@xemahq/repo-build-tooling 0.26.4 → 0.26.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.26.4",
+  "version": "0.26.5",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM, depending only on @xemahq/release-policy for registry access, so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -54,6 +54,6 @@
     "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-stage-tree.test.mjs && node --test src/composed-image-install.test.mjs && node --test src/composed-image-proof.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-image-prisma-engine.test.mjs && node --test src/composed-migrate.test.mjs && node --test src/promote-image.test.mjs && node --test src/arm64-supplement-needed.test.mjs && node --test src/prepush-sanity.test.mjs && node --test src/service-image.test.mjs && node --test src/install-git-hooks.test.mjs && node --test src/image-cpu-arch.test.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:c6b72c65876d81f6a2548bb6da641b908eccb57c9a6ecaa435e31da9b237d75e"
+    "sourceDigest": "sha256:f0df75e0b53e7d061fca29cca85baadc3e8d20ac245220164fe16d5e3f051adc"
   }
 }

package/src/composed-image-install.mjs

@@ -10,7 +10,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import { assertPinsUnchanged } from './composed-image-in-image.mjs';
-import { nodeArch } from './service-image-platform.mjs';
+import { pruneForeignLibcPackages } from './prune-foreign-libc.mjs';
+import { libcOf, nodeArch } from './service-image-platform.mjs';
 
 /** The install-flag words that make pnpm copy workspace packages into the store layout. */
 export const injectFlags = () => ['--config.inject-workspace-packages=true', '--config.dedupe-injected-deps=false'];
@@ -27,7 +28,7 @@ export const lockfileOnlyCommand = (filters) => ['pnpm', 'install', '--lockfile-
 /** The production install for `filters` on `linux/<arch>` as `[file, ...args]`. */
 export const productionInstallCommand = (filters, arch) => [
   'pnpm', 'install', '--prod', '--offline', '--ignore-scripts', ...injectFlags(), ...filters, '--frozen-lockfile',
-  '--os=linux', `--cpu=${nodeArch(arch)}`, '--libc=glibc',
+  '--os=linux', `--cpu=${nodeArch(arch)}`, `--libc=${libcOf(arch)}`,
 ];
 
 const defaultExec = (file, args, { cwd }) => execFileSync(file, args, { cwd, stdio: 'inherit' });
@@ -47,6 +48,8 @@ export function installClosure({ treeRoot, filters, arch, exec = defaultExec })
     assertPinsUnchanged({ root: treeRoot, committedLockfile: committed });
     const [installFile, ...installArgs] = productionInstallCommand(filters, arch);
     exec(installFile, installArgs, { cwd: treeRoot });
+    // pnpm 10.33 frozen offline install does not filter by libc; cpu/os do.
+    pruneForeignLibcPackages(treeRoot, libcOf(arch));
   } finally {
     rmSync(scratch, { recursive: true, force: true });
   }

package/src/image-cpu-arch.test.mjs

@@ -2,13 +2,14 @@
 // optional x64 binary, so an amd64 image lost its @swc/core binding.
 import assert from 'node:assert/strict';
 import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
 import { injectFlags, productionInstallCommand } from './composed-image-install.mjs';
 import { deployArgs } from './service-image-stage.mjs';
-import { nodeArch } from './service-image-platform.mjs';
+import { pruneForeignLibcPackages } from './prune-foreign-libc.mjs';
+import { libcOf, nodeArch } from './service-image-platform.mjs';
 
 test('nodeArch maps amd64 to x64 and arm64 to arm64, and refuses an arch with no row', () => {
   assert.equal(nodeArch('amd64'), 'x64');
@@ -38,8 +39,9 @@ test('an amd64 stage installs @swc/core-linux-x64-gnu and no arm64 binding; arm6
   t.after(() => rmSync(dir, { recursive: true, force: true }));
   const x64 = fixturePackage(dir, '@swc/core-linux-x64-gnu', { os: ['linux'], cpu: ['x64'], libc: ['glibc'] });
   const arm64 = fixturePackage(dir, '@swc/core-linux-arm64-gnu', { os: ['linux'], cpu: ['arm64'], libc: ['glibc'] });
+  const x64musl = fixturePackage(dir, '@swc/core-linux-x64-musl', { os: ['linux'], cpu: ['x64'], libc: ['musl'] });
   const core = fixturePackage(dir, '@swc/core', {
-    optionalDependencies: { '@swc/core-linux-x64-gnu': `file:${x64}`, '@swc/core-linux-arm64-gnu': `file:${arm64}` },
+    optionalDependencies: { '@swc/core-linux-x64-gnu': `file:${x64}`, '@swc/core-linux-x64-musl': `file:${x64musl}`, '@swc/core-linux-arm64-gnu': `file:${arm64}` },
   });
   const store = join(dir, 'store');
   const env = { ...process.env, npm_config_store_dir: store };
@@ -51,17 +53,73 @@ test('an amd64 stage installs @swc/core-linux-x64-gnu and no arm64 binding; arm6
     }
   };
   for (const arch of ['amd64', 'arm64']) {
+    const manifest = JSON.stringify({ name: 'app', version: '1.0.0', dependencies: { '@swc/core': `file:${core}` } });
+    // Prime from a SEPARATE directory so the project under test carries no install state recording libc=*.
+    const prime = join(dir, `prime-${arch}`);
+    mkdirSync(prime);
+    writeFileSync(join(prime, 'package.json'), manifest);
+    // Resolve and fetch every platform's tarball into the store, as the real stage's committed lockfile and primed store do.
+    run(prime, ['install', '--ignore-workspace', '--ignore-scripts', ...injectFlags(), '--force', '--config.supported-architectures.cpu=*', '--config.supported-architectures.os=*', '--config.supported-architectures.libc=*']);
     const app = join(dir, `app-${arch}`);
     mkdirSync(app);
-    writeFileSync(join(app, 'package.json'), JSON.stringify({ name: 'app', version: '1.0.0', dependencies: { '@swc/core': `file:${core}` } }));
-    // Resolve and fetch every platform's tarball into the store, as the real stage's committed lockfile and primed store do.
-    run(app, ['install', '--ignore-workspace', '--ignore-scripts', ...injectFlags(), '--force', '--config.supported-architectures.cpu=*', '--config.supported-architectures.os=*', '--config.supported-architectures.libc=*']);
-    rmSync(join(app, 'node_modules'), { recursive: true, force: true });
+    writeFileSync(join(app, 'package.json'), manifest);
+    copyFileSync(join(prime, 'pnpm-lock.yaml'), join(app, 'pnpm-lock.yaml'));
     const [file, ...args] = productionInstallCommand(['--ignore-workspace'], arch);
     run(app, args);
     assert.equal(file, 'pnpm');
+    // pnpm 10.33 frozen offline install does not filter by libc; cpu/os do. The prune is what keeps musl out.
+    pruneForeignLibcPackages(app, libcOf(arch), () => {});
     const present = (binding) => existsSync(join(app, 'node_modules', '.pnpm', 'node_modules', '@swc', binding));
     assert.equal(present('core-linux-x64-gnu'), arch === 'amd64', `${arch}: x64 binding`);
+    assert.equal(present('core-linux-x64-musl'), false, `${arch}: a glibc image stages no musl binding`);
     assert.equal(present('core-linux-arm64-gnu'), arch === 'arm64', `${arch}: arm64 binding`);
   }
 });
+
+test('libcOf reads the IMAGE_PLATFORMS row and refuses an unknown arch', () => {
+  assert.equal(libcOf('amd64'), 'glibc');
+  assert.throws(() => libcOf('riscv64'), /no libc for image arch 'riscv64'/);
+});
+
+// A hand-built pnpm layout: .pnpm/<entry>/node_modules/<name> is the package, siblings are links to dependencies.
+function layout(root, packages, links) {
+  for (const [entry, name, manifest] of packages) {
+    const dir = join(root, 'node_modules', '.pnpm', entry, 'node_modules', name);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, 'package.json'), JSON.stringify({ name, version: '1.0.0', ...manifest }));
+  }
+  for (const [from, name, toEntry, toName] of links) {
+    const linkDir = join(root, 'node_modules', '.pnpm', from, 'node_modules');
+    symlinkSync(join(root, 'node_modules', '.pnpm', toEntry, 'node_modules', toName), join(linkDir, name));
+  }
+}
+
+test('prune removes only packages declaring a foreign libc, with their links; a package without libc is untouched', (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'xema-prune-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  layout(root, [
+    ['core@1', 'core', { optionalDependencies: { gnu: '1', musl: '1' } }],
+    ['gnu@1', 'gnu', { libc: ['glibc'] }],
+    ['musl@1', 'musl', { libc: ['musl'] }],
+    ['plain@1', 'plain', {}],
+  ], [['core@1', 'gnu', 'gnu@1', 'gnu'], ['core@1', 'musl', 'musl@1', 'musl']]);
+  const lines = [];
+  assert.deepEqual(pruneForeignLibcPackages(root, 'glibc', (line) => lines.push(line)), ['musl@1']);
+  assert.equal(lines.length, 1);
+  const store = join(root, 'node_modules', '.pnpm');
+  assert.equal(existsSync(join(store, 'musl@1')), false);
+  assert.equal(lstatSync(join(store, 'core@1', 'node_modules', 'musl'), { throwIfNoEntry: false }), undefined);
+  for (const kept of ['gnu@1', 'plain@1', 'core@1']) assert.ok(existsSync(join(store, kept)), kept);
+  assert.ok(existsSync(join(store, 'core@1', 'node_modules', 'gnu', 'package.json')));
+});
+
+test('prune throws, naming both, when a kept package hard-depends on a pruned one', (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'xema-prune-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  layout(root, [
+    ['app@1', 'app', { dependencies: { musl: '1' } }],
+    ['musl@1', 'musl', { libc: ['musl'] }],
+  ], [['app@1', 'musl', 'musl@1', 'musl']]);
+  assert.throws(() => pruneForeignLibcPackages(root, 'glibc', () => {}), /app depends on musl/);
+  assert.ok(existsSync(join(root, 'node_modules', '.pnpm', 'musl@1')));
+});

package/src/prune-foreign-libc.mjs

@@ -0,0 +1,96 @@
+// pnpm 10.33's frozen offline install does not filter packages by `libc` (cpu and os it does), so a glibc image's
+// tree also holds the musl bindings (`@swc/core-linux-x64-musl`). This removes every package that DECLARES a `libc`
+// list without the target's, and the symlinks to it. A package with no `libc` field is never touched.
+// Upstream: no pnpm issue found 2026-10-17 that tracks libc being ignored by supportedArchitectures/--libc in frozen
+// offline installs (nearest, not the same: pnpm/pnpm#11702, `pnpm add` on 11.1.2). Not fixed as of pnpm 10.33.
+// Delete this module at the first pnpm raise that filters libc (fixed in pnpm <version>).
+import { existsSync, lstatSync, readdirSync, readFileSync, readlinkSync, rmSync, unlinkSync } from 'node:fs';
+import { dirname, join, resolve, sep } from 'node:path';
+
+const readJson = (file) => JSON.parse(readFileSync(file, 'utf8'));
+const isDirectory = (path) => {
+  try {
+    return lstatSync(path).isDirectory();
+  } catch (error) {
+    if (error.code === 'ENOENT' || error.code === 'ENOTDIR') return false;
+    throw error;
+  }
+};
+
+/** The real (non-symlink) package directories under a `node_modules`, scoped ones included: `[{ name, dir }]`. */
+function realPackages(nodeModules) {
+  const found = [];
+  if (!isDirectory(nodeModules)) return found;
+  for (const entry of readdirSync(nodeModules)) {
+    const path = join(nodeModules, entry);
+    if (!isDirectory(path)) continue;
+    if (entry.startsWith('@')) {
+      for (const child of readdirSync(path)) if (isDirectory(join(path, child))) found.push({ name: `${entry}/${child}`, dir: join(path, child) });
+    } else {
+      found.push({ name: entry, dir: path });
+    }
+  }
+  return found;
+}
+
+/** Every symlink directly under `nodeModules` (scoped children included): absolute paths. */
+function symlinksIn(nodeModules) {
+  const links = [];
+  if (!isDirectory(nodeModules)) return links;
+  for (const entry of readdirSync(nodeModules)) {
+    const path = join(nodeModules, entry);
+    const stat = lstatSync(path);
+    if (stat.isSymbolicLink()) links.push(path);
+    else if (entry.startsWith('@') && stat.isDirectory()) {
+      for (const child of readdirSync(path)) if (lstatSync(join(path, child)).isSymbolicLink()) links.push(join(path, child));
+    }
+  }
+  return links;
+}
+
+/**
+ * Remove, under `<stagedRoot>/node_modules/.pnpm`, every package whose `libc` array lacks `libc`, with the symlinks
+ * to it. Throws, naming both, when a package that stays depends on a removed one non-optionally. Returns the removed
+ * `.pnpm` entry names, one log line each.
+ */
+export function pruneForeignLibcPackages(stagedRoot, libc, log = (line) => console.log(line)) {
+  const store = join(stagedRoot, 'node_modules', '.pnpm');
+  if (!isDirectory(store)) return [];
+  const removed = new Map(); // entry -> package name
+  const kept = [];
+  for (const entry of readdirSync(store)) {
+    const entryDir = join(store, entry);
+    if (entry === 'node_modules' || entry === 'lock.yaml' || !isDirectory(entryDir)) continue;
+    for (const { name, dir } of realPackages(join(entryDir, 'node_modules'))) {
+      const manifestFile = join(dir, 'package.json');
+      if (!existsSync(manifestFile)) continue;
+      const manifest = readJson(manifestFile);
+      // The entry's own package is the one whose directory is not a dependency link; a dependency's real dir lives in its own entry.
+      if (Array.isArray(manifest.libc) && !manifest.libc.includes(libc)) removed.set(entry, name);
+      else kept.push({ entry, name, manifest });
+    }
+  }
+  if (removed.size === 0) return [];
+  const removedNames = new Set(removed.values());
+  for (const { name, manifest } of kept) {
+    for (const dependency of Object.keys(manifest.dependencies ?? {})) {
+      if (removedNames.has(dependency)) {
+        throw new Error(`${name} depends on ${dependency} (not optionally), which declares a libc without '${libc}' and would be removed; refusing to break the image`);
+      }
+    }
+  }
+  const doomed = [...removed.keys()].map((entry) => join(store, entry) + sep);
+  const nodeModulesDirs = [join(stagedRoot, 'node_modules'), join(store, 'node_modules')];
+  for (const entry of readdirSync(store)) nodeModulesDirs.push(join(store, entry, 'node_modules'));
+  for (const directory of nodeModulesDirs) {
+    for (const link of symlinksIn(directory)) {
+      const target = resolve(dirname(link), readlinkSync(link)) + sep;
+      if (doomed.some((prefix) => target.startsWith(prefix))) unlinkSync(link);
+    }
+  }
+  for (const [entry, name] of removed) {
+    rmSync(join(store, entry), { recursive: true, force: true });
+    log(`pruned ${name} (.pnpm/${entry}): declares a libc without '${libc}'`);
+  }
+  return [...removed.keys()];
+}

package/src/service-image-platform.mjs

@@ -13,8 +13,8 @@ import { join } from 'node:path';
  * schema engine Prisma would not use.
  */
 export const IMAGE_PLATFORMS = Object.freeze({
-  amd64: Object.freeze({ node: 'x64', elfMachine: 62, prismaBinaryTarget: 'debian-openssl-3.0.x' }),
-  arm64: Object.freeze({ node: 'arm64', elfMachine: 183, prismaBinaryTarget: 'linux-arm64-openssl-3.0.x' }),
+  amd64: Object.freeze({ node: 'x64', libc: 'glibc', elfMachine: 62, prismaBinaryTarget: 'debian-openssl-3.0.x' }),
+  arm64: Object.freeze({ node: 'arm64', libc: 'glibc', elfMachine: 183, prismaBinaryTarget: 'linux-arm64-openssl-3.0.x' }),
 });
 
 /** The Node `process.arch` name of an image arch (`amd64` → `x64`): what pnpm's `--cpu` takes. Refuses an arch with no row. */
@@ -25,6 +25,14 @@ export function nodeArch(arch) {
   return IMAGE_PLATFORMS[arch].node;
 }
 
+/** The libc of an image arch's runtime base (glibc: node:22-bookworm-slim), from the same row as `nodeArch`. Refuses an arch with no row. */
+export function libcOf(arch) {
+  if (!Object.hasOwn(IMAGE_PLATFORMS, arch)) {
+    throw new Error(`no libc for image arch '${arch}'; known: ${Object.keys(IMAGE_PLATFORMS).join(', ')}`);
+  }
+  return IMAGE_PLATFORMS[arch].libc;
+}
+
 /** `linux/<arch>` → `<arch>`; refuses any platform this recipe does not build. */
 export function platformArch(platform) {
   const match = /^linux\/([a-z0-9]+)$/.exec(String(platform ?? ''));

package/src/service-image-stage.mjs

@@ -31,7 +31,8 @@ import { prismaEnginesDirectories } from './composed-image-prisma-engine.mjs';
 import { copyTool, toolVersion } from './composed-image-stage.mjs';
 import { MANIFEST_FILE, MANIFEST_SCHEMA } from './service-image-in-image.mjs';
 import { LOCKFILE, TOOL_NAME, rootBuildInputNames, sha256File } from './staged-image-proof.mjs';
-import { IMAGE_PLATFORMS, nodeArch, platformArch, scanNatives } from './service-image-platform.mjs';
+import { pruneForeignLibcPackages } from './prune-foreign-libc.mjs';
+import { IMAGE_PLATFORMS, libcOf, nodeArch, platformArch, scanNatives } from './service-image-platform.mjs';
 
 
 export const DEFAULT_STAGE_DIR = '.xema-stage';
@@ -49,7 +50,7 @@ export const deployArgs = ({ service, arch, destination }) => [
   '--ignore-scripts',
   '--os=linux',
   `--cpu=${nodeArch(arch)}`,
-  '--libc=glibc',
+  `--libc=${libcOf(arch)}`,
   '--config.force-legacy-deploy=false',
   '--config.inject-workspace-packages=true',
   '--config.dedupe-injected-deps=true',
@@ -249,6 +250,8 @@ export async function stageService({
   const appDir = join(serviceStage, APP_DIRECTORY);
   mkdirSync(serviceStage, { recursive: true });
   deploy(deployArgs({ service, arch, destination: resolve(appDir) }), root);
+  // pnpm 10.33 frozen offline install does not filter by libc; cpu/os do.
+  pruneForeignLibcPackages(appDir, libcOf(arch));
   if (!existsSync(join(appDir, 'dist', 'main.js'))) problems.push(`the deploy of ${service} has no dist/main.js: is dist excluded from the package's files?`);
 
   // A dependency whose build script matters would have to run on the target; this recipe runs none.