@fungi.computer/oyster 0.0.1 → 0.2.0

package/dist/build/local-build.js

@@ -7,9 +7,10 @@ function logEvent(operation, cause) {
         failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
     }));
 }
-import { frozenSnapshotInstallArguments } from "./snapshot-package-store.js";
-import mime from "mime";
-import { assetPathSchema, assetBuildJsonSchema, decodeAssetBuild, } from "@fungi.computer/puffball/assets";
+import { frozenSnapshotInstallArguments, packageScriptArguments, } from "./snapshot-package-store.js";
+import { isInsideSnapshot } from "./snapshot-programs/snapshot-path.js";
+import { writeImmutableArtifact, } from "./artifact-writer.js";
+import { assetPathSchema, } from "@fungi.computer/puffball/assets";
 import { resolveWorkspaceBuild, workspaceProjectsArguments, } from "./workspace-build.js";
 import { readBundledHtml } from "./bundled-html.js";
 import { createHash, randomBytes } from "node:crypto";
@@ -22,13 +23,12 @@ import { pipeline } from "node:stream/promises";
 import { setTimeout as delay } from "node:timers/promises";
 import { parseArtifactRef, parseSha256Digest, parseSourceRevision, } from "@fungi.computer/puffball";
 import { appIdSchema } from "@fungi.computer/puffball/effect";
-import { appBuildJsonSchema, createAppBuild, } from "@fungi.computer/puffball/app";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
 import * as esbuild from "esbuild";
 import { readWantedLockfile, writeWantedLockfile } from "@pnpm/lockfile.fs";
 import { pruneSharedLockfile } from "@pnpm/lockfile.pruner";
-import { AppPublisherError, appBackendExportConditions, createAppPublisher, pinnedRecipeSchema, } from "./effect.js";
+import { AppPublisherError, appBackendExportConditions, createAppPublisher, pinnedRecipeSchema, pinsCurrentToolchain, } from "./effect.js";
 import { artifactsGitEnvironment, repositoryEnvironment, } from "./git-environment.js";
 const localConfigSchema = Schema.Struct({
     appId: appIdSchema,
@@ -44,9 +44,6 @@ function localRepositoryPath(input) {
         return input;
     throw new AppPublisherError("configuration");
 }
-function sha256(bytes) {
-    return parseSha256Digest(`sha256:${createHash("sha256").update(bytes).digest("hex")}`);
-}
 async function sha256File(path, signal) {
     const hash = createHash("sha256");
     await pipeline(createReadStream(path), hash, { signal });
@@ -332,6 +329,63 @@ async function prunePnpmLockfile(snapshotPath, isIncludedPath) {
         await rm(scratch, { recursive: true, force: true });
     }
 }
+/** The provenance file every distribution records beside the App source. */
+function provenanceFile(appId, source) {
+    return {
+        path: "botanical-app-source.json",
+        contents: new TextEncoder().encode(JSON.stringify({
+            appId,
+            sourceRevision: source.sourceRevision,
+            sourceTreeDigest: source.sourceTreeDigest,
+        }, null, 2) + "\n"),
+    };
+}
+/** Builder state a source listing writes into the snapshot, never source. */
+const snapshotScratch = new Set([".publisher-source-home", "node_modules"]);
+/**
+ * An App repository's distribution: every captured file, unchanged, plus its
+ * provenance. The repository's own pnpm lockfile pins its registry packages.
+ */
+function repositoryAppSourceDistribution(appId, source) {
+    return Effect.tryPromise({
+        try: async () => {
+            const snapshot = realpathSync(resolve(source.snapshotPath));
+            const collected = new Map();
+            const collect = async (relativePath) => {
+                const sourcePath = join(snapshot, relativePath);
+                const stats = await lstat(sourcePath);
+                if (stats.isSymbolicLink())
+                    throw new Error("Source distribution cannot contain symbolic links");
+                if (stats.isFile()) {
+                    collected.set(relativePath, await readFile(sourcePath));
+                    return;
+                }
+                if (!stats.isDirectory())
+                    throw new Error("Source distribution contains a non-file entry");
+                const entries = await readdir(sourcePath, { withFileTypes: true });
+                entries.sort((left, right) => left.name.localeCompare(right.name));
+                for (const entry of entries)
+                    if (relativePath !== "" || !snapshotScratch.has(entry.name))
+                        await collect(join(relativePath, entry.name));
+            };
+            await collect("");
+            const provenance = provenanceFile(appId, source);
+            if (collected.has(provenance.path))
+                throw new Error("Source distribution reserves its provenance path");
+            collected.set(provenance.path, provenance.contents);
+            return Object.freeze({
+                appId,
+                sourceRevision: source.sourceRevision,
+                sourceTreeDigest: source.sourceTreeDigest,
+                appDirectory: "",
+                files: [...collected]
+                    .sort(([left], [right]) => left.localeCompare(right))
+                    .map(([path, contents]) => Object.freeze({ path, contents })),
+            });
+        },
+        catch: (error) => error,
+    });
+}
 /**
  * Project one pinned first-party App and its pnpm workspace dependency graph
  * without changing upstream files or manufacturing Git history. The caller
@@ -352,6 +406,10 @@ export function createFirstPartyAppSourceDistribution(options) {
     return Effect.gen(function* () {
         const recipe = yield* capturedWorkspaceBuild(snapshot, options.entry, (args) => runHtmlCommand(args, snapshot, env));
         const appDirectory = recipe.directory;
+        // An App's own repository is the App at its root: its editable template
+        // is that repository's whole captured tree, as forking it would copy.
+        if (appDirectory === "")
+            return yield* repositoryAppSourceDistribution(appId, options.source);
         const listed = yield* runHtmlCommand([
             ...productionWorkspaceSelectors(recipe),
             "list",
@@ -432,13 +490,10 @@ export function createFirstPartyAppSourceDistribution(options) {
                 await collect("patches");
                 if (collected.has("pnpm-lock.yaml"))
                     collected.set("pnpm-lock.yaml", await prunePnpmLockfile(snapshot, (importerPath) => collected.has(join(importerPath, "package.json"))));
-                if (collected.has("botanical-app-source.json"))
+                const provenance = provenanceFile(appId, options.source);
+                if (collected.has(provenance.path))
                     throw new Error("Source distribution reserves its provenance path");
-                collected.set("botanical-app-source.json", new TextEncoder().encode(JSON.stringify({
-                    appId,
-                    sourceRevision: options.source.sourceRevision,
-                    sourceTreeDigest: options.source.sourceTreeDigest,
-                }, null, 2) + "\n"));
+                collected.set(provenance.path, provenance.contents);
                 return [...collected]
                     .sort(([left], [right]) => left.localeCompare(right))
                     .map(([path, contents]) => Object.freeze({ path, contents }));
@@ -533,13 +588,13 @@ function runHtmlCommand(args, cwd, env, command = "pnpm") {
 function snapshotPrograms() {
     return import("#snapshot-program-scripts");
 }
-/** Compiler heap ceiling: fits a 6 GB Computer with room for pnpm and esbuild. */
+/** Compiler heap ceiling: fits a 12 GiB Computer with two builds at once. */
 const snapshotBuildHeapMegabytes = 4096;
 function snapshotBuildEnvironment(sourceSnapshotPath) {
     // PATH locates pinned executables; the Computer's CA files authenticate
     // its egress gateway. Credentials and package-manager settings stay out.
-    // V8 sizes its default heap from the machine, about 2 GB in a 6 GB
-    // standard-2 Computer, where compiling Bonsai runs out; the build owns one
+    // V8 sizes its default heap from the machine, about 3 GB in a 12 GiB
+    // standard-4 Computer, where compiling Bonsai runs out; the build owns one
     // fixed ceiling instead.
     const env = {
         PATH: process.env.PATH ?? "/usr/bin:/bin",
@@ -553,7 +608,7 @@ function snapshotBuildEnvironment(sourceSnapshotPath) {
     };
     return env;
 }
-function rebuildViteSnapshot(sourceSnapshotPath, recipe, packageStoreDirectory) {
+function rebuildViteSnapshot(sourceSnapshotPath, recipe, options) {
     if (recipe.kind === "source-html")
         return rebuildNpmSnapshot(sourceSnapshotPath, recipe);
     return Effect.gen(function* () {
@@ -567,10 +622,16 @@ function rebuildViteSnapshot(sourceSnapshotPath, recipe, packageStoreDirectory)
             try: () => checkPinnedWorkspaceToolchain(sourceSnapshotPath, html, recipe),
             catch: (error) => error,
         });
+        if (options.packageScripts !== "run" &&
+            html.steps.some((step) => step.kind === "script"))
+            return yield* Effect.fail(new Error("This source builds a dependency with its package script, which only a Computer build runs"));
+        const installStarted = performance.now();
         yield* run([
             ...productionWorkspaceSelectors(html),
-            ...frozenSnapshotInstallArguments(packageStoreDirectory),
+            ...frozenSnapshotInstallArguments(options.packageStoreDirectory),
         ]);
+        const buildStarted = performance.now();
+        options.onPhase?.("install", buildStarted - installStarted);
         const appDirectory = join(sourceSnapshotPath, html.directory);
         const dependencies = join(appDirectory, ".publisher-dependencies.mjs");
         const program = join(appDirectory, ".publisher-build.mjs");
@@ -593,8 +654,23 @@ function rebuildViteSnapshot(sourceSnapshotPath, recipe, packageStoreDirectory)
             else
                 groups.push([step]);
         }
-        for (const group of groups)
+        for (const group of groups) {
+            const [step] = group;
+            if (step?.kind === "script") {
+                // Exactly the named script, in its own package: no pre/post hooks or
+                // implicit install, whatever the captured repository's pnpm settings
+                // ask for. The script is arbitrary package code: its isolation is the
+                // admitted Computer, not this builder's compiler path checks.
+                const directory = resolve(sourceSnapshotPath, step.directory);
+                if (!isInsideSnapshot(sourceSnapshotPath, directory))
+                    return yield* Effect.fail(new Error("Package script directory escapes the captured source"));
+                yield* run([...packageScriptArguments, step.script], directory);
+                continue;
+            }
             yield* run([
+                // The frozen install above is the only install, whatever the
+                // captured pnpm settings ask `exec` to verify first.
+                "--config.verify-deps-before-run=false",
                 "exec",
                 "node",
                 dependencies,
@@ -602,8 +678,11 @@ function rebuildViteSnapshot(sourceSnapshotPath, recipe, packageStoreDirectory)
                 html.directory,
                 recipe.format,
                 JSON.stringify(group),
+                tailwindToolchainDirectory(html),
             ], appDirectory);
+        }
         yield* run([
+            "--config.verify-deps-before-run=false",
             "exec",
             "node",
             program,
@@ -616,9 +695,20 @@ function rebuildViteSnapshot(sourceSnapshotPath, recipe, packageStoreDirectory)
             String(html.react),
             html.shellEntry ?? "",
         ], appDirectory);
+        options.onPhase?.("build", performance.now() - buildStarted);
         return yield* readHtmlBuildOutput(sourceSnapshotPath, recipe);
     });
 }
+/**
+ * Where the captured Tailwind compiler lives: Caps, when the App builds Caps
+ * from its workspace, or else the App itself, which then pins the compiler
+ * and installs Caps' built stylesheet from a registry.
+ */
+function tailwindToolchainDirectory(html) {
+    return html.dependencies.includes("packages/caps")
+        ? "packages/caps"
+        : html.directory;
+}
 const pinnedVersionsSchema = Schema.Record(Schema.String, Schema.String);
 const pinnedManifestSchema = Schema.fromJsonString(Schema.Struct({
     dependencies: Schema.optional(pinnedVersionsSchema),
@@ -656,9 +746,13 @@ async function checkPinnedWorkspaceToolchain(sourceSnapshotPath, html, recipe) {
     if (stylesheets.length === 0)
         return;
     // The captured Tailwind compiler and its typography plugin come from Caps.
-    const caps = await manifest("packages/caps");
-    pinned("packages/caps", caps.devDependencies, "@tailwindcss/cli", "4.2.1");
-    pinned("packages/caps", caps.dependencies, "@tailwindcss/typography", "0.5.19");
+    // An App that installs Caps from a registry pins the compiler itself, and
+    // Caps' own dependencies bring the typography plugin its stylesheet uses.
+    const toolchain = tailwindToolchainDirectory(html);
+    const compiler = await manifest(toolchain);
+    pinned(toolchain, compiler.devDependencies, "@tailwindcss/cli", "4.2.1");
+    if (toolchain === "packages/caps")
+        pinned(toolchain, compiler.dependencies, "@tailwindcss/typography", "0.5.19");
     for (const directory of html.dependencies) {
         if (!stylesheets.some((step) => step.input.startsWith(`${directory}/`)))
             continue;
@@ -876,7 +970,7 @@ export function createLocalBuildExecutor(options = {}) {
                             try: () => readBundledHtml(source.snapshotPath, recipe),
                             catch: () => new Error("Captured HTML bundle failed validation"),
                         })
-                        : rebuildViteSnapshot(source.snapshotPath, recipe, options.packageStoreDirectory);
+                        : rebuildViteSnapshot(source.snapshotPath, recipe, options);
                     const code = yield* compiler.build(source, {
                         bundle: true,
                         entry,
@@ -905,7 +999,7 @@ export function createLocalBuildExecutor(options = {}) {
                 });
             }
             return recipe.format !== "esm"
-                ? rebuildViteSnapshot(source.snapshotPath, recipe, options.packageStoreDirectory)
+                ? rebuildViteSnapshot(source.snapshotPath, recipe, options)
                 : Effect.acquireUseRelease(Effect.tryPromise({
                     try: () => {
                         const emission = emissions.get(source);
@@ -935,6 +1029,8 @@ export function createLocalBuildExecutor(options = {}) {
     const declarations = new WeakMap();
     return {
         build: (source, recipe) => Effect.gen(function* () {
+            if (!pinsCurrentToolchain(recipe))
+                return yield* Effect.fail(new Error("Recipe pins another build toolchain or policy"));
             const emission = yield* Effect.tryPromise({
                 try: () => createDefinitionEmission(source, recipe),
                 catch: (cause) => cause instanceof Error
@@ -960,83 +1056,37 @@ export function createLocalBuildExecutor(options = {}) {
         },
     };
 }
+/** The configured artifact directory as write-once immutable objects. */
+function directoryArtifactObjects(artifactRoot, signal) {
+    const pathOf = (artifactRef) => join(artifactRoot, artifactRef.slice("artifact:".length));
+    return {
+        async create(artifactRef, bytes) {
+            try {
+                await writeFile(pathOf(artifactRef), bytes, { flag: "wx", signal });
+                return "created";
+            }
+            catch (error) {
+                if (error instanceof Error &&
+                    "code" in error &&
+                    error.code === "EEXIST")
+                    return "exists";
+                throw error;
+            }
+            finally {
+                signal.throwIfAborted();
+            }
+        },
+        async read(artifactRef) {
+            return new Uint8Array(await readFile(pathOf(artifactRef)));
+        },
+    };
+}
 async function writeArtifact(output, artifactRoot, signal, assetPolicy) {
     signal.throwIfAborted();
-    const ui = output.kind === "backend" ? null : output.ui;
     await mkdir(artifactRoot, { recursive: true });
-    const persist = async (bytes, ref) => {
-        const digest = sha256(bytes);
-        const artifactRef = parseArtifactRef(ref ?? `artifact:sha256-${digest.slice("sha256:".length)}`);
-        const artifactPath = join(artifactRoot, artifactRef.slice("artifact:".length));
-        try {
-            await writeFile(artifactPath, bytes, { flag: "wx", signal });
-        }
-        catch (error) {
-            const code = error instanceof Error && "code" in error ? error.code : undefined;
-            if (code !== "EEXIST" || sha256(await readFile(artifactPath)) !== digest)
-                throw error;
-        }
-        signal.throwIfAborted();
-        return {
-            artifactRef,
-            digest,
-            version: digest,
-            byteLength: bytes.byteLength,
-        };
-    };
-    const uiBytes = await (async () => {
-        if (ui === null)
-            return null;
-        if (ui.content.kind === "html")
-            return ui.content.bytes.slice();
-        if (!assetPolicy)
-            throw new Error("Asset writer requires explicit policy");
-        const content = {};
-        for (const asset of ui.content.assets) {
-            const path = Schema.decodeUnknownSync(assetPathSchema)(asset.path);
-            if (Object.hasOwn(content, path))
-                throw new Error("Duplicate build path");
-            content[path] = new Uint8Array(asset.bytes).buffer;
-        }
-        const assets = [];
-        for (const path of Object.keys(content).sort()) {
-            const bytes = content[path];
-            const mediaType = mime.getType(path);
-            const contentType = mediaType?.startsWith("text/")
-                ? `${mediaType}; charset=utf-8`
-                : mediaType;
-            if (!bytes || !contentType)
-                throw new Error("Build asset has no maintained content type");
-            assets.push({
-                path,
-                ...(await persist(new Uint8Array(bytes))),
-                contentType,
-            });
-        }
-        const manifest = new TextEncoder().encode(Schema.encodeUnknownSync(assetBuildJsonSchema)({
-            format: "fungi-assets-v1",
-            base: ui.content.base,
-            assets,
-        }));
-        decodeAssetBuild(manifest, assetPolicy);
-        return manifest;
-    })();
-    const storedUi = ui === null || uiBytes === null
-        ? null
-        : { ...(await persist(uiBytes)), mediaType: ui.mediaType };
-    const backendBytes = output.kind === "ui" ? null : output.backend;
-    const storedBackend = backendBytes === null
-        ? null
-        : await persist(backendBytes.slice()).then((stored) => ({
-            ...stored,
-            mediaType: "application/vnd.fungi.app-backend+json",
-        }));
-    const root = new TextEncoder().encode(Schema.encodeUnknownSync(appBuildJsonSchema)(createAppBuild(storedUi, storedBackend, output.declaration)));
-    const rootRef = `artifact:${Buffer.from(randomBytes(16)).toString("hex")}`;
-    const storedRoot = await persist(root, rootRef);
-    return Object.freeze({
-        artifactRef: storedRoot.artifactRef,
-        artifactDigest: storedRoot.digest,
+    return writeImmutableArtifact(output, directoryArtifactObjects(artifactRoot, signal), {
+        rootArtifactRef: parseArtifactRef(`artifact:${Buffer.from(randomBytes(16)).toString("hex")}`),
+        assetPolicy,
     });
 }
 /** Local proving adapter; the configured root is private and write-once. */

package/dist/build/snapshot-package-store.d.ts

@@ -1,2 +1,12 @@
 /** Frozen hydration policy. Cached bytes are verified and copied into each snapshot. */
 export declare function frozenSnapshotInstallArguments(packageStoreDirectory?: string): string[];
+/**
+ * `pnpm run` for one declared package build script, which follows `--` so
+ * pnpm selects that literal name (never an option or a `/pattern/`). pnpm 11
+ * runs `pre<name>`/`post<name>` by default, and installs first when it judges
+ * dependencies stale, running their lifecycle scripts; a captured `.npmrc` or
+ * `pnpm-workspace.yaml` may also ask for either. These command line settings
+ * win, so the frozen, script-free install stays the only install. What the
+ * named script itself runs is that package's own build.
+ */
+export declare const packageScriptArguments: readonly string[];

package/dist/build/snapshot-package-store.js

@@ -19,3 +19,18 @@ export function frozenSnapshotInstallArguments(packageStoreDirectory) {
         "--reporter=append-only",
     ];
 }
+/**
+ * `pnpm run` for one declared package build script, which follows `--` so
+ * pnpm selects that literal name (never an option or a `/pattern/`). pnpm 11
+ * runs `pre<name>`/`post<name>` by default, and installs first when it judges
+ * dependencies stale, running their lifecycle scripts; a captured `.npmrc` or
+ * `pnpm-workspace.yaml` may also ask for either. These command line settings
+ * win, so the frozen, script-free install stays the only install. What the
+ * named script itself runs is that package's own build.
+ */
+export const packageScriptArguments = Object.freeze([
+    "run",
+    "--config.enable-pre-post-scripts=false",
+    "--config.verify-deps-before-run=false",
+    "--",
+]);