node consumers: node-lts interpreter only at runtime, node-lts to build (fixes #751)

packages/agent-browser/build.ncl

@@ -1,10 +1,10 @@
-let { standaloneTest, Attrs, BuildSpec, Local, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
+let { standaloneTest, subsetOf, Attrs, BuildSpec, Local, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let make = import "../make/build.ncl" in
 let pkgconf = import "../pkgconf/build.ncl" in
 let rust = import "../rust/build.ncl" in
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 let pnpm = import "../pnpm/build.ncl" in
 
 let bash = import "../bash/build.ncl" in
@@ -66,12 +66,12 @@ let version = "0.15.1" in
     make,
     pkgconf,
     rust,
-    node,
+    node-lts,
     pnpm,
   ],
   runtime_deps = [
     bash,
-    node,
+    subsetOf node-lts ["node"],
     glibc,
     chromium-headless-shell-bin,
   ],

packages/bash-language-server/build.ncl

@@ -1,19 +1,19 @@
-let { Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, .. } = import "minimal.ncl" in
+let { subsetOf, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
 let coreutils = import "../coreutils/build.ncl" in
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 
 let version = "5.8.0" in
 {
   name = "bash-language-server",
   build_deps = [
     { file = "build.sh" } | Local,
     base,
-    node,
+    node-lts,
   ],
   runtime_deps = [
     coreutils,
-    node,
+    subsetOf node-lts ["node"],
   ],
   needs =
     {

packages/capy/build.ncl

@@ -1,4 +1,4 @@
-let { Attrs, BuildSpec, Local, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
+let { subsetOf, Attrs, BuildSpec, Local, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
 let coreutils = import "../coreutils/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
@@ -28,7 +28,7 @@ let version = "0.9.1" in
     coreutils, # `capy` shebang resolves node via /usr/bin/env
     ca-certificates, # HTTPS to the Capy API (sync, decryption)
     git, # capy shells out to git for repo/branch detection
-    node-lts, # capy is a Node CLI (#!/usr/bin/env node)
+    subsetOf node-lts ["node"], # capy is a Node CLI (#!/usr/bin/env node); interpreter only, no npm (#751)
   ],
 
   cmd = "./build.sh",

packages/cf/build.ncl

@@ -1,7 +1,7 @@
-let { standaloneTest, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, Source, .. } = import "minimal.ncl" in
+let { standaloneTest, subsetOf, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, Source, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
 let coreutils = import "../coreutils/build.ncl" in
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 
 # cf is Cloudflare's unified CLI (technical preview). It is closed-source and
 # distributed only as a pre-bundled npm package — there is no public source
@@ -20,11 +20,11 @@ let version = "0.1.0" in
       sha256 = "758b65757a10cf6ef918c3ec02da45374d6b4ec402ebe39b6907e46b8ac25c1b",
     } | Source,
     base,
-    node,
+    node-lts,
   ],
   runtime_deps = [
     coreutils,
-    node,
+    subsetOf node-lts ["node"],
   ],
   needs =
     {

packages/emscripten/build.ncl

@@ -2,7 +2,7 @@ let { subsetOf, Attrs, BuildSpec, Local, OutputBin, OutputData, Source, Test, ..
 let base = import "../base/build.ncl" in
 let binaryen = import "../binaryen/build.ncl" in
 let llvm = import "../llvm/build.ncl" in
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 let python = import "../python/build.ncl" in
 
 let glibc = import "../glibc/build.ncl" in
@@ -42,7 +42,7 @@ let version = "4.0.11" in
   runtime_deps = [
     binaryen,
     glibc,
-    node,
+    subsetOf node-lts ["node"],
     python,
     subsetOf llvm ["bins", "libllvm", "libs_clang", "liblld", "libclang"],
   ],

packages/eslint/build.ncl

@@ -1,18 +1,18 @@
 # Imported from Wolfi `eslint` by `pkgmgr import-wolfi` (node build),
 # with outputs refined from a verified `minimal package` build.
-let { Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, .. } = import "minimal.ncl" in
+let { subsetOf, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 let coreutils = import "../coreutils/build.ncl" in
 let version = "10.9.1" in
 {
   name = "eslint",
   build_deps = [
     { file = "build.sh" } | Local,
     base,
-    node,
+    node-lts,
   ],
-  runtime_deps = [coreutils, node],
+  runtime_deps = [coreutils, subsetOf node-lts ["node"]],
   needs =
     {
       dns = {},

packages/json-server/build.ncl

@@ -1,18 +1,18 @@
 # Imported from Wolfi `json-server` by `pkgmgr import-wolfi` (node build),
 # with outputs refined from a verified `minimal package` build.
-let { Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, .. } = import "minimal.ncl" in
+let { subsetOf, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 let coreutils = import "../coreutils/build.ncl" in
 let version = "0.17.4" in
 {
   name = "json-server",
   build_deps = [
     { file = "build.sh" } | Local,
     base,
-    node,
+    node-lts,
   ],
-  runtime_deps = [coreutils, node],
+  runtime_deps = [coreutils, subsetOf node-lts ["node"]],
   needs =
     {
       dns = {},

packages/lerna/build.ncl

@@ -1,18 +1,18 @@
 # Imported from Wolfi `lerna` by `pkgmgr import-wolfi` (node build),
 # with outputs refined from a verified `minimal package` build.
-let { Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, .. } = import "minimal.ncl" in
+let { subsetOf, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 let coreutils = import "../coreutils/build.ncl" in
 let version = "10.0.1" in
 {
   name = "lerna",
   build_deps = [
     { file = "build.sh" } | Local,
     base,
-    node,
+    node-lts,
   ],
-  runtime_deps = [coreutils, node],
+  runtime_deps = [coreutils, subsetOf node-lts ["node"]],
   needs =
     {
       dns = {},

packages/mermaid-cli/build.ncl

@@ -1,8 +1,8 @@
-let { standaloneTest, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
+let { standaloneTest, subsetOf, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
 let curl = import "../curl/build.ncl" in
 let gh = import "../gh/build.ncl" in
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 
 # chromium-headless-shell-bin provides the headless-shell binary (which
 # Puppeteer drives in mermaid's "headless: shell" mode) and its full
@@ -24,12 +24,12 @@ let version = "11.17.0" in
     base,
     curl,
     gh,
-    node,
+    node-lts,
   ],
   runtime_deps = [
     base,
     chromium-headless-shell-bin,
-    node,
+    subsetOf node-lts ["node"],
   ],
   needs =
     {

packages/next/build.ncl

@@ -1,10 +1,10 @@
-let { Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
+let { subsetOf, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
 let coreutils = import "../coreutils/build.ncl" in
 let glib = import "../glib/build.ncl" in
 let libvips = import "../libvips/build.ncl" in
 let make = import "../make/build.ncl" in
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 let pkgconf = import "../pkgconf/build.ncl" in
 let pnpm = import "../pnpm/build.ncl" in
 let python = import "../python/build.ncl" in
@@ -24,7 +24,7 @@ let version = "16.3.5" in
     base,
     glib,
     make,
-    node,
+    node-lts,
     pkgconf,
     pnpm,
     python,
@@ -34,7 +34,7 @@ let version = "16.3.5" in
     coreutils,
     glib,
     libvips,
-    node,
+    subsetOf node-lts ["node"],
   ],
   needs =
     {

packages/next/build.sh

@@ -99,8 +99,14 @@ if [ -d src/build ]; then
   fi
 fi
 
-# Copy the source-built sharp into next's node_modules
+# Copy the source-built sharp into next's node_modules, REPLACING the sharp npm
+# already installed there: sharp is one of next's optionalDependencies. With
+# the target present, `cp -r` nests the build at sharp/sharp/, which nothing
+# loads. The npm copy then wins with its prebuilt @img binaries (deleted
+# below): no binary at all on amd64, and on arm64 a silent fallback to the
+# prebuilt addon plus bundled libvips.
 cd "$SHARP_STAGING"
+rm -rf "$NEXT_DIR/node_modules/sharp"
 cp -r node_modules/sharp "$NEXT_DIR/node_modules/sharp"
 
 # Copy sharp's runtime dependencies
@@ -110,14 +116,30 @@ for dep in detect-libc semver; do
   fi
 done
 mkdir -p "$NEXT_DIR/node_modules/@img"
-if [ -d "node_modules/@img/colour" ]; then
+if [ -d "node_modules/@img/colour" ] && [ ! -d "$NEXT_DIR/node_modules/@img/colour" ]; then
   cp -r node_modules/@img/colour "$NEXT_DIR/node_modules/@img/colour"
 fi
 
-# Remove any prebuilt platform binaries (we use source-built sharp + system libvips)
-rm -rf "$NEXT_DIR/node_modules/@img/sharp-linux-x64"
-rm -rf "$NEXT_DIR/node_modules/@img/sharp-libvips-linux-x64"
-rm -rf "$NEXT_DIR/node_modules/sharp/node_modules/@img/sharp-linux-x64"
-rm -rf "$NEXT_DIR/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64"
-rm -rf "$NEXT_DIR/node_modules/sharp/node_modules/@img/sharp-linuxmusl-x64"
-rm -rf "$NEXT_DIR/node_modules/sharp/node_modules/@img/sharp-libvips-linuxmusl-x64"
+# Remove every prebuilt platform binary, for EVERY arch (we use source-built
+# sharp + system libvips). Naming only the x64 ones left arm64's
+# @img/sharp-linux-arm64 in place, so arm64 quietly loaded the prebuilt addon.
+# @img/colour is a JS dependency, not a binary; it stays.
+for img in "$NEXT_DIR/node_modules/@img" "$NEXT_DIR/node_modules/sharp/node_modules/@img"; do
+  [ -d "$img" ] || continue
+  find "$img" -mindepth 1 -maxdepth 1 -name 'sharp-*' -exec rm -rf {} +
+done
+
+# Prove it at build time, not in a later test: sharp must load from the
+# installed tree, from its source-built addon, with a libvips version.
+node -e '
+const path = require("path");
+const dir = process.argv[1];
+const s = require(dir);
+const addon = Object.keys(require.cache).find((f) => f.endsWith(".node"));
+const want = path.join(dir, "src", "build", "Release") + path.sep;
+if (!addon || !addon.startsWith(want)) {
+  throw new Error("sharp did not load its source-built addon (loaded: " + addon + ")");
+}
+if (!s.versions.vips) throw new Error("sharp loaded without libvips");
+console.log("sharp", s.versions.sharp, "vips", s.versions.vips, "addon", path.basename(addon));
+' "$NEXT_DIR/node_modules/sharp"

packages/pi/build.ncl

@@ -1,7 +1,7 @@
-let { Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, Source, .. } = import "minimal.ncl" in
+let { subsetOf, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, Source, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
 let coreutils = import "../coreutils/build.ncl" in
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 
 # pi is the Pi coding agent (pi.dev), published to npm as
 # @earendil-works/pi-coding-agent. It is installed from the sha256-pinned
@@ -21,11 +21,11 @@ let version = "0.84.4" in
       sha256 = "5bce766d19c3ceba18f3fbaad91c449c9f9d73981f9e3400ecef932006f06968",
     } | Source,
     base,
-    node,
+    node-lts,
   ],
   runtime_deps = [
     coreutils,
-    node,
+    subsetOf node-lts ["node"],
   ],
   needs =
     {

packages/pnpm/build.ncl

@@ -3,7 +3,7 @@ let base = import "../base/build.ncl" in
 let coreutils = import "../coreutils/build.ncl" in
 let tar = import "../tar/build.ncl" in
 
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 
 let version = "11.21.0" in
 {
@@ -18,28 +18,22 @@ let version = "11.21.0" in
     tar,
   ],
   runtime_deps = [
-    # `node`, NOT `node-lts`. pnpm only needs *a* node for its
-    # `#!/usr/bin/env node` shebang, but whichever one it names lands in the
-    # closure of every package that builds with pnpm. `next` and
-    # `agent-browser` both declare `node` themselves, so naming `node-lts` here
-    # put TWO npm installs in one sandbox — and since the sandbox hardlinks
-    # closure members first-writer-wins PER FILE, the resulting
-    # /usr/lib/node_modules/npm was a blend of both versions:
-    # minipass-flush/index.js from npm 11.17.0 (named `{ Minipass }` import)
-    # beside a nested minipass@3.3.6 from npm 11.11.1 (default export only).
-    # That tree has never existed upstream and cannot load — every
-    # `npm install` died, which broke `next` for two days. See pkgs#665/#670.
-    # ONLY the `node` binary — deliberately NOT npm/npx/node_modules.
+    # ONLY the `node` binary from `node-lts` — deliberately NOT npm/npx/node_modules.
     #
     # pnpm needs a node to interpret its `#!/usr/bin/env node` shebang and
-    # nothing else. Depending on the whole package dragged a SECOND npm into
-    # the closure of everything built with pnpm, and since the sandbox
-    # hardlinks closure members first-writer-wins PER FILE, the resulting
-    # /usr/lib/node_modules/npm was a blend of two npm versions that cannot
-    # load (see the commit message and pkgs#665). Taking the subset means pnpm
-    # can never contribute an npm tree at all, so that class is closed even if
-    # a consumer later picks a different node.
-    subsetOf node ["node"],
+    # nothing else, but whatever it names lands in the closure of every package
+    # built with pnpm. Depending on a whole node package dragged a SECOND npm
+    # into that closure; the sandbox (and a user session) hardlinks closure
+    # members first-writer-wins PER FILE, so /usr/lib/node_modules/npm became a
+    # blend of two npm versions that cannot load ("Class extends value
+    # undefined"). That broke `next` for two days (#665/#670) and webapp's
+    # sessions (#751). The subset means pnpm can never contribute an npm tree.
+    #
+    # `node-lts`, like every other node consumer: one runtime flavor across the
+    # catalog means every package ships the same /usr/bin/node, so there is no
+    # first-writer race on the interpreter either (#751 review). `node` (Current)
+    # stays available as an explicit opt-in for users.
+    subsetOf node-lts ["node"],
     coreutils,
   ],
   needs =

packages/prettier/build.ncl

@@ -1,9 +1,9 @@
 # Imported from npm `prettier` by `pkgmgr import npm` (node build).
 # TODO: REVIEWER — installs `prettier` from npm; add any peer packages the
 # tool needs (cf. typescript-language-server pulling `typescript`).
-let { Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, .. } = import "minimal.ncl" in
+let { subsetOf, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
-let node = import "../node/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
 let coreutils = import "../coreutils/build.ncl" in
 let version = "3.9.8" in
 {
@@ -13,9 +13,9 @@ let version = "3.9.8" in
     { file = "package.json" } | Local,
     { file = "package-lock.json" } | Local,
     base,
-    node,
+    node-lts,
   ],
-  runtime_deps = [coreutils, node],
+  runtime_deps = [coreutils, subsetOf node-lts ["node"]],
   needs =
     {
       dns = {},