Compare commits
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"version": 1,
|
||||
"sourceRepo": "https://gitea.internal.quixos.org/quixos/quixos.git",
|
||||
"sourceCommit": "ca5b05584b89e90cb259b4596b1bc01d3d692136",
|
||||
"sourceCommit": "dd5a29c267f0313d46ac845e5d341cde4c67e4d1",
|
||||
"sourcePath": "quixos-protocol",
|
||||
"exportName": "quixos-protocol",
|
||||
"mirrorRemote": "https://repos.quixos.org/quixos-toolchain/quixos-protocol.git"
|
||||
|
||||
@@ -4,6 +4,14 @@ Shared protobuf APIs for Camino, orch, package runtimes/descriptors and values,
|
||||
plus the capability language/compiler. Commands below are for backend development;
|
||||
workspace authors use `qx-workspace check` for all verification.
|
||||
|
||||
The flake's default Package and check use the same `default.nix` constructor.
|
||||
It declares implementation, tests, grammars, protobufs, installed Nix helpers and
|
||||
the package/Yarn/TypeScript configuration as inputs. All existing compiler tests,
|
||||
generated-code comparisons and emitted fixtures remain in that build;
|
||||
documentation edits preserve its identity. The monorepo's maintained
|
||||
`checks.x86_64-linux.quixos-protocol-source` check builds that checked compiler
|
||||
before evaluating source-input mutations against the actual constructor.
|
||||
|
||||
## Capability language
|
||||
|
||||
The grammar is `grammar/QuixosCapability.g4`. The parser lowers source into the
|
||||
|
||||
+146
@@ -0,0 +1,146 @@
|
||||
{ pkgs, nixpkgsNarHash }:
|
||||
let
|
||||
nodejs = pkgs.nodejs_24;
|
||||
in
|
||||
(pkgs.callPackage ./yarn-project.nix { inherit nodejs; }) {
|
||||
src = pkgs.lib.fileset.toSource {
|
||||
root = ./.;
|
||||
fileset = pkgs.lib.fileset.unions [
|
||||
./src
|
||||
./test
|
||||
./grammar
|
||||
./proto
|
||||
./nix
|
||||
./package.json
|
||||
./yarn.lock
|
||||
./.yarnrc.yml
|
||||
./.yarn/plugins
|
||||
./tsconfig.json
|
||||
./tsconfig.build.json
|
||||
./tsconfig.test.json
|
||||
];
|
||||
};
|
||||
overrideAttrs = old: {
|
||||
nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
|
||||
pkgs.diffutils
|
||||
pkgs.esbuild
|
||||
pkgs.protobuf
|
||||
pkgs.git
|
||||
pkgs.jujutsu
|
||||
pkgs.gnutar
|
||||
pkgs.util-linux
|
||||
pkgs.nix
|
||||
];
|
||||
buildPhase = ''
|
||||
runHook preBuild
|
||||
mkdir -p "$TMPDIR/generated-before"
|
||||
cp --recursive src/gen "$TMPDIR/generated-before/proto"
|
||||
cp --recursive src/capability-language/generated "$TMPDIR/generated-before/capability"
|
||||
cp --recursive src/resource-lock/generated "$TMPDIR/generated-before/lock"
|
||||
export QUIXOS_PROTO_PATH="${pkgs.protobuf}/include:$PWD/proto''${QUIXOS_PROTO_PATH:+:$QUIXOS_PROTO_PATH}"
|
||||
patchShebangs node_modules/.bin node_modules/@bufbuild/protoc-gen-es/bin
|
||||
yarn build
|
||||
esbuild dist/src/execution-world/index.js --bundle --platform=node --target=node24 --format=esm --outfile=execution-world.mjs
|
||||
esbuild dist/src/react-build/package-queries.js --bundle --platform=node --target=node24 --format=esm --outfile=react-query-generator.mjs
|
||||
esbuild dist/src/bindings/client.js --bundle --platform=node --target=node24 --format=esm --outfile=client-codegen.mjs
|
||||
diff --recursive --unified "$TMPDIR/generated-before/proto" src/gen
|
||||
diff --recursive --unified "$TMPDIR/generated-before/capability" src/capability-language/generated
|
||||
diff --recursive --unified "$TMPDIR/generated-before/lock" src/resource-lock/generated
|
||||
esbuild dist/src/descriptor-check.js \
|
||||
--bundle --platform=node --target=node24 --format=esm \
|
||||
--outfile=quixos-descriptor-check.mjs
|
||||
esbuild dist/src/capability-language/cli.js \
|
||||
--bundle --platform=node --target=node24 --format=esm \
|
||||
--outfile=quixos-capability-compile.mjs
|
||||
esbuild dist/src/capability-language/workspace-cli.js \
|
||||
--bundle --platform=node --target=node24 --format=esm \
|
||||
--outfile=quixos-workspace-compile.mjs
|
||||
esbuild dist/src/capability-language/resource-cli.js \
|
||||
--bundle --platform=node --target=node24 --format=esm \
|
||||
--outfile=quixos-resource-compile.mjs
|
||||
esbuild dist/src/resource-lock/cli.js \
|
||||
--bundle --platform=node --target=node24 --format=esm \
|
||||
--outfile=quixos-lock-check.mjs
|
||||
esbuild dist/src/bindings/cli.js --bundle --platform=node --target=node24 --format=esm --outfile=quixos-codegen-ts.mjs
|
||||
esbuild dist/src/bindings/portable-client-cli.js --bundle --platform=node --target=node24 --format=esm --outfile=quixos-codegen-client.mjs
|
||||
esbuild dist/src/bindings/react-platform.js --bundle --platform=node --target=node24 --format=esm --outfile=react-platform.mjs
|
||||
esbuild dist/src/capability-language/tool-cli.js --bundle --platform=node --target=node24 --format=esm --outfile=quixos-qx.mjs
|
||||
esbuild dist/src/capability-language/source-check-driver.js --bundle --platform=node --target=node24 --format=esm --outfile=source-check-driver.mjs
|
||||
runHook postBuild
|
||||
'';
|
||||
doCheck = true;
|
||||
checkPhase = ''
|
||||
runHook preCheck
|
||||
yarn test
|
||||
node dist/test/emit-portable-reader.js
|
||||
node dist/test/emit-managed.js
|
||||
runHook postCheck
|
||||
'';
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
mkdir -p "$out"
|
||||
install -Dm644 nix/checked-package.nix "$out/share/checked-package.nix"
|
||||
install -Dm644 nix/checked-artifacts.nix "$out/share/checked-artifacts.nix"
|
||||
install -Dm644 nix/package-context.nix "$out/share/package-context.nix"
|
||||
install -Dm644 nix/lock-source.nix "$out/share/lock-source.nix"
|
||||
install -Dm644 nix/package-context.mjs "$out/share/package-context.mjs"
|
||||
install -Dm644 nix/check-package.mjs "$out/share/check-package.mjs"
|
||||
install -Dm644 nix/check-execution.mjs "$out/share/check-execution.mjs"
|
||||
substitute nix/checked-candidate.nix "$out/share/checked-candidate.nix" \
|
||||
--replace-fail '@nixpkgs@' '${pkgs.path}' \
|
||||
--replace-fail '@nixpkgsNarHash@' '${nixpkgsNarHash}'
|
||||
cp --reflink=auto --recursive grammar "$out/grammar"
|
||||
cp --reflink=auto --recursive proto "$out/proto"
|
||||
cp --reflink=auto --recursive dist "$out/dist"
|
||||
cp package.json "$out/package.json"
|
||||
mkdir -p "$out/share/quixos-protocol/qualification"
|
||||
cp -r dist/portable-reader dist/managed "$out/share/quixos-protocol/qualification/"
|
||||
mkdir -p "$out/bin"
|
||||
for tool in quixos-codegen-ts quixos-codegen-client quixos-qx; do
|
||||
printf '#!/bin/sh\nexec ${pkgs.nodejs_24}/bin/node "%s/libexec/quixos-protocol/%s.mjs" "$@"\n' "$out" "$tool" > "$out/bin/$tool"
|
||||
chmod +x "$out/bin/$tool"
|
||||
done
|
||||
cat > "$out/bin/quixos-descriptor-check" <<EOF
|
||||
#!/bin/sh
|
||||
export PATH="${pkgs.protobuf}/bin:\$PATH"
|
||||
export QUIXOS_PROTO_PATH="${pkgs.protobuf}/include:$out/proto\''${QUIXOS_PROTO_PATH:+:$QUIXOS_PROTO_PATH}"
|
||||
exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-descriptor-check.mjs" "\$@"
|
||||
EOF
|
||||
chmod +x "$out/bin/quixos-descriptor-check"
|
||||
cat > "$out/bin/quixos-capability-compile" <<EOF
|
||||
#!/bin/sh
|
||||
exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-capability-compile.mjs" "\$@"
|
||||
EOF
|
||||
chmod +x "$out/bin/quixos-capability-compile"
|
||||
cat > "$out/bin/quixos-workspace-compile" <<EOF
|
||||
#!/bin/sh
|
||||
exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-workspace-compile.mjs" "\$@"
|
||||
EOF
|
||||
chmod +x "$out/bin/quixos-workspace-compile"
|
||||
cat > "$out/bin/quixos-resource-compile" <<EOF
|
||||
#!/bin/sh
|
||||
exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-resource-compile.mjs" "\$@"
|
||||
EOF
|
||||
chmod +x "$out/bin/quixos-resource-compile"
|
||||
cat > "$out/bin/quixos-lock-check" <<EOF
|
||||
#!/bin/sh
|
||||
exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-lock-check.mjs" "\$@"
|
||||
EOF
|
||||
chmod +x "$out/bin/quixos-lock-check"
|
||||
mkdir -p "$out/libexec/quixos-protocol"
|
||||
install -m644 execution-world.mjs "$out/libexec/quixos-protocol/execution-world.mjs"
|
||||
install -m644 react-query-generator.mjs "$out/libexec/quixos-protocol/react-query-generator.mjs"
|
||||
install -m644 client-codegen.mjs "$out/libexec/quixos-protocol/client-codegen.mjs"
|
||||
install -m644 react-platform.mjs "$out/libexec/quixos-protocol/react-platform.mjs"
|
||||
install -m644 quixos-codegen-ts.mjs quixos-qx.mjs "$out/libexec/quixos-protocol/"
|
||||
install -m644 source-check-driver.mjs "$out/libexec/quixos-protocol/"
|
||||
install -m644 quixos-codegen-client.mjs "$out/libexec/quixos-protocol/"
|
||||
install -m644 quixos-descriptor-check.mjs "$out/libexec/quixos-protocol/quixos-descriptor-check.mjs"
|
||||
install -m644 quixos-capability-compile.mjs "$out/libexec/quixos-protocol/quixos-capability-compile.mjs"
|
||||
install -m644 quixos-workspace-compile.mjs "$out/libexec/quixos-protocol/quixos-workspace-compile.mjs"
|
||||
install -m644 quixos-resource-compile.mjs "$out/libexec/quixos-protocol/quixos-resource-compile.mjs"
|
||||
install -m644 quixos-lock-check.mjs "$out/libexec/quixos-protocol/quixos-lock-check.mjs"
|
||||
runHook postInstall
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -18,131 +18,9 @@
|
||||
let
|
||||
pkgs = import nixpkgs { inherit system; };
|
||||
nodejs = pkgs.nodejs_24;
|
||||
quixos-protocol = (pkgs.callPackage ./yarn-project.nix { inherit nodejs; }) {
|
||||
src = pkgs.lib.cleanSource ./.;
|
||||
overrideAttrs = old: {
|
||||
nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
|
||||
pkgs.diffutils
|
||||
pkgs.esbuild
|
||||
pkgs.protobuf
|
||||
pkgs.git
|
||||
pkgs.jujutsu
|
||||
pkgs.gnutar
|
||||
pkgs.util-linux
|
||||
pkgs.nix
|
||||
];
|
||||
buildPhase = ''
|
||||
runHook preBuild
|
||||
mkdir -p "$TMPDIR/generated-before"
|
||||
cp --recursive src/gen "$TMPDIR/generated-before/proto"
|
||||
cp --recursive src/capability-language/generated "$TMPDIR/generated-before/capability"
|
||||
cp --recursive src/resource-lock/generated "$TMPDIR/generated-before/lock"
|
||||
export QUIXOS_PROTO_PATH="${pkgs.protobuf}/include:$PWD/proto''${QUIXOS_PROTO_PATH:+:$QUIXOS_PROTO_PATH}"
|
||||
patchShebangs node_modules/.bin node_modules/@bufbuild/protoc-gen-es/bin
|
||||
yarn build
|
||||
esbuild dist/src/execution-world/index.js --bundle --platform=node --target=node24 --format=esm --outfile=execution-world.mjs
|
||||
esbuild dist/src/react-build/package-queries.js --bundle --platform=node --target=node24 --format=esm --outfile=react-query-generator.mjs
|
||||
esbuild dist/src/bindings/client.js --bundle --platform=node --target=node24 --format=esm --outfile=client-codegen.mjs
|
||||
diff --recursive --unified "$TMPDIR/generated-before/proto" src/gen
|
||||
diff --recursive --unified "$TMPDIR/generated-before/capability" src/capability-language/generated
|
||||
diff --recursive --unified "$TMPDIR/generated-before/lock" src/resource-lock/generated
|
||||
esbuild dist/src/descriptor-check.js \
|
||||
--bundle --platform=node --target=node24 --format=esm \
|
||||
--outfile=quixos-descriptor-check.mjs
|
||||
esbuild dist/src/capability-language/cli.js \
|
||||
--bundle --platform=node --target=node24 --format=esm \
|
||||
--outfile=quixos-capability-compile.mjs
|
||||
esbuild dist/src/capability-language/workspace-cli.js \
|
||||
--bundle --platform=node --target=node24 --format=esm \
|
||||
--outfile=quixos-workspace-compile.mjs
|
||||
esbuild dist/src/capability-language/resource-cli.js \
|
||||
--bundle --platform=node --target=node24 --format=esm \
|
||||
--outfile=quixos-resource-compile.mjs
|
||||
esbuild dist/src/resource-lock/cli.js \
|
||||
--bundle --platform=node --target=node24 --format=esm \
|
||||
--outfile=quixos-lock-check.mjs
|
||||
esbuild dist/src/bindings/cli.js --bundle --platform=node --target=node24 --format=esm --outfile=quixos-codegen-ts.mjs
|
||||
esbuild dist/src/bindings/portable-client-cli.js --bundle --platform=node --target=node24 --format=esm --outfile=quixos-codegen-client.mjs
|
||||
esbuild dist/src/bindings/react-platform.js --bundle --platform=node --target=node24 --format=esm --outfile=react-platform.mjs
|
||||
esbuild dist/src/capability-language/tool-cli.js --bundle --platform=node --target=node24 --format=esm --outfile=quixos-qx.mjs
|
||||
esbuild dist/src/capability-language/source-check-driver.js --bundle --platform=node --target=node24 --format=esm --outfile=source-check-driver.mjs
|
||||
runHook postBuild
|
||||
'';
|
||||
doCheck = true;
|
||||
checkPhase = ''
|
||||
runHook preCheck
|
||||
yarn test
|
||||
node dist/test/emit-portable-reader.js
|
||||
node dist/test/emit-managed.js
|
||||
runHook postCheck
|
||||
'';
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
mkdir -p "$out"
|
||||
install -Dm644 nix/checked-package.nix "$out/share/checked-package.nix"
|
||||
install -Dm644 nix/checked-artifacts.nix "$out/share/checked-artifacts.nix"
|
||||
install -Dm644 nix/package-context.nix "$out/share/package-context.nix"
|
||||
install -Dm644 nix/lock-source.nix "$out/share/lock-source.nix"
|
||||
install -Dm644 nix/package-context.mjs "$out/share/package-context.mjs"
|
||||
install -Dm644 nix/check-package.mjs "$out/share/check-package.mjs"
|
||||
install -Dm644 nix/check-execution.mjs "$out/share/check-execution.mjs"
|
||||
substitute nix/checked-candidate.nix "$out/share/checked-candidate.nix" \
|
||||
--replace-fail '@nixpkgs@' '${pkgs.path}' \
|
||||
--replace-fail '@nixpkgsNarHash@' '${nixpkgs.narHash}'
|
||||
cp --reflink=auto --recursive grammar "$out/grammar"
|
||||
cp --reflink=auto --recursive proto "$out/proto"
|
||||
cp --reflink=auto --recursive dist "$out/dist"
|
||||
cp package.json "$out/package.json"
|
||||
mkdir -p "$out/share/quixos-protocol/qualification"
|
||||
cp -r dist/portable-reader dist/managed "$out/share/quixos-protocol/qualification/"
|
||||
mkdir -p "$out/bin"
|
||||
for tool in quixos-codegen-ts quixos-codegen-client quixos-qx; do
|
||||
printf '#!/bin/sh\nexec ${pkgs.nodejs_24}/bin/node "%s/libexec/quixos-protocol/%s.mjs" "$@"\n' "$out" "$tool" > "$out/bin/$tool"
|
||||
chmod +x "$out/bin/$tool"
|
||||
done
|
||||
cat > "$out/bin/quixos-descriptor-check" <<EOF
|
||||
#!/bin/sh
|
||||
export PATH="${pkgs.protobuf}/bin:\$PATH"
|
||||
export QUIXOS_PROTO_PATH="${pkgs.protobuf}/include:$out/proto\''${QUIXOS_PROTO_PATH:+:$QUIXOS_PROTO_PATH}"
|
||||
exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-descriptor-check.mjs" "\$@"
|
||||
EOF
|
||||
chmod +x "$out/bin/quixos-descriptor-check"
|
||||
cat > "$out/bin/quixos-capability-compile" <<EOF
|
||||
#!/bin/sh
|
||||
exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-capability-compile.mjs" "\$@"
|
||||
EOF
|
||||
chmod +x "$out/bin/quixos-capability-compile"
|
||||
cat > "$out/bin/quixos-workspace-compile" <<EOF
|
||||
#!/bin/sh
|
||||
exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-workspace-compile.mjs" "\$@"
|
||||
EOF
|
||||
chmod +x "$out/bin/quixos-workspace-compile"
|
||||
cat > "$out/bin/quixos-resource-compile" <<EOF
|
||||
#!/bin/sh
|
||||
exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-resource-compile.mjs" "\$@"
|
||||
EOF
|
||||
chmod +x "$out/bin/quixos-resource-compile"
|
||||
cat > "$out/bin/quixos-lock-check" <<EOF
|
||||
#!/bin/sh
|
||||
exec ${pkgs.nodejs_24}/bin/node "$out/libexec/quixos-protocol/quixos-lock-check.mjs" "\$@"
|
||||
EOF
|
||||
chmod +x "$out/bin/quixos-lock-check"
|
||||
mkdir -p "$out/libexec/quixos-protocol"
|
||||
install -m644 execution-world.mjs "$out/libexec/quixos-protocol/execution-world.mjs"
|
||||
install -m644 react-query-generator.mjs "$out/libexec/quixos-protocol/react-query-generator.mjs"
|
||||
install -m644 client-codegen.mjs "$out/libexec/quixos-protocol/client-codegen.mjs"
|
||||
install -m644 react-platform.mjs "$out/libexec/quixos-protocol/react-platform.mjs"
|
||||
install -m644 quixos-codegen-ts.mjs quixos-qx.mjs "$out/libexec/quixos-protocol/"
|
||||
install -m644 source-check-driver.mjs "$out/libexec/quixos-protocol/"
|
||||
install -m644 quixos-codegen-client.mjs "$out/libexec/quixos-protocol/"
|
||||
install -m644 quixos-descriptor-check.mjs "$out/libexec/quixos-protocol/quixos-descriptor-check.mjs"
|
||||
install -m644 quixos-capability-compile.mjs "$out/libexec/quixos-protocol/quixos-capability-compile.mjs"
|
||||
install -m644 quixos-workspace-compile.mjs "$out/libexec/quixos-protocol/quixos-workspace-compile.mjs"
|
||||
install -m644 quixos-resource-compile.mjs "$out/libexec/quixos-protocol/quixos-resource-compile.mjs"
|
||||
install -m644 quixos-lock-check.mjs "$out/libexec/quixos-protocol/quixos-lock-check.mjs"
|
||||
runHook postInstall
|
||||
'';
|
||||
};
|
||||
quixos-protocol = import ./default.nix {
|
||||
inherit pkgs;
|
||||
nixpkgsNarHash = nixpkgs.narHash;
|
||||
};
|
||||
in
|
||||
{
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
# Read actual constructor attributes as comparison data. Their values AND
|
||||
# dependency contexts remain visible; none is substituted for a build input.
|
||||
derivation:
|
||||
let
|
||||
fields = [
|
||||
"name"
|
||||
"system"
|
||||
"src"
|
||||
"stdenv"
|
||||
"nativeBuildInputs"
|
||||
"buildInputs"
|
||||
"propagatedBuildInputs"
|
||||
"propagatedNativeBuildInputs"
|
||||
"configurePhase"
|
||||
"buildPhase"
|
||||
"checkPhase"
|
||||
"installPhase"
|
||||
"doCheck"
|
||||
"strictDeps"
|
||||
"outputs"
|
||||
"__structuredAttrs"
|
||||
];
|
||||
selected = builtins.intersectAttrs (builtins.listToAttrs (
|
||||
map (name: {
|
||||
inherit name;
|
||||
value = null;
|
||||
}) fields
|
||||
)) derivation;
|
||||
in
|
||||
builtins.mapAttrs (_: value: {
|
||||
type = builtins.typeOf value;
|
||||
value = builtins.unsafeDiscardStringContext (toString value);
|
||||
context = builtins.getContext (toString value);
|
||||
}) selected
|
||||
@@ -0,0 +1,257 @@
|
||||
// Evaluate the production compiler constructor; its checked build is a prerequisite.
|
||||
import assert from "node:assert/strict";
|
||||
import fs from "node:fs/promises";
|
||||
import os from "node:os";
|
||||
import path from "node:path";
|
||||
import { spawnSync } from "node:child_process";
|
||||
import { createHash } from "node:crypto";
|
||||
|
||||
const config = JSON.parse(await fs.readFile(process.argv[2], "utf8"));
|
||||
const output = process.argv[3];
|
||||
const scratch = await fs.mkdtemp(path.join(os.tmpdir(), "protocol-source-"));
|
||||
const source = path.join(scratch, "source");
|
||||
const nixString = (value) => JSON.stringify(value).replaceAll("${", "\\${");
|
||||
async function writable(directory) {
|
||||
await fs.chmod(directory, 0o700);
|
||||
for (const item of await fs.readdir(directory, { withFileTypes: true })) {
|
||||
const file = path.join(directory, item.name);
|
||||
if (item.isDirectory()) await writable(file);
|
||||
else {
|
||||
const info = await fs.stat(file);
|
||||
await fs.chmod(file, info.mode & 0o111 ? 0o700 : 0o600);
|
||||
}
|
||||
}
|
||||
}
|
||||
function identity() {
|
||||
const expression = `let
|
||||
pkgs = import (/. + ${nixString(config.nixpkgs)}) { system = ${nixString(config.system)}; };
|
||||
compiler = import ((/. + ${nixString(source)}) + "/default.nix") {
|
||||
inherit pkgs;
|
||||
nixpkgsNarHash = builtins.appendContext ${nixString(config.nixpkgsNarHash)}
|
||||
(builtins.fromJSON ${nixString(JSON.stringify(config.narHashContext))});
|
||||
};
|
||||
in {
|
||||
derivation = compiler.drvPath;
|
||||
yarn = compiler.yarn-freestanding.drvPath;
|
||||
source = toString compiler.src;
|
||||
metadata = (import ((/. + ${nixString(source)}) + "/source-qualification-metadata.nix")) compiler;
|
||||
}`;
|
||||
const result = spawnSync(
|
||||
"nix",
|
||||
[
|
||||
"--store",
|
||||
"local?root=" + process.env.QUIXOS_PROTOCOL_EVALUATION_STORE,
|
||||
"eval",
|
||||
"--offline",
|
||||
"--impure",
|
||||
"--json",
|
||||
"--expr",
|
||||
expression,
|
||||
],
|
||||
{ encoding: "utf8", timeout: 30000, maxBuffer: 1048576 },
|
||||
);
|
||||
assert.equal(result.status, 0, result.error?.message ?? result.stderr);
|
||||
return JSON.parse(result.stdout);
|
||||
}
|
||||
function summarized(value) {
|
||||
const text = JSON.stringify(value) ?? "undefined";
|
||||
return text.length < 500
|
||||
? value
|
||||
: {
|
||||
bytes: Buffer.byteLength(text),
|
||||
sha256: createHash("sha256").update(text).digest("hex"),
|
||||
prefix: text.slice(0, 180),
|
||||
};
|
||||
}
|
||||
function structuralDifferences(actual, expected, field = "", result = []) {
|
||||
if (JSON.stringify(actual) === JSON.stringify(expected)) return result;
|
||||
if (
|
||||
Array.isArray(actual) &&
|
||||
Array.isArray(expected) &&
|
||||
[...actual, ...expected].every((x) => typeof x === "string")
|
||||
) {
|
||||
result.push({
|
||||
field,
|
||||
onlyActual: actual.filter((x) => !expected.includes(x)),
|
||||
onlyExpected: expected.filter((x) => !actual.includes(x)),
|
||||
actualCount: actual.length,
|
||||
expectedCount: expected.length,
|
||||
sequenceChanged: true,
|
||||
});
|
||||
} else if (
|
||||
actual &&
|
||||
expected &&
|
||||
typeof actual === "object" &&
|
||||
typeof expected === "object" &&
|
||||
!Array.isArray(actual) &&
|
||||
!Array.isArray(expected)
|
||||
) {
|
||||
for (const key of new Set([...Object.keys(actual), ...Object.keys(expected)]))
|
||||
structuralDifferences(actual[key], expected[key], field ? field + "." + key : key, result);
|
||||
} else {
|
||||
const difference = { field, actual: summarized(actual), expected: summarized(expected) };
|
||||
if (typeof actual === "string" && typeof expected === "string" && Math.max(actual.length, expected.length) >= 500) {
|
||||
let offset = 0;
|
||||
while (offset < actual.length && offset < expected.length && actual[offset] === expected[offset]) offset++;
|
||||
difference.offset = offset;
|
||||
difference.actualExcerpt = actual.slice(Math.max(0, offset - 80), offset + 200);
|
||||
difference.expectedExcerpt = expected.slice(Math.max(0, offset - 80), offset + 200);
|
||||
}
|
||||
result.push(difference);
|
||||
}
|
||||
return result;
|
||||
}
|
||||
function baselineDifference(baseline) {
|
||||
const { metadata, ...identities } = baseline;
|
||||
console.log(
|
||||
"PROTOCOL_SOURCE_BASELINE: " +
|
||||
JSON.stringify({
|
||||
actual: identities,
|
||||
expected: config.expected,
|
||||
expectedSource: config.expectedSource,
|
||||
evaluatorVersion: config.evaluatorVersion,
|
||||
pinnedNixVersion: config.pinnedNixVersion,
|
||||
narHashContext: config.narHashContext,
|
||||
}),
|
||||
);
|
||||
console.log(
|
||||
"PROTOCOL_SOURCE_BASELINE_DIFF: " +
|
||||
JSON.stringify(structuralDifferences(metadata, config.expectedMetadata)).slice(0, 10000),
|
||||
);
|
||||
}
|
||||
async function edit(file, mutate, check) {
|
||||
const before = await fs.readFile(file, "utf8");
|
||||
try {
|
||||
await fs.writeFile(file, mutate(before));
|
||||
await check();
|
||||
} finally {
|
||||
await fs.writeFile(file, before);
|
||||
}
|
||||
}
|
||||
const cases = [];
|
||||
async function record(name, check) {
|
||||
await check();
|
||||
cases.push(name);
|
||||
console.log("PROTOCOL_SOURCE_INPUT: " + name);
|
||||
}
|
||||
try {
|
||||
await fs.cp(config.source, source, { recursive: true });
|
||||
await writable(source);
|
||||
const baseline = identity();
|
||||
if (baseline.derivation !== config.expected) baselineDifference(baseline);
|
||||
await record("real production compiler and generated Yarn launcher identities", async () => {
|
||||
assert.equal(baseline.derivation, config.expected);
|
||||
assert.equal(baseline.yarn, config.yarn);
|
||||
});
|
||||
for (const file of ["README.md", "flake.nix", "default.nix", "yarn-project.nix"]) {
|
||||
await record(file + " commentary preserves compiler identity", () =>
|
||||
edit(
|
||||
path.join(source, file),
|
||||
(text) => text + (file.endsWith(".nix") ? "\n# source qualification\n" : "\nSource qualification.\n"),
|
||||
async () => assert.deepEqual(identity(), baseline),
|
||||
),
|
||||
);
|
||||
}
|
||||
await record("new documentation preserves compiler identity", async () => {
|
||||
const file = path.join(source, "NOTES.md");
|
||||
try {
|
||||
await fs.writeFile(file, "qualification\n");
|
||||
assert.deepEqual(identity(), baseline);
|
||||
} finally {
|
||||
await fs.rm(file, { force: true });
|
||||
}
|
||||
});
|
||||
async function compilerOnly() {
|
||||
const changed = identity();
|
||||
assert.notEqual(changed.derivation, baseline.derivation);
|
||||
assert.equal(changed.yarn, baseline.yarn);
|
||||
}
|
||||
for (const file of [
|
||||
"src/capability-language/cli.ts",
|
||||
"test/emit-managed.ts",
|
||||
"grammar/QuixosCapability.g4",
|
||||
"proto/quixos/refs.proto",
|
||||
"nix/check-package.mjs",
|
||||
"package.json",
|
||||
"yarn.lock",
|
||||
".yarnrc.yml",
|
||||
".yarn/plugins/yarn-plugin-nixify.cjs",
|
||||
"tsconfig.json",
|
||||
"tsconfig.build.json",
|
||||
"tsconfig.test.json",
|
||||
]) {
|
||||
await record(file + " remains a compiler input", () =>
|
||||
edit(path.join(source, file), (text) => text + "\n", compilerOnly),
|
||||
);
|
||||
}
|
||||
for (const file of ["src/future.ts", "test/future.ts", "nix/future.nix"]) {
|
||||
await record(file + " is included without a file inventory update", async () => {
|
||||
const target = path.join(source, file);
|
||||
try {
|
||||
await fs.writeFile(target, "qualification\n");
|
||||
await compilerOnly();
|
||||
} finally {
|
||||
await fs.rm(target, { force: true });
|
||||
}
|
||||
});
|
||||
}
|
||||
await record("executable recipe changes invalidate compiler identity", () =>
|
||||
edit(
|
||||
path.join(source, "default.nix"),
|
||||
(text) => {
|
||||
assert(text.includes("runHook preBuild"));
|
||||
return text.replace("runHook preBuild", "runHook preBuild\n echo qualification");
|
||||
},
|
||||
compilerOnly,
|
||||
),
|
||||
);
|
||||
await record("selected generated archive pin remains a compiler input", () =>
|
||||
edit(
|
||||
path.join(source, "yarn-project.nix"),
|
||||
(text) => {
|
||||
const changedHash = "sha512-" + Buffer.alloc(64, 0x42).toString("base64");
|
||||
const pattern = /("@types\/node@npm:[^\n]+hash = ")[^"]+(";)/;
|
||||
assert(pattern.test(text));
|
||||
return text.replace(pattern, (_, before, after) => before + changedHash + after);
|
||||
},
|
||||
async () => {
|
||||
await compilerOnly();
|
||||
assert.equal(identity().source, baseline.source);
|
||||
},
|
||||
),
|
||||
);
|
||||
await record("installed Nixpkgs trust identity remains a compiler input", async () => {
|
||||
const previous = config.nixpkgsNarHash;
|
||||
try {
|
||||
config.nixpkgsNarHash = "sha256-" + Buffer.alloc(32, 0x42).toString("base64");
|
||||
assert.notEqual(config.nixpkgsNarHash, previous);
|
||||
await compilerOnly();
|
||||
assert.equal(identity().source, baseline.source);
|
||||
} finally {
|
||||
config.nixpkgsNarHash = previous;
|
||||
}
|
||||
});
|
||||
assert.deepEqual(identity(), baseline, "Every private mutation was restored");
|
||||
await fs.mkdir(output, { recursive: true });
|
||||
await fs.writeFile(
|
||||
path.join(output, "protocol-source.json"),
|
||||
JSON.stringify(
|
||||
{
|
||||
codec: "quixos-protocol-source-qualification/1",
|
||||
derivation: baseline.derivation,
|
||||
yarn: baseline.yarn,
|
||||
source: baseline.source,
|
||||
cases,
|
||||
metadataContext: config.narHashContext,
|
||||
evaluatorVersion: config.evaluatorVersion,
|
||||
pinnedNixVersion: config.pinnedNixVersion,
|
||||
nestedBuilds: false,
|
||||
guestExecution: false,
|
||||
},
|
||||
null,
|
||||
2,
|
||||
) + "\n",
|
||||
);
|
||||
} finally {
|
||||
await fs.rm(scratch, { recursive: true, force: true });
|
||||
}
|
||||
@@ -0,0 +1,84 @@
|
||||
{
|
||||
pkgs,
|
||||
library,
|
||||
nixpkgsSource,
|
||||
nixpkgsNarHash,
|
||||
}:
|
||||
assert builtins.isString nixpkgsSource;
|
||||
let
|
||||
comparisonIdentity = import ../tools/local-first/derivation-identity.nix;
|
||||
inspect = import ./source-qualification-metadata.nix;
|
||||
source = pkgs.lib.fileset.toSource {
|
||||
root = ./.;
|
||||
fileset = pkgs.lib.fileset.unions [
|
||||
./src
|
||||
./test
|
||||
./grammar
|
||||
./proto
|
||||
./nix
|
||||
./package.json
|
||||
./yarn.lock
|
||||
./.yarnrc.yml
|
||||
./.yarn/plugins
|
||||
./tsconfig.json
|
||||
./tsconfig.build.json
|
||||
./tsconfig.test.json
|
||||
./default.nix
|
||||
./source-qualification-metadata.nix
|
||||
./yarn-project.nix
|
||||
./flake.nix
|
||||
./README.md
|
||||
];
|
||||
};
|
||||
inputs = pkgs.writeText "protocol-source-inputs.json" (
|
||||
builtins.toJSON {
|
||||
inherit source nixpkgsNarHash;
|
||||
narHashContext = builtins.getContext nixpkgsNarHash;
|
||||
evaluatorVersion = builtins.nixVersion;
|
||||
pinnedNixVersion = pkgs.nix.version;
|
||||
# toJSON ingests path values. Keep the original flake input's outPath
|
||||
# string, so importing it and interpolating pkgs.path does not copy twice.
|
||||
nixpkgs = nixpkgsSource;
|
||||
system = pkgs.stdenv.hostPlatform.system;
|
||||
expected = comparisonIdentity library;
|
||||
expectedMetadata = inspect library;
|
||||
expectedSource = builtins.unsafeDiscardStringContext (toString library.src);
|
||||
yarn = comparisonIdentity library.yarn-freestanding;
|
||||
}
|
||||
);
|
||||
closure = pkgs.closureInfo { rootPaths = [ nixpkgsSource ]; };
|
||||
in
|
||||
pkgs.runCommand "quixos-protocol-source-check"
|
||||
{
|
||||
nativeBuildInputs = [
|
||||
pkgs.nodejs_24
|
||||
pkgs.nix
|
||||
];
|
||||
passthru.ciDiagnosticArtifacts."protocol-source.json" = {
|
||||
file = "protocol-source.json";
|
||||
maxBytes = 8192;
|
||||
};
|
||||
}
|
||||
''
|
||||
# The ordinary compiler still owns all tests and emitted fixtures. Finish
|
||||
# that same checked build before the new identity-only evaluations.
|
||||
test -e ${library}
|
||||
export HOME="$TMPDIR/home"
|
||||
export NIX_STATE_DIR="$TMPDIR/nix-state"
|
||||
export NIX_LOG_DIR="$TMPDIR/nix-log"
|
||||
export NIX_CONF_DIR="$TMPDIR/nix-conf"
|
||||
export NIX_USER_CONF_FILES=/dev/null
|
||||
export NIX_CONFIG='experimental-features = nix-command flakes
|
||||
substituters =
|
||||
builders =
|
||||
max-jobs = 0
|
||||
allow-import-from-derivation = false
|
||||
accept-flake-config = false'
|
||||
export QUIXOS_PROTOCOL_EVALUATION_STORE="$TMPDIR/evaluation-store"
|
||||
mkdir -p "$HOME" "$NIX_STATE_DIR" "$NIX_LOG_DIR" "$NIX_CONF_DIR" "$QUIXOS_PROTOCOL_EVALUATION_STORE/nix/store"
|
||||
while IFS= read -r dependency; do
|
||||
cp -a --no-preserve=ownership "$dependency" "$QUIXOS_PROTOCOL_EVALUATION_STORE$dependency"
|
||||
done < ${closure}/store-paths
|
||||
nix-store --store "local?root=$QUIXOS_PROTOCOL_EVALUATION_STORE" --load-db < ${closure}/registration
|
||||
timeout --kill-after=5s 180s node ${./source-qualification.mjs} ${inputs} "$out"
|
||||
''
|
||||
@@ -21,6 +21,8 @@ export async function authoringContext(start: string) {
|
||||
}
|
||||
if (text !== undefined) {
|
||||
const graph = JSON.parse(text) as { resources: AuthoringResource[]; workspaceId?: string };
|
||||
if (!graph || typeof graph !== "object" || Array.isArray(graph))
|
||||
throw new Error("Managed resource inventory is malformed");
|
||||
if (
|
||||
graph.workspaceId !== undefined &&
|
||||
(typeof graph.workspaceId !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,255}$/.test(graph.workspaceId))
|
||||
@@ -30,27 +32,68 @@ export async function authoringContext(start: string) {
|
||||
const resources: AuthoringResource[] = [{ kind: "workspace", directory: "root" }];
|
||||
const identities = new Set<string>(),
|
||||
directories = new Set<string>(["root"]);
|
||||
for (const entry of graph.resources) {
|
||||
// Compiler graphs carry resolved paths; the authoring API presents
|
||||
// stable workbench-relative names and validates containment here.
|
||||
if (typeof entry.directory === "string" && path.isAbsolute(entry.directory))
|
||||
entry.directory = path.relative(workbench, entry.directory);
|
||||
for (const [index, entry] of graph.resources.entries()) {
|
||||
const invalid = (reason: string): never => {
|
||||
throw new Error(`Invalid managed resource registration at entry ${index + 1}: ${reason}`);
|
||||
};
|
||||
if (
|
||||
!["interface", "package", "build"].includes(entry.kind) ||
|
||||
!entry.source ||
|
||||
!/^resources\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(entry.directory)
|
||||
) {
|
||||
throw new Error("Invalid managed resource registration");
|
||||
!entry ||
|
||||
typeof entry !== "object" ||
|
||||
Array.isArray(entry) ||
|
||||
!["interface", "package", "build"].includes(entry.kind)
|
||||
)
|
||||
invalid("unsupported resource kind");
|
||||
if (
|
||||
entry.resourceId !== undefined &&
|
||||
(typeof entry.resourceId !== "string" ||
|
||||
entry.resourceId.length < 1 ||
|
||||
entry.resourceId.length > 256 ||
|
||||
entry.resourceId.includes("\0"))
|
||||
)
|
||||
invalid("resource identity must be a bounded nonempty identifier");
|
||||
const source = entry.source;
|
||||
if (
|
||||
!source ||
|
||||
typeof source !== "object" ||
|
||||
Array.isArray(source) ||
|
||||
source.resolver !== "git" ||
|
||||
typeof source.repository !== "string" ||
|
||||
!source.repository ||
|
||||
source.repository.length > 4096 ||
|
||||
source.repository.includes("\0") ||
|
||||
typeof source.commit !== "string" ||
|
||||
!/^([0-9a-f]{40}|[0-9a-f]{64})$/.test(source.commit)
|
||||
)
|
||||
invalid("expected an immutable Git source");
|
||||
// Git transport policy belongs to the source resolver, including its
|
||||
// maintained local/file fixtures; registration validates only its shape.
|
||||
if (
|
||||
typeof entry.directory !== "string" ||
|
||||
!entry.directory ||
|
||||
entry.directory.length > 4096 ||
|
||||
entry.directory.includes("\0")
|
||||
)
|
||||
invalid("directory must be a bounded path");
|
||||
// Bootstrap intentionally records stable aliases for native histories.
|
||||
// Compare physical paths on BOTH sides, then expose the same canonical
|
||||
// workbench-relative selection for alias and physical working dirs.
|
||||
let directory: string;
|
||||
try {
|
||||
directory = path.relative(workbench, await realpath(path.resolve(workbench, entry.directory)));
|
||||
} catch {
|
||||
invalid("registered directory is unavailable");
|
||||
}
|
||||
const identity = `${entry.kind}\0${entry.resourceId ?? entry.source.repository}`;
|
||||
if (identities.has(identity) || directories.has(entry.directory)) {
|
||||
throw new Error(`Multiple editable selections for ${entry.resourceId ?? entry.source.repository}`);
|
||||
if (!/^resources\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(directory!))
|
||||
invalid("registered directory must resolve beneath workbench resources");
|
||||
const identity = `${entry.kind}\0${entry.resourceId ?? source!.repository}`;
|
||||
if (identities.has(identity) || directories.has(directory!)) {
|
||||
throw new Error(`Multiple editable selections for ${directory!}`);
|
||||
}
|
||||
identities.add(identity);
|
||||
directories.add(entry.directory);
|
||||
directories.add(directory!);
|
||||
resources.push({
|
||||
kind: entry.kind,
|
||||
directory: entry.directory,
|
||||
directory: directory!,
|
||||
resourceId: entry.resourceId,
|
||||
source: entry.source,
|
||||
});
|
||||
|
||||
@@ -4,6 +4,7 @@ import { execFile as callback } from "node:child_process";
|
||||
import { promisify } from "node:util";
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { authoringContext } from "./authoring-context.js";
|
||||
import { managedResourcePath } from "./managed-source-path.js";
|
||||
import { snapshotCommit } from "./checked-build.js";
|
||||
import { profile } from "./profile.js";
|
||||
import {
|
||||
@@ -85,6 +86,11 @@ export async function convergeAuthoring(start: string, target = "root") {
|
||||
const context = await authoringContext(start);
|
||||
const graphFile = path.join(context.workbench, ".quixos/resource-graph.json");
|
||||
const graphBefore = await readFile(graphFile, "utf8");
|
||||
const graph = JSON.parse(graphBefore);
|
||||
// Discovery resolves outer guest aliases. Persist those same physical
|
||||
// selections, without accepting symlinks within the managed workbench.
|
||||
for (const resource of graph.resources)
|
||||
resource.directory = await managedResourcePath(context.workbench, resource.directory);
|
||||
const blockers: AuthoringBlocker[] = [];
|
||||
const nodes = new Map<string, { directory: string; kind: string; source: GitSource; dependencies: string[] }>();
|
||||
const selected = new Map<string, string>();
|
||||
@@ -247,9 +253,6 @@ export async function convergeAuthoring(start: string, target = "root") {
|
||||
profile("capture-recheck", recheckStarted, { repositories: complete.size });
|
||||
// Persist successful selections even if another repository is still broken.
|
||||
// Recovery must not depend on all parents succeeding in the same invocation.
|
||||
const graph = JSON.parse(graphBefore);
|
||||
for (const resource of graph.resources)
|
||||
resource.directory = path.relative(context.workbench, path.resolve(context.workbench, resource.directory));
|
||||
const replacements = new Map<string, string>();
|
||||
for (const resource of graph.resources) {
|
||||
const source = complete.get(resource.directory);
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
import { realpath } from "node:fs/promises";
|
||||
import path from "node:path";
|
||||
|
||||
/** Registration may name the workbench through its guest alias. Only that
|
||||
* outer alias is permitted: resources and each checkout remain physical,
|
||||
* directly contained directories. Persist the resulting root-relative path.
|
||||
*/
|
||||
export async function managedResourcePath(workbench: string, directory: string): Promise<string> {
|
||||
const root = await realpath(workbench);
|
||||
const selected = path.resolve(root, directory);
|
||||
const name = path.basename(selected);
|
||||
const resources = path.dirname(selected);
|
||||
if (path.basename(resources) !== "resources" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name))
|
||||
throw new Error(`Repository is outside the managed workbench: ${directory}`);
|
||||
const relative = `resources/${name}`;
|
||||
if ((await realpath(path.dirname(resources))) !== root || (await realpath(selected)) !== path.join(root, relative))
|
||||
throw new Error(`Managed repository path crosses a symlink or escapes the workbench: ${directory}`);
|
||||
return relative;
|
||||
}
|
||||
@@ -22,6 +22,7 @@ import {
|
||||
type EvolutionReview,
|
||||
} from "../capability-model/index.js";
|
||||
import { withFileLock } from "./file-lock.js";
|
||||
import { managedResourcePath } from "./managed-source-path.js";
|
||||
const execFile = promisify(callback);
|
||||
type Source = { repository: string; commit: string };
|
||||
export type UpgradeNode = { kind: "workspace" | "package" | "interface" | "build"; directory: string; source: Source };
|
||||
@@ -98,7 +99,8 @@ const writeJournal = async (filename: string, journal: unknown) => {
|
||||
}
|
||||
};
|
||||
|
||||
export const discoverUpgradeSpec = async (workbench: string): Promise<UpgradeSpec> => {
|
||||
export const discoverUpgradeSpec = async (workbenchPath: string): Promise<UpgradeSpec> => {
|
||||
const workbench = await fs.realpath(workbenchPath);
|
||||
const graph = JSON.parse(await fs.readFile(path.join(workbench, ".quixos/resource-graph.json"), "utf8"));
|
||||
const root = await location(workbench, "root");
|
||||
const nodes: UpgradeNode[] = [
|
||||
@@ -110,11 +112,15 @@ export const discoverUpgradeSpec = async (workbench: string): Promise<UpgradeSpe
|
||||
commit: await command(root, "jj", ["--ignore-working-copy", "log", "--no-graph", "-r", "@", "-T", "commit_id"]),
|
||||
},
|
||||
},
|
||||
...graph.resources.map((entry: { kind: "interface" | "package" | "build"; directory: string; source: Source }) => ({
|
||||
kind: entry.kind,
|
||||
source: entry.source,
|
||||
directory: path.relative(workbench, path.resolve(workbench, entry.directory)),
|
||||
})),
|
||||
...(await Promise.all(
|
||||
graph.resources.map(
|
||||
async (entry: { kind: "interface" | "package" | "build"; directory: string; source: Source }) => ({
|
||||
kind: entry.kind,
|
||||
source: entry.source,
|
||||
directory: await managedResourcePath(workbench, entry.directory),
|
||||
}),
|
||||
),
|
||||
)),
|
||||
];
|
||||
let baseline: string | undefined;
|
||||
try {
|
||||
@@ -406,10 +412,7 @@ export const applyPinUpgrades = async (
|
||||
previous.resources.map(async (entry: { kind: string; source: Source; directory: string }) => ({
|
||||
kind: entry.kind,
|
||||
...entry.source,
|
||||
directory: await location(
|
||||
plan.workbench,
|
||||
path.relative(plan.workbench, path.resolve(plan.workbench, entry.directory)),
|
||||
),
|
||||
directory: await location(plan.workbench, await managedResourcePath(plan.workbench, entry.directory)),
|
||||
})),
|
||||
);
|
||||
for (const node of plan.nodes.filter((entry) => entry.kind !== "workspace")) {
|
||||
|
||||
@@ -1,6 +1,9 @@
|
||||
import { constants } from "node:fs";
|
||||
import { open } from "node:fs/promises";
|
||||
|
||||
const admissionFailure = (code: string, kind: "file-bytes", measured: number, limit: number) =>
|
||||
Object.assign(Error(code), { metadataAdmission: { kind, measured, limit } });
|
||||
|
||||
/** Admission estimates, not a hard V8 heap limit. A process/cgroup ceiling is
|
||||
* still required. Charge input, parse trees and derived indexes before reading
|
||||
* or parsing. Each live candidate retains its reservation until explicit close. */
|
||||
@@ -116,8 +119,8 @@ export async function readCandidateMetadata(
|
||||
let releaseInput: (() => void) | undefined;
|
||||
try {
|
||||
const stat = await handle.stat();
|
||||
if (!stat.isFile() || !Number.isSafeInteger(stat.size) || stat.size > limit)
|
||||
throw Error("CANDIDATE_METADATA_FILE_LIMIT");
|
||||
if (!stat.isFile() || !Number.isSafeInteger(stat.size)) throw Error("CANDIDATE_METADATA_FILE_LIMIT");
|
||||
if (stat.size > limit) throw admissionFailure("CANDIDATE_METADATA_FILE_LIMIT", "file-bytes", stat.size, limit);
|
||||
// Reserve the input buffer and UTF-16 decoding before allocating either.
|
||||
releaseInput = scope.reserve((stat.size + 1) * 3);
|
||||
const bytes = Buffer.alloc(stat.size + 1);
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
import test from "node:test";
|
||||
import assert from "node:assert/strict";
|
||||
import fs from "node:fs/promises";
|
||||
import os from "node:os";
|
||||
import path from "node:path";
|
||||
import { managedResourcePath } from "../src/capability-language/managed-source-path.js";
|
||||
|
||||
test("source registration permits an outer workbench alias, never nested checkout or resources symlinks", async (t) => {
|
||||
const scratch = await fs.mkdtemp(path.join(os.tmpdir(), "qx-managed-source-path-"));
|
||||
t.after(() => fs.rm(scratch, { recursive: true, force: true }));
|
||||
const root = path.join(scratch, "retained/workbench"),
|
||||
alias = path.join(scratch, "guest"),
|
||||
outside = path.join(scratch, "outside");
|
||||
await fs.mkdir(path.join(root, "resources/Package"), { recursive: true });
|
||||
await fs.mkdir(outside);
|
||||
await fs.symlink(root, alias);
|
||||
for (const registered of [
|
||||
"resources/Package",
|
||||
path.join(alias, "resources/Package"),
|
||||
path.relative(root, path.join(alias, "resources/Package")),
|
||||
])
|
||||
assert.equal(await managedResourcePath(alias, registered), "resources/Package");
|
||||
await fs.symlink(path.join(root, "resources/Package"), path.join(root, "resources/Alias"));
|
||||
await assert.rejects(managedResourcePath(root, "resources/Alias"), /crosses a symlink/);
|
||||
await fs.symlink(outside, path.join(root, "resources/Escape"));
|
||||
await assert.rejects(managedResourcePath(root, "resources/Escape"), /escapes the workbench/);
|
||||
await fs.mkdir(path.join(outside, "resources/Package"), { recursive: true });
|
||||
await assert.rejects(managedResourcePath(root, path.join(outside, "resources/Package")), /escapes the workbench/);
|
||||
await fs.rename(path.join(root, "resources"), path.join(root, "relocated-resources"));
|
||||
await fs.symlink(path.join(root, "relocated-resources"), path.join(root, "resources"));
|
||||
await assert.rejects(managedResourcePath(root, "resources/Package"), /crosses a symlink/);
|
||||
});
|
||||
@@ -176,6 +176,9 @@ for (const dependencyKind of ["interface", "build"] as const)
|
||||
test(`${dependencyKind} pin upgrades publish children before parent locks and resume without republishing completed nodes`, async (context) => {
|
||||
const workbench = await fs.mkdtemp(path.join(os.tmpdir(), "qx-upgrade-test-"));
|
||||
context.after(() => fs.rm(workbench, { recursive: true, force: true }));
|
||||
const alias = `${workbench}-guest-alias`;
|
||||
await fs.symlink(workbench, alias);
|
||||
context.after(() => fs.unlink(alias));
|
||||
const from = "a".repeat(40),
|
||||
to = "b".repeat(40),
|
||||
framework = "c".repeat(40);
|
||||
@@ -244,7 +247,15 @@ for (const dependencyKind of ["interface", "build"] as const)
|
||||
await fs.mkdir(path.join(workbench, ".quixos"), { recursive: true });
|
||||
await fs.writeFile(
|
||||
path.join(workbench, ".quixos/resource-graph.json"),
|
||||
JSON.stringify({ resources: [{ ...sources[1], source: { resolver: "git", ...sources[1].source } }] }),
|
||||
JSON.stringify({
|
||||
resources: [
|
||||
{
|
||||
...sources[1],
|
||||
directory: path.join(alias, sources[1].directory),
|
||||
source: { resolver: "git", ...sources[1].source },
|
||||
},
|
||||
],
|
||||
}),
|
||||
);
|
||||
assert.deepEqual(
|
||||
plan.nodes.map((node) => node.directory),
|
||||
@@ -275,6 +286,7 @@ for (const dependencyKind of ["interface", "build"] as const)
|
||||
assert.deepEqual(published, ["resources/Named", "root"]);
|
||||
const graph = JSON.parse(await fs.readFile(path.join(workbench, ".quixos/resource-graph.json"), "utf8"));
|
||||
assert.equal(graph.resources.length, 1);
|
||||
assert.equal(graph.resources[0].directory, "resources/Named");
|
||||
assert.equal(graph.resources[0].source.commit, to);
|
||||
const next = await planPinUpgrades(workbench, {
|
||||
nodes: [sources[0], { ...sources[1], source: graph.resources[0].source }],
|
||||
|
||||
Reference in New Issue
Block a user