From 6e591d55880d6f1039af217e6b1f23ed84c01037 Mon Sep 17 00:00:00 2001 From: "Timothy J. Aveni" Date: Sat, 10 Oct 2026 08:16:21 -0700 Subject: [PATCH] Make Node dependency outputs reproducible without build caches --- PORTABLE_ARTIFACTS.md | 19 +++++++++++++++++++ yarn-dependencies.nix | 3 +++ 2 files changed, 22 insertions(+) diff --git a/PORTABLE_ARTIFACTS.md b/PORTABLE_ARTIFACTS.md index 12fa668..7348087 100644 --- a/PORTABLE_ARTIFACTS.md +++ b/PORTABLE_ARTIFACTS.md @@ -61,6 +61,25 @@ with their own versions. Authored source symlinks and non-bundled portable impor other than the SDK and server Node builtins are rejected. This is build closure checking, not a purity proof or security sandbox. +`mkCaminoYarnDependencies` installs the locked dependency recipe and exports its +installed Node dependency tree, including native package results and executable +links. Generated Yarn install/linker state stays outside runtime outputs. Yarn +describes its install-state file as an optimization cache in its +[configuration reference](https://yarnpkg.com/configuration/yarnrc#installStatePath). +This helper output is a dependency directory for a build, not a standalone +Package or a runnable Yarn project. Its `devShell` supplies freestanding Yarn for +editable projects; do not run Yarn against the readonly dependency output. + +Use the shared `installDependencies` assembly for consumers: authored libraries +are copied into the consumer's `node_modules`, where Node can find their +transitive dependencies, while selected SDK links retain their canonical type +identity. Reserved SDK substitutions fail checks. Web Studio uses this same +assembly rather than retaining a full Yarn project just to resolve UI libraries. +Its dependency inputs contain manifests, lock and Yarn configuration/plugin +recipe; ordinary Studio source edits do not enter that dependency derivation. +Recipes with local/workspace dependencies must still include their needed source. +This is language-specific build machinery; it adds no core Package file contract. + The core/Automerge bundle and Replicache bundle are built once. Browser modules import the core through a content-addressed gateway URL, independent of package identity. Each manifest covers the shared bytes it uses. The gateway retains its diff --git a/yarn-dependencies.nix b/yarn-dependencies.nix index b444174..6ea4567 100644 --- a/yarn-dependencies.nix +++ b/yarn-dependencies.nix @@ -13,6 +13,9 @@ let test -d node_modules mkdir -p "$out" cp -a node_modules/. "$out/" + # Node resolves installed packages directly. This generated index is for + # Yarn's linker, not a runtime input; do not export build-session state. + rm -f "$out/.yarn-state.yml" runHook postInstall ''; };