e2e: assigned plex + redis prove the module runtime (ADR 0052)

build-module-runtime.sh generalises the audit-logger runtime image to any module (mesh-tools + sdk + the module's dist, entrypoints for tools/events/provisioner). Two scenarios and two tests: assigned-plex proves a tools+events module serves its tools over a mesh-issued scoped account; assigned-redis proves a provider's runtime serves tools AND runs its provisioner in the same broker-bound process, provisioning a grant and emitting its lifecycle event. Both green. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
2026-09-04 22:29:53 +02:00
parent 37b16cd0e9
commit f093769354
5 changed files with 628 additions and 0 deletions
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Build a per-module runtime image (novox/hq ADR 0052): the tool runtime carrying ONE module's
+# compiled code, which serves that module's tools and runs its events/provisioner under the module's
+# own scoped broker account. Generalises build-runtime-image.sh from the audit-logger to any module.
+#
+#   build-module-runtime.sh <module> <output.tar>
+#   -> tags mesh-runtime-<module>:development and saves it to <output.tar>
+set -euo pipefail
+
+MODULE="${1:?usage: build-module-runtime.sh <module> <output.tar>}"
+OUT="${2:?usage: build-module-runtime.sh <module> <output.tar>}"
+HERE="$(cd "$(dirname "$0")/.." && pwd)"; ROOT="$(cd "$HERE/.." && pwd)"
+MESH_TOOLS="${MESH_TOOLS:-$ROOT/mesh-tools}"
+MESH_SDK="${MESH_SDK:-$ROOT/mesh-sdk}"
+MESH_CATALOG="${MESH_CATALOG:-$ROOT/mesh-catalog}"
+MOD="$MESH_CATALOG/modules/$MODULE"
+TAG="${RUNTIME_TAG:-mesh-runtime-$MODULE:development}"
+BASE="${RUNTIME_BASE:-node:22-bookworm-slim}"
+[ -d "$MOD" ] || { echo "no module $MODULE at $MOD" >&2; exit 1; }
+
+( cd "$MESH_SDK" && npm run build >/dev/null )
+( cd "$MESH_TOOLS" && npm run build >/dev/null )
+# Compile whichever of the module's entrypoints exist.
+SRCS=(); for f in client.ts index.ts tools/index.ts provisioner/index.ts; do [ -f "$MOD/$f" ] && SRCS+=("$f"); done
+TSC="$MESH_SDK/node_modules/.bin/tsc"; ( cd "$MOD" && "$TSC" "${SRCS[@]}" --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist >/dev/null )
+
+STAGE="$(mktemp -d)"; trap 'rm -rf "$STAGE"' EXIT
+cp -r "$MESH_TOOLS/dist" "$STAGE/dist"
+cp -rL "$MESH_TOOLS/node_modules" "$STAGE/node_modules"
+mkdir -p "$STAGE/modules/$MODULE"; cp -r "$MOD/dist" "$STAGE/modules/$MODULE/dist"
+cp "$MESH_TOOLS/package.json" "$STAGE/package.json"
+
+# The entrypoints the runtime loads: tools, events and (a provider's) provisioner, whichever exist.
+ENTRIES=""; for e in tools/index.js index.js provisioner/index.js; do
+  [ -f "$STAGE/modules/$MODULE/dist/$e" ] && ENTRIES="${ENTRIES:+$ENTRIES,}/app/modules/$MODULE/dist/$e"
+done
+
+cat > "$STAGE/Dockerfile" <<DOCKER
+FROM $BASE
+WORKDIR /app
+COPY package.json ./
+COPY node_modules ./node_modules
+COPY dist ./dist
+COPY modules ./modules
+ENV MESH_TOOL_MODULES=$ENTRIES
+ENTRYPOINT ["node", "dist/main.js"]
+DOCKER
+docker build -t "$TAG" "$STAGE"
+docker save -o "$OUT" "$TAG"
+echo "built $TAG (entrypoints: $ENTRIES) -> $OUT"