1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
# Publish a module
Reference for [Publish a module](../start/publish.md): session records, what is uploaded, pins.
## Give it a session record
A module that acts for a signed-in user names a session: `records/<session>.json`, a
`com.fedfork.exec.oauth.clientMetadata` record. Its scope is all the module may do. Copy one:
`records/statusphere.json`
```json
"clientMetadata": {
"client_id": "https://statusphere.example.com/oauth-client-metadata.json",
"client_name": "Statusphere",
"client_uri": "https://statusphere.example.com",
"redirect_uris": [
"https://statusphere.example.com/oauth/callback"
],
"grant_types": [
"authorization_code",
"refresh_token"
],
"response_types": [
"code"
],
"scope": "atproto repo:xyz.statusphere.status",
```
`scopeGroups` let a page ask for parts of it at a time. `hello` makes only public reads, so it has none.
## What is published
The flow: [Publish a module](../start/publish.md). `atlibs publish` builds the repo's cargo workspace in
a `rust:<rustc version>` container ([CONTAINER_ENGINE](../reference/env.md)) on a copy of exactly the files
it publishes (`Cargo.toml`, `Cargo.lock`, `.cargo`, every member), uploads each source file once (by
sha256), a manifest (its `build.command` is what `atlibs verify` replays), the blob and the module record,
and keeps a copy under `records/wasm/`. The record is written twice: at `<name>` (the latest) and at
`<name>.<first 32 hex of its pin>` (this version, which later publishes leave in place):
```bash run
jq -c '{language, build: .build.command, origin: (.origin | keys)}' records/wasm/statusphere.manifest.json
jq -c '{session: .session | keys, source: .source | keys}' records/wasm/statusphere.json
```
```output
{"language":"rust","build":"…","origin":["commit","repository"]}
{"session":["cid","uri"],"source":["cid","uri"]}
```
Sharing a checkout with other work? Publish from `git worktree add ../pub HEAD`.
A module is republished when its wasm, its record fields or its session record changed; a record whose
live CID differs from the last publish is `drift`.
Published before atlibs 0.5.0? Copy each module and composition to its version record (getRecord only, no
build, the same pin):
```bash run=account
atlibs publish versions hello compose --dry-run --as you.bsky.social
atlibs publish versions hello compose --as you.bsky.social
```
## Pins
A lockfile pins each module: sha256 of the wasm's sha256 and the record's grant fields. `add` with
`@<pin>` (32+ hex digits) or `@<record CID>` refuses anything else. A pin loads its version
(`<name>.<32 hex>`), so it survives a republish:
```bash run=network
atlibs add bobvmbuilder.bsky.social/echo
PIN=$(jq -r .modules.echo.pin atlibs.lock.json)
atlibs add "bobvmbuilder.bsky.social/echo@$PIN" > /dev/null && echo pinned
atlibs add "bobvmbuilder.bsky.social/echo@$(printf '0%.0s' {1..32})" 2>&1 | grep -c pin
```
```output
pinned
1
```
## Verify a published module
`atlibs verify` fetches the module, its manifest and every source file, checks each hash, rebuilds in a
container and compares the result with the manifest and the blob.
```bash run=container
atlibs verify bobvmbuilder.bsky.social/echo
```
## Remove one
```bash run=account
atlibs publish delete com.fedfork.exec.wasm.module/hello --as you.bsky.social
```
Previous: [Test a module](test.md) | Next: [Compositions](../compositions.md)
