@gjsify/cli 0.49.0 → 0.50.0

package/lib/utils/build-cache.js

@@ -11,9 +11,9 @@
 //   - a toolchain salt (workspace-resolved versions of @gjsify/cli,
 //     @gjsify/tsc, rolldown, typescript — a bundler/compiler bump must
 //     invalidate everything),
-//   - the package's own input hash (every file under `src/**`, plus
-//     `package.json`, plus the package's root `tsconfig*.json` — real file
-//     contents, streamed sha256, sorted for determinism),
+//   - the package's own input hash — `packageBuildInputs`, the ONE definition
+//     of "what are this package's build inputs" (`utils/package-inputs.ts`),
+//     hashed by real file contents, streamed sha256, sorted for determinism,
 //   - the input hashes of EVERY workspace dependency in the package's
 //     transitive dep closure (prod + dev + optional + peer `workspace:`
 //     edges). Composing the closure's OWN hashes (instead of recursing into
@@ -54,6 +54,7 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { buildDependencyGraph } from '@gjsify/workspace';
 import { replicateLinkSync } from './dir-link.js';
+import { CONVENTIONAL_OUTPUT_DIRS, packageBuildInputs } from './package-inputs.js';
 /**
  * Bump to invalidate every existing cache entry (schema/semantic changes).
  *
@@ -66,10 +67,20 @@ import { replicateLinkSync } from './dir-link.js';
  * still on v2's whole-dir ownership and could restore over a sibling unit; a v2
  * manifest for them records `lib`, so it must not be replayed against the
  * per-child units this version stores.
+ *
+ * v4: the input set is now `packageBuildInputs` instead of `src/**` + the
+ * manifests (#1651). Every v3 key was computed over a strictly narrower set,
+ * so replaying one would report a hit for a change it could not have seen.
  */
-export const BUILD_CACHE_LAYOUT_VERSION = 'v3';
-/** Conventional per-package build output directories, checked in this order. */
-export const OUTPUT_DIR_CANDIDATES = ['lib', 'dist', 'dist-templates'];
+export const BUILD_CACHE_LAYOUT_VERSION = 'v4';
+/**
+ * Conventional per-package build output directories, checked in this order.
+ *
+ * Deliberately the same constant the input definition subtracts: a directory
+ * this cache STORES as an output must never also be hashed as an input, or
+ * storing it would invalidate the key it was stored under.
+ */
+export const OUTPUT_DIR_CANDIDATES = CONVENTIONAL_OUTPUT_DIRS;
 /** Keep at most this many keys per package; evict the least recently stored/used. */
 export const MAX_KEYS_PER_PACKAGE = 2;
 /** Toolchain packages whose resolved versions salt every cache key. */
@@ -113,11 +124,50 @@ export function hashFileStream(path) {
     }
     return hash.digest('hex');
 }
-// Recursive, sorted file walk. Yields workspace-relative paths (forward
-// slashes). Directory symlinks are NOT followed (loop safety) — the link
-// target string participates in the hash instead. `node_modules` and the
-// output dirs never appear because callers only walk `src/` + explicit root
-// files, but guard anyway for nested oddities.
+/**
+ * Content hash of a package's build INPUTS — the set is
+ * {@link packageBuildInputs}, shared with `gjsify test`'s freshness check so
+ * the two cannot drift about what an input is. Sorted, content-streamed:
+ * mtimes do not participate, so a `git checkout` with identical contents
+ * hashes identically across machines.
+ */
+export function hashPackageInputs(location) {
+    const files = packageBuildInputs(location);
+    const hash = createHash('sha256');
+    hash.update(`gjsify-build-cache-inputs/${BUILD_CACHE_LAYOUT_VERSION}\n`);
+    for (const f of files) {
+        if (f.link !== undefined) {
+            // Symlink: try content (file links), fall back to the target path.
+            let content;
+            try {
+                content = hashFileStream(f.abs);
+            }
+            catch {
+                content = `link:${f.link}`;
+            }
+            hash.update(`${f.rel} ${content}\n`);
+            continue;
+        }
+        try {
+            hash.update(`${f.rel} ${hashFileStream(f.abs)}\n`);
+        }
+        catch {
+            // Vanished mid-hash (concurrent edit) — record the absence so the
+            // key still changes vs. the file being present.
+            hash.update(`${f.rel} unreadable\n`);
+        }
+    }
+    return hash.digest('hex');
+}
+/**
+ * Recursive, sorted walk of an OUTPUT tree, yielding `/`-separated relative
+ * paths. Directory symlinks are not followed (loop safety) — the link target
+ * string participates in the hash instead.
+ *
+ * Deliberately NOT `packageBuildInputs`: this one is handed a directory that
+ * the input walk subtracts, and it must report everything inside it, dot-files
+ * included — an emitted `.gresource` is part of what was built.
+ */
 function walkFiles(dir, prefix, out) {
     let entries;
     try {
@@ -140,11 +190,8 @@ function walkFiles(dir, prefix, out) {
             continue;
         }
         if (st.isSymbolicLink()) {
-            // File symlinks: hash the resolved content below if readable;
-            // dir symlinks: record the target only.
             try {
-                const target = readlinkSync(abs);
-                out.push({ rel, abs, link: target });
+                out.push({ rel, abs, link: readlinkSync(abs) });
             }
             catch {
                 /* dropped mid-walk */
@@ -158,58 +205,6 @@ function walkFiles(dir, prefix, out) {
         }
     }
 }
-/**
- * Content hash of a package's build INPUTS: every file under `src/**`, plus
- * `package.json`, plus root `tsconfig*.json`. Sorted, content-streamed —
- * mtimes do not participate, so a `git checkout` with identical contents
- * hashes identically across machines.
- */
-export function hashPackageInputs(location) {
-    const files = [];
-    const pkgJson = join(location, 'package.json');
-    if (existsSync(pkgJson))
-        files.push({ rel: 'package.json', abs: pkgJson });
-    let rootEntries = [];
-    try {
-        rootEntries = readdirSync(location);
-    }
-    catch {
-        /* unreadable package dir — hash degenerates to the empty set */
-    }
-    for (const entry of rootEntries.sort()) {
-        if (/^tsconfig.*\.json$/.test(entry)) {
-            files.push({ rel: entry, abs: join(location, entry) });
-        }
-    }
-    const srcDir = join(location, 'src');
-    if (existsSync(srcDir))
-        walkFiles(srcDir, 'src', files);
-    const hash = createHash('sha256');
-    hash.update(`gjsify-build-cache-inputs/${BUILD_CACHE_LAYOUT_VERSION}\n`);
-    for (const f of files) {
-        if (f.link !== undefined) {
-            // Symlink: try content (file links), fall back to the target path.
-            let content;
-            try {
-                content = hashFileStream(f.abs);
-            }
-            catch {
-                content = `link:${f.link}`;
-            }
-            hash.update(`${f.rel} ${content}\n`);
-            continue;
-        }
-        try {
-            hash.update(`${f.rel} ${hashFileStream(f.abs)}\n`);
-        }
-        catch {
-            // Vanished mid-hash (concurrent edit) — record the absence so the
-            // key still changes vs. the file being present.
-            hash.update(`${f.rel} unreadable\n`);
-        }
-    }
-    return hash.digest('hex');
-}
 /**
  * Mtime-independent content hash of a set of output dirs — used to skip the
  * restore copy when the on-disk outputs already match the cached entry, and

package/lib/utils/cli-exit.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The status a settled CLI run still owes the shell, or `null` when it owes
+ * none.
+ *
+ * @param exitCode what `process.exitCode` holds now — `number | string | null |
+ *   undefined`, the full set Node accepts for that property.
+ * @param isDaemon whether the command declared itself a daemon. A watch loop
+ *   RESOLVES as soon as it is armed and keeps running, so its resolution is not
+ *   an ending to exit on — the same rule `gjsify run`'s fast path applies, and
+ *   the incident behind it (`gjsify run dev` killing the loop it had just
+ *   started) is in `daemon-command.ts`.
+ */
+export declare function pendingFailureCode(exitCode: number | string | null | undefined, isDaemon: boolean): number | null;
+/**
+ * End a settled CLI run on the status its handler reported, on both runtimes.
+ *
+ * No-op unless a handler actually reported a failure. On Node it is a no-op
+ * even then — `gjsExit` finds no `imports.system` and the runtime honours
+ * `process.exitCode` at natural shutdown by itself, which is why this does NOT
+ * reach for `process.exit()`: that would cut short the stdout flush Node's own
+ * idiom exists to allow.
+ */
+export declare function exitOnReportedFailure(): void;

package/lib/utils/cli-exit.js

@@ -0,0 +1,78 @@
+// The CLI has TWO ways to fail, and until now only one of them reached the shell
+// under GJS.
+//
+// A command handler either THROWS — `index.ts` catches it, prints, and calls
+// `gjsExit(1)` — or it REPORTS the failure by assigning `process.exitCode` and
+// returning normally. The second shape is the documented Node idiom (streams
+// flush, the process ends naturally) and the CLI uses it wherever a failure has
+// already been printed in full: `gjsify gresource`/`gjsify gsettings` propagate
+// the code `glib-compile-*` exited with, `gjsify barrels --check` reports drift,
+// `setOxcExitCode` propagates a formatter's verdict.
+//
+// **Under GJS that assignment is a REPORT and nothing more.** There is no atexit
+// hook, so nothing reads `process.exitCode` back at natural shutdown and the
+// process ends 0. Measured on the v0.49.0 bundle, same argv, same broken input:
+//
+//     $ node lib/index.js  gresource broken.gresource.xml   → exit 1
+//     $ gjs -m dist/cli.gjs.mjs gresource broken.gresource.xml → exit 0
+//       ("[gjsify gresource] glib-compile-resources failed (exit 1)" printed)
+//
+// and the same split for `gjsify gsettings` and `gjsify barrels --check`. The
+// consequence is not a cosmetic status: a package script chaining on it runs the
+// next step over an artifact that was never written —
+//
+//     "build:resources": "gjsify gresource … && echo SECOND"
+//       → SECOND printed, script exits 0   (JumpLink/Learn6502#180)
+//
+// — which is exactly the shape `&&` is supposed to protect. `gjsify run`'s
+// in-process fast path was already immune (it reads `process.exitCode` back
+// itself, #1568), so the hole survived precisely in the SPAWNED command, i.e.
+// in every chained script and every direct CI invocation.
+//
+// This module is the missing half of the entry's exit funnel, and a sibling of
+// `force-exit.ts`: that one is for a caller that knows the code it wants NOW,
+// this one for the status a settled run left behind. The rule is pure so it can
+// be stated as a test without driving a process to its death.
+//
+// Related, and deliberately distinct: `gjsify/deferred-process-exit` (oxlint)
+// covers the OTHER GJS exit trap, a bare `process.exit()` that does not halt.
+// No lint rule could have caught this one — every `process.exitCode = …` site
+// is correct; the entry was not reading them.
+import { gjsExit } from '@gjsify/rolldown-plugin-gjsify/runtime';
+import { isDaemonCommand } from './daemon-command.js';
+/**
+ * The status a settled CLI run still owes the shell, or `null` when it owes
+ * none.
+ *
+ * @param exitCode what `process.exitCode` holds now — `number | string | null |
+ *   undefined`, the full set Node accepts for that property.
+ * @param isDaemon whether the command declared itself a daemon. A watch loop
+ *   RESOLVES as soon as it is armed and keeps running, so its resolution is not
+ *   an ending to exit on — the same rule `gjsify run`'s fast path applies, and
+ *   the incident behind it (`gjsify run dev` killing the loop it had just
+ *   started) is in `daemon-command.ts`.
+ */
+export function pendingFailureCode(exitCode, isDaemon) {
+    if (isDaemon)
+        return null;
+    if (exitCode === null || exitCode === undefined)
+        return null;
+    const code = Number(exitCode);
+    // A non-finite value cannot be assigned to `process.exitCode` on Node at
+    // all, so there is no failure here to invent one from.
+    return Number.isFinite(code) && code !== 0 ? code : null;
+}
+/**
+ * End a settled CLI run on the status its handler reported, on both runtimes.
+ *
+ * No-op unless a handler actually reported a failure. On Node it is a no-op
+ * even then — `gjsExit` finds no `imports.system` and the runtime honours
+ * `process.exitCode` at natural shutdown by itself, which is why this does NOT
+ * reach for `process.exit()`: that would cut short the stdout flush Node's own
+ * idiom exists to allow.
+ */
+export function exitOnReportedFailure() {
+    const code = pendingFailureCode(process.exitCode, isDaemonCommand());
+    if (code !== null)
+        gjsExit(code);
+}

package/lib/utils/package-inputs.d.ts

@@ -0,0 +1,81 @@
+/** One file the build may read. `link` is set for a symlink (never followed). */
+export interface PackageInputFile {
+    /** Package-relative path, forward slashes. */
+    rel: string;
+    abs: string;
+    /** Raw symlink target, when this entry is a symlink. */
+    link?: string;
+}
+/**
+ * Where the toolchain writes when the package does not say otherwise.
+ *
+ * Used for a package with NO `clear` script (a consumer project we know
+ * nothing about), and unioned onto the declared set for one that has one:
+ * `gjsify test` writes `dist/test.{gjs,node}.mjs` into packages whose `clear`
+ * line predates that command and names only `lib`, and an output left in the
+ * input set makes every run see a newer file than the artifact it is judging.
+ */
+export declare const CONVENTIONAL_OUTPUT_DIRS: readonly ["lib", "dist", "dist-templates"];
+/**
+ * Files whose change means the installed dependency tree may have moved.
+ *
+ * `node_modules` is deliberately not walked — too large to stat per run, and
+ * the reason the old `gjsify test` walk skipped it too — so the lockfile is
+ * the cheap proxy for it. That substitution is not new: `actions/build.ts`
+ * has made it since the plugin bundle cache existed, and this is the list it
+ * uses, kept in one place so a fifth package manager is added once.
+ */
+export declare const DEP_CHANGE_LOCKFILES: readonly ["gjsify-lock.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"];
+export interface PackageBuildInputOptions {
+    /** Parsed `package.json`, when the caller already has it. */
+    manifest?: {
+        scripts?: Record<string, string>;
+    } | null;
+    /** Extra package-relative paths to treat as output (e.g. a `--outdir`). */
+    extraOutputs?: readonly string[];
+}
+/**
+ * The paths this package PRODUCES, package-relative — DERIVED from the
+ * package's own `clear` script rather than re-declared, the same move
+ * `utils/dev-plan.ts` makes for build flags.
+ *
+ * Three cases, and the middle one is the one that matters:
+ *   - `clear` is `gjsify clear a b c` → `a b c` plus the conventional dirs.
+ *     127 of 212 workspace packages, naming `tmp`, `build`, `*.tsbuildinfo`,
+ *     `test.gjs.mjs`, and in two of them `src/*.generated.ts` — a generated
+ *     file INSIDE `src/` that the old walk hashed as an input.
+ *   - `clear` is anything else (`echo 'nothing to do'`, 74 packages) →
+ *     NOTHING. The package states it has nothing to delete, so its `lib/` is
+ *     source, not output. Exactly two of the 74 have a conventional output dir
+ *     on disk, `resolve-npm/lib` and `manifest-conformance/lib`, and in both
+ *     it is tracked source — so the script is a trustworthy oracle both ways.
+ *   - no `clear` script (11 packages, and any consumer project) → the
+ *     conventional dirs, the only guess available.
+ */
+export declare function packageOutputPaths(manifest: {
+    scripts?: Record<string, string>;
+} | null): string[];
+/** `package.json` at `pkgRoot`, or `null` when absent/unreadable. */
+export declare function readPackageManifest(pkgRoot: string): {
+    scripts?: Record<string, string>;
+} | null;
+/**
+ * Every file the build of the package at `pkgRoot` may read, sorted by
+ * package-relative path.
+ *
+ * Enumeration only — the caller decides whether to hash contents (build cache)
+ * or take mtimes (`gjsify test` freshness). That split is deliberate: the two
+ * must agree on the SET, and they legitimately differ on what they do with it.
+ */
+export declare function packageBuildInputs(pkgRoot: string, options?: PackageBuildInputOptions): PackageInputFile[];
+/** Newest mtime (ms) among `files`, or 0 for an empty set. */
+export declare function newestInputMtimeMs(files: readonly PackageInputFile[]): number;
+/**
+ * Newest lockfile mtime (ms) at or above `startDir`, or 0 when there is none.
+ *
+ * Walks up because in a monorepo the lockfile that governs a package's
+ * `node_modules` sits at the workspace root, several levels away — and a
+ * dependency bump that rewrites it is precisely the case #1651 was found in
+ * (postbote, gjsify 0.33.0 → 0.49.0, not one source file touched).
+ */
+export declare function newestDepSignalMtimeMs(startDir: string): number;

package/lib/utils/package-inputs.js

@@ -0,0 +1,233 @@
+// SPDX-License-Identifier: MIT
+// ONE answer to "what are this package's build inputs" — read by the build
+// cache (`build-cache.ts`) and by `gjsify test`'s freshness check. Add a
+// fourth READER, never a fourth answer.
+//
+// It was answered three times, each an ALLOW-list over a guessed layout, and
+// each is wrong for a package that already exists here: `src/**` misses
+// `@gjsify/adwaita-fonts` (no `src/` at all) and the tracked source in
+// `resolve-npm/lib` + `manifest-conformance/lib` (#821); `dirname(<test
+// entry>)` missed `src/**` entirely, so `gjsify test` reran the PREVIOUS
+// bundle and reported on it (#1651).
+//
+// So: a DENY-list. An input is any file in the package that is not a
+// dependency, not tool/VCS state, and not something the package produces —
+// which covers a layout nobody anticipated by construction. **In doubt, a
+// file is an input**: a false input costs one rebuild, a false non-input
+// costs a green test run about code that is not in the artifact.
+//
+// The incident, the measurements behind every number below, and the copy
+// still open (CI's `actions/cache` glob): docs/build-artifacts.md.
+import { existsSync, lstatSync, readdirSync, readFileSync, readlinkSync, statSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { hasWildcard, segmentToRegExp } from './clear-targets.js';
+import { gjsifyCommandArgv } from './simple-command.js';
+/**
+ * Where the toolchain writes when the package does not say otherwise.
+ *
+ * Used for a package with NO `clear` script (a consumer project we know
+ * nothing about), and unioned onto the declared set for one that has one:
+ * `gjsify test` writes `dist/test.{gjs,node}.mjs` into packages whose `clear`
+ * line predates that command and names only `lib`, and an output left in the
+ * input set makes every run see a newer file than the artifact it is judging.
+ */
+export const CONVENTIONAL_OUTPUT_DIRS = ['lib', 'dist', 'dist-templates'];
+/**
+ * Files whose change means the installed dependency tree may have moved.
+ *
+ * `node_modules` is deliberately not walked — too large to stat per run, and
+ * the reason the old `gjsify test` walk skipped it too — so the lockfile is
+ * the cheap proxy for it. That substitution is not new: `actions/build.ts`
+ * has made it since the plugin bundle cache existed, and this is the list it
+ * uses, kept in one place so a fifth package manager is added once.
+ */
+export const DEP_CHANGE_LOCKFILES = ['gjsify-lock.json', 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml'];
+/**
+ * The paths this package PRODUCES, package-relative — DERIVED from the
+ * package's own `clear` script rather than re-declared, the same move
+ * `utils/dev-plan.ts` makes for build flags.
+ *
+ * Three cases, and the middle one is the one that matters:
+ *   - `clear` is `gjsify clear a b c` → `a b c` plus the conventional dirs.
+ *     127 of 212 workspace packages, naming `tmp`, `build`, `*.tsbuildinfo`,
+ *     `test.gjs.mjs`, and in two of them `src/*.generated.ts` — a generated
+ *     file INSIDE `src/` that the old walk hashed as an input.
+ *   - `clear` is anything else (`echo 'nothing to do'`, 74 packages) →
+ *     NOTHING. The package states it has nothing to delete, so its `lib/` is
+ *     source, not output. Exactly two of the 74 have a conventional output dir
+ *     on disk, `resolve-npm/lib` and `manifest-conformance/lib`, and in both
+ *     it is tracked source — so the script is a trustworthy oracle both ways.
+ *   - no `clear` script (11 packages, and any consumer project) → the
+ *     conventional dirs, the only guess available.
+ */
+export function packageOutputPaths(manifest) {
+    const clear = manifest?.scripts?.clear;
+    if (clear === undefined)
+        return [...CONVENTIONAL_OUTPUT_DIRS];
+    // `allowGlobs`: five packages here clear `*.tsbuildinfo`, and the pattern
+    // is what we want — this reads the targets, it does not run them.
+    const argv = gjsifyCommandArgv(clear, { allowGlobs: true });
+    if (argv === null || argv[0] !== 'clear')
+        return [];
+    const targets = argv.slice(1).filter((token) => !token.startsWith('-'));
+    return [...targets, ...CONVENTIONAL_OUTPUT_DIRS];
+}
+/** `package.json` at `pkgRoot`, or `null` when absent/unreadable. */
+export function readPackageManifest(pkgRoot) {
+    try {
+        return JSON.parse(readFileSync(join(pkgRoot, 'package.json'), 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Match a package-relative path against output targets — the target itself and
+ * everything under it.
+ *
+ * Wildcards are honoured in the LAST segment only, which is `gjsify clear`'s
+ * own rule (`utils/clear-targets.ts`), so the set matched here is the set that
+ * command would delete.
+ */
+function makeOutputMatcher(targets) {
+    const compiled = targets
+        .map((target) => target
+        .split(/[\\/]+/)
+        .filter((segment) => segment !== '' && segment !== '.')
+        .map((segment) => (hasWildcard(segment) ? segmentToRegExp(segment) : segment)))
+        .filter((segments) => segments.length > 0);
+    return (rel) => {
+        const parts = rel.split('/');
+        for (const target of compiled) {
+            if (target.length > parts.length)
+                continue;
+            let matched = true;
+            for (let i = 0; i < target.length; i++) {
+                const segment = target[i];
+                const got = parts[i];
+                if (typeof segment === 'string' ? segment !== got : !segment.test(got)) {
+                    matched = false;
+                    break;
+                }
+            }
+            if (matched)
+                return true;
+        }
+        return false;
+    };
+}
+function walk(dir, prefix, isOutput, out) {
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    entries.sort();
+    for (const entry of entries) {
+        // `node_modules` is the dependency tree, not this package's source, and
+        // a dot-entry is VCS/editor/cache state — `.git` alone would make the
+        // walk unbounded. Measured across every package here: no file under any
+        // `src/` is dot-prefixed, so nothing the old hash covered is lost.
+        if (entry === 'node_modules' || entry.startsWith('.'))
+            continue;
+        const rel = prefix === '' ? entry : `${prefix}/${entry}`;
+        if (isOutput(rel))
+            continue;
+        const abs = join(dir, entry);
+        let st;
+        try {
+            st = lstatSync(abs);
+        }
+        catch {
+            continue;
+        }
+        if (st.isSymbolicLink()) {
+            // Not followed: a directory symlink can loop, and a workspace
+            // `node_modules` link would drag the whole tree in. The target
+            // string participates instead; file links are read by content where
+            // the consumer asks for content.
+            out.push({ rel, abs, link: readLinkTarget(abs) });
+        }
+        else if (st.isDirectory()) {
+            walk(abs, rel, isOutput, out);
+        }
+        else if (st.isFile()) {
+            out.push({ rel, abs });
+        }
+    }
+}
+function readLinkTarget(abs) {
+    try {
+        return readlinkSync(abs);
+    }
+    catch {
+        // Dropped between lstat and readlink. An empty target still differs
+        // from the file being absent, which is all the hash needs.
+        return '';
+    }
+}
+/**
+ * Every file the build of the package at `pkgRoot` may read, sorted by
+ * package-relative path.
+ *
+ * Enumeration only — the caller decides whether to hash contents (build cache)
+ * or take mtimes (`gjsify test` freshness). That split is deliberate: the two
+ * must agree on the SET, and they legitimately differ on what they do with it.
+ */
+export function packageBuildInputs(pkgRoot, options = {}) {
+    const manifest = options.manifest !== undefined ? options.manifest : readPackageManifest(pkgRoot);
+    const outputs = [...packageOutputPaths(manifest), ...(options.extraOutputs ?? [])];
+    const files = [];
+    walk(pkgRoot, '', makeOutputMatcher(outputs), files);
+    return files;
+}
+/** Newest mtime (ms) among `files`, or 0 for an empty set. */
+export function newestInputMtimeMs(files) {
+    let newest = 0;
+    for (const file of files) {
+        try {
+            const { mtimeMs } = statSync(file.abs);
+            if (mtimeMs > newest)
+                newest = mtimeMs;
+        }
+        catch {
+            // Vanished mid-walk. Treat as a change: an input we cannot read is
+            // not evidence that the artifact is current.
+            return Number.POSITIVE_INFINITY;
+        }
+    }
+    return newest;
+}
+/**
+ * Newest lockfile mtime (ms) at or above `startDir`, or 0 when there is none.
+ *
+ * Walks up because in a monorepo the lockfile that governs a package's
+ * `node_modules` sits at the workspace root, several levels away — and a
+ * dependency bump that rewrites it is precisely the case #1651 was found in
+ * (postbote, gjsify 0.33.0 → 0.49.0, not one source file touched).
+ */
+export function newestDepSignalMtimeMs(startDir) {
+    let newest = 0;
+    let dir = startDir;
+    for (;;) {
+        for (const name of DEP_CHANGE_LOCKFILES) {
+            const candidate = join(dir, name);
+            if (!existsSync(candidate))
+                continue;
+            try {
+                const { mtimeMs } = statSync(candidate);
+                if (mtimeMs > newest)
+                    newest = mtimeMs;
+            }
+            catch {
+                /* raced away — the other lockfiles still answer */
+            }
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return newest;
+        dir = parent;
+    }
+}

package/lib/utils/ship/changelog.d.ts

@@ -38,19 +38,20 @@ export declare function changelogEntriesFor(version: string, source: string): st
  * wrong: exactly one leading space, then `--`, one space, the maintainer, and TWO
  * spaces before the date.
  *
- * TWO lintian tags this file still raises, both measured on lintian 2.117 against
- * gjsify's own `.deb` and both left alone deliberately:
- *
- *  - `initial-upload-closes-no-bugs`, because the Debian revision is `-1` and the
- *    entry closes no bug. It is a statement about the Debian ARCHIVE's ITP
- *    workflow — the first upload of a new source package should close its ITP bug
- *    — and a package built by `gjsify ship` is never uploaded there. There is no
- *    bug number that would be true to write, so the tag is inapplicable rather
- *    than unmet.
- *  - `changelog-not-compressed-with-max-compression`. Policy asks for `gzip -9`
- *    and neither `CompressionStream` nor `@gjsify/zlib` takes a level, so
- *    `gzipDeterministic` cannot ask for one. Ledgered in `status/open-todos.md`:
- *    the fix is a capability in the core, and stamping the header's XFL byte to
- *    claim max compression we did not use is not one.
+ * ONE lintian tag this file still raises, measured on lintian 2.117 against
+ * gjsify's own `.deb` and left alone deliberately: `initial-upload-closes-no-bugs`,
+ * because the Debian revision is `-1` and the entry closes no bug. It is a
+ * statement about the Debian ARCHIVE's ITP workflow — the first upload of a new
+ * source package should close its ITP bug — and a package built by `gjsify ship`
+ * is never uploaded there. There is no bug number that would be true to write, so
+ * the tag is inapplicable rather than unmet.
+ *
+ * `changelog-not-compressed-with-max-compression` was a second one, and closing it
+ * was a capability gap in the CORE rather than anything wrong in this file:
+ * neither `CompressionStream` nor `@gjsify/zlib` would take a compression level,
+ * so `gzipDeterministic` had none to pass on. `@gjsify/zlib` honours
+ * `options.level` now and `plan.ts` compresses this file at
+ * `POLICY_MAX_COMPRESSION`. `verify-deb.sh` gates the tag by name, so it cannot
+ * come back quietly.
  */
 export declare function renderDebianChangelog(settings: PackSettings, source: string | undefined, mtime: number): string;

package/lib/utils/ship/changelog.js

@@ -134,20 +134,21 @@ const WIDTH = 80;
  * wrong: exactly one leading space, then `--`, one space, the maintainer, and TWO
  * spaces before the date.
  *
- * TWO lintian tags this file still raises, both measured on lintian 2.117 against
- * gjsify's own `.deb` and both left alone deliberately:
+ * ONE lintian tag this file still raises, measured on lintian 2.117 against
+ * gjsify's own `.deb` and left alone deliberately: `initial-upload-closes-no-bugs`,
+ * because the Debian revision is `-1` and the entry closes no bug. It is a
+ * statement about the Debian ARCHIVE's ITP workflow — the first upload of a new
+ * source package should close its ITP bug — and a package built by `gjsify ship`
+ * is never uploaded there. There is no bug number that would be true to write, so
+ * the tag is inapplicable rather than unmet.
  *
- *  - `initial-upload-closes-no-bugs`, because the Debian revision is `-1` and the
- *    entry closes no bug. It is a statement about the Debian ARCHIVE's ITP
- *    workflow — the first upload of a new source package should close its ITP bug
- *    — and a package built by `gjsify ship` is never uploaded there. There is no
- *    bug number that would be true to write, so the tag is inapplicable rather
- *    than unmet.
- *  - `changelog-not-compressed-with-max-compression`. Policy asks for `gzip -9`
- *    and neither `CompressionStream` nor `@gjsify/zlib` takes a level, so
- *    `gzipDeterministic` cannot ask for one. Ledgered in `status/open-todos.md`:
- *    the fix is a capability in the core, and stamping the header's XFL byte to
- *    claim max compression we did not use is not one.
+ * `changelog-not-compressed-with-max-compression` was a second one, and closing it
+ * was a capability gap in the CORE rather than anything wrong in this file:
+ * neither `CompressionStream` nor `@gjsify/zlib` would take a compression level,
+ * so `gzipDeterministic` had none to pass on. `@gjsify/zlib` honours
+ * `options.level` now and `plan.ts` compresses this file at
+ * `POLICY_MAX_COMPRESSION`. `verify-deb.sh` gates the tag by name, so it cannot
+ * come back quietly.
  */
 export function renderDebianChangelog(settings, source, mtime) {
     const entries = source === undefined ? [] : changelogEntriesFor(settings.version, source);