| """Bounded offline generated-module reconstruction over a verified capture.""" |
| import argparse |
| import json |
| import shutil |
| import sys |
| from pathlib import Path |
|
|
| ROOT = Path(__file__).resolve().parents[1] |
| sys.path.insert(0, str(ROOT / 'packages/core')) |
| from chameleon_core.repository_capture import verify_package |
| from chameleon_core.windows_job import run_bounded |
| from derived_overlay import validate_overlay |
|
|
|
|
| def build_saved(package, importer, output): |
| verify_package(package) |
| if importer not in package['repository']['files']: |
| raise ValueError('BUILD_IMPORTER_NOT_CAPTURED') |
| output.mkdir(exist_ok=False) |
| node = shutil.which('node') |
| if not node: |
| raise ValueError('NODE_UNAVAILABLE') |
| runtime = run_bounded([node, str(ROOT / 'scripts/build_declared_module.mjs')], |
| json.dumps({'package': package, 'importer': importer, 'policy': 'modern-esm-bundle-v1'}), ROOT) |
| stdout = runtime.pop('stdout') |
| (output / 'runtime.json').write_text(json.dumps(runtime, indent=2), encoding='utf-8') |
| if (runtime.get('returncode') != 0 or runtime.get('remaining_job_processes') != 0 |
| or any(runtime.get(k) is not False for k in ('timed_out', 'cpu_budget_exhausted', 'output_budget_exhausted'))): |
| raise ValueError('BUILD_SUPERVISOR_FAILED') |
| candidate = json.loads(stdout) |
| if candidate['source_digest'] != package['digest'] or candidate['importer'] != importer: |
| raise ValueError('BUILD_CANDIDATE_BINDING') |
| (output / 'candidate.json').write_text(json.dumps(candidate, indent=2), encoding='utf-8') |
| overlay = {'version': 'derived-bundle-v1', 'source_digest': package['digest'], 'path': importer, |
| 'before_sha256': package['repository']['files'][importer]['sha256'], |
| 'after_base64': candidate['after_base64'], 'after_sha256': candidate['after_sha256'], |
| 'operator': 'modern-esm-bundle-v1', |
| 'build': {k: candidate[k] for k in ('tool', 'plan', 'used')}} |
| encoded, fingerprint = validate_overlay(overlay, package) |
| (output / 'overlay.json').write_text(encoded, encoding='utf-8') |
| return {'status': 'UNVERIFIED_CANDIDATE', 'source_digest': package['digest'], |
| 'overlay_digest': fingerprint, 'bytes': candidate['bytes'], 'public_changes': False} |
|
|
|
|
| def main(): |
| parser = argparse.ArgumentParser() |
| parser.add_argument('package') |
| parser.add_argument('importer') |
| parser.add_argument('output') |
| args = parser.parse_args() |
| source, output = Path(args.package).resolve(), Path(args.output).resolve() |
| base = ROOT / '.local/repository-pilot' |
| if (not source.is_relative_to(base) or source.stat().st_size > 8*1024*1024 |
| or not output.is_relative_to(base) or output == base or output.exists()): |
| raise ValueError('BUILD_PILOT_BOUNDARY') |
| print(json.dumps(build_saved(json.loads(source.read_text(encoding='utf-8')), args.importer, output))) |
|
|
|
|
| if __name__ == '__main__': |
| main() |
|
|
