@gjsify/cli 0.47.0 → 0.48.0

package/lib/utils/ship/gi-namespaces.js

@@ -1,10 +1,24 @@
 // Which GI namespaces does this bundle actually load?
 //
-// Read off the emitted `--app gjs` bundle, because that is the file that gets
-// installed. `gi://` is a real module protocol under GJS, so the bundler keeps
-// those specifiers in the output verbatim (`rolldown-plugin-gjsify`'s externals
-// plugin) — the artifact carries its own dependency list and nothing has to be
-// declared twice.
+// Read off the EMITTED bundle, because that is the file that gets installed —
+// and the emitted form is not one form but two, which is the correction this
+// header carries. Under `--app gjs`, `gi://` is a real module protocol, so the
+// bundler keeps those specifiers in the output verbatim
+// (`rolldown-plugin-gjsify`'s externals plugin) and the artifact carries its own
+// dependency list. Under `--app node` there is no such protocol:
+// `gjsGiNodePlugin` rewrites every `gi://Ns?version=X` into a shim whose body is
+// `require('@gjsify/node-gi/gi').requireGi("Ns", "X")`, so the specifier this
+// scanner was written to find is gone from the file by construction.
+//
+// WHAT THAT COST, and why reading one form is not "mostly right": these
+// namespaces are what `depends.ts` maps to `gir1.2-gtk-4.0` and friends
+// (ADR 0024 § 6). A `--app node` project therefore derived an EMPTY typelib
+// dependency set — the package installed cleanly and died at its first GI call,
+// which is the same failure the bare-side-effect-import fix below was written to
+// prevent, arriving again through the other build target. Nothing caught it
+// because every ship fixture's "node bundle" was hand-written with `gi://`
+// imports in it: a shape `gjsify build --app node` cannot emit and node cannot
+// run.
 //
 // PARSED, not pattern-matched, and the first version of this file is why. A
 // regex over the bundle text got it wrong in both directions at once:
@@ -17,18 +31,65 @@
 //     `from`, and since an unmapped namespace fails the build, that made a
 //     correct project unbuildable.
 //
-// `moduleSpecifiers` answers the question exactly, and it is the same acorn
-// pass the CLI already uses to compute its own runtime closure — so there is
-// one definition of "what does this file import" rather than two.
-import { moduleSpecifiers } from '../cli-runtime-closure.js';
+// `walkModuleAst` answers both questions in ONE pass, and it is the same acorn
+// pass the CLI already uses to compute its own runtime closure — so there is one
+// definition of "what does this file import" rather than two.
+import { importedSpecifier, staticStringValue, walkModuleAst, } from '../cli-runtime-closure.js';
+/** The module a `--app node` bundle reaches GI through. */
+const NODE_GI_MODULE = '@gjsify/node-gi/gi';
+/** Namespaces are GI identifiers; anything else is a call this reader misread. */
+const NAMESPACE = /^[A-Za-z][A-Za-z\d_]*$/;
 /**
  * Extract the GI namespaces a bundle imports, as `Ns-Version` when the
  * specifier pins one and bare `Ns` when it does not.
  */
 export function scanGiNamespaces(source) {
     const found = new Set();
-    for (const specifier of moduleSpecifiers(source)) {
-        const key = parseGiSpecifier(specifier);
+    // TWO SETS, because the two kinds of binding are not interchangeable and
+    // treating them as one over-approximated on a real minified bundle. A
+    // namespace object (`import * as gi`) and a required module object are only
+    // ever the OBJECT of `.requireGi(…)`: calling a module namespace is a
+    // TypeError, so a bare `gi(…)` is never one of ours. Only `requireGi` itself
+    // — the named import, or the default export, which IS `requireGi` — is
+    // callable on its own.
+    //
+    // Measured on `gjsify build --app node` (minify is the DEFAULT): a file with
+    // `import * as gi from '@gjsify/node-gi/gi'` and a callback parameter emitted
+    // as `function render(e,t){return e(t)+e(\`Zzqfoo\`)}` — where the minifier
+    // gave the import and the parameter the SAME short name in different scopes.
+    // Read as one set, `e(\`Zzqfoo\`)` became the namespace `Zzqfoo`, and
+    // `deriveDepends` then refused to package a correct project.
+    const callable = new Set();
+    const objects = new Set();
+    const calls = [];
+    walkModuleAst(source, (node) => {
+        const specifier = importedSpecifier(node);
+        if (specifier !== null) {
+            const key = parseGiSpecifier(specifier);
+            if (key !== null)
+                found.add(key);
+            if (node.type === 'ImportDeclaration' && specifier === NODE_GI_MODULE) {
+                collectNodeGiBindings(node, callable, objects);
+            }
+            return;
+        }
+        if (node.type === 'VariableDeclarator' && loadsNodeGiModule(node.init)) {
+            const id = node.id;
+            // An OBJECT: `const gi = require('@gjsify/node-gi/gi')` is the module,
+            // reached as `gi.requireGi(…)` and never called directly.
+            if (id?.type === 'Identifier' && typeof id.name === 'string')
+                objects.add(id.name);
+            return;
+        }
+        // Collected rather than resolved in place: a call can precede the
+        // `require` that binds its callee (the shim's `load()` is hoisted above
+        // nothing, but a minifier is free to reorder declarations), so the
+        // binding set has to be complete before any call is judged.
+        if (node.type === 'CallExpression')
+            calls.push(node);
+    });
+    for (const call of calls) {
+        const key = requireGiNamespace(call, callable, objects);
         if (key !== null)
             found.add(key);
     }
@@ -40,10 +101,112 @@ export function parseGiSpecifier(specifier) {
         return null;
     const rest = specifier.slice('gi://'.length);
     const [namespace, query] = rest.split('?', 2);
-    if (namespace === undefined || !/^[A-Za-z][A-Za-z0-9_]*$/.test(namespace))
+    if (namespace === undefined || !NAMESPACE.test(namespace))
         return null;
     if (query === undefined)
         return namespace;
     const version = /(?:^|&)version=([^&]+)/.exec(query)?.[1];
     return version === undefined ? namespace : `${namespace}-${version}`;
 }
+/**
+ * What an `import … from '@gjsify/node-gi/gi'` binds, split by what it can BE.
+ *
+ * All three spellings appear in real code and the default export IS `requireGi`
+ * (`packages/node-gi/node-gi/gi.d.ts`), so the named import (under any local
+ * name — `import { requireGi as gi }` renames it) and the default import are
+ * CALLABLE. A namespace import is not: calling a module namespace object throws,
+ * so it can only ever be the object of `.requireGi(…)`, and putting it in the
+ * callable set is what let a minified callback parameter of the same name be
+ * read as a `requireGi` call.
+ */
+function collectNodeGiBindings(node, callable, objects) {
+    const specifiers = node.specifiers ?? [];
+    for (const specifier of specifiers) {
+        const local = specifier.local;
+        if (local?.type !== 'Identifier' || typeof local.name !== 'string')
+            continue;
+        const imported = specifier.imported;
+        if (specifier.type === 'ImportNamespaceSpecifier')
+            objects.add(local.name);
+        else if (specifier.type === 'ImportDefaultSpecifier')
+            callable.add(local.name);
+        else if (imported?.type === 'Identifier' && imported.name === 'requireGi')
+            callable.add(local.name);
+    }
+}
+/**
+ * A call that LOADS `@gjsify/node-gi/gi` — recognised by its argument, never by
+ * the name of the callee.
+ *
+ * THE CALLEE NAME DOES NOT SURVIVE BUNDLING, and reading it is how the first cut
+ * of this function passed its own tests while answering `[]` for every real
+ * artifact. Measured on `gjsify build --app node` output for a two-import app,
+ * which is the exact input this module exists to read:
+ *
+ *     unminified   const require$1 = createRequire(import.meta.url);
+ *                  … require$1("@gjsify/node-gi/gi").requireGi("Gtk", "4.0")
+ *     minified     const n = e(import.meta.url);
+ *                  … n(`@gjsify/node-gi/gi`).requireGi(`Gtk`, `4.0`)
+ *
+ * Two shims in one bundle means two `require` bindings, so the second is renamed
+ * even without `--minify` (which is the DEFAULT). A reader keyed on the
+ * identifier `require` therefore loses one namespace unminified and both
+ * minified — silently, since an empty namespace list is a legal answer.
+ *
+ * The module STRING is what survives every rename, and it is a precise
+ * discriminator: a call taking `'@gjsify/node-gi/gi'` as its first argument is a
+ * load of that module under any name a bundler gives the loader.
+ */
+function loadsNodeGiModule(node) {
+    if (!node || typeof node !== 'object')
+        return false;
+    const call = node;
+    if (call.type !== 'CallExpression')
+        return false;
+    const args = call.arguments ?? [];
+    return staticStringValue(args[0]) === NODE_GI_MODULE;
+}
+/**
+ * The namespace a `requireGi(…)` call names, or `null` when this is not one.
+ *
+ * BINDING-TRACED rather than name-matched, and the asymmetry is deliberate: a
+ * bare `.requireGi(…)` on any object would over-approximate, and
+ * over-approximating is NOT the harmless direction here — an unmapped namespace
+ * fails the build, so a foreign method sharing the name would make a correct
+ * project unpackageable. Every accepted shape traces back to an import or
+ * require of `@gjsify/node-gi/gi` in this same file, which is what a bundle
+ * always has: the shim carries its own `require`, and a hand-written node-gi app
+ * carries its own import.
+ *
+ * Shadowing is the one gap left, and the split above is what makes it small.
+ * This reader has no scope analysis, so a local binding that reuses the name of
+ * the CALLABLE import — `requireGi` itself, or the default import — and is called
+ * with a GI-shaped string literal would still be read as one. A minifier can
+ * manufacture exactly that collision, which is why the two shapes it produces
+ * most (the namespace object and the required module object) are the two that no
+ * longer count as callees.
+ */
+function requireGiNamespace(call, callable, objects) {
+    const callee = call.callee;
+    let reached = false;
+    if (callee?.type === 'Identifier') {
+        reached = typeof callee.name === 'string' && callable.has(callee.name);
+    }
+    else if (callee?.type === 'MemberExpression' && callee.computed !== true) {
+        const property = callee.property;
+        if (property?.type !== 'Identifier' || property.name !== 'requireGi')
+            return null;
+        const object = callee.object;
+        reached =
+            loadsNodeGiModule(object) ||
+                (object?.type === 'Identifier' && typeof object.name === 'string' && objects.has(object.name));
+    }
+    if (!reached)
+        return null;
+    const args = call.arguments ?? [];
+    const namespace = staticStringValue(args[0]);
+    if (namespace === null || !NAMESPACE.test(namespace))
+        return null;
+    const version = staticStringValue(args[1]);
+    return version === null ? namespace : `${namespace}-${version}`;
+}

package/lib/utils/ship/plan.d.ts

@@ -11,6 +11,10 @@ export interface StageInputs {
     desktopEntry?: string;
     /** Contents of the project's licence file, when one was found. */
     licenseText?: string;
+    /** Contents of the project's own changelog, when one was found. */
+    changelogText?: string;
+    /** The build stamp every header and every rendered file shares — the changelog's date. */
+    mtime: number;
 }
 /**
  * Build the prefix-relative payload.
@@ -46,7 +50,7 @@ export declare function planStage(settings: ShipSettings, inputs: StageInputs):
  * missing `LICENSE` — actually is; {@link assertOverlayIsLicensed} repeats it at
  * pack time for a stage that arrived from somewhere else.
  */
-export declare function planOverlay(settings: ShipSettings, format: FormatDescriptor, inputs: StageInputs): StagedFile[];
+export declare function planOverlay(settings: ShipSettings, format: FormatDescriptor, inputs: StageInputs): Promise<StagedFile[]>;
 /**
  * The same refusal, at pack time.
  *

package/lib/utils/ship/plan.js

@@ -2,6 +2,8 @@
 // case (including the ones that must be REFUSED) is unit-testable. Same split
 // as `utils/copy-targets.ts`, and for the same reason: a stager that discovers
 // its own inputs can only be tested by building a real project.
+import { renderDebianChangelog } from './changelog.js';
+import { gzipDeterministic } from './gzip.js';
 import { renderMimePackage } from './mime.js';
 import { SHARE } from './share-dirs.js';
 import { basename, extname, posix } from 'node:path';
@@ -152,7 +154,7 @@ function planFonts(settings) {
  * missing `LICENSE` — actually is; {@link assertOverlayIsLicensed} repeats it at
  * pack time for a stage that arrived from somewhere else.
  */
-export function planOverlay(settings, format, inputs) {
+export async function planOverlay(settings, format, inputs) {
     if (inputs.licenseText === undefined) {
         throw new Error(`gjsify ship: no licence file found, so the ${format.id} package would ship no ` +
             `${format.licenseDest(settings.binaryName)}. Debian Policy § 12.5 requires it and lintian ` +
@@ -163,7 +165,24 @@ export function planOverlay(settings, format, inputs) {
     const text = format.licenseKind === 'debian-copyright'
         ? renderDebianCopyright(settings, inputs.licenseText)
         : inputs.licenseText;
-    return [{ path: format.licenseDest(settings.binaryName), mode: 0o644, source: { kind: 'text', text } }];
+    const files = [
+        { path: format.licenseDest(settings.binaryName), mode: 0o644, source: { kind: 'text', text } },
+    ];
+    // COMPRESSED HERE, not at pack time, and that is what makes the two-phase
+    // handoff sound: `--from-stage` rehydrates the overlay out of the sidecar and
+    // packs it, so the assembling host's bytes have to BE the shipped bytes. A
+    // gzip performed on the packing host would put a second compressor's output in
+    // an artifact whose every other byte came from the first. `gzipDeterministic`
+    // zeroes the header stamp for the usual reason (utils/ship/gzip.ts).
+    if (format.changelogDest !== undefined) {
+        const changelog = renderDebianChangelog(settings, inputs.changelogText, inputs.mtime);
+        files.push({
+            path: format.changelogDest(settings.binaryName),
+            mode: 0o644,
+            source: { kind: 'bytes', data: await gzipDeterministic(new TextEncoder().encode(changelog)) },
+        });
+    }
+    return files;
 }
 /**
  * The same refusal, at pack time.

package/lib/utils/ship/settings.d.ts

@@ -37,6 +37,7 @@ export interface DiscoveredPayload {
     /** Absolute paths of the font faces the application ships itself. */
     fontFiles: string[];
     licenseFile?: string;
+    changelogFile?: string;
 }
 export interface SettingsInput {
     projectDir: string;
@@ -144,13 +145,58 @@ export interface ResolvedSettings {
     warnings: string[];
 }
 export declare function resolveShipSettings(input: SettingsInput): ResolvedSettings;
-/** The bundle path a project declares, in the order the rest of the CLI reads them. */
-export declare function declaredBundlePath(pkg: ShipPackageManifest, ship: ConfigDataShip): string | undefined;
+/** The entry one ship target installs, which key named it, and what it must NOT carry. */
+export interface ResolvedShipBundle {
+    /** The declared path as written — project-relative or absolute. */
+    declared?: string;
+    /** The config key the answer came from — named in the refusal and in the notice. */
+    key: string;
+    /** Whether a per-target key overrode the project default. */
+    overridden: boolean;
+    /**
+     * The entries OTHER targets declared, as written.
+     *
+     * Not decoration: `discoverPayload` stages the whole directory the entry
+     * lives in, so a project that keeps `dist/app.gjs.mjs` beside
+     * `dist/app.node.mjs` ships both to both targets. One of them is a bundle
+     * that target's interpreter cannot load, in an artifact advertising that it
+     * can — and on macOS it is inside the signed bundle.
+     */
+    foreign: string[];
+}
+/**
+ * The ONE place a ship target's ENTRY is decided — {@link resolveShipApp}'s twin.
+ *
+ * The two are twins because they answer one question between them, and #1545 is
+ * what answering only half of it costs: `gjsify.ship.app.darwin: "node"` moved
+ * the launcher to `node` while the payload stayed `gjsify.main`, which for a
+ * project whose primary target is Linux is its `--app gjs` bundle. Both keys
+ * were honoured, they contradicted each other, and the `.app` died on its first
+ * import with the only line of output on the subject reading as confirmation.
+ *
+ * A DECLARATION rather than a derivation, and both alternatives were considered
+ * where the issue raised them. Deriving the entry from the runtime by filename
+ * convention (`app.node.mjs` beside `app.gjs.mjs`) is a heuristic on an output
+ * name the project owns — the same guess `tests/e2e/ship`'s fixture exists to
+ * refuse. Having ship invoke `gjsify build --app <runtime>` itself cannot work
+ * for the phase that needs it most: `--from-stage` packs on a host with no
+ * project, no bundler and no sources (ADR 0024 § A2).
+ *
+ * Fall-through, not requirement: a target with no key keeps `gjsify.main`, so
+ * every single-host project is unaffected and nothing new is mandatory.
+ */
+export declare function resolveShipBundle(input: {
+    pkg: ShipPackageManifest;
+    ship: ConfigDataShip;
+    layoutOs: HostOs;
+}): ResolvedShipBundle;
 /** npm package name → a package/binary name both dpkg and rpm accept. */
 export declare function deriveBinaryName(pkgName: string | undefined): string;
 /** AppStream description (string or blocks) → plain paragraphs for deb/rpm. */
 export declare function descriptionParagraphs(description: string | Array<DescriptionBlock | string> | undefined): string[] | undefined;
 /** `LICENSE`, `LICENSE.md`, … — the names a licence file actually has. */
 export declare const LICENSE_FILE_NAMES: readonly ["LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING", "COPYING.md"];
+/** `CHANGELOG.md`, … — the names a project's own changelog actually has. */
+export declare const CHANGELOG_FILE_NAMES: readonly ["CHANGELOG.md", "CHANGELOG", "CHANGELOG.txt", "NEWS.md", "NEWS"];
 /** The bundle's own basename, used as the launcher's exec target. */
 export declare function bundleEntryName(bundlePath: string): string;

package/lib/utils/ship/settings.js

@@ -177,6 +177,7 @@ export function resolveShipSettings(input) {
         description,
         license,
         licenseFile: discovered.licenseFile,
+        changelogFile: discovered.changelogFile,
         homepage: metadata.homepageUrl ?? pkg.homepage,
         section: ship.section ?? sections.section,
         group: ship.group ?? sections.group,
@@ -203,9 +204,66 @@ export function resolveShipSettings(input) {
     };
     return { settings, metadata, warnings };
 }
-/** The bundle path a project declares, in the order the rest of the CLI reads them. */
-export function declaredBundlePath(pkg, ship) {
-    return ship.bundle ?? pkg.gjsify?.main ?? pkg.main;
+/**
+ * The ONE place a ship target's ENTRY is decided — {@link resolveShipApp}'s twin.
+ *
+ * The two are twins because they answer one question between them, and #1545 is
+ * what answering only half of it costs: `gjsify.ship.app.darwin: "node"` moved
+ * the launcher to `node` while the payload stayed `gjsify.main`, which for a
+ * project whose primary target is Linux is its `--app gjs` bundle. Both keys
+ * were honoured, they contradicted each other, and the `.app` died on its first
+ * import with the only line of output on the subject reading as confirmation.
+ *
+ * A DECLARATION rather than a derivation, and both alternatives were considered
+ * where the issue raised them. Deriving the entry from the runtime by filename
+ * convention (`app.node.mjs` beside `app.gjs.mjs`) is a heuristic on an output
+ * name the project owns — the same guess `tests/e2e/ship`'s fixture exists to
+ * refuse. Having ship invoke `gjsify build --app <runtime>` itself cannot work
+ * for the phase that needs it most: `--from-stage` packs on a host with no
+ * project, no bundler and no sources (ADR 0024 § A2).
+ *
+ * Fall-through, not requirement: a target with no key keeps `gjsify.main`, so
+ * every single-host project is unaffected and nothing new is mandatory.
+ */
+export function resolveShipBundle(input) {
+    const declaredTable = input.ship.bundle;
+    const perTarget = typeof declaredTable === 'object' && declaredTable !== null ? declaredTable : {};
+    // The WHOLE table, for the reason `resolveShipApp` gives: a mis-keyed
+    // override is silent by construction, so the run that must report `windows`
+    // is the one assembling some OTHER layout.
+    for (const os of Object.keys(perTarget)) {
+        if (Object.hasOwn(SHIP_APP_OSES, os))
+            continue;
+        throw new Error(`gjsify ship: \`gjsify.ship.bundle.${os}\` is not an OS this command assembles for. Known: ` +
+            `${Object.keys(SHIP_APP_OSES).join(', ')} — the \`process.platform\` spelling, not the ` +
+            "`gjsify ship <os>` positional's. An entry under a key nothing reads leaves that target on " +
+            '`gjsify.main` with nothing to say so.');
+    }
+    const projectWide = typeof declaredTable === 'string' ? declaredTable : undefined;
+    const fallback = input.pkg.gjsify?.main ?? input.pkg.main;
+    const entryFor = (os) => perTarget[os] ?? projectWide ?? fallback;
+    const override = perTarget[input.layoutOs];
+    const declared = entryFor(input.layoutOs);
+    const key = override !== undefined
+        ? `gjsify.ship.bundle.${input.layoutOs}`
+        : projectWide !== undefined
+            ? 'gjsify.ship.bundle'
+            : input.pkg.gjsify?.main !== undefined
+                ? 'gjsify.main'
+                : 'main';
+    // RESOLVED per OS, not read off the table — because the entry another target
+    // ships is as often the FALL-THROUGH as it is a declared one, and that is
+    // #1545's own project shape: `main` is the GJS bundle, only darwin declares
+    // its own, and reading the table alone leaves the GJS bundle sitting inside
+    // the signed `.app` with nothing to name it. When nothing is keyed per OS
+    // every target resolves the same entry and this set is empty by construction.
+    const foreign = [
+        ...new Set(Object.keys(SHIP_APP_OSES)
+            .filter((os) => os !== input.layoutOs)
+            .map(entryFor)
+            .filter((entry) => entry !== undefined && entry !== declared)),
+    ];
+    return { declared, key, overridden: override !== undefined, foreign };
 }
 /** npm package name → a package/binary name both dpkg and rpm accept. */
 export function deriveBinaryName(pkgName) {
@@ -302,6 +360,8 @@ export function descriptionParagraphs(description) {
 }
 /** `LICENSE`, `LICENSE.md`, … — the names a licence file actually has. */
 export const LICENSE_FILE_NAMES = ['LICENSE', 'LICENSE.md', 'LICENSE.txt', 'COPYING', 'COPYING.md'];
+/** `CHANGELOG.md`, … — the names a project's own changelog actually has. */
+export const CHANGELOG_FILE_NAMES = ['CHANGELOG.md', 'CHANGELOG', 'CHANGELOG.txt', 'NEWS.md', 'NEWS'];
 /** The bundle's own basename, used as the launcher's exec target. */
 export function bundleEntryName(bundlePath) {
     return basename(bundlePath);

package/lib/utils/ship/stage-manifest.d.ts

@@ -53,8 +53,17 @@ export declare const STAGE_MANIFEST_FILE = ".gjsify-ship-stage.json";
  *    the one thing the reader can do about it. That is the same shape the 3-to-4
  *    paragraph describes, and at 5 the schema check above fires first and says
  *    "re-run the `--stage` phase with this gjsify".
+ *
+ * 6 made an overlay entry carry EITHER `text` or `base64`, for the gzipped
+ * `changelog.Debian.gz` Debian Policy § 4.4 requires. That is the meaning case
+ * again and the sharpest one yet: a schema-5 reader demands `text` on every
+ * entry, so it meets a 6 stage and fails on `overlay.deb[1].text must be a
+ * string` — a sentence about a field, over a stage whose only problem is the
+ * gjsify reading it. And the inverse is worse than a bad message: a reader that
+ * ignored the unknown key would write an entry with no bytes, or write base64 AS
+ * text, and ship a `.deb` whose changelog is a wall of ASCII at exit 0.
  */
-export declare const STAGE_SCHEMA_VERSION = 5;
+export declare const STAGE_SCHEMA_VERSION = 6;
 /** What this stage was assembled FOR, in the repo-wide `${process.platform}-${process.arch}` spelling. */
 export interface StageTarget {
     /** The layout the stage carries, in the `process.platform` spelling — `win32`, never `windows`. */
@@ -65,9 +74,19 @@ export interface StageTarget {
 export interface StageFileRecord extends StagedMode {
     bytes: number;
 }
-/** One pre-rendered overlay file. Text only — see {@link writeStageManifest}. */
+/**
+ * One pre-rendered overlay file. EXACTLY ONE of `text` and `base64` is present —
+ * see {@link writeStageManifest} for why a file reference is still refused.
+ *
+ * `text` is preferred wherever the content is text, because the sidecar is the one
+ * artifact in this handoff a human reads: the whole copyright is legible in it. The
+ * `base64` half exists for the gzipped Debian changelog, whose bytes must be the
+ * bytes that ship — a stage packed on another host cannot re-compress it and get
+ * the same file.
+ */
 export interface StageOverlayFile extends StagedMode {
-    text: string;
+    text?: string;
+    base64?: string;
 }
 export interface StageManifest {
     schema: number;

package/lib/utils/ship/stage-manifest.js

@@ -13,8 +13,10 @@
 //   * no `staged` — modes come from the plan (see `stage-writer.ts`), so the
 //     launcher packs 0644 and the installed `bin/<name>` is not executable.
 //   * no `overlay` — the `.deb` ships no `/usr/share/doc/<pkg>/copyright`,
-//     which Debian Policy § 12.5 requires and lintian errors on, and the
-//     `.rpm` ships no `/usr/share/licenses/<pkg>/LICENSE`.
+//     which Debian Policy § 12.5 requires and lintian errors on, no
+//     `/usr/share/doc/<pkg>/changelog.Debian.gz`, which § 4.4 requires and
+//     lintian also errors on, and the `.rpm` ships no
+//     `/usr/share/licenses/<pkg>/LICENSE`.
 //   * no `namespaces` — they are scanned from the BUILD TREE's bundle, so a
 //     packing host that re-derived nothing would emit `Depends:` without
 //     `gir1.2-gtk-4.0` and `gir1.2-adw-1`: the package installs on a machine
@@ -36,6 +38,7 @@
 //     that is right there.
 import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { join, sep } from 'node:path';
+import { base64Decode, base64Encode } from '../base64.js';
 import { cliVersion } from '../publish-headers.js';
 import { FORMAT_IDS } from './formats.js';
 import { layoutForOs, LAYOUTS, LAYOUT_NAMES } from './layout.js';
@@ -93,8 +96,17 @@ export const STAGE_MANIFEST_FILE = '.gjsify-ship-stage.json';
  *    the one thing the reader can do about it. That is the same shape the 3-to-4
  *    paragraph describes, and at 5 the schema check above fires first and says
  *    "re-run the `--stage` phase with this gjsify".
+ *
+ * 6 made an overlay entry carry EITHER `text` or `base64`, for the gzipped
+ * `changelog.Debian.gz` Debian Policy § 4.4 requires. That is the meaning case
+ * again and the sharpest one yet: a schema-5 reader demands `text` on every
+ * entry, so it meets a 6 stage and fails on `overlay.deb[1].text must be a
+ * string` — a sentence about a field, over a stage whose only problem is the
+ * gjsify reading it. And the inverse is worse than a bad message: a reader that
+ * ignored the unknown key would write an entry with no bytes, or write base64 AS
+ * text, and ship a `.deb` whose changelog is a wall of ASCII at exit 0.
  */
-export const STAGE_SCHEMA_VERSION = 5;
+export const STAGE_SCHEMA_VERSION = 6;
 /**
  * The half of {@link ShipSettings} that crosses the host boundary.
  *
@@ -149,15 +161,17 @@ export function writeStageManifest(input) {
     const overlay = {};
     for (const format of input.formats) {
         overlay[format.id] = (input.overlay.get(format.id) ?? []).map((file) => {
-            if (file.source.kind !== 'text') {
-                // Every overlay entry `planOverlay` produces today is rendered text. A file
-                // reference would be a build-host path, and putting one in here is how the
-                // manifest would start naming files the packing host cannot open.
-                throw new Error(`gjsify ship: internal error — the ${format.id} overlay entry ${file.path} is a file ` +
-                    'reference, and a stage manifest may only carry rendered text. Render it in ' +
-                    '`planOverlay` instead.');
+            if (file.source.kind === 'text')
+                return { path: file.path, mode: file.mode, text: file.source.text };
+            if (file.source.kind === 'bytes') {
+                return { path: file.path, mode: file.mode, base64: base64Encode(file.source.data) };
             }
-            return { path: file.path, mode: file.mode, text: file.source.text };
+            // A FILE reference is still refused. It would be a build-host path, and
+            // putting one in here is how the manifest would start naming files the
+            // packing host cannot open — the failure the closure exists to prevent.
+            throw new Error(`gjsify ship: internal error — the ${format.id} overlay entry ${file.path} is a file ` +
+                'reference, and a stage manifest may only carry rendered bytes. Render it in ' +
+                '`planOverlay` instead.');
         });
     }
     const manifest = {
@@ -295,10 +309,21 @@ export function readStageManifest(stageDir) {
         // lintian errors on.
         manifest.overlay[id] = expectArray(overlay[id], at(`overlay.${id}`)).map((entry, index) => {
             const file = record(entry, at(`overlay.${id}[${index}]`));
+            const where = at(`overlay.${id}[${index}]`);
+            // EXACTLY ONE, checked in both directions. Neither would write an empty
+            // file at a path Debian policy demands content at; both would leave which
+            // one wins to whichever branch `overlayFiles` happens to test first.
+            if ((file.text === undefined) === (file.base64 === undefined)) {
+                throw new Error(`gjsify ship: ${where} must carry exactly one of \`text\` and \`base64\`. ` +
+                    'An overlay entry is either rendered text or rendered bytes; an entry with ' +
+                    'neither would pack an empty file at a path the format requires content at.');
+            }
             return {
                 path: expectString(file.path, at(`overlay.${id}[${index}].path`)),
                 mode: expectInteger(file.mode, at(`overlay.${id}[${index}].mode`)),
-                text: expectString(file.text, at(`overlay.${id}[${index}].text`)),
+                ...(file.text === undefined
+                    ? { base64: expectString(file.base64, at(`overlay.${id}[${index}].base64`)) }
+                    : { text: expectString(file.text, at(`overlay.${id}[${index}].text`)) }),
             };
         });
     }
@@ -329,7 +354,9 @@ export function overlayFiles(manifest, format) {
     return (manifest.overlay[format] ?? []).map((file) => ({
         path: file.path,
         mode: file.mode,
-        source: { kind: 'text', text: file.text },
+        source: file.base64 === undefined
+            ? { kind: 'text', text: file.text ?? '' }
+            : { kind: 'bytes', data: base64Decode(file.base64) },
     }));
 }
 /**

package/lib/utils/ship/types.d.ts

@@ -224,6 +224,17 @@ export interface FormatDescriptor {
     interpreterGap: string;
     /** Where the project's licence text goes in this format's overlay. */
     licenseDest: (binaryName: string) => string;
+    /**
+     * Where this format wants a packaging changelog, when it wants one at all.
+     *
+     * OPTIONAL, unlike {@link licenseDest}, and the asymmetry is a policy
+     * difference rather than an oversight: Debian Policy § 4.4 makes
+     * `share/doc/<package>/changelog.Debian.gz` mandatory and lintian errors
+     * without it, while rpm's `%doc` changelog is a convention and `rpm` says
+     * nothing when it is absent. A format that leaves this undefined has
+     * answered "this format does not require one".
+     */
+    changelogDest?: (binaryName: string) => string;
     /**
      * `debian-copyright` renders the machine-readable copyright 1.0 format
      * Debian policy asks for; `plain` copies the licence file verbatim.
@@ -420,6 +431,8 @@ export interface ShipSettings extends PackSettings {
     projectDir: string;
     /** Absolute path to the licence file, when one was found. */
     licenseFile?: string;
+    /** Absolute path to the project's own changelog, when one was found. */
+    changelogFile?: string;
     /** `'app'` stages a desktop entry and an icon; `'cli'` stages neither. */
     kind: 'app' | 'cli';
     /** Absolute path to the built bundle that `bin/<binaryName>` executes. */