nanocodex-vite 0.6.1 → 0.6.5

package/chatgpt-egress.mjs

@@ -7,6 +7,7 @@ import WebSocket, { WebSocketServer } from "ws";
 const CHATGPT_HOST = "chatgpt.com";
 const CHATGPT_PATH_PREFIX = "/backend-api/codex/";
 const RELAY_HTTP_PATHS = new Map([
+  ["codex-responses", "/backend-api/codex/responses"],
   ["codex-web-search", "/backend-api/codex/alpha/search"],
   ["codex-image-generation", "/backend-api/codex/images/generations"],
   ["codex-image-edit", "/backend-api/codex/images/edits"],
@@ -84,13 +85,18 @@ export async function startChatGptWorkerEgress(options = {}) {
 
 async function proxyHttpRequest(request, response, fetchImpl, localPrefix, relayPrefix) {
   const upstreamPath = allowedUpstreamPath(request.url, localPrefix, relayPrefix, false);
-  if (!safeLoopbackRequest(request) || upstreamPath === undefined) {
+  if (!safeLoopbackRequest(request) || upstreamPath === undefined
+    || (request.url?.startsWith(`${relayPrefix}/http/codex-responses`)
+      && (request.method !== "POST" || request.url !== `${relayPrefix}/http/codex-responses`))) {
     response.writeHead(404, noStoreHeaders("text/plain; charset=utf-8"));
     response.end("Not found\n");
     return;
   }
   try {
     const method = request.method ?? "GET";
+    const controller = new AbortController();
+    request.once("aborted", () => controller.abort());
+    response.once("close", () => { if (!response.writableFinished) controller.abort(); });
     const upstream = await fetchImpl(`https://${CHATGPT_HOST}${upstreamPath}`, {
       method,
       headers: upstreamHttpHeaders(request),
@@ -99,17 +105,22 @@ async function proxyHttpRequest(request, response, fetchImpl, localPrefix, relay
         : Readable.toWeb(request),
       duplex: "half",
       redirect: "manual",
+      signal: controller.signal,
     });
     const headers = new Headers(upstream.headers);
     headers.delete("content-encoding");
     headers.delete("content-length");
     headers.set("cache-control", "no-store");
     response.writeHead(upstream.status, upstream.statusText, Object.fromEntries(headers));
-    if (upstream.body) Readable.fromWeb(upstream.body).pipe(response);
+    if (upstream.body) Readable.fromWeb(upstream.body).once("error", (error) => response.destroy(error)).pipe(response);
     else response.end();
-  } catch {
-    if (!response.headersSent) response.writeHead(502, noStoreHeaders("text/plain; charset=utf-8"));
-    response.end("ChatGPT development egress failed\n");
+  } catch (error) {
+    if (response.destroyed) return;
+    if (response.headersSent) response.destroy(error);
+    else {
+      response.writeHead(502, noStoreHeaders("text/plain; charset=utf-8"));
+      response.end("ChatGPT development egress failed\n");
+    }
   }
 }
 
@@ -214,6 +225,10 @@ function upstreamHttpHeaders(request) {
     "x-oai-attestation",
     "x-openai-fedramp",
     "x-session-id",
+    "x-client-request-id",
+    "x-codex-turn-state",
+    "x-openai-internal-codex-responses-lite",
+    "x-responsesapi-include-timing-metrics",
   ]) {
     const value = request.headers[name];
     if (typeof value === "string") headers.set(name, value);

package/oauth-relay.d.mts

@@ -1,4 +1,4 @@
-export type LocalOAuthProvider = "github" | "google" | "gmail" | "gdrive" | "slack" | "x";
+export type LocalOAuthProvider = "github" | "google" | "gmail" | "gdrive" | "slack" | "x" | "spotify" | "soundcloud";
 export type LocalOAuthFlow = "connect" | "managed";
 export type LocalConnectorFlow = LocalOAuthFlow;
 export type LocalConnectorAuthorization = Readonly<{

package/oauth-relay.mjs

@@ -1,4 +1,4 @@
-const PROVIDERS = new Set(["github", "google", "gmail", "gdrive", "slack", "x"]);
+const PROVIDERS = new Set(["github", "google", "gmail", "gdrive", "slack", "x", "spotify", "soundcloud"]);
 const FLOWS = new Set(["connect", "managed"]);
 const BASE64_URL = /^[A-Za-z0-9_-]+$/;
 const INSTANCE_HOST = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.nanocodex\.localhost$/;
@@ -9,7 +9,7 @@ const MAX_CLOCK_SKEW_SECONDS = 30;
 const MAX_INNER_STATE_LENGTH = 512;
 const MAX_ENVELOPE_LENGTH = 2_048;
 const CONNECTION_ID = /^[A-Za-z0-9_-]{43}$/;
-const CONNECTOR_CALLBACK = /^\/v1\/connectors\/(github|google|gmail|gdrive|slack|x)\/callback$/;
+const CONNECTOR_CALLBACK = /^\/v1\/connectors\/(github|google|gmail|gdrive|slack|x|spotify|soundcloud)\/callback$/;
 const MCP_CALLBACK = /^\/v1\/mcp-connections\/([A-Za-z0-9_-]{43})\/callback$/;
 const SAFE_QUERY = ["code", "error", "error_description"];
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nanocodex-vite",
-  "version": "0.6.1",
+  "version": "0.6.5",
   "description": "Vite, Cloudflare, WASM, ChatGPT development, and OAuth relay integration for Nanocodex",
   "type": "module",
   "exports": {
@@ -32,14 +32,14 @@
   "devDependencies": {
     "@cloudflare/vite-plugin": "1.54.2",
     "@types/node": "^22.20.1",
-    "nanocodex": "0.6.1",
+    "nanocodex": "0.6.5",
     "typescript": "5.9.3",
     "vite": "8.2.1",
     "wrangler": "4.127.1"
   },
   "peerDependencies": {
     "@cloudflare/vite-plugin": ">=1.54.2",
-    "nanocodex": "^0.6.1",
+    "nanocodex": "^0.6.5",
     "vite": ">=6.1.0"
   },
   "peerDependenciesMeta": {

package/plugin.mjs

@@ -339,6 +339,9 @@ async function localOAuthBindings() {
 }
 
 export function oauthBindingsFromEnvironment(environment) {
+  const spotifyClientId = firstEnvironmentValue(environment, [
+    "NANOCODEX_SPOTIFY_OAUTH_CLIENT_ID", "SPOTIFY_OAUTH_CLIENT_ID", "SPOTIFY_CLIENT_ID",
+  ]);
   return {
     ...oauthCredentialPair(environment, {
       label: "GitHub",
@@ -361,6 +364,14 @@ export function oauthBindingsFromEnvironment(environment) {
       targetId: "SLACK_OAUTH_CLIENT_ID",
       targetSecret: "SLACK_OAUTH_CLIENT_SECRET",
     }),
+    ...(spotifyClientId ? { SPOTIFY_OAUTH_CLIENT_ID: spotifyClientId } : {}),
+    ...oauthCredentialPair(environment, {
+      label: "SoundCloud",
+      ids: ["NANOCODEX_SOUNDCLOUD_OAUTH_CLIENT_ID", "SOUNDCLOUD_OAUTH_CLIENT_ID", "SOUNDCLOUD_CLIENT_ID"],
+      secrets: ["NANOCODEX_SOUNDCLOUD_OAUTH_CLIENT_SECRET", "SOUNDCLOUD_OAUTH_CLIENT_SECRET", "SOUNDCLOUD_CLIENT_SECRET"],
+      targetId: "SOUNDCLOUD_OAUTH_CLIENT_ID",
+      targetSecret: "SOUNDCLOUD_OAUTH_CLIENT_SECRET",
+    }),
     ...oauthCredentialPair(environment, {
       label: "X",
       ids: ["NANOCODEX_X_OAUTH_CLIENT_ID", "X_OAUTH_CLIENT_ID", "X_CLIENT_ID"],

package/scripts/build-js-package.sh

@@ -65,10 +65,22 @@ cleanup() {
 
 trap cleanup EXIT
 
+cache_helper="js/nanocodex-vite/scripts/wasm-output-cache.mjs"
+if node "$cache_helper" check "$build_mode"; then
+  node js/nanocodex/scripts/write-wasm-attestation.mjs .ci-wasm-cache/source.wasm
+  echo "WASM outputs are current; skipped Cargo and binding generation"
+  exit 0
+fi
+
+if [[ "$(wasm-bindgen --version)" != "wasm-bindgen 0.2.126" ]]; then
+  echo "Nanocodex WASM requires wasm-bindgen 0.2.126" >&2
+  exit 1
+fi
+
 if [[ "$build_mode" == release ]]; then
-  cargo build --locked -p nanocodex-wasm --target "$wasm_target" --profile wasm
+  cargo +1.97 build --locked -p nanocodex-wasm --target "$wasm_target" --profile wasm
 else
-  cargo build --locked -p nanocodex-wasm --target "$wasm_target"
+  cargo +1.97 build --locked -p nanocodex-wasm --target "$wasm_target"
 fi
 wasm_artifact="$target_dir/$wasm_target/$cargo_profile/nanocodex_wasm.wasm"
 stamp_path="js/nanocodex/pkg-web/.nanocodex-bindgen-stamp"
@@ -84,7 +96,15 @@ fingerprint="$({
   wasm-bindgen --version
   printf 'build-mode=%s\n' "$build_mode"
   printf 'worker-bundler-v1-simd\n'
-  cksum < js/nanocodex-vite/scripts/wasm-memory-views.mjs
+  # A source-cache miss must not bless bindings made by older generation policy.
+  for generator in "$script_path" "$cache_helper" \
+    js/nanocodex-vite/scripts/wasm-memory-views.mjs \
+    js/nanocodex/scripts/deduplicate-wasm.mjs \
+    js/nanocodex/scripts/write-package-types.mjs \
+    js/nanocodex/scripts/write-wasm-attestation.mjs \
+    js/nanocodex/scripts/check-managed-wasm.mjs; do
+    cksum < "$generator"
+  done
   if [[ "$build_mode" == release ]]; then
     "$binaryen" --version
   fi
@@ -100,6 +120,7 @@ if [[ -f "$stamp_path" ]] \
   && [[ "$(<"$stamp_path")" == "$fingerprint" ]] \
   && node js/nanocodex/scripts/write-wasm-attestation.mjs --check-cache "$wasm_artifact" 2>/dev/null; then
   node js/nanocodex/scripts/write-wasm-attestation.mjs "$wasm_artifact"
+  node "$cache_helper" save "$build_mode" "$wasm_artifact"
   echo "wasm-bindgen outputs are current"
   exit 0
 fi
@@ -145,3 +166,4 @@ node js/nanocodex/scripts/deduplicate-wasm.mjs
 node js/nanocodex/scripts/write-package-types.mjs
 printf '%s\n' "$fingerprint" > "$stamp_path"
 node js/nanocodex/scripts/write-wasm-attestation.mjs "$wasm_artifact"
+node "$cache_helper" save "$build_mode" "$wasm_artifact"

package/scripts/wasm-output-cache.mjs

@@ -0,0 +1,254 @@
+// Uses Node built-ins and Python 3.11+ tomllib; no Rust or pnpm setup needed.
+import { execFileSync } from "node:child_process";
+import assert from "node:assert/strict";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, relative, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { assertCachedManagedWasmAttestation, hashManagedWasmArtifacts } from "../../nanocodex/scripts/check-managed-wasm.mjs";
+
+export const rustToolchain = "1.97";
+const root = fileURLToPath(new URL("../../../", import.meta.url));
+const metadataPath = ".ci-wasm-cache/outputs.json";
+const rawPath = ".ci-wasm-cache/source.wasm";
+const sha = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const excluded = new Set([".git", "target", "node_modules", "pkg-web", "pkg-node"]);
+
+async function walk(directory, skipStandaloneTests = false) {
+  const result = [];
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    if (excluded.has(entry.name) || (skipStandaloneTests && ["tests", "benches"].includes(entry.name))) continue;
+    const path = resolve(directory, entry.name);
+    if (entry.isDirectory()) result.push(...await walk(path));
+    else if (entry.isFile() || entry.isSymbolicLink()) result.push(path);
+  }
+  return result;
+}
+
+// Retain optional dependencies and unknown cfgs, excluding only target tables
+// proven inapplicable to wasm32. Host build/proc-macro dependencies stay broad.
+// Registry/git dependencies are pinned by Cargo.lock. No Cargo metadata call.
+function dependencyDirectories(repository) {
+  // Parse the entire closure in one Python process. tomllib handles all valid
+  // Cargo TOML key/table/string layouts instead of approximating that grammar.
+  return JSON.parse(execFileSync("python3", ["-c", String.raw`
+import json, pathlib, re, sys, tomllib
+root = pathlib.Path(sys.argv[1]).resolve()
+def manifest(directory):
+    with (directory / "Cargo.toml").open("rb") as file:
+        return tomllib.load(file)
+workspace = manifest(root).get("workspace", {}).get("dependencies", {})
+
+def wasm_cfg(platform):
+    # Three-valued evaluation: unsupported predicates/syntax remain included.
+    # Cargo target predicates do not depend on optional dependency activation.
+    expression = re.fullmatch(r"cfg\s*\((.*)\)", platform.strip(), re.S)
+    if expression is None:
+        return None if re.match(r"cfg\b", platform.strip()) else platform == "wasm32-unknown-unknown"
+    text = expression[1].strip()
+    tokens = []
+    while text:
+        match = re.match(r'\s*([A-Za-z_][A-Za-z_0-9]*|"(?:[^"\\]|\\.)*"|[(),=])', text)
+        if not match:
+            return None
+        tokens.append(match[1])
+        text = text[match.end():].strip()
+    position = 0
+    def take():
+        nonlocal position
+        token = tokens[position]
+        position += 1
+        return token
+    def peek():
+        return tokens[position] if position < len(tokens) else None
+    def parse():
+        name = take()
+        if not re.fullmatch(r'[A-Za-z_][A-Za-z_0-9]*', name):
+            raise ValueError("unknown cfg syntax")
+        if peek() == "=":
+            take()
+            value = json.loads(take())
+            known = {"target_arch": "wasm32", "target_os": "unknown", "target_family": "wasm",
+                     "target_env": "", "target_vendor": "unknown", "target_pointer_width": "32",
+                     "target_endian": "little"}
+            return known[name] == value if name in known else None
+        if peek() == "(":
+            take()
+            values = []
+            while peek() != ")":
+                values.append(parse())
+                if peek() != ",":
+                    break
+                take()
+            if take() != ")":
+                raise ValueError("unterminated cfg")
+            if name == "all":
+                return False if False in values else (None if None in values else True)
+            if name == "any":
+                return True if True in values else (None if None in values else False)
+            if name == "not" and len(values) == 1:
+                return None if values[0] is None else not values[0]
+            return None
+        return False if name in ("unix", "windows") else None
+    try:
+        value = parse()
+        return value if position == len(tokens) else None
+    except (IndexError, ValueError, TypeError):
+        return None
+
+visited = set()
+inputs = {}
+def visit(directory, target=True):
+    directory = directory.resolve()
+    if not directory.is_relative_to(root):
+        raise ValueError("local Rust dependencies must remain inside repository")
+    data = manifest(directory)
+    # A proc macro and its dependency tree compile for the build host.
+    target = target and not data.get("lib", {}).get("proc-macro", False)
+    if (directory, target) in visited:
+        return
+    visited.add((directory, target))
+    build_script = (directory / "build.rs").exists() or bool(data.get("package", {}).get("build", False))
+    entry_points = [data.get("lib", {}), *data.get("bin", [])]
+    # Explicit production entry points can live in normally test-only folders.
+    keep_tests = build_script or any(pathlib.PurePosixPath(entry.get("path", "")).parts[:1] in [("tests",), ("benches",)] for entry in entry_points)
+    inputs[str(directory)] = {"directory": str(directory), "buildScript": build_script, "skipStandaloneTests": not keep_tests}
+    tables = [(None, data), *data.get("target", {}).items()]
+    for platform, table in tables:
+        for kind in ("dependencies", "build-dependencies"):
+            # Target-specific build dependencies are selected for the host.
+            dependency_target = target and kind != "build-dependencies"
+            if dependency_target and platform is not None and wasm_cfg(platform) is False:
+                continue
+            for name, dependency in table.get(kind, {}).items():
+                if not isinstance(dependency, dict):
+                    continue
+                base = directory
+                if dependency.get("workspace"):
+                    dependency = workspace[name]
+                    base = root
+                if isinstance(dependency, dict) and "path" in dependency:
+                    visit(base / dependency["path"], dependency_target)
+visit(root / "js/nanocodex")
+print(json.dumps([inputs[path] for path in sorted(inputs)]))
+`, repository], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }));
+}
+
+export async function fingerprint(repository = root, mode = "release", environment = process.env) {
+  try { return await fingerprintInputs(repository, mode, environment); }
+  catch (error) {
+    // A new unsupported manifest/include cannot accidentally reuse stale output.
+    // A unique key still permits the ordinary build and its cache-save step.
+    console.error(`WASM cache reuse disabled: ${error.stderr?.toString().trim().split("\n").at(-1) || error.message.split("\n")[0]}`);
+    return sha(randomUUID());
+  }
+}
+
+// Release identity must be deterministic: callers receive resolution errors.
+// Only fingerprint(), the output-cache API, converts errors into non-reuse.
+export async function fingerprintInputs(repository = root, mode = "release", environment = process.env) {
+  repository = await realpath(repository);
+  assert.ok(["release", "development"].includes(mode));
+  const files = new Set();
+  const omittedTestDirectories = new Set();
+  for (const { directory, buildScript, skipStandaloneTests } of dependencyDirectories(repository)) {
+    files.add(resolve(directory, "Cargo.toml"));
+    if (skipStandaloneTests) for (const name of ["tests", "benches"]) omittedTestDirectories.add(resolve(directory, name));
+    if (directory === resolve(repository, "js/nanocodex") && !buildScript) {
+      for (const path of await walk(resolve(directory, "src"))) files.add(path);
+      for (const name of ["build.rs", "README.md"]) {
+        try { await readFile(resolve(directory, name)); files.add(resolve(directory, name)); }
+        catch (error) { if (error.code !== "ENOENT") throw error; }
+      }
+    } else {
+      for (const path of await walk(directory, skipStandaloneTests)) files.add(path);
+    }
+  }
+  for (const name of ["Cargo.toml", "Cargo.lock", "js/nanocodex-vite/scripts/build-js-package.sh",
+    "js/nanocodex-vite/scripts/wasm-output-cache.mjs", "js/nanocodex-vite/scripts/wasm-memory-views.mjs",
+    "js/nanocodex/scripts/deduplicate-wasm.mjs", "js/nanocodex/scripts/write-package-types.mjs",
+    "js/nanocodex/scripts/write-wasm-attestation.mjs", "js/nanocodex/scripts/check-managed-wasm.mjs"]) files.add(resolve(repository, name));
+  for (const name of [".cargo", "rust-toolchain", "rust-toolchain.toml"]) {
+    try {
+      if (name === ".cargo") for (const path of await walk(resolve(repository, name))) files.add(path);
+      else { await readFile(resolve(repository, name)); files.add(resolve(repository, name)); }
+    } catch (error) { if (error.code !== "ENOENT") throw error; }
+  }
+  // Rust literal include/#[path] references can leave their crate directory.
+  // Follow those recursively while retaining checkout-relative content keys.
+  for (const path of files) {
+    if (!path.endsWith(".rs")) continue;
+    const source = await readFile(path, "utf8");
+    for (const match of source.matchAll(/(?:include(?:_str|_bytes)?!\s*\(\s*|#\[path\s*=\s*)(?:r(#{0,8}))?"([^"\n]+)"/g)) {
+      const included = resolve(dirname(path), match[2]);
+      assert.ok(!relative(repository, included).startsWith(".."), "Rust include must remain inside repository");
+      await readFile(included);
+      files.add(included);
+      // A production Rust module in tests/ can itself use ordinary mod children.
+      // Retain that subtree rather than approximating Rust module resolution.
+      if (included.endsWith(".rs")) for (const directory of omittedTestDirectories) {
+        if (!relative(directory, included).startsWith("..")) {
+          for (const path of await walk(directory)) files.add(path);
+          omittedTestDirectories.delete(directory);
+        }
+      }
+    }
+  }
+  const pkg = JSON.parse(await readFile(resolve(repository, "js/nanocodex/package.json"), "utf8"));
+  const buildEnvironment = Object.fromEntries(Object.entries(environment)
+    .filter(([name]) => /^(RUSTFLAGS|CARGO_ENCODED_RUSTFLAGS|RUSTC|RUSTC_WRAPPER|RUSTC_WORKSPACE_WRAPPER|CARGO_INCREMENTAL|CARGO_PROFILE_.*|CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_.*)$/.test(name))
+    // cargo +1.97 overrides RUSTUP_TOOLCHAIN. Dev/test overrides do not affect
+    // --profile wasm, and rust-toolchain setup commonly introduces them.
+    .filter(([name, value]) => name !== "CARGO_INCREMENTAL" || value !== (mode === "release" ? "0" : "1"))
+    .filter(([name]) => !name.startsWith("CARGO_PROFILE_") || (mode === "release"
+      ? /^CARGO_PROFILE_(WASM|RELEASE)_/.test(name)
+      : /^CARGO_PROFILE_DEV_/.test(name))).sort());
+  const hash = createHash("sha256");
+  hash.update(JSON.stringify({ schema: 1, mode, rustToolchain, bindgen: "0.2.126", binaryen: pkg.devDependencies.binaryen, buildEnvironment }));
+  for (const path of [...files].sort()) hash.update(JSON.stringify([relative(repository, path), sha(await readFile(path))]));
+  return hash.digest("hex");
+}
+
+async function outputs(repository) {
+  const web = pathToFileURL(`${resolve(repository, "js/nanocodex/pkg-web")}/`);
+  const artifacts = await hashManagedWasmArtifacts(web);
+  const node = {};
+  for (const name of ["nanocodex.js", "nanocodex.d.ts", "package.json"]) node[name] = sha(await readFile(resolve(repository, "js/nanocodex/pkg-node", name)));
+  return { artifacts, node, sourceWasmSha256: sha(await readFile(resolve(repository, rawPath))) };
+}
+
+export async function check(repository = root, mode = "release") {
+  const retained = JSON.parse(await readFile(resolve(repository, metadataPath), "utf8"));
+  assert.equal(retained.schema, 1);
+  assert.equal(retained.fingerprint, await fingerprint(repository, mode));
+  const current = await outputs(repository);
+  assert.deepEqual(retained.outputs, current);
+  assertCachedManagedWasmAttestation(JSON.parse(await readFile(resolve(repository, "js/nanocodex/pkg-web/nanocodex-build.json"), "utf8")), current);
+}
+
+async function atomicWrite(path, bytes) {
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try { await writeFile(temporary, bytes, { flag: "wx" }); await rename(temporary, path); }
+  finally { await rm(temporary, { force: true }); }
+}
+
+export async function save(repository = root, mode = "release", source) {
+  // Remove pre-release cache locations so older local builds cannot publish raw WASM.
+  for (const name of [".nanocodex-source.wasm", ".nanocodex-output-cache.json"]) {
+    await rm(resolve(repository, "js/nanocodex/pkg-web", name), { force: true });
+  }
+  await mkdir(resolve(repository, ".ci-wasm-cache"), { recursive: true });
+  await writeFile(resolve(repository, ".ci-wasm-cache/.gitignore"), "*\n");
+  await atomicWrite(resolve(repository, rawPath), await readFile(source));
+  await atomicWrite(resolve(repository, metadataPath), `${JSON.stringify({ schema: 1, fingerprint: await fingerprint(repository, mode), outputs: await outputs(repository) })}\n`);
+}
+
+if (process.argv[1] && pathToFileURL(resolve(process.argv[1])).href === import.meta.url) {
+  const [command, mode = "release", source] = process.argv.slice(2);
+  if (command === "key") console.log(await fingerprint(root, mode));
+  else if (command === "check") {
+    try { await check(root, mode); console.log("WASM output cache verified"); }
+    catch (error) { console.error(`WASM output cache miss: ${error.message}`); process.exitCode = 1; }
+  } else if (command === "save" && source) await save(root, mode, resolve(source));
+  else throw new Error("usage: wasm-output-cache.mjs key|check [release|development], or save <mode> <raw-wasm>");
+}

package/scripts/wasm-output-cache.test.mjs

@@ -0,0 +1,202 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { test } from "node:test";
+import { check, fingerprint, fingerprintInputs, save } from "./wasm-output-cache.mjs";
+
+const repository = new URL("../../../", import.meta.url);
+test("content key, attestation integrity, and pre-Cargo reuse", async () => {
+  const root = await mkdtemp(resolve(tmpdir(), "nanocodex-wasm-cache-"));
+  const put = async (path, value) => {
+    await mkdir(resolve(root, path, ".."), { recursive: true });
+    await writeFile(resolve(root, path), value);
+  };
+  try {
+    const scripts = ["js/nanocodex-vite/scripts/build-js-package.sh", "js/nanocodex-vite/scripts/wasm-output-cache.mjs", "js/nanocodex-vite/scripts/wasm-memory-views.mjs", "js/nanocodex/scripts/deduplicate-wasm.mjs", "js/nanocodex/scripts/write-package-types.mjs", "js/nanocodex/scripts/write-wasm-attestation.mjs", "js/nanocodex/scripts/check-managed-wasm.mjs"];
+    for (const path of scripts) await put(path, await readFile(new URL(path, repository)));
+    await put("Cargo.toml", '[workspace.dependencies]\ncore = { path = "crates/core" }\n');
+    await put("Cargo.lock", "locked");
+    await put("js/nanocodex/Cargo.toml", '[dependencies]\ncore.workspace = true\n');
+    await put("js/nanocodex/src/lib.rs", "wasm source");
+    await put("crates/core/Cargo.toml", '[package]\nname = "core"\n');
+    await put("crates/core/src/lib.rs", "core source");
+    await put("js/nanocodex/package.json", '{"devDependencies":{"binaryen":"132.0.0"}}');
+    await put(".cargo/config.toml", "# config");
+    const key = await fingerprint(root);
+    assert.equal(await fingerprintInputs(root), key);
+    assert.equal(await fingerprint(root, "release", { ...process.env, RUSTUP_TOOLCHAIN: "1.97", CARGO_PROFILE_DEV_DEBUG: "0", CARGO_PROFILE_TEST_DEBUG: "0", CARGO_INCREMENTAL: "0" }), key);
+    const manifestPath = "js/nanocodex/Cargo.toml";
+    const oldManifest = await readFile(resolve(root, manifestPath));
+    await put(manifestPath, '[dependencies.core]\nworkspace = true\n');
+    const dottedKey = await fingerprint(root);
+    await put("crates/core/src/lib.rs", "changed dotted dependency");
+    assert.notEqual(await fingerprint(root), dottedKey);
+    await put("crates/core/src/lib.rs", "core source");
+    await put(manifestPath, oldManifest);
+    await put("shared/prompt.md", "embedded prompt");
+    await put("js/nanocodex/src/lib.rs", 'const PROMPT: &str = include_str!("../../../shared/prompt.md");');
+    const includeKey = await fingerprint(root);
+    await put("shared/prompt.md", "changed embedded prompt");
+    assert.notEqual(await fingerprint(root), includeKey);
+    await put("js/nanocodex/src/lib.rs", "wasm source");
+    await put(manifestPath, '[dependencies."core"]\nworkspace = true\n');
+    assert.equal(await fingerprint(root), await fingerprint(root), "quoted dependency table is supported");
+    await put(manifestPath, '[dependencies]\n  core = { workspace = true }\n');
+    const indentedKey = await fingerprint(root);
+    await put("crates/core/src/lib.rs", "changed indented dependency");
+    assert.notEqual(await fingerprint(root), indentedKey);
+    await put("crates/core/src/lib.rs", "core source");
+    await put(manifestPath, '[invalid TOML');
+    await assert.rejects(fingerprintInputs(root), "release identity must surface resolution failures");
+    assert.notEqual(await fingerprint(root), await fingerprint(root), "invalid manifest disables reuse");
+    await put(manifestPath, oldManifest);
+    await put("js/nanocodex/cloudflare/worker.mjs", "unrelated worker change");
+    assert.equal(await fingerprint(root), key);
+    for (const path of ["crates/core/src/lib.rs", "Cargo.lock", ".cargo/config.toml", "js/nanocodex-vite/scripts/wasm-memory-views.mjs"]) {
+      const before = await readFile(resolve(root, path));
+      await put(path, `${before}\nchanged`);
+      assert.notEqual(await fingerprint(root), key, path);
+      await put(path, before);
+    }
+    assert.notEqual(await fingerprint(root, "development"), key);
+    assert.notEqual(await fingerprint(root, "release", { RUSTFLAGS: "-C opt-level=1" }), key);
+    for (const dir of ["pkg-web", "pkg-node"]) {
+      for (const name of ["nanocodex.js", "nanocodex.d.ts", "package.json", ...(dir === "pkg-web" ? ["nanocodex_bg.js", "nanocodex_bg.wasm", "nanocodex_worker.js"] : [])]) await put(`js/nanocodex/${dir}/${name}`, name);
+    }
+    await put("raw.wasm", "raw WASM bytes");
+    const git = (...args) => execFileSync("git", args, { cwd: root, stdio: "pipe" });
+    git("init"); git("add", "."); git("-c", "user.name=Fixture", "-c", "user.email=fixture@example.test", "commit", "-m", "fixture");
+    execFileSync(process.execPath, [resolve(root, "js/nanocodex/scripts/write-wasm-attestation.mjs"), resolve(root, "raw.wasm")]);
+    await save(root, "release", resolve(root, "raw.wasm"));
+    await check(root);
+    // The lock is already held by the fixture; Cargo and wasm-bindgen must not run.
+    const result = execFileSync("bash", [resolve(root, scripts[0]), "--release"], {
+      cwd: root, encoding: "utf8", env: { ...process.env, NANOCODEX_WASM_LOCK_HELD: root },
+    });
+    assert.match(result, /skipped Cargo and binding generation/);
+    for (const path of ["js/nanocodex/pkg-node/nanocodex.js", "js/nanocodex/pkg-web/nanocodex_bg.wasm", ".ci-wasm-cache/source.wasm"]) {
+      const before = await readFile(resolve(root, path));
+      await put(path, "corrupted");
+      await assert.rejects(check(root));
+      await put(path, before);
+      await rm(resolve(root, path));
+      await assert.rejects(check(root));
+      await put(path, before);
+    }
+    await assert.rejects(check(root, "development"));
+  } finally { await rm(root, { recursive: true, force: true }); }
+});
+
+
+test("WASM closure skips only proven target mismatches and preserves host dependencies", async () => {
+  const fixture = await inputFixture();
+  const { root, put } = fixture;
+  try {
+    const cases = [
+      ['cfg(not(target_family = "wasm"))', false],
+      ['cfg(unix)', false],
+      ['cfg (unix)', false],
+      ['cfg (not(unknown_flag))', true],
+      ['cfg(windows)', false],
+      ['x86_64-unknown-linux-gnu', false],
+      ['wasm32-unknown-unknown', true],
+      ['cfg(all(target_arch = "wasm32", target_os = "unknown"))', true],
+      ['cfg(any(unix, target_family = "wasm"))', true],
+      ['cfg(not(any(unix, windows)))', true],
+      ['cfg(all(unknown_flag, unix))', false],
+      ['cfg(any(unknown_flag, unix))', true],
+      ['cfg(not(unknown_flag))', true],
+      ['cfg(target_feature = "atomics")', true],
+      ['cfg(feature = "optional-feature")', true],
+      ['cfg(future_predicate(target_arch = "wasm32"))', true],
+    ];
+    for (const [platform, included] of cases) {
+      await put("js/nanocodex/Cargo.toml", `[target.'${platform}'.dependencies]\ncore = { path = "../../crates/core", optional = true }\n`);
+      const before = await fingerprintInputs(root);
+      await put("crates/core/src/lib.rs", `changed for ${platform}`);
+      assert.equal((await fingerprintInputs(root)) !== before, included, platform);
+      await put("crates/core/src/lib.rs", "core source");
+    }
+    await put("js/nanocodex/Cargo.toml", '[dependencies]\ncore = { path = "../../crates/core", optional = true }\n');
+    const optional = await fingerprintInputs(root);
+    await put("crates/core/src/lib.rs", "optional dependency still included");
+    assert.notEqual(await fingerprintInputs(root), optional, "do not infer optional feature activation");
+
+    for (const kind of ["build-dependency", "proc-macro"]) {
+      await put("js/nanocodex/Cargo.toml", kind === "build-dependency"
+        ? `[target.'cfg(unix)'.build-dependencies]\ncore = { path = "../../crates/core" }\n`
+        : '[dependencies]\ncore = { path = "../../crates/core" }\n');
+      await put("crates/core/Cargo.toml", `[package]\nname = "core"\n${kind === "proc-macro" ? "[lib]\nproc-macro = true\n" : ""}[target.'cfg(unix)'.dependencies]\nhost = { path = "../host" }\n`);
+      await put("crates/host/Cargo.toml", '[package]\nname = "host"\n');
+      await put("crates/host/src/lib.rs", "host dependency source");
+      const before = await fingerprintInputs(root);
+      await put("crates/host/src/lib.rs", "host dependency changed");
+      assert.notEqual(await fingerprintInputs(root), before, kind);
+    }
+  } finally { await fixture.close(); }
+});
+
+test("standalone test directories are omitted unless builds or production references need them", async () => {
+  const fixture = await inputFixture();
+  const { root, put } = fixture;
+  try {
+    const beforeTests = await fingerprintInputs(root);
+    await put("crates/core/tests/standalone.rs", "integration test");
+    await put("crates/core/benches/standalone.rs", "benchmark");
+    assert.equal(await fingerprintInputs(root), beforeTests);
+    await put("crates/core/tests/standalone.rs", "changed integration test");
+    assert.equal(await fingerprintInputs(root), beforeTests);
+
+    await put("crates/core/tests/prompt.txt", "embedded asset");
+    await put("crates/core/src/lib.rs", 'const PROMPT: &str = include_str!("../tests/prompt.txt");');
+    const beforeAsset = await fingerprintInputs(root);
+    await put("crates/core/tests/prompt.txt", "changed embedded asset");
+    assert.notEqual(await fingerprintInputs(root), beforeAsset, "literal includes retain excluded-directory assets");
+
+    await put("crates/core/src/lib.rs", '#[path = "../tests/production.rs"] mod production;');
+    await put("crates/core/tests/production.rs", "mod sibling;");
+    await put("crates/core/tests/sibling.rs", "production child module");
+    const beforeModule = await fingerprintInputs(root);
+    await put("crates/core/tests/sibling.rs", "changed production child module");
+    assert.notEqual(await fingerprintInputs(root), beforeModule, "referenced Rust modules retain their ordinary mod children");
+    await put("crates/core/src/lib.rs", "core source");
+
+    await put("crates/core/src/tests/production.rs", "nested source remains conservative");
+    const beforeNested = await fingerprintInputs(root);
+    await put("crates/core/src/tests/production.rs", "changed nested source");
+    assert.notEqual(await fingerprintInputs(root), beforeNested);
+
+    for (const build of ["build.rs", "custom-build.rs"]) {
+      await put("crates/core/Cargo.toml", `[package]\nname = "core"\n${build === "build.rs" ? "" : 'build = "custom-build.rs"\n'}`);
+      await put(`crates/core/${build}`, "fn main() {}");
+      const before = await fingerprintInputs(root);
+      await put("crates/core/tests/standalone.rs", `build input for ${build}`);
+      assert.notEqual(await fingerprintInputs(root), before, "build scripts may read test assets");
+      await rm(resolve(root, `crates/core/${build}`));
+    }
+    await put("crates/core/Cargo.toml", '[package]\nname = "core"\n[lib]\npath = "tests/library.rs"\n');
+    await put("crates/core/tests/library.rs", "production library");
+    const explicitTarget = await fingerprintInputs(root);
+    await put("crates/core/tests/library.rs", "changed production library");
+    assert.notEqual(await fingerprintInputs(root), explicitTarget, "explicit production entry points remain covered");
+  } finally { await fixture.close(); }
+});
+
+async function inputFixture() {
+  const root = await mkdtemp(resolve(tmpdir(), "nanocodex-wasm-inputs-"));
+  const put = async (path, value) => {
+    await mkdir(resolve(root, path, ".."), { recursive: true });
+    await writeFile(resolve(root, path), value);
+  };
+  for (const path of ["js/nanocodex-vite/scripts/build-js-package.sh", "js/nanocodex-vite/scripts/wasm-output-cache.mjs", "js/nanocodex-vite/scripts/wasm-memory-views.mjs", "js/nanocodex/scripts/deduplicate-wasm.mjs", "js/nanocodex/scripts/write-package-types.mjs", "js/nanocodex/scripts/write-wasm-attestation.mjs", "js/nanocodex/scripts/check-managed-wasm.mjs"]) await put(path, "// build policy");
+  await put("Cargo.toml", '[workspace]\n');
+  await put("Cargo.lock", "locked");
+  await put("js/nanocodex/Cargo.toml", '[dependencies]\ncore = { path = "../../crates/core" }\n');
+  await put("js/nanocodex/package.json", '{"devDependencies":{"binaryen":"132.0.0"}}');
+  await put("js/nanocodex/src/lib.rs", "wasm source");
+  await put("crates/core/Cargo.toml", '[package]\nname = "core"\n');
+  await put("crates/core/src/lib.rs", "core source");
+  return { root, put, close: () => rm(root, { recursive: true, force: true }) };
+}