@xemahq/repo-build-tooling 0.31.0 → 0.31.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.31.0",
+  "version": "0.31.1",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM, depending only on @xemahq/release-policy for registry access, so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -53,6 +53,6 @@
     "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-class.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-stage-tree.test.mjs && node --test src/composed-image-install.test.mjs && node --test src/composed-image-proof.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-image-prisma-engine.test.mjs && node --test src/composed-migrate.test.mjs && node --test src/promote-image.test.mjs && node --test src/arm64-supplement-needed.test.mjs && node --test src/service-image.test.mjs && node --test src/image-cpu-arch.test.mjs && node --test src/staged-image-proof.test.mjs && node --test src/effective-input.test.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:724bdf902b48fed78564a3b6d52abb15d5ed2a6962da85e7a88f17eab1b085c2"
+    "sourceDigest": "sha256:a1e1068eca88fad502417b887f16c732ecf0c9ed0ca339849880ea780aa894d4"
   }
 }

package/src/composed-image-stage-tree.mjs

@@ -4,7 +4,9 @@
 //   <stage>/layers/store/monorepo/node_modules/.pnpm/   the registry packages (stable until the lockfile changes)
 //   <stage>/layers/workspace/monorepo/                  root manifests, the closure's package.json + declared `files` (the
 //                                    non-member built outputs among them), the injected workspace copies, the Prisma
-//                                    clients and engine, the migrate script
+//                                    clients and engine, the migrate script. No source tree: the `--copy` directories
+//                                    reach the install only as their workspace manifests (removed again unless the
+//                                    closure ships them), and their bytes reach only the proof stage (`/proof/copied`)
 //   <stage>/layers/dist/monorepo/    the members' build outputs (default `dist`), the member index and the host link: the
 //                                    only layer a commit that changes no dependency changes
 //
@@ -68,6 +70,41 @@ function copyPackageFiles({ root, treeRoot, closure, problems }) {
   }
 }
 
+/**
+ * The install's view of the `--copy` directories: every workspace `package.json` and `.patch` file under them (less what
+ * the `.dockerignore` keeps out), so pnpm sees the workspace the lockfile describes. Never their sources: those reach
+ * only the proof stage, and a source edit must leave the shipped layers byte-identical. Returns the repository-relative
+ * paths it wrote.
+ */
+function copyInstallManifests({ root, treeRoot, copy }) {
+  const written = [];
+  const walk = (rel) => {
+    for (const entry of readdirSync(join(root, rel), { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : 1))) {
+      const path = posix.join(rel, entry.name);
+      if (isIgnoredEntry(entry) || entry.name === '.git') continue;
+      if (entry.isDirectory()) walk(path);
+      else if (entry.isFile() && (entry.name === 'package.json' || entry.name.endsWith('.patch')) && !existsSync(join(treeRoot, path))) {
+        mkdirSync(dirname(join(treeRoot, path)), { recursive: true });
+        copyFileSync(join(root, path), join(treeRoot, path));
+        written.push(path);
+      }
+    }
+  };
+  for (const directory of copy) walk(posix.normalize(directory).replace(/\/$/, ''));
+  return written;
+}
+
+/** Remove the install-only manifests from the tree, and the directories they leave empty: nothing at runtime reads them. */
+function removeInstallManifests({ treeRoot, paths }) {
+  for (const rel of paths) {
+    rmSync(join(treeRoot, rel), { force: true });
+    for (let dir = posix.dirname(rel); dir !== '.' && dir !== ''; dir = posix.dirname(dir)) {
+      if (!existsSync(join(treeRoot, dir)) || readdirSync(join(treeRoot, dir)).length > 0) break;
+      rmSync(join(treeRoot, dir), { recursive: true });
+    }
+  }
+}
+
 /** `node_modules/.pnpm` entries that are registry packages: directories without an injected (`@file+`) workspace copy, and not pnpm's hoist directory. */
 const isStoreEntry = (entry) => entry.isDirectory() && !entry.name.includes('@file+') && entry.name !== 'node_modules';
 
@@ -131,8 +168,8 @@ export async function stageComposedTree({
   problems.push(...inputProblems);
 
   for (const name of INSTALL_INPUTS.filter((file) => existsSync(join(root, file)))) copyFileSync(join(root, name), join(treeRoot, name));
-  for (const directory of copy) copyEntry(join(root, directory), join(treeRoot, directory));
   copyPackageFiles({ root, treeRoot, closure, problems });
+  const installOnly = copyInstallManifests({ root, treeRoot, copy });
   for (const manifest of memberManifests({ root, imageDir })) copyFileSync(join(root, manifest), join(treeRoot, manifest));
   mkdirSync(join(treeRoot, imageDir), { recursive: true });
   copyFileSync(join(root, imageDir, IMAGE_BUILD_INPUTS_FILE), join(treeRoot, imageDir, IMAGE_BUILD_INPUTS_FILE));
@@ -182,6 +219,7 @@ export async function stageComposedTree({
   // Written on the runner: the index resolves modules in the tree, whatever the platform. The host link is relative.
   const index = writeIndex({ root: treeRoot, imageDir, commit, buildSourceRepository: buildSource });
   copyFileSync(join(dirname(fileURLToPath(import.meta.url)), MIGRATE_SCRIPT), join(treeRoot, MIGRATE_TARGET));
+  removeInstallManifests({ treeRoot, paths: installOnly });
   const moved = splitLayers(stageRoot);
   const members = readMembers({ root, imageDir }).map(([, directory]) => directory);
   splitDistLayer({ stageRoot, members, outputs });

package/src/composed-image-stage-tree.test.mjs

@@ -20,7 +20,7 @@ const git = (args) => {
   throw new Error(`unexpected git ${args.join(' ')}`);
 };
 
-function ready() {
+function ready({ copy = ['tooling/dev'] } = {}) {
   const root = workspace();
   write(root, 'package.json', { name: 'r' });
   write(root, 'pnpm-lock.yaml', "lockfileVersion: '9.0'\n");
@@ -29,7 +29,7 @@ function ready() {
   write(root, 'tooling/dev/node_modules/ignored.js', 'x');
   write(root, 'packages/sdks/lib-a/assets/data.json', '{}');
   write(root, 'biomes/alpha/api/alpha-api/README.md', 'ignored');
-  write(root, 'infra/composed-process/Dockerfile', renderPrebuiltDockerfile({ root, imageClass: ComposedImageClass.Common, copy: ['tooling/dev'], buildSource: 'alpha', base: BASE, nodeMajor: String(process.versions.node.split('.')[0]) }).dockerfile);
+  write(root, 'infra/composed-process/Dockerfile', renderPrebuiltDockerfile({ root, imageClass: ComposedImageClass.Common, copy, buildSource: 'alpha', base: BASE, nodeMajor: String(process.versions.node.split('.')[0]) }).dockerfile);
   return root;
 }
 
@@ -66,12 +66,12 @@ test('stages the layers, the manifest and the tool; only package.json + declared
   assert.equal(calls[0].arch, 'amd64');
   assert.deepEqual(calls[0].filters, ['--filter', '@t/alpha-api...', '--filter', '@t/alpha-db-api...']);
   const appFiles = [...files(path.join(root, '.xema-stage/layers/workspace/monorepo')), ...files(path.join(root, '.xema-stage/layers/dist/monorepo'))];
-  for (const expected of ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', 'tooling/dev/patch.txt', 'infra/composed-process/image-build-inputs.json', 'biomes/alpha/xema-biome.json',
+  for (const expected of ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', 'infra/composed-process/image-build-inputs.json', 'biomes/alpha/xema-biome.json',
     'biomes/alpha/api/alpha-api/package.json', 'biomes/alpha/api/alpha-api/dist/main.js', 'biomes/alpha/api/alpha-db-api/prisma/schema.prisma', 'biomes/alpha/api/alpha-db-api/node_modules/.prisma/alpha-db/index.js',
     'packages/sdks/lib-a/assets/data.json', 'packages/sdks/lib-a/dist/index.js', 'xema-composed-migrate.mjs', 'xema-composed-member-index.json']) {
     assert.ok(appFiles.includes(expected), expected);
   }
-  for (const absent of ['turbo.json', 'tooling/dev/node_modules/ignored.js', 'biomes/alpha/api/alpha-api/README.md', 'biomes/alpha/api/alpha-api/src/main.test.ts', 'infra/composed-process/Dockerfile', 'node_modules/.modules.yaml', 'node_modules/.pnpm-workspace-state-v1.json']) {
+  for (const absent of ['turbo.json', 'tooling/dev/patch.txt', 'tooling/dev/node_modules/ignored.js', 'biomes/alpha/api/alpha-api/README.md', 'biomes/alpha/api/alpha-api/src/main.test.ts', 'infra/composed-process/Dockerfile', 'node_modules/.modules.yaml', 'node_modules/.pnpm-workspace-state-v1.json']) {
     assert.ok(!appFiles.includes(absent), `${absent} must not ship`);
   }
   assert.ok(fs.existsSync(path.join(root, '.xema-stage/tool/src/composed-image-in-image.mjs')));
@@ -190,3 +190,40 @@ test('a change to a library (workspace package) changes the workspace layer and
   await run(dep, { install: (args) => { fakeInstall()(args); write(args.treeRoot, 'node_modules/.pnpm/left-pad@1.0.1/node_modules/left-pad/package.json', { name: 'left-pad' }); } });
   assert.notEqual(layerDigests(dep).store, before.store);
 });
+
+test('the --copy directories reach the install as workspace manifests and the proof as bytes, never a shipped layer: a member src edit leaves every layer byte-identical', async () => {
+  const sources = (root) => {
+    write(root, 'biomes/alpha/api/alpha-api/src/main.ts', 'export const main = 1;\n');
+    write(root, 'packages/sdks/lib-a/src/index.ts', 'export const lib = 1;\n');
+    write(root, 'packages/sdks/unused/package.json', { name: '@t/unused', files: ['dist'] });
+    write(root, 'packages/sdks/unused/src/index.ts', '// not in the closure\n');
+    write(root, 'patches/left-pad.patch', 'diff\n');
+  };
+  const copy = ['tooling/dev', 'biomes', 'packages', 'patches'];
+  const seen = [];
+  const install = (args) => {
+    seen.push(fs.readdirSync(args.treeRoot, { recursive: true }).map(String).sort());
+    fakeInstall()(args);
+  };
+  const first = ready({ copy });
+  sources(first);
+  const manifest = await run(first, { install });
+  assert.ok(seen[0].includes('packages/sdks/unused/package.json') && seen[0].includes('patches/left-pad.patch'), 'the install sees every workspace manifest and patch');
+  assert.ok(!seen[0].some((f) => f.endsWith('.ts') || f === 'tooling/dev/patch.txt'), 'the install sees no source');
+  assert.deepEqual(Object.keys(manifest.copied).sort(), ['biomes', 'packages', 'patches', 'tooling/dev'], 'the proof still binds the --copy bytes');
+  const shipped = LAYERS.flatMap((layer) => files(path.join(first, '.xema-stage/layers', layer, 'monorepo')));
+  for (const absent of ['biomes/alpha/api/alpha-api/src/main.ts', 'biomes/alpha/api/alpha-api/src/main.test.ts', 'packages/sdks/lib-a/src/index.ts', 'packages/sdks/unused/package.json', 'packages/sdks/unused', 'patches/left-pad.patch', 'patches', 'tooling/dev/patch.txt']) {
+    assert.ok(!shipped.includes(absent), `${absent} must not ship`);
+  }
+  for (const present of ['biomes/alpha/api/alpha-api/package.json', 'packages/sdks/lib-a/package.json', 'packages/sdks/lib-a/dist/index.js', 'biomes/alpha/api/alpha-db-api/prisma/schema.prisma']) {
+    assert.ok(shipped.includes(present), present);
+  }
+  const before = layerDigests(first);
+  const second = ready({ copy });
+  sources(second);
+  write(second, 'biomes/alpha/api/alpha-api/src/main.ts', 'export const main = 2; // edited\n');
+  write(second, 'biomes/alpha/api/alpha-api/src/added.ts', '// a new source file\n');
+  const edited = await run(second);
+  assert.deepEqual(layerDigests(second), before);
+  assert.notEqual(edited.copied.biomes, manifest.copied.biomes, 'the edit reaches the proof stage');
+});