@fungi.computer/oyster 0.0.0-stage → 0.1.0

package/dist/build/local-build.js

@@ -0,0 +1,1128 @@
+import { Buffer } from "node:buffer";
+import { appBackendPackageMainFields, createDefinitionEmission, } from "./definition-emission.js";
+function logEvent(operation, cause) {
+    console.error(JSON.stringify({
+        source: "app-publisher",
+        operation,
+        failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+    }));
+}
+import { frozenSnapshotInstallArguments, packageScriptArguments, } from "./snapshot-package-store.js";
+import { isInsideSnapshot } from "./snapshot-programs/snapshot-path.js";
+import { writeImmutableArtifact, } from "./artifact-writer.js";
+import { assetPathSchema, } from "@fungi.computer/puffball/assets";
+import { resolveWorkspaceBuild, workspaceProjectsArguments, } from "./workspace-build.js";
+import { readBundledHtml } from "./bundled-html.js";
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { createReadStream, mkdtempSync, realpathSync } from "node:fs";
+import { access, cp, lstat, mkdir, readdir, readFile, rm, writeFile, } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep, } from "node:path";
+import { pipeline } from "node:stream/promises";
+import { setTimeout as delay } from "node:timers/promises";
+import { parseArtifactRef, parseSha256Digest, parseSourceRevision, } from "@fungi.computer/puffball";
+import { appIdSchema } from "@fungi.computer/puffball/effect";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import * as esbuild from "esbuild";
+import { readWantedLockfile, writeWantedLockfile } from "@pnpm/lockfile.fs";
+import { pruneSharedLockfile } from "@pnpm/lockfile.pruner";
+import { AppPublisherError, appBackendExportConditions, createAppPublisher, pinnedRecipeSchema, pinsCurrentToolchain, } from "./effect.js";
+import { artifactsGitEnvironment, repositoryEnvironment, } from "./git-environment.js";
+const localConfigSchema = Schema.Struct({
+    appId: appIdSchema,
+    source: Schema.Struct({
+        repositoryPath: Schema.String.pipe(Schema.check(Schema.isMinLength(1))),
+    }),
+    recipe: pinnedRecipeSchema,
+    artifactRoot: Schema.String.pipe(Schema.check(Schema.isMinLength(1))),
+});
+const ACCEPTED_BRANCH = "main";
+function localRepositoryPath(input) {
+    if (isAbsolute(input) && !input.startsWith("//"))
+        return input;
+    throw new AppPublisherError("configuration");
+}
+async function sha256File(path, signal) {
+    const hash = createHash("sha256");
+    await pipeline(createReadStream(path), hash, { signal });
+    return parseSha256Digest(`sha256:${hash.digest("hex")}`);
+}
+function runGit(args, cwd, signal, environment = repositoryEnvironment()) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("git", [...args], {
+            cwd,
+            env: environment,
+            shell: false,
+            signal,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const stdout = [];
+        const stderr = [];
+        let spawnError;
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.once("error", (error) => {
+            spawnError = error;
+        });
+        child.once("close", (code, terminationSignal) => {
+            if (code === 0 && spawnError === undefined) {
+                resolve(Buffer.concat(stdout));
+                return;
+            }
+            const detail = Buffer.concat(stderr).toString("utf8").trim();
+            reject(spawnError ??
+                new Error(detail.length > 0
+                    ? `git exited unsuccessfully: ${detail}`
+                    : `git exited unsuccessfully (${String(code)} ${String(terminationSignal)})`));
+        });
+    });
+}
+function extractTar(archivePath, destination, signal) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("tar", [
+            "--extract",
+            "--file",
+            archivePath,
+            "--directory",
+            destination,
+            "--no-same-owner",
+        ], { shell: false, signal, stdio: ["ignore", "ignore", "pipe"] });
+        const stderr = [];
+        let spawnError;
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.once("error", (error) => {
+            spawnError = error;
+        });
+        child.once("close", (code, terminationSignal) => {
+            if (code === 0 && spawnError === undefined) {
+                resolve();
+                return;
+            }
+            const detail = Buffer.concat(stderr).toString("utf8").trim();
+            reject(spawnError ??
+                new Error(detail.length > 0
+                    ? `tar exited unsuccessfully: ${detail}`
+                    : `tar exited unsuccessfully (${String(code)} ${String(terminationSignal)})`));
+        });
+    });
+}
+async function rejectSymbolicLinks(snapshotPath, signal) {
+    const directories = [snapshotPath];
+    while (directories.length > 0) {
+        signal.throwIfAborted();
+        const directory = directories.pop();
+        if (directory === undefined)
+            continue;
+        const entries = await readdir(directory, { withFileTypes: true });
+        for (const entry of entries) {
+            const path = join(directory, entry.name);
+            const stats = await lstat(path);
+            if (entry.isSymbolicLink() || stats.isSymbolicLink()) {
+                throw new Error("Symbolic links are not accepted in source snapshots");
+            }
+            if (stats.isDirectory())
+                directories.push(path);
+        }
+    }
+}
+async function captureGitSnapshot(workdir, repositoryPath, reference, expectedRevision, signal, fetchEnvironment = repositoryEnvironment()) {
+    const snapshotPath = join(workdir, "snapshot");
+    const archivePath = join(workdir, "snapshot.tar");
+    await mkdir(snapshotPath);
+    await runGit(["init", "--quiet"], workdir, signal);
+    await runGit([
+        "fetch",
+        "--quiet",
+        "--no-tags",
+        "--depth=1",
+        "--",
+        repositoryPath,
+        reference,
+    ], workdir, signal, fetchEnvironment);
+    const sourceRevision = parseSourceRevision(`git:${Buffer.from(await runGit(["rev-parse", "--verify", "FETCH_HEAD^{commit}"], workdir, signal))
+        .toString("utf8")
+        .trim()}`);
+    if (expectedRevision !== undefined && sourceRevision !== expectedRevision)
+        throw new Error("Captured Git commit differs from requested source revision");
+    await runGit([
+        "archive",
+        "--format=tar",
+        // Git's @0 date spelling means "now" in the maintained local Git
+        // version; this equivalent absolute spelling keeps the tar bytes fixed.
+        "--mtime=1970-01-01T00:00:00Z",
+        "--output",
+        archivePath,
+        "FETCH_HEAD^{tree}",
+    ], workdir, signal);
+    const sourceTreeDigest = await sha256File(archivePath, signal);
+    await extractTar(archivePath, snapshotPath, signal);
+    await rejectSymbolicLinks(snapshotPath, signal);
+    return Object.freeze({
+        sourceRevision,
+        sourceTreeDigest,
+        snapshotPath,
+    });
+}
+async function captureCommit(workdir, repositoryPath, sourceRevision, signal) {
+    const commit = sourceRevision.slice("git:".length);
+    return captureGitSnapshot(workdir, repositoryPath, commit, sourceRevision, signal);
+}
+function scopedSourceCapture(capture, failureMessage) {
+    return {
+        capture: () => Effect.acquireRelease(Effect.sync(() => mkdtempSync(join(tmpdir(), "app-publisher-"))), (workdir) => Effect.tryPromise({
+            try: () => rm(workdir, { recursive: true, force: true }),
+            catch: () => new Error("Local source cleanup failed"),
+        }).pipe(Effect.catch((cause) => {
+            logEvent("services/app-publisher/src/local.ts:289", cause);
+            return Effect.void;
+        }))).pipe(Effect.flatMap((workdir) => Effect.tryPromise({
+            try: (signal) => capture(workdir, signal),
+            catch: () => new Error(failureMessage),
+        }))),
+    };
+}
+function artifactsFetchEnvironment(token) {
+    if (token.length === 0 || /[\r\n]/.test(token))
+        throw new AppPublisherError("configuration");
+    // Keep credentials in the Git environment, never argv or the remote URL.
+    return artifactsGitEnvironment(token);
+}
+/** Local proving adapter; accepted source policy is intentionally fixed to main. */
+export function createLocalSourceCapture(repositoryPath) {
+    const localPath = localRepositoryPath(repositoryPath);
+    return scopedSourceCapture((workdir, signal) => captureGitSnapshot(workdir, localPath, `refs/heads/${ACCEPTED_BRANCH}`, undefined, signal), "Local Git source capture failed");
+}
+/** Capture saved App files for local authoring without modifying the customer's
+ * repository. Provenance names the exact temporary Git snapshot, not an existing
+ * customer commit. Dependencies and local credentials are not source inputs.
+ */
+export function createLocalDirectorySourceCapture(directory) {
+    const sourceDirectory = resolve(directory);
+    const excluded = new Set([
+        ".git",
+        "node_modules",
+        ".botanical",
+        ".wrangler",
+        "dist",
+        ".npmrc",
+    ]);
+    return scopedSourceCapture(async (workdir, signal) => {
+        const repository = join(workdir, "working");
+        await cp(sourceDirectory, repository, {
+            recursive: true,
+            filter: (path) => {
+                const parts = relative(sourceDirectory, path).split(sep);
+                return !parts.some((part) => excluded.has(part) ||
+                    part.startsWith(".env") ||
+                    part.startsWith(".dev.vars"));
+            },
+        });
+        await rejectSymbolicLinks(repository, signal);
+        const environment = {
+            ...repositoryEnvironment(),
+            GIT_CONFIG_GLOBAL: "/dev/null",
+            GIT_CONFIG_NOSYSTEM: "1",
+            GIT_AUTHOR_DATE: "1970-01-01T00:00:00Z",
+            GIT_COMMITTER_DATE: "1970-01-01T00:00:00Z",
+        };
+        await runGit(["init", "--quiet"], repository, signal, environment);
+        await runGit(["add", "."], repository, signal, environment);
+        await runGit([
+            "-c",
+            "user.name=Fungi App builder",
+            "-c",
+            "user.email=app-builder@localhost",
+            "commit",
+            "--quiet",
+            "-m",
+            "Capture local App source",
+        ], repository, signal, environment);
+        return captureGitSnapshot(workdir, repository, "HEAD", undefined, signal, environment);
+    }, "Local App source capture failed");
+}
+/** Capture an exact Artifacts commit through a trusted host's credential-free Git URL. */
+export function createArtifactsSourceCapture(options) {
+    let remote;
+    let revision;
+    let fetchEnvironment;
+    try {
+        remote = new URL(options.remote);
+        const localHttp = remote.protocol === "http:" &&
+            (remote.hostname === "localhost" || remote.hostname === "127.0.0.1");
+        if ((remote.protocol !== "https:" && !localHttp) ||
+            remote.username ||
+            remote.password ||
+            remote.search ||
+            remote.hash)
+            throw new Error("Invalid Artifacts remote");
+        revision = parseSourceRevision(options.sourceRevision);
+        fetchEnvironment = artifactsFetchEnvironment(options.token);
+    }
+    catch {
+        throw new AppPublisherError("configuration");
+    }
+    return scopedSourceCapture((workdir, signal) => captureGitSnapshot(workdir, remote.toString(), revision.slice("git:".length), revision, signal, fetchEnvironment), "Artifacts Git source capture failed");
+}
+/** Capture one explicit committed revision without manufacturing a branch. */
+export function createLocalCommitSourceCapture(repositoryPath, sourceRevision) {
+    const localPath = localRepositoryPath(repositoryPath);
+    const revision = parseSourceRevision(sourceRevision);
+    return scopedSourceCapture((workdir, signal) => captureCommit(workdir, localPath, revision, signal), "Local Git source capture failed");
+}
+const workspacePackageSchema = Schema.Struct({
+    name: Schema.String.pipe(Schema.check(Schema.isMinLength(1))),
+    path: Schema.String.pipe(Schema.check(Schema.isMinLength(1))),
+});
+/** Hydrate the App workspace and its runtime workspace dependency closure. */
+function productionWorkspaceSelectors(build) {
+    return ["--filter-prod", `${build.packageName}...`];
+}
+/** Derive the App's page build from the captured tree's own manifests. */
+function capturedWorkspaceBuild(snapshot, entry, run) {
+    return Effect.flatMap(run(workspaceProjectsArguments), (projects) => Effect.tryPromise({
+        try: () => resolveWorkspaceBuild({ root: snapshot, entry, projects }),
+        catch: (error) => error,
+    }));
+}
+const sourceDistributionRootFiles = [
+    ".npmrc",
+    "package.json",
+    "pnpm-lock.yaml",
+    "pnpm-workspace.yaml",
+    "tsconfig.json",
+    "tsconfig.build.json",
+];
+/**
+ * Keep only the pinned dependency graph the editable template's included
+ * workspaces actually resolve. pnpm-lock.yaml tracks every workspace member
+ * in the repository; copying it whole makes every captured App's upload grow
+ * with dependency churn anywhere in the monorepo, including unrelated Apps,
+ * packages and docs tooling outside this App's build. `isIncludedPath`
+ * reports whether a workspace importer path (its `package.json` directory)
+ * is among the files already selected for this distribution.
+ *
+ * The read, the importer-closure graph walk and the write are pnpm's own
+ * maintained lockfile packages (`@pnpm/lockfile.fs`, `@pnpm/lockfile.pruner`),
+ * not a hand-rolled parse of pnpm's lockfile grammar. Only the choice of
+ * which importers to keep is this distribution's own decision.
+ */
+async function prunePnpmLockfile(snapshotPath, isIncludedPath) {
+    const lockfile = await readWantedLockfile(snapshotPath, {
+        ignoreIncompatible: false,
+    });
+    if (lockfile === null)
+        throw new Error("Source distribution is missing its pnpm-lock.yaml");
+    const importers = Object.fromEntries(Object.entries(lockfile.importers).filter(([path]) => path === "." || isIncludedPath(path)));
+    const pruned = pruneSharedLockfile({ ...lockfile, importers }, {
+        warn: (message) => {
+            throw new Error(`pnpm-lock.yaml pruning hit an unresolved dependency: ${message}`);
+        },
+    });
+    const scratch = mkdtempSync(join(tmpdir(), "oyster-lockfile-prune-"));
+    try {
+        await writeWantedLockfile(scratch, pruned);
+        return await readFile(join(scratch, "pnpm-lock.yaml"));
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+}
+/** The provenance file every distribution records beside the App source. */
+function provenanceFile(appId, source) {
+    return {
+        path: "botanical-app-source.json",
+        contents: new TextEncoder().encode(JSON.stringify({
+            appId,
+            sourceRevision: source.sourceRevision,
+            sourceTreeDigest: source.sourceTreeDigest,
+        }, null, 2) + "\n"),
+    };
+}
+/** Builder state a source listing writes into the snapshot, never source. */
+const snapshotScratch = new Set([".publisher-source-home", "node_modules"]);
+/**
+ * An App repository's distribution: every captured file, unchanged, plus its
+ * provenance. The repository's own pnpm lockfile pins its registry packages.
+ */
+function repositoryAppSourceDistribution(appId, source) {
+    return Effect.tryPromise({
+        try: async () => {
+            const snapshot = realpathSync(resolve(source.snapshotPath));
+            const collected = new Map();
+            const collect = async (relativePath) => {
+                const sourcePath = join(snapshot, relativePath);
+                const stats = await lstat(sourcePath);
+                if (stats.isSymbolicLink())
+                    throw new Error("Source distribution cannot contain symbolic links");
+                if (stats.isFile()) {
+                    collected.set(relativePath, await readFile(sourcePath));
+                    return;
+                }
+                if (!stats.isDirectory())
+                    throw new Error("Source distribution contains a non-file entry");
+                const entries = await readdir(sourcePath, { withFileTypes: true });
+                entries.sort((left, right) => left.name.localeCompare(right.name));
+                for (const entry of entries)
+                    if (relativePath !== "" || !snapshotScratch.has(entry.name))
+                        await collect(join(relativePath, entry.name));
+            };
+            await collect("");
+            const provenance = provenanceFile(appId, source);
+            if (collected.has(provenance.path))
+                throw new Error("Source distribution reserves its provenance path");
+            collected.set(provenance.path, provenance.contents);
+            return Object.freeze({
+                appId,
+                sourceRevision: source.sourceRevision,
+                sourceTreeDigest: source.sourceTreeDigest,
+                appDirectory: "",
+                files: [...collected]
+                    .sort(([left], [right]) => left.localeCompare(right))
+                    .map(([path, contents]) => Object.freeze({ path, contents })),
+            });
+        },
+        catch: (error) => error,
+    });
+}
+/**
+ * Project one pinned first-party App and its pnpm workspace dependency graph
+ * without changing upstream files or manufacturing Git history. The caller
+ * records the returned provenance on the Artifacts template seed commit.
+ */
+export function createFirstPartyAppSourceDistribution(options) {
+    const appId = Schema.decodeUnknownSync(appIdSchema)(options.appId);
+    if (!options.entry.endsWith(".html"))
+        return Effect.fail(new AppPublisherError("configuration"));
+    const snapshot = realpathSync(resolve(options.source.snapshotPath));
+    const env = {
+        PATH: process.env.PATH ?? "/usr/bin:/bin",
+        HOME: join(snapshot, ".publisher-source-home"),
+        NODE_ENV: "production",
+        npm_config_userconfig: "/dev/null",
+        npm_config_globalconfig: "/dev/null",
+    };
+    return Effect.gen(function* () {
+        const recipe = yield* capturedWorkspaceBuild(snapshot, options.entry, (args) => runHtmlCommand(args, snapshot, env));
+        const appDirectory = recipe.directory;
+        // An App's own repository is the App at its root: its editable template
+        // is that repository's whole captured tree, as forking it would copy.
+        if (appDirectory === "")
+            return yield* repositoryAppSourceDistribution(appId, options.source);
+        const listed = yield* runHtmlCommand([
+            ...productionWorkspaceSelectors(recipe),
+            "list",
+            "--depth",
+            "-1",
+            "--prod",
+            "--json",
+        ], snapshot, env);
+        const workspaces = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Array(workspacePackageSchema)))(listed);
+        const selectedApp = workspaces.filter((workspace) => workspace.name === recipe.packageName);
+        const selectedAppWorkspace = selectedApp[0];
+        if (selectedApp.length !== 1 ||
+            !selectedAppWorkspace ||
+            realpathSync(selectedAppWorkspace.path) !==
+                realpathSync(resolve(snapshot, recipe.directory)))
+            return yield* Effect.fail(new AppPublisherError("source"));
+        const selectedPaths = new Set();
+        const packageNames = new Set();
+        for (const workspace of workspaces) {
+            if (packageNames.has(workspace.name))
+                return yield* Effect.fail(new AppPublisherError("source"));
+            packageNames.add(workspace.name);
+            const path = resolve(workspace.path);
+            const relativePath = relative(snapshot, path);
+            if (relativePath === "" ||
+                relativePath === ".." ||
+                relativePath.startsWith(`..${sep}`) ||
+                isAbsolute(relativePath) ||
+                (!relativePath.startsWith("apps/") &&
+                    !relativePath.startsWith("forks/") &&
+                    !relativePath.startsWith("packages/") &&
+                    !relativePath.startsWith("runtimes/")))
+                return yield* Effect.fail(new AppPublisherError("source"));
+            selectedPaths.add(relativePath);
+        }
+        const files = yield* Effect.tryPromise({
+            try: async () => {
+                const collected = new Map();
+                const collect = async (relativePath) => {
+                    const sourcePath = join(snapshot, relativePath);
+                    const stats = await lstat(sourcePath);
+                    if (stats.isSymbolicLink())
+                        throw new Error("Source distribution cannot contain symbolic links");
+                    if (stats.isFile()) {
+                        collected.set(relativePath, await readFile(sourcePath));
+                        return;
+                    }
+                    if (!stats.isDirectory())
+                        throw new Error("Source distribution contains a non-file entry");
+                    const entries = await readdir(sourcePath, { withFileTypes: true });
+                    entries.sort((left, right) => left.name.localeCompare(right.name));
+                    for (const entry of entries) {
+                        // Design workbenches are outside the editable production build.
+                        if (selectedPaths.has(relativePath) &&
+                            entry.name === "workbench" &&
+                            entry.isDirectory())
+                            continue;
+                        // A dependency's own tests are not App build inputs; the App keeps its tests.
+                        if (selectedPaths.has(relativePath) &&
+                            relativePath !== appDirectory &&
+                            entry.name === "test" &&
+                            entry.isDirectory())
+                            continue;
+                        // Generated API docs and documentation media are not App build inputs.
+                        if (relativePath.startsWith("packages/") &&
+                            basename(relativePath) === "docs" &&
+                            selectedPaths.has(dirname(relativePath)) &&
+                            (entry.name === "media" || entry.name === "api") &&
+                            entry.isDirectory())
+                            continue;
+                        await collect(join(relativePath, entry.name));
+                    }
+                };
+                for (const relativePath of [...selectedPaths].sort())
+                    await collect(relativePath);
+                for (const relativePath of sourceDistributionRootFiles)
+                    await collect(relativePath);
+                await collect("patches");
+                if (collected.has("pnpm-lock.yaml"))
+                    collected.set("pnpm-lock.yaml", await prunePnpmLockfile(snapshot, (importerPath) => collected.has(join(importerPath, "package.json"))));
+                const provenance = provenanceFile(appId, options.source);
+                if (collected.has(provenance.path))
+                    throw new Error("Source distribution reserves its provenance path");
+                collected.set(provenance.path, provenance.contents);
+                return [...collected]
+                    .sort(([left], [right]) => left.localeCompare(right))
+                    .map(([path, contents]) => Object.freeze({ path, contents }));
+            },
+            catch: (error) => error,
+        });
+        return Object.freeze({
+            appId,
+            sourceRevision: options.source.sourceRevision,
+            sourceTreeDigest: options.source.sourceTreeDigest,
+            appDirectory,
+            files,
+        });
+    });
+}
+function htmlGroupExists(child) {
+    if (child.pid === undefined)
+        return false;
+    try {
+        process.kill(-child.pid, 0);
+        return true;
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ESRCH")
+            return false;
+        throw error;
+    }
+}
+// Narrow adaptation of Caps' workbench-process process-group teardown. The
+// Effect finalizer waits for cleanup before the source snapshot can be removed.
+async function stopHtmlGroup(child) {
+    if (!htmlGroupExists(child))
+        return;
+    const deadline = Date.now() + 5_000;
+    for (const [signal, until] of [
+        ["SIGTERM", deadline - 1_000],
+        ["SIGKILL", deadline],
+    ]) {
+        try {
+            if (child.pid !== undefined)
+                process.kill(-child.pid, signal);
+        }
+        catch (error) {
+            if (!(error instanceof Error &&
+                "code" in error &&
+                error.code === "ESRCH"))
+                throw error;
+        }
+        while (htmlGroupExists(child) && Date.now() < until)
+            await delay(25);
+        if (!htmlGroupExists(child))
+            return;
+    }
+    throw new Error("HTML process group survived its five-second cleanup bound");
+}
+function runHtmlCommand(args, cwd, env, command = "pnpm") {
+    return Effect.acquireUseRelease(Effect.sync(() => {
+        if (process.platform === "win32")
+            throw new Error("HTML builds require POSIX process groups");
+        const child = spawn(command, [...args], {
+            cwd,
+            env,
+            detached: true,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const completion = new Promise((resolveResult, reject) => {
+            let stdout = "";
+            let stderr = "";
+            child.stdout.on("data", (chunk) => {
+                stdout += chunk.toString();
+                if (Buffer.byteLength(stdout) > 1024 * 1024)
+                    reject(new Error("HTML command output exceeded its bound"));
+            });
+            child.stderr.on("data", (chunk) => {
+                stderr += chunk.toString();
+                if (Buffer.byteLength(stderr) > 1024 * 1024)
+                    reject(new Error("HTML command diagnostics exceeded their bound"));
+            });
+            child.once("error", reject);
+            child.once("close", (code) => {
+                if (code === 0)
+                    resolveResult(stdout);
+                else
+                    reject(new Error(stderr || stdout || `HTML command exited ${String(code)}`));
+            });
+        });
+        return { child, completion };
+    }), ({ completion }) => Effect.tryPromise({ try: () => completion, catch: (error) => error }), ({ child }) => Effect.promise(() => stopHtmlGroup(child)));
+}
+/** Load the bundled snapshot programs only when a snapshot build writes them,
+ * so source-level importers of this module do not need the package build. */
+function snapshotPrograms() {
+    return import("#snapshot-program-scripts");
+}
+/** Compiler heap ceiling: fits a 12 GiB Computer with two builds at once. */
+const snapshotBuildHeapMegabytes = 4096;
+function snapshotBuildEnvironment(sourceSnapshotPath) {
+    // PATH locates pinned executables; the Computer's CA files authenticate
+    // its egress gateway. Credentials and package-manager settings stay out.
+    // V8 sizes its default heap from the machine, about 3 GB in a 12 GiB
+    // standard-4 Computer, where compiling Bonsai runs out; the build owns one
+    // fixed ceiling instead.
+    const env = {
+        PATH: process.env.PATH ?? "/usr/bin:/bin",
+        HOME: join(sourceSnapshotPath, ".publisher-home"),
+        NODE_ENV: "production",
+        NODE_OPTIONS: `--max-old-space-size=${String(snapshotBuildHeapMegabytes)}`,
+        NODE_EXTRA_CA_CERTS: process.env.NODE_EXTRA_CA_CERTS,
+        SSL_CERT_FILE: process.env.SSL_CERT_FILE,
+        npm_config_userconfig: "/dev/null",
+        npm_config_globalconfig: "/dev/null",
+    };
+    return env;
+}
+function rebuildViteSnapshot(sourceSnapshotPath, recipe, options) {
+    if (recipe.kind === "source-html")
+        return rebuildNpmSnapshot(sourceSnapshotPath, recipe);
+    return Effect.gen(function* () {
+        const env = snapshotBuildEnvironment(sourceSnapshotPath);
+        const run = (args, cwd = sourceSnapshotPath) => runHtmlCommand(args, cwd, env);
+        if ((yield* run(["--version"])).trim() !== "11.24.0") {
+            return yield* Effect.fail(new Error("Publisher requires pnpm 11.24.0"));
+        }
+        const html = yield* capturedWorkspaceBuild(sourceSnapshotPath, recipe.entry, run);
+        yield* Effect.tryPromise({
+            try: () => checkPinnedWorkspaceToolchain(sourceSnapshotPath, html, recipe),
+            catch: (error) => error,
+        });
+        if (options.packageScripts !== "run" &&
+            html.steps.some((step) => step.kind === "script"))
+            return yield* Effect.fail(new Error("This source builds a dependency with its package script, which only a Computer build runs"));
+        const installStarted = performance.now();
+        yield* run([
+            ...productionWorkspaceSelectors(html),
+            ...frozenSnapshotInstallArguments(options.packageStoreDirectory),
+        ]);
+        const buildStarted = performance.now();
+        options.onPhase?.("install", buildStarted - installStarted);
+        const appDirectory = join(sourceSnapshotPath, html.directory);
+        const dependencies = join(appDirectory, ".publisher-dependencies.mjs");
+        const program = join(appDirectory, ".publisher-build.mjs");
+        yield* Effect.tryPromise({
+            try: async () => {
+                const { dependencyBuildProgram, htmlBuildProgram } = await snapshotPrograms();
+                await writeFile(dependencies, dependencyBuildProgram, { flag: "wx" });
+                await writeFile(program, htmlBuildProgram, { flag: "wx" });
+            },
+            catch: (error) => error,
+        });
+        // Keep the derived order and every diagnostic/emit check. Consecutive
+        // projects share one warmed compiler; stylesheet steps stay separate.
+        const groups = [];
+        for (const step of html.steps) {
+            const last = groups.at(-1);
+            if (step.kind === "typescript" &&
+                last?.every((member) => member.kind === "typescript"))
+                last.push(step);
+            else
+                groups.push([step]);
+        }
+        for (const group of groups) {
+            const [step] = group;
+            if (step?.kind === "script") {
+                // Exactly the named script, in its own package: no pre/post hooks or
+                // implicit install, whatever the captured repository's pnpm settings
+                // ask for. The script is arbitrary package code: its isolation is the
+                // admitted Computer, not this builder's compiler path checks.
+                const directory = resolve(sourceSnapshotPath, step.directory);
+                if (!isInsideSnapshot(sourceSnapshotPath, directory))
+                    return yield* Effect.fail(new Error("Package script directory escapes the captured source"));
+                yield* run([...packageScriptArguments, step.script], directory);
+                continue;
+            }
+            yield* run([
+                // The frozen install above is the only install, whatever the
+                // captured pnpm settings ask `exec` to verify first.
+                "--config.verify-deps-before-run=false",
+                "exec",
+                "node",
+                dependencies,
+                sourceSnapshotPath,
+                html.directory,
+                recipe.format,
+                JSON.stringify(group),
+                tailwindToolchainDirectory(html),
+            ], appDirectory);
+        }
+        yield* run([
+            "--config.verify-deps-before-run=false",
+            "exec",
+            "node",
+            program,
+            sourceSnapshotPath,
+            String(recipe.maxOutputBytes),
+            html.directory,
+            recipe.format,
+            recipe.assetBase ?? "/",
+            dirname(recipe.entry),
+            String(html.react),
+            html.shellEntry ?? "",
+        ], appDirectory);
+        options.onPhase?.("build", performance.now() - buildStarted);
+        return yield* readHtmlBuildOutput(sourceSnapshotPath, recipe);
+    });
+}
+/**
+ * Where the captured Tailwind compiler lives: Caps, when the App builds Caps
+ * from its workspace, or else the App itself, which then pins the compiler
+ * and installs Caps' built stylesheet from a registry.
+ */
+function tailwindToolchainDirectory(html) {
+    return html.dependencies.includes("packages/caps")
+        ? "packages/caps"
+        : html.directory;
+}
+const pinnedVersionsSchema = Schema.Record(Schema.String, Schema.String);
+const pinnedManifestSchema = Schema.fromJsonString(Schema.Struct({
+    dependencies: Schema.optional(pinnedVersionsSchema),
+    devDependencies: Schema.optional(pinnedVersionsSchema),
+}));
+/**
+ * Refuse a captured tree whose declared toolchain differs from the pinned
+ * one before any of its dependencies hydrate.
+ */
+async function checkPinnedWorkspaceToolchain(sourceSnapshotPath, html, recipe) {
+    const manifest = async (directory) => Schema.decodeUnknownSync(pinnedManifestSchema)(await readFile(join(sourceSnapshotPath, directory, "package.json"), "utf8"));
+    const pinned = (directory, versions, name, version) => {
+        if (versions?.[name] !== version)
+            throw new Error(`${directory} must pin ${name} ${version}`);
+    };
+    const root = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Struct({
+        packageManager: Schema.Literal("pnpm@11.24.0"),
+        devDependencies: Schema.Struct({
+            typescript: Schema.Literal("5.9.3"),
+        }),
+    })));
+    root(await readFile(join(sourceSnapshotPath, "package.json"), "utf8"));
+    const app = await manifest(html.directory);
+    pinned(html.directory, app.devDependencies, "vite", "8.2.2");
+    if (html.react) {
+        pinned(html.directory, app.dependencies, "react-dom", "18.3.1");
+        pinned(html.directory, app.devDependencies, "@vitejs/plugin-react", "6.1.1");
+        pinned(html.directory, app.dependencies?.react === undefined
+            ? app.devDependencies
+            : app.dependencies, "react", "18.3.1");
+    }
+    if (recipe.format === "html")
+        pinned(html.directory, app.devDependencies, "vite-plugin-singlefile", "2.3.3");
+    const stylesheets = html.steps.filter((step) => step.kind === "tailwind");
+    if (stylesheets.length === 0)
+        return;
+    // The captured Tailwind compiler and its typography plugin come from Caps.
+    // An App that installs Caps from a registry pins the compiler itself, and
+    // Caps' own dependencies bring the typography plugin its stylesheet uses.
+    const toolchain = tailwindToolchainDirectory(html);
+    const compiler = await manifest(toolchain);
+    pinned(toolchain, compiler.devDependencies, "@tailwindcss/cli", "4.2.1");
+    if (toolchain === "packages/caps")
+        pinned(toolchain, compiler.dependencies, "@tailwindcss/typography", "0.5.19");
+    for (const directory of html.dependencies) {
+        if (!stylesheets.some((step) => step.input.startsWith(`${directory}/`)))
+            continue;
+        const owner = await manifest(directory);
+        for (const versions of [owner.dependencies, owner.devDependencies])
+            if (versions?.["@tailwindcss/typography"] !== undefined)
+                pinned(directory, versions, "@tailwindcss/typography", "0.5.19");
+    }
+}
+function readHtmlBuildOutput(sourceSnapshotPath, recipe) {
+    return Effect.gen(function* () {
+        if (recipe.assets) {
+            const policy = recipe.assets;
+            const base = recipe.assetBase;
+            if (base === undefined)
+                return yield* Effect.fail(new Error("Asset recipe requires its captured base"));
+            return yield* Effect.tryPromise(async () => {
+                const root = join(sourceSnapshotPath, ".publisher-output");
+                const files = await readdir(root, {
+                    recursive: true,
+                    withFileTypes: true,
+                });
+                const assets = [];
+                let total = 0;
+                for (const file of files) {
+                    if (file.isDirectory())
+                        continue;
+                    if (!file.isFile() || assets.length >= policy.maxObjects)
+                        throw new Error("Invalid or excessive build outputs");
+                    const filename = join(file.parentPath, file.name);
+                    const path = Schema.decodeUnknownSync(assetPathSchema)("/" + relative(root, filename).split(sep).join("/"));
+                    const stat = await lstat(filename);
+                    total += stat.size;
+                    if (stat.size > policy.maxObjectBytes ||
+                        !Number.isSafeInteger(total) ||
+                        total > policy.maxTotalBytes)
+                        throw new Error("Split output exceeds asset policy");
+                    const bytes = await readFile(filename);
+                    if (bytes.byteLength !== stat.size)
+                        throw new Error("Build output changed during capture");
+                    assets.push({ path, bytes });
+                }
+                return { kind: "assets", base, assets };
+            });
+        }
+        const bytes = yield* Effect.tryPromise({
+            try: (signal) => readFile(join(sourceSnapshotPath, ".publisher.html"), { signal }),
+            catch: (error) => error,
+        });
+        return Object.freeze({ kind: "bytes", bytes });
+    });
+}
+function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
+    return Effect.gen(function* () {
+        const env = snapshotBuildEnvironment(sourceSnapshotPath);
+        const home = join(sourceSnapshotPath, ".publisher-home");
+        const userConfig = join(home, "user.npmrc");
+        const globalConfig = join(home, "global.npmrc");
+        env.npm_config_userconfig = userConfig;
+        env.npm_config_globalconfig = globalConfig;
+        yield* Effect.tryPromise(async () => {
+            await mkdir(home, { recursive: true });
+            await writeFile(userConfig, "", { flag: "wx" });
+            await writeFile(globalConfig, "", { flag: "wx" });
+        });
+        if ((yield* runHtmlCommand(["--version"], sourceSnapshotPath, env, "npm")).trim() !== recipe.toolchain.npm)
+            return yield* Effect.fail(new Error("Captured npm version differs from the recipe"));
+        yield* runHtmlCommand(["ci", "--include=dev", "--ignore-scripts", "--no-audit", "--no-fund"], sourceSnapshotPath, env, "npm");
+        const program = join(sourceSnapshotPath, ".publisher-build.mjs");
+        yield* Effect.tryPromise(async () => {
+            const { htmlBuildProgram } = await snapshotPrograms();
+            await writeFile(program, htmlBuildProgram, { flag: "wx" });
+        });
+        yield* runHtmlCommand([
+            program,
+            sourceSnapshotPath,
+            String(recipe.maxOutputBytes),
+            ".",
+            recipe.format,
+            recipe.assetBase ?? "./",
+            dirname(recipe.entry),
+            "true",
+            "",
+        ], sourceSnapshotPath, env, "node");
+        return yield* readHtmlBuildOutput(sourceSnapshotPath, recipe);
+    });
+}
+async function rebuildSnapshot(context, recipe, signal, sourceSnapshotPath, emission) {
+    signal.throwIfAborted();
+    const result = await new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (operation) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener("abort", onAbort);
+            operation();
+        };
+        const rejectWithError = () => {
+            reject(new Error("Local snapshot build was interrupted"));
+        };
+        const onAbort = () => {
+            void context.cancel().then(() => {
+                finish(() => {
+                    rejectWithError();
+                });
+            }, () => {
+                finish(() => {
+                    reject(new Error("Local snapshot build cancellation failed"));
+                });
+            });
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        context.rebuild().then((value) => {
+            finish(() => {
+                resolve(value);
+            });
+        }, (cause) => {
+            finish(() => {
+                reject(cause instanceof Error
+                    ? cause
+                    : new Error("Local snapshot rebuild failed", { cause }));
+            });
+        });
+        if (signal.aborted)
+            onAbort();
+    });
+    if (result.metafile === undefined) {
+        throw new Error("Local snapshot build did not return its requested metafile");
+    }
+    const escapedInput = Object.keys(result.metafile.inputs).find((input) => {
+        const path = resolve(sourceSnapshotPath, input);
+        const fromSnapshot = relative(sourceSnapshotPath, path);
+        return (fromSnapshot === ".." ||
+            fromSnapshot.startsWith(`..${sep}`) ||
+            isAbsolute(fromSnapshot));
+    });
+    if (escapedInput !== undefined) {
+        throw new Error("Local snapshot build resolved an input outside the captured snapshot");
+    }
+    const output = emission.worker(result).file;
+    if (output.contents.byteLength > recipe.maxOutputBytes) {
+        throw new Error("Local build output exceeded its pinned bound");
+    }
+    return Object.freeze({
+        kind: "bytes",
+        bytes: output.contents.slice(),
+    });
+}
+/** Exact pinned esbuild options shared by local builds and artifact-budget proofs. */
+export function localSnapshotBuildOptions(source, recipe, emission) {
+    const options = {
+        absWorkingDir: source.snapshotPath,
+        bundle: true,
+        minify: recipe.backend !== null,
+        entryPoints: emission.entryPoints(`./${recipe.entry}`),
+        outdir: emission.outdir,
+        format: "esm",
+        platform: recipe.platform,
+        external: recipe.backend === null ? [] : ["cloudflare:workers"],
+        target: ["es2022"],
+        write: false,
+        metafile: true,
+        plugins: [...emission.plugins],
+    };
+    if (recipe.backend !== null) {
+        const mainFields = appBackendPackageMainFields(recipe);
+        if (mainFields !== undefined)
+            options.mainFields = mainFields;
+        options.conditions = [...appBackendExportConditions];
+        options.tsconfigRaw = {};
+    }
+    return options;
+}
+/** Local proving adapter; it builds only the captured extracted snapshot. */
+export function createLocalBuildExecutor(options = {}) {
+    const emissions = new WeakMap();
+    const compiler = {
+        build: (source, recipe) => {
+            if (recipe.kind === "bundled-html" && recipe.backend === null)
+                return Effect.tryPromise({
+                    try: () => readBundledHtml(source.snapshotPath, recipe),
+                    catch: () => new Error("Captured HTML bundle failed validation"),
+                });
+            if (recipe.format !== "esm" && recipe.backend !== null) {
+                const backend = recipe.backend;
+                const entry = backend.entry;
+                if (entry === undefined)
+                    return Effect.fail(new Error("Joined App requires a backend entry"));
+                return Effect.gen(function* () {
+                    // Build both facets from the same captured tree. The UI build hydrates
+                    // that tree's pinned dependencies before the backend resolves them.
+                    if (recipe.kind === "bundled-html") {
+                        const hasLockfile = yield* Effect.tryPromise(() => access(join(source.snapshotPath, "pnpm-lock.yaml")).then(() => true, (error) => {
+                            if (error instanceof Error &&
+                                "code" in error &&
+                                error.code === "ENOENT")
+                                return false;
+                            throw error;
+                        }));
+                        if (hasLockfile) {
+                            yield* Effect.tryPromise(async () => {
+                                Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Struct({
+                                    packageManager: Schema.Literal("pnpm@11.24.0"),
+                                })))(await readFile(join(source.snapshotPath, "package.json"), "utf8"));
+                            });
+                            const environment = snapshotBuildEnvironment(source.snapshotPath);
+                            if ((yield* runHtmlCommand(["--version"], source.snapshotPath, environment)).trim() !== "11.24.0")
+                                return yield* Effect.fail(new Error("Publisher requires pnpm 11.24.0"));
+                            yield* runHtmlCommand(frozenSnapshotInstallArguments(options.packageStoreDirectory), source.snapshotPath, environment);
+                        }
+                    }
+                    const ui = yield* recipe.kind === "bundled-html"
+                        ? Effect.tryPromise({
+                            try: () => readBundledHtml(source.snapshotPath, recipe),
+                            catch: () => new Error("Captured HTML bundle failed validation"),
+                        })
+                        : rebuildViteSnapshot(source.snapshotPath, recipe, options);
+                    const code = yield* compiler.build(source, {
+                        bundle: true,
+                        entry,
+                        format: "esm",
+                        platform: "neutral",
+                        toolchain: { ...recipe.toolchain, esbuild: "0.28.2" },
+                        target: ["es2022"],
+                        maxOutputBytes: recipe.maxOutputBytes,
+                        backend,
+                    });
+                    if (code.kind !== "bytes" || ui.kind === "app")
+                        return yield* Effect.fail(new Error("Invalid joined App output"));
+                    return {
+                        kind: "app",
+                        ui: ui.kind === "bytes"
+                            ? {
+                                content: { kind: "html", bytes: ui.bytes },
+                                mediaType: "text/html; charset=utf-8",
+                            }
+                            : {
+                                content: ui,
+                                mediaType: "application/vnd.fungi.app-assets+json",
+                            },
+                        backend: code.bytes,
+                    };
+                });
+            }
+            return recipe.format !== "esm"
+                ? rebuildViteSnapshot(source.snapshotPath, recipe, options)
+                : Effect.acquireUseRelease(Effect.tryPromise({
+                    try: () => {
+                        const emission = emissions.get(source);
+                        if (emission === undefined)
+                            throw new Error("App backend build requires its definition emission");
+                        return esbuild
+                            .context(localSnapshotBuildOptions(source, recipe, emission))
+                            .then((context) => ({ context, emission }));
+                    },
+                    catch: (error) => error instanceof Error
+                        ? error
+                        : new Error("Local snapshot build failed"),
+                }), ({ context, emission }) => Effect.tryPromise({
+                    try: (signal) => rebuildSnapshot(context, recipe, signal, source.snapshotPath, emission),
+                    catch: (error) => error instanceof Error
+                        ? error
+                        : new Error("Local snapshot build failed"),
+                }), ({ context }) => Effect.tryPromise({
+                    try: () => context.dispose(),
+                    catch: () => new Error("Local build cleanup failed"),
+                }).pipe(Effect.catch((cause) => {
+                    logEvent("services/app-publisher/src/local.ts:1262", cause);
+                    return Effect.void;
+                })));
+        },
+    };
+    const declarations = new WeakMap();
+    return {
+        build: (source, recipe) => Effect.gen(function* () {
+            if (!pinsCurrentToolchain(recipe))
+                return yield* Effect.fail(new Error("Recipe pins another build toolchain or policy"));
+            const emission = yield* Effect.tryPromise({
+                try: () => createDefinitionEmission(source, recipe),
+                catch: (cause) => cause instanceof Error
+                    ? cause
+                    : new Error("App declaration emission failed", { cause }),
+            });
+            emissions.set(source, emission);
+            const output = yield* compiler.build(source, recipe);
+            const declaration = yield* Effect.tryPromise({
+                try: (signal) => emission.declare(signal),
+                catch: (cause) => cause instanceof Error
+                    ? cause
+                    : new Error("App declaration emission failed", { cause }),
+            });
+            declarations.set(source, declaration);
+            return output;
+        }),
+        declaration: (source) => {
+            const declaration = declarations.get(source);
+            return declaration === undefined
+                ? Effect.fail(new Error("App declaration must be read after the captured build"))
+                : Effect.succeed(declaration);
+        },
+    };
+}
+/** The configured artifact directory as write-once immutable objects. */
+function directoryArtifactObjects(artifactRoot, signal) {
+    const pathOf = (artifactRef) => join(artifactRoot, artifactRef.slice("artifact:".length));
+    return {
+        async create(artifactRef, bytes) {
+            try {
+                await writeFile(pathOf(artifactRef), bytes, { flag: "wx", signal });
+                return "created";
+            }
+            catch (error) {
+                if (error instanceof Error &&
+                    "code" in error &&
+                    error.code === "EEXIST")
+                    return "exists";
+                throw error;
+            }
+            finally {
+                signal.throwIfAborted();
+            }
+        },
+        async read(artifactRef) {
+            return new Uint8Array(await readFile(pathOf(artifactRef)));
+        },
+    };
+}
+async function writeArtifact(output, artifactRoot, signal, assetPolicy) {
+    signal.throwIfAborted();
+    await mkdir(artifactRoot, { recursive: true });
+    return writeImmutableArtifact(output, directoryArtifactObjects(artifactRoot, signal), {
+        rootArtifactRef: parseArtifactRef(`artifact:${Buffer.from(randomBytes(16)).toString("hex")}`),
+        assetPolicy,
+    });
+}
+/** Local proving adapter; the configured root is private and write-once. */
+export function createLocalArtifactWriter(artifactRoot, assetPolicy) {
+    return {
+        write: (output) => Effect.tryPromise({
+            try: (signal) => writeArtifact(output, artifactRoot, signal, assetPolicy),
+            catch: () => new Error("Local immutable artifact write failed"),
+        }),
+    };
+}
+/** Construct the complete local proving adapter around the provider-neutral core. */
+export function createLocalAppPublisher(options) {
+    let decoded;
+    try {
+        decoded = Schema.decodeUnknownSync(localConfigSchema)(options.config);
+    }
+    catch {
+        throw new AppPublisherError("configuration");
+    }
+    if (decoded.recipe.assets)
+        throw new AppPublisherError("configuration", {
+            cause: new Error("Asset publication requires the native immutable object writer"),
+        });
+    const repositoryPath = localRepositoryPath(decoded.source.repositoryPath);
+    const artifactRoot = decoded.artifactRoot;
+    const recipe = {
+        entry: decoded.recipe.entry,
+        backend: decoded.recipe.backend,
+        maxOutputBytes: decoded.recipe.maxOutputBytes,
+    };
+    return createAppPublisher({
+        config: { appId: decoded.appId, recipe },
+        releaseCatalog: options.releaseCatalog,
+        sourceCapture: createLocalSourceCapture(repositoryPath),
+        buildExecutor: createLocalBuildExecutor(),
+        artifactWriter: createLocalArtifactWriter(artifactRoot),
+    });
+}