@tsplc/build 0.0.0-stage → 0.1.0

package/docker/install/wine-signal/check.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -eu
+sources=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+work=$(mktemp -d /tmp/tsplc-wine-signal.XXXXXX)
+echo "Native check artifacts: $work"
+"$sources/build.sh" "$work/compat"
+gcc -Wall -Wextra -Werror -O2 -fno-tree-vectorize \
+    "$sources/tests/frame-and-handler.c" -ldl -o "$work/frame-and-handler"
+gcc -Wall -Wextra -Werror -O2 -mavx \
+    "$sources/tests/avx-registers.c" -o "$work/avx-registers"
+gcc -Wall -Wextra -Werror -O2 \
+    "$sources/tests/signal-return.c" -o "$work/signal-return"
+gcc -m32 -nostdlib -Wall -Wextra -Werror -O2 -Wl,-e,_start \
+    -Wl,--dynamic-linker=/lib/ld-linux.so.2 \
+    "$sources/tests/loader-i386.c" -o "$work/loader-i386"
+"$work/frame-and-handler"
+# Leave the calling shell's environment untouched, just as the Wine launcher does.
+preload="$work/compat/\$LIB/signal-state.so"
+LD_PRELOAD="$preload" "$work/signal-return"
+LD_PRELOAD="$preload" "$work/avx-registers"
+LD_PRELOAD="$preload" "$work/avx-registers" nonzero
+LD_DEBUG=libs,files LD_PRELOAD="$preload" "$work/signal-return" > "$work/amd64.log" 2>&1
+LD_DEBUG=libs,files LD_PRELOAD="$preload" "$work/loader-i386" > "$work/i386.log" 2>&1
+python3 - "$work" <<'PY_CHECK'
+import pathlib, sys
+work = pathlib.Path(sys.argv[1])
+for architecture, library in [('amd64', 'x86_64-linux-gnu'), ('i386', 'i386-linux-gnu')]:
+    log = (work / (architecture + '.log')).read_text()
+    expected = str(work / 'compat' / 'lib' / library / 'signal-state.so')
+    if 'calling init: ' + expected not in log or any(message in log for message in
+            ['ERROR:', 'wrong ELF class', 'cannot be preloaded']):
+        raise SystemExit(log)
+    print(architecture + ' loader: ' + expected + ' PASS (no preload warnings)')
+PY_CHECK

package/docker/install/wine-signal/noop-i386.c

@@ -0,0 +1,2 @@
+/* The 32-bit Wine loader needs no x86-64 signal-state adapter. */
+void tsplc_wine_compat_noop(void) {}

package/docker/install/wine-signal/signal-state.c

@@ -0,0 +1,105 @@
+#define _GNU_SOURCE
+#include <dlfcn.h>
+#include <errno.h>
+#include <signal.h>
+#include <stdatomic.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <ucontext.h>
+#include <unistd.h>
+
+/* Linux's standard, uncompacted XSAVE layout for x87, SSE and AVX only.
+   Restrict the adapter to the exact frame produced by the tested Rosetta ABI. */
+struct __attribute__((may_alias)) signal_xstate {
+    unsigned char legacy[464];
+    uint32_t magic;
+    uint32_t extended_size;
+    uint64_t supported_features;
+    uint32_t xstate_size;
+    uint32_t software_reserved[7];
+    uint64_t features;
+    uint64_t header_reserved[7];
+    unsigned char ymm_high[256];
+    uint32_t end_magic;
+};
+_Static_assert(offsetof(struct signal_xstate, features) == 512, "XSAVE header offset");
+_Static_assert(offsetof(struct signal_xstate, ymm_high) == 576, "AVX component offset");
+_Static_assert(offsetof(struct signal_xstate, end_magic) == 832, "Linux XSAVE tail offset");
+
+typedef void (*signal_handler)(int, siginfo_t *, void *);
+typedef int (*sigaction_function)(int, const struct sigaction *, struct sigaction *);
+static sigaction_function next_sigaction;
+static _Atomic(signal_handler) usr1_handler;
+_Static_assert(ATOMIC_POINTER_LOCK_FREE == 2, "Handler loads must be signal-safe");
+
+static struct signal_xstate *valid_state(ucontext_t *context)
+{
+    struct signal_xstate *state = (void *)context->uc_mcontext.fpregs;
+    if (!state || state->magic != UINT32_C(0x46505853)) return NULL;
+    /* Check lengths before accessing the extended header, component or tail. */
+    if (state->extended_size != 836 || state->xstate_size != 832 ||
+        state->supported_features != 7) return NULL;
+    /* The Linux public signal ABI reserves all other header words. Rosetta
+       leaves some uninitialized; preserve them rather than infer a format. */
+    if (state->end_magic != UINT32_C(0x46505845)) return NULL;
+    return state;
+}
+
+static void dispatch_usr1(int signal, siginfo_t *information, void *pointer)
+{
+    ucontext_t *context = pointer;
+    struct signal_xstate *entry = context ? valid_state(context) : NULL;
+    int full_state_on_entry = entry && entry->features == 7;
+    signal_handler handler = atomic_load_explicit(&usr1_handler, memory_order_acquire);
+    handler(signal, information, pointer);
+    /* Wine may replace fpregs; revalidate the returned frame rather than retain
+       the old pointer. An absent AVX component means all YMM-high bits are zero.
+       Store that same architectural state explicitly for Rosetta's sigreturn. */
+    struct signal_xstate *returned = context && full_state_on_entry ? valid_state(context) : NULL;
+    if (returned && returned->features == 3) {
+        volatile unsigned char *ymm = returned->ymm_high;
+        for (size_t index = 0; index < sizeof(returned->ymm_high); ++index) ymm[index] = 0;
+        returned->features = 7;
+    }
+}
+
+__attribute__((constructor)) static void resolve_sigaction(void)
+{
+    next_sigaction = (sigaction_function)dlsym(RTLD_NEXT, "sigaction");
+    if (!next_sigaction) {
+        const char message[] = "Wine signal adapter: cannot resolve libc sigaction\n";
+        ssize_t ignored = write(STDERR_FILENO, message, sizeof(message) - 1);
+        (void)ignored;
+        _exit(127);
+    }
+}
+
+int sigaction(int signal, const struct sigaction *action, struct sigaction *old_action)
+{
+    if (signal != SIGUSR1) return next_sigaction(signal, action, old_action);
+    struct sigaction wrapped;
+    const struct sigaction *installed = action;
+    int siginfo_handler = action && (action->sa_flags & SA_SIGINFO) &&
+                          action->sa_handler != SIG_DFL && action->sa_handler != SIG_IGN;
+    if (siginfo_handler) {
+        /* Wine installs one process-wide usr1_handler. Bind it once, so a
+           concurrently replaced disposition cannot redirect an active wrapper.
+           A different application's replacement handler goes directly to libc. */
+        signal_handler expected = NULL;
+        atomic_compare_exchange_strong_explicit(&usr1_handler, &expected, action->sa_sigaction,
+                                                memory_order_acq_rel, memory_order_acquire);
+        signal_handler bound = atomic_load_explicit(&usr1_handler, memory_order_acquire);
+        if (bound == action->sa_sigaction) {
+            wrapped = *action;
+            wrapped.sa_sigaction = dispatch_usr1;
+            installed = &wrapped;
+        }
+    }
+    int result = next_sigaction(signal, installed, old_action);
+    int saved_errno = errno;
+    if (!result && old_action && (old_action->sa_flags & SA_SIGINFO) &&
+        old_action->sa_sigaction == dispatch_usr1)
+        old_action->sa_sigaction = atomic_load_explicit(&usr1_handler, memory_order_acquire);
+    errno = saved_errno;
+    return result;
+}

package/docker/install/wine-signal/tests/avx-registers.c

@@ -0,0 +1,53 @@
+#define _GNU_SOURCE
+#include <assert.h>
+#include <signal.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/syscall.h>
+#include <ucontext.h>
+#include <unistd.h>
+
+static int preserve_nonzero;
+
+static void handler(int signal, siginfo_t *information, void *pointer)
+{
+    (void)signal;
+    (void)information;
+    unsigned char *state = (void *)((ucontext_t *)pointer)->uc_mcontext.fpregs;
+    uint64_t features;
+    memcpy(&features, state + 512, sizeof(features));
+    if ((features & 7) != 7) _exit(78);
+    if (preserve_nonzero) {
+        memset(state + 576, 0x3c, 256);
+    } else {
+        features &= ~UINT64_C(4);
+        memcpy(state + 512, &features, sizeof(features));
+    }
+}
+
+int main(int argc, char **argv)
+{
+    (void)argv;
+    preserve_nonzero = argc > 1;
+    struct sigaction action = {.sa_sigaction = handler, .sa_flags = SA_SIGINFO};
+    sigemptyset(&action.sa_mask);
+    assert(!sigaction(SIGUSR1, &action, NULL));
+    unsigned char seed[32], returned[32];
+    memset(seed, 0x19, 16);
+    memset(seed + 16, 0x29, 16);
+    long process = getpid(), thread = syscall(SYS_gettid), number = SYS_tgkill;
+    /* Do not call a libc function between loading and reading YMM0: the SysV
+       calling convention would allow it to destroy the vector register. */
+    __asm__ volatile("vmovdqu %2, %%ymm0\n\tsyscall\n\tvmovdqu %%ymm0, %0"
+        : "=m"(returned), "+a"(number)
+        : "m"(seed), "D"(process), "S"(thread), "d"((long)SIGUSR1)
+        : "rcx", "r11", "memory", "ymm0");
+    assert(number == 0);
+    for (int index = 0; index < 16; ++index) assert(returned[index] == 0x19);
+    for (int index = 16; index < 32; ++index)
+        assert(returned[index] == (preserve_nonzero ? 0x3c : 0));
+    printf("Real AVX register return: %s PASS\n",
+           preserve_nonzero ? "nonzero preserved" : "absent component initialized");
+    return 0;
+}

package/docker/install/wine-signal/tests/frame-and-handler.c

@@ -0,0 +1,192 @@
+#include "../signal-state.c"
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/mman.h>
+
+static int calls;
+static uint64_t desired_features;
+static void *replacement;
+static void original(int signal, siginfo_t *information, void *pointer)
+{
+    (void)information;
+    assert(signal == SIGUSR1);
+    ++calls;
+    ucontext_t *context = pointer;
+    if (replacement) context->uc_mcontext.fpregs = replacement;
+    if (context->uc_mcontext.fpregs)
+        ((struct signal_xstate *)context->uc_mcontext.fpregs)->features = desired_features;
+}
+static void different(int signal, siginfo_t *information, void *pointer)
+{
+    (void)signal;
+    (void)information;
+    (void)pointer;
+}
+static void simple(int signal)
+{
+    (void)signal;
+}
+
+static struct signal_xstate frame(void)
+{
+    struct signal_xstate value;
+    memset(&value, 0xa5, sizeof(value));
+    value.magic = 0x46505853;
+    value.extended_size = 836;
+    value.supported_features = 7;
+    value.xstate_size = 832;
+    value.features = 7;
+    value.header_reserved[0] = 0x6e6769732d656e69;
+    /* Observed unused Rosetta header data. */
+    value.end_magic = 0x46505845;
+    return value;
+}
+static void invoke(struct signal_xstate *value)
+{
+    ucontext_t context = {0};
+    context.uc_mcontext.fpregs = (void *)value;
+    struct sigaction kernel;
+    assert(!next_sigaction(SIGUSR1, NULL, &kernel));
+    kernel.sa_sigaction(SIGUSR1, NULL, &context);
+}
+static int cases;
+static void expect_unchanged(struct signal_xstate value)
+{
+    struct signal_xstate expected = value;
+    expected.features = desired_features;
+    invoke(&value);
+    assert(!memcmp(&value, &expected, sizeof(value)));
+    ++cases;
+}
+
+int main(void)
+{
+    struct sigaction action = {
+        .sa_sigaction = original,
+        .sa_flags = SA_SIGINFO | SA_RESTART | SA_ONSTACK
+    };
+    sigemptyset(&action.sa_mask);
+    sigaddset(&action.sa_mask, SIGUSR2);
+    struct sigaction before, query;
+    assert(!sigaction(SIGUSR1, &action, &before));
+    assert(!sigaction(SIGUSR1, NULL, &query));
+    assert(query.sa_sigaction == original);
+    assert((query.sa_flags & (SA_SIGINFO | SA_RESTART | SA_ONSTACK)) == action.sa_flags);
+    assert(sigismember(&query.sa_mask, SIGUSR2));
+    ++cases;
+
+    desired_features = 3;
+    struct signal_xstate value = frame(), expected = value;
+    memset(expected.ymm_high, 0, sizeof(expected.ymm_high));
+    invoke(&value);
+    assert(!memcmp(&value, &expected, sizeof(value)));
+    ++cases;
+
+    desired_features = 7;
+    expect_unchanged(frame());
+    /* Nonzero AVX state remains intact. */
+    desired_features = 3;
+    value = frame();
+    value.features = 3;
+    expect_unchanged(value);
+    value = frame();
+    value.magic = 0;
+    expect_unchanged(value);
+    value = frame();
+    value.extended_size = 835;
+    expect_unchanged(value);
+    value = frame();
+    value.extended_size = 840;
+    expect_unchanged(value);
+    value = frame();
+    value.xstate_size = 831;
+    expect_unchanged(value);
+    value = frame();
+    value.supported_features = 15;
+    expect_unchanged(value);
+    value = frame();
+    value.header_reserved[0] = UINT64_C(1) << 63;
+    expected = value;
+    memset(expected.ymm_high,0, sizeof(expected.ymm_high));
+    invoke(&value);
+    assert(!memcmp(&value, &expected, sizeof(value)));
+    ++cases;
+    value = frame();
+    value.end_magic = 0;
+    expect_unchanged(value);
+    desired_features = 1;
+    expect_unchanged(frame());
+    desired_features = 5;
+    expect_unchanged(frame());
+    desired_features = 15;
+    expect_unchanged(frame());
+    desired_features = 3;
+    invoke(NULL);
+    ++cases;
+
+    value = frame();
+    struct signal_xstate second = frame();
+    expected = second;
+    memset(expected.ymm_high, 0, sizeof(expected.ymm_high));
+    replacement = &second;
+    invoke(&value);
+    struct signal_xstate unchanged = frame();
+    assert(!memcmp(&value, &unchanged, sizeof(value)));
+    assert(!memcmp(&second, &expected, sizeof(second)));
+    replacement = NULL;
+    ++cases;
+
+    /* The legacy header can end at a protected page boundary. No extended
+       access is permitted after missing magic. */
+    long page = sysconf(_SC_PAGESIZE);
+    void *memory = mmap(NULL, (size_t)page * 2, PROT_READ | PROT_WRITE,
+                      MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    assert(memory != MAP_FAILED);
+    assert(!mprotect((char *)memory + page,(size_t)page, PROT_NONE));
+    unsigned char *legacy = (unsigned char *)memory + page - 512;
+    memset(legacy, 0, 512);
+    ucontext_t context = {0};
+    context.uc_mcontext.fpregs = (void *)legacy;
+    assert(valid_state(&context) == NULL);
+    munmap(memory,(size_t)page * 2);
+    ++cases;
+
+    struct sigaction changed = {.sa_sigaction = different, .sa_flags = SA_SIGINFO};
+    sigemptyset(&changed.sa_mask);
+    assert(!sigaction(SIGUSR1, &changed, &query));
+    assert(query.sa_sigaction == original);
+    assert(!next_sigaction(SIGUSR1, NULL, &query));
+    assert(query.sa_sigaction == different);
+    ++cases;
+    assert(!sigaction(SIGUSR1, &action, &query));
+    assert(query.sa_sigaction == different);
+    ++cases;
+    struct sigaction ignored = {.sa_handler = SIG_IGN};
+    sigemptyset(&ignored.sa_mask);
+    assert(!sigaction(SIGUSR1, &ignored, &query));
+    assert(query.sa_sigaction == original);
+    assert(!sigaction(SIGUSR1, NULL, &query));
+    assert(query.sa_handler == SIG_IGN);
+    ++cases;
+    struct sigaction defaults = {.sa_handler = SIG_DFL};
+    sigemptyset(&defaults.sa_mask);
+    assert(!sigaction(SIGUSR1, &defaults, &query));
+    assert(query.sa_handler == SIG_IGN);
+    assert(!sigaction(SIGUSR1, NULL, &query));
+    assert(query.sa_handler == SIG_DFL);
+    ++cases;
+    struct sigaction one = {.sa_handler = simple};
+    sigemptyset(&one.sa_mask);
+    assert(!sigaction(SIGUSR1, &one, &query));
+    assert(query.sa_handler == SIG_DFL);
+    assert(!next_sigaction(SIGUSR1, NULL, &query));
+    assert(query.sa_handler == simple);
+    ++cases;
+    assert(!sigaction(SIGUSR2, &action, NULL));
+    assert(!next_sigaction(SIGUSR2, NULL, &query));
+    assert(query.sa_sigaction == original);
+    ++cases;
+    printf("Signal adapter semantics: %d cases PASS (%d original callbacks)\n", cases, calls);
+    return 0;
+}

package/docker/install/wine-signal/tests/loader-i386.c

@@ -0,0 +1,8 @@
+/* A minimal dynamic i386 executable: its loader must expand LD_PRELOAD
+   correctly, then this entry point exits without depending on 32-bit libc. */
+__attribute__((noreturn)) void _start(void)
+{
+    __asm__ volatile("movl $1, %%eax\n\txorl %%ebx, %%ebx\n\tint $0x80"
+                     : : : "eax", "ebx", "memory");
+    __builtin_unreachable();
+}

package/docker/install/wine-signal/tests/signal-return.c

@@ -0,0 +1,47 @@
+#define _GNU_SOURCE
+#include <signal.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ucontext.h>
+#include <unistd.h>
+
+static int normalize;
+
+static void handler(int signal, siginfo_t *information, void *context)
+{
+    (void)signal;
+    (void)information;
+    unsigned char *state = (unsigned char *)((ucontext_t *)context)->uc_mcontext.fpregs;
+    uint32_t magic, extended_size;
+    uint64_t features;
+    memcpy(&magic, state + 464, sizeof(magic));
+    memcpy(&extended_size, state + 468, sizeof(extended_size));
+    if (magic != 0x46505853 || extended_size < 832) _exit(77);
+    memcpy(&features, state + 512, sizeof(features));
+    if ((features & 7) != 7) _exit(78);
+    features &= ~UINT64_C(4);
+    memcpy(state + 512, &features, sizeof(features));
+    if (normalize) {
+        /* An absent AVX component requests its initial, all-zero YMM-high state.
+           Store that state explicitly before marking the component present. */
+        memset(state + 576, 0, 256);
+        features |= 4;
+        memcpy(state + 512, &features, sizeof(features));
+    }
+    ssize_t ignored = write(STDOUT_FILENO,
+        normalize ? "Returning features 7\n" : "Returning features 3\n", 21);
+    (void)ignored;
+}
+
+int main(int argc, char **argv)
+{
+    (void)argv;
+    normalize = argc > 1;
+    struct sigaction action = { .sa_sigaction = handler, .sa_flags = SA_SIGINFO };
+    sigemptyset(&action.sa_mask);
+    if (sigaction(SIGUSR1, &action, NULL) || raise(SIGUSR1)) return 1;
+    puts("Signal returned: PASS");
+    return 0;
+}

package/docker/install/wine-signal/wine

@@ -0,0 +1,4 @@
+#!/bin/sh
+# The dynamic loader selects the matching library for each Wine process.
+export LD_PRELOAD='/opt/tsplc-wine-compat/$LIB/signal-state.so'"${LD_PRELOAD:+:$LD_PRELOAD}"
+exec /opt/wine-devel/bin/wine "$@"

package/docker/runner.ts

@@ -0,0 +1,131 @@
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { z } from "zod";
+import { buildFiles, publishBuild } from "../src/artifacts";
+import { buildInContainer } from "../src/build";
+import { resolveContainerConfig } from "./config.ts";
+import { runControllerSession } from "../src/controller-session";
+import { createCodesysWorker, withWorkerShutdown } from "../src/host/codesys-worker";
+import { buildFailureFile, describeBuildFailure } from "../src/diagnostics.ts";
+
+const { values, positionals } = parseArgs({
+  args: process.argv.slice(2),
+  allowPositionals: true,
+  options: {
+    config: { type: "string" },
+    request: { type: "string" },
+    job: { type: "string" },
+    help: { type: "boolean", short: "h" },
+    "image-id": { type: "string" },
+    "operation-id": { type: "string" },
+    "initialize-user": { type: "boolean" },
+    read: { type: "string" },
+  },
+});
+if (values.help || (!positionals.length && !values.request && !values.job)) {
+  console.log(
+    "codesys-build build|download|online-change|inspect [--config codesys-build.config.ts]\n\nDocker contains Bun, Wine and CODESYS 3.5.22.30. Outputs are written to the configured outDir.",
+  );
+  process.exit(0);
+}
+if (
+  positionals.length &&
+  (positionals.length !== 1 ||
+    !["build", "download", "online-change", "inspect"].includes(positionals[0] ?? ""))
+) {
+  throw new Error("The builder container supports build, download, online-change and inspect.");
+}
+const configFile = resolve(values.config ?? "codesys-build.config.ts");
+const inputFile = values.job ?? values.request;
+const input = inputFile
+  ? JSON.parse(await readFile(inputFile, "utf8"))
+  : z
+      .object({ config: z.record(z.string(), z.unknown()) })
+      .parse(await import(pathToFileURL(configFile).href)).config;
+// Host installation paths never enter Wine inside this container.
+const config = resolveContainerConfig(input, configFile);
+const directory = resolve(config.outDir, ".codesys/docker");
+const operation = positionals[0] ?? "build";
+await mkdir(directory, { recursive: true });
+
+if (!values.job) {
+  const request = "/tmp/codesys-job-config.json";
+  await writeFile(
+    request,
+    JSON.stringify({ ...config, configFile: undefined, codesys: undefined }),
+  );
+  const child = Bun.spawn(
+    [
+      "flock",
+      "--nonblock",
+      "--conflict-exit-code",
+      "73",
+      resolve(directory, "command.lock"),
+      process.execPath,
+      import.meta.path,
+      "--job",
+      request,
+      operation,
+      ...(values["image-id"] ? ["--image-id", values["image-id"]] : []),
+      ...(values["operation-id"] ? ["--operation-id", values["operation-id"]] : []),
+      ...(values["initialize-user"] ? ["--initialize-user"] : []),
+      ...(values.read ? ["--read", values.read] : []),
+    ],
+    { stdin: "inherit", stdout: "inherit", stderr: "inherit" },
+  );
+  const code = await child.exited;
+  if (code === 73) {
+    console.error(`Another Docker command is using ${config.outDir}`);
+  }
+  process.exit(code);
+}
+
+if (operation !== "build") {
+  const imageId = z
+    .string()
+    .regex(/^sha256:[a-f0-9]{64}$/)
+    .parse(values["image-id"]);
+  const operationId = z.string().uuid().parse(values["operation-id"]);
+  const read = z.array(z.string().nonempty()).parse(JSON.parse(values.read ?? "[]"));
+  await runControllerSession(
+    config,
+    z.enum(["download", "online-change", "inspect"]).parse(operation),
+    {
+      imageId,
+      operationId,
+      read,
+      initializeUser: values["initialize-user"],
+    },
+  );
+  console.log(`Completed ${operation}. Controller state: ${config.outDir}/.codesys/controller`);
+  process.exit(0);
+}
+
+await rm(resolve(config.outDir, buildFiles.receipt), { force: true });
+const jobConfig = { ...config, outDir: resolve(directory, "job") };
+// PIDs from a previous container cannot identify processes in this job.
+await rm(resolve(jobConfig.outDir, ".codesys/session.json"), { force: true });
+await rm(resolve(jobConfig.outDir, ".codesys/command.lock"), { force: true });
+const operationId = z.uuid().parse(values["operation-id"] ?? randomUUID());
+// A worker crash must not publish a receipt that another command can deploy.
+try {
+  const result = await withWorkerShutdown(jobConfig, createCodesysWorker(jobConfig), () =>
+    buildInContainer(jobConfig),
+  );
+  await publishBuild(result, config.outDir);
+  console.log(`Completed build. Artifacts: ${config.outDir}`);
+} catch (cause) {
+  try {
+    await writeFile(
+      resolve(config.outDir, buildFailureFile),
+      JSON.stringify({ operationId, ...describeBuildFailure(cause) }, null, 2),
+    );
+  } catch (metadataError) {
+    // The original compiler/worker failure still determines the container exit status.
+    console.error("Could not save CODESYS failure metadata", metadataError);
+  }
+  throw cause;
+}

package/package.json

@@ -1,6 +1,55 @@
 {
   "name": "@tsplc/build",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "license": "MIT",
+  "description": "Build tsPLC and Structured Text projects with CODESYS in Docker: library installs, compilation, runtime download and online changes.",
+  "keywords": [
+    "plc",
+    "codesys",
+    "docker",
+    "structured-text"
+  ],
+  "homepage": "https://github.com/livingforjesus/tsplc#readme",
+  "bugs": "https://github.com/livingforjesus/tsplc/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/livingforjesus/tsplc.git",
+    "directory": "packages/build"
+  },
+  "version": "0.1.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "bun": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./libraries": {
+      "types": "./src/libraries.ts",
+      "bun": "./src/libraries.ts",
+      "default": "./dist/libraries.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "python",
+    "docker",
+    "runtime",
+    "!**/*.test.ts",
+    "!**/__tests__/**"
+  ],
+  "engines": {
+    "bun": ">=1.4.3"
+  },
+  "dependencies": {
+    "zod": "4.3.6",
+    "@tsplc/config": "0.1.0",
+    "@tsplc/typegen": "0.1.0"
+  },
+  "bin": {
+    "tsplc-build": "./dist/cli.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}