@gjsify/cli 0.64.12-next.281 → 0.64.13-next.283

package/lib/utils/ship/dmg.d.ts

@@ -22,7 +22,7 @@ export declare function dmgVolumeName(settings: PackSettings): string;
 export interface DmgCreateInput {
     /** The volume label — see {@link dmgVolumeName}. */
     volumeName: string;
-    /** The directory whose CONTENTS become the volume root; it holds `<App>.app` and nothing else. */
+    /** The directory whose CONTENTS become the volume root: `<App>.app` and the `Applications` link. */
     sourceDir: string;
     /** Absolute path the finished `.dmg` is written to. */
     target: string;
@@ -63,9 +63,57 @@ export declare function buildDmgImage(input: DmgPackInput): Promise<void>;
  * Where the volume is assembled before `hdiutil` turns it into an image.
  *
  * A directory of its own under the run's output root, never `out/` itself: the
- * volume root holds the `.app` and NOTHING ELSE, because `-srcfolder` copies
+ * volume root holds the `.app` and its drop target and NOTHING ELSE, because `-srcfolder` copies
  * whatever it finds — a stray sibling would ride into the image, and the reader
  * that would catch it is the same listing comparison that would then have to be
  * relaxed to allow it.
  */
 export declare function dmgVolumeDir(outRoot: string): string;
+/** The drop target's name in the volume root, and where it points. */
+export declare const DMG_APPLICATIONS_LINK: {
+    readonly name: "Applications";
+    readonly target: "/Applications";
+};
+/**
+ * Put the drag-here link into a volume `writePayload` has just filled.
+ *
+ * AFTER `writePayload`, never before: that call wipes the directory it writes,
+ * so it is also what keeps a previous run's link from making this one fail
+ * with `EEXIST`. An ABSOLUTE target, because the link is resolved on the
+ * user's machine where `/Applications` is the only path that means anything —
+ * the Finder shows it as "Applications" with the folder's own icon.
+ */
+export declare function addApplicationsLink(volumeDir: string): void;
+/** The tool that signs the image. The bundle's signer uses the same one. */
+export declare const DMG_SIGN_TOOL = "codesign";
+export interface DmgSignInput {
+    /** A `codesign` identity, or `-` for ad-hoc. */
+    identity: string;
+    /** The finished `.dmg`. */
+    file: string;
+    /** `identity` is the ad-hoc `-`. */
+    adhoc: boolean;
+}
+/**
+ * The `codesign` invocation for the IMAGE, as data.
+ *
+ * NOT the darwin signer's argv (`SIGNERS.darwin.args`), and the two differences
+ * are the point. No `--options runtime`: the hardened runtime is a property of
+ * code that executes, and a disk image does not. No entitlements, for the same
+ * reason. What stays is `--force` — `-ov` rewrites the file, but a caller may
+ * hand in one that is already signed — and `--timestamp` on a real identity
+ * only, for the reason that row gives: an ad-hoc signature has no certificate
+ * to countersign, and `codesign(1)` documents a timestamp failure as fatal.
+ */
+export declare function codesignDmgArgs(input: DmgSignInput): string[];
+/**
+ * Sign the image at `input.file`.
+ *
+ * Ad-hoc is signed too. It earns the image nothing with Gatekeeper, but it is
+ * what CI runs, and a branch only a release with a real certificate reaches is
+ * a branch that breaks on release day.
+ */
+export declare function signDmgImage(input: DmgSignInput & {
+    verbose: boolean;
+    workDir: string;
+}): Promise<void>;

package/lib/utils/ship/dmg.js

@@ -39,13 +39,25 @@
 //     ubuntu-24.04 ships 7-Zip 23.01, not this workstation's 26.02. zlib is the
 //     method its `Dmg` handler has read since long before either.
 //
-// WHAT THIS PACKER DOES NOT PUT IN THE VOLUME: an `/Applications` symlink, the
-// drag-here convention. `writePayload` writes regular files and nothing else —
-// which is a property `tests/e2e/ship` and the `ship-stage` job both assert, and
-// a symlink is also what `actions/upload-artifact` silently dereferences. The
-// artifact is still draggable out of the mounted volume; what it lacks is the
-// arrow. Unblocker: a staged-symlink concept with a reader that can see one, at
-// which point the link and its oracle land together.
+// THE VOLUME CARRIES ONE SYMLINK, `Applications → /Applications`, the drag-here
+// convention: without it the mounted window shows the bundle and nothing to drop
+// it on. It is NOT staged. `writePayload` writes regular files and nothing else —
+// a property `tests/e2e/ship` and the `ship-stage` job both assert — and a staged
+// symlink would be dereferenced by `actions/upload-artifact` on its way to the
+// packing host. The volume directory is assembled ON that host, after the stage
+// has arrived, so neither objection reaches it: the link is written here, next to
+// the `hdiutil` call that consumes it. Its reader is `verify-dmg.py`, which admits
+// exactly this one link with exactly this target and refuses any other.
+//
+// THE IMAGE ITSELF IS SIGNED, and that is a separate signature from the bundle's.
+// Measured on macOS 27 with a Developer ID identity (2026-10-29): a notarised and
+// stapled `.dmg` whose container was never passed to `codesign` reads "code object
+// is not signed at all" under `codesign -dv`, and `spctl -a -t open
+// --context context:primary-signature` rejects it with "no usable signature" —
+// while the `.app` mounted from it is "accepted, source=Notarized Developer ID".
+// The order is fixed by `stapler(1)`: a later `codesign` invalidates a stapled
+// ticket, so the image is signed here, before `ship` notarises and staples it.
+import { symlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { describeExit, spawnToCompletion } from '../spawn.js';
 /** The tool this packer execs. One spelling, read by this module AND by the format row. */
@@ -171,7 +183,7 @@ export async function buildDmgImage(input) {
  * Where the volume is assembled before `hdiutil` turns it into an image.
  *
  * A directory of its own under the run's output root, never `out/` itself: the
- * volume root holds the `.app` and NOTHING ELSE, because `-srcfolder` copies
+ * volume root holds the `.app` and its drop target and NOTHING ELSE, because `-srcfolder` copies
  * whatever it finds — a stray sibling would ride into the image, and the reader
  * that would catch it is the same listing comparison that would then have to be
  * relaxed to allow it.
@@ -179,3 +191,55 @@ export async function buildDmgImage(input) {
 export function dmgVolumeDir(outRoot) {
     return join(outRoot, 'dmg', 'volume');
 }
+/** The drop target's name in the volume root, and where it points. */
+export const DMG_APPLICATIONS_LINK = { name: 'Applications', target: '/Applications' };
+/**
+ * Put the drag-here link into a volume `writePayload` has just filled.
+ *
+ * AFTER `writePayload`, never before: that call wipes the directory it writes,
+ * so it is also what keeps a previous run's link from making this one fail
+ * with `EEXIST`. An ABSOLUTE target, because the link is resolved on the
+ * user's machine where `/Applications` is the only path that means anything —
+ * the Finder shows it as "Applications" with the folder's own icon.
+ */
+export function addApplicationsLink(volumeDir) {
+    symlinkSync(DMG_APPLICATIONS_LINK.target, join(volumeDir, DMG_APPLICATIONS_LINK.name));
+}
+/** The tool that signs the image. The bundle's signer uses the same one. */
+export const DMG_SIGN_TOOL = 'codesign';
+/**
+ * The `codesign` invocation for the IMAGE, as data.
+ *
+ * NOT the darwin signer's argv (`SIGNERS.darwin.args`), and the two differences
+ * are the point. No `--options runtime`: the hardened runtime is a property of
+ * code that executes, and a disk image does not. No entitlements, for the same
+ * reason. What stays is `--force` — `-ov` rewrites the file, but a caller may
+ * hand in one that is already signed — and `--timestamp` on a real identity
+ * only, for the reason that row gives: an ad-hoc signature has no certificate
+ * to countersign, and `codesign(1)` documents a timestamp failure as fatal.
+ */
+export function codesignDmgArgs(input) {
+    return ['--force', '--sign', input.identity, ...(input.adhoc ? [] : ['--timestamp']), input.file];
+}
+/**
+ * Sign the image at `input.file`.
+ *
+ * Ad-hoc is signed too. It earns the image nothing with Gatekeeper, but it is
+ * what CI runs, and a branch only a release with a real certificate reaches is
+ * a branch that breaks on release day.
+ */
+export async function signDmgImage(input) {
+    const args = codesignDmgArgs(input);
+    if (input.verbose)
+        console.log(`[gjsify ship] ${DMG_SIGN_TOOL} ${args.join(' ')}`);
+    const result = await spawnToCompletion(DMG_SIGN_TOOL, args, {
+        completion: 'return',
+        cwd: input.workDir,
+        stdio: 'inherit',
+        notFound: () => new Error(`gjsify ship: ${DMG_SIGN_TOOL} is not on PATH, so the image cannot be signed. Install the ` +
+            'Xcode Command Line Tools (`xcode-select --install`).'),
+    });
+    if (result.code !== 0) {
+        throw new Error(`gjsify ship: ${DMG_SIGN_TOOL} failed on the image with ${describeExit(result)}.`);
+    }
+}

package/lib/utils/ship/entry-interpreter.js

@@ -45,7 +45,7 @@
 // WHY A REFUSAL AND NOT A WARNING. There is no reading of this artifact under
 // which it works. A warning at the end of a `ship` run competes with the
 // artifact path printed beside it, and the artifact is what gets uploaded.
-import { importedSpecifier, walkModuleAst } from '../cli-runtime-closure.js';
+import { importedSpecifier, walkModuleAst } from '@gjsify/rolldown-plugin-gjsify';
 /**
  * The GJS built-in modules, which are bare specifiers rather than a scheme.
  *

package/lib/utils/ship/release-record.d.ts

@@ -0,0 +1,47 @@
+import type { FormatId, HostOs } from './types.js';
+/** The suffix a record's name adds to its artifact's. The site matches on it. */
+export declare const RELEASE_RECORD_SUFFIX = ".gjsify-release.json";
+export declare const RELEASE_RECORD_SCHEMA = 1;
+export type RecordedSignature = {
+    kind: 'none';
+} | {
+    kind: 'adhoc';
+} | {
+    kind: 'identity';
+    identity: string;
+};
+export interface ReleaseRecord {
+    schema: typeof RELEASE_RECORD_SCHEMA;
+    /** The artifact's file name, which is also its release asset name. */
+    artifact: string;
+    /** Lower-case hex SHA-256 of the artifact as written. */
+    sha256: string;
+    size: number;
+    format: FormatId;
+    os: HostOs;
+    /** `process.arch` spelling, or `noarch` for a payload with no native code. */
+    arch: string;
+    signature: RecordedSignature;
+    notarized: boolean;
+    stapled: boolean;
+    /** `@gjsify/cli <version>` — who wrote this record. */
+    generator: string;
+}
+export interface ReleaseRecordInput {
+    /** Absolute path of the finished artifact file. */
+    file: string;
+    format: FormatId;
+    os: HostOs;
+    arch: string;
+    signature: RecordedSignature;
+    notarized: boolean;
+    stapled: boolean;
+    generator: string;
+}
+export declare function releaseRecordPath(artifact: string): string;
+/** Map a run's signing identity to what the record says; `-` is ad-hoc. */
+export declare function recordedSignature(identity: string | undefined, adhocIdentity: string): RecordedSignature;
+/** Build the record from the bytes at `input.file`. Pure apart from reading that file. */
+export declare function buildReleaseRecord(input: ReleaseRecordInput): ReleaseRecord;
+/** Write the record beside its artifact and return the record's path. */
+export declare function writeReleaseRecord(input: ReleaseRecordInput): string;

package/lib/utils/ship/release-record.js

@@ -0,0 +1,55 @@
+// The release record — ADR 0124.
+//
+// ONE FILE BESIDE EVERY FILE ARTIFACT, `<artifact>.gjsify-release.json`, saying
+// what this run did to it: which signature it carries, whether Apple accepted
+// it, whether a ticket was stapled. `@gjsify/site` reads it to decide whether a
+// download needs the "how to open an unsigned app" hint.
+//
+// WRITTEN LAST, from outcomes and not from flags. The hash is taken from the
+// bytes on disk after `stapler` wrote into them, because a hash from before
+// the staple describes a file nobody downloads. A step that fails throws
+// before this runs, so a record never claims a step that did not finish.
+//
+// Per artifact rather than per run or per release: a release is assembled by
+// several jobs on several hosts, and a file named by its artifact cannot
+// collide with another job's.
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { basename } from 'node:path';
+/** The suffix a record's name adds to its artifact's. The site matches on it. */
+export const RELEASE_RECORD_SUFFIX = '.gjsify-release.json';
+export const RELEASE_RECORD_SCHEMA = 1;
+export function releaseRecordPath(artifact) {
+    return `${artifact}${RELEASE_RECORD_SUFFIX}`;
+}
+/** Map a run's signing identity to what the record says; `-` is ad-hoc. */
+export function recordedSignature(identity, adhocIdentity) {
+    if (identity === undefined)
+        return { kind: 'none' };
+    if (identity === adhocIdentity)
+        return { kind: 'adhoc' };
+    return { kind: 'identity', identity };
+}
+/** Build the record from the bytes at `input.file`. Pure apart from reading that file. */
+export function buildReleaseRecord(input) {
+    const bytes = readFileSync(input.file);
+    return {
+        schema: RELEASE_RECORD_SCHEMA,
+        artifact: basename(input.file),
+        sha256: createHash('sha256').update(bytes).digest('hex'),
+        size: bytes.length,
+        format: input.format,
+        os: input.os,
+        arch: input.arch,
+        signature: input.signature,
+        notarized: input.notarized,
+        stapled: input.stapled,
+        generator: input.generator,
+    };
+}
+/** Write the record beside its artifact and return the record's path. */
+export function writeReleaseRecord(input) {
+    const path = releaseRecordPath(input.file);
+    writeFileSync(path, `${JSON.stringify(buildReleaseRecord(input), null, 4)}\n`);
+    return path;
+}

package/lib/utils/ship/signing.d.ts

@@ -266,12 +266,12 @@ export declare function resolveNotaryPlan(input: {
 /**
  * Submit one written artifact for notarisation.
  *
- * ⚠️ UNVERIFIED END TO END. Everything up to the `spawnToCompletion` is covered
- * — the argv by `signing.spec.ts`, the guard and both refusals by
- * `tests/e2e/ship-signing` — and the invocation itself has never run: it needs
- * an Apple Developer account, and § A17's whole point is that M6's proof does
- * not. Whoever first runs this on a real credential should record what it did
- * beside § A15, which is where the question was left open.
+ * VERIFIED BY HAND, NOT IN CI. The argv is covered by `signing.spec.ts`, the
+ * guard and both refusals by `tests/e2e/ship-signing`; the invocation needs an
+ * Apple Developer account, which § A17 keeps out of CI. It has been run with a
+ * real Developer ID and keychain profile on 2026-10-29 (ADR 0024, amendment of
+ * that date): the `.dmg` and the `.zip` of a GTK application both came back
+ * `Accepted`.
  */
 export declare function notarizeArtifact(input: {
     plan: Extract<NotaryPlan, {
@@ -298,9 +298,10 @@ export declare function notarizeArtifact(input: {
  * instead — which is a fact about the CONTAINER and therefore lives on the format
  * (`canCarryTicket`), not in a branch here.
  *
- * ⚠️ UNVERIFIED END TO END, for the same reason `notarizeArtifact` is: stapling
- * needs a real notarisation, which needs an Apple account (ADR 0024 § A15, § A17).
- * The argv is unit-tested and the invocation has never run in this repository.
+ * VERIFIED BY HAND, for the same reason as `notarizeArtifact`: stapling needs a
+ * real notarisation (ADR 0024 § A15, § A17). Run on 2026-10-29 against a signed
+ * `.dmg` — "The staple and validate action worked!", and `spctl` accepts the
+ * image afterwards. The argv is unit-tested.
  *
  * `stapler(1)` also states the constraint that decides the ORDER: *"Stapling does
  * not invalidate the code signature and must be run after an executable or archive

package/lib/utils/ship/signing.js

@@ -461,12 +461,12 @@ export function resolveNotaryPlan(input) {
 /**
  * Submit one written artifact for notarisation.
  *
- * ⚠️ UNVERIFIED END TO END. Everything up to the `spawnToCompletion` is covered
- * — the argv by `signing.spec.ts`, the guard and both refusals by
- * `tests/e2e/ship-signing` — and the invocation itself has never run: it needs
- * an Apple Developer account, and § A17's whole point is that M6's proof does
- * not. Whoever first runs this on a real credential should record what it did
- * beside § A15, which is where the question was left open.
+ * VERIFIED BY HAND, NOT IN CI. The argv is covered by `signing.spec.ts`, the
+ * guard and both refusals by `tests/e2e/ship-signing`; the invocation needs an
+ * Apple Developer account, which § A17 keeps out of CI. It has been run with a
+ * real Developer ID and keychain profile on 2026-10-29 (ADR 0024, amendment of
+ * that date): the `.dmg` and the `.zip` of a GTK application both came back
+ * `Accepted`.
  */
 export async function notarizeArtifact(input) {
     const { notary, credential } = input.plan;
@@ -504,9 +504,10 @@ export async function notarizeArtifact(input) {
  * instead — which is a fact about the CONTAINER and therefore lives on the format
  * (`canCarryTicket`), not in a branch here.
  *
- * ⚠️ UNVERIFIED END TO END, for the same reason `notarizeArtifact` is: stapling
- * needs a real notarisation, which needs an Apple account (ADR 0024 § A15, § A17).
- * The argv is unit-tested and the invocation has never run in this repository.
+ * VERIFIED BY HAND, for the same reason as `notarizeArtifact`: stapling needs a
+ * real notarisation (ADR 0024 § A15, § A17). Run on 2026-10-29 against a signed
+ * `.dmg` — "The staple and validate action worked!", and `spctl` accepts the
+ * image afterwards. The argv is unit-tested.
  *
  * `stapler(1)` also states the constraint that decides the ORDER: *"Stapling does
  * not invalidate the code signature and must be run after an executable or archive

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.64.12-next.281",
+    "version": "0.64.13-next.283",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -142,22 +142,22 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/blueprint": "0.64.12-next.281",
-        "@gjsify/buffer": "0.64.12-next.281",
-        "@gjsify/create-app": "0.64.12-next.281",
-        "@gjsify/node-globals": "0.64.12-next.281",
-        "@gjsify/node-polyfills": "0.64.12-next.281",
-        "@gjsify/npm-registry": "0.64.12-next.281",
-        "@gjsify/resolve-npm": "0.64.12-next.281",
-        "@gjsify/rolldown-plugin-gjsify": "0.64.12-next.281",
-        "@gjsify/vite-plugin-blueprint": "0.64.12-next.281",
-        "@gjsify/rolldown-plugin-pnp": "0.64.12-next.281",
-        "@gjsify/semver": "0.64.12-next.281",
-        "@gjsify/tar": "0.64.12-next.281",
-        "@gjsify/tsc": "0.64.12-next.281",
-        "@gjsify/utils": "0.64.12-next.281",
-        "@gjsify/web-polyfills": "0.64.12-next.281",
-        "@gjsify/workspace": "0.64.12-next.281",
+        "@gjsify/blueprint": "0.64.13-next.283",
+        "@gjsify/buffer": "0.64.13-next.283",
+        "@gjsify/create-app": "0.64.13-next.283",
+        "@gjsify/node-globals": "0.64.13-next.283",
+        "@gjsify/node-polyfills": "0.64.13-next.283",
+        "@gjsify/npm-registry": "0.64.13-next.283",
+        "@gjsify/resolve-npm": "0.64.13-next.283",
+        "@gjsify/rolldown-plugin-gjsify": "0.64.13-next.283",
+        "@gjsify/vite-plugin-blueprint": "0.64.13-next.283",
+        "@gjsify/rolldown-plugin-pnp": "0.64.13-next.283",
+        "@gjsify/semver": "0.64.13-next.283",
+        "@gjsify/tar": "0.64.13-next.283",
+        "@gjsify/tsc": "0.64.13-next.283",
+        "@gjsify/utils": "0.64.13-next.283",
+        "@gjsify/web-polyfills": "0.64.13-next.283",
+        "@gjsify/workspace": "0.64.13-next.283",
         "acorn": "^8.17.0",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
@@ -166,13 +166,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "0.64.12-next.281",
+        "@gjsify/unit": "0.64.13-next.283",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "0.64.12-next.281",
-        "@gjsify/rolldown-native": "0.64.12-next.281"
+        "@gjsify/oxfmt-native": "0.64.13-next.283",
+        "@gjsify/rolldown-native": "0.64.13-next.283"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {
@@ -192,5 +192,5 @@
         "url": "https://github.com/gjsify/gjsify/issues"
     },
     "homepage": "https://github.com/gjsify/gjsify/tree/main/packages/infra/cli#readme",
-    "gitHead": "c4d2e266c0d9849860b9828c14ebfe37b6d493b8"
+    "gitHead": "05fae97125a374e84bf57c2d2d086fb53523f205"
 }

package/lib/utils/ship/gi-namespaces.d.ts

@@ -1,23 +0,0 @@
-/**
- * What a bundle loads, split by whether the host must provide it.
- *
- * `namespaces` is the union — the same answer {@link scanGiNamespaces} has always
- * given — and `optional` is the subset the artifact itself marks optional. A namespace
- * in both is still a hard dependency as far as anything else is concerned: the
- * importer asked for it both ways, and only one of those edges degrades.
- */
-export interface GiRequirements {
-    /** Every GI namespace the bundle loads, `Ns-Version` where a specifier pins one. */
-    namespaces: string[];
-    /** The subset carrying the bundler's optional marker — absent is not fatal. */
-    optional: string[];
-}
-/**
- * Extract the GI namespaces a bundle imports, as `Ns-Version` when the
- * specifier pins one and bare `Ns` when it does not.
- */
-export declare function scanGiNamespaces(source: string): string[];
-/** {@link scanGiNamespaces}, plus which of them the artifact marks optional (ADR 0087). */
-export declare function scanGiRequirements(source: string): GiRequirements;
-/** `gi://Gtk?version=4.0` → `Gtk-4.0`; `gi://Gtk` → `Gtk`; anything else → null. */
-export declare function parseGiSpecifier(specifier: string): string | null;