bryan-minimal · Oct 7, 2026
@@ -0,0 +1,61 @@
+# EXPERIMENT (vlt-from-source-exp): vlt built from source with no prebuilt vlt,
+# esbuild or wasm in the chain, rooted in our node / go (hex0-rooted toolchain).
+let { standaloneTest, BuildSpec, Local, Needs, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
+let base = import "../base/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
+let go = import "../go/build.ncl" in
+let coreutils = import "../coreutils/build.ncl" in
+{
+  name = "vlt-src",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    { file = "gen-deps.mjs" } | Local,
+    # vlt's own source at the release tag
+    {
+      url = "https://github.com/vltpkg/vltpkg/archive/refs/tags/v1.3.7.tar.gz",
+      sha256 = "c8dd06a1cf4520b76c4f8a83102cd6bdd11d1d8841889fabc51003bfdf3a0a74",
+      extract = true,
+      strip_prefix = "vltpkg-1.3.7",
+    } | Source,
+    # esbuild at the exact version vlt's bundler pins (infra/build: ^0.27.1 -> 0.27.7),
+    # built from source with our go instead of npm's prebuilt @esbuild/<platform>
+    {
+      url = "https://github.com/evanw/esbuild/archive/refs/tags/v0.27.7.tar.gz",
+      sha256 = "a2569028ce53f06531794e67388e760b343a1d5e77cef446a6ec07eeb96137f0",
+      extract = true,
+    } | Source,
+    # the published npm tarball, ONLY to diff our build against (never installed)
+    {
+      url = "https://registry.npmjs.org/vlt/-/vlt-1.3.7.tgz",
+      sha256 = "5195a4984473a35429a322165f493b5c1d45668bcd7b239ac8db6d839100fedc",
+    } | Source,
+    base,
+    node-lts,
+    go,
+  ],
+  runtime_deps = [coreutils, node-lts],
+  needs = { dns = {}, internet = {} } | Needs,
+  cmd = "./build.sh",
+  outputs = {
+    vlt = { glob = "usr/bin/vlt" } | OutputBin,
+    vlr = { glob = "usr/bin/vlr" } | OutputBin,
+    vlx = { glob = "usr/bin/vlx" } | OutputBin,
+    libexec = { glob = "usr/libexec/vlt/**", allow_executable = true } | OutputData,
+    report = { glob = "usr/share/vlt-src/**" } | OutputData,
+  },
+  tests = {
+    smoketest = standaloneTest "/usr/bin/vlt --version",
+    version_is_exact =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [["/bin/bash", "-c", "test \"$(/usr/bin/vlt --version)\" = 1.3.7"]],
+      } | Test,
+    reads_a_manifest =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [["/bin/bash", "-c", "d=/tmp/vs; mkdir -p $d; cd $d; printf '{\"name\":\"from-source\",\"version\":\"9.9.9\"}' > package.json; test \"$(VLT_TELEMETRY=0 /usr/bin/vlt pkg get name)\" = '\"from-source\"'"]],
+      } | Test,
+  },
+} | BuildSpec
@@ -0,0 +1,61 @@
+#!/bin/sh
+set -eux
+export VLT_TELEMETRY=0 DO_NOT_TRACK=1
+SRC=$(pwd)
+
+# 1) esbuild 0.27.7 from source with OUR go.
+(cd esbuild-0.27.7 && CGO_ENABLED=0 go build -trimpath -ldflags=-buildid= -o /tmp/esbuild ./cmd/esbuild)
+test "$(/tmp/esbuild --version)" = 0.27.7
+export ESBUILD_BINARY_PATH=/tmp/esbuild
+
+# 2) Stage 1: run vlt from its TypeScript source. Runtime deps (exact versions
+#    from vlt-lock.json) via our node's npm, NO lifecycle scripts.
+mkdir -p /tmp/deps
+node gen-deps.mjs
+printf '@jsr:registry=https://npm.jsr.io\n' > /tmp/deps/.npmrc
+(cd /tmp/deps && npm install --omit=dev --ignore-scripts --legacy-peer-deps --no-audit --no-fund)
+mkdir -p /tmp/boot && cp -r "$SRC/src" "$SRC/infra" "$SRC/package.json" /tmp/boot/
+mv /tmp/deps/node_modules /tmp/boot/node_modules
+mkdir -p /tmp/boot/node_modules/@vltpkg
+for d in /tmp/boot/src/* /tmp/boot/infra/build; do
+  n=$(node -p "require('$d/package.json').name")
+  case "$n" in @vltpkg/*) ln -sfn "$d" "/tmp/boot/node_modules/$n" ;; esac
+done
+BOOT="node --no-warnings --experimental-strip-types /tmp/boot/infra/build/src/bins/vlt.ts"
+test "$($BOOT --version)" = 1.3.7
+
+# 3) Stage 2: the bootstrap vlt installs vlt's own monorepo from its own lockfile.
+#    vlt's default is to run NO lifecycle scripts (':not(*)'), but its repo
+#    vlt.json allows #esbuild/#tailwindcss/#node-pty; override back to none, so
+#    no downloaded installer or prebuilt binary executes.
+$BOOT install --frozen-lockfile --allow-scripts=':not(*)' >/tmp/install.json 2>&1 || { cat /tmp/install.json; exit 1; }
+# Keep prebuilt binaries we did not root out of the tree (and so out of the bundle):
+# npm's @esbuild/<platform> executables (we use ours) and resvg's .wasm (optional
+# mermaid PNG rendering; bundle.ts tolerates its absence).
+mkdir -p /tmp/quarantine
+for d in node_modules/.vlt/~npm~@esbuild+* node_modules/.vlt/~npm~@resvg+*; do
+  [ -e "$d" ] && mv "$d" /tmp/quarantine/
+done
+ls /tmp/quarantine | sed 's/^/quarantined: /'
+
+# 4) Bundle with vlt's own release tool, using OUR esbuild.
+(cd infra/cli && node --no-warnings --experimental-strip-types ../build/src/prepack.ts)
+OUT=infra/cli/.build-publish
+test -f "$OUT/package.json"
+
+# 5) Install like packages/vlt does: private prefix + bin symlinks.
+P="$OUTPUT_DIR/usr/libexec/vlt"
+mkdir -p "$P" "$OUTPUT_DIR/usr/bin"
+cp -r "$OUT/." "$P/"
+for b in vlt vlr vlx; do ln -s "../libexec/vlt/$b.js" "$OUTPUT_DIR/usr/bin/$b"; done
+ls "$P" | head -30
+
+# 6) Compare with the published npm tarball (diagnostic only).
+mkdir -p /tmp/npm && tar -xzf vlt-1.3.7.tgz -C /tmp/npm
+R="$OUTPUT_DIR/usr/share/vlt-src"; mkdir -p "$R"
+(cd /tmp/npm/package && find . -type f | sort | while read f; do echo "$(sha256sum < "$f" | cut -c1-16) $f"; done) > "$R/npm.txt"
+(cd "$P" && find . -type f | sort | while read f; do echo "$(sha256sum < "$f" | cut -c1-16) $f"; done) > "$R/ours.txt"
+echo "npm files: $(wc -l < "$R/npm.txt")  ours: $(wc -l < "$R/ours.txt")  identical: $(comm -12 "$R/npm.txt" "$R/ours.txt" | wc -l)"
+diff "$R/npm.txt" "$R/ours.txt" > "$R/diff.txt" || true
+head -40 "$R/diff.txt"
+diff /tmp/npm/package/package.json "$P/package.json" | tee "$R/package-json.diff" || true
@@ -0,0 +1,22 @@
+// From vlt-lock.json: the exact versions of every EXTERNAL dependency that a
+// runtime (non-dev) edge of the CLI's workspaces (src/*, infra/build) points at.
+import { readFileSync, writeFileSync } from 'node:fs'
+const lock = JSON.parse(readFileSync('vlt-lock.json', 'utf8'))
+const deps = {}, conflicts = {}
+for (const [from, to] of Object.entries(lock.edges)) {
+  const src = from.split(' ')[0]
+  if (!(src.startsWith('workspace~src+') || src === 'workspace~infra+build')) continue
+  const [type, , target] = to.split(' ')
+  if (!['prod', 'optional', 'peer', 'peerOptional'].includes(type) || !target) continue
+  if (target.startsWith('workspace~') || target.startsWith('file~')) continue
+  const node = lock.nodes[target]
+  if (!node) continue
+  const name = node[1]
+  const version = target.slice(target.lastIndexOf('@') + 1).split('~')[0] // drop vlt's ~peer.<hash> context suffix
+  if (deps[name] && deps[name] !== version) (conflicts[name] ??= new Set([deps[name]])).add(version)
+  deps[name] = version
+}
+delete deps.esbuild // bundling only; not needed to RUN from source (and it is a prebuilt Go binary)
+writeFileSync('/tmp/deps/package.json', JSON.stringify({ name: 'vlt-src-deps', private: true, dependencies: deps }, null, 1))
+console.log(`external runtime deps: ${Object.keys(deps).length}`)
+for (const [n, v] of Object.entries(conflicts)) console.log(`version conflict ${n}: ${[...v].join(' ')}`)