@jigging/jig 0.1.0-alpha.13 → 0.1.0-alpha.15

package/libexec/linux-rootless-supervisor.js

@@ -246,8 +246,12 @@ async function enterMain(arguments_) {
   writeSync(3, `${process.pid}
 `);
   closeSync(3);
-  const output = bubblewrapArguments_.includes("--sync-fd");
-  const inputDescriptors = bubblewrapArguments_.flatMap((arg, index) => arg === "--ro-bind-data" ? [Number(bubblewrapArguments_[index + 1])] : []);
+  const separator = bubblewrapArguments_.indexOf("--");
+  if (separator < 0)
+    throw new Error("missing rootless command boundary");
+  const envelopeArguments = bubblewrapArguments_.slice(0, separator);
+  const output = envelopeArguments.includes("--sync-fd");
+  const inputDescriptors = envelopeArguments.flatMap((arg, index) => arg === "--file" ? [Number(envelopeArguments[index + 1])] : []);
   if (inputDescriptors.some((fd, index) => fd !== 6 + index))
     throw new Error("invalid captured input descriptor order");
   const child = spawn(bubblewrap, bubblewrapArguments_, {
@@ -337,11 +341,11 @@ function bubblewrapArguments(configuration) {
   for (const mount of configuration.readOnlyMounts)
     result.push("--ro-bind", mount.source, mount.destination);
   if (configuration.inputDirectories.length > 0)
-    result.push("--size", "1048576", "--tmpfs", "/jig-input");
+    result.push("--size", String(16 * 1024 * 1024), "--tmpfs", "/jig-input");
   for (const path of configuration.inputDirectories)
     result.push("--dir", path);
   for (const file of configuration.capturedInputs)
-    result.push("--ro-bind-data", String(file.fd), file.destination);
+    result.push("--perms", "0444", "--file", String(file.fd), file.destination);
   if (configuration.inputDirectories.length > 0)
     result.push("--remount-ro", "/jig-input");
   if (configuration.output)

package/libexec/preparation/bun-native-preparation-worker.js

@@ -5,6 +5,12 @@ import { copyFile, lstat, mkdir, opendir, readFile, rm, writeFile } from "fs/pro
 import { dirname, join } from "path";
 
 // src/internal/bun-native-lock-policy.ts
+function requirePrivateBunResolutionManifest(value) {
+  const manifest = ordinaryRecord(value);
+  if (manifest === undefined || ["workspaces", "patchedDependencies", "overrides", "resolutions"].some((field) => manifest[field] !== undefined))
+    throw new TypeError("unsupported Bun resolution input");
+  requireRegistryDependencyMaps(manifest);
+}
 function requirePrivateBunLockPolicy(value) {
   const lock = ordinaryRecord(value);
   const workspaces = ordinaryRecord(lock?.workspaces);
@@ -141,6 +147,7 @@ class WorkerFailure extends Error {
   }
 }
 var outputQueue = Promise.resolve();
+var allowResolutionNetwork = process.argv.length === 3 && process.argv[2] === "--allow-resolution-network";
 try {
   const iterator = jsonLines(process.stdin, PRIVATE_BUN_SOURCE_MESSAGE_BYTES)[Symbol.asyncIterator]();
   const first = await iterator.next();
@@ -150,9 +157,14 @@ try {
   if (!(await iterator.next()).done) {
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source has trailing data");
   }
-  await materializeSource(source.files);
-  await requireSupportedLock();
+  const inputs = source.files.filter(({ path }) => path === "package.json" || path === "bun.lock");
+  await materializeSource(inputs);
+  const resolving = !inputs.some(({ path }) => path === "bun.lock");
+  if (resolving)
+    await resolveMissingLock();
+  await requireSupportedLock(resolving);
   await install();
+  await materializeSource(source.files.filter(({ path }) => path !== "package.json" && path !== "bun.lock"));
   await verifySource(source.files);
   const prepared = await capturePrepared();
   await sendPrepared(prepared);
@@ -185,7 +197,7 @@ async function verifySource(files) {
     }
   }
 }
-async function requireSupportedLock() {
+async function requireSupportedLock(resolved) {
   const lockCopy = "/work/bun-lock.jsonc";
   await copyFile(join(PACKAGE_ROOT, "bun.lock"), lockCopy);
   let value;
@@ -210,9 +222,37 @@ async function requireSupportedLock() {
   try {
     requirePrivateBunLockPolicy(value);
   } catch {
+    if (resolved) {
+      throw new WorkerFailure("PACKAGE_BUN_RESOLVED_SOURCE_UNSUPPORTED", "resolved dependencies are unsupported; resolution requests may already have occurred");
+    }
     unsupportedSource();
   }
 }
+async function resolveMissingLock() {
+  if (!allowResolutionNetwork)
+    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "resolution permission is missing");
+  try {
+    requirePrivateBunResolutionManifest(JSON.parse(await readFile(join(PACKAGE_ROOT, "package.json"), "utf8")));
+  } catch {
+    throw new WorkerFailure("PACKAGE_BUN_SOURCE_UNSUPPORTED", "package.json contains unsupported resolution inputs");
+  }
+  const result = await runChild([
+    "--no-env-file",
+    "--config=/dev/null",
+    "install",
+    "--lockfile-only",
+    "--production",
+    "--ignore-scripts",
+    "--backend=copyfile",
+    "--linker=hoisted",
+    `--cache-dir=${CACHE_ROOT}`,
+    "--registry=https://registry.npmjs.org",
+    "--no-progress",
+    "--no-summary"
+  ], { cwd: PACKAGE_ROOT, env: { LD_LIBRARY_PATH: "/jig-runtime/lib" } }, 64 * 1024, 64 * 1024);
+  if (result.exit !== 0)
+    throw new WorkerFailure("PACKAGE_BUN_RESOLUTION_FAILED", "dependency resolution failed; network requests may already have occurred");
+}
 function unsupportedSource() {
   throw new WorkerFailure("PACKAGE_BUN_SOURCE_UNSUPPORTED", "bun.lock contains a dependency source unsupported by this Jig alpha; only the default npm registry is supported");
 }
@@ -307,7 +347,7 @@ function requireSource(value) {
     }
     files.push(Object.freeze({ path: file.path, content: file.content }));
   }
-  if (!files.some(({ path }) => path === "package.json") || !files.some(({ path }) => path === "bun.lock")) {
+  if (!files.some(({ path }) => path === "package.json") || !files.some(({ path }) => path === "bun.lock") && !allowResolutionNetwork) {
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "locked Bun source is incomplete");
   }
   return Object.freeze({ files: Object.freeze(files) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jigging/jig",
-  "version": "0.1.0-alpha.13",
+  "version": "0.1.0-alpha.15",
   "description": "A local, secure host for admitted FLOW packages",
   "license": "MPL-2.0",
   "repository": {
@@ -42,6 +42,7 @@
     "dist/index.js",
     "dist/index.d.ts",
     "dist/project/author.d.ts",
+    "dist/project/commands.d.ts",
     "dist/json.d.ts",
     "libexec/installed-cli.js",
     "libexec/linux-rootless-supervisor.js",