@gjsify/cli 0.64.12 → 0.64.13

package/lib/utils/ship/signing.js

@@ -74,13 +74,57 @@
 // ad-hoc answer, and § A4's re-sign of every image stays the design of record for
 // the Developer ID that notarisation will actually require.
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join, sep } from 'node:path';
+import { basename, dirname, join, sep } from 'node:path';
 import { isOnPath } from '../check-system-deps.js';
 import { describeExit, spawnToCompletion } from '../spawn.js';
 import { listFilesRecursive } from './discover.js';
 import { classifyBinary } from './payload.js';
 import { renderEntitlements } from './plist.js';
 import { writePayload } from './stage-writer.js';
+/**
+ * An explicit `--identifier` for an image whose FILE NAME is not ASCII, or
+ * `undefined` when codesign's own default is already right.
+ *
+ * WHY THIS EXISTS, measured on macOS 2026-10-30 (steuererklaerung CI run
+ * 41050980433, plus mini bundles beside it): the darwin layout puts the
+ * interpreter at `Contents/Helpers/<display name>`, so an app called
+ * "Steuererklärung" carries a non-ASCII leaf. codesign derives an image's code
+ * identifier from that file name; with a NAMED identity the designated
+ * requirement becomes `identifier "<derived>" and certificate leaf …`, and
+ * `codesign --verify --strict <App>.app` then fails with *"the sealed resource
+ * directory is invalid"* for the NFD-derived identifier (`…61cc88…`); why
+ * codesign rejects it is not established, only that it does. Ad-hoc (a cdhash
+ * requirement, no identifier at all) and ASCII names are unaffected; the same
+ * bundle with `--identifier eu.test.x.helper` verifies, and an NFC identifier
+ * still does not, so the value has to be plain ASCII rather than merely
+ * normalised.
+ *
+ * Hence: an ASCII leaf keeps codesign's default (this returns `undefined` and
+ * the flag is not sent, so every name that already worked is unchanged), and
+ * only a non-ASCII leaf gets a stable ASCII identifier. NFD first, so a
+ * precomposed "ä" and a decomposed "a"+U+0308 fold to the same value instead of
+ * to two identifiers that differ by bytes nobody can see.
+ */
+export function asciiCodesignIdentifier(fileName) {
+    // `fileName` may be a path, and codesign derives the identifier from the
+    // LEAF — so both the ASCII test and the fallback bytes are about the leaf.
+    const leaf = basename(fileName);
+    if ([...leaf].every((char) => (char.codePointAt(0) ?? 0) < 0x80))
+        return undefined;
+    const slug = leaf
+        .normalize('NFD')
+        .replace(/\p{M}+/gu, '')
+        .replace(/[^A-Za-z0-9.-]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    if (/[A-Za-z0-9]/.test(slug))
+        return slug;
+    // Nothing Latin survives (a name that is entirely CJK or emoji): a readable
+    // slug would be the empty string, which is not an identifier, so the UTF-8
+    // bytes are spelled out — ASCII, unique, and reproducible from the name it
+    // came from.
+    const bytes = new TextEncoder().encode(leaf);
+    return `x-${[...bytes].map((byte) => byte.toString(16).padStart(2, '0')).join('')}`;
+}
 /**
  * The signers, keyed by the LAYOUT they sign — never by the host they run on.
  *
@@ -116,16 +160,25 @@ export const SIGNERS = {
         // the timestamp authority service cannot be contacted … the signing
         // operation will fail", which is not a failure worth inventing for a
         // signature that cannot carry the result.
-        args: ({ identity, file, entitlements, adhoc }) => [
-            '--force',
-            '--sign',
-            identity,
-            '--options',
-            'runtime',
-            ...(entitlements === undefined ? [] : ['--entitlements', entitlements]),
-            ...(adhoc ? [] : ['--timestamp']),
-            file,
-        ],
+        args: ({ identity, file, entitlements, adhoc, seal }) => {
+            // A non-ASCII leaf gets an explicit ASCII identifier — see
+            // {@link asciiCodesignIdentifier}. NEVER for the seal: the bundle
+            // takes its identifier from `CFBundleIdentifier` in `Info.plist`,
+            // and overriding that would make the seal disagree with the bundle
+            // the system reads.
+            const derived = seal ? undefined : asciiCodesignIdentifier(file);
+            return [
+                '--force',
+                '--sign',
+                identity,
+                '--options',
+                'runtime',
+                ...(entitlements === undefined ? [] : ['--entitlements', entitlements]),
+                ...(adhoc ? [] : ['--timestamp']),
+                ...(derived === undefined ? [] : ['--identifier', derived]),
+                file,
+            ];
+        },
         // FIVE OF THE REFERENCE'S SIX for an ad-hoc identity, FOUR for a real one,
         // and the difference is the one § A16 left open — now MEASURED, on
         // darwin-arm64 with the published `@gjsify/gtk-runtime-darwin-arm64` staged
@@ -182,7 +235,9 @@ export const SIGNERS = {
         gap: 'the images are signed and the bundle is sealed, and the seal survives both the `.zip` and the ' +
             '`.dmg` round trip; § A16 stands measured in ONE direction only — library validation refuses an ' +
             'ad-hoc-signed dylib, so the ad-hoc identity grants `disable-library-validation` while a named ' +
-            'one does not, and no run in this repository has ever held the named one',
+            'one does not; a named Developer ID was signed and notarised on 2026-10-30 for an ASCII-named ' +
+            'app, and a non-ASCII image name verifies only with the explicit ASCII `--identifier` this ' +
+            'signer now passes',
     },
     win32: {
         layoutOs: 'win32',
@@ -335,8 +390,14 @@ export async function signPayload(input) {
         writeFileSync(input.entitlementsPath, renderEntitlements(granted));
         entitlements = input.entitlementsPath;
     }
-    const run = async (file, what) => {
-        const args = signer.args({ identity: input.identity, file, adhoc, ...(entitlements ? { entitlements } : {}) });
+    const run = async (file, what, seal) => {
+        const args = signer.args({
+            identity: input.identity,
+            file,
+            adhoc,
+            seal,
+            ...(entitlements ? { entitlements } : {}),
+        });
         if (input.verbose)
             input.log(`${signer.tool} ${args.join(' ')}`);
         const result = await spawnToCompletion(signer.tool, args, {
@@ -367,7 +428,7 @@ export async function signPayload(input) {
         return [...payload];
     }
     for (const entry of signable) {
-        await run(join(workDir, entry.path.split('/').join(sep)), entry.path);
+        await run(join(workDir, entry.path.split('/').join(sep)), entry.path, false);
     }
     // THE IMAGES FIRST, THE SEAL LAST, and the order is not stylistic: a bundle
     // seal hashes the files it seals, so sealing before the closure is signed
@@ -381,7 +442,7 @@ export async function signPayload(input) {
                 'stage would sign the payload of every other format beside it.');
         }
         sealPrefix = signer.sealAddPrefix(input.bundleRoot);
-        await run(join(workDir, input.bundleRoot.split('/').join(sep)), `${input.bundleRoot} (bundle seal)`);
+        await run(join(workDir, input.bundleRoot.split('/').join(sep)), `${input.bundleRoot} (bundle seal)`, true);
     }
     // THE FILE SET MAY ONLY GROW WHERE THE SEAL WRITES. Both tools rewrite an
     // image in place, so any other new path means something else ran — and a file

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.64.12",
+    "version": "0.64.13",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -142,22 +142,22 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/blueprint": "^0.64.12",
-        "@gjsify/buffer": "^0.64.12",
-        "@gjsify/create-app": "^0.64.12",
-        "@gjsify/node-globals": "^0.64.12",
-        "@gjsify/node-polyfills": "^0.64.12",
-        "@gjsify/npm-registry": "^0.64.12",
-        "@gjsify/resolve-npm": "^0.64.12",
-        "@gjsify/rolldown-plugin-gjsify": "^0.64.12",
-        "@gjsify/vite-plugin-blueprint": "^0.64.12",
-        "@gjsify/rolldown-plugin-pnp": "^0.64.12",
-        "@gjsify/semver": "^0.64.12",
-        "@gjsify/tar": "^0.64.12",
-        "@gjsify/tsc": "^0.64.12",
-        "@gjsify/utils": "^0.64.12",
-        "@gjsify/web-polyfills": "^0.64.12",
-        "@gjsify/workspace": "^0.64.12",
+        "@gjsify/blueprint": "^0.64.13",
+        "@gjsify/buffer": "^0.64.13",
+        "@gjsify/create-app": "^0.64.13",
+        "@gjsify/node-globals": "^0.64.13",
+        "@gjsify/node-polyfills": "^0.64.13",
+        "@gjsify/npm-registry": "^0.64.13",
+        "@gjsify/resolve-npm": "^0.64.13",
+        "@gjsify/rolldown-plugin-gjsify": "^0.64.13",
+        "@gjsify/vite-plugin-blueprint": "^0.64.13",
+        "@gjsify/rolldown-plugin-pnp": "^0.64.13",
+        "@gjsify/semver": "^0.64.13",
+        "@gjsify/tar": "^0.64.13",
+        "@gjsify/tsc": "^0.64.13",
+        "@gjsify/utils": "^0.64.13",
+        "@gjsify/web-polyfills": "^0.64.13",
+        "@gjsify/workspace": "^0.64.13",
         "acorn": "^8.17.0",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
@@ -166,13 +166,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.64.12",
+        "@gjsify/unit": "^0.64.13",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.64.12",
-        "@gjsify/rolldown-native": "^0.64.12"
+        "@gjsify/oxfmt-native": "^0.64.13",
+        "@gjsify/rolldown-native": "^0.64.13"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {

package/lib/utils/ship/gi-namespaces.d.ts

@@ -1,23 +0,0 @@
-/**
- * What a bundle loads, split by whether the host must provide it.
- *
- * `namespaces` is the union — the same answer {@link scanGiNamespaces} has always
- * given — and `optional` is the subset the artifact itself marks optional. A namespace
- * in both is still a hard dependency as far as anything else is concerned: the
- * importer asked for it both ways, and only one of those edges degrades.
- */
-export interface GiRequirements {
-    /** Every GI namespace the bundle loads, `Ns-Version` where a specifier pins one. */
-    namespaces: string[];
-    /** The subset carrying the bundler's optional marker — absent is not fatal. */
-    optional: string[];
-}
-/**
- * Extract the GI namespaces a bundle imports, as `Ns-Version` when the
- * specifier pins one and bare `Ns` when it does not.
- */
-export declare function scanGiNamespaces(source: string): string[];
-/** {@link scanGiNamespaces}, plus which of them the artifact marks optional (ADR 0087). */
-export declare function scanGiRequirements(source: string): GiRequirements;
-/** `gi://Gtk?version=4.0` → `Gtk-4.0`; `gi://Gtk` → `Gtk`; anything else → null. */
-export declare function parseGiSpecifier(specifier: string): string | null;

package/lib/utils/ship/gi-namespaces.js

@@ -1,275 +0,0 @@
-// Which GI namespaces does this bundle actually load?
-//
-// Read off the EMITTED bundle, because that is the file that gets installed —
-// and the emitted form is not one form but two, which is the correction this
-// header carries. Under `--app gjs`, `gi://` is a real module protocol, so the
-// bundler keeps those specifiers in the output verbatim
-// (`rolldown-plugin-gjsify`'s externals plugin) and the artifact carries its own
-// dependency list. Under `--app node` there is no such protocol:
-// `gjsGiNodePlugin` rewrites every `gi://Ns?version=X` into a shim whose body is
-// `require('@gjsify/node-gi/gi').requireGi("Ns", "X")`, so the specifier this
-// scanner was written to find is gone from the file by construction.
-//
-// WHAT THAT COST, and why reading one form is not "mostly right": these
-// namespaces are what `depends.ts` maps to `gir1.2-gtk-4.0` and friends
-// (ADR 0024 § 6). A `--app node` project therefore derived an EMPTY typelib
-// dependency set — the package installed cleanly and died at its first GI call,
-// which is the same failure the bare-side-effect-import fix below was written to
-// prevent, arriving again through the other build target. Nothing caught it
-// because every ship fixture's "node bundle" was hand-written with `gi://`
-// imports in it: a shape `gjsify build --app node` cannot emit and node cannot
-// run.
-//
-// PARSED, not pattern-matched, and the first version of this file is why. A
-// regex over the bundle text got it wrong in both directions at once:
-//
-//   * it missed `import "gi://Soup?version=3.0"` — the bare side-effect form,
-//     which is exactly what `@gjsify/fetch` puts at the top of every bundle
-//     that pulls it. The package would have shipped without libsoup, installed
-//     cleanly, and died at the first request.
-//   * it matched `gi://…` inside a diagnostic STRING containing the word
-//     `from`, and since an unmapped namespace fails the build, that made a
-//     correct project unbuildable.
-//
-// `walkModuleAst` answers both questions in ONE pass, and it is the same acorn
-// pass the CLI already uses to compute its own runtime closure — so there is one
-// definition of "what does this file import" rather than two.
-//
-// HARD OR OPTIONAL, since ADR 0087: a `gi://Ns?version=X&optional` import still
-// appears in the emitted file, so this scanner still reports its namespace — and
-// `depends.ts` has to know it may be absent. The discriminator is the marker
-// statement the bundler's own optional shim emits (`GI_OPTIONAL_MARKER`, imported
-// from the plugin that writes it rather than restated here). NOT the `import()`
-// SHAPE, which was the tempting reading of the same file: an app that writes its own
-// `await import('gi://Goa')` without the flag must stay a HARD dependency, and
-// classifying it as optional would move a package the host must have out of its
-// `Depends:` — the failure this whole chain exists to prevent, reached from the other
-// direction.
-import { GI_OPTIONAL_MARKER } from '@gjsify/rolldown-plugin-gjsify';
-import { importedSpecifier, staticStringValue, walkModuleAst, } from '../cli-runtime-closure.js';
-/** The module a `--app node` bundle reaches GI through. */
-const NODE_GI_MODULE = '@gjsify/node-gi/gi';
-/** Namespaces are GI identifiers; anything else is a call this reader misread. */
-const NAMESPACE = /^[A-Za-z][A-Za-z\d_]*$/;
-/**
- * Extract the GI namespaces a bundle imports, as `Ns-Version` when the
- * specifier pins one and bare `Ns` when it does not.
- */
-export function scanGiNamespaces(source) {
-    return scanGiRequirements(source).namespaces;
-}
-/** {@link scanGiNamespaces}, plus which of them the artifact marks optional (ADR 0087). */
-export function scanGiRequirements(source) {
-    const found = new Set();
-    const optional = new Set();
-    // TWO SETS, because the two kinds of binding are not interchangeable and
-    // treating them as one over-approximated on a real minified bundle. A
-    // namespace object (`import * as gi`) and a required module object are only
-    // ever the OBJECT of `.requireGi(…)`: calling a module namespace is a
-    // TypeError, so a bare `gi(…)` is never one of ours. Only `requireGi` itself
-    // — the named import, or the default export, which IS `requireGi` — is
-    // callable on its own.
-    //
-    // Measured on `gjsify build --app node` (minify is the DEFAULT): a file with
-    // `import * as gi from '@gjsify/node-gi/gi'` and a callback parameter emitted
-    // as `function render(e,t){return e(t)+e(\`Zzqfoo\`)}` — where the minifier
-    // gave the import and the parameter the SAME short name in different scopes.
-    // Read as one set, `e(\`Zzqfoo\`)` became the namespace `Zzqfoo`, and
-    // `deriveDepends` then refused to package a correct project.
-    const callable = new Set();
-    const objects = new Set();
-    const calls = [];
-    walkModuleAst(source, (node) => {
-        const specifier = importedSpecifier(node);
-        if (specifier !== null) {
-            const key = parseGiSpecifier(specifier);
-            if (key !== null)
-                found.add(key);
-            if (node.type === 'ImportDeclaration' && specifier === NODE_GI_MODULE) {
-                collectNodeGiBindings(node, callable, objects);
-            }
-            return;
-        }
-        if (node.type === 'VariableDeclarator' && loadsNodeGiModule(node.init)) {
-            const id = node.id;
-            // An OBJECT: `const gi = require('@gjsify/node-gi/gi')` is the module,
-            // reached as `gi.requireGi(…)` and never called directly.
-            if (id?.type === 'Identifier' && typeof id.name === 'string')
-                objects.add(id.name);
-            return;
-        }
-        // Collected rather than resolved in place: a call can precede the
-        // `require` that binds its callee (the shim's `load()` is hoisted above
-        // nothing, but a minifier is free to reorder declarations), so the
-        // binding set has to be complete before any call is judged.
-        if (node.type === 'CallExpression')
-            calls.push(node);
-    });
-    for (const call of calls) {
-        const marker = optionalMarkerNamespace(call);
-        if (marker !== null) {
-            optional.add(marker);
-            continue;
-        }
-        const key = requireGiNamespace(call, callable, objects);
-        if (key !== null)
-            found.add(key);
-    }
-    return { namespaces: [...found].sort(), optional: [...optional].filter((ns) => found.has(ns)).sort() };
-}
-/**
- * The namespace an optional-marker call names, or `null` when this is not one.
- *
- * The shape is the bundler's: `globalThis[Symbol.for(GI_OPTIONAL_MARKER)]?.("Ns", "X")`,
- * matched on BOTH halves rather than on the whole statement — the minifier rewrites
- * the string literals to backticks and the optional call to a `ChainExpression`
- * around the `CallExpression` this walk still reaches, and a plain call (a host that
- * has a handler the minifier could prove is non-null) reads the same way.
- */
-function optionalMarkerNamespace(call) {
-    const callee = call.callee;
-    if (callee?.type !== 'MemberExpression' || callee.computed !== true)
-        return null;
-    // `globalThis[Symbol.for(KEY)]` — a computed member whose PROPERTY is the
-    // `Symbol.for` call, so the key is an argument of that inner call rather than
-    // of the outer one. Verified against acorn's own shape: `optional` chaining
-    // wraps the whole thing in a `ChainExpression`, which the walk descends into,
-    // so the `CallExpression` reaches this function either way.
-    const keyCall = callee.property;
-    if (keyCall?.type !== 'CallExpression')
-        return null;
-    const keyCallee = keyCall.callee;
-    const keyObject = keyCallee?.type === 'MemberExpression' ? keyCallee.object : undefined;
-    const keyProperty = keyCallee?.type === 'MemberExpression' ? keyCallee.property : undefined;
-    if (keyObject?.type !== 'Identifier' || keyObject.name !== 'Symbol')
-        return null;
-    if (keyProperty?.type !== 'Identifier' || keyProperty.name !== 'for')
-        return null;
-    const keyArgs = keyCall.arguments ?? [];
-    if (staticStringValue(keyArgs[0]) !== GI_OPTIONAL_MARKER)
-        return null;
-    const host = callee.object;
-    if (host?.type !== 'Identifier' || host.name !== 'globalThis')
-        return null;
-    const args = call.arguments ?? [];
-    const namespace = staticStringValue(args[0]);
-    if (namespace === null || !NAMESPACE.test(namespace))
-        return null;
-    const version = staticStringValue(args[1]);
-    return version === null || version === '' ? namespace : `${namespace}-${version}`;
-}
-/** `gi://Gtk?version=4.0` → `Gtk-4.0`; `gi://Gtk` → `Gtk`; anything else → null. */
-export function parseGiSpecifier(specifier) {
-    if (!specifier.startsWith('gi://'))
-        return null;
-    const rest = specifier.slice('gi://'.length);
-    const [namespace, query] = rest.split('?', 2);
-    if (namespace === undefined || !NAMESPACE.test(namespace))
-        return null;
-    if (query === undefined)
-        return namespace;
-    const version = /(?:^|&)version=([^&]+)/.exec(query)?.[1];
-    return version === undefined ? namespace : `${namespace}-${version}`;
-}
-/**
- * What an `import … from '@gjsify/node-gi/gi'` binds, split by what it can BE.
- *
- * All three spellings appear in real code and the default export IS `requireGi`
- * (`packages/node-gi/node-gi/gi.d.ts`), so the named import (under any local
- * name — `import { requireGi as gi }` renames it) and the default import are
- * CALLABLE. A namespace import is not: calling a module namespace object throws,
- * so it can only ever be the object of `.requireGi(…)`, and putting it in the
- * callable set is what let a minified callback parameter of the same name be
- * read as a `requireGi` call.
- */
-function collectNodeGiBindings(node, callable, objects) {
-    const specifiers = node.specifiers ?? [];
-    for (const specifier of specifiers) {
-        const local = specifier.local;
-        if (local?.type !== 'Identifier' || typeof local.name !== 'string')
-            continue;
-        const imported = specifier.imported;
-        if (specifier.type === 'ImportNamespaceSpecifier')
-            objects.add(local.name);
-        else if (specifier.type === 'ImportDefaultSpecifier')
-            callable.add(local.name);
-        else if (imported?.type === 'Identifier' && imported.name === 'requireGi')
-            callable.add(local.name);
-    }
-}
-/**
- * A call that LOADS `@gjsify/node-gi/gi` — recognised by its argument, never by
- * the name of the callee.
- *
- * THE CALLEE NAME DOES NOT SURVIVE BUNDLING, and reading it is how the first cut
- * of this function passed its own tests while answering `[]` for every real
- * artifact. Measured on `gjsify build --app node` output for a two-import app,
- * which is the exact input this module exists to read:
- *
- *     unminified   const require$1 = createRequire(import.meta.url);
- *                  … require$1("@gjsify/node-gi/gi").requireGi("Gtk", "4.0")
- *     minified     const n = e(import.meta.url);
- *                  … n(`@gjsify/node-gi/gi`).requireGi(`Gtk`, `4.0`)
- *
- * Two shims in one bundle means two `require` bindings, so the second is renamed
- * even without `--minify` (which is the DEFAULT). A reader keyed on the
- * identifier `require` therefore loses one namespace unminified and both
- * minified — silently, since an empty namespace list is a legal answer.
- *
- * The module STRING is what survives every rename, and it is a precise
- * discriminator: a call taking `'@gjsify/node-gi/gi'` as its first argument is a
- * load of that module under any name a bundler gives the loader.
- */
-function loadsNodeGiModule(node) {
-    if (!node || typeof node !== 'object')
-        return false;
-    const call = node;
-    if (call.type !== 'CallExpression')
-        return false;
-    const args = call.arguments ?? [];
-    return staticStringValue(args[0]) === NODE_GI_MODULE;
-}
-/**
- * The namespace a `requireGi(…)` call names, or `null` when this is not one.
- *
- * BINDING-TRACED rather than name-matched, and the asymmetry is deliberate: a
- * bare `.requireGi(…)` on any object would over-approximate, and
- * over-approximating is NOT the harmless direction here — an unmapped namespace
- * fails the build, so a foreign method sharing the name would make a correct
- * project unpackageable. Every accepted shape traces back to an import or
- * require of `@gjsify/node-gi/gi` in this same file, which is what a bundle
- * always has: the shim carries its own `require`, and a hand-written node-gi app
- * carries its own import.
- *
- * Shadowing is the one gap left, and the split above is what makes it small.
- * This reader has no scope analysis, so a local binding that reuses the name of
- * the CALLABLE import — `requireGi` itself, or the default import — and is called
- * with a GI-shaped string literal would still be read as one. A minifier can
- * manufacture exactly that collision, which is why the two shapes it produces
- * most (the namespace object and the required module object) are the two that no
- * longer count as callees.
- */
-function requireGiNamespace(call, callable, objects) {
-    const callee = call.callee;
-    let reached = false;
-    if (callee?.type === 'Identifier') {
-        reached = typeof callee.name === 'string' && callable.has(callee.name);
-    }
-    else if (callee?.type === 'MemberExpression' && callee.computed !== true) {
-        const property = callee.property;
-        if (property?.type !== 'Identifier' || property.name !== 'requireGi')
-            return null;
-        const object = callee.object;
-        reached =
-            loadsNodeGiModule(object) ||
-                (object?.type === 'Identifier' && typeof object.name === 'string' && objects.has(object.name));
-    }
-    if (!reached)
-        return null;
-    const args = call.arguments ?? [];
-    const namespace = staticStringValue(args[0]);
-    if (namespace === null || !NAMESPACE.test(namespace))
-        return null;
-    const version = staticStringValue(args[1]);
-    return version === null ? namespace : `${namespace}-${version}`;
-}

package/lib/utils/ship/gi-selection.d.ts

@@ -1,18 +0,0 @@
-/** What {@link planGiSelection} decided, and what it wants the build to say out loud. */
-export interface GiSelection {
-    /** The namespaces to hand the AAR builder, as the config spells them, deduped and sorted. */
-    selected: string[];
-    /** Declared but not found in the bundle — worth a warning, never a refusal. */
-    unscanned: string[];
-}
-/**
- * Reconcile the configured namespace set with the one the emitted bundle imports.
- *
- * @param spec.declared `nativescript.giNamespaces`, as `Ns` or `Ns-Version`
- * @param spec.scanned what {@link scanGiNamespaces} read off the emitted bundle
- * @throws when the bundle imports a namespace the config does not cover
- */
-export declare function planGiSelection({ declared, scanned }: {
-    declared: string[];
-    scanned: string[];
-}): GiSelection;

package/lib/utils/ship/gi-selection.js

@@ -1,73 +0,0 @@
-// Which GI namespaces does this Android APK carry? — ADR 0117 § 2, the CLI half.
-//
-// THE CONFIG DECIDES AND THE BUNDLE IS CHECKED AGAINST IT, which is the asymmetry
-// the ADR turns on. The payload is cross-compiled hours earlier by
-// `build-gi-runtime-android.mjs` against a sha256-pinned sysroot; nothing at app-build
-// time can conjure a typelib that is not in it. So the config is the input, and the
-// scan of the emitted bundle is the EVIDENCE that the input is complete.
-//
-// The scan is a LOWER BOUND, and the two directions of disagreement are therefore not
-// symmetric:
-//
-//   * IMPORTED, NOT CONFIGURED → build error naming the namespace. The scanner found a
-//     real import; the APK will not have the typelib; the device throws at that import,
-//     after the download, reading like an application bug. This is the same failure
-//     `deriveDepends` refuses for distro packages (ADR 0024 § 6), reached from Android.
-//   * CONFIGURED, NOT IMPORTED → warning. `scanGiNamespaces` reads the emitted file and
-//     cannot see a namespace reached through a computed specifier, nor one loaded by a
-//     native dependency. Refusing here would make a correct project unbuildable on the
-//     scanner's blind spot — so it reports a probably-larger-than-necessary APK and
-//     builds it.
-//
-// COMPARED BY NAMESPACE, NOT BY STRING. A config may pin an ABI (`Gtk-4.0`) where the
-// bundle's specifier carries no version (`import 'gi://Gtk'`), and vice versa. Both
-// sides mean the same namespace, and string equality would fail a correct project on
-// the spelling.
-/** `Gtk-4.0` → `Gtk`; `Gtk` → `Gtk`. */
-function namespaceOf(entry) {
-    const dash = entry.indexOf('-');
-    return dash === -1 ? entry : entry.slice(0, dash);
-}
-/**
- * The namespaces every AAR carries whether or not anything declares them.
- *
- * These back `libnode_gi.so` itself, so they are in the payload's DT_NEEDED closure
- * before any selection happens (ADR 0110's measured core set). Demanding them in the
- * config would make the key boilerplate and fail every project that exists today, for
- * a selection that cannot change the bytes.
- */
-const ALWAYS_PRESENT = new Set(['GLib', 'GObject', 'Gio', 'GioUnix', 'GLibUnix', 'GModule', 'GIRepository']);
-/**
- * Reconcile the configured namespace set with the one the emitted bundle imports.
- *
- * @param spec.declared `nativescript.giNamespaces`, as `Ns` or `Ns-Version`
- * @param spec.scanned what {@link scanGiNamespaces} read off the emitted bundle
- * @throws when the bundle imports a namespace the config does not cover
- */
-export function planGiSelection({ declared, scanned }) {
-    // A bare and a pinned declaration of one namespace are one selection, and the
-    // pinned spelling wins: it says something the bare one does not.
-    const byNamespace = new Map();
-    for (const entry of declared) {
-        const ns = namespaceOf(entry);
-        const held = byNamespace.get(ns);
-        if (held === undefined || (held === ns && entry !== ns))
-            byNamespace.set(ns, entry);
-    }
-    const missing = [
-        ...new Set(scanned.map(namespaceOf).filter((ns) => !byNamespace.has(ns) && !ALWAYS_PRESENT.has(ns))),
-    ].sort();
-    if (missing.length > 0) {
-        throw new Error(`The bundle imports ${missing.join(', ')}, which nativescript.giNamespaces does not declare. ` +
-            'An Android APK carries only the typelibs the config selects (ADR 0117), so this would ' +
-            `install and then throw at the import. Add ${missing.length === 1 ? 'it' : 'them'} to ` +
-            'nativescript.giNamespaces, or stop importing ' +
-            `${missing.length === 1 ? 'it' : 'them'}.`);
-    }
-    const seen = new Set(scanned.map(namespaceOf));
-    const unscanned = [...byNamespace.entries()]
-        .filter(([ns]) => !seen.has(ns))
-        .map(([, entry]) => entry)
-        .sort();
-    return { selected: [...byNamespace.values()].sort(), unscanned };
-}