Review round 1 for the Node build module: build depth (1490), bin scripts for the test script (1491), toolchain.reported and its stream (1483, 1488); delta part 3 of 4

modules/mesh-build-node/README.md

@@ -45,21 +45,23 @@ toolchain install: a long step answers at once with its id and ends on `<node>.<
 - `build_node_fetch` {repository, commit, ref} (issue 1489): the commit over ssh as the module's account
   (`buildstep.FetchCommit`, remote `ssh://mesh-forge/<owner>/<name>.git`) into `<work>/<id>/tree`, then for each
   TypeScript module (a module.json with a typescript artifact) the packages its package.json names beyond the SDK,
-  `typescript` and `@types/*` (the toolchain carries those): none installs nothing; some need a package-lock.json, else
-  the step fails naming the directory, and are installed as the build agent does (scratch copy without the SDK,
+  `typescript` and `@types/*` (the toolchain carries those): none installs nothing; some need a package-lock.json, and
+  are installed as the build agent does (scratch copy without the SDK,
   devDependencies and scripts; `npm ci --omit=dev --omit=peer --ignore-scripts --no-bin-links`; copies of the SDK
-  removed). A dependency on another `@novox/` package fails the step: a fetch holds no registry credential
-  (ADR 0466 §4). Every command runs through `forgekey.ExecRunnerClean(0)` with PATH, HOME, the locale and its own
+  removed). The mesh's registry reaches `npm ci` through a private config file (`--userconfig`), so
+  other `@novox/` packages install. A module with packages and no lock does not fail the fetch: its result lists it
+  under `refused` with the reason, and a build of that bundle fails naming it (issue 1459). Every command runs through `forgekey.ExecRunnerClean(0)` with PATH, HOME, the locale and its own
   words, nothing of this process's environment. Workspaces older than a day are removed at each fetch.
 - `build_node_test` {workspace, module, level} (issue 1491): the unit level is the type-check (the toolchain's tsc, the
   package's `tsconfig.json` or the build agent's flags over its .ts files) and the `test` script; the integration level
   is the `test:integration` script, the type-check being its setup. Bounds (the Go module's; ADR 0445 names none for
-  TypeScript): unit 5 s, integration 30 s setup and 60 s running. A level over its bound says `over_bound` and passes;
+  TypeScript): unit 5 s, integration 30 s setup and 60 s running. The test script finds `tsc` and `esbuild` on its PATH through `<work>/<id>/bin` (shell scripts calling the toolchain's). A level over its bound says `over_bound` and passes;
   a failed one finishes the step with `passed` false and the output (the step fails only when the tests could not be run). Neither script nor .ts files: no tests. The toolchain makes no bin
   links, so a script runs `node` and files, not `tsc` by name.
 - `build_node_build` {workspace, module, artifact} (issue 1490): the build agent's tsc and esbuild lines
   (mesh-controller internal/builder, cited in `build.go`), the launchers, `package.json`, `buildstep.Pack`, and the
-  digest. No network. The toolchain's packages (not typescript or esbuild) are copied to `<work>/<id>/node_modules`,
-  above the tree, which is where tsc, esbuild and node find `@novox/mesh-sdk` and the types by walking up; a copy and
-  not a link, because the mesh makes no symlink. A bundle that keeps an external gets them in its own `node_modules`.
+  digest. No network. The build runs in a staging copy of the module at `<work>/<id>/stage-<artifact>/modules/module`, with the
+  toolchain's packages (not typescript or esbuild) copied to `stage-<artifact>/node_modules`: the build agent's depth
+  (`/app/modules/module`, `/app/node_modules`), so esbuild's `../../node_modules/...` path comments, and the bundle's
+  digest, equal its. Copies, not links, because the mesh makes no symlink. A bundle that keeps an external gets them in its own `node_modules`.
   The packed archive is written beside the tree as `<artifact>.tar.gz`.