CI / verify (pull_request) Successful in 1m6s
CI / infrastructure-smoke (pull_request) Successful in 27s
CI / migration-smoke (pull_request) Successful in 1m54s
CI / image-build (pull_request) Successful in 29s
CI / deploy-smoke (same-origin) (pull_request) Successful in 43s
CI / deploy-smoke (split) (pull_request) Successful in 1m30s
Implements ADR 0049's deferred native target and ADR 0052's reviewed license supplements. The proof case is a real module using sharp. packageFormat stays 1, and `any` is unchanged. Packager (@ekklesia/module-pack): - --target linux-x64-glibc. Native or platform-specific packages, found by the same generic rule that refuses them in `any`, stay outside the bundle. - Each native package's production closure is walked through its own dependencies, installed optionalDependencies that match the target, and required peers. It is copied as real files flat under node_modules/<name>, with no links, dev dependencies, declarations, source maps, or other platforms' packages. Missing or foreign-platform required dependencies, version conflicts, links, foreign machines, and Node.js range conflicts fail closed. - runtime.nodeApi, nodeAbi, and libcVersion are read from the binaries by a small ELF reader: the addon's node_api_module_get_api_version_v1 and the newest GLIBC_ symbol version needed. No shelling out. A native target with no addon is refused. - ADR 0052 supplements: package-provided material stays primary. An exact match on name, version, and ekklesia-content-v1 digest (sorted normalized paths with each file's size and SHA-256; no metadata) adds labelled material after the package's own. Any mismatch, a declared-licence conflict, or a malformed or unreviewed supplement file fails. Missing material with no supplement still fails. Supplement for @img/[email protected]: - 184 components and 143 unique texts, assembled from the exact upstream sources sharp-libvips v1.3.3 builds linux-x64 from: 27 C/C++ libraries, glib's gvdb, librsvg's Rust crates (reproduced with cargo tree), the Rust standard library at the rustc commit recorded in the binary, plus the LGPL-3.0, GPL-3.0, and MPL-2.0 texts. Each source is recorded with its SHA-256 in PROVENANCE.md. - It pins digest ekklesia-content-v1:sha256:50647b0b…, which is identical from the installed copy and from the registry tarball. - LGPL/MPL source-availability determinations stay open, as ADR 0052 states. Nothing claims they are met. Verifier (Core): - linux-x64-glibc is accepted only on a host whose platform, arch, glibc family and version, and Node-API version (from Node itself) match. - Every ELF file must be x86-64; every .node must be an ELF object. - `any` packages now also refuse node_modules/ and ELF files. - Contract: native metadata must state nodeApi or nodeAbi, and Linux targets libcVersion (ADR 0049). Proof: - A checked-in AGPL native fixture packs byte-identically from unrelated copies (8.86 MB) and verifies with Core's verifier. - Extracted elsewhere, it runs a sharp resize and PNG round trip in an empty-environment process. Every resolution stays in the package, and only the package's addon and libvips plus host system libraries load. Signage is untouched. Co-Authored-By: Claude Opus 5.5 <[email protected]>
261 lines
9.6 KiB
TypeScript
261 lines
9.6 KiB
TypeScript
import { cp, mkdir, mkdtemp, realpath, rm, symlink, writeFile } from "node:fs/promises";
|
|
import { tmpdir } from "node:os";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
/**
|
|
* Generated module fixtures for the packager's tests: a built module directory in a temporary
|
|
* location, whose `node_modules` links to the real Module SDK and Drizzle this package depends on.
|
|
* Everything a development module directory holds is there, including what must never ship
|
|
* (`src/`, `tests/`, declarations, source maps, `workspace:` ranges), so a test can prove the
|
|
* packager leaves it out.
|
|
*/
|
|
|
|
const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
|
|
|
|
export interface FakePackage {
|
|
readonly name: string;
|
|
readonly version?: string;
|
|
readonly packageJson?: Record<string, unknown>;
|
|
/** Files relative to the fake package's root. */
|
|
readonly files?: Record<string, string | Uint8Array>;
|
|
}
|
|
|
|
export interface FixtureModuleOptions {
|
|
readonly databaseAbi?: 1;
|
|
readonly id?: string;
|
|
readonly license?: unknown;
|
|
readonly licenseText?: string | Uint8Array;
|
|
readonly version?: string;
|
|
readonly serverSource?: string;
|
|
readonly withModuleDatabase?: boolean;
|
|
readonly withSchema?: boolean;
|
|
readonly fakePackages?: readonly FakePackage[];
|
|
readonly manifest?: (manifest: Record<string, unknown>) => Record<string, unknown>;
|
|
}
|
|
|
|
const temporaryDirectories: string[] = [];
|
|
|
|
export async function cleanupFixtures(): Promise<void> {
|
|
await Promise.all(
|
|
temporaryDirectories
|
|
.splice(0)
|
|
.map((directory) => rm(directory, { force: true, recursive: true })),
|
|
);
|
|
}
|
|
|
|
export async function scratchDirectory(prefix = "ekklesia-pack-"): Promise<string> {
|
|
const directory = await realpath(await mkdtemp(path.join(tmpdir(), prefix)));
|
|
temporaryDirectories.push(directory);
|
|
return directory;
|
|
}
|
|
|
|
async function write(file: string, contents: string | Uint8Array): Promise<void> {
|
|
await mkdir(path.dirname(file), { recursive: true });
|
|
await writeFile(file, contents);
|
|
}
|
|
|
|
const defaultServer = (
|
|
id: string,
|
|
version: string,
|
|
databaseAbi?: 1,
|
|
) => `import { defineModuleRuntime } from "@ekklesia/module-sdk";
|
|
export default defineModuleRuntime({ ${databaseAbi === 1 ? "database: { abi: 1 }, " : ""}id: ${JSON.stringify(id)}, version: ${JSON.stringify(version)}, register() {} });
|
|
`;
|
|
|
|
const schemaSource = (id: string, databaseAbi?: 1) => `${
|
|
databaseAbi === 1
|
|
? 'import { moduleDrizzleSchemaMetadata } from "@ekklesia/module-database/drizzle";'
|
|
: 'import { defineModuleSchema } from "@ekklesia/module-sdk";'
|
|
}
|
|
import { createModuleTable } from "@ekklesia/module-sdk";
|
|
import { text, uuid } from "drizzle-orm/pg-core";
|
|
export const records = createModuleTable(${JSON.stringify(id)})("records", {
|
|
id: uuid("id").primaryKey(),
|
|
value: text("value").notNull(),
|
|
});
|
|
export default ${
|
|
databaseAbi === 1
|
|
? `moduleDrizzleSchemaMetadata(${JSON.stringify(id)}, { records })`
|
|
: `defineModuleSchema({ moduleId: ${JSON.stringify(id)}, tables: { records } })`
|
|
};
|
|
`;
|
|
|
|
export async function fixtureModule(options: FixtureModuleOptions = {}): Promise<string> {
|
|
const id = options.id ?? "example";
|
|
const version = options.version ?? "0.1.0";
|
|
const root = await scratchDirectory("ekklesia-pack-fixture-");
|
|
const moduleDirectory = path.join(root, id);
|
|
const tableName = `${id.replaceAll("-", "_")}_records`;
|
|
const usesModuleDatabase = options.withModuleDatabase || options.databaseAbi === 1;
|
|
|
|
const baseManifest: Record<string, unknown> = {
|
|
manifestVersion: 8,
|
|
id,
|
|
name: `${id} module`,
|
|
version,
|
|
compatibility: { platform: "^0.1.0", moduleSdk: "^0.1.0" },
|
|
...(options.databaseAbi === 1 ? { database: { abi: 1 } } : {}),
|
|
capabilities: [],
|
|
permissions: [],
|
|
entrypoints: {
|
|
server: "./dist/server/index.js",
|
|
...(options.withSchema ? { schema: "./dist/schema/index.js" } : {}),
|
|
migrations: "./drizzle",
|
|
},
|
|
};
|
|
const manifest = options.manifest ? options.manifest(baseManifest) : baseManifest;
|
|
|
|
await write(
|
|
path.join(moduleDirectory, "ekklesia.module.json"),
|
|
`${JSON.stringify(manifest, null, 2)}\n`,
|
|
);
|
|
await write(
|
|
path.join(moduleDirectory, "package.json"),
|
|
`${JSON.stringify(
|
|
{
|
|
name: `@test/module-${id}`,
|
|
version,
|
|
license: Object.hasOwn(options, "license") ? options.license : "MIT",
|
|
private: true,
|
|
type: "module",
|
|
scripts: { build: "tsc" },
|
|
dependencies: {
|
|
"@ekklesia/module-sdk": "workspace:*",
|
|
...(usesModuleDatabase ? { "@ekklesia/module-database": "workspace:*" } : {}),
|
|
"drizzle-orm": "0.45.2",
|
|
},
|
|
devDependencies: { typescript: "7.0.2" },
|
|
exports: { ".": "./dist/server/index.js" },
|
|
ekklesia: { layer: "module" },
|
|
},
|
|
null,
|
|
2,
|
|
)}\n`,
|
|
);
|
|
await write(
|
|
path.join(moduleDirectory, "LICENSE"),
|
|
options.licenseText ?? "MIT License\n\nCopyright (c) 2026 Example Module\n",
|
|
);
|
|
await write(
|
|
path.join(moduleDirectory, "dist/server/index.js"),
|
|
options.serverSource ?? defaultServer(id, version, options.databaseAbi),
|
|
);
|
|
await write(path.join(moduleDirectory, "dist/server/index.js.map"), '{"version":3}\n');
|
|
await write(path.join(moduleDirectory, "dist/server/index.d.ts"), "export {};\n");
|
|
if (options.withSchema) {
|
|
await write(
|
|
path.join(moduleDirectory, "dist/schema/index.js"),
|
|
schemaSource(id, options.databaseAbi),
|
|
);
|
|
}
|
|
await write(path.join(moduleDirectory, "src/server/index.ts"), "export {};\n");
|
|
await write(path.join(moduleDirectory, "tests/server.test.ts"), "export {};\n");
|
|
await write(path.join(moduleDirectory, "README.md"), "# Development notes\n");
|
|
|
|
await write(
|
|
path.join(moduleDirectory, "drizzle/0000_initial.sql"),
|
|
`CREATE TABLE "${tableName}" ("id" uuid PRIMARY KEY NOT NULL, "value" text NOT NULL);\n`,
|
|
);
|
|
await write(
|
|
path.join(moduleDirectory, "drizzle/meta/_journal.json"),
|
|
JSON.stringify({
|
|
version: "7",
|
|
dialect: "postgresql",
|
|
entries: [
|
|
{ idx: 0, version: "7", when: 1_700_000_000_000, tag: "0000_initial", breakpoints: true },
|
|
],
|
|
}),
|
|
);
|
|
await write(
|
|
path.join(moduleDirectory, "drizzle/meta/_ekklesia.json"),
|
|
JSON.stringify({
|
|
version: 1,
|
|
moduleId: id,
|
|
entries: [{ tag: "0000_initial", destructive: { mode: "none" } }],
|
|
}),
|
|
);
|
|
await write(
|
|
path.join(moduleDirectory, "drizzle/meta/0000_snapshot.json"),
|
|
JSON.stringify({
|
|
version: "7",
|
|
dialect: "postgresql",
|
|
id: "10000000-0000-4000-8000-000000000001",
|
|
prevId: "00000000-0000-0000-0000-000000000000",
|
|
}),
|
|
);
|
|
|
|
// The module's dependencies, as a workspace links them: the real packages this package depends on.
|
|
const modules = path.join(moduleDirectory, "node_modules");
|
|
await mkdir(path.join(modules, "@ekklesia"), { recursive: true });
|
|
await symlink(
|
|
await realpath(path.join(packageRoot, "node_modules", "@ekklesia", "module-sdk")),
|
|
path.join(modules, "@ekklesia", "module-sdk"),
|
|
);
|
|
if (usesModuleDatabase) {
|
|
await symlink(
|
|
await realpath(path.join(packageRoot, "node_modules", "@ekklesia", "module-database")),
|
|
path.join(modules, "@ekklesia", "module-database"),
|
|
);
|
|
}
|
|
await symlink(
|
|
await realpath(path.join(packageRoot, "node_modules", "drizzle-orm")),
|
|
path.join(modules, "drizzle-orm"),
|
|
);
|
|
for (const fake of options.fakePackages ?? []) {
|
|
const fakeRoot = path.join(modules, ...fake.name.split("/"));
|
|
await write(
|
|
path.join(fakeRoot, "package.json"),
|
|
JSON.stringify({
|
|
name: fake.name,
|
|
version: fake.version ?? "1.0.0",
|
|
type: "module",
|
|
main: "index.js",
|
|
license: "MIT",
|
|
...fake.packageJson,
|
|
}),
|
|
);
|
|
for (const [relative, contents] of Object.entries(fake.files ?? {})) {
|
|
await write(path.join(fakeRoot, relative), contents);
|
|
}
|
|
}
|
|
return moduleDirectory;
|
|
}
|
|
|
|
export const SOURCE_REVISION = "86ae907f59458508e3277666cdd214f5bd7c1078";
|
|
|
|
const nativeFixtureSource = path.join(packageRoot, "tests", "fixtures", "native-module");
|
|
|
|
/**
|
|
* The checked-in native proof module (`tests/fixtures/native-module`), copied to a fresh, unrelated
|
|
* temporary directory with `node_modules` linking the real sharp and Module SDK this package's
|
|
* workspace installed, as a module's own install would provide them.
|
|
*/
|
|
export async function nativeFixtureModule(): Promise<string> {
|
|
// Inside this package, beside its own node_modules, as a module checkout sits beside its own: a
|
|
// bundle's module keys are paths relative to the module, so a copy in the system temporary
|
|
// directory would bundle paths that climb out of it and into this checkout.
|
|
const fixtures = path.join(packageRoot, ".fixtures");
|
|
await mkdir(fixtures, { recursive: true });
|
|
const root = await realpath(await mkdtemp(path.join(fixtures, "native-")));
|
|
temporaryDirectories.push(root);
|
|
const moduleDirectory = path.join(root, "native-proof");
|
|
await cp(nativeFixtureSource, moduleDirectory, { recursive: true });
|
|
const modules = path.join(moduleDirectory, "node_modules");
|
|
await mkdir(path.join(modules, "@ekklesia"), { recursive: true });
|
|
await symlink(
|
|
await realpath(path.join(packageRoot, "node_modules", "sharp")),
|
|
path.join(modules, "sharp"),
|
|
);
|
|
await symlink(
|
|
await realpath(path.join(packageRoot, "node_modules", "@ekklesia", "module-sdk")),
|
|
path.join(modules, "@ekklesia", "module-sdk"),
|
|
);
|
|
return moduleDirectory;
|
|
}
|
|
|
|
/** The workspace's real installed package, for tests that build fake native packages from it. */
|
|
export async function installedPackageFile(...segments: string[]): Promise<string> {
|
|
return realpath(path.join(packageRoot, "node_modules", ...segments));
|
|
}
|