fix(infra): build native voice deps (opus, datachannel) in Nix closure

pnpm 11 rebuild hanya jalanin script package yang di-approve via pnpm-workspace.yaml (allowBuilds) DAN abort di kegagalan pertama. Yaml harus tracked (flake source cuma ikut file git). Tapi pnpm rebuild tetap gagal karena: (1) node-crc MSRV cargo:: error — dead dep, dihapus dari deps+patch; (2) sharp install script gagal di sandbox — binary-nya prebuilt @img, script cuma validasi — dikeluarkan dari approval list; (3) node-datachannel prebuild CLI TypeError + cmake-js butuh cwd benar. Fix: loop eksplisit di buildPhase gateway yang jalankan install script tiap native dep (opus/node-datachannel/zeromq) dengan cwd package dir, + cmake (dontUseCmakeConfigure biar stdenv nggak auto-configure), + opensslDevEnv = symlinkJoin pkgsStatic.openssl.out (libcrypto.a — CMakeLists set OPENSSL_USE_STATIC_LIBS=TRUE; pkgs.openssl default output = bin tanpa lib) + openssl.dev (headers), + git (libdatachannel FetchContent clone dari GitHub). Verifikasi: result store punya opus.node (compile source), node_datachannel.node (compile source), node-av prebuilt, zeromq prebuilt; runtime smoke test: PeerConnection instantiate+close OK, OpusEncoder encode OK, dank074 Streamer/prepareStream/playStream load OK.
2026-08-01 12:44:01 +07:00
parent 823b484497
commit 493bca590d
5 changed files with 45 additions and 55 deletions
@@ -11,6 +11,15 @@
      let
        pkgs = import nixpkgs { inherit system; };

+        # OpenSSL headers (.dev output) + STATIC libs (pkgsStatic.openssl.out —
+        # node-datachannel's CMakeLists sets OPENSSL_USE_STATIC_LIBS=TRUE, and
+        # the default `pkgs.openssl` resolves to `bin` which has no lib/) merged
+        # into one tree so FindOpenSSL resolves both via OPENSSL_ROOT_DIR.
+        opensslDevEnv = pkgs.symlinkJoin {
+          name = "openssl-dev-env";
+          paths = [ pkgs.pkgsStatic.openssl.out pkgs.openssl.dev ];
+        };
+
        # ---- Shared build tools ----
        nodejs = pkgs.nodejs_22;
        pnpm = pkgs.pnpm.override { nodejs = nodejs; };
@@ -105,10 +114,12 @@ WRAPPER

          nativeBuildInputs = [
            nodejs pnpm
-            pkgs.python3 pkgs.gnumake pkgs.gcc
+            pkgs.python3 pkgs.gnumake pkgs.gcc pkgs.cmake
            pkgs.rustc pkgs.cargo
            pkgs.pkg-config
            pkgs.openssl
+            pkgs.openssl.dev
+            pkgs.git # libdatachannel FetchContent clones from GitHub
            pkgs.cacert
          ];

@@ -117,7 +128,35 @@ WRAPPER
          # search media resolution). Must be on PATH inside the wrapper below.
          buildInputs = [ pkgs.ffmpeg-headless pkgs.yt-dlp ];

+          # cmake is only needed for node-datachannel's postinstall build —
+          # do NOT let stdenv run its own cmake configure phase on the source.
+          dontUseCmakeConfigure = true;
+
          buildPhase = pnpmInstall + ''
+            echo "=== Building native voice deps ==="
+            # pnpm rebuild aborts on the first failing package and runs scripts
+            # from the wrong cwd — build each native dep explicitly with its own
+            # install script. Each failure is tolerated (|| true); the packages
+            # that matter (opus, datachannel, node-av) are verified at runtime.
+            for pkg in \
+              node_modules/.pnpm/@discordjs+opus@*/node_modules/@discordjs/opus \
+              node_modules/.pnpm/@lng2004+node-datachannel@*/node_modules/@lng2004/node-datachannel \
+              node_modules/.pnpm/zeromq@*/node_modules/zeromq
+            do
+              if [ -d "$pkg" ]; then
+                echo "--- native build: $pkg ---"
+                (cd "$pkg" && npm run install 2>&1 || true)
+                # node-datachannel's `prebuild -r napi` CLI is broken (TypeError:
+                # expected first argument to be an array) — the install fallback
+                # populates devDeps incl. cmake-js; build directly via cmake-js.
+                if [ "$(basename "$pkg")" = "node-datachannel" ]; then
+                  echo "--- datachannel cmake-js compile ---"
+                  # Nix splits OpenSSL headers/libs across outputs — merge them
+                  # (opensslDevEnv) so FindOpenSSL finds both include + libcrypto.
+                  (cd "$pkg" && OPENSSL_ROOT_DIR="${opensslDevEnv}" npm run compile 2>&1 || true)
+                fi
+              fi
+            done
            echo "=== Compiling TypeScript ==="
            npx tsc 2>&1
            echo "=== Fixing @/ path aliases to relative paths ==="
@@ -10,13 +10,9 @@
      "@lng2004/node-datachannel",
      "esbuild",
      "node-av",
-      "node-crc",
      "sharp",
      "zeromq"
-    ],
-    "patchedDependencies": {
-      "node-crc@4.0.0": "./patches/node-crc@4.0.0.patch"
-    }
+    ]
  },
  "scripts": {
    "dev": "tsx watch src/index.ts",
@@ -40,7 +36,6 @@
    "ioredis": "^5.11.0",
    "libsodium-wrappers": "^0.8.4",
    "lru-cache": "^11.5.1",
-    "node-crc": "^4.0.0",
    "openai": "^6.38.0",
    "opusscript": "^0.0.8",
    "p-limit": "^7.3.0",
@@ -1,13 +0,0 @@
-diff --git a/Cargo.toml b/Cargo.toml
-index a967508960d8b6b686b23401ea14333b858a675c..d0282a30ee931563a65d774ed783c83d6d2fdd5e 100644
--- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -3,7 +3,7 @@ name = "node-crc"
- version = "4.0.0"
- authors = ["Magic Len <len@magiclen.org>"]
- edition = "2021"
-rust-version = "1.65"
-+rust-version = "1.77.0"
- repository = "https://github.com/magiclen/node-crc"
- homepage = "https://magiclen.org/node-js-crc/"
- keywords = ["nodejs", "crc8", "crc16", "crc32", "crc64"]
@@ -44,9 +44,6 @@ importers:
      lru-cache:
        specifier: ^11.5.1
        version: 11.5.2
-      node-crc:
-        specifier: ^4.0.0
-        version: 4.0.0
      openai:
        specifier: ^6.38.0
        version: 6.49.0(ws@8.21.1)(zod@4.4.3)
@@ -875,11 +872,6 @@ packages:
  '@minhducsun2002/leb128@1.0.0':
    resolution: {integrity: sha512-eFrYUPDVHeuwWHluTG1kwNQUEUcFjVKYwPkU8z9DR1JH3AW7JtJsG9cRVGmwz809kKtGfwGJj58juCZxEvnI/g==}

-  '@napi-rs/cli@2.18.4':
-    resolution: {integrity: sha512-SgJeA4df9DE2iAEpr3M2H0OKl/yjtg1BnRI5/JyowS71tUWhrfSu2LT0V3vlHET+g1hBVlrO60PmEXwUEKp8Mg==}
-    engines: {node: '>= 10'}
-    hasBin: true
-
  '@napi-rs/nice-android-arm-eabi@1.1.1':
    resolution: {integrity: sha512-kjirL3N6TnRPv5iuHw36wnucNqXAO46dzK9oPb0wj076R5Xm8PfUVA9nAFB5ZNMmfJQJVKACAPd/Z2KYMppthw==}
    engines: {node: '>= 10'}
@@ -1342,9 +1334,6 @@ packages:
  '@types/estree@1.0.9':
    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}

-  '@types/node@22.20.1':
-    resolution: {integrity: sha512-EANqOCF9QFyra+4pfxUcX9STKJpCLjMbObVzljIJomAWSnuSIEAvyzEU53GaajbXJEgdh0iEcPL+DGvpUd4k1Q==}
-
  '@types/node@25.9.5':
    resolution: {integrity: sha512-OScDchr2fwuUmWdf4kZ9h7PcJiYDVInhJizG/biAq3cAvqwYktuy/TYGGdZNMtNTFUP7rnb0NU4TUdm82kt4Rg==}

@@ -2147,10 +2136,6 @@ packages:
  node-av@5.2.4:
    resolution: {integrity: sha512-L5r+6k+YGvH5MZX8o55JHQbbeRZ+iFieAb1bhKtpa8hrqBEGuSwdkXRwpE4vd414JqVJsq/EQq6s+3qKeviQTg==}

-  node-crc@4.0.0:
-    resolution: {integrity: sha512-531jch48okOhmA9a6flMwEuXxmu+gVkRjS2FEvudiB/b40GODQQsG1qUY5aUZTO+dCC0qR3GSPZ7GI3/mXxnrQ==}
-    engines: {node: '>=20'}
-
  node-fetch@2.7.0:
    resolution: {integrity: sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==}
    engines: {node: 4.x || >=6.0.0}
@@ -2625,9 +2610,6 @@ packages:
    engines: {node: '>=14.17'}
    hasBin: true

-  undici-types@6.21.0:
-    resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
-
  undici-types@7.24.6:
    resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}

@@ -3352,8 +3334,6 @@ snapshots:

  '@minhducsun2002/leb128@1.0.0': {}

-  '@napi-rs/cli@2.18.4': {}
-
  '@napi-rs/nice-android-arm-eabi@1.1.1':
    optional: true

@@ -3745,10 +3725,6 @@ snapshots:

  '@types/estree@1.0.9': {}

-  '@types/node@22.20.1':
-    dependencies:
-      undici-types: 6.21.0
-
  '@types/node@25.9.5':
    dependencies:
      undici-types: 7.24.6
@@ -4517,11 +4493,6 @@ snapshots:
    transitivePeerDependencies:
      - supports-color

-  node-crc@4.0.0:
-    dependencies:
-      '@napi-rs/cli': 2.18.4
-      '@types/node': 22.20.1
-
  node-fetch@2.7.0:
    dependencies:
      whatwg-url: 5.0.0
@@ -4983,8 +4954,6 @@ snapshots:

  typescript@5.9.3: {}

-  undici-types@6.21.0: {}
-
  undici-types@7.24.6: {}

  undici@7.29.0: {}
@@ -3,16 +3,16 @@ allowBuilds:
  "@lng2004/node-datachannel": true
  esbuild: true
  node-av: true
-  node-crc: true
-  sharp: true
  zeromq: true
 # pnpm 11 requires build-script approvals here (the legacy `pnpm` field in
 # package.json is ignored). Native voice deps need their postinstall build.
+# NOTE: sharp sengaja TIDAK ada — binary-nya dari @img/sharp-linux-x64
+# (prebuilt), install script-nya cuma validasi dan gagal di Nix sandbox.
+# Kalau script sharp dijalankan pnpm rebuild abort sebelum opus/datachannel
+# kebangun. node-crc dihapus dari deps (tidak pernah di-import).
 onlyBuiltDependencies:
  - "@discordjs/opus"
  - "@lng2004/node-datachannel"
  - esbuild
  - node-av
-  - node-crc
-  - sharp
  - zeromq