@gjsify/cli 0.64.12 → 0.64.13

package/lib/actions/build.js

@@ -1,5 +1,5 @@
 import { runBundle, runWatch, bundleToChunks } from '../bundler-pick.js';
-import { gjsifyPlugin, textLoaderPlugin, resolveShebangLine, NODE_SHEBANG, createGjsExternalsPredicate, globToEntryPoints, } from '@gjsify/rolldown-plugin-gjsify';
+import { gjsifyPlugin, textLoaderPlugin, resolveShebangLine, NODE_SHEBANG, createGjsExternalsPredicate, globToEntryPoints, scanGiNamespaces, planGiSelection, } from '@gjsify/rolldown-plugin-gjsify';
 import { isGjs } from '@gjsify/rolldown-plugin-gjsify/runtime';
 import { resolveUserPlugins } from '../utils/resolve-plugin-by-name.js';
 import { resolveGlobalsList, writeRegisterInjectFile, detectAutoGlobals, detectNodeGiGlobals, } from '@gjsify/rolldown-plugin-gjsify/globals';
@@ -15,8 +15,6 @@ import { collectEntryPaths, describeJsxConfig, findJsxEntryPoint, jsxConfigMissi
 import { giSystemProbes } from '../utils/gi-runtime-paths.js';
 import { escapeRawNulForGjs } from '../utils/gjs-source-escape.js';
 import { assertNodeBundleGlobalsShimmed } from '../utils/node-bundle-guard.js';
-import { scanGiNamespaces } from '../utils/ship/gi-namespaces.js';
-import { planGiSelection } from '../utils/ship/gi-selection.js';
 import { DEP_CHANGE_LOCKFILES } from '../utils/package-inputs.js';
 const DEFAULT_GJS_SHEBANG = '#!/usr/bin/env -S gjs -m';
 /**
@@ -700,7 +698,7 @@ export class BuildAction {
             throw new Error('gjsify build: an .html entry needs an explicit --outfile ' +
                 '(e.g. --outfile dist-app/app.js); the emitted index.html is written beside it.');
         }
-        const { consoleShim, globals, dialect, giRenderer } = this.configData;
+        const { consoleShim, globals, dialect, giRenderer, nativescriptLocale } = this.configData;
         const userExternal = Array.isArray(userBundler.external) ? userBundler.external : undefined;
         const userBanner = typeof userBundler.output?.banner === 'string' ? userBundler.output.banner : undefined;
         const pluginOpts = {
@@ -712,6 +710,7 @@ export class BuildAction {
             consoleShim,
             ...(dialect !== undefined ? { dialect } : {}),
             ...(giRenderer === true ? { giRenderer: true } : {}),
+            ...(nativescriptLocale ? { nativescriptLocale } : {}),
             ...(aliases ? { aliases } : {}),
             ...(opts.preserveDefaultExport ? { preserveDefaultExport: true } : {}),
             ...(opts.toolchainAnchor !== undefined ? { toolchainAnchor: opts.toolchainAnchor } : {}),

package/lib/commands/link.js

@@ -12,7 +12,7 @@
 // step is an install anyway.
 import { existsSync } from 'node:fs';
 import { relative, resolve } from 'node:path';
-import { applyDevLinks, consumerKnownNames, DEV_LINK_FILE, devLinkPath, ensureLocallyIgnored, formatUnbuiltDevLinks, planDevLinks, prepareDevLinks, readDevLinkOverride, removeDevLinkOverride, removeDevLinks, removeLocalIgnore, resolveCheckoutWorkspaces, retireDevLinks, scanDevLinks, unbuiltDevLinks, writeDevLinkOverride, } from '../utils/dev-link.js';
+import { applyDevLinks, consumerKnownNames, consumerNestedPlacements, DEV_LINK_FILE, devLinkPath, ensureLocallyIgnored, formatUnbuiltDevLinks, planDevLinks, prepareDevLinks, readDevLinkOverride, removeDevLinkOverride, removeDevLinks, removeLocalIgnore, resolveCheckoutWorkspaces, retireDevLinks, scanDevLinks, unbuiltDevLinks, writeDevLinkOverride, } from '../utils/dev-link.js';
 export const linkCommand = {
     command: 'link <checkout>',
     description: 'Link this project against a local gjsify checkout for development: its workspace packages replace the installed registry copies, recorded in a git-ignored .gjsify-link.json that every later `gjsify install` re-applies. Undo with `gjsify unlink`.',
@@ -23,7 +23,7 @@ export const linkCommand = {
         demandOption: true,
     })
         .option('packages', {
-        description: "Name glob selecting which of the checkout's workspace packages take part (repeatable; default: all of them). Matched against the package NAME with the same single-segment dialect as `gjsify foreach --include`, so a whole scope is `@gjsify/*` — a bare `*` matches no scoped name. Only packages this project actually depends on are ever linked.",
+        description: "Name glob selecting which of the checkout's workspace packages take part (repeatable; default: all of them). Matched against the package NAME with the same single-segment dialect as `gjsify foreach --include`, so a whole scope is `@gjsify/*` — a bare `*` matches no scoped name. Only packages this project actually uses are linked: declared dependencies plus everything in its lockfile or installed node_modules, transitive and nested copies included.",
         type: 'string',
         array: true,
     })
@@ -50,10 +50,11 @@ export const linkCommand = {
             workspaces,
             patterns,
             knownNames: consumerKnownNames(consumerRoot),
+            nested: consumerNestedPlacements(consumerRoot),
         });
         if (links.length === 0) {
             console.error(`gjsify link: nothing to link — ${checkout} has ${workspaces.length} workspace package(s), ` +
-                `none of which ${consumerRoot} depends on${patterns.length === 0 ? '' : ` and matches ${patterns.join(', ')}`}.\n` +
+                `none of which ${consumerRoot} uses (declared, locked or installed)${patterns.length === 0 ? '' : ` and matches ${patterns.join(', ')}`}.\n` +
                 `A link that links nothing is a silent no-op, so this is an error. Check the --packages ` +
                 `pattern, or run \`gjsify install\` first so the dependency tree exists.`);
             return process.exit(1);

package/lib/commands/ship.js

@@ -52,7 +52,7 @@ import { compileSchemasForPayload, compileSchemasForStage } from '../utils/ship/
 import { buildMsi, MSI_PAYLOAD_DIR } from '../utils/ship/msi.js';
 import { buildZip, zipEntriesFromPayload } from '../utils/ship/zip.js';
 import { assertEntryRunsUnder } from '../utils/ship/entry-interpreter.js';
-import { scanGiRequirements } from '../utils/ship/gi-namespaces.js';
+import { scanGiRequirements } from '@gjsify/rolldown-plugin-gjsify';
 import { assertLauncherMatchesInterpreter, assertPayloadMatchesArch, buildTimestamp, isArchIndependent, linuxInstallDependent, readPayloadFacts, } from '../utils/ship/payload.js';
 import { assertOverlayIsLicensed, planOverlay, planStage } from '../utils/ship/plan.js';
 import { recordedSignature, writeReleaseRecord } from '../utils/ship/release-record.js';

package/lib/config.js

@@ -5,7 +5,7 @@ import { basename, dirname } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { isGjs, hostRuntime } from '@gjsify/rolldown-plugin-gjsify/runtime';
 import { buildAppForRuntime } from './utils/runtimes.js';
-import { DIALECT_APPS, isSourceDialect, SOURCE_DIALECTS } from '@gjsify/rolldown-plugin-gjsify';
+import { assertGiNamespaceEntries, DIALECT_APPS, isSourceDialect, SOURCE_DIALECTS, } from '@gjsify/rolldown-plugin-gjsify';
 import { GI_RENDERER_APPS } from '@gjsify/resolve-npm';
 /**
  * Does the failed `import()` of a config look like a MODULE-RESOLUTION failure
@@ -326,16 +326,10 @@ export class Config {
                 'It selects what an Android APK carries (ADR 0117); every other target resolves ' +
                 '`gi://` against a GI stack the host already has.');
         }
-        for (const entry of configData.nativescript?.giNamespaces ?? []) {
-            // `Ns` or `Ns-Version`, because that is what the AAR builder resolves
-            // against the typelib names in the sysroot. A free-form string here
-            // surfaces as "the prefix has no typelib for …" hours later, naming the
-            // typo rather than the shape.
-            if (!/^[A-Za-z][A-Za-z\d_]*(-\d+(\.\d+)*)?$/.test(entry)) {
-                throw new Error(`gjsify build: nativescript.giNamespaces entry "${entry}" is not a GI namespace. ` +
-                    'Write it as `Gtk` or `Gtk-4.0`.');
-            }
-        }
+        // Shape-checked through the shared helper, because the Vite path accepts the
+        // same key and a check that holds on only one of them is a project that builds
+        // one way and fails the other for a typo.
+        assertGiNamespaceEntries(configData.nativescript?.giNamespaces ?? [], 'gjsify build: nativescript.giNamespaces');
         if (cliArgs.globals !== undefined)
             configData.globals = cliArgs.globals;
         // Fallback applied post-merge (not as a yargs `default:`) so a

package/lib/types/config-data.d.ts

@@ -110,6 +110,16 @@ export interface ConfigData {
      * into a hard build failure.
      */
     giRenderer?: boolean;
+    /**
+     * `--app nativescript`: compile `poDirectory/<lang>.po` into
+     * `locale/<lang>/LC_MESSAGES/<domain>.mo` assets of the app, so the Android GLib gettext
+     * finds them under `<filesDir>/app/locale`. Config-file only (an object has no flag).
+     */
+    nativescriptLocale?: {
+        poDirectory: string;
+        domain: string;
+        localeNames?: Record<string, string[]>;
+    };
     /** Comma-separated global identifiers to register. Format: see CliBuildOptions. */
     globals?: string;
     /**

package/lib/utils/cli-runtime-closure.d.ts

@@ -1,66 +1,4 @@
 import type { Workspace } from '@gjsify/workspace';
-/**
- * Literal module specifiers of `code`: static `import`/`export … from`, plus
- * `import('<literal>')`.
- *
- * acorn rather than a regex — see the header. `allowHashBang` because the CLI's
- * own entry is a bin (`#!/usr/bin/env node`), and a parse failure yields NO
- * specifiers, which under-selects rather than mis-selects.
- */
-export interface SpecifierNode {
-    type?: string;
-    value?: unknown;
-    expressions?: unknown[];
-    quasis?: Array<{
-        value?: {
-            cooked?: unknown;
-        };
-    }>;
-}
-/**
- * The string a node names statically, or `null` when it is computed.
- *
- * A substitution-free TEMPLATE LITERAL is as static as a quoted string, and
- * skipping it is not hypothetical: the minifier rewrites `await
- * import('gi://GLib?version=2.0')` to a backtick form, so a Literal-only reader
- * silently loses every dynamic import in a built bundle.
- *
- * Not named for specifiers, because it does not only read them: the same
- * question is asked of a CALL ARGUMENT by `utils/ship/gi-namespaces.ts`, whose
- * `requireGi("Gtk", "4.0")` carries a namespace and a version in exactly the two
- * spellings above.
- */
-export declare function staticStringValue(node: SpecifierNode | undefined): string | null;
-/** One node of the walk: whatever acorn produced, seen as a bag of properties. */
-export type AstNode = {
-    type?: string;
-} & Record<string, unknown>;
-/**
- * Parse `code` as a module and call `visit` for every node in it.
- *
- * Exported because a SECOND parse is how the two readers of a built bundle
- * would drift apart: {@link moduleSpecifiers} answers "what does this file
- * import" and `utils/ship/gi-namespaces.ts` answers "which GI namespaces does
- * it load", and the second question has an answer the first cannot see — a
- * `--app node` bundle carries no `gi://` specifier at all, only the
- * `requireGi()` calls the bundler rewrote them into. One walker, two readers.
- *
- * A parse failure yields NO nodes rather than throwing: every caller is
- * summarising a file it did not write, and under-selecting is the failure mode
- * that keeps a correct project buildable.
- */
-export declare function walkModuleAst(code: string, visit: (node: AstNode) => void): void;
-/**
- * The module `node` imports from, or `null` when `node` is not an import at all.
- *
- * FOUR node types, in one place. Every reader of a built bundle in this tree asks
- * the same question of the same four — a static `import`, both `export … from`
- * forms and `import()` — and each copy of that list is a chance for one reader to
- * miss a form the others catch. The bare side-effect `import "gi://Soup"` is what
- * that costs when it happens (`utils/ship/gi-namespaces.ts`).
- */
-export declare function importedSpecifier(node: AstNode): string | null;
-export declare function moduleSpecifiers(code: string): string[];
 export interface CliRuntimeClosureOptions {
     /**
      * File to start the walk from. Defaults to the running CLI's Node entry

package/lib/utils/cli-runtime-closure.js

@@ -51,9 +51,9 @@
 // optional PEER dependencies. So the peers of every package in the graph are
 // added: one declaration closes both blind spots, and it stays a declaration the
 // package owns rather than a list this file keeps.
-import * as acorn from 'acorn';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { dirname, join, resolve as resolvePath } from 'node:path';
+import { moduleSpecifiers } from '@gjsify/rolldown-plugin-gjsify';
 import { cliPackageDir } from './publish-headers.js';
 /**
  * Split a bare specifier into a WORKSPACE package name + its `exports` key, or
@@ -78,95 +78,6 @@ function splitWorkspaceSpecifier(specifier, byName) {
     }
     return null;
 }
-/**
- * The string a node names statically, or `null` when it is computed.
- *
- * A substitution-free TEMPLATE LITERAL is as static as a quoted string, and
- * skipping it is not hypothetical: the minifier rewrites `await
- * import('gi://GLib?version=2.0')` to a backtick form, so a Literal-only reader
- * silently loses every dynamic import in a built bundle.
- *
- * Not named for specifiers, because it does not only read them: the same
- * question is asked of a CALL ARGUMENT by `utils/ship/gi-namespaces.ts`, whose
- * `requireGi("Gtk", "4.0")` carries a namespace and a version in exactly the two
- * spellings above.
- */
-export function staticStringValue(node) {
-    if (node?.type === 'Literal')
-        return typeof node.value === 'string' ? node.value : null;
-    if (node?.type === 'TemplateLiteral' && node.expressions?.length === 0) {
-        const cooked = node.quasis?.[0]?.value?.cooked;
-        return typeof cooked === 'string' ? cooked : null;
-    }
-    return null;
-}
-/**
- * Parse `code` as a module and call `visit` for every node in it.
- *
- * Exported because a SECOND parse is how the two readers of a built bundle
- * would drift apart: {@link moduleSpecifiers} answers "what does this file
- * import" and `utils/ship/gi-namespaces.ts` answers "which GI namespaces does
- * it load", and the second question has an answer the first cannot see — a
- * `--app node` bundle carries no `gi://` specifier at all, only the
- * `requireGi()` calls the bundler rewrote them into. One walker, two readers.
- *
- * A parse failure yields NO nodes rather than throwing: every caller is
- * summarising a file it did not write, and under-selecting is the failure mode
- * that keeps a correct project buildable.
- */
-export function walkModuleAst(code, visit) {
-    let ast;
-    try {
-        ast = acorn.parse(code, { ecmaVersion: 'latest', sourceType: 'module', allowHashBang: true });
-    }
-    catch {
-        return;
-    }
-    const descend = (node) => {
-        if (!node || typeof node !== 'object')
-            return;
-        if (Array.isArray(node)) {
-            for (const child of node)
-                descend(child);
-            return;
-        }
-        const n = node;
-        visit(n);
-        for (const [key, value] of Object.entries(n)) {
-            if (key === 'type' || key === 'start' || key === 'end' || key === 'loc')
-                continue;
-            descend(value);
-        }
-    };
-    descend(ast);
-}
-/**
- * The module `node` imports from, or `null` when `node` is not an import at all.
- *
- * FOUR node types, in one place. Every reader of a built bundle in this tree asks
- * the same question of the same four — a static `import`, both `export … from`
- * forms and `import()` — and each copy of that list is a chance for one reader to
- * miss a form the others catch. The bare side-effect `import "gi://Soup"` is what
- * that costs when it happens (`utils/ship/gi-namespaces.ts`).
- */
-export function importedSpecifier(node) {
-    if (node.type !== 'ImportDeclaration' &&
-        node.type !== 'ExportNamedDeclaration' &&
-        node.type !== 'ExportAllDeclaration' &&
-        node.type !== 'ImportExpression') {
-        return null;
-    }
-    return staticStringValue(node.source);
-}
-export function moduleSpecifiers(code) {
-    const out = [];
-    walkModuleAst(code, (node) => {
-        const specifier = importedSpecifier(node);
-        if (specifier !== null)
-            out.push(specifier);
-    });
-    return out;
-}
 /** The file a relative specifier names, probing the extensionless spellings Node accepts. */
 function resolveRelative(fromFile, specifier) {
     const base = resolvePath(dirname(fromFile), specifier);

package/lib/utils/dev-link.d.ts

@@ -83,6 +83,22 @@ export declare function resolveCheckoutWorkspaces(checkout: string, overridePath
  * loads — are covered too).
  */
 export declare function consumerKnownNames(consumerRoot: string): Set<string>;
+/** A package copy that sits below another package's `node_modules`, not at the consumer's top level. */
+export interface NestedPlacement {
+    name: string;
+    /** Absolute path of the copy. */
+    dir: string;
+}
+/**
+ * Real (non-symlink) copies installed below `<consumer>/node_modules/<pkg>/node_modules`.
+ *
+ * Node resolves the nearest copy, so a top-level link alone leaves a nested
+ * registry copy in charge for everything under its parent — the same silent
+ * "testing the published copy" this feature exists to prevent. Only what is on
+ * disk counts: the installer excludes linked names from its fetch set at every
+ * depth, so a nested copy that is not there yet will not appear.
+ */
+export declare function consumerNestedPlacements(consumerRoot: string): NestedPlacement[];
 /**
  * The links an override asks for: the checkout's workspace packages, narrowed by
  * the name globs, INTERSECTED with what the consumer actually depends on.
@@ -98,6 +114,8 @@ export declare function planDevLinks(opts: {
     workspaces: readonly Workspace[];
     patterns: readonly string[];
     knownNames: ReadonlySet<string>;
+    /** Installed copies below another package's `node_modules`; see {@link consumerNestedPlacements}. */
+    nested?: readonly NestedPlacement[];
 }): DevLink[];
 /**
  * Read + validate the override at `consumerRoot` and plan its links, or `null`
@@ -136,9 +154,9 @@ export declare function removeDevLinks(links: readonly DevLink[]): DevLink[];
  * it removed the override (the escape route) before hitting the same abort. Only a
  * hand-written `rm` got the project back.
  *
- * So the ground truth for "what is linked" is the tree, not the file. Reads one
- * level of `node_modules` plus one level into each `@scope/`, which is where
- * top-level links live; `.bin` and real directories are skipped by construction.
+ * So the ground truth for "what is linked" is the tree, not the file. Walks every
+ * `node_modules` level (top-level and nested copies) without following links;
+ * `.bin` and real directories are skipped by construction.
  */
 export declare function scanDevLinks(consumerRoot: string, checkouts: readonly string[]): DevLink[];
 /**

package/lib/utils/dev-link.js

@@ -35,8 +35,8 @@
 // committed lockfile the moment a link is active, which is the one thing this
 // feature promises not to do. `linkedNames` therefore applies after the lockfile
 // is written and only to what gets fetched.
-import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from 'node:fs';
-import { dirname, isAbsolute, join, resolve, sep } from 'node:path';
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { discoverWorkspaces, filterWorkspaces } from '@gjsify/workspace';
 import { linkDirSync } from './dir-link.js';
 import { readPackageJson } from './pkg-json.js';
@@ -179,8 +179,51 @@ export function consumerKnownNames(consumerRoot) {
     }
     for (const pkg of scanPrefix(consumerRoot))
         names.add(pkg.name);
+    // The lockfile answers for a consumer that has not installed yet (or was
+    // cleaned): its keys are the whole resolved closure, transitive packages
+    // included, so a link made before the first install covers them too.
+    for (const name of lockfileNames(consumerRoot))
+        names.add(name);
     return names;
 }
+/** Package names behind the `node_modules/…` keys of `gjsify-lock.json`; empty when unreadable. */
+function lockfileNames(consumerRoot) {
+    try {
+        const lock = JSON.parse(readFileSync(join(consumerRoot, 'gjsify-lock.json'), 'utf-8'));
+        const names = [];
+        for (const key of Object.keys(lock.packages ?? {})) {
+            const at = key.lastIndexOf('node_modules/');
+            if (at !== -1)
+                names.push(key.slice(at + 'node_modules/'.length));
+        }
+        return names;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Real (non-symlink) copies installed below `<consumer>/node_modules/<pkg>/node_modules`.
+ *
+ * Node resolves the nearest copy, so a top-level link alone leaves a nested
+ * registry copy in charge for everything under its parent — the same silent
+ * "testing the published copy" this feature exists to prevent. Only what is on
+ * disk counts: the installer excludes linked names from its fetch set at every
+ * depth, so a nested copy that is not there yet will not appear.
+ */
+export function consumerNestedPlacements(consumerRoot) {
+    const top = join(consumerRoot, 'node_modules') + sep;
+    const nested = [];
+    for (const pkg of scanPrefix(consumerRoot)) {
+        if (pkg.linked)
+            continue;
+        const rel = pkg.dir.startsWith(top) ? pkg.dir.slice(top.length) : '';
+        if (!rel.includes(`${sep}node_modules${sep}`))
+            continue;
+        nested.push({ name: pkg.name, dir: pkg.dir });
+    }
+    return nested;
+}
 /**
  * The links an override asks for: the checkout's workspace packages, narrowed by
  * the name globs, INTERSECTED with what the consumer actually depends on.
@@ -209,7 +252,19 @@ export function planDevLinks(opts) {
             linkPath: join(opts.consumerRoot, 'node_modules', ws.name),
         });
     }
-    links.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    // A nested copy under a package that is itself being linked disappears with
+    // that package's directory and resolves into the checkout's own tree instead.
+    const topLevel = links.map((l) => l.linkPath + sep);
+    const byName = new Map(links.map((l) => [l.name, l]));
+    for (const copy of opts.nested ?? []) {
+        const link = byName.get(copy.name);
+        if (!link)
+            continue;
+        if (topLevel.some((prefix) => copy.dir.startsWith(prefix)))
+            continue;
+        links.push({ name: copy.name, target: link.target, linkPath: copy.dir });
+    }
+    links.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : a.linkPath < b.linkPath ? -1 : a.linkPath > b.linkPath ? 1 : 0);
     return links;
 }
 /**
@@ -228,6 +283,7 @@ export function prepareDevLinks(consumerRoot) {
         workspaces,
         patterns: override.packages,
         knownNames: consumerKnownNames(consumerRoot),
+        nested: consumerNestedPlacements(consumerRoot),
     });
     return {
         overridePath,
@@ -325,9 +381,9 @@ function linkAlreadyPointsAt(linkPath, target) {
  * it removed the override (the escape route) before hitting the same abort. Only a
  * hand-written `rm` got the project back.
  *
- * So the ground truth for "what is linked" is the tree, not the file. Reads one
- * level of `node_modules` plus one level into each `@scope/`, which is where
- * top-level links live; `.bin` and real directories are skipped by construction.
+ * So the ground truth for "what is linked" is the tree, not the file. Walks every
+ * `node_modules` level (top-level and nested copies) without following links;
+ * `.bin` and real directories are skipped by construction.
  */
 export function scanDevLinks(consumerRoot, checkouts) {
     const roots = [];
@@ -343,50 +399,31 @@ export function scanDevLinks(consumerRoot, checkouts) {
     }
     if (roots.length === 0)
         return [];
-    const nodeModules = join(consumerRoot, 'node_modules');
+    // Every depth: `assertNodeModulesDest` aborts on a link out of `node_modules`
+    // wherever it sits, and `scanPrefix` never descends into a link itself.
     const found = [];
-    const consider = (name) => {
-        const linkPath = join(nodeModules, name);
+    for (const pkg of scanPrefix(consumerRoot)) {
+        if (!pkg.linked)
+            continue;
         let target;
         try {
-            if (!lstatSync(linkPath).isSymbolicLink())
-                return;
-            target = realpathSync(linkPath);
+            target = realpathSync(pkg.dir);
         }
         catch {
-            return;
+            continue;
         }
         if (!roots.some((root) => target === root || target.startsWith(root + sep)))
-            return;
-        found.push({ name, target, linkPath });
-    };
-    let entries;
-    try {
-        entries = readdirSync(nodeModules);
-    }
-    catch {
-        return [];
-    }
-    for (const entry of entries) {
-        if (entry.startsWith('.'))
             continue;
-        if (entry.startsWith('@')) {
-            let scoped;
-            try {
-                scoped = readdirSync(join(nodeModules, entry));
-            }
-            catch {
-                continue;
-            }
-            for (const inner of scoped)
-                consider(`${entry}/${inner}`);
-            continue;
-        }
-        consider(entry);
+        found.push({ name: packageNameAt(consumerRoot, pkg.dir), target, linkPath: pkg.dir });
     }
-    found.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    found.sort((a, b) => (a.linkPath < b.linkPath ? -1 : a.linkPath > b.linkPath ? 1 : 0));
     return found;
 }
+/** `@scope/name` of the last `node_modules/` segment in `dir`. */
+function packageNameAt(consumerRoot, dir) {
+    const rel = relative(consumerRoot, dir).split(sep).join('/');
+    return rel.slice(rel.lastIndexOf('node_modules/') + 'node_modules/'.length);
+}
 /**
  * Remove every dev link into `checkouts` that `keep` does not name.
  *

package/lib/utils/ship/entry-interpreter.js

@@ -45,7 +45,7 @@
 // WHY A REFUSAL AND NOT A WARNING. There is no reading of this artifact under
 // which it works. A warning at the end of a `ship` run competes with the
 // artifact path printed beside it, and the artifact is what gets uploaded.
-import { importedSpecifier, walkModuleAst } from '../cli-runtime-closure.js';
+import { importedSpecifier, walkModuleAst } from '@gjsify/rolldown-plugin-gjsify';
 /**
  * The GJS built-in modules, which are bare specifiers rather than a scheme.
  *

package/lib/utils/ship/signing.d.ts

@@ -66,6 +66,31 @@ export interface SignerDescriptor {
     /** What a signature from this signer does NOT yet cover — printed once per run. */
     gap: string;
 }
+/**
+ * An explicit `--identifier` for an image whose FILE NAME is not ASCII, or
+ * `undefined` when codesign's own default is already right.
+ *
+ * WHY THIS EXISTS, measured on macOS 2026-10-30 (steuererklaerung CI run
+ * 41050980433, plus mini bundles beside it): the darwin layout puts the
+ * interpreter at `Contents/Helpers/<display name>`, so an app called
+ * "Steuererklärung" carries a non-ASCII leaf. codesign derives an image's code
+ * identifier from that file name; with a NAMED identity the designated
+ * requirement becomes `identifier "<derived>" and certificate leaf …`, and
+ * `codesign --verify --strict <App>.app` then fails with *"the sealed resource
+ * directory is invalid"* for the NFD-derived identifier (`…61cc88…`); why
+ * codesign rejects it is not established, only that it does. Ad-hoc (a cdhash
+ * requirement, no identifier at all) and ASCII names are unaffected; the same
+ * bundle with `--identifier eu.test.x.helper` verifies, and an NFC identifier
+ * still does not, so the value has to be plain ASCII rather than merely
+ * normalised.
+ *
+ * Hence: an ASCII leaf keeps codesign's default (this returns `undefined` and
+ * the flag is not sent, so every name that already worked is unchanged), and
+ * only a non-ASCII leaf gets a stable ASCII identifier. NFD first, so a
+ * precomposed "ä" and a decomposed "a"+U+0308 fold to the same value instead of
+ * to two identifiers that differ by bytes nobody can see.
+ */
+export declare function asciiCodesignIdentifier(fileName: string): string | undefined;
 /**
  * The signers, keyed by the LAYOUT they sign — never by the host they run on.
  *
@@ -156,6 +181,17 @@ export interface SignArgs {
     entitlements?: string;
     /** Is {@link identity} the reserved ad-hoc `-`? */
     adhoc: boolean;
+    /**
+     * Is {@link file} the bundle DIRECTORY being sealed, rather than one image
+     * inside it?
+     *
+     * A signer needs the distinction because the two invocations are not the
+     * same operation on the same kind of object: a bundle takes its identifier
+     * from `Info.plist` and must never be given one, while an image's identifier
+     * is derived from its own file name — which is where a non-ASCII helper name
+     * becomes a problem ({@link asciiCodesignIdentifier}).
+     */
+    seal: boolean;
 }
 /** `codesign --sign -`: the one identity value that names no identity at all. */
 export declare const ADHOC_IDENTITY = "-";