quixos-protocol/src/capability-language/checked-build.ts

import fs from "node:fs/promises";
import path from "node:path";
import {execFile as callback, spawn} from "node:child_process";
import { createWriteStream } from "node:fs";
import {promisify} from "node:util";
import {fileURLToPath} from "node:url";
const execFile = promisify(callback);
const environment = () => ({...process.env, QUIXOS_JJ_NO_CHECKPOINT: "1", GIT_TERMINAL_PROMPT: "0"});
export const checkerIdentity = () => process.env.QUIXOS_CHECK_GENERATOR ?? path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");

/** Checking snapshots jj, but never publishes or activates the working copy. */
export async function snapshotCommit(root: string): Promise<string> {
  const run = async (...args: string[]) => (await execFile("jj", args, {cwd: root, env: environment()})).stdout.trim();
  await run("status");
  // jj resolve --list exits 1 on a clean revision. Query structured revision
  // metadata instead of depending on diagnostic wording or swallowing errors.
  if (await run("--ignore-working-copy", "log", "--no-graph", "-r", "@", "-T", "conflict") !== "false") throw new Error("Resolve source conflicts before verification");
  const commit = await run("--ignore-working-copy", "log", "--no-graph", "-r", "@", "-T", "commit_id");
  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(commit)) throw new Error("Verification requires an exact jj commit");
  await execFile("git", ["diff", "--exit-code", "--no-ext-diff", "--no-textconv", commit, "--"], {cwd: root, env: environment()});
  const {stdout} = await execFile("git", ["ls-files", "--others", "--exclude-standard", "-z"], {cwd: root});
  if (stdout) throw new Error("Source contains files not captured by jj; inspect jj tracking before verification");
  return commit;
}

/** Use Git's actual committed tree, never dirty overlays labelled as old pins. */
export async function checkoutCommit(root: string, commit: string, destination: string) {
  await fs.mkdir(destination, {recursive: true});
  const archive = await execFile("git", ["archive", "--format=tar", commit], {cwd: root, encoding: "buffer", maxBuffer: 128 * 1024 * 1024});
  await new Promise<void>((resolve, reject) => {
    const child = spawn("tar", ["-xf", "-", "-C", destination], {stdio: ["pipe", "ignore", "pipe"]});
    let error = "";
    child.stderr.on("data", chunk => {error += chunk;});
    child.on("error", reject);
    child.on("close", code => code === 0 ? resolve() : reject(new Error(`Cannot extract committed source: ${error}`)));
    child.stdin.on("error", reject);
    child.stdin.end(archive.stdout);
  });
}

/** Shared by provisional checks, template publication and host activation.
 * The Nix derivation is the cached check; its metadata is internal provenance,
 * not a certificate authored or approved by the workspace agent.
 */
export async function buildCheckedPackage(source: string, schema: string, packageRevisionId: string): Promise<string> {
  const generator = process.env.QUIXOS_CHECK_GENERATOR ?? path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
  if (!/^\/nix\/store\/[^/]+$/.test(generator)) throw new Error("Run verification with the installed Quixos tooling (its exact Nix checker is required)");
  const builder = path.join(generator, "share/checked-package.nix");
  await fs.access(builder);
  return await new Promise((resolve, reject) => {
    const child = spawn("nix", ["build", "--impure", "--file", builder,
      "--argstr", "source", source, "--argstr", "schema", schema,
      "--argstr", "generator", generator, "--argstr", "packageRevisionId", packageRevisionId,
      "--no-link", "--print-out-paths", "-L"], {env: environment(), stdio: ["ignore", "pipe", "inherit"]});
    let output = "";
    child.stdout.on("data", chunk => {output += chunk;});
    child.on("error", reject);
    child.on("close", code => {
      const artifact = output.trim();
      if (code !== 0 || !/^\/nix\/store\/[a-z0-9]{32}-[^\s/]+$/.test(artifact)) reject(new Error(`Checked Nix build failed (${code}); see build diagnostics above`));
      else resolve(artifact);
    });
  });
}

/** Exact remote source DAG; the Nix checker owns schema construction and all
 * nested fetches. Keep build noise in a named log, with a bounded failure tail. */
export async function buildImmutableCandidate(source: { repository: string; commit: string }, kind: "workspace" | "interface" | "package", logFile: string, contractOnly = false): Promise<string> {
  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(source.commit)) throw new Error("An immutable candidate requires an exact commit");
  const url = new URL(source.repository);
  if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash) throw new Error("Candidate origin must be credential-free HTTPS");
  const generator = process.env.QUIXOS_CHECK_GENERATOR ?? path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
  if (!/^\/nix\/store\/[^/]+$/.test(generator)) throw new Error("Use the installed Quixos checker");
  const builder = path.join(generator, "share/checked-candidate.nix");
  await fs.access(builder);
  const log = createWriteStream(logFile, { flags: "wx", mode: 0o600 });
  await new Promise<void>((resolve, reject) => { log.once("open", () => resolve()); log.once("error", reject); });
  return await new Promise((resolve, reject) => {
    let output = "", tail = "", failure: Error | undefined;
    const child = spawn("nix", ["build", "--impure", "--file", builder,
      "--argstr", "repository", source.repository, "--argstr", "commit", source.commit,
      "--argstr", "kind", kind, "--argstr", "generator", generator,
      "--arg", "contractOnly", contractOnly ? "true" : "false",
      "--no-link", "--print-out-paths", "-L"], { env: environment(), stdio: ["ignore", "pipe", "pipe"] });
    log.on("error", error => { failure = error; child.kill(); });
    child.stdout.on("data", chunk => { output += chunk; });
    child.stderr.on("data", chunk => { log.write(chunk); tail = (tail + String(chunk)).slice(-6000); });
    child.on("error", error => { failure = error; });
    child.on("close", code => log.end(() => {
      if (failure) reject(failure);
      else if (code !== 0 || !/^\/nix\/store\/[a-z0-9]{32}-[^\s/]+$/.test(output.trim())) reject(new Error(`Candidate Nix check failed (${code}). Full log: ${logFile}\n${tail}`));
      else resolve(output.trim());
    }));
  });
}