From 5a4d5ba56322835d730587a9e35ba7db22668c05 Mon Sep 17 00:00:00 2001
From: cvince <vincent@vincentchan.vc>
Date: Sat, 13 Jun 2026 11:39:54 -0700
Subject: [PATCH 1/2] feat(capy): add capy 0.7.0

---
 packages/capy/build.ncl | 75 +++++++++++++++++++++++++++++++++++++++++
 packages/capy/build.sh  | 17 ++++++++++
 2 files changed, 92 insertions(+)
 create mode 100644 packages/capy/build.ncl
 create mode 100755 packages/capy/build.sh

diff --git a/packages/capy/build.ncl b/packages/capy/build.ncl
new file mode 100644
index 00000000..6da32f68
--- /dev/null
+++ b/packages/capy/build.ncl
@@ -0,0 +1,75 @@
+let { Attrs, BuildSpec, Local, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
+let base = import "../base/build.ncl" in
+let coreutils = import "../coreutils/build.ncl" in
+let glibc = import "../glibc/build.ncl" in
+let ca-certificates = import "../ca-certificates/build.ncl" in
+let git = import "../git/build.ncl" in
+let node-lts = import "../node-lts/build.ncl" in
+
+let version = "0.7.0" in
+{
+  name = "capy",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    # @capysc/cli source, hash-pinned and built from source (not the prebuilt
+    # npm artifact). Referenced by url+sha256 — the source is never vendored
+    # into this registry.
+    {
+      url = "https://github.com/capysc/capy-cli/archive/refs/tags/v%{version}.tar.gz",
+      sha256 = "d2efcb436c58061662e9546d61e6b8cc1e650ae235236a89c7fe6a00265392ca",
+      extract = true,
+      strip_prefix = "capy-cli-%{version}",
+    } | Source,
+    node-lts, # node + npm to build (tsc) and stage the CLI
+  ],
+  runtime_deps = [
+    base,
+    glibc,
+    coreutils, # `capy` shebang resolves node via /usr/bin/env
+    ca-certificates, # HTTPS to the Capy API (sync, decryption)
+    git, # capy shells out to git for repo/branch detection
+    node-lts, # capy is a Node CLI (#!/usr/bin/env node)
+  ],
+
+  cmd = "./build.sh",
+  build_args = {
+    include version,
+  },
+
+  # build.sh compiles the pinned source tarball above (tsc), then `npm install`
+  # pulls the CLI's runtime deps from the registry — dns+internet cover that
+  # dependency fetch. Follow-up: vendor the transitive npm deps as hash-pinned
+  # Sources for a fully hermetic / SLSA build.
+  needs = { dns = {}, internet = {} },
+
+  outputs = {
+    capy = { glob = "usr/bin/capy" } | OutputBin,
+    node_modules = { glob = "usr/lib/node_modules/**" } | OutputData,
+  },
+  attrs =
+    {
+      upstream_version = version,
+      source_provenance = {
+        category = 'GithubRepo,
+        owner = "capysc",
+        repo = "capy-cli",
+      },
+      # Maps the developer's ~/.capy into the box so in-box capy reuses the
+      # existing login instead of transporting keys. Mounted read-write so capy
+      # can refresh its session and update its local cache. For trusted
+      # developer shells.
+      env_dir_mappings = [{ read_only = false, path = "~/.capy", class = 'Credential }],
+    } | Attrs,
+
+  tests = {
+    runs =
+      {
+        class = 'Standalone,
+        test_deps = [base, node-lts],
+        cmds = [
+          # capy must run and report its version with no auth/network/config.
+          ["/bin/bash", "-c", "capy --version | grep -q '%{version}'"],
+        ],
+      } | Test,
+  },
+} | BuildSpec
diff --git a/packages/capy/build.sh b/packages/capy/build.sh
new file mode 100755
index 00000000..4264cf8a
--- /dev/null
+++ b/packages/capy/build.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+set -ex
+
+# The @capysc/cli source tarball is declared as a Source in build.ncl
+# (extract = true, strip_prefix), so its contents are already unpacked into the
+# working directory. Build it from source rather than installing the prebuilt
+# npm artifact.
+
+npm install                  # no committed lockfile upstream -> install, not ci
+npm run build                # tsc -> dist/
+npm pkg delete bin.capy-dev  # match the published artifact (upstream prepublishOnly)
+
+# Pack the built package, then install the tarball into the output prefix.
+# Packing first copies real files in; a bare `npm install -g .` would instead
+# symlink back to the source dir, which escapes $OUTPUT_DIR.
+npm pack
+npm install -g --prefix="$OUTPUT_DIR/usr" ./*.tgz

From 3a620518a715011c6314cb45b60179979fb8b001 Mon Sep 17 00:00:00 2001
From: cvince <vincent@vincentchan.vc>
Date: Tue, 23 Jun 2026 15:56:11 -0700
Subject: [PATCH 2/2] capy 0.8.0

---
 packages/capy/build.ncl | 2 +-
 packages/capy/build.sh  | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/capy/build.ncl b/packages/capy/build.ncl
index 6da32f68..e8f855eb 100644
--- a/packages/capy/build.ncl
+++ b/packages/capy/build.ncl
@@ -6,7 +6,7 @@ let ca-certificates = import "../ca-certificates/build.ncl" in
 let git = import "../git/build.ncl" in
 let node-lts = import "../node-lts/build.ncl" in
 
-let version = "0.7.0" in
+let version = "0.8.0" in
 {
   name = "capy",
   build_deps = [
diff --git a/packages/capy/build.sh b/packages/capy/build.sh
index 4264cf8a..b1961139 100755
--- a/packages/capy/build.sh
+++ b/packages/capy/build.sh
@@ -6,6 +6,9 @@ set -ex
 # working directory. Build it from source rather than installing the prebuilt
 # npm artifact.
 
+# This package builds with tsc only; drop the binary/bundle tooling so the
+# sandbox doesn't fetch @yao-pkg/pkg or esbuild (neither is used here).
+npm pkg delete devDependencies.@yao-pkg/pkg devDependencies.esbuild
 npm install                  # no committed lockfile upstream -> install, not ci
 npm run build                # tsc -> dist/
 npm pkg delete bin.capy-dev  # match the published artifact (upstream prepublishOnly)