V48 (impl-only): Fix deposit sandbox package imports

Ship live runner into sandbox, resolve monorepo packages via
BITCODE_MONOREPO_ROOT + .ts URLs, and run with tsx so Pipeliner
image mode can load TypeScript package sources.

Author: geraldarthurdavis

containers/images/pipeliner/scripts/materialize.mjs

@@ -34,12 +34,14 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const mode = (process.env.BITCODE_PIPELINE_HOST_MODE || 'host_smoke').trim();
 const monorepoRoot = (process.env.BITCODE_MONOREPO_ROOT || '/opt/bitcode').trim();
 
-// Prefer image layout (runners next to monorepo for relative imports).
+// Prefer sandbox-uploaded runners (hot-fixed by host plan), then image-baked.
+const sandboxRunnerDir = '/vercel/sandbox/.bitcode/pipeline-host';
 const imageRunnerDir = path.join(monorepoRoot, '.bitcode', 'pipeline-host');
 const localRunnerDir = __dirname;
 
 async function resolveRunner(name) {
   const candidates = [
+    path.join(sandboxRunnerDir, name),
     path.join(imageRunnerDir, name),
     path.join(localRunnerDir, name),
   ];
@@ -72,28 +74,21 @@ async function main() {
     monorepoRoot,
     'packages/pipeline-hosts/tsconfig.json',
   );
+  const hostsPkg = path.join(monorepoRoot, 'packages/pipeline-hosts');
+  const outAbs = path.resolve(distDir);
+  // shell:true so PATH resolves pnpm when invoked under pnpm recursive run.
   const result = spawnSync(
-    'pnpm',
-    [
-      '--filter',
-      '@bitcode/pipeline-hosts',
-      'exec',
-      'ts-node',
-      '--transpile-only',
-      '--project',
-      hostsTsconfig,
-      'src/dev/materialize-runners.ts',
-      distDir,
-    ],
+    `pnpm exec ts-node --transpile-only --project ${JSON.stringify(hostsTsconfig)} src/dev/materialize-runners.ts ${JSON.stringify(outAbs)}`,
     {
-      cwd: path.join(monorepoRoot, 'packages/pipeline-hosts'),
+      cwd: hostsPkg,
       encoding: 'utf8',
       env: process.env,
+      shell: true,
     },
   );
-  if (result.status !== 0) {
+  if (result.error || result.status !== 0) {
     throw new Error(
-      `materialize-runners failed (status ${result.status}): ${result.stderr || result.stdout}`,
+      `materialize-runners failed (status ${result.status}, error=${result.error?.message || 'none'}): ${result.stderr || result.stdout}`,
     );
   }
 

packages/pipeline-hosts/package.json

@@ -27,7 +27,8 @@
     "@vercel/sandbox": "2.6.0",
     "@bitcode/host-generics": "workspace:*",
     "@bitcode/generic-hosts-local": "workspace:*",
-    "@bitcode/generic-hosts-vercel-sandbox": "workspace:*"
+    "@bitcode/generic-hosts-vercel-sandbox": "workspace:*",
+    "tsx": "^4.19.3"
   },
   "devDependencies": {
     "@types/jest": "^29.5.12",

packages/pipeline-hosts/src/__tests__/asset-pack-host-plan.test.ts

@@ -29,6 +29,7 @@ describe('asset-pack sandbox host plan', () => {
     ]);
     expect(plan.files.map((file) => file.path)).toEqual([
       '.bitcode/pipeline-host/manifest.json',
+      '.bitcode/pipeline-host/run-live-asset-pack-pipeline.mjs',
       '.bitcode/pipeline-host/run-host-smoke.mjs',
       '.bitcode/pipeline-host/run-live-asset-pack-pipeline.ts',
     ]);
@@ -98,13 +99,18 @@ describe('asset-pack sandbox host plan', () => {
     expect(plan.createOptions.persistent).toBe(false);
     expect(plan.files.map((file) => file.path)).toEqual([
       '.bitcode/pipeline-host/manifest.json',
+      '.bitcode/pipeline-host/run-live-asset-pack-pipeline.mjs',
     ]);
     expect(plan.commands.map((command) => command.label)).toEqual([
       'runtime-readiness',
       'asset-pack-pipeline-run',
     ]);
     const run = plan.commands.find((c) => c.label === 'asset-pack-pipeline-run');
-    expect(run?.args?.join(' ')).toContain('/opt/bitcode/pipeline/run-pipeline.mjs');
+    const runScript = run?.args?.join(' ') ?? '';
+    // Image path runs sandbox-uploaded runner with tsx (loads monorepo .ts packages).
+    expect(runScript).toContain('run-live-asset-pack-pipeline.mjs');
+    expect(runScript).toContain('tsx');
+    expect(runScript).toContain('/opt/bitcode');
   });
 
   it('plans dependency install and live runner commands for real pipeline mode', () => {

packages/pipeline-hosts/src/__tests__/vercel-sandbox-host.test.ts

@@ -154,7 +154,8 @@ describe('VercelSandboxPipelineHost', () => {
     const result = await host.runHostPlan(plan);
 
     expect(createOptions[0].runtime).toBe('node24');
-    expect(fakeSandbox.writtenFiles).toHaveLength(3);
+    // manifest + live runner mjs (+ smoke/ts runners when not image mode)
+    expect(fakeSandbox.writtenFiles).toHaveLength(4);
     expect(fakeSandbox.commands.map((command) => command.cmd)).toEqual(['node', 'node']);
     expect(result.outcome).toBe('completed');
     expect(result.artifacts.evidence).toEqual({ resultState: 'blocked_readiness' });

packages/pipeline-hosts/src/asset-pack-host-plan.ts

@@ -207,14 +207,21 @@ export function buildAssetPackSandboxHostPlan(
       : { runtime: options.runtime ?? VERCEL_SANDBOX_HOST_CAPABILITIES.defaultRuntime }),
   };
 
-  // Image mode: only ship the run manifest (+ optional overlay). Runners live
-  // in the VCR image under /opt/bitcode.
+  // Always ship the live runner into the sandbox workspace so host plan fixes
+  // apply without waiting for a Pipeliner image rebuild. Image mode still uses
+  // /opt/bitcode packages; the runner is invoked with tsx from monorepo root.
+  const liveRunnerMjsPath = `${HOST_RUN_DIRECTORY}/run-live-asset-pack-pipeline.mjs`;
   const files: PipelineHostPlan['files'] = [
     {
       path: MANIFEST_PATH,
       content: Buffer.from(JSON.stringify(manifest, null, 2)),
       mode: 0o644,
     },
+    {
+      path: liveRunnerMjsPath,
+      content: Buffer.from(createLiveAssetPackPipelineRunner()),
+      mode: 0o755,
+    },
     ...(usePipelineImage
       ? []
       : [
@@ -284,13 +291,27 @@ function buildPipelineImageCommands(
     120000;
 
   if (mode === 'asset_pack_pipeline') {
+    // Prefer sandbox-uploaded runner (hot-fixed) over image-baked copy.
+    // tsx loads monorepo .ts package sources under BITCODE_MONOREPO_ROOT.
+    const sandboxLiveRunner = `${SANDBOX_WORKING_DIRECTORY}/${HOST_RUN_DIRECTORY}/run-live-asset-pack-pipeline.mjs`;
+    const monorepoRoot = PIPELINE_IMAGE_MONOREPO_ROOT_DEFAULT;
+    const pipelineRunScript = [
+      `cd ${shellQuote(monorepoRoot)}`,
+      // tsx loads monorepo .ts package sources (plain node cannot).
+      `if ! node --import tsx -e "process.exit(0)" >/dev/null 2>&1; then`,
+      `  npm install -g tsx@4.19.3 || npm install --no-save --prefix ${shellQuote(monorepoRoot)} tsx@4.19.3`,
+      `fi`,
+      `RUNNER=${shellQuote(sandboxLiveRunner)}`,
+      `if [ ! -f "$RUNNER" ]; then RUNNER=${shellQuote(`${monorepoRoot}/.bitcode/pipeline-host/run-live-asset-pack-pipeline.mjs`)}; fi`,
+      `if [ ! -f "$RUNNER" ]; then echo "live runner missing; falling back to image dispatcher" >&2; node ${shellQuote(pipelineImageEntry)}; else node --import tsx "$RUNNER"; fi`,
+    ].join(' && ');
     commands.push({
       label: 'asset-pack-pipeline-run',
       cmd: 'sh',
       args: [
         '-lc',
         [
-          `node ${shellQuote(pipelineImageEntry)} > ${shellQuote(PIPELINE_STDOUT_PATH)} 2> ${shellQuote(PIPELINE_STDERR_PATH)}`,
+          `( ${pipelineRunScript} ) > ${shellQuote(PIPELINE_STDOUT_PATH)} 2> ${shellQuote(PIPELINE_STDERR_PATH)}`,
           'code=$?',
           `printf "%s" "$code" > ${shellQuote(PIPELINE_EXIT_CODE_PATH)}`,
           'exit "$code"',

packages/pipeline-hosts/src/asset-pack-host-runners.ts

@@ -84,6 +84,14 @@ await writeFile(\`\${artifactDir}/evidence.json\`, JSON.stringify(evidence, null
 export function createLiveAssetPackPipelineRunner(): string {
   return `import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { createHash, randomUUID } from 'node:crypto';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const monorepoRoot = (process.env.BITCODE_MONOREPO_ROOT || '/opt/bitcode').trim();
+/** Absolute file URL into monorepo TypeScript sources (loaded via tsx/ts-node). */
+function pkgImport(relPath) {
+  return pathToFileURL(path.join(monorepoRoot, relPath)).href;
+}
 
 const manifestPath = process.env.BITCODE_PIPELINE_HOST_MANIFEST || '${MANIFEST_PATH}';
 const artifactDir = process.env.BITCODE_PIPELINE_HOST_ARTIFACT_DIR || '${HOST_RUN_DIRECTORY}';
@@ -1413,12 +1421,14 @@ try {
 	    { evaluateBtdOrganizationInterfaceAuthority },
       btdReceiptBuilders,
 	  ] = await Promise.all([
-	    import('../../packages/asset-packs-pipelines/domain/src/index'),
-	    import('../../packages/pipelines-generics/src/index'),
-	    import('../../packages/btd/src/settlement'),
-	    import('../../packages/btd/src/reconciliation'),
-	    import('../../packages/btd/src/authority'),
-      import('../../packages/btd/src/receipts'),
+	    // Resolve monorepo packages by absolute file URL + .ts (tsx/ts-node loaders).
+	    // Relative extensionless imports fail under plain node in the Pipeliner image.
+	    import(pkgImport('packages/asset-packs-pipelines/domain/src/index.ts')),
+	    import(pkgImport('packages/pipelines-generics/src/index.ts')),
+	    import(pkgImport('packages/btd/src/settlement.ts')),
+	    import(pkgImport('packages/btd/src/reconciliation.ts')),
+	    import(pkgImport('packages/btd/src/authority.ts')),
+	    import(pkgImport('packages/btd/src/receipts.ts')),
 	  ]);
   buildBtdAssetPackMintReceiptFn = btdReceiptBuilders.buildBtdAssetPackMintReceipt;
   buildBtdReadReceiptFn = btdReceiptBuilders.buildBtdReadReceipt;
@@ -1443,7 +1453,7 @@ try {
 
   const databaseStreamingRequested = process.env.BITCODE_PIPELINE_STREAM_TO_DATABASE === '1';
   if (databaseStreamingRequested) {
-    const { supabaseAdmin } = await import('../../packages/supabase/src/index');
+    const { supabaseAdmin } = await import(pkgImport('packages/supabase/src/index.ts'));
     supabase = supabaseAdmin;
     userId = await resolvePipelineUserId();
     execution.store('host', 'userId', userId);