Add macOS x86_64 platform support

Platform detection now happens in framework/platform, sourced by both
sync.sh and the node shim. Uses shasum on macOS, sha256sum on Linux.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.go-version

@@ -0,0 +1 @@
+1.23.6

CLAUDE.md

@@ -94,8 +94,8 @@ This ensures consistent tooling versions across the team without system-wide ins
 
 ## Platform Requirements
 
-Linux x86_64 only (currently). Requires:
+Linux or macOS on x86_64. Requires:
-- Modern libc for Go binaries
+- Modern libc for Go binaries (Linux)
 - docker compose (for full stack)
 - fd, shellcheck, shfmt (for development)
 

README.md

@@ -2,16 +2,13 @@ diachron
 
 ## Introduction
 
-Is your answer to some of these questions "yes"?  If so, you might like
-diachron.  (When it comes to that dev/test/prod one, hear us out first, ok?)
-
 - Do you want to share a lot of backend and frontend code?
 
 - Are you tired of your web stack breaking when you blink too hard?
 
 - Have you read [Taking PHP
-  Seriously](https://slack.engineering/taking-php-seriously/) and wish you had
+  Seriously](https://slack.engineering/taking-php-seriously/) and do you wish
-  something similar for Typescript?
+  you had something similar for Typescript?
 
 - Do you think that ORMs are not all that?  Do you wish you had first class
   unmediated access to your database?  And do you think that database
@@ -35,6 +32,9 @@ diachron.  (When it comes to that dev/test/prod one, hear us out first, ok?)
   you're trying to fix?  We're talking authentication, authorization, XSS,
   https, nested paths, all that stuff.
 
+Is your answer to some of these questions "yes"?  If so, you might like
+diachron.  (When it comes to that dev/test/prod one, hear us out first, ok?)
+
 ## Getting started
 
 Different situations require different getting started docs.
@@ -44,9 +44,8 @@ Different situations require different getting started docs.
 
 ## Requirements
 
-To run diachron, you currently need to have a Linux box running x86_64 with a
+To run diachron, you need Linux or macOS on x86_64.  Linux requires a new
-new enough libc to run golang binaries.  Support for other platforms will come
+enough libc to run golang binaries.
-eventually.
 
 To run a more complete system, you also need to have docker compose installed.
 

express/framework/migrations/2026-01-01_03-user-credentials.sql

@@ -0,0 +1,17 @@
+-- 0003_user_credentials.sql
+-- Create user_credentials table for password storage (extensible for other auth methods)
+
+CREATE TABLE user_credentials (
+    id UUID PRIMARY KEY,
+    user_id UUID NOT NULL REFERENCES users(id),
+    credential_type TEXT NOT NULL DEFAULT 'password',
+    password_hash TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- Each user can have at most one credential per type
+CREATE UNIQUE INDEX user_credentials_user_type_idx ON user_credentials (user_id, credential_type);
+
+-- Index for user lookups
+CREATE INDEX user_credentials_user_id_idx ON user_credentials (user_id);

framework/platform

@@ -0,0 +1,26 @@
+# shellcheck shell=bash
+
+# Detect platform (OS and architecture)
+
+os=$(uname -s | tr '[:upper:]' '[:lower:]')
+arch=$(uname -m)
+
+case "$os" in
+    linux) platform_os=linux ;;
+    darwin) platform_os=darwin ;;
+    *) echo "Unsupported OS: $os" >&2; exit 1 ;;
+esac
+
+case "$arch" in
+    x86_64) platform_arch=x86_64 ;;
+    *) echo "Unsupported architecture: $arch" >&2; exit 1 ;;
+esac
+
+platform="${platform_os}_${platform_arch}"
+
+# Platform-specific checksum command
+if [ "$platform_os" = "darwin" ]; then
+    sha256_check() { shasum -a 256 -c -; }
+else
+    sha256_check() { sha256sum -c -; }
+fi

framework/shims/node.common

@@ -7,6 +7,15 @@ project_root="$node_common_DIR/../.."
 # shellcheck source=../versions
 source "$node_common_DIR"/../versions
 
+# shellcheck source=../platform
+source "$node_common_DIR"/../platform
+
+# Get platform-specific node directory
+nodejs_dirname_var="nodejs_dirname_${platform}"
+nodejs_dirname="${!nodejs_dirname_var}"
+nodejs_dist_dir="framework/binaries/$nodejs_dirname"
+nodejs_bin_dir="$nodejs_dist_dir/bin"
+
 nodejs_binary_dir="$project_root/$nodejs_bin_dir"
 
 # This might be too restrictive.  Or not restrictive enough.

framework/versions

@@ -2,18 +2,25 @@
 
 # This file belongs to the framework.  You are not expected to modify it.
 
+nodejs_version=v24.12.0
+
 # https://nodejs.org/dist
 nodejs_binary_linux_x86_64=https://nodejs.org/dist/v24.12.0/node-v24.12.0-linux-x64.tar.xz
 nodejs_checksum_linux_x86_64=bdebee276e58d0ef5448f3d5ac12c67daa963dd5e0a9bb621a53d1cefbc852fd
-nodejs_dist_dir=framework/binaries/node-v22.15.1-linux-x64
+nodejs_dirname_linux_x86_64=node-v24.12.0-linux-x64
-nodejs_bin_dir="$nodejs_dist_dir/bin"
+
+nodejs_binary_darwin_x86_64=https://nodejs.org/dist/v24.12.0/node-v24.12.0-darwin-x64.tar.xz
+nodejs_checksum_darwin_x86_64=1e4d54f706e0a3613d6415ffe2ccdfd4095d3483971dbbaa4ff909fac5fc211c
+nodejs_dirname_darwin_x86_64=node-v24.12.0-darwin-x64
 
 caddy_binary_linux_x86_64=fixme
 caddy_checksum_linux_x86_64=fixmetoo
 
 # https://github.com/pnpm/pnpm/releases
 pnpm_binary_linux_x86_64=https://github.com/pnpm/pnpm/releases/download/v10.28.0/pnpm-linux-x64
-pnpm_checksum_linux_x86_64=sha256:348e863d17a62411a65f900e8d91395acabae9e9237653ccc3c36cb385965f28
+pnpm_checksum_linux_x86_64=348e863d17a62411a65f900e8d91395acabae9e9237653ccc3c36cb385965f28
 
+pnpm_binary_darwin_x86_64=https://github.com/pnpm/pnpm/releases/download/v10.28.0/pnpm-macos-x64
+pnpm_checksum_darwin_x86_64=99431e91d721169c2050d5e46abefc6f0d23c49e635a5964dcb573d9fe89975a
 
 golangci_lint=v2.7.2-alpine

sync.sh

@@ -9,6 +9,26 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=framework/versions
 source "$DIR/framework/versions"
 
+# shellcheck source=framework/platform
+source "$DIR/framework/platform"
+
+# Get platform-specific variables
+nodejs_binary_var="nodejs_binary_${platform}"
+nodejs_checksum_var="nodejs_checksum_${platform}"
+nodejs_dirname_var="nodejs_dirname_${platform}"
+nodejs_binary="${!nodejs_binary_var}"
+nodejs_checksum="${!nodejs_checksum_var}"
+nodejs_dirname="${!nodejs_dirname_var}"
+
+pnpm_binary_var="pnpm_binary_${platform}"
+pnpm_checksum_var="pnpm_checksum_${platform}"
+pnpm_binary_url="${!pnpm_binary_var}"
+pnpm_checksum="${!pnpm_checksum_var}"
+
+# Set up paths for shims to use
+nodejs_dist_dir="framework/binaries/$nodejs_dirname"
+nodejs_bin_dir="$nodejs_dist_dir/bin"
+
 # Ensure correct node version is installed
 node_installed_checksum_file="$DIR/framework/binaries/.node.checksum"
 node_installed_checksum=""
@@ -16,19 +36,19 @@ if [ -f "$node_installed_checksum_file" ]; then
     node_installed_checksum=$(cat "$node_installed_checksum_file")
 fi
 
-if [ "$node_installed_checksum" != "$nodejs_checksum_linux_x86_64" ]; then
+if [ "$node_installed_checksum" != "$nodejs_checksum" ]; then
-    echo "Downloading Node.js..."
+    echo "Downloading Node.js for $platform..."
     node_archive="$DIR/framework/downloads/node.tar.xz"
-    curl -fsSL "$nodejs_binary_linux_x86_64" -o "$node_archive"
+    curl -fsSL "$nodejs_binary" -o "$node_archive"
 
     echo "Verifying checksum..."
-    echo "$nodejs_checksum_linux_x86_64  $node_archive" | sha256sum -c -
+    echo "$nodejs_checksum  $node_archive" | sha256_check
 
     echo "Extracting Node.js..."
     tar -xf "$node_archive" -C "$DIR/framework/binaries"
     rm "$node_archive"
 
-    echo "$nodejs_checksum_linux_x86_64" >"$node_installed_checksum_file"
+    echo "$nodejs_checksum" >"$node_installed_checksum_file"
 fi
 
 # Ensure correct pnpm version is installed
@@ -39,15 +59,12 @@ if [ -f "$pnpm_installed_checksum_file" ]; then
     pnpm_installed_checksum=$(cat "$pnpm_installed_checksum_file")
 fi
 
-# pnpm checksum includes "sha256:" prefix, strip it for sha256sum
-pnpm_checksum="${pnpm_checksum_linux_x86_64#sha256:}"
-
 if [ "$pnpm_installed_checksum" != "$pnpm_checksum" ]; then
-    echo "Downloading pnpm..."
+    echo "Downloading pnpm for $platform..."
-    curl -fsSL "$pnpm_binary_linux_x86_64" -o "$pnpm_binary"
+    curl -fsSL "$pnpm_binary_url" -o "$pnpm_binary"
 
     echo "Verifying checksum..."
-    echo "$pnpm_checksum  $pnpm_binary" | sha256sum -c -
+    echo "$pnpm_checksum  $pnpm_binary" | sha256_check
 
     chmod +x "$pnpm_binary"