Publish quixos-nix-helpers from e5aec2bb26110ed474929f353ee51ff46d4f20d6

Profile source capture, Nix evaluation/realization, resource/query checking,
and implementation builds without putting timings into immutable outputs.
Keep modular repositories; bound independent capture work, snapshot jj once
per observation, and retain final concurrent-edit and Git completeness checks.

Compose exact resource/closure/frontend/toolchain checks as memoized Nix
derivations. Preserve whole-workspace validation and the full compiler path
when no checked dependency is supplied. Share canonical Nixpkgs by content,
index workspace build contexts once, and narrow lock/driver/compiler inputs
with conservative complete-source fallback. Batch React witness checks only
when distinct source closures cannot share ambient declarations; otherwise
run the original independent TypeScript checks.

Seed local authoring toolchains with exact canonical fetch identities when
they match the selected inputs; retain store-path inputs for overrides.
Add generic correctness checks rather than permanent Reader timing/content
fixtures. Verify actual Reader edits and rejection/recovery in a private
workbench, preserving the original user's workbench and runtime.

Query checking currently caches at resource/closure boundaries, not individual
query semantic dependency boundaries. Template helper pins and reproducible
fixture snapshots follow in a separate publication change.

.quixos-subtree-source.json

@@ -0,0 +1,8 @@
+{
+  "version": 1,
+  "sourceRepo": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos",
+  "sourceCommit": "e5aec2bb26110ed474929f353ee51ff46d4f20d6",
+  "sourcePath": "quixos-instance/quixos-nix-helpers",
+  "exportName": "quixos-nix-helpers",
+  "mirrorRemote": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-nix-helpers.git"
+}

PORTABLE_ARTIFACTS.md

@@ -0,0 +1,93 @@
+# Checked capability and component artifacts
+
+`mkCaminoArtifacts` is the fresh package builder. It regenerates candidate
+bindings, typechecks the entry's dependency closure, bundles declared targets,
+generates a process service when requested, and emits content manifests and
+receipts. It has no migration step or package-defined shell hooks.
+
+```nix
+# Inside a per-system flake output:
+quixosPackages.checkedArtifacts =
+  { buildContract, sourceDigest, generator, core, sharedRuntime, typescript, packageRevisionId, ... }:
+  helpers.mkCaminoArtifacts {
+    inherit pkgs buildContract sourceDigest core sharedRuntime typescript packageRevisionId;
+    protocol = generator;
+    src = ./.;
+    portable = {
+      entry = "src/portable.ts";
+      bindingOutput = "src/gen/qx.ts";
+      registryExport = "registry";
+      targets = [ "browser" "server" ];
+    };
+  };
+```
+
+`buildContract` is a canonical, source-free capability slice. `sourceDigest`
+records the exact selected package source in the final installation manifest;
+it does not enter the reusable compilation group. Ordinary source dependencies,
+SDKs and React props companions remain explicit Nix inputs. Raw QX and resource
+lock files enter through the checked contract and evaluated recipe, and are
+excluded from the implementation source tree. The `plan` argument on the low-level
+helper is a composition convenience for fixtures; it is projected before building.
+Package recipes receive the contract directly and can be checked without a workspace.
+
+Inside `checkedArtifacts = context: ...`, the package helpers expose
+`camino.packageSet { inherit nixpkgs system context; }` as the usual package set
+selection. It shares the workspace composition's evaluated Nixpkgs when the
+source content, system, and default import arguments match. Pass ordinary Nixpkgs
+arguments such as `config` or `overlays` to use a separate import. A direct
+`import nixpkgs { inherit system; }` also works, with additional evaluation cost.
+The implementation groups depend on the complete execution compiler bundle and
+JavaScript build drivers by content; unrelated checker CLI and publication
+metadata changes do not enter those inputs.
+
+The handler entry exports `registry = createRegistry(handlers)` from the generated
+bindings. One registry contains many exports. The builder always supplies a server
+implementation for the generated process service. A service-only package instead
+omits `portable` and supplies `service.entry`, an ordinary JavaScript process entry
+using the versioned stdin/stdout protocol. Custom services own their lifecycle and
+may hold external resources. This first helper supports JavaScript custom service
+entries; other languages can emit the same checked artifact contract independently.
+
+Additional portable source dependencies can be provided as a locked `nodeModules` directory.
+The workspace supplies the exact SDK and compiler; packages cannot replace those
+with their own versions. Authored source symlinks and non-bundled portable imports
+other than the SDK and server Node builtins are rejected. This is build closure
+checking, not a purity proof or security sandbox.
+
+The core/Automerge bundle and Replicache bundle are built once. Browser modules
+import the core through a content-addressed gateway URL, independent of package
+identity. Each manifest covers the shared bytes it uses. The gateway retains its
+workspace authentication and explicit file registry; it never interprets an HTTP
+path as a Nix store path. Applications cannot import Replicache through the SDK.
+
+`checked-artifacts.nix` evaluates a package's `checkedArtifacts` output without
+activation. During the checked Nix build, `loadCheckedArtifactWorld` verifies manifest bytes, the selected
+generator identity, and exact regenerated binding sources. Receipts are consistency
+evidence from a trusted Nix build, not cryptographic attestations of remote builds.
+The build stores the checked plan, kernel/query programs, their digests and original
+compiler provenance in its immutable candidate output. Runtime loading validates
+that output's identities, artifact contents and supported runtime contracts. It
+does not regenerate bindings or programs with the currently running compiler.
+Nix owns rebuilding and cache reuse when a toolchain input changes.
+
+The root `camino-artifact-builds` check exercises actual reader/service outputs,
+module and process execution, browser shared imports, rejection recovery, and
+altered receipt rejection at the build boundary. The managed workspace host loads
+the resulting checked candidate before activation. No adapter pretends this ABI
+works in the old server dispatcher.
+
+Component packages add `components = { inherit (react) sdk runtime; entries; }`.
+The ordinary execution candidate checker supplies the selected React build inputs
+when the package declares components. Each entry maps a component ID to
+`{ entry = "src/card.tsx"; export = "Card"; }`. See the
+[React SDK](../camino-react/README.md) for bindings and hooks. CSS is emitted as a
+checked artifact; local image/font imports are inlined. The helper rejects
+undeclared external assets and substituted React/client dependencies.
+Component-only packages produce no backend service.
+
+`camino-component-artifacts` checks bad subject/SDK/dependency/asset inputs and
+proves that a component-only edit preserves a mixed package's service digest.
+Run `nix run .#camino-component-source-qualification` from the monorepo to
+materialize separate retained Git resources and compile an ordinary Nix candidate.
+This is a source/build qualification harness; it does not deploy a workspace.

artifacts.nix

@@ -0,0 +1,130 @@
+# Fresh artifact builder. Candidate plans and runtime dependencies are supplied by the workspace compiler.
+{
+  pkgs,
+  src,
+  plan ? null,
+  buildContract ?
+    (import ./package-context.nix {
+      inherit
+        pkgs
+        protocol
+        plan
+        packageRevisionId
+        ;
+    }).buildContract,
+  sourceDigest ?
+    (import ./package-context.nix {
+      inherit
+        pkgs
+        protocol
+        plan
+        packageRevisionId
+        ;
+    }).sourceDigest,
+  protocol,
+  core,
+  sharedRuntime,
+  typescript ? core.dependencies,
+  packageRevisionId,
+  portable ? null,
+  remote ? null,
+  service ? { },
+  nodeModules ? null,
+  components ? null,
+  group ? false,
+}:
+let
+  buildTools = import ./build-tools.nix;
+  # The standalone bundle is the complete code dependency of this driver.
+  # Changes to unrelated checker CLIs must not invalidate every package group.
+  compiler = builtins.path {
+    path = "${protocol}/libexec/quixos-protocol/execution-world.mjs";
+    name = "execution-world.mjs";
+  };
+  config = pkgs.writeText "camino-artifact-build.json" (
+    builtins.toJSON {
+      inherit
+        buildContract
+        compiler
+        packageRevisionId
+        core
+        sharedRuntime
+        nodeModules
+        service
+        ;
+      group = true;
+      components =
+        if components == null then
+          null
+        else
+          {
+            inherit (components) sdk runtime entries;
+            dependencies = components.sdk.dependencies;
+            bindingOutput = components.bindingOutput or "src/gen/client.ts";
+            contracts = components.contracts or [ ];
+          };
+      source = import ./implementation-source.nix {
+        inherit (pkgs) lib;
+        inherit src;
+      };
+      portable =
+        if portable == null then
+          null
+        else
+          {
+            inherit (portable) entry;
+            entries = portable.entries or { };
+            registryExport = portable.registryExport or "registry";
+            bindingOutput = portable.bindingOutput or "src/gen/qx.ts";
+            targets =
+              portable.targets or [
+                "browser"
+                "server"
+              ];
+          };
+      remote =
+        if remote == null then
+          null
+        else
+          {
+            inherit (remote) entry;
+            registryExport = remote.registryExport or "registry";
+            bindingOutput = remote.bindingOutput or "src/gen/remote.ts";
+          };
+      node = "${pkgs.nodejs_24}/bin/node";
+      tsc = "${typescript}/node_modules/typescript/bin/tsc";
+      esbuild = "${pkgs.esbuild}/bin/esbuild";
+      shell = "${pkgs.runtimeShell}";
+      serviceAdapter = ./portable-service.mjs;
+    }
+  );
+  compiled =
+    pkgs.runCommand "camino-compiled-artifacts"
+      {
+        passthru.buildConfig = config;
+        QUIXOS_TRACE_PROFILE = "1";
+      }
+      ''
+        ${pkgs.nodejs_24}/bin/node ${buildTools}/build-artifacts.mjs ${config}
+      '';
+in
+if group then
+  compiled
+else
+  (import ./assemble-package.nix {
+    inherit pkgs;
+    artifacts = [ compiled ];
+    context = {
+      inherit
+        buildContract
+        sourceDigest
+        packageRevisionId
+        sharedRuntime
+        ;
+      generator = protocol;
+    };
+  })
+  // {
+    caminoGroup = compiled;
+    buildConfig = config;
+  }

assemble-package.mjs

@@ -0,0 +1,97 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { pathToFileURL } from "node:url";
+import { buildService } from "./build-service.mjs";
+
+const config = JSON.parse(await fs.readFile(process.argv[2], "utf8"));
+const compiler = await import(pathToFileURL(config.compiler));
+const contract = JSON.parse(await fs.readFile(config.buildContract, "utf8"));
+compiler.checkPackageBuildContract(contract);
+const pkg = contract.definition.package;
+if (pkg.revision !== config.packageRevisionId) throw Error("Invalid package assembly context");
+const output = process.env.out;
+if (!output) throw Error("Package assembly requires an output directory");
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const generatorDigest = digest(await fs.readFile(config.compiler));
+const implementations = [],
+  components = [],
+  files = new Map(),
+  ids = new Set();
+const recordFile = async (name, mediaType) => {
+  const bytes = await fs.readFile(path.join(output, compiler.artifactPath(name)));
+  return { path: name, bytes: bytes.length, digest: digest(bytes), mediaType };
+};
+await fs.mkdir(path.join(output, "share/quixos/generated"), { recursive: true });
+for (const root of config.groups) {
+  const manifest = compiler.parseArtifactGroup(
+    JSON.parse(await fs.readFile(path.join(root, "share/quixos/package-artifacts.json"), "utf8")),
+  );
+  if (
+    manifest.packageRevisionId !== pkg.revision ||
+    manifest.bindingDigest !== contract.digest ||
+    JSON.stringify(manifest.versions) !== JSON.stringify(contract.definition.versions)
+  )
+    throw Error("Artifact group belongs to a different checked package");
+  const receipt = JSON.parse(await fs.readFile(path.join(root, "share/quixos/build-receipt.json"), "utf8"));
+  const expected = compiler.expectedGroupReceipt(contract, manifest, generatorDigest);
+  if (JSON.stringify(receipt) !== JSON.stringify(expected.receipt))
+    throw Error("Artifact group has an invalid build receipt");
+  const read = await compiler.artifactFileReader({ [pkg.revision]: root });
+  for (const artifact of [...manifest.implementations, ...(manifest.components ?? [])]) {
+    const key = `${artifact.compatibility === "org.quixos.react.esm/1" ? "module" : "implementation"}:${artifact.id}`;
+    if (ids.has(key)) throw Error("Duplicate artifact group export " + key);
+    ids.add(key);
+    for (const file of artifact.files) {
+      const bytes = await read(pkg.revision, file.path, file.bytes);
+      if (bytes.length !== file.bytes || digest(bytes) !== file.digest)
+        throw Error("Modified group asset " + file.path);
+      const previous = files.get(file.path);
+      if (previous && JSON.stringify(previous) !== JSON.stringify(file))
+        throw Error("Conflicting group asset " + file.path);
+      if (!previous) {
+        await fs.mkdir(path.dirname(path.join(output, file.path)), { recursive: true });
+        await fs.writeFile(path.join(output, file.path), bytes, { mode: file.path.startsWith("bin/") ? 0o755 : 0o644 });
+        files.set(file.path, file);
+      }
+    }
+  }
+  for (const [name, bytes] of expected.sources) {
+    const actual = await fs.readFile(path.join(root, name));
+    if (!Buffer.from(bytes).equals(actual)) throw Error("Modified group type witness " + name);
+    await fs.writeFile(path.join(output, name), bytes);
+  }
+  implementations.push(...manifest.implementations);
+  components.push(...(manifest.components ?? []));
+}
+if (implementations.filter((entry) => entry.compatibility === "quixos-service-v1").length > 1)
+  throw Error("A package can have only one process service owner");
+if (!implementations.some((entry) => entry.compatibility === "quixos-service-v1"))
+  await buildService({
+    config: { ...config, service: {} },
+    compiler,
+    pkg,
+    output,
+    coreServer: path.join(config.sharedRuntime, "core.mjs"),
+    sharedFiles: [...files.values()].filter((file) => file.path.startsWith("share/quixos/shared/")),
+    implementations,
+    recordFile,
+  });
+const manifest = compiler.parsePackageArtifacts({
+  schemaVersion: 1,
+  packageRevisionId: pkg.revision,
+  bindingDigest: contract.digest,
+  sourceDigest: config.sourceDigest,
+  versions: contract.definition.versions,
+  implementations,
+  ...(components.length ? { components } : {}),
+});
+const { receipt, sources } = compiler.expectedPackageReceipt(contract, manifest, config.sourceDigest, generatorDigest);
+for (const [name, bytes] of sources) {
+  const actual = await fs.readFile(path.join(output, name));
+  if (!Buffer.from(bytes).equals(actual)) throw Error("Assembly lacks checked generated source " + name);
+}
+await fs.writeFile(path.join(output, "share/quixos/package-artifacts.json"), JSON.stringify(manifest, null, 2));
+await fs.writeFile(path.join(output, "share/quixos/build-receipt.json"), JSON.stringify(receipt, null, 2));
+// Source selection is attested here; compilation groups retain their own receipt.
+compiler.checkPackageCoverage({ ...pkg, bindingDigest: contract.digest, sourceDigest: config.sourceDigest }, manifest);

assemble-package.nix

@@ -0,0 +1,39 @@
+{
+  pkgs,
+  context,
+  artifacts,
+}:
+let
+  buildTools = import ./build-tools.nix;
+  groups = map (artifact: artifact.caminoGroup or artifact) artifacts;
+  compiler = builtins.path {
+    path = "${context.generator}/libexec/quixos-protocol/execution-world.mjs";
+    name = "execution-world.mjs";
+  };
+  config = pkgs.writeText "camino-package-assembly.json" (
+    builtins.toJSON {
+      inherit groups;
+      inherit (context)
+        buildContract
+        sourceDigest
+        packageRevisionId
+        sharedRuntime
+        ;
+      inherit compiler;
+      node = "${pkgs.nodejs_24}/bin/node";
+      esbuild = "${pkgs.esbuild}/bin/esbuild";
+      shell = "${pkgs.runtimeShell}";
+      serviceAdapter = ./portable-service.mjs;
+    }
+  );
+in
+pkgs.runCommand "camino-package"
+  {
+    passthru = {
+      caminoGroups = groups;
+      assemblyConfig = config;
+    };
+  }
+  ''
+    ${pkgs.nodejs_24}/bin/node ${buildTools}/assemble-package.mjs ${config}
+  ''

browser-source.mjs

@@ -0,0 +1,69 @@
+import { createRequire } from "node:module";
+import path from "node:path";
+
+// Resolve build dependencies from the package's locked node_modules, not from
+// the helper's own Nix-store location. This program runs only during the build.
+const require = createRequire(path.join(process.cwd(), "package.json"));
+const { build } = require("esbuild");
+const options = JSON.parse(process.argv[2]);
+const platform = new Map([
+  ["react", "/__quixos/platform/react/v18.mjs"],
+  ["react/jsx-runtime", "/__quixos/platform/react-jsx-runtime/v18.mjs"],
+  ["react/jsx-dev-runtime", "/__quixos/platform/react-jsx-dev-runtime/v18.mjs"],
+  ["@quixos/web-studio-react-runtime", "/__quixos/platform/web-studio-react-runtime/v1.mjs"],
+]);
+await build({
+  ...options,
+  plugins: [
+    {
+      name: "quixos-browser-source",
+      setup(api) {
+        api.onResolve({ filter: /\?browser-source$/ }, async ({ path: specifier, resolveDir }) => {
+          if (!specifier.startsWith("./") && !specifier.startsWith("../"))
+            throw new Error("Browser source imports must name a relative compiled module");
+          const resolved = await api.resolve(specifier.slice(0, -"?browser-source".length), {
+            resolveDir,
+            kind: "import-statement",
+          });
+          if (resolved.errors.length) return { errors: resolved.errors };
+          return { path: resolved.path, namespace: "browser-source" };
+        });
+        api.onLoad({ filter: /.*/, namespace: "browser-source" }, async ({ path: entry }) => {
+          const browser = await build({
+            entryPoints: [entry],
+            bundle: true,
+            write: false,
+            outfile: "component.mjs",
+            format: "esm",
+            platform: "browser",
+            target: "es2022",
+            metafile: true,
+            plugins: [
+              {
+                name: "quixos-platform",
+                setup(browserApi) {
+                  browserApi.onResolve({ filter: /.*/ }, ({ path: name }) =>
+                    platform.has(name) ? { path: platform.get(name), external: true } : undefined,
+                  );
+                },
+              },
+            ],
+          });
+          const js = browser.outputFiles.find((file) => file.path.endsWith(".mjs"));
+          if (!js) throw new Error("Browser source build produced no JavaScript");
+          const css = browser.outputFiles.find((file) => file.path.endsWith(".css"));
+          if (css && Object.values(browser.metafile.outputs).some((output) => output.exports?.includes("styles")))
+            throw new Error("Use either imported CSS or an explicit styles export, not both");
+          if (browser.outputFiles.some((file) => !file.path.endsWith(".mjs") && !file.path.endsWith(".css")))
+            throw new Error("Browser assets must be embedded, not emitted as unserved files");
+          const source = js.text + (css ? `\nexport const styles = ${JSON.stringify(css.text)};\n` : "");
+          return {
+            contents: `export default ${JSON.stringify(source)};`,
+            loader: "js",
+            watchFiles: Object.keys(browser.metafile.inputs),
+          };
+        });
+      },
+    },
+  ],
+});

build-artifacts.mjs

@@ -0,0 +1,207 @@
+import { installDependencies } from "./install-dependencies.mjs";
+import { measureBuild } from "./build-profile.mjs";
+import { buildService } from "./build-service.mjs";
+import { buildComponents } from "./build-components.mjs";
+/** Trusted Nix build driver. No package-defined build hooks run between generation and witnessing. */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { builtinModules } from "node:module";
+import { execFileSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+const config = JSON.parse(await fs.readFile(process.argv[2], "utf8"));
+const compiler = await import(pathToFileURL(config.compiler));
+const contract = JSON.parse(await fs.readFile(config.buildContract, "utf8"));
+compiler.checkPackageBuildContract(contract);
+const pkg = contract.definition.package;
+if (pkg.revision !== config.packageRevisionId) throw Error("Invalid build contract package");
+const output = process.env.out;
+if (!output) throw Error("Missing Nix output");
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const generatorDigest = digest(await fs.readFile(config.compiler));
+const runtime =
+  config.portable || config.remote
+    ? JSON.parse(await fs.readFile(path.join(config.sharedRuntime, "runtime.json"), "utf8"))
+    : { files: [] };
+const relative = (p) => compiler.artifactPath(p);
+const implementations = [];
+const generated = new Map();
+const recordFile = async (p, mediaType) => {
+  const bytes = await fs.readFile(path.join(output, relative(p)));
+  return { path: p, digest: digest(bytes), bytes: bytes.length, mediaType };
+};
+const copyRuntime = async () => {
+  await fs.mkdir(path.join(output, "share/quixos/shared"), { recursive: true });
+  for (const file of runtime.files) {
+    relative(file.path);
+    const bytes = await fs.readFile(path.join(config.sharedRuntime, file.path));
+    if (bytes.length !== file.bytes || digest(bytes) !== file.digest) throw Error("Shared runtime mismatch");
+    await fs.writeFile(path.join(output, "share/quixos/shared", file.path), bytes);
+  }
+};
+await copyRuntime();
+const sharedFiles = await Promise.all(
+  runtime.files.map((f) => recordFile(`share/quixos/shared/${f.path}`, f.mediaType)),
+);
+const coreFile = sharedFiles.find((f) => f.path.endsWith("/core.mjs"));
+const coreURL = coreFile ? compiler.contentArtifactUrl(coreFile) : null;
+const coreServer = path.join(config.sharedRuntime, "core.mjs");
+await fs.mkdir(path.join(output, "share/quixos/generated"), { recursive: true });
+const portable = config.portable;
+for (const target of Object.keys(portable?.entries ?? {}))
+  if (!["browser", "server"].includes(target)) throw Error(`Unsupported portable entry target ${target}`);
+for (const settings of [portable, config.remote].filter(Boolean))
+  if (!/^[$A-Z_a-z][$\w]*$/.test(settings.registryExport))
+    throw Error("Registry export must be a JavaScript identifier");
+const targets = portable ? [...new Set([...portable.targets, "server"])] : [];
+const builds = targets.map((target) => ({ target, mode: target, settings: portable }));
+if (config.remote) builds.push({ target: "server", mode: "remote", settings: config.remote });
+for (const { target, mode, settings } of builds) {
+  const executionTarget = target === "browser" ? "target:org.quixos.execution.javascript@1" : "server";
+  if (!["browser", "server"].includes(target)) throw Error(`Unsupported JS build target ${target}`);
+  const work = path.resolve(`work-${mode}`);
+  await fs.cp(config.source, work, { recursive: true, dereference: false });
+  const writable = async (directory) => {
+    await fs.chmod(directory, 0o755);
+    for (const item of await fs.readdir(directory, { withFileTypes: true })) {
+      const file = path.join(directory, item.name);
+      if (item.isSymbolicLink()) throw Error("Authored package source cannot contain symlinks");
+      if (item.isDirectory()) await writable(file);
+      else await fs.chmod(file, 0o644);
+    }
+  };
+  await writable(work);
+  const modules = path.join(work, "node_modules");
+  await fs.mkdir(path.join(modules, "@quixos"), { recursive: true });
+  await installDependencies({
+    destination: modules,
+    application: config.nodeModules,
+    selected: { "@quixos/camino-replica-core": config.core },
+    reserved: ["@quixos/camino-replica-core", "@quixos/camino-replica-client", "@quixos/camino-replica-engine"],
+  });
+  const packageFile = path.join(work, "package.json");
+  const packageMetadata = await fs.readFile(packageFile, "utf8").then(JSON.parse, (error) => {
+    if (error.code === "ENOENT") return {};
+    throw error;
+  });
+  await fs.writeFile(packageFile, JSON.stringify({ ...packageMetadata, type: "module" }));
+  const bindingPath = relative(settings.bindingOutput);
+  const source =
+    mode === "remote"
+      ? compiler.generateRemoteTypeScriptBindings(contract.definition.bindings, pkg.revision)
+      : compiler.generatePortableTypeScriptBindings(contract.definition.bindings, pkg.revision, {
+          target: executionTarget,
+        });
+  await fs.mkdir(path.dirname(path.join(work, bindingPath)), { recursive: true });
+  await fs.writeFile(path.join(work, bindingPath), source);
+  generated.set(mode, { file: path.join(work, bindingPath), source });
+  await fs.writeFile(
+    path.join(
+      output,
+      mode === "remote" ? "share/quixos/generated/remote.ts" : compiler.generatedBindingPath(executionTarget),
+    ),
+    source,
+  );
+  const entry = relative(settings.entries?.[target] ?? settings.entry);
+  measureBuild("portable-typecheck", { package: pkg.revision, target, mode }, () =>
+    execFileSync(
+      config.node,
+      [
+        config.tsc,
+        "--noEmit",
+        "--strict",
+        "--skipLibCheck",
+        "false",
+        "--target",
+        "es2024",
+        "--lib",
+        "es2024,dom,esnext.disposable",
+        "--module",
+        "nodenext",
+        "--moduleResolution",
+        "nodenext",
+        entry,
+      ],
+      { cwd: work, stdio: "inherit" },
+    ),
+  );
+  const bundlePath =
+    mode === "remote" ? "share/quixos/remote/server/module.mjs" : `share/quixos/portable/${target}/module.mjs`;
+  await fs.mkdir(path.dirname(path.join(output, bundlePath)), { recursive: true });
+  const coreImport = target === "browser" ? coreURL : coreServer;
+  const metadata = path.join(work, "bundle-meta.json");
+  measureBuild("portable-bundle", { package: pkg.revision, target, mode }, () =>
+    execFileSync(
+      config.esbuild,
+      [
+        entry,
+        "--bundle",
+        `--platform=${target === "browser" ? "browser" : "node"}`,
+        "--format=esm",
+        "--minify-whitespace",
+        "--target=es2024",
+        `--outfile=${path.join(output, bundlePath)}`,
+        `--metafile=${metadata}`,
+        `--alias:@quixos/camino-replica-core=${coreImport}`,
+        `--external:${coreImport}`,
+      ],
+      { cwd: work, stdio: "inherit" },
+    ),
+  );
+  const meta = JSON.parse(await fs.readFile(metadata, "utf8"));
+  const built = Object.values(meta.outputs).find((o) => o.entryPoint);
+  if (!built?.exports.includes(settings.registryExport)) throw Error("Bundle lacks the declared registry export");
+  // Portable modules must contain their ordinary source dependencies and share only the checked SDK.
+  if (
+    Object.values(meta.outputs).some((o) =>
+      o.imports.some(
+        (i) =>
+          i.external &&
+          i.path !== coreImport &&
+          !(target === "server" && builtinModules.includes(i.path.replace(/^node:/, ""))),
+      ),
+    )
+  )
+    throw Error("Unexpected external import in portable module");
+  const exports = pkg.exports
+    .filter((e) =>
+      mode === "remote"
+        ? e.execution.kind === "remote"
+        : e.execution.kind !== "remote" && e.execution.targets.includes(executionTarget),
+    )
+    .map((e) => e.id);
+  const body = {
+    id: `${mode}-module`,
+    target: executionTarget,
+    compatibility: "quixos-js-module-v1",
+    path: bundlePath,
+    ports: "quixos-transaction-ports-v1",
+    registryExport: settings.registryExport,
+    exports,
+    files: [await recordFile(bundlePath, "text/javascript"), ...sharedFiles],
+  };
+  implementations.push({ ...body, contentDigest: compiler.implementationDigest(body) });
+}
+const components =
+  config.group && !config.components
+    ? []
+    : await buildComponents({ config, compiler, contract, pkg, output, recordFile, generated });
+if (!config.group || config.service.entry)
+  await buildService({ config, compiler, pkg, output, coreServer, sharedFiles, implementations, recordFile });
+
+const manifest = compiler.parseArtifactGroup({
+  schemaVersion: 1,
+  packageRevisionId: pkg.revision,
+  bindingDigest: contract.digest,
+  versions: contract.definition.versions,
+  implementations,
+  ...(components.length ? { components } : {}),
+});
+for (const { file, source } of generated.values())
+  if ((await fs.readFile(file, "utf8")) !== source) throw Error("Generated bindings changed during build");
+const { receipt, sources } = compiler.expectedGroupReceipt(contract, manifest, generatorDigest);
+for (const [file, bytes] of sources)
+  if (!Buffer.from(bytes).equals(await fs.readFile(path.join(output, file))))
+    throw Error("Receipt generation differs from compiled bindings");
+await fs.writeFile(path.join(output, "share/quixos/package-artifacts.json"), JSON.stringify(manifest, null, 2));
+await fs.writeFile(path.join(output, "share/quixos/build-receipt.json"), JSON.stringify(receipt, null, 2));

build-components.mjs

@@ -0,0 +1,264 @@
+import { installDependencies } from "./install-dependencies.mjs";
+import { checkComponentTypes } from "./component-types.mjs";
+import { measureBuild } from "./build-profile.mjs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+export async function buildComponents({ config, compiler, contract, pkg, output, recordFile, generated }) {
+  const settings = config.components;
+  if (!settings) {
+    if (pkg.components?.length) throw Error("Declared components require checked component build settings");
+    return [];
+  }
+  const declarations = config.group
+    ? (pkg.components ?? []).filter((entry) => Object.hasOwn(settings.entries, entry.id))
+    : (pkg.components ?? []);
+  const entries = Object.entries(settings.entries);
+  if (
+    entries.length !== declarations.length ||
+    entries.some(([id]) => !declarations.some((component) => component.id === id))
+  )
+    throw Error("Component build entries differ from package declarations");
+  const runtime = JSON.parse(await fs.readFile(path.join(settings.runtime, "runtime.json"), "utf8"));
+  if (
+    runtime.sdkCodeDigest !== digest(await fs.readFile(path.join(settings.sdk, "dist/index.js"))) ||
+    runtime.sdkTypeDigest !== digest(await fs.readFile(path.join(settings.sdk, "dist/index.d.ts")))
+  )
+    throw Error("Component SDK differs from selected shared runtime");
+  const sharedFiles = [];
+  for (const file of runtime.files) {
+    compiler.artifactPath(file.path);
+    const bytes = await fs.readFile(path.join(settings.runtime, file.path));
+    if (bytes.length !== file.bytes || digest(bytes) !== file.digest) throw Error("Modified component runtime");
+    const target = "share/quixos/component-shared/" + file.path;
+    await fs.mkdir(path.dirname(path.join(output, target)), { recursive: true });
+    await fs.writeFile(path.join(output, target), bytes);
+    sharedFiles.push(await recordFile(target, file.mediaType));
+  }
+  const sharedModules = Object.fromEntries(
+    compiler.componentSharedModules.map((name) => {
+      const file = sharedFiles.find((file) => file.path === "share/quixos/component-shared/" + runtime.modules[name]);
+      if (!file) throw Error("Missing shared component module " + name);
+      return [name, file.path];
+    }),
+  );
+  const imports = Object.fromEntries(
+    Object.entries(sharedModules).map(([name, file]) => [
+      name,
+      compiler.contentArtifactUrl(sharedFiles.find((value) => value.path === file)),
+    ]),
+  );
+  const core = runtime.files.find((file) => file.path === "core.mjs");
+  const selected = JSON.parse(await fs.readFile(path.join(config.sharedRuntime, "runtime.json"), "utf8")).files.find(
+    (file) => file.path === "core.mjs",
+  );
+  if (core?.digest !== selected?.digest) throw Error("Component runtime core differs from portable runtime core");
+  const work = path.resolve("work-components");
+  await fs.cp(config.source, work, { recursive: true, dereference: false });
+  const writable = async (directory) => {
+    await fs.chmod(directory, 0o755);
+    for (const item of await fs.readdir(directory, { withFileTypes: true })) {
+      const file = path.join(directory, item.name);
+      if (item.isSymbolicLink()) throw Error("Authored component source cannot contain symlinks");
+      if (item.isDirectory()) await writable(file);
+      else await fs.chmod(file, 0o644);
+    }
+  };
+  await writable(work);
+  const modules = path.join(work, "node_modules");
+  await fs.mkdir(path.join(modules, "@quixos"), { recursive: true });
+  await installDependencies({
+    destination: modules,
+    application: config.nodeModules,
+    defaults: [path.join(settings.dependencies, "node_modules")],
+    selected: { "@quixos/camino-react": settings.sdk },
+    reserved: [
+      "react",
+      "react-dom",
+      "scheduler",
+      "csstype",
+      "@types/react",
+      "@types/react-dom",
+      "@types/prop-types",
+      "@quixos/camino-react",
+      "@quixos/camino-replica-core",
+      "@quixos/camino-replica-client",
+      "@quixos/camino-replica-engine",
+    ],
+  });
+  const packageFile = path.join(work, "package.json");
+  const packageMetadata = await fs.readFile(packageFile, "utf8").then(JSON.parse, (error) => {
+    if (error.code === "ENOENT") return {};
+    throw error;
+  });
+  await fs.writeFile(packageFile, JSON.stringify({ ...packageMetadata, type: "module" }));
+  // CommonJS dependencies may require React. An ESM bridge lets esbuild lower
+  // that require while retaining the one host-owned runtime instance.
+  const sharedAliases = [];
+  for (const [name, url] of Object.entries(imports)) {
+    const shim = path.join(work, "shared-" + digest(Buffer.from(name)).slice(0, 16) + ".mjs");
+    await fs.writeFile(
+      shim,
+      `export * from ${JSON.stringify(url)};` +
+        (["@quixos/camino-react", "@quixos/camino-react/ui"].includes(name)
+          ? ""
+          : `export {default} from ${JSON.stringify(url)};`),
+    );
+    sharedAliases.push("--alias:" + name + "=" + shim, "--external:" + url);
+  }
+  const bindingPath = compiler.artifactPath(settings.bindingOutput),
+    bindings = contract.definition.component,
+    assets = compiler.componentAssetDeclarations();
+  await fs.mkdir(path.dirname(path.join(work, bindingPath)), { recursive: true });
+  await fs.writeFile(path.join(work, bindingPath), bindings);
+  const assetPath = "component-assets.d.ts";
+  await fs.writeFile(path.join(work, assetPath), assets);
+  await fs.writeFile(path.join(output, "share/quixos/generated/client.ts"), bindings);
+  await fs.writeFile(path.join(output, "share/quixos/generated/component-assets.d.ts"), assets);
+  generated.set("component-client", { file: path.join(work, bindingPath), source: bindings });
+  generated.set("component-assets", { file: path.join(work, assetPath), source: assets });
+  // Public props are type-only inputs owned by imported interface resources.
+  // Augment the generated nominal registry without importing an implementation.
+  const propsImports = [],
+    propsMembers = [],
+    seenProps = new Set();
+  for (const root of settings.contracts ?? []) {
+    const companion = JSON.parse(await fs.readFile(path.join(root, "react-contracts.json"), "utf8"));
+    if (companion.schemaVersion !== 1) throw Error("Unsupported React props companion");
+    const contracts = contract.definition.moduleInterfaces.filter(
+      (iface) =>
+        iface.revisionId === companion.interfaceRevisionId || iface.definitionId === companion.interfaceRevisionId,
+    );
+    if (!contracts.length) continue;
+    for (const [memberId, entry] of Object.entries(companion.members)) {
+      if (!/^[$A-Z_a-z][$\w]*$/.test(entry.export)) throw Error("Invalid props type export");
+      const alias = `Props${propsImports.length}`;
+      propsImports.push(
+        `import type {${entry.export} as ${alias}} from ${JSON.stringify(path.join(root, "types", compiler.artifactPath(entry.path)))};`,
+      );
+      for (const iface of contracts) {
+        if (!iface.members.includes(memberId)) throw Error("Props companion names an unknown module member");
+        const key = JSON.stringify([iface.revisionId, memberId]);
+        if (seenProps.has(key)) throw Error("Duplicate React props companion for " + key);
+        seenProps.add(key);
+        propsMembers.push(`${JSON.stringify(key)}: ${alias};`);
+      }
+    }
+  }
+  const propsPath = "component-props.d.ts";
+  await fs.writeFile(
+    path.join(work, propsPath),
+    propsImports.join("\n") +
+      `\nexport {};\ndeclare module ${JSON.stringify("./" + bindingPath.replace(/\.ts$/, ".js"))} { interface ModuleProps {${propsMembers.join("\n")}} }\n`,
+  );
+  const witnesses = [];
+  for (const [id, entry] of entries) {
+    const declaration = declarations.find((component) => component.id === id),
+      source = compiler.artifactPath(entry.entry);
+    if (!/^[$A-Z_a-z][$\w]*$/.test(entry.export)) throw Error("Invalid component export name");
+    const key = digest(Buffer.from(id)).slice(0, 24);
+    const witness = path.join(work, "component-check-" + key + ".tsx");
+    const module = pkg.modules.find((module) => module.id === id);
+    await fs.writeFile(
+      witness,
+      `import type {Modules} from ${JSON.stringify("./" + bindingPath.replace(/\.ts$/, ".js"))};import {${entry.export} as Component} from ${JSON.stringify("./" + source.replace(/\.[cm]?tsx?$/, ".js"))};const checked:Modules[${JSON.stringify(declaration.displayName)}]=Component;export default checked;\n` +
+        (module.contract === "org.quixos.react.subject-only/1"
+          ? `import type {ComponentProps} from "react";declare const props:Pick<ComponentProps<Modules[${JSON.stringify(declaration.displayName)}]>,"subject"|"input">;const mount = <Component {...props}/>;\n`
+          : ""),
+    );
+    witnesses.push(path.basename(witness));
+  }
+  checkComponentTypes({
+    node: config.node,
+    tsc: config.tsc,
+    work,
+    witnesses,
+    assets: assetPath,
+    props: propsPath,
+    packageRevision: pkg.revision,
+  });
+  const components = [];
+  const { checkControls } = await import(pathToFileURL(path.join(settings.sdk, "lint-controls.mjs")));
+  const { default: ts } = await import(pathToFileURL(path.resolve(path.dirname(config.tsc), "../lib/typescript.js")));
+  const checkedControls = new Set();
+  for (const [id, entry] of entries) {
+    const declaration = declarations.find((component) => component.id === id),
+      source = compiler.artifactPath(entry.entry),
+      key = digest(Buffer.from(id)).slice(0, 24),
+      directory = "share/quixos/components/" + key;
+    const metadata = path.join(work, "component-meta-" + key + ".json");
+    const facade = "component-entry-" + key + ".ts";
+    await fs.writeFile(
+      path.join(work, facade),
+      `export {${entry.export}} from ${JSON.stringify("./" + source.replace(/\.[cm]?tsx?$/, ".js"))};\n`,
+    );
+    await fs.mkdir(path.join(output, directory), { recursive: true });
+    measureBuild("component-bundle", { package: pkg.revision, component: id }, () =>
+      execFileSync(
+        config.esbuild,
+        [
+          facade,
+          "--bundle",
+          "--platform=browser",
+          "--format=esm",
+          "--target=es2024",
+          "--jsx=automatic",
+          '--define:process.env.NODE_ENV="production"',
+          "--metafile=" + metadata,
+          "--outfile=" + path.join(output, directory, "module.mjs"),
+          ...sharedAliases,
+          ...["svg", "png", "jpg", "jpeg", "gif", "webp", "avif", "woff", "woff2", "ttf", "ico"].map(
+            (extension) => "--loader:." + extension + "=dataurl",
+          ),
+        ],
+        { cwd: work, stdio: "inherit" },
+      ),
+    );
+    const meta = JSON.parse(await fs.readFile(metadata, "utf8")),
+      outputs = Object.entries(meta.outputs);
+    for (const file of Object.keys(meta.inputs)) {
+      if (!/\.[cm]?[jt]sx?$/.test(file) || file.includes("node_modules/") || checkedControls.has(file)) continue;
+      checkedControls.add(file);
+      const errors = checkControls(ts, await fs.readFile(path.resolve(work, file), "utf8"), file);
+      if (errors.length) throw Error(errors.join("\n"));
+    }
+    const main = outputs.find(([file]) => file.endsWith("/module.mjs"))?.[1];
+    if (!main?.exports.includes(entry.export)) throw Error("Component bundle lacks declared export");
+    if (
+      Object.keys(meta.inputs).some((file) =>
+        /camino-replica-engine|camino-replica-client|replicache|node_modules\/(?:react|react-dom|scheduler)(?:\/|$)/.test(
+          file,
+        ),
+      )
+    )
+      throw Error("Component bundled an internal engine/client or duplicate React");
+    if (
+      outputs.some(([, value]) =>
+        value.imports.some((imported) => imported.external && !Object.values(imports).includes(imported.path)),
+      )
+    )
+      throw Error("Component has an undeclared external module or asset");
+    const files = [...sharedFiles];
+    for (const [file] of outputs) {
+      const absolute = path.resolve(work, file),
+        relative = path.relative(output, absolute);
+      compiler.artifactPath(relative);
+      if (!relative.startsWith(directory + "/")) throw Error("Component output escaped declared artifact closure");
+      files.push(await recordFile(relative, relative.endsWith(".css") ? "text/css" : "text/javascript"));
+    }
+    const body = {
+      id,
+      subject: declaration.subject,
+      compatibility: "org.quixos.react.esm/1",
+      path: directory + "/module.mjs",
+      exportName: entry.export,
+      sharedModules,
+      files,
+    };
+    components.push({ ...body, contentDigest: compiler.componentArtifactDigest(body) });
+  }
+  return components;
+}

build-profile.mjs

@@ -0,0 +1,12 @@
+/** Timing is log data, never part of an artifact or its witness. */
+export function measureBuild(phase, details, action) {
+  const started = performance.now();
+  try {
+    return action();
+  } finally {
+    if (process.env.QUIXOS_TRACE_PROFILE === "1")
+      console.error(
+        `[qx-build-profile] ${JSON.stringify({ phase, ms: Math.round(performance.now() - started), ...details })}`,
+      );
+  }
+}

build-react-contracts.mjs

@@ -0,0 +1,107 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { installDependencies } from "./install-dependencies.mjs";
+const config = JSON.parse(await fs.readFile(process.argv[2], "utf8"));
+const resource = JSON.parse(await fs.readFile(config.interface, "utf8"));
+if (resource.kind !== "interface") throw Error("React props belong to an interface resource");
+const iface = resource.revision;
+const output = process.env.out;
+if (!output) throw Error("Missing Nix output");
+const work = path.resolve("contracts-source");
+const declarations = [];
+await fs.cp(config.source, work, { recursive: true });
+const writable = async (directory) => {
+  await fs.chmod(directory, 0o755);
+  for (const entry of await fs.readdir(directory, { withFileTypes: true })) {
+    const file = path.join(directory, entry.name);
+    if (entry.isSymbolicLink()) throw Error("Contract source cannot contain symlinks");
+    if (entry.isDirectory()) await writable(file);
+    else {
+      await fs.chmod(file, 0o644);
+      if (/\.d\.[cm]?ts$/.test(file)) declarations.push(path.relative(work, file));
+    }
+  }
+};
+await writable(work);
+const packageFile = path.join(work, "package.json");
+const metadata = await fs.readFile(packageFile, "utf8").then(JSON.parse, (error) => {
+  if (error.code === "ENOENT") return {};
+  throw error;
+});
+await fs.writeFile(packageFile, JSON.stringify({ ...metadata, type: "module" }));
+const modules = path.join(output, "node_modules");
+await fs.mkdir(modules, { recursive: true });
+await installDependencies({
+  destination: modules,
+  application: config.dependencies,
+  selected: config.reactSdk ? { "@quixos/camino-react": config.reactSdk } : {},
+  reserved: ["@quixos/camino-react"],
+});
+await fs.symlink(modules, path.join(work, "node_modules"));
+const members = Object.create(null);
+let index = 0;
+for (const [id, entry] of Object.entries(config.members)) {
+  const member = (iface.template?.members ?? iface.members).find((member) => member.id === id);
+  if (
+    member?.kind !== "module" ||
+    !["org.quixos.react.component/1", "org.quixos.react.component/2", "org.quixos.react.subject-only/1"].includes(
+      member.contract,
+    )
+  )
+    throw Error("Props entry is not a React module member: " + id);
+  if (
+    !/^[$A-Z_a-z][$\w]*$/.test(entry.export) ||
+    path.isAbsolute(entry.entry) ||
+    entry.entry.split("/").some((part) => part === ".." || !part)
+  )
+    throw Error("Invalid props type entry");
+  const filename = `props-${index++}.ts`;
+  const typeImport = JSON.stringify("./" + entry.entry.replace(/\.[cm]?tsx?$/, ".js"));
+  await fs.writeFile(
+    path.join(work, filename),
+    `import type {${entry.export} as Props} from ${typeImport};
+type Assert<T extends true> = T;
+type ObjectProps = Assert<Props extends object ? true : false>;
+type ReservedRendererProps = Assert<Extract<keyof Props, "subject" | "input" | "navigation" | "usingComponent" | "provider" | "coverage" | "componentCodeFallback"> extends never ? true : false>;
+${member.contract === "org.quixos.react.subject-only/1" ? "type SubjectOnly = Assert<{} extends Props ? true : false>;" : ""}
+export type {Props};\n`,
+  );
+  members[id] = { path: filename.replace(/\.ts$/, ".d.ts"), export: "Props" };
+}
+await fs.mkdir(path.join(output, "types"), { recursive: true });
+if (!Object.keys(members).length) throw Error("React type companion declares no module members");
+execFileSync(
+  config.node,
+  [
+    config.tsc,
+    "--declaration",
+    "--emitDeclarationOnly",
+    "--strict",
+    "--target",
+    "es2024",
+    "--lib",
+    "es2024,dom,dom.iterable,esnext.disposable",
+    "--module",
+    "nodenext",
+    "--moduleResolution",
+    "nodenext",
+    "--rootDir",
+    work,
+    "--outDir",
+    path.join(output, "types"),
+    ...Object.values(members).map((entry) => path.join(work, entry.path.replace(/\.d\.ts$/, ".ts"))),
+  ],
+  { cwd: work, stdio: "inherit" },
+);
+// TypeScript emits declarations for implementation sources, but does not copy
+// authored declarations which those emitted files may import.
+for (const file of declarations) {
+  await fs.mkdir(path.dirname(path.join(output, "types", file)), { recursive: true });
+  await fs.copyFile(path.join(work, file), path.join(output, "types", file));
+}
+await fs.writeFile(path.join(output, "package.json"), JSON.stringify({ type: "module" }));
+await fs.writeFile(
+  path.join(output, "react-contracts.json"),
+  JSON.stringify({ schemaVersion: 1, interfaceRevisionId: iface.revisionId, members }, null, 2),
+);

build-service.mjs

@@ -0,0 +1,88 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+
+export async function buildService({
+  config,
+  compiler,
+  pkg,
+  output,
+  coreServer,
+  sharedFiles,
+  implementations,
+  recordFile,
+}) {
+  const relative = compiler.artifactPath;
+  if (pkg.exports.length || config.service.entry) {
+    await fs.mkdir(path.join(output, "bin"), { recursive: true });
+    await fs.mkdir(path.join(output, "share/quixos/service"), { recursive: true });
+    let serviceEntry;
+    if (config.service.entry) {
+      if (!/\.m?js$/.test(config.service.entry))
+        throw Error("Custom service entry must be JavaScript; use a separate typed/language build before packaging");
+      serviceEntry = path.join(config.source, relative(config.service.entry));
+    } else {
+      const modules = implementations.filter((implementation) => implementation.target === "server");
+      if (pkg.exports.some((entry) => !modules.some((module) => module.exports.includes(entry.id))))
+        throw Error("Generated service does not cover every package export; provide a custom service");
+      if (!modules.length) throw Error("Generated service requires a checked registry");
+      serviceEntry = path.resolve("service-entry.mjs");
+      const imports = modules
+        .map(
+          (module, index) =>
+            `import { ${module.registryExport} as registry${index} } from ${JSON.stringify(path.join(output, module.path))};`,
+        )
+        .join("\n");
+      await fs.writeFile(
+        serviceEntry,
+        imports +
+          `\nimport {servePortableRegistry} from ${JSON.stringify(config.serviceAdapter)};
+const registries = [${modules.map((_, index) => "registry" + index).join(",")}];
+const owners = new Map();
+for (const registry of registries) for (const id of registry.exports) {
+  if (owners.has(id)) throw Error("Duplicate registry export " + id);
+  owners.set(id, registry);
+}
+servePortableRegistry({exports: [...owners.keys()], invoke(request, channel, context) {
+  const registry = owners.get(request.exportId);
+  if (!registry) throw Error("Unknown export");
+  return registry.invoke(request, channel, context);
+}});\n`,
+      );
+    }
+    const serviceModule = "share/quixos/service/main.mjs";
+    execFileSync(
+      config.esbuild,
+      [
+        serviceEntry,
+        "--bundle",
+        "--platform=node",
+        "--format=esm",
+        "--minify-whitespace",
+        "--target=es2024",
+        `--external:${coreServer}`,
+        `--outfile=${path.join(output, serviceModule)}`,
+      ],
+      { stdio: "inherit" },
+    );
+    await fs.writeFile(
+      path.join(output, "bin/service"),
+      `#!${config.shell}\nservice_root=\${0%/*}/..\nexec ${config.node} "$service_root/${serviceModule}" "$@"\n`,
+      { mode: 0o755 },
+    );
+    const serviceBody = {
+      id: "service",
+      target: "server",
+      compatibility: "quixos-service-v1",
+      path: "bin/service",
+      ports: "quixos-transaction-ports-v1",
+      exports: pkg.exports.map((e) => e.id),
+      files: [
+        await recordFile("bin/service", "text/x-shellscript"),
+        await recordFile(serviceModule, "text/javascript"),
+        ...sharedFiles,
+      ],
+    };
+    implementations.unshift({ ...serviceBody, contentDigest: compiler.implementationDigest(serviceBody) });
+  }
+}

build-tools.nix

@@ -0,0 +1,13 @@
+# Standalone build drivers import sibling JavaScript modules. Their code is an
+# input; Nix helper APIs and test sources do not belong to that dependency.
+builtins.path {
+  path = ./.;
+  name = "camino-build-tools";
+  filter =
+    filename: type:
+    let
+      name = builtins.baseNameOf filename;
+    in
+    type == "directory"
+    || (builtins.match ".*\\.mjs" name != null && builtins.match ".*\\.test\\.mjs" name == null);
+}

check-receipt.mjs

@@ -0,0 +1,40 @@
+import fs from "node:fs";
+import crypto from "node:crypto";
+const [schemaPath, packageRevisionId, bindingOutput, generatorPath, output] = process.argv.slice(2);
+if (!schemaPath || !packageRevisionId || !bindingOutput || !generatorPath || !output)
+  throw new Error("Missing candidate check receipt inputs");
+const canonical = (value) =>
+  Array.isArray(value)
+    ? value.map(canonical)
+    : value && typeof value === "object"
+      ? Object.fromEntries(
+          Object.entries(value)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([key, entry]) => [key, canonical(entry)]),
+        )
+      : value;
+const hash = (value) =>
+  `sha256:${crypto
+    .createHash("sha256")
+    .update(JSON.stringify(canonical(value)))
+    .digest("hex")}`;
+const schema = JSON.parse(fs.readFileSync(schemaPath, "utf8"));
+if (!schema.packages.some((entry) => entry.revisionId === packageRevisionId))
+  throw new Error("Checked binding schema lacks the package");
+const generated = fs.readFileSync(bindingOutput, "utf8");
+if (generated !== fs.readFileSync(".qx-checked-bindings", "utf8"))
+  throw new Error("Build replaced candidate-generated bindings; its check is not evidence for this candidate");
+const receipt = {
+  schemaVersion: 1,
+  packageRevisionId,
+  success: true,
+  bindingSchema: schema,
+  bindingSchemaDigest: hash(schema),
+  generatedDigest: hash(generated),
+  checkerDigest: hash({
+    generatorPath,
+    compiler: JSON.parse(fs.readFileSync("node_modules/typescript/package.json", "utf8")),
+    lock: fs.readFileSync("yarn.lock", "utf8"),
+  }),
+};
+fs.writeFileSync(output, `${JSON.stringify(receipt, null, 2)}\n`, { flag: "wx" });

component-type-batch.mjs

@@ -0,0 +1,49 @@
+import path from "node:path";
+import { createRequire } from "node:module";
+
+const [tsc, count, ...args] = process.argv.slice(2);
+const ts = createRequire(import.meta.url)(path.resolve(path.dirname(tsc), "../lib/typescript.js"));
+const parsed = ts.parseCommandLine(args);
+const witnesses = parsed.fileNames.slice(0, Number(count));
+const shared = parsed.fileNames.slice(Number(count));
+const host = ts.createCompilerHost(parsed.options, true);
+// These programs only discover source closures; they do not bind or check.
+// Sharing immutable parsed source files avoids reading/parsing the same libs
+// for every witness. Only the final combined program performs typechecking.
+const sources = new Map();
+const getSourceFile = host.getSourceFile;
+host.getSourceFile = (filename, ...options) => {
+  if (!sources.has(filename)) sources.set(filename, getSourceFile(filename, ...options));
+  return sources.get(filename);
+};
+for (const method of ["fileExists", "directoryExists", "getDirectories", "readFile", "realpath"]) {
+  if (!host[method]) continue;
+  const original = host[method],
+    cache = new Map();
+  host[method] = (filename) => {
+    if (!cache.has(filename)) cache.set(filename, original(filename));
+    return cache.get(filename);
+  };
+}
+const closures = witnesses.map(
+  (witness) => new Set(ts.createProgram([witness, ...shared], parsed.options, host).getSourceFiles()),
+);
+const common = new Set([...closures[0]].filter((source) => closures.every((closure) => closure.has(source))));
+const ambient = (node) =>
+  ts.isModuleDeclaration(node) || ts.isNamespaceExportDeclaration(node) || ts.forEachChild(node, ambient);
+// A file that is visible to just some witnesses must not contribute globals
+// or ambient module declarations to the others. Otherwise a combined success
+// could hide an independent failure. Script files are conservatively unsafe.
+if (
+  closures.some((closure) =>
+    [...closure].some((source) => !common.has(source) && (!ts.isExternalModule(source) || ambient(source))),
+  )
+)
+  process.exit(2);
+
+const program = ts.createProgram(parsed.fileNames, parsed.options, host);
+const diagnostics = [...parsed.errors, ...ts.getPreEmitDiagnostics(program)];
+if (diagnostics.length) {
+  console.error(ts.formatDiagnosticsWithColorAndContext(diagnostics, host));
+  process.exit(1);
+}

component-types.mjs

@@ -0,0 +1,51 @@
+import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { measureBuild } from "./build-profile.mjs";
+
+// Component witnesses share bindings and usually the same source graph.
+// Check a bounded batch once when distinct source closures cannot supply
+// ambient declarations to one another. Otherwise use the original checks.
+export function checkComponentTypes({ node, tsc, work, witnesses, assets, props, packageRevision }) {
+  const checkTypes = (files, combined = false) =>
+    execFileSync(
+      node,
+      [
+        ...(combined ? [fileURLToPath(new URL("./component-type-batch.mjs", import.meta.url))] : []),
+        tsc,
+        ...(combined ? [String(files.length)] : []),
+        "--noEmit",
+        "--strict",
+        "--skipLibCheck",
+        "false",
+        "--target",
+        "es2024",
+        "--lib",
+        "es2024,dom,dom.iterable,esnext.disposable",
+        "--module",
+        "nodenext",
+        "--moduleResolution",
+        "nodenext",
+        "--jsx",
+        "react-jsx",
+        ...files,
+        assets,
+        props,
+      ],
+      { cwd: work, stdio: combined ? "pipe" : "inherit" },
+    );
+  measureBuild("component-typecheck", { package: packageRevision, components: witnesses.length }, () => {
+    for (let start = 0; start < witnesses.length; start += 1000) {
+      const batch = witnesses.slice(start, start + 1000);
+      if (batch.length === 1) checkTypes(batch);
+      else {
+        try {
+          checkTypes(batch, true);
+        } catch (error) {
+          if (!(error.status > 0) && error.code !== "ENOBUFS") throw error;
+          console.error("Component batch requires independent witness checks");
+          for (const witness of batch) checkTypes([witness]);
+        }
+      }
+    }
+  });
+}

component-types.test.mjs

@@ -0,0 +1,59 @@
+import assert from "node:assert/strict";
+import { mkdtemp, writeFile, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { checkComponentTypes } from "./component-types.mjs";
+
+const tsc = process.env.QUIXOS_TYPESCRIPT;
+if (!tsc) throw Error("Pass the selected TypeScript compiler path");
+async function fixture(context, left, right) {
+  const work = await mkdtemp(path.join(os.tmpdir(), "component-types-"));
+  context.after(() => rm(work, { recursive: true, force: true }));
+  await Promise.all(
+    Object.entries({ "left.ts": left, "right.ts": right, "assets.d.ts": "", "props.d.ts": "" }).map(([file, source]) =>
+      writeFile(path.join(work, file), source),
+    ),
+  );
+  return {
+    node: process.execPath,
+    tsc,
+    work,
+    witnesses: ["left.ts", "right.ts"],
+    assets: "assets.d.ts",
+    props: "props.d.ts",
+    packageRevision: "test",
+  };
+}
+test("shared component typechecking accepts all valid witnesses", async (context) => {
+  checkComponentTypes(await fixture(context, "export const left: string = 'ok';", "export const right: number = 1;"));
+});
+test("independently valid ambient declarations use the full individual check fallback", async (context) => {
+  checkComponentTypes(
+    await fixture(
+      context,
+      "export {}; declare global { interface Application { value: string; } }",
+      "export {}; declare global { interface Application { value: number; } }",
+    ),
+  );
+});
+test("a type error in any witness still rejects the artifact", async (context) => {
+  const input = await fixture(context, "export const left: string = 'ok';", "export const right: string = 1;");
+  assert.throws(() => checkComponentTypes(input));
+});
+test("one witness's globals cannot make an independently invalid witness pass", async (context) => {
+  const input = await fixture(
+    context,
+    "export {}; declare global { interface Application { value: string; } }",
+    "export const right: Application = {value: 'ok'};",
+  );
+  assert.throws(() => checkComponentTypes(input));
+});
+test("an ambient module from another source closure cannot resolve a missing import", async (context) => {
+  const input = await fixture(
+    context,
+    "declare module 'missing-component-package' { export const value: string; }",
+    "import {value} from 'missing-component-package'; export const right = value;",
+  );
+  assert.throws(() => checkComponentTypes(input));
+});

implementation-source.nix

@@ -0,0 +1,30 @@
+# QX and recursive pins enter through the checked contract and build recipe.
+# The compiler receives authored implementation files, not resource provenance.
+{ lib, src }:
+builtins.path {
+  path = src;
+  name = "camino-implementation-source";
+  filter =
+    path: type:
+    let
+      name = builtins.baseNameOf path;
+    in
+    if type == "directory" then
+      !(builtins.elem name [
+        ".git"
+        ".jj"
+        "node_modules"
+      ])
+    else
+      !(builtins.elem name [
+        "flake.nix"
+        "flake.lock"
+        "quixos.lock"
+        "quixos.check.json"
+        "quixos.react.json"
+        "yarn-project.nix"
+        "components.nix"
+        "contracts.nix"
+      ])
+      && !(lib.hasSuffix ".qx" name);
+}

install-dependencies.mjs

@@ -0,0 +1,61 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createHash } from "node:crypto";
+
+async function packages(directory) {
+  const result = new Map();
+  for (const entry of await fs.readdir(directory)) {
+    if (entry.startsWith(".")) continue;
+    if (entry.startsWith("@")) {
+      for (const name of await fs.readdir(path.join(directory, entry)))
+        result.set(`${entry}/${name}`, path.join(directory, entry, name));
+    } else result.set(entry, path.join(directory, entry));
+  }
+  return result;
+}
+async function packageDigest(directory) {
+  const digest = createHash("sha256");
+  async function visit(relative) {
+    for (const entry of (await fs.readdir(path.join(directory, relative), { withFileTypes: true })).sort((a, b) =>
+      a.name.localeCompare(b.name),
+    )) {
+      if (entry.name === "node_modules") continue;
+      const name = path.join(relative, entry.name),
+        file = path.join(directory, name);
+      if (entry.isDirectory()) await visit(name);
+      else {
+        const bytes = await fs.readFile(file);
+        digest.update(JSON.stringify([name, bytes.length]));
+        digest.update(bytes);
+      }
+    }
+  }
+  await visit("");
+  return digest.digest("hex");
+}
+/** Merge at package granularity: a scope such as @types is not a reserved package. */
+export async function installDependencies({ destination, application, defaults = [], selected = {}, reserved = [] }) {
+  const entries = new Map();
+  const authored = new Set();
+  for (const root of defaults) for (const [name, file] of await packages(root)) entries.set(name, file);
+  for (const [name, file] of Object.entries(selected)) entries.set(name, file);
+  if (application)
+    for (const [name, file] of await packages(application)) {
+      if (reserved.includes(name)) {
+        const canonical = entries.get(name);
+        if (!canonical || (await packageDigest(file)) !== (await packageDigest(canonical)))
+          throw Error("Application dependencies cannot substitute selected React/client types or checked SDK: " + name);
+      } else {
+        entries.set(name, file);
+        authored.add(name);
+      }
+    }
+  for (const [name, file] of entries) {
+    await fs.mkdir(path.dirname(path.join(destination, name)), { recursive: true });
+    // Application packages resolve siblings from this assembled node_modules.
+    // Keep SDK links canonical: copying those would duplicate branded types and
+    // React declarations from their own retained dependency closures.
+    if (authored.has(name)) await fs.cp(file, path.join(destination, name), { recursive: true, dereference: true });
+    else await fs.symlink(file, path.join(destination, name));
+  }
+}

package-context.nix

@@ -0,0 +1,2 @@
+# The selected protocol owns semantic projection; builders receive its result.
+args@{ protocol, ... }: import "${protocol}/share/package-context.nix" args

package-set.test.nix

@@ -0,0 +1,57 @@
+{
+  pkgs,
+  nixpkgs,
+  system,
+}:
+let
+  packageSet = (import ./quixos-package-helpers.nix).packageSet;
+  shared = {
+    marker = "shared";
+  };
+  environment = {
+    inherit system;
+    nixpkgsSource = toString nixpkgs;
+    pkgs = shared;
+    narHash = nixpkgs.narHash;
+  };
+  standard = {
+    inherit nixpkgs system;
+    context.buildEnvironment = environment;
+  };
+  fallback = packageSet { inherit nixpkgs system; };
+in
+assert packageSet standard == shared;
+assert
+  packageSet (
+    standard
+    // {
+      context.buildEnvironment = environment // {
+        nixpkgsSource = "same-content-under-another-name";
+      };
+    }
+  ) == shared;
+assert
+  (packageSet (
+    standard
+    // {
+      context.buildEnvironment = environment // {
+        system = "another-system";
+      };
+    }
+  )).path == fallback.path;
+assert
+  (packageSet (
+    standard
+    // {
+      context.buildEnvironment = environment // {
+        nixpkgsSource = "another-source";
+        narHash = "another-hash";
+      };
+    }
+  )).path == fallback.path;
+assert
+  (packageSet (standard // { overlays = [ (_: _: { marker = "overlay"; }) ]; })).marker == "overlay";
+assert (packageSet (standard // { config.allowBroken = true; })).config.allowBroken;
+pkgs.runCommand "camino-package-set-check" { } ''
+  touch "$out"
+''

portable-service.mjs

@@ -0,0 +1,171 @@
+/** Generated-service transport. The supervisor owns process isolation, deadlines and termination.
+ * stdout is reserved for this protocol; application diagnostics belong on stderr. */
+export function servePortableRegistry(
+  registry,
+  { maxBytes = 4 * 1024 * 1024, maxInvocations = 64, maxPortCalls = 10000 } = {},
+) {
+  const abi = "quixos-transaction-ports-v1";
+  const active = new Map();
+  const pending = new Map();
+  let buffer = Buffer.alloc(0),
+    stopped = false;
+  const send = (message) => {
+    const encoded = JSON.stringify(message);
+    if (Buffer.byteLength(encoded) > maxBytes) throw Error("SERVICE_MESSAGE_LIMIT");
+    // A slow or absent coordinator must not cause an unbounded stdout queue.
+    if (process.stdout.writableLength + Buffer.byteLength(encoded) > maxBytes * 2) throw Error("SERVICE_BACKPRESSURE");
+    process.stdout.write(encoded + "\n");
+  };
+  const errorBody = (error) => ({
+    code: typeof error?.code === "string" ? error.code.slice(0, 1024) : "PACKAGE_ERROR",
+    message: String(error?.message ?? error).slice(0, 4096),
+  });
+  const rejectPorts = (id, reason) => {
+    for (const [key, call] of pending)
+      if (call.invocation === id) {
+        pending.delete(key);
+        call.reject(reason);
+      }
+  };
+  const cancel = (id, reason) => {
+    const token = active.get(id);
+    if (token) {
+      token.cancelled = true;
+      token.controller.abort(reason);
+    }
+    rejectPorts(id, reason);
+  };
+  const fatal = (error) => {
+    if (stopped) return;
+    stopped = true;
+    for (const id of active.keys()) cancel(id, error);
+    process.stderr.write(String(error?.message ?? error) + "\n");
+    process.exitCode = 1;
+    process.stdin.destroy();
+  };
+  const receive = (message) => {
+    if (!message || message.abi !== abi) throw Error("SERVICE_ABI_MISMATCH");
+    if (message.kind === "shutdown") {
+      for (const id of active.keys()) cancel(id, Error("SERVICE_SHUTDOWN"));
+      stopped = true;
+      process.stdin.destroy();
+      return;
+    }
+    if (message.kind === "cancel") {
+      const token = active.get(message.invocation);
+      if (token && token.frame !== message.frame) throw Error("INVALID_CANCELLATION_FRAME");
+      cancel(message.invocation, Error("INVOCATION_CANCELLED"));
+      // A completed result may already be in flight. Acknowledge without resurrecting its context.
+      if (!token) send({ abi, kind: "cancelled", invocation: message.invocation, frame: message.frame });
+      return;
+    }
+    if (message.kind === "port-result") {
+      const key = JSON.stringify([message.invocation, message.sequence]);
+      const call = pending.get(key);
+      if (!call && (!active.has(message.invocation) || active.get(message.invocation).cancelled)) return;
+      if (!call || message.frame !== call.frame) throw Error("UNEXPECTED_PORT_RESULT");
+      pending.delete(key);
+      if (message.status === "returned") call.resolve(message.output);
+      else if (message.status === "failed")
+        call.reject(
+          Object.assign(Error(String(message.error?.message ?? "Port failed")), {
+            code: String(message.error?.code ?? "PORT_FAILED"),
+          }),
+        );
+      else throw Error("INVALID_PORT_RESULT");
+      return;
+    }
+    if (
+      message.kind !== "invoke" ||
+      typeof message.invocation !== "string" ||
+      typeof message.frame !== "string" ||
+      !message.invocation ||
+      !message.frame ||
+      message.invocation.length > 4096 ||
+      message.frame.length > 4096
+    )
+      throw Error("INVALID_INVOCATION");
+    if (active.has(message.invocation) || active.size >= maxInvocations) throw Error("INVOCATION_LIMIT_OR_DUPLICATE");
+    const token = { frame: message.frame, controller: new AbortController(), cancelled: false };
+    active.set(message.invocation, token);
+    let sequence = 0;
+    const channel = (request) => {
+      if (active.get(message.invocation) !== token || token.cancelled)
+        return Promise.reject(Error("EXPIRED_INVOCATION"));
+      if (++sequence > maxPortCalls || pending.size >= maxPortCalls) return Promise.reject(Error("PORT_CALL_LIMIT"));
+      const key = JSON.stringify([message.invocation, sequence]);
+      return new Promise((resolve, reject) => {
+        pending.set(key, { invocation: message.invocation, frame: message.frame, resolve, reject });
+        try {
+          send({
+            abi,
+            kind: "port",
+            frame: message.frame,
+            invocation: message.invocation,
+            sequence,
+            portId: request.portId,
+            action: { ...request.action, ...(request.key === undefined ? {} : { key: request.key }) },
+            input: request.input,
+          });
+        } catch (error) {
+          pending.delete(key);
+          reject(error);
+        }
+      });
+    };
+    void registry
+      .invoke(
+        { exportId: message.exportId, workspace: message.workspace, receiver: message.receiver, input: message.input },
+        channel,
+        Object.freeze({ signal: token.controller.signal, effect: message.effect }),
+      )
+      .then(
+        (output) => {
+          if (active.get(message.invocation) === token && !token.cancelled)
+            send({ abi, invocation: message.invocation, status: "returned", output });
+        },
+        (error) => {
+          if (active.get(message.invocation) === token && !token.cancelled)
+            send({ abi, invocation: message.invocation, status: "failed", error: errorBody(error) });
+        },
+      )
+      .catch(fatal)
+      .finally(() => {
+        if (active.get(message.invocation) === token) {
+          active.delete(message.invocation);
+          token.controller.abort(Error("INVOCATION_ENDED"));
+          rejectPorts(message.invocation, Error("INVOCATION_ENDED"));
+          if (token.cancelled && !stopped)
+            send({ abi, kind: "cancelled", invocation: message.invocation, frame: token.frame });
+        }
+      })
+      .catch(fatal);
+  };
+  process.stdin.on("data", (bytes) => {
+    if (stopped) return;
+    try {
+      // Consume each line before retaining the remainder; combined transport chunks may contain many frames.
+      let offset = 0;
+      while (offset < bytes.length) {
+        const newline = bytes.indexOf(10, offset);
+        const end = newline < 0 ? bytes.length : newline;
+        if (buffer.length + end - offset > maxBytes) throw Error("SERVICE_MESSAGE_LIMIT");
+        buffer = Buffer.concat([buffer, bytes.subarray(offset, end)]);
+        if (newline < 0) break;
+        receive(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(buffer)));
+        buffer = Buffer.alloc(0);
+        offset = newline + 1;
+        if (stopped) break;
+      }
+    } catch (error) {
+      fatal(error);
+    }
+  });
+  process.stdin.on("end", () => {
+    if (buffer.length) fatal(Error("TRUNCATED_SERVICE_MESSAGE"));
+    for (const id of active.keys()) cancel(id, Error("COORDINATOR_DISCONNECTED"));
+  });
+  process.stdin.on("error", fatal);
+  process.stdout.on("error", fatal);
+  send({ abi, kind: "ready", exports: registry.exports });
+}

react-contracts.nix

@@ -0,0 +1,38 @@
+{
+  pkgs,
+  context,
+  src,
+  members,
+  dependencies ? null,
+}:
+let
+  buildTools = import ./build-tools.nix;
+  config = pkgs.writeText "camino-react-contracts.json" (
+    builtins.toJSON {
+      source = import ./implementation-source.nix {
+        inherit (pkgs) lib;
+        inherit src;
+      };
+      interface = builtins.toFile "camino-interface-contract.json" (
+        builtins.unsafeDiscardStringContext (
+          builtins.toJSON (
+            let
+              resource = builtins.fromJSON (builtins.readFile context.interface);
+            in
+            {
+              kind = resource.kind;
+              revision = builtins.removeAttrs resource.revision [ "source" ];
+            }
+          )
+        )
+      );
+      inherit members dependencies;
+      reactSdk = context.reactSdk or null;
+      node = "${pkgs.nodejs_24}/bin/node";
+      tsc = "${context.typescript}/node_modules/typescript/bin/tsc";
+    }
+  );
+in
+pkgs.runCommand "camino-react-contracts" { } ''
+  ${pkgs.nodejs_24}/bin/node ${buildTools}/build-react-contracts.mjs ${config}
+''

react-package.nix

@@ -0,0 +1,34 @@
+{
+  pkgs,
+  context,
+  src,
+  modules,
+  bindingOutput ? "src/gen/client.ts",
+  dependencies ? null,
+}:
+let
+  group = import ./artifacts.nix {
+    inherit pkgs src;
+    inherit (context)
+      buildContract
+      core
+      sharedRuntime
+      typescript
+      packageRevisionId
+      ;
+    protocol = context.generator;
+    group = true;
+    nodeModules = dependencies;
+    components = {
+      inherit bindingOutput;
+      inherit (context.react) sdk runtime;
+      entries = modules;
+      contracts = context.react.contracts or [ ];
+    };
+  };
+  package = import ./assemble-package.nix {
+    inherit pkgs context;
+    artifacts = [ group ];
+  };
+in
+package // { caminoGroup = group; }

typescript-package.nix

@@ -0,0 +1,41 @@
+{
+  pkgs,
+  context,
+  src,
+  entry,
+  targets ? [
+    "browser"
+    "server"
+  ],
+  entries ? { },
+  bindingOutput ? "src/gen/qx.ts",
+  dependencies ? null,
+}:
+let
+  group = import ./artifacts.nix {
+    inherit pkgs src;
+    inherit (context)
+      buildContract
+      core
+      sharedRuntime
+      typescript
+      packageRevisionId
+      ;
+    protocol = context.generator;
+    group = true;
+    nodeModules = dependencies;
+    portable = {
+      inherit
+        entry
+        entries
+        targets
+        bindingOutput
+        ;
+    };
+  };
+  package = import ./assemble-package.nix {
+    inherit pkgs context;
+    artifacts = [ group ];
+  };
+in
+package // { caminoGroup = group; }

typescript-service.nix

@@ -0,0 +1,30 @@
+{
+  pkgs,
+  context,
+  src,
+  entry,
+  bindingOutput ? "src/gen/remote.ts",
+  dependencies ? null,
+  service ? { },
+}:
+let
+  group = import ./artifacts.nix {
+    inherit pkgs src service;
+    inherit (context)
+      buildContract
+      core
+      sharedRuntime
+      typescript
+      packageRevisionId
+      ;
+    protocol = context.generator;
+    group = true;
+    nodeModules = dependencies;
+    remote = { inherit entry bindingOutput; };
+  };
+  package = import ./assemble-package.nix {
+    inherit pkgs context;
+    artifacts = [ group ];
+  };
+in
+package // { caminoGroup = group; }

yarn-dependencies.nix

@@ -0,0 +1,29 @@
+{
+  pkgs,
+  src,
+  nodejs ? pkgs.nodejs_24,
+}:
+let
+  project = (pkgs.callPackage (src + "/yarn-project.nix") { inherit nodejs; }) {
+    inherit src;
+    overrideAttrs = _: {
+      buildPhase = "runHook preBuild; runHook postBuild";
+      installPhase = ''
+        runHook preInstall
+        test -d node_modules
+        mkdir -p "$out"
+        cp -a node_modules/. "$out/"
+        runHook postInstall
+      '';
+    };
+  };
+in
+project
+// {
+  devShell = pkgs.mkShell {
+    packages = [
+      nodejs
+      project.yarn-freestanding
+    ];
+  };
+}

yarn-shell.nix

@@ -0,0 +1,22 @@
+{ pkgs }:
+let
+  yarnCli = pkgs.fetchurl {
+    url = "https://repo.yarnpkg.com/4.18.0/packages/yarnpkg-cli/bin/yarn.js";
+    hash = "sha512-/Lhxb+fNDuzhQf/Bi5IZOp35IEwbqDGJwoiDUiP8C75kr0c7qw1emSen2utcryuwfrJ4fMkzjKBA6hJfKh8vfg==";
+  };
+  yarn = pkgs.writeShellScriptBin "yarn" ''
+    exec ${pkgs.nodejs_24}/bin/node ${yarnCli} "$@"
+  '';
+in
+pkgs.mkShell {
+  packages = [
+    pkgs.nodejs_24
+    yarn
+  ];
+  shellHook = ''
+    if [ ! -f .yarn/plugins/yarn-plugin-nixify.cjs ]; then
+      mkdir -p .yarn/plugins
+      cp ${./.yarn/plugins/yarn-plugin-nixify.cjs} .yarn/plugins/yarn-plugin-nixify.cjs
+    fi
+  '';
+}