@xemahq/repo-build-tooling 0.25.0 → 0.26.0

package/src/composed-image-prebuilt-dockerfile.mjs

@@ -1,333 +1,136 @@
 // `xema-composed-image dockerfile --prebuilt --write|--check`: renders
-// `<image-dir>/Dockerfile` AND `<image-dir>/Dockerfile.dockerignore` for the image that
-// is ASSEMBLED from build outputs made on the CI runner (`xema-composed-image stage`).
-// Docker compiles nothing. The full-build template (`composed-image-dockerfile.mjs`)
+// `<image-dir>/Dockerfile` AND `<image-dir>/Dockerfile.dockerignore` for the image that is
+// COPIED from a tree the CI runner staged (`xema-composed-image stage`). Docker installs nothing,
+// compiles nothing and reaches no network. The full-build template (`composed-image-dockerfile.mjs`)
 // stays available for repositories that still build inside Docker.
-import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, posix } from 'node:path';
 
-import { COMPOSED_IMAGE_DIR, IN_IMAGE_ENTRY } from './composed-image-paths.mjs';
+import { COMPOSED_IMAGE_DIR, COMPOSED_MANIFEST_FILE, IN_IMAGE_ENTRY, NODE_MAJOR_LABEL, PROOF_DIRECTORY, STAGE_APP_LAYER, STAGE_PROOF_DIRECTORY, STAGE_STORE_LAYER, VERIFIED_IMAGE_FILE } from './composed-image-paths.mjs';
 import { toolVersion } from './composed-image-stage.mjs';
-import { npmrcUsesToken } from './composed-image-dockerfile.mjs';
-import { IGNORED_DIRECTORIES, IGNORED_FILE_PATTERNS, packageSources } from './composed-image-package-files.mjs';
-import { memberClosure, memberFilters, memberManifests } from './composed-image-members.mjs';
-import { needsPrismaSchemaEngine } from './composed-image-prisma-engine.mjs';
+import { IGNORED_DIRECTORIES, IGNORED_FILE_PATTERNS } from './composed-image-package-files.mjs';
+import { memberFilters } from './composed-image-members.mjs';
+import { CONTEXT_DIRECTORY, rootBuildInputNames } from './staged-image-proof.mjs';
 
 export const DEFAULT_STAGE_DIR = '.xema-stage';
 const DIRECTORY = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*\/?$/;
-const CACHE_ID = /^[a-z0-9][a-z0-9-]*$/;
 const REPOSITORY = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/;
 const DIGEST_REFERENCE = /^[a-z0-9][a-z0-9._/-]*(:[A-Za-z0-9._-]+)?@sha256:[0-9a-f]{64}$/;
+/** The image label that carries the repository its member index names; the stage reads it back from the committed Dockerfile. */
+export const BUILD_SOURCE_LABEL = 'dev.xema.composed-image.build-source';
+/** Where the proof stage puts the `--copy` directories, so the build context's bytes are what the stage hashed. */
+const COPIED_DIRECTORY = `${PROOF_DIRECTORY}/copied`;
 
-function validate({ copy, cacheId, buildSource, stageDir, base }) {
+const NODE_MAJOR = /^[1-9][0-9]*$/;
+
+function validate({ copy, buildSource, stageDir, base, nodeMajor }) {
+  if (!NODE_MAJOR.test(nodeMajor ?? '')) throw new Error(`--node-major must be the Node major of the --base image (e.g. 22), got "${nodeMajor}"`);
   if (!DIGEST_REFERENCE.test(base ?? '')) throw new Error(`--base must be an image reference pinned by digest (<ref>@sha256:<64 hex>), got "${base}"`);
   for (const directory of [...(copy ?? []), stageDir]) {
     if (!DIRECTORY.test(directory) || directory.startsWith('/') || directory.split('/').includes('..')) {
       throw new Error(`"${directory}" is not a repository-relative directory`);
     }
   }
-  if (!CACHE_ID.test(cacheId ?? '')) throw new Error(`--cache-id must be lowercase [a-z0-9-], got "${cacheId}"`);
   if (!REPOSITORY.test(buildSource ?? '')) throw new Error(`--build-source must name a repository, got "${buildSource}"`);
 }
 
-/** The ignore file: the build context carries sources, never local build output, except the staged outputs. */
+/** The ignore file: the build context carries sources, never local build output, except the staged tree. */
 export function renderPrebuiltDockerignore({ stageDir = DEFAULT_STAGE_DIR } = {}) {
   return `# @generated by \`xema-composed-image dockerfile --prebuilt --write\` — DO NOT EDIT.
-# Local build output stays out of the context; the staged outputs carry dist and node_modules/.prisma paths, so they are re-included LAST.
+# Local build output stays out of the context; the staged tree carries dist and node_modules paths, so it is re-included LAST.
 .git
 ${[...IGNORED_DIRECTORIES.map((d) => `**/${d}`), ...IGNORED_FILE_PATTERNS.map((p) => `**/${p}`)].join('\n')}
 !${stageDir}/**
 `;
 }
 
-/** The `onlyBuiltDependencies:` items of a `pnpm-workspace.yaml` text (block list; comments skipped; ends at the next top-level key). */
-export function onlyBuiltDependencies(workspaceYaml) {
-  const names = [];
-  let inList = false;
-  for (const line of workspaceYaml.split('\n')) {
-    if (!inList) {
-      inList = /^onlyBuiltDependencies:\s*(#.*)?$/.test(line);
-      continue;
-    }
-    if (/^\s*(#.*)?$/.test(line)) continue;
-    if (/^\S/.test(line)) break;
-    const item = /^\s+-\s+(?:'([^']*)'|"([^"]*)"|([^\s#]+))\s*(?:#.*)?$/.exec(line);
-    if (item === null) throw new Error(`pnpm-workspace.yaml: cannot read onlyBuiltDependencies item "${line.trim()}"`);
-    names.push(item[1] ?? item[2] ?? item[3]);
-  }
-  for (const name of names) {
-    if (!/^[@A-Za-z0-9._/-]+$/.test(name)) throw new Error(`pnpm-workspace.yaml: onlyBuiltDependencies "${name}" is not a package name`);
-  }
-  return names;
-}
-
-/** The install-flag word the rendered RUN keeps as a shell variable; `injectFlags()` is what it expands to. */
-export const INJECT_TOKEN = '${INJECT}';
-export const injectFlags = () => ['--config.inject-workspace-packages=true', '--config.dedupe-injected-deps=false'];
-
-/**
- * The deps stage's `--lockfile-only` resolve, as words (`INJECT_TOKEN` stands for `injectFlags()`).
- * The image runs it `--offline` against the metadata cache `pnpm-context --image-dir` warmed; the warm-up
- * runs the SAME words with `--prefer-offline` (`offline: false`). Both read THIS function, so the metadata
- * the context holds is exactly what the image resolves.
- */
-export const lockfileOnlyWords = (filters, { offline = true } = {}) =>
-  ['pnpm', 'install', '--lockfile-only', offline ? '--offline' : '--prefer-offline', INJECT_TOKEN, ...filters];
-/** The same command with the inject words expanded: `[file, ...args]`. `offline: false` is the cache warm-up form. */
-export const lockfileOnlyCommand = (filters, options) => lockfileOnlyWords(filters, options).flatMap((w) => (w === INJECT_TOKEN ? injectFlags() : [w]));
-
-/** The line that brings one `--copy` directory into the deps stage; `depsCopyDirs` is its inverse (pnpm-context reads the directories back from the committed Dockerfile). */
-const copyLine = (directory) => `COPY ${directory} ./${directory}`;
-export function depsCopyDirs(dockerfileText) {
-  const deps = /^FROM base AS deps\n([\s\S]*?)^COPY --parents/m.exec(dockerfileText);
-  if (deps === null) throw new Error('the Dockerfile has no deps stage with COPY --parents — render it: xema-composed-image dockerfile --prebuilt --write');
-  return [...deps[1].matchAll(/^COPY (\S+\/) \.\/\1$/gm)].map((m) => m[1]);
-}
-
-/** Build-script dependencies the image never runs: Prisma 7 with the pg adapter ships no engine (migrations run in-app), the rest are JS or fetch nothing the image needs. */
-export const REBUILD_EXCLUDED = Object.freeze(['prisma', '@prisma/client', '@prisma/engines', '@nestjs/core', 'esbuild', '@swc/core']);
-
-/**
- * The `onlyBuiltDependencies` the image must still `pnpm rebuild`: those in the members' PROD closure
- * (`prodPackages`: `[{ name, dir }]`) less `REBUILD_EXCLUDED`. A module that needs `node-gyp` (a `binding.gyp`
- * and no optional prebuilt packages) cannot be built here (the install is offline, `--ignore-scripts`, and the base
- * has no toolchain), so it is refused: build it on a runner of the target arch and stage the `.node` files.
- */
-export function rebuildList({ built, prodPackages }) {
-  const present = new Map(prodPackages.map((p) => [p.name, p.dir]));
-  const names = built.filter((name) => !REBUILD_EXCLUDED.includes(name) && present.has(name));
-  for (const name of names) {
-    const dir = present.get(name);
-    let optional = 0;
-    try {
-      optional = Object.keys(JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).optionalDependencies ?? {}).length;
-    } catch {
-      /* unreadable manifest: judged by binding.gyp alone */
-    }
-    if (existsSync(join(dir, 'binding.gyp')) && optional === 0) {
-      throw new Error(
-        `${name} needs node-gyp (binding.gyp, no optional prebuilt packages) and no native artifact is staged for it: ` +
-          'the prebuilt composed image installs offline with --ignore-scripts and has no toolchain. ' +
-          'Build it on a runner of each target arch (the arm runner for arm64) and stage the .node files; see the arm64 native-artifact note in composed-image-prebuilt-dockerfile.mjs. Refusing to render.',
-      );
-    }
-  }
-  return names;
-}
-
-const defaultExec = (file, args, { cwd }) => execFileSync(file, args, { cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
-
-/** `[{ name, dir }]` for every installed package in the members' prod closure (`pnpm ls --prod --parseable`); needs `pnpm install` to have run. */
-export function memberProdPackages({ root = process.cwd(), imageDir = COMPOSED_IMAGE_DIR, exec = defaultExec } = {}) {
-  const words = memberFilters({ root, imageDir }).flatMap((f) => f.split(' '));
-  const listing = exec('pnpm', ['ls', '-r', '--prod', '--depth', 'Infinity', '--parseable', ...words], { cwd: root });
-  const seen = new Map();
-  for (const line of listing.split('\n').map((l) => l.trim()).filter(Boolean)) {
-    if (!line.includes('node_modules')) continue; // workspace packages themselves
-    let dir;
-    try {
-      dir = realpathSync(line);
-      const name = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).name;
-      if (typeof name === 'string') seen.set(name, dir);
-    } catch {
-      /* not an installed package directory */
-    }
-  }
-  if (seen.size === 0) throw new Error('pnpm ls --prod listed no installed package: run pnpm install --frozen-lockfile before rendering the prebuilt Dockerfile');
-  return [...seen].map(([name, dir]) => ({ name, dir }));
-}
-
-/** Where the deps stage bind-mounts `<stage dir>/prisma-engines` (`<enginesVersion>/schema-engine-<binaryTarget>`). */
-const PRISMA_ENGINES_MOUNT = '/xema-prisma-engines';
+const normalizedCopy = (copy) => [...new Set(copy.map((d) => posix.normalize(`${d}/`)))];
+const copyLine = (directory) => `COPY ${directory} /${COPIED_DIRECTORY}/${directory}`;
 
-/**
- * The deps-stage step that puts the Prisma schema engine where Prisma looks, rendered only when the
- * prod closure carries the prisma CLI (the one thing that runs the engine). It runs in DEPS so the
- * engine lands in `node_modules/.pnpm/@prisma+engines@<v>/node_modules/@prisma/engines/`, which the
- * final stage takes from deps (layer 1); assemble's copy excludes the .pnpm store.
- */
-function prismaSchemaEngineStep({ toolMount, node, stageDir }) {
-  return `
-# The Prisma SCHEMA ENGINE for this image's platform. \`prisma migrate deploy\` runs it (the
-# Rust-free client does not replace it), and the prisma CLI downloads it into @prisma/engines
-# at RUNTIME when it is missing, which the read-only, non-root container refuses. The install
-# above is --ignore-scripts, so @prisma/engines' postinstall never fetched it. The runner
-# staged it for every image platform at the lockfile's engines version (Prisma's downloader,
-# sha256-checked) in \`${stageDir}/prisma-engines/\`; this copies the one for the platform
-# Prisma computes HERE into each @prisma/engines a prisma CLI resolves, and fails the build
-# unless it runs and reports that version. Here in deps, so the final stage carries it.
-RUN --network=none ${toolMount} \\
-  --mount=type=bind,source=${stageDir}/prisma-engines,target=${PRISMA_ENGINES_MOUNT} \\
-  node ${node} prisma-schema-engine ${PRISMA_ENGINES_MOUNT}
-`;
+/** What the stage reads back from the committed Dockerfile, so the stage and the render have one definition: the `--copy` directories and the build source. */
+export function parseRenderedDockerfile(dockerfileText) {
+  const copy = [...dockerfileText.matchAll(new RegExp(`^COPY (\\S+/) /${COPIED_DIRECTORY}/\\1$`, 'gm'))].map((m) => m[1]);
+  const buildSource = new RegExp(`^LABEL ${BUILD_SOURCE_LABEL.replaceAll('.', '\\.')}="([^"]+)"$`, 'm').exec(dockerfileText)?.[1];
+  if (buildSource === undefined) throw new Error('the Dockerfile carries no build-source label — render it: xema-composed-image dockerfile --prebuilt --write');
+  return { copy, buildSource };
 }
 
-const parts = (sources) => sources.map((source) => `    ${source} \\`).join('\n');
-
-/** The prebuilt Dockerfile text. The closure and the members' literal filters are derived from `root` (`memberClosure`); `exec` is injectable for tests. */
-export function renderPrebuiltDockerfile({
-  root = process.cwd(),
-  imageDir = COMPOSED_IMAGE_DIR,
-  copy = [],
-  cacheId,
-  buildSource,
-  usesToken,
-  stageDir = DEFAULT_STAGE_DIR,
-  base,
-  exec,
-  prodPackages = [],
-}) {
-  if (typeof usesToken !== 'boolean') throw new Error('usesToken must be a boolean derived from .npmrc');
-  validate({ copy, cacheId, buildSource, stageDir, base });
+/** The prebuilt Dockerfile text. The members' literal filters and the root build inputs are derived from `root`. */
+export function renderPrebuiltDockerfile({ root = process.cwd(), imageDir = COMPOSED_IMAGE_DIR, copy = [], buildSource, stageDir = DEFAULT_STAGE_DIR, base, nodeMajor }) {
+  validate({ copy, buildSource, stageDir, base, nodeMajor });
   const toolingVersion = toolVersion();
-  const workspaceFile = join(root, 'pnpm-workspace.yaml');
-  const built = existsSync(workspaceFile) ? onlyBuiltDependencies(readFileSync(workspaceFile, 'utf8')) : [];
-  if (built.length === 0) {
-    throw new Error('pnpm-workspace.yaml has no onlyBuiltDependencies: — `pnpm rebuild` would have nothing to build; refusing to render');
-  }
-  const closure = memberClosure({ root, imageDir, exec });
-  const rebuild = rebuildList({ built, prodPackages });
   const filters = memberFilters({ root, imageDir }).join(' ');
-  const manifests = memberManifests({ root, imageDir });
+  const rootInputs = rootBuildInputNames(root);
   const dirFlag = imageDir === COMPOSED_IMAGE_DIR ? '' : ` --image-dir ${imageDir}`;
   const toolDir = '/opt/xema-composed-image';
   const toolMount = `--mount=type=bind,source=${stageDir}/tool,target=${toolDir}`;
   const node = `${toolDir}/${IN_IMAGE_ENTRY}`;
-  const store = '--mount=type=bind,from=xema-pnpm-store,target=/root/.pnpm-store,rw';
-  const metadata = '--mount=type=bind,from=xema-pnpm,source=cache,target=/root/.cache/pnpm,rw';
-  const secret = usesToken ? '  --mount=type=secret,id=npm_token,required=true \\\n' : '';
-  const tokenExport = usesToken
-    ? 'export NPM_TOKEN="$(cat /run/secrets/npm_token)" && export GH_PACKAGES_TOKEN="$NPM_TOKEN" && \\\n  '
-    : '';
-  const copies = [...new Set(copy.map((d) => posix.normalize(`${d}/`)))].map(copyLine).join('\n');
-  const manifestSources = closure.map((directory) => `${directory}/package.json`);
-  const assembleSources = [...closure.flatMap((directory) => packageSources({ root, directory })), ...manifests];
-  const imageCopy = posix.normalize(`${imageDir}/`);
-  const text = `# @generated by \`xema-composed-image dockerfile --prebuilt --write\` (@xemahq/repo-build-tooling@${toolingVersion}) — DO NOT EDIT.
+  const copies = normalizedCopy(copy).map(copyLine).join('\n');
+  const layers = `COPY ${stageDir}/${STAGE_STORE_LAYER}/ /\nCOPY ${stageDir}/${STAGE_APP_LAYER}/ /`;
+  const dockerfile = `# @generated by \`xema-composed-image dockerfile --prebuilt --write\` (@xemahq/repo-build-tooling@${toolingVersion}) — DO NOT EDIT.
 # Re-render with the same options; \`--check\` refuses a stale file (and a stale Dockerfile.dockerignore).
 #
-# The COMPOSED-PROCESS image of this repository, ASSEMBLED from build outputs: ONE image
-# per build (repository at commit), every member of \`image-build-inputs.json\` in ONE module
-# graph behind the SDK's \`xema-composed-process\` host. Docker compiles nothing. The CI
-# runner ran \`turbo run build prisma:generate\` for the members' closures and
-# \`xema-composed-image stage ${stageDir}\` gathered the outputs into the build-step
-# directory \`${stageDir}/\` (\`out/\` = dist and generated Prisma clients, pure JS/wasm;
-# \`tool/\` = this tool, bind-mounted into the steps below and never copied into a layer).
+# The COMPOSED-PROCESS image of this repository, COPIED from a tree the CI runner staged: ONE
+# image per build (repository at commit), every member of \`image-build-inputs.json\` in ONE module
+# graph behind the SDK's \`xema-composed-process\` host. Docker installs nothing, compiles nothing
+# and has no network. The runner built the members (\`turbo run build prisma:generate\`) and
+# \`xema-composed-image stage ${stageDir} --platform linux/<arch>\` produced, from the job's own
+# pnpm store, the production tree of the members' closures for that platform (the install, the
+# injected workspace packages, the member index, the Prisma clients and the platform's schema
+# engine) and wrote it to \`${stageDir}/${STAGE_STORE_LAYER}/\` (the \`.pnpm\` packages, stable until the lockfile changes) and
+# \`${stageDir}/${STAGE_APP_LAYER}/\` (everything else). \`${stageDir}/tool/\` is this tool, bind-mounted into the steps
+# below and never copied into a layer.
 #
 # Stages:
-#   deps      arch-native. Inputs are the lockfile and the closure's manifests ONLY, so the
-#             layer is cached until one of them changes. OFFLINE: every install RUN is
-#             \`--network=none\` and reads only the CI runner's pnpm store (\`xema-pnpm-store\`
-#             context), the packed pnpm and the warmed registry-metadata cache (\`xema-pnpm\`
-#             context, built by \`xema-composed-image pnpm-context --image-dir\`). corepack
-#             installs pnpm from that tarball, never from the network. Production install with
-#             the workspace packages INJECTED and \`--ignore-scripts\`. \`pnpm rebuild <names>\`
-#             runs only for \`onlyBuiltDependencies\` present in the members' PROD closure, less
-#             prisma, @prisma/client, @prisma/engines (Prisma 7 + pg adapter ships no engine and
-#             migrations run in-app), @nestjs/core, esbuild and @swc/core; when none is left the
-#             step is not rendered. The list is rendered, so a change makes \`--check\` stale.
-#   assemble  source of the closure + the staged outputs, the injected copies synced to
-#             their \`files\`, then the proofs on the target arch: Prisma clients run, the
-#             member index is written, every member loads ALONE as \`node\`, production.
-#   (final)   \`/monorepo\` of assemble, shipped as THREE layers so a commit that changes only
-#             members' code re-pushes only the layers that changed (see the final stage).
-#             Nothing of the tool ships.
-#
-# NATIVE MODULES. No prod-closure module needs node-gyp today. The renderer REFUSES to render when
-# one appears (a \`binding.gyp\` and no optional prebuilt packages) because this image installs with
-# --ignore-scripts and carries no compiler. The path then: build the module on a runner of EACH target
-# arch natively (the \`arm\` runner for arm64; no QEMU), in the digest-pinned bookworm node image with
-# --network=none and the image's node headers, stage \`native/<arch>/<pkg>/*.node\`, and COPY them from
-# \`native/\${TARGETARCH}/\` in the deps stage.
+#   proof  The staged tree and the repository's inputs meet. The root build inputs that decide the
+#          staged bytes are COPIED into \`/${PROOF_DIRECTORY}/${CONTEXT_DIRECTORY}/\` and the \`--copy\` directories into
+#          \`/${COPIED_DIRECTORY}/\`, which puts them in the image's content tag. \`prove\` refuses the build unless the
+#          stage was made at BUILD_SHA from exactly those bytes, with this tool, for this platform, and
+#          the literal \`--filter\` words below are the ones it staged. Then the Prisma clients run and every
+#          member loads ALONE as \`node\`, production, on the target arch.
+#   (final) the same two COPYs of the staged tree, plus the proof's verdict, so the image cannot exist without it.
 #
 # The \`--filter <package>...\` words below are LITERAL: the content hash of this image reads
 # them to narrow the lockfile to the members' closures.
-FROM scratch AS xema-pnpm
-FROM scratch AS xema-pnpm-store
-
 FROM ${base} AS base
-RUN corepack enable && \\
-    pnpm config set store-dir /root/.pnpm-store
 
-FROM base AS deps
-WORKDIR /monorepo
-ENV CI=true
-# corepack must not download pnpm: the packed tarball comes from the runner.
-ENV COREPACK_ENABLE_NETWORK=0
-# The runner's store is bind-mounted here. Set it for pnpm explicitly: the base layer's \`pnpm config set\` was
-# written by whatever pnpm corepack fetched then, and an offline resolve falls back to the store index.
-ENV npm_config_store_dir=/root/.pnpm-store
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
-${copies === '' ? '' : `${copies}\n`}COPY --parents \\
-${parts(manifestSources)}
-    ./
-RUN --network=none --mount=type=bind,from=xema-pnpm,target=/xema-pnpm \\
-  test -f /xema-pnpm/staged.json || { \\
-    echo "the prebuilt composed image needs --build-context xema-pnpm and xema-pnpm-store (CI only); render the full image (no --prebuilt) to build elsewhere" >&2; \\
-    exit 1; \\
-  } && corepack install -g /xema-pnpm/corepack/pnpm.tgz
-RUN --network=none ${store} \\
-  ${metadata} \\
-${secret}  ${toolMount} \\
-  ${tokenExport}INJECT="${injectFlags().join(' ')}" && \\
-  cp pnpm-lock.yaml /tmp/pnpm-lock.committed.yaml && \\
-  ${lockfileOnlyWords(filters.split(' ')).join(' ')} && \\
-  node ${node} pins${dirFlag} /tmp/pnpm-lock.committed.yaml && \\
-  pnpm install --prod --offline --ignore-scripts \${INJECT} ${filters} --frozen-lockfile${rebuild.length === 0 ? '' : ` && \\
-  pnpm rebuild ${rebuild.join(' ')} ${filters}`}
-${needsPrismaSchemaEngine(prodPackages) ? prismaSchemaEngineStep({ toolMount, node, stageDir }) : ''}
-FROM deps AS assemble
-COPY --parents \\
-${parts(assembleSources)}
-    ./
-COPY ${imageCopy} ./${imageCopy}
-COPY ${stageDir}/out/ ./
+FROM base AS proof
+WORKDIR /${PROOF_DIRECTORY}
 ARG BUILD_SHA
-RUN ${toolMount} \\
+COPY ${stageDir}/${STAGE_PROOF_DIRECTORY}/${COMPOSED_MANIFEST_FILE} /${PROOF_DIRECTORY}/
+COPY ${rootInputs.join(' ')} /${PROOF_DIRECTORY}/${CONTEXT_DIRECTORY}/
+${copies === '' ? '' : `${copies}\n`}${layers}
+RUN --network=none ${toolMount} \\
+  : "\${BUILD_SHA:?BUILD_SHA build-arg is required}" && \\
   T="node ${node}" && \\
-  $T sync-injected${dirFlag} && $T prisma-check${dirFlag} && \\
-  : "\${BUILD_SHA:?BUILD_SHA build-arg is required}" && $T index "\${BUILD_SHA}" --build-source ${buildSource}${dirFlag} && \\
-  cp ${toolDir}/src/composed-migrate.mjs /monorepo/xema-composed-migrate.mjs
+  $T prove /${PROOF_DIRECTORY} --root /monorepo --commit "\${BUILD_SHA}" ${filters}${dirFlag} && \\
+  $T prisma-check --root /monorepo${dirFlag}
 
 # Every member's module graph loads here, ALONE (one process each), through the host's own
 # entry reader, as the user and NODE_ENV the image runs with, or the image is never pushed.
 USER node
-RUN ${toolMount} \\
-  NODE_ENV=production node ${node} load --each${dirFlag}
+RUN --network=none ${toolMount} \\
+  NODE_ENV=production node ${node} load --each --root /monorepo${dirFlag}
 
-# The final stage is layered by how often each part changes, so a registry and a node
-# already holding the stable layers fetch only the rest. The three copies overlay to
-# exactly assemble's /monorepo (proven by a tree diff of both images).
-#   1 deps       root manifests, the external .pnpm store, and the injected stubs that hold
-#                only package.json. Stable while the lockfile and the closure's package.json
-#                files are unchanged.
-#   2 assemble   members, dist, Prisma clients, member index, migrate script: everything
-#                but the .pnpm store, whose packages layer 1 already carries.
-#   3 injected   the workspace copies \`node_modules/.pnpm/*@file+*\`: \`sync-injected\` fills
-#                them from the members' files, so they change with every commit. \`--parents\`
-#                keeps their paths under /.
 FROM base
 WORKDIR /monorepo
-COPY --from=deps /monorepo /monorepo
-COPY --from=assemble --exclude=node_modules/.pnpm /monorepo /monorepo
-COPY --from=assemble --parents /monorepo/node_modules/.pnpm/*@file+* /
+LABEL ${NODE_MAJOR_LABEL}="${nodeMajor}"
+${layers}
+COPY --from=proof /${PROOF_DIRECTORY}/${VERIFIED_IMAGE_FILE} /monorepo/${VERIFIED_IMAGE_FILE}
+LABEL ${BUILD_SOURCE_LABEL}="${buildSource}"
 ENV NODE_ENV=production
 # Set by the IMAGE, never by a deployment (kernel \`COMPOSED_PROCESS_ENV.MemberIndex\`).
 ENV XEMA_COMPOSED_MEMBER_INDEX=/monorepo/xema-composed-member-index.json
 USER node
 CMD ["node", "/monorepo/xema-composed-process"]
 `;
-  return { dockerfile: text, dockerignore: renderPrebuiltDockerignore({ stageDir }), closure };
+  return { dockerfile, dockerignore: renderPrebuiltDockerignore({ stageDir }) };
 }
 
 /** `--write` writes both files; `--check` throws when either differs. */
-export function syncPrebuiltDockerfile({ mode, root = process.cwd(), imageDir = COMPOSED_IMAGE_DIR, exec, ...options }) {
+export function syncPrebuiltDockerfile({ mode, root = process.cwd(), imageDir = COMPOSED_IMAGE_DIR, ...options }) {
   if (mode !== 'write' && mode !== 'check') throw new Error(`mode must be write or check, got "${mode}"`);
-  const npmrc = join(root, '.npmrc');
-  if (!existsSync(npmrc)) throw new Error(`${npmrc} is absent — the Dockerfile copies it and its token use decides the build secret`);
-  const prodPackages = options.prodPackages ?? memberProdPackages({ root, imageDir, exec });
-  const { dockerfile, dockerignore } = renderPrebuiltDockerfile({ ...options, root, imageDir, exec, prodPackages, usesToken: npmrcUsesToken(readFileSync(npmrc, 'utf8')) });
+  const { dockerfile, dockerignore } = renderPrebuiltDockerfile({ ...options, root, imageDir });
   const files = [
     [posix.join(imageDir, 'Dockerfile'), dockerfile],
     [posix.join(imageDir, 'Dockerfile.dockerignore'), dockerignore],