fix(scenarios): make Synapse source runs consumer-equivalent

Install only the production dependency closure and resolve peers under
Synapse's pnpm security policy. Add EIP-2612 support to MockUSDFC so
fresh devnet accounts can fund uploads through Synapse.

#182 didn't quite work in
resolving #179

Author: rvagg

ci/README.md

@@ -192,7 +192,7 @@ override is applied. The resolver does not infer overrides from package metadata
 
 Overrides are currently allowed only for npm-installed `synapse-sdk` and
 `filecoin-pin` selections. They are written to the temporary consumer
-`package.json`; source profiles use the checkout's committed lockfile.
+`package.json`.
 
 Current consumers write npm overrides to the temporary `package.json` used by
 their scenario.

contracts/MockUSDFC/src/MockUSDFC.sol

@@ -2,19 +2,20 @@
 pragma solidity ^0.8.20;
 
 import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import "@openzeppelin/contracts/token/ERC20/extensions/ERC20Permit.sol";
 
 /**
  * @title MockUSDFC
  * @dev Mock USDC token for testing FOC warm storage services
  */
-contract MockUSDFC is ERC20 {
+contract MockUSDFC is ERC20, ERC20Permit {
     uint8 private _decimals;
 
     /**
      * @dev Constructor that gives msg.sender all of initial supply.
      * @param initialSupply The initial supply of tokens (in wei, accounting for decimals)
      */
-    constructor(uint256 initialSupply) ERC20("Mock USDC", "USDFC") {
+    constructor(uint256 initialSupply) ERC20("Mock USDC", "USDFC") ERC20Permit("Mock USDC") {
         _decimals = 18;
         _mint(msg.sender, initialSupply);
     }
@@ -26,6 +27,10 @@ contract MockUSDFC is ERC20 {
         return _decimals;
     }
 
+    function version() external pure returns (string memory) {
+        return "1";
+    }
+
     /**
      * @dev Mint new tokens (for testing purposes)
      * @param to Address to receive the tokens

contracts/MockUSDFC/test/MockUSDFC.t.sol

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import "forge-std/Test.sol";
+import "../src/MockUSDFC.sol";
+
+contract MockUSDFCTest is Test {
+    bytes32 private constant PERMIT_TYPEHASH =
+        keccak256("Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)");
+
+    MockUSDFC private token;
+    uint256 private ownerKey;
+    address private owner;
+
+    function setUp() public {
+        token = new MockUSDFC(0);
+        ownerKey = 0xA11CE;
+        owner = vm.addr(ownerKey);
+        token.mint(owner, 100 ether);
+    }
+
+    function testPermit() public {
+        address spender = makeAddr("spender");
+        uint256 value = 25 ether;
+        uint256 deadline = block.timestamp + 1 hours;
+        bytes32 structHash = keccak256(abi.encode(PERMIT_TYPEHASH, owner, spender, value, 0, deadline));
+        bytes32 digest = keccak256(abi.encodePacked("\x19\x01", token.DOMAIN_SEPARATOR(), structHash));
+        (uint8 v, bytes32 r, bytes32 s) = vm.sign(ownerKey, digest);
+
+        token.permit(owner, spender, value, deadline, v, r, s);
+
+        assertEq(token.allowance(owner, spender), value);
+        assertEq(token.nonces(owner), 1);
+        assertEq(token.version(), "1");
+    }
+}

scenarios/synapse-e2e/source-runtime.mjs

@@ -1,11 +1,11 @@
 /**
  * Runs foc-devnet scenarios against Synapse TypeScript source on Node 24+.
  *
- * Source profiles install Synapse's production dependency closure, then preload
- * this module with `node --import`. Public `@filoz/synapse-sdk` and
- * `@filoz/synapse-core` imports resolve to their source counterparts instead of
- * the packages' compiled `dist` targets. All other imports use Node's normal
- * resolver.
+ * Source profiles install Synapse's production dependencies and peer runtime,
+ * then preload this module with `node --import`. Public
+ * `@filoz/synapse-sdk` and `@filoz/synapse-core` imports resolve to their source
+ * counterparts instead of the packages' compiled `dist` targets. Peer imports
+ * resolve from the temporary consumer; all other imports use Node's resolver.
  *
  * Mappings come from each package's export map, keeping the scenario on the
  * public API and avoiding a hard-coded list that drifts as exports change.
@@ -16,10 +16,14 @@ import assert from 'node:assert/strict'
 import { existsSync, readFileSync } from 'node:fs'
 import { registerHooks } from 'node:module'
 import { dirname, join, resolve } from 'node:path'
-import { pathToFileURL } from 'node:url'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const sourceRoot = process.env.SYNAPSE_SDK_SOURCE_DIR
 assert(sourceRoot, 'SYNAPSE_SDK_SOURCE_DIR must name the Synapse checkout when using source-runtime.mjs')
+const runtimePackageUrl = pathToFileURL(join(dirname(fileURLToPath(import.meta.url)), 'package.json')).href
+const runtimeDependencies = new Set(
+  Object.keys(JSON.parse(readFileSync(fileURLToPath(runtimePackageUrl), 'utf8')).dependencies ?? {})
+)
 
 // Export entries may be strings or nested condition objects. Prefer the
 // conditions used by this ESM runtime, then inspect package-specific branches.
@@ -62,10 +66,20 @@ const sourceMappings = new Map([
   ...sourceExports('@filoz/synapse-core', 'packages/synapse-core'),
 ])
 
-// Short-circuit exact public package matches; delegate everything else.
+function packageName(specifier) {
+  if (specifier.startsWith('@')) return specifier.split('/', 2).join('/')
+  return specifier.split('/', 1)[0]
+}
+
+// Short-circuit public Synapse exports and resolve peer dependencies from the
+// temporary consumer. Source package dependencies use Node's normal resolver.
 registerHooks({
   resolve(specifier, context, nextResolve) {
     const sourceUrl = sourceMappings.get(specifier)
-    return sourceUrl == null ? nextResolve(specifier, context) : { url: sourceUrl, shortCircuit: true }
+    if (sourceUrl != null) return { url: sourceUrl, shortCircuit: true }
+    if (runtimeDependencies.has(packageName(specifier))) {
+      return nextResolve(specifier, { ...context, parentURL: runtimePackageUrl })
+    }
+    return nextResolve(specifier, context)
   },
 })

scenarios/synapse_runtime.py

@@ -110,6 +110,32 @@ def _write_manifest(work_dir: Path, dependency: dict) -> None:
     (work_dir / "package.json").write_text(json.dumps(manifest, indent=2) + "\n")
 
 
+def _write_source_manifest(work_dir: Path, source_dir: Path) -> None:
+    dependencies: dict[str, str] = {}
+    for package in ("synapse-sdk", "synapse-core"):
+        package_json = json.loads(
+            (source_dir / "packages" / package / "package.json").read_text()
+        )
+        for name, version in package_json.get("peerDependencies", {}).items():
+            existing = dependencies.get(name)
+            if existing is not None and existing != version:
+                raise RuntimeError(
+                    f"Synapse source packages disagree on {name}: {existing} != {version}"
+                )
+            dependencies[name] = version
+    manifest = {
+        "name": "foc-devnet-synapse-source-e2e",
+        "private": True,
+        "type": "module",
+        "dependencies": dependencies,
+    }
+    (work_dir / "package.json").write_text(json.dumps(manifest, indent=2) + "\n")
+    policy = source_dir / "pnpm-workspace.yaml"
+    if not policy.is_file():
+        raise RuntimeError(f"Synapse source has no pnpm workspace policy: {policy}")
+    shutil.copyfile(policy, work_dir / policy.name)
+
+
 def _copy_scenarios(work_dir: Path) -> None:
     source = _scenario_dir()
     if not source.is_dir():
@@ -126,6 +152,11 @@ def _source_pnpm_version(source_dir: Path) -> str:
     return package_manager.removeprefix("pnpm@")
 
 
+def _has_source_package_closure(source_dir: Path) -> bool:
+    node_modules = source_dir / "packages" / "synapse-sdk" / "node_modules"
+    return (node_modules / "@filoz" / "synapse-core").is_dir()
+
+
 def _source_commit(source_dir: Path) -> str:
     result = subprocess.run(
         ["git", "-C", str(source_dir), "rev-parse", "HEAD"],
@@ -197,34 +228,41 @@ def prepare_synapse_runtime(work_dir: Path) -> SynapseRuntime:
 
         pnpm_version = _source_pnpm_version(source_dir)
         source_node_modules = source_dir / "packages" / "synapse-sdk" / "node_modules"
-        has_runtime_closure = (source_node_modules / "viem").is_dir() and (
-            source_node_modules / "@filoz" / "synapse-core"
-        ).is_dir()
-        if not local_source or not has_runtime_closure:
+        has_package_closure = _has_source_package_closure(source_dir)
+        if not local_source or not has_package_closure:
             if not run_cmd(
                 [
                     "pnpm",
                     "install",
-                    "--frozen-lockfile",
+                    "--no-frozen-lockfile",
                     "--prod",
                     "--ignore-scripts",
                     "--filter",
                     "@filoz/synapse-sdk...",
                 ],
                 cwd=str(source_dir),
-                label=f"install Synapse production runtime (pnpm@{pnpm_version})",
+                label=f"install Synapse production dependencies (pnpm@{pnpm_version})",
             ):
-                raise RuntimeError("failed to install Synapse production runtime")
-        if not source_node_modules.is_dir():
-            raise RuntimeError(
-                f"Synapse production install has no SDK node_modules: {source_node_modules}"
-            )
-        runtime_node_modules = work_dir / "node_modules"
-        if runtime_node_modules.exists() or runtime_node_modules.is_symlink():
+                raise RuntimeError("failed to install Synapse production dependencies")
+        if not _has_source_package_closure(source_dir):
             raise RuntimeError(
-                f"Synapse runtime node_modules already exists: {runtime_node_modules}"
+                f"Synapse source install has no package closure: {source_node_modules}"
             )
-        runtime_node_modules.symlink_to(source_node_modules, target_is_directory=True)
+        _write_source_manifest(work_dir, source_dir)
+        if not run_cmd(
+            [
+                "pnpm",
+                "install",
+                "--no-frozen-lockfile",
+                "--prod",
+                "--ignore-scripts",
+            ],
+            cwd=str(work_dir),
+            label="install Synapse peer runtime",
+        ):
+            raise RuntimeError("failed to install Synapse peer runtime")
+        if not (work_dir / "node_modules" / "viem").is_dir():
+            raise RuntimeError("Synapse peer runtime has no viem installation")
         provenance = f"{provenance} (pnpm@{pnpm_version})"
         runtime = SynapseRuntime(work_dir, "source", provenance, source_dir)
     else:

scripts/tests/test_scenario_dependencies.py

@@ -149,18 +149,32 @@ def test_npm_runtime_resolves_fallback_consumer_dependencies(
             "commit": "deadbeef",
         },
     )
-    def test_source_runtime_checks_out_and_installs_production_closure(
+    def test_source_runtime_installs_production_and_peer_closures(
         self, _component, run_cmd, _source_commit, _copy_scenarios
     ):
         with tempfile.TemporaryDirectory() as directory:
             source = Path(directory) / "synapse-sdk"
             source.mkdir()
-            (source / "packages" / "synapse-sdk" / "node_modules").mkdir(parents=True)
+            source_node_modules = source / "packages" / "synapse-sdk" / "node_modules"
+            (source_node_modules / "@filoz" / "synapse-core").mkdir(parents=True)
+            (Path(directory) / "node_modules" / "viem").mkdir(parents=True)
             (source / "package.json").write_text('{"packageManager":"pnpm@11.5.3"}')
+            (source / "pnpm-workspace.yaml").write_text(
+                "minimumReleaseAge: 10080\ntrustPolicy: no-downgrade\n"
+            )
+            for package in ("synapse-sdk", "synapse-core"):
+                package_dir = source / "packages" / package
+                package_dir.mkdir(parents=True, exist_ok=True)
+                (package_dir / "package.json").write_text(
+                    '{"peerDependencies":{"viem":"2.x"}}'
+                )
             runtime = prepare_synapse_runtime(Path(directory))
+            self.assertFalse((runtime.work_dir / "node_modules").is_symlink())
             self.assertEqual(
-                (runtime.work_dir / "node_modules").resolve(),
-                source / "packages" / "synapse-sdk" / "node_modules",
+                json.loads((runtime.work_dir / "package.json").read_text())[
+                    "dependencies"
+                ],
+                {"viem": "2.x"},
             )
 
         commands = [call.args[0] for call in run_cmd.call_args_list]
@@ -169,14 +183,24 @@ def test_source_runtime_checks_out_and_installs_production_closure(
             [
                 "pnpm",
                 "install",
-                "--frozen-lockfile",
+                "--no-frozen-lockfile",
                 "--prod",
                 "--ignore-scripts",
                 "--filter",
                 "@filoz/synapse-sdk...",
             ],
             commands,
         )
+        self.assertIn(
+            [
+                "pnpm",
+                "install",
+                "--no-frozen-lockfile",
+                "--prod",
+                "--ignore-scripts",
+            ],
+            commands,
+        )
 
     @patch("scenarios.synapse_runtime._copy_scenarios")
     @patch("scenarios.synapse_runtime._source_commit", return_value="localcommit")
@@ -199,9 +223,18 @@ def test_local_source_runtime_uses_declared_pnpm(
             source_node_modules = (
                 source_dir / "packages" / "synapse-sdk" / "node_modules"
             )
-            (source_node_modules / "viem").mkdir(parents=True)
             (source_node_modules / "@filoz" / "synapse-core").mkdir(parents=True)
+            (work_dir / "node_modules" / "viem").mkdir(parents=True)
             (source_dir / "package.json").write_text('{"packageManager":"pnpm@11.5.3"}')
+            (source_dir / "pnpm-workspace.yaml").write_text(
+                "minimumReleaseAge: 10080\ntrustPolicy: no-downgrade\n"
+            )
+            for package in ("synapse-sdk", "synapse-core"):
+                package_dir = source_dir / "packages" / package
+                package_dir.mkdir(parents=True, exist_ok=True)
+                (package_dir / "package.json").write_text(
+                    '{"peerDependencies":{"viem":"2.x"}}'
+                )
             with patch.dict("os.environ", {"SYNAPSE_SDK_SOURCE_DIR": str(source_dir)}):
                 runtime = prepare_synapse_runtime(work_dir)
 
@@ -210,7 +243,13 @@ def test_local_source_runtime_uses_declared_pnpm(
         )
         commands = [call.args[0] for call in run_cmd.call_args_list]
         self.assertFalse(any(command[:2] == ["git", "clone"] for command in commands))
-        self.assertFalse(any(command[0] == "pnpm" for command in commands))
+        source_commands = [
+            call.args[0]
+            for call in run_cmd.call_args_list
+            if call.kwargs.get("cwd") == str(source_dir)
+        ]
+        self.assertFalse(any(command[0] == "pnpm" for command in source_commands))
+        self.assertTrue(any(command[:2] == ["pnpm", "install"] for command in commands))
 
     @patch("scenarios.synapse_runtime.ok")
     @patch("scenarios.synapse_runtime.info")