@gjsify/cli 0.44.0 → 0.46.0

package/lib/utils/ship/xml.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Escape a value for XML element content or an attribute value.
+ *
+ * `&` FIRST, or the ampersands the four later replacements introduce are escaped
+ * again and `Ship & Co` comes out as `Ship & Co`.
+ */
+export declare function xmlEscape(value: string): string;

package/lib/utils/ship/xml.js

@@ -0,0 +1,25 @@
+// The XML escape `gjsify ship`'s document renderers share.
+//
+// TWO COPIES BECAME ONE. `mime.ts` and `msi.ts` each grew their own — five
+// replacements, same entities, same order, byte-identical bodies — one milestone
+// apart, by people who never saw the other file. The second copy is where the
+// helper goes.
+//
+// `plist.ts` keeps its own and that divergence CARRIES something: a plist value
+// lands only in element CONTENT, so `"` and `'` are left as themselves rather
+// than becoming entities a human reading `Info.plist` has to decode. This one is
+// used in ATTRIBUTES too — a `.wxs` is almost nothing else — so it escapes both.
+/**
+ * Escape a value for XML element content or an attribute value.
+ *
+ * `&` FIRST, or the ampersands the four later replacements introduce are escaped
+ * again and `Ship & Co` comes out as `Ship & Co`.
+ */
+export function xmlEscape(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;');
+}

package/lib/utils/ship/zip.d.ts

@@ -0,0 +1,69 @@
+import type { PayloadEntry } from './payload.js';
+/** CRC-32 of a byte range, in ZIP's spelling (pre- and post-inverted). */
+export declare function crc32(data: Uint8Array): number;
+/**
+ * A Unix epoch second as the MS-DOS date and time pair ZIP stores.
+ *
+ * The format is from 1980 and cannot say anything earlier, and its seconds field
+ * holds HALF-seconds, so an odd second is not representable. Neither is refused:
+ * the stamp is metadata no reader in this repository asserts on, and failing a
+ * build because `SOURCE_DATE_EPOCH` named 1979 would reject an artifact over a
+ * display field. Earlier than 1980 is CLAMPED to it; the odd second is floored.
+ *
+ * UTC deliberately, not local time. A DOS stamp carries no zone, so reading it
+ * back as local time is the only convention available — and using the packing
+ * host's zone would mean two runners in different regions produce different bytes
+ * from one stage, which is exactly the property this module exists to hold.
+ */
+export declare function dosDateTime(epochSeconds: number): {
+    date: number;
+    time: number;
+};
+/** One entry to store, addressed by its path INSIDE the archive. */
+export interface ZipEntry {
+    /** Archive-relative, POSIX-separated. ZIP stores `/` on every platform. */
+    path: string;
+    /** POSIX mode bits, written into the external attributes' high 16 bits. */
+    mode: number;
+    data: Uint8Array;
+}
+/**
+ * Build a ZIP archive: local headers, then the central directory, then the EOCD.
+ *
+ * `mtime` is one stamp for every entry, taken from the caller. Per-file mtimes
+ * are deliberately not read off disk: an artifact upload does not carry them
+ * (`stage-manifest.ts`'s header), so re-stat'ing the stage on the packing host
+ * would stamp the archive with "whenever the download finished" and two hosts
+ * packing one stage would disagree.
+ *
+ * ENTRIES ARE SORTED BY PATH, and the caller's order is not trusted for the same
+ * reason `plan.ts` sorts: two runs over one payload must produce one byte
+ * sequence, and a `readdir` order is a filesystem's opinion.
+ *
+ * NO DIRECTORY ENTRIES. A ZIP may carry them and `unzip` recreates the tree from
+ * the file paths alone, so emitting them would add entries no reader here
+ * inspects and one more thing to keep deterministic. The consequence is stated
+ * rather than left to be discovered: an EMPTY directory inside a `.app` would not
+ * survive the archive — nothing in the payload can produce one, because
+ * `writeStage` only ever writes files.
+ *
+ * ZIP64 is NOT implemented, and the refusal below is what keeps that honest:
+ * past 4 GiB or 65535 entries the 32-bit fields silently wrap and the archive
+ * that comes out is well-formed and wrong. A loud limit is the better failure —
+ * the same argument `assertPayloadMatchesArch` makes one field over, where a
+ * label nothing compared to the payload produced an artifact `rpm` confirmed.
+ */
+export declare function buildZip(entries: readonly ZipEntry[], mtime: number): Uint8Array;
+/**
+ * The payload as zip entries, keeping each file's planned mode.
+ *
+ * `topLevel` names a directory every entry goes UNDER, and `''` means the payload
+ * paths already carry one. The two callers differ because their layouts do:
+ * a `<App>.app`'s staged paths already begin with the bundle directory
+ * (`Layout.root`), while a Windows program directory's do not — the stage IS its
+ * contents, because an installer chooses the parent. An archive without a top
+ * level expands into whatever directory the user happened to be in, scattering
+ * `app\`, `share\` and the launcher across it, and no listing of NAMES reads as
+ * wrong: every entry is individually correct.
+ */
+export declare function zipEntriesFromPayload(payload: readonly PayloadEntry[], topLevel?: string): ZipEntry[];

package/lib/utils/ship/zip.js

@@ -0,0 +1,245 @@
+// A deterministic ZIP writer, in-tree, execing nothing.
+//
+// SAME ARGUMENT AS THE HAND-WRITTEN `.deb` AND `.rpm` (ADR 0024 § A3): a format
+// this tree writes itself needs no tool on the packing host, which is what keeps
+// `zipinfo` an INDEPENDENT reader rather than the other half of a round trip.
+// `zip(1)` would have been fewer lines and would have made the oracle
+// `unzip`-reads-what-`zip`-wrote — two programs from one source distribution,
+// which is the shape `oracle.selfReading` exists to confess.
+//
+// WHY THE MODE MATTERS ENOUGH TO WRITE A ZIP WRITER. The failure mode of a
+// distributed `.app` is a launcher that arrives 0644 and will not run, and the
+// zip's external-attributes field is the only place in the archive that can
+// carry 0755. `actions/upload-artifact` has already proven the class inside this
+// repository (`main.yml`'s ship-pack job: "the artifact round-trip does not
+// preserve the mode"). So the writer sets the mode, and
+// `.github/ship-oracle/verify-app-zip.sh` reads it back with `zipinfo -l` — not
+// `unzip -Z1`, which prints names only and is blind to exactly this.
+//
+// STORE ONLY, no DEFLATE. A `.app` is mostly a JavaScript bundle and would
+// compress well, but compression buys size and this milestone buys correctness:
+// STORE is ~40 lines with one CRC table, DEFLATE means either a second
+// implementation or peeling the 10-byte header and 8-byte trailer off
+// `@gjsify/tar`'s gzip, and neither changes what any reader here checks. The
+// method field is a per-entry constant so the day that trade flips, it is one
+// branch and not a rewrite.
+//
+// DETERMINISM: every timestamp comes from the caller (the stage manifest's
+// `mtime`), never `Date.now()`. Same rule as `buildTimestamp` and
+// `gzipDeterministic`, and it is what lets `main.yml` compare two packs of one
+// stage byte for byte.
+/** ZIP's own constants, spelled once. */
+const LOCAL_HEADER_SIGNATURE = 0x04034b50;
+const CENTRAL_HEADER_SIGNATURE = 0x02014b50;
+const EOCD_SIGNATURE = 0x06054b50;
+/** Stored, not deflated — see the module header. */
+const METHOD_STORE = 0;
+/**
+ * `version made by`: high byte 3 = Unix, low byte 20 = ZIP spec 2.0.
+ *
+ * LOAD-BEARING, and the reason the mode survives. `zipinfo` and `unzip` read the
+ * external attributes as POSIX bits ONLY when the high byte says the archive was
+ * made on Unix; with the DOS value (0) the same 0755 in the same field is read as
+ * DOS attribute flags and every file extracts at the umask default. The mode
+ * would be in the archive and no reader would ever see it.
+ */
+const VERSION_MADE_BY = 0x0314;
+/** `version needed to extract`: 2.0, the floor for everything this writer emits. */
+const VERSION_NEEDED = 20;
+/** The CRC-32 table, built once on first use rather than as a 256-entry literal. */
+let crcTable = null;
+function getCrcTable() {
+    if (crcTable !== null)
+        return crcTable;
+    const table = new Uint32Array(256);
+    for (let i = 0; i < 256; i++) {
+        let c = i;
+        // The reversed polynomial 0xEDB88320 — ZIP, gzip and PNG all use this one.
+        for (let bit = 0; bit < 8; bit++)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        table[i] = c >>> 0;
+    }
+    crcTable = table;
+    return table;
+}
+/** CRC-32 of a byte range, in ZIP's spelling (pre- and post-inverted). */
+export function crc32(data) {
+    const table = getCrcTable();
+    let crc = 0xffffffff;
+    for (let i = 0; i < data.length; i++)
+        crc = table[(crc ^ data[i]) & 0xff] ^ (crc >>> 8);
+    return (crc ^ 0xffffffff) >>> 0;
+}
+/**
+ * A Unix epoch second as the MS-DOS date and time pair ZIP stores.
+ *
+ * The format is from 1980 and cannot say anything earlier, and its seconds field
+ * holds HALF-seconds, so an odd second is not representable. Neither is refused:
+ * the stamp is metadata no reader in this repository asserts on, and failing a
+ * build because `SOURCE_DATE_EPOCH` named 1979 would reject an artifact over a
+ * display field. Earlier than 1980 is CLAMPED to it; the odd second is floored.
+ *
+ * UTC deliberately, not local time. A DOS stamp carries no zone, so reading it
+ * back as local time is the only convention available — and using the packing
+ * host's zone would mean two runners in different regions produce different bytes
+ * from one stage, which is exactly the property this module exists to hold.
+ */
+export function dosDateTime(epochSeconds) {
+    const stamp = new Date(Math.max(epochSeconds, 315532800) * 1000);
+    const date = (((stamp.getUTCFullYear() - 1980) & 0x7f) << 9) | ((stamp.getUTCMonth() + 1) << 5) | stamp.getUTCDate();
+    const time = (stamp.getUTCHours() << 11) | (stamp.getUTCMinutes() << 5) | Math.floor(stamp.getUTCSeconds() / 2);
+    return { date, time };
+}
+/** A little-endian byte sink, so the header layouts below read as tables. */
+class Writer {
+    parts = [];
+    length = 0;
+    get offset() {
+        return this.length;
+    }
+    u16(value) {
+        this.push(new Uint8Array([value & 0xff, (value >>> 8) & 0xff]));
+    }
+    u32(value) {
+        this.push(new Uint8Array([value & 0xff, (value >>> 8) & 0xff, (value >>> 16) & 0xff, (value >>> 24) & 0xff]));
+    }
+    bytes(value) {
+        this.push(value);
+    }
+    push(part) {
+        this.parts.push(part);
+        this.length += part.byteLength;
+    }
+    finish() {
+        const out = new Uint8Array(this.length);
+        let at = 0;
+        for (const part of this.parts) {
+            out.set(part, at);
+            at += part.byteLength;
+        }
+        return out;
+    }
+}
+/**
+ * Build a ZIP archive: local headers, then the central directory, then the EOCD.
+ *
+ * `mtime` is one stamp for every entry, taken from the caller. Per-file mtimes
+ * are deliberately not read off disk: an artifact upload does not carry them
+ * (`stage-manifest.ts`'s header), so re-stat'ing the stage on the packing host
+ * would stamp the archive with "whenever the download finished" and two hosts
+ * packing one stage would disagree.
+ *
+ * ENTRIES ARE SORTED BY PATH, and the caller's order is not trusted for the same
+ * reason `plan.ts` sorts: two runs over one payload must produce one byte
+ * sequence, and a `readdir` order is a filesystem's opinion.
+ *
+ * NO DIRECTORY ENTRIES. A ZIP may carry them and `unzip` recreates the tree from
+ * the file paths alone, so emitting them would add entries no reader here
+ * inspects and one more thing to keep deterministic. The consequence is stated
+ * rather than left to be discovered: an EMPTY directory inside a `.app` would not
+ * survive the archive — nothing in the payload can produce one, because
+ * `writeStage` only ever writes files.
+ *
+ * ZIP64 is NOT implemented, and the refusal below is what keeps that honest:
+ * past 4 GiB or 65535 entries the 32-bit fields silently wrap and the archive
+ * that comes out is well-formed and wrong. A loud limit is the better failure —
+ * the same argument `assertPayloadMatchesArch` makes one field over, where a
+ * label nothing compared to the payload produced an artifact `rpm` confirmed.
+ */
+export function buildZip(entries, mtime) {
+    const sorted = [...entries].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    const { date, time } = dosDateTime(mtime);
+    const encoder = new TextEncoder();
+    if (sorted.length > 0xffff) {
+        throw new Error(`gjsify ship: this archive would hold ${sorted.length} entries and a non-ZIP64 central directory ` +
+            'records the count in 16 bits, so it would silently wrap. Nothing here writes ZIP64 yet; the ' +
+            'payload has to shrink, or this writer has to grow the ZIP64 records.');
+    }
+    const local = new Writer();
+    const central = new Writer();
+    let count = 0;
+    for (const entry of sorted) {
+        const name = encoder.encode(entry.path);
+        const crc = crc32(entry.data);
+        const size = entry.data.byteLength;
+        const offset = local.offset;
+        if (offset > 0xffffffff || size > 0xffffffff) {
+            throw new Error(`gjsify ship: ${entry.path} would push this archive past 4 GiB, which a non-ZIP64 header ` +
+                'records in 32 bits and therefore truncates. Nothing here writes ZIP64 yet.');
+        }
+        // Local file header (PKWARE APPNOTE § 4.3.7).
+        local.u32(LOCAL_HEADER_SIGNATURE);
+        local.u16(VERSION_NEEDED);
+        // General purpose flags: bit 11 marks the name as UTF-8. Set
+        // unconditionally, because the alternative — CP437 — cannot spell the
+        // `<App>.app` directory of an app whose display name is not ASCII, and
+        // every reader in this decade honours the bit.
+        local.u16(0x0800);
+        local.u16(METHOD_STORE);
+        local.u16(time);
+        local.u16(date);
+        local.u32(crc);
+        local.u32(size);
+        local.u32(size);
+        local.u16(name.byteLength);
+        local.u16(0);
+        local.bytes(name);
+        local.bytes(entry.data);
+        // Central directory header (§ 4.3.12), same fields plus the mode.
+        central.u32(CENTRAL_HEADER_SIGNATURE);
+        central.u16(VERSION_MADE_BY);
+        central.u16(VERSION_NEEDED);
+        central.u16(0x0800);
+        central.u16(METHOD_STORE);
+        central.u16(time);
+        central.u16(date);
+        central.u32(crc);
+        central.u32(size);
+        central.u32(size);
+        central.u16(name.byteLength);
+        central.u16(0);
+        central.u16(0);
+        central.u16(0);
+        central.u16(0);
+        // External attributes: POSIX mode in the HIGH 16 bits, DOS attributes in
+        // the low ones. `0o100000` is `S_IFREG` — without the file-type bits
+        // `zipinfo` prints `?rwxr-xr-x` and some extractors treat the entry as
+        // having no type at all.
+        central.u32(((0o100000 | (entry.mode & 0o7777)) >>> 0) * 0x10000);
+        central.u32(offset);
+        central.bytes(name);
+        count += 1;
+    }
+    const centralBytes = central.finish();
+    const out = new Writer();
+    out.bytes(local.finish());
+    const centralOffset = out.offset;
+    out.bytes(centralBytes);
+    // End of central directory (§ 4.3.16). No comment — a comment would be one
+    // more field to keep identical across runs for no reader's benefit.
+    out.u32(EOCD_SIGNATURE);
+    out.u16(0);
+    out.u16(0);
+    out.u16(count);
+    out.u16(count);
+    out.u32(centralBytes.byteLength);
+    out.u32(centralOffset);
+    out.u16(0);
+    return out.finish();
+}
+/**
+ * The payload as zip entries, keeping each file's planned mode.
+ *
+ * `topLevel` names a directory every entry goes UNDER, and `''` means the payload
+ * paths already carry one. The two callers differ because their layouts do:
+ * a `<App>.app`'s staged paths already begin with the bundle directory
+ * (`Layout.root`), while a Windows program directory's do not — the stage IS its
+ * contents, because an installer chooses the parent. An archive without a top
+ * level expands into whatever directory the user happened to be in, scattering
+ * `app\`, `share\` and the launcher across it, and no listing of NAMES reads as
+ * wrong: every entry is individually correct.
+ */
+export function zipEntriesFromPayload(payload, topLevel = '') {
+    const prefix = topLevel === '' ? '' : `${topLevel}/`;
+    return payload.map((entry) => ({ path: `${prefix}${entry.path}`, mode: entry.mode, data: entry.data }));
+}

package/lib/utils/system-gi.d.ts

@@ -28,11 +28,25 @@ export declare const PROBED_GI_LIBDIRS: Record<string, readonly string[]>;
 /**
  * The subdir GI installs typelibs into — historically `1.0` even for the girepository-2.0 API.
  *
- * Exported so `gi-typelib.ts` shares it rather than keeping a third copy of the
- * one string this whole layout rule turns on. Both mirrors export it, so the
- * agreement suite still compares two files that differ only in language.
+ * Exported so `gi-typelib.ts` shares it rather than keeping a fourth copy of the
+ * one string this whole layout rule turns on, and compared across all three copies
+ * by the agreement suite rather than trusting three literals to stay equal.
  */
 export declare const TYPELIB_SUBDIR = "girepository-1.0";
+/**
+ * The library directories a typelib directory implies, most specific first.
+ *
+ * TWO LAYOUTS, and a path alone cannot always say which: GI's INSTALL layout keeps
+ * the libraries in the PARENT (`<libdir>/girepository-1.0/…`), while a STAGED pair —
+ * an ADR 0017 prebuild directory, `gjsify.ship.bundledTypelibs` — keeps them in the
+ * DIRECTORY ITSELF. {@link TYPELIB_SUBDIR} as the basename is a positive signal for
+ * the first; absent it, both readings are offered and the caller's `existsDir` keeps
+ * whichever is real.
+ *
+ * The measurement, and why the ORDER of the two is the load-bearing half, are in the
+ * ORIGINAL, `packages/node-gi/node-gi/system-gi.js`.
+ */
+export declare function giLibraryDirsForTypelibDir(typelibDir: string): string[];
 /** Split an OS search-path variable, dropping empty segments. */
 export declare function splitSearchPath(value: string | undefined, separator?: string): string[];
 /**
@@ -52,8 +66,9 @@ export declare function pkgConfigSearchDirs(env: Record<string, string | undefin
  *
  * Three sources, in precedence order:
  *   1. `GI_TYPELIB_PATH` — the host stating outright where typelibs live; the
- *      libraries are the sibling `dirname()`. Accepted on directory existence
- *      alone: an explicit statement is not second-guessed.
+ *      libraries are wherever {@link giLibraryDirsForTypelibDir} says the layout
+ *      puts them. Accepted on directory existence alone: an explicit statement is
+ *      not second-guessed.
  *   2. `pkg-config`'s `.pc` search path → each `<dir>/pkgconfig`'s parent. The
  *      general mechanism (any prefix, including a custom one).
  *   3. {@link PROBED_GI_LIBDIRS} — the standard macOS prefixes, for the common

package/lib/utils/system-gi.js

@@ -3,10 +3,12 @@
 // dynamic loader can find the ones a typelib names by BARE LEAF
 // (`libgtk-4.1.dylib`, `libgdk_pixbuf-2.0.0.dylib`, …).
 //
-// A PINNED MIRROR of `packages/node-gi/node-gi/system-gi.js` — the two must agree
-// and `system-gi.spec.ts` asserts it over a table of injected host shapes. Why a
-// mirror and not an import, and what is owed to retire it:
-// `status/open-todos.md` § "systemGiLibraryDirs() lives in two places".
+// A PINNED MIRROR of `packages/node-gi/node-gi/system-gi.js`, and of
+// `@gjsify/utils/core`'s `system-gi-dirs.ts` — all three must agree and
+// `system-gi.spec.ts` asserts it over a table of injected host shapes. Why a mirror
+// and not an import, and what is owed to retire THIS copy (a delegation to
+// `@gjsify/utils`, which the CLI already depends on):
+// `status/open-todos.md` § "systemGiLibraryDirs() lives in three places".
 //
 // WHY THIS EXISTS. A failed `dlopen('libgtk-4.1.dylib')` surfaces one layer up as
 // something that reads like a type-system bug — `TypeError: Gtk.DrawingArea is not
@@ -32,6 +34,8 @@
 // `<libdir>/libgtk-4.1.dylib`. A directory holding `girepository-1.0/` therefore IS
 // a GI library directory, which is what makes this package-manager-agnostic — it
 // lands on Homebrew, MacPorts or a custom prefix without knowing any of them exist.
+// THAT IS ONE LAYOUT, NOT THE LAYOUT — {@link giLibraryDirsForTypelibDir}; a staged
+// pair keeps typelib and backer in ONE directory, and the incident is in the ORIGINAL.
 //
 // PURE FUNCTION of injected host facts (platform / env / fs / pkg-config), like
 // `resolvePrebuildDirName()` and `buildNativeEnv()` beside it, so the darwin branch
@@ -74,11 +78,28 @@ export const PROBED_GI_LIBDIRS = {
 /**
  * The subdir GI installs typelibs into — historically `1.0` even for the girepository-2.0 API.
  *
- * Exported so `gi-typelib.ts` shares it rather than keeping a third copy of the
- * one string this whole layout rule turns on. Both mirrors export it, so the
- * agreement suite still compares two files that differ only in language.
+ * Exported so `gi-typelib.ts` shares it rather than keeping a fourth copy of the
+ * one string this whole layout rule turns on, and compared across all three copies
+ * by the agreement suite rather than trusting three literals to stay equal.
  */
 export const TYPELIB_SUBDIR = 'girepository-1.0';
+/**
+ * The library directories a typelib directory implies, most specific first.
+ *
+ * TWO LAYOUTS, and a path alone cannot always say which: GI's INSTALL layout keeps
+ * the libraries in the PARENT (`<libdir>/girepository-1.0/…`), while a STAGED pair —
+ * an ADR 0017 prebuild directory, `gjsify.ship.bundledTypelibs` — keeps them in the
+ * DIRECTORY ITSELF. {@link TYPELIB_SUBDIR} as the basename is a positive signal for
+ * the first; absent it, both readings are offered and the caller's `existsDir` keeps
+ * whichever is real.
+ *
+ * The measurement, and why the ORDER of the two is the load-bearing half, are in the
+ * ORIGINAL, `packages/node-gi/node-gi/system-gi.js`.
+ */
+export function giLibraryDirsForTypelibDir(typelibDir) {
+    const parent = dirname(typelibDir);
+    return basename(typelibDir) === TYPELIB_SUBDIR ? [parent] : [typelibDir, parent];
+}
 /** Memoized `pkg-config` answer: the spawn happens at most once per process. */
 let pkgConfigDirsCache = null;
 /** Split an OS search-path variable, dropping empty segments. */
@@ -124,8 +145,9 @@ export function pkgConfigSearchDirs(env) {
  *
  * Three sources, in precedence order:
  *   1. `GI_TYPELIB_PATH` — the host stating outright where typelibs live; the
- *      libraries are the sibling `dirname()`. Accepted on directory existence
- *      alone: an explicit statement is not second-guessed.
+ *      libraries are wherever {@link giLibraryDirsForTypelibDir} says the layout
+ *      puts them. Accepted on directory existence alone: an explicit statement is
+ *      not second-guessed.
  *   2. `pkg-config`'s `.pc` search path → each `<dir>/pkgconfig`'s parent. The
  *      general mechanism (any prefix, including a custom one).
  *   3. {@link PROBED_GI_LIBDIRS} — the standard macOS prefixes, for the common
@@ -155,11 +177,12 @@ export function systemGiLibraryDirs({ platform = process.platform, env = process
         if (dir && dir !== '/' && !out.includes(dir))
             out.push(dir);
     };
-    // 1. Explicit: the typelib dir's sibling libdir.
+    // 1. Explicit: the libdirs each typelib dir implies, both layouts.
     for (const typelibDir of splitSearchPath(env['GI_TYPELIB_PATH'])) {
-        const libDir = dirname(typelibDir);
-        if (existsDir(libDir))
-            add(libDir);
+        for (const libDir of giLibraryDirsForTypelibDir(typelibDir)) {
+            if (existsDir(libDir))
+                add(libDir);
+        }
     }
     // 2 + 3. Candidate prefixes, believed only on the girepository-1.0 marker.
     const candidates = [];

package/lib/utils/trust-registry.js

@@ -82,6 +82,11 @@ export function parseRepoFromGitRemote(url) {
     let s = url.trim();
     if (!s)
         return null;
+    // npm manifests spell the same URL `git+https://…` / `git+ssh://…`. The
+    // scheme prefix is npm's, not the transport's, and without stripping it the
+    // scheme match below fails on `+` and the whole URL reads as unparseable —
+    // which is indistinguishable from "this package declares no repository".
+    s = s.replace(/^git\+/, '');
     s = s.replace(/\.git$/, '');
     const scp = s.match(/^[^/@]+@[^:]+:(.+)$/);
     if (scp) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.44.0",
+    "version": "0.46.0",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -142,21 +142,21 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/buffer": "^0.44.0",
-        "@gjsify/create-app": "^0.44.0",
-        "@gjsify/node-globals": "^0.44.0",
-        "@gjsify/node-polyfills": "^0.44.0",
-        "@gjsify/npm-registry": "^0.44.0",
-        "@gjsify/resolve-npm": "^0.44.0",
-        "@gjsify/rolldown-plugin-gjsify": "^0.44.0",
-        "@gjsify/vite-plugin-blueprint": "^0.44.0",
-        "@gjsify/rolldown-plugin-pnp": "^0.44.0",
-        "@gjsify/semver": "^0.44.0",
-        "@gjsify/tar": "^0.44.0",
-        "@gjsify/tsc": "^0.44.0",
-        "@gjsify/utils": "^0.44.0",
-        "@gjsify/web-polyfills": "^0.44.0",
-        "@gjsify/workspace": "^0.44.0",
+        "@gjsify/buffer": "^0.46.0",
+        "@gjsify/create-app": "^0.46.0",
+        "@gjsify/node-globals": "^0.46.0",
+        "@gjsify/node-polyfills": "^0.46.0",
+        "@gjsify/npm-registry": "^0.46.0",
+        "@gjsify/resolve-npm": "^0.46.0",
+        "@gjsify/rolldown-plugin-gjsify": "^0.46.0",
+        "@gjsify/vite-plugin-blueprint": "^0.46.0",
+        "@gjsify/rolldown-plugin-pnp": "^0.46.0",
+        "@gjsify/semver": "^0.46.0",
+        "@gjsify/tar": "^0.46.0",
+        "@gjsify/tsc": "^0.46.0",
+        "@gjsify/utils": "^0.46.0",
+        "@gjsify/web-polyfills": "^0.46.0",
+        "@gjsify/workspace": "^0.46.0",
         "acorn": "^8.17.0",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
@@ -165,13 +165,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.44.0",
+        "@gjsify/unit": "^0.46.0",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.44.0",
-        "@gjsify/rolldown-native": "^0.44.0"
+        "@gjsify/oxfmt-native": "^0.46.0",
+        "@gjsify/rolldown-native": "^0.46.0"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {