Add sourceURL to endoZipBase64 bundle format to restore parity with nestedEvaluate

What is the Problem Being Solved?

Refs: #3843

No Agoric bundles currently have useful //#sourceURL comments for local development. By default, bundles are and must be suitable for submission to a chain and two users submitting the same source artifact from different home directories should arrive at the same bundle and the same hash.

Description of the Design

But, we could extend Endo to produce development versions of an archive that keep track of original sourceURLs and leave a mark in their compartment-map.json that provides some indicator that it is a debug build and an indicator of who the bundle should work for and no-one else.

Security Considerations

Our deployment scripts should guard against submitting such bundles to a live chain, and every bundle importer should refuse to run bundles built by other users.

Test Plan

This will require unit and integration tests in @endo/compartment-mapper, @agoric/bundle-source, @agoric/import-bundle, and @agoric/ deployment code.

[michaelfig]

@kriskowal, would it be possible to add some kind of postamble hook to the archive['import'] call so that the SDK has a place to stand to add sourceURL and/or sourceMaps during @agoric/import-bundle? I’d like to see that in the coming release, if possible.

[kriskowal]

From conversation out of band with @dckc @michaelfig @erights:

For parity, we only need <kbd>⌘/＾</kbd>+<kbd>click</kbd> on file names in stack traces in VS Code’s Terminal view to reveal the corresponding source in the open workspace. For this it is sufficient for the source URL to be .../ + the basename of the package name (last path component, e.g., compartment-mapper for @endo/compartment-mapper joined with on the package-relative module specifier.

We learned that the VS Debug view doesn’t make file names in stack traces reliably clickable, so that isn’t a success criterion.

Debugger statements work already and regardless of the sourceURL, so that isn’t a success criterion either.

Beyond parity, we arrived at mutual understanding of an idea that would preserve the consistent hash of bundles, avoid accidental exposure of local debug information to production systems, and produce a good experience for IDE breakpoints in the stepping debuggers. The sourceURL evaluated locally must be the exact file URL on the debugging machine for this to work. We propose that we could hook bundleSource and importBundle such that the bundleSource leaves a note in a per-user database (like one stored under ~/.agoric) that maps the hash of the bundle to a file that indicates the fully qualified path for each package in the archive’s compartment map. Then, importBundle would rehydrate the sourceURL’s according to the local information for that hash. https://github.com/endojs/endo/issues/929