@gjsify/cli 0.64.13-next.283 → 0.64.14

package/lib/cli-app.js

@@ -18,7 +18,7 @@
 import yargs from 'yargs';
 import { classifyCliFailure } from './cli-fail.js';
 import { cliVersion } from './utils/publish-headers.js';
-import { buildCommand as build, clearCommand as clear, copyCommand as copy, envCommand as env, execCommand as exec, testCommand as test, runCommand as run, infoCommand as info, systemCheckCommand as systemCheck, checkCommand as check, showcaseCommand as showcase, createCommand as create, gresourceCommand as gresource, gettextCommand as gettext, gsettingsCommand as gsettings, flatpakCommand as flatpak, shipCommand as ship, dlxCommand as dlx, installCommand as install, linkCommand as link, unlinkCommand as unlink, foreachCommand as foreach, workspaceCommand as workspace, packCommand as pack, publishCommand as publish, whoamiCommand as whoami, loginCommand as login, logoutCommand as logout, trustCommand as trust, onboardCommand as onboard, selfUpdateCommand as selfUpdate, generateInstallerCommand as generateInstaller, pruneCommand as prune, uninstallCommand as uninstall, formatCommand as format, lintCommand as lint, fixCommand as fix, upgradeCommand as upgrade, barrelsCommand as barrels, tscCommand as tsc, affectedCommand as affected, storybookCommand as storybook, siteCommand as site, devCommand as dev, debugCommand as debug, devtoolsCommand as devtools, browseCommand as browse, webextCommand as webext, blueprintCommand as blueprint, } from './commands/index.js';
+import { buildCommand as build, clearCommand as clear, copyCommand as copy, envCommand as env, execCommand as exec, testCommand as test, runCommand as run, infoCommand as info, systemCheckCommand as systemCheck, checkCommand as check, showcaseCommand as showcase, createCommand as create, gresourceCommand as gresource, gettextCommand as gettext, gsettingsCommand as gsettings, flatpakCommand as flatpak, shipCommand as ship, dlxCommand as dlx, installCommand as install, linkCommand as link, unlinkCommand as unlink, foreachCommand as foreach, workspaceCommand as workspace, packCommand as pack, publishCommand as publish, whoamiCommand as whoami, releaseNotesCommand as releaseNotes, loginCommand as login, logoutCommand as logout, trustCommand as trust, onboardCommand as onboard, selfUpdateCommand as selfUpdate, generateInstallerCommand as generateInstaller, pruneCommand as prune, uninstallCommand as uninstall, formatCommand as format, lintCommand as lint, fixCommand as fix, upgradeCommand as upgrade, barrelsCommand as barrels, tscCommand as tsc, affectedCommand as affected, storybookCommand as storybook, siteCommand as site, devCommand as dev, debugCommand as debug, devtoolsCommand as devtools, browseCommand as browse, webextCommand as webext, blueprintCommand as blueprint, } from './commands/index.js';
 import { APP_NAME } from './constants.js';
 import { isBun, isDeno, isNode, gjsSystemVersion } from '@gjsify/rolldown-plugin-gjsify/runtime';
 import { ensureGjsifyShimOnPath } from './utils/gjsify-shim.js';
@@ -117,6 +117,7 @@ export async function runCli(argv) {
         .command(pack.command, pack.description, pack.builder, pack.handler)
         .command(publish.command, publish.description, publish.builder, publish.handler)
         .command(whoami.command, whoami.description, whoami.builder, whoami.handler)
+        .command(releaseNotes.command, releaseNotes.description, releaseNotes.builder, releaseNotes.handler)
         .command(login.command, login.description, login.builder, login.handler)
         .command(logout.command, logout.description, logout.builder, logout.handler)
         .command(trust.command, trust.description, trust.builder, trust.handler)

package/lib/commands/index.d.ts

@@ -22,6 +22,7 @@ export * from './foreach.js';
 export * from './workspace.js';
 export * from './pack.js';
 export * from './publish.js';
+export * from './release-notes.js';
 export * from './whoami.js';
 export * from './login.js';
 export * from './logout.js';

package/lib/commands/index.js

@@ -22,6 +22,7 @@ export * from './foreach.js';
 export * from './workspace.js';
 export * from './pack.js';
 export * from './publish.js';
+export * from './release-notes.js';
 export * from './whoami.js';
 export * from './login.js';
 export * from './logout.js';

package/lib/commands/release-notes.d.ts

@@ -0,0 +1,7 @@
+import type { Command } from '../types/index.js';
+interface ReleaseNotesOptions {
+    release?: string;
+    compare?: boolean;
+}
+export declare const releaseNotesCommand: Command<unknown, ReleaseNotesOptions>;
+export {};

package/lib/commands/release-notes.js

@@ -0,0 +1,42 @@
+// `gjsify release-notes [release] [--compare]`
+//
+// Prints one `releases` entry as GitHub Markdown, so a release workflow can pass
+// it to `gh release create --notes-file -` instead of an empty body. Exits 1 when
+// the version has no entry or no description: a release job must fail loudly
+// rather than publish nothing.
+import { Config } from '../config.js';
+import { readPackageJson } from '../utils/pkg-json.js';
+import { renderReleaseNotes, stripVersionPrefix } from '../utils/release-notes.js';
+import { join } from 'node:path';
+export const releaseNotesCommand = {
+    command: 'release-notes [release]',
+    description: 'Print the `releases` entry for a version as GitHub Markdown. Fails when there is no entry or no description.',
+    builder: (yargs) => yargs
+        .positional('release', {
+        description: 'Version or tag (a leading `v` is accepted). Default: the version in package.json.',
+        type: 'string',
+    })
+        .option('compare', {
+        description: 'Append a `**Full changelog:**` compare link to the previous entry (needs `vcsBrowserUrl`).',
+        type: 'boolean',
+        default: false,
+    }),
+    handler: async (args) => {
+        const projectDir = process.cwd();
+        try {
+            const config = await new Config().forCommand(projectDir);
+            const ship = config.ship ?? {};
+            const flatpak = config.flatpak ?? {};
+            const version = args.release ?? readPackageJson(join(projectDir, 'package.json'))?.version;
+            if (!version)
+                throw new Error('no version given and package.json has none');
+            const releases = ship.releases ?? flatpak.releases;
+            const repoUrl = args.compare === true ? (ship.vcsBrowserUrl ?? flatpak.vcsBrowserUrl) : undefined;
+            process.stdout.write(renderReleaseNotes({ releases, version: stripVersionPrefix(version), repoUrl }));
+        }
+        catch (err) {
+            process.stderr.write(`gjsify release-notes: ${err instanceof Error ? err.message : String(err)}\n`);
+            return process.exit(1);
+        }
+    },
+};

package/lib/utils/app-metadata.d.ts

@@ -1,4 +1,4 @@
-import type { AppMetadata } from '../types/config-data.js';
+import type { AppMetadata, DescriptionBlock } from '../types/config-data.js';
 /** Everything a renderer needs that is not part of {@link AppMetadata} itself. */
 export interface AppMetadataInputs {
     /** Reverse-DNS application id — the MetaInfo `<id>` and the icon/desktop basename. */
@@ -50,4 +50,6 @@ export declare function renderMetainfoCli(inputs: AppMetadataInputs): string;
  * wins over file types: a URL handler must take `%u`.
  */
 export declare function renderDesktopEntry(inputs: AppMetadataInputs): string;
+/** Auto-convert blank-line-split string into paragraph blocks. */
+export declare function stringToBlocks(s: string): DescriptionBlock[];
 export declare function escapeXml(value: string): string;

package/lib/utils/app-metadata.js

@@ -332,7 +332,7 @@ function renderDescriptionBlocks(description, indent) {
     return out;
 }
 /** Auto-convert blank-line-split string into paragraph blocks. */
-function stringToBlocks(s) {
+export function stringToBlocks(s) {
     return s
         .trim()
         .split(/\n\n+/)

package/lib/utils/check-system-deps.js

@@ -281,6 +281,7 @@ export const PACKAGE_DEPS = {
     '@gjsify/gamepad': ['manette'],
     '@gjsify/speech-synthesis': ['spiel'],
     '@gjsify/webaudio': ['gstreamer', 'gst-app'],
+    '@gjsify/media-capture': ['gstreamer', 'gst-app'],
     '@gjsify/iframe': ['webkitgtk'],
     '@gjsify/canvas2d': ['gdk-pixbuf', 'pango', 'pangocairo', 'cairo'],
     '@gjsify/canvas2d-core': ['gdk-pixbuf', 'pango', 'pangocairo', 'cairo'],

package/lib/utils/release-notes.d.ts

@@ -0,0 +1,19 @@
+import type { DescriptionBlock } from '../types/config-data.js';
+export interface ReleaseEntry {
+    version: string;
+    date: string;
+    description?: string | DescriptionBlock[];
+}
+/** Paragraphs → paragraphs, lists → `- ` items. Translator hints are dropped. */
+export declare function descriptionToMarkdown(description: string | DescriptionBlock[]): string;
+/** `v0.1.7` and `0.1.7` name the same release. */
+export declare function stripVersionPrefix(version: string): string;
+export interface ReleaseNotesInput {
+    releases: readonly ReleaseEntry[] | undefined;
+    /** Requested version, with or without a leading `v`. */
+    version: string;
+    /** Append the compare link when set and a previous release exists. */
+    repoUrl?: string;
+}
+/** Throws an `Error` whose message is meant to be printed as-is. */
+export declare function renderReleaseNotes({ releases, version, repoUrl }: ReleaseNotesInput): string;

package/lib/utils/release-notes.js

@@ -0,0 +1,49 @@
+// GitHub-Markdown rendering of one `releases` entry, for `gjsify release-notes`.
+//
+// The AppStream `<release>` blocks and a GitHub release body describe the same
+// release, so both read the one `releases` list in the config. The string →
+// block normalisation is `stringToBlocks` from app-metadata.ts, not a second copy.
+import { stringToBlocks } from './app-metadata.js';
+/** Paragraphs → paragraphs, lists → `- ` items. Translator hints are dropped. */
+export function descriptionToMarkdown(description) {
+    const blocks = typeof description === 'string' ? stringToBlocks(description) : description;
+    const out = [];
+    for (const block of blocks) {
+        if ('p' in block) {
+            const text = block.p.trim().replace(/\s+/g, ' ');
+            if (text)
+                out.push(text);
+        }
+        else {
+            const items = block.ul.map((item) => (typeof item === 'string' ? item : item.item).trim()).filter(Boolean);
+            if (items.length)
+                out.push(items.map((item) => `- ${item}`).join('\n'));
+        }
+    }
+    return out.join('\n\n');
+}
+/** `v0.1.7` and `0.1.7` name the same release. */
+export function stripVersionPrefix(version) {
+    return version.trim().replace(/^v/i, '');
+}
+/** Throws an `Error` whose message is meant to be printed as-is. */
+export function renderReleaseNotes({ releases, version, repoUrl }) {
+    const wanted = stripVersionPrefix(version);
+    const list = releases ?? [];
+    const index = list.findIndex((r) => stripVersionPrefix(r.version) === wanted);
+    if (index < 0) {
+        throw new Error(`no \`releases\` entry for version ${wanted} in the gjsify config` +
+            (list.length ? ` (found: ${list.map((r) => r.version).join(', ')})` : ' (no `releases` configured)'));
+    }
+    const entry = list[index];
+    const body = entry.description === undefined ? '' : descriptionToMarkdown(entry.description);
+    if (!body)
+        throw new Error(`the \`releases\` entry for version ${wanted} has no description`);
+    // Most recent first, so the previous release is the next entry.
+    const previous = list[index + 1];
+    if (!repoUrl || !previous)
+        return `${body}\n`;
+    const base = repoUrl.replace(/\/+$/, '');
+    const compare = `${base}/compare/v${stripVersionPrefix(previous.version)}...v${wanted}`;
+    return `${body}\n\n**Full changelog:** ${compare}\n`;
+}

package/lib/utils/ship/layout.d.ts

@@ -170,6 +170,13 @@ export interface Layout {
      * first line is `import Gtk from 'gi://Gtk?version=4.0'`.
      */
     shippedRuntime: 'gjs' | 'node';
+    /**
+     * Set when the artifact's container stores names in a DECOMPOSED form and a
+     * seal over those names is byte-exact: every path BELOW the layout root is
+     * then staged in that form, so the bytes the seal was made over are the
+     * bytes the container hands back. See {@link nameFormBelowRoot}.
+     */
+    nameForm?: 'NFD';
     /**
      * Why the staged launcher cannot name {@link shippedRuntime} yet, or absent
      * when it already does.
@@ -402,6 +409,17 @@ export declare function assertLayoutSupportsArch(layout: Layout, arch: string):
  * `lib/<name>/`, because on macOS those two go to different directories.
  */
 export declare function place(layout: Layout, identity: LayoutIdentity, rel: string): string;
+/**
+ * A staged path with every segment BELOW the layout root put in the layout's
+ * {@link Layout.nameForm}; the first segment (`<App>.app`) is left as given.
+ *
+ * The root is exempt for two reasons: no seal covers its own name, and the
+ * packers look the directory up by `${name}.app` on a Linux host whose
+ * filesystem compares bytes. Only ever changes non-ASCII names — an ASCII
+ * path is returned unchanged, so every bundle that already verified keeps
+ * its exact bytes.
+ */
+export declare function nameFormBelowRoot(layout: Layout, path: string): string;
 /**
  * Apply a layout to a whole planned payload, and add what the layout itself owns.
  *

package/lib/utils/ship/layout.js

@@ -268,6 +268,14 @@ export const LAYOUTS = {
             'with `PangoCairo.FontMap.get_default().list_families()`, and `PANGOCAIRO_BACKEND=bogus` to ' +
             'print which backends it was built with.',
         launcherExt: '',
+        // `codesign` seals the bytes of every name inside the bundle, and the `.dmg` is an
+        // HFS+ volume (`dmg.ts`), which stores names decomposed. Measured on macOS 27
+        // with an app whose display name holds "ä": the bundle sealed with the precomposed
+        // `Contents/Helpers/<name>` verifies out of the zip and fails inside the mounted
+        // image ("file added / file missing" on that one path), because HFS+ rewrote the
+        // name to a + U+0308. APFS keeps the bytes it is given, so staging NFD makes
+        // zip and image agree.
+        nameForm: 'NFD',
         root: appBundleDir,
         // Apple's, all four. `Contents/MacOS` holds executables, `Contents/Resources`
         // everything that is not, and `Contents/Frameworks` the dylibs — which is
@@ -680,6 +688,26 @@ export function place(layout, identity, rel) {
         return posix.join(dirs.data, rel.slice('share/'.length));
     return posix.join(dirs.other, rel);
 }
+/**
+ * A staged path with every segment BELOW the layout root put in the layout's
+ * {@link Layout.nameForm}; the first segment (`<App>.app`) is left as given.
+ *
+ * The root is exempt for two reasons: no seal covers its own name, and the
+ * packers look the directory up by `${name}.app` on a Linux host whose
+ * filesystem compares bytes. Only ever changes non-ASCII names — an ASCII
+ * path is returned unchanged, so every bundle that already verified keeps
+ * its exact bytes.
+ */
+export function nameFormBelowRoot(layout, path) {
+    if (layout.nameForm === undefined)
+        return path;
+    const form = layout.nameForm;
+    // Staged paths are stage-relative and built with `posix.join` on every host.
+    const [root, ...below] = path.split(posix.sep);
+    if (below.length === 0)
+        return path;
+    return [root, ...below.map((segment) => segment.normalize(form))].join(posix.sep);
+}
 /**
  * Apply a layout to a whole planned payload, and add what the layout itself owns.
  *
@@ -712,7 +740,8 @@ export function place(layout, identity, rel) {
 export function placeStage(layout, identity, files, carried = []) {
     const byPlaced = new Map();
     const out = [];
-    const claim = (path, from, file) => {
+    const claim = (rawPath, from, file) => {
+        const path = nameFormBelowRoot(layout, rawPath);
         const previous = byPlaced.get(path);
         if (previous !== undefined) {
             throw new Error(`gjsify ship: in the ${layout.name} layout both ${previous} and ${from} install as ` +

package/lib/utils/ship/signing.d.ts

@@ -66,6 +66,31 @@ export interface SignerDescriptor {
     /** What a signature from this signer does NOT yet cover — printed once per run. */
     gap: string;
 }
+/**
+ * An explicit `--identifier` for an image whose FILE NAME is not ASCII, or
+ * `undefined` when codesign's own default is already right.
+ *
+ * WHY THIS EXISTS, measured on macOS 2026-10-30 (steuererklaerung CI run
+ * 41050980433, plus mini bundles beside it): the darwin layout puts the
+ * interpreter at `Contents/Helpers/<display name>`, so an app called
+ * "Steuererklärung" carries a non-ASCII leaf. codesign derives an image's code
+ * identifier from that file name; with a NAMED identity the designated
+ * requirement becomes `identifier "<derived>" and certificate leaf …`, and
+ * `codesign --verify --strict <App>.app` then fails with *"the sealed resource
+ * directory is invalid"* for the NFD-derived identifier (`…61cc88…`); why
+ * codesign rejects it is not established, only that it does. Ad-hoc (a cdhash
+ * requirement, no identifier at all) and ASCII names are unaffected; the same
+ * bundle with `--identifier eu.test.x.helper` verifies, and an NFC identifier
+ * still does not, so the value has to be plain ASCII rather than merely
+ * normalised.
+ *
+ * Hence: an ASCII leaf keeps codesign's default (this returns `undefined` and
+ * the flag is not sent, so every name that already worked is unchanged), and
+ * only a non-ASCII leaf gets a stable ASCII identifier. NFD first, so a
+ * precomposed "ä" and a decomposed "a"+U+0308 fold to the same value instead of
+ * to two identifiers that differ by bytes nobody can see.
+ */
+export declare function asciiCodesignIdentifier(fileName: string): string | undefined;
 /**
  * The signers, keyed by the LAYOUT they sign — never by the host they run on.
  *
@@ -156,6 +181,17 @@ export interface SignArgs {
     entitlements?: string;
     /** Is {@link identity} the reserved ad-hoc `-`? */
     adhoc: boolean;
+    /**
+     * Is {@link file} the bundle DIRECTORY being sealed, rather than one image
+     * inside it?
+     *
+     * A signer needs the distinction because the two invocations are not the
+     * same operation on the same kind of object: a bundle takes its identifier
+     * from `Info.plist` and must never be given one, while an image's identifier
+     * is derived from its own file name — which is where a non-ASCII helper name
+     * becomes a problem ({@link asciiCodesignIdentifier}).
+     */
+    seal: boolean;
 }
 /** `codesign --sign -`: the one identity value that names no identity at all. */
 export declare const ADHOC_IDENTITY = "-";

package/lib/utils/ship/signing.js

@@ -74,13 +74,57 @@
 // ad-hoc answer, and § A4's re-sign of every image stays the design of record for
 // the Developer ID that notarisation will actually require.
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join, sep } from 'node:path';
+import { basename, dirname, join, sep } from 'node:path';
 import { isOnPath } from '../check-system-deps.js';
 import { describeExit, spawnToCompletion } from '../spawn.js';
 import { listFilesRecursive } from './discover.js';
 import { classifyBinary } from './payload.js';
 import { renderEntitlements } from './plist.js';
 import { writePayload } from './stage-writer.js';
+/**
+ * An explicit `--identifier` for an image whose FILE NAME is not ASCII, or
+ * `undefined` when codesign's own default is already right.
+ *
+ * WHY THIS EXISTS, measured on macOS 2026-10-30 (steuererklaerung CI run
+ * 41050980433, plus mini bundles beside it): the darwin layout puts the
+ * interpreter at `Contents/Helpers/<display name>`, so an app called
+ * "Steuererklärung" carries a non-ASCII leaf. codesign derives an image's code
+ * identifier from that file name; with a NAMED identity the designated
+ * requirement becomes `identifier "<derived>" and certificate leaf …`, and
+ * `codesign --verify --strict <App>.app` then fails with *"the sealed resource
+ * directory is invalid"* for the NFD-derived identifier (`…61cc88…`); why
+ * codesign rejects it is not established, only that it does. Ad-hoc (a cdhash
+ * requirement, no identifier at all) and ASCII names are unaffected; the same
+ * bundle with `--identifier eu.test.x.helper` verifies, and an NFC identifier
+ * still does not, so the value has to be plain ASCII rather than merely
+ * normalised.
+ *
+ * Hence: an ASCII leaf keeps codesign's default (this returns `undefined` and
+ * the flag is not sent, so every name that already worked is unchanged), and
+ * only a non-ASCII leaf gets a stable ASCII identifier. NFD first, so a
+ * precomposed "ä" and a decomposed "a"+U+0308 fold to the same value instead of
+ * to two identifiers that differ by bytes nobody can see.
+ */
+export function asciiCodesignIdentifier(fileName) {
+    // `fileName` may be a path, and codesign derives the identifier from the
+    // LEAF — so both the ASCII test and the fallback bytes are about the leaf.
+    const leaf = basename(fileName);
+    if ([...leaf].every((char) => (char.codePointAt(0) ?? 0) < 0x80))
+        return undefined;
+    const slug = leaf
+        .normalize('NFD')
+        .replace(/\p{M}+/gu, '')
+        .replace(/[^A-Za-z0-9.-]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    if (/[A-Za-z0-9]/.test(slug))
+        return slug;
+    // Nothing Latin survives (a name that is entirely CJK or emoji): a readable
+    // slug would be the empty string, which is not an identifier, so the UTF-8
+    // bytes are spelled out — ASCII, unique, and reproducible from the name it
+    // came from.
+    const bytes = new TextEncoder().encode(leaf);
+    return `x-${[...bytes].map((byte) => byte.toString(16).padStart(2, '0')).join('')}`;
+}
 /**
  * The signers, keyed by the LAYOUT they sign — never by the host they run on.
  *
@@ -116,16 +160,25 @@ export const SIGNERS = {
         // the timestamp authority service cannot be contacted … the signing
         // operation will fail", which is not a failure worth inventing for a
         // signature that cannot carry the result.
-        args: ({ identity, file, entitlements, adhoc }) => [
-            '--force',
-            '--sign',
-            identity,
-            '--options',
-            'runtime',
-            ...(entitlements === undefined ? [] : ['--entitlements', entitlements]),
-            ...(adhoc ? [] : ['--timestamp']),
-            file,
-        ],
+        args: ({ identity, file, entitlements, adhoc, seal }) => {
+            // A non-ASCII leaf gets an explicit ASCII identifier — see
+            // {@link asciiCodesignIdentifier}. NEVER for the seal: the bundle
+            // takes its identifier from `CFBundleIdentifier` in `Info.plist`,
+            // and overriding that would make the seal disagree with the bundle
+            // the system reads.
+            const derived = seal ? undefined : asciiCodesignIdentifier(file);
+            return [
+                '--force',
+                '--sign',
+                identity,
+                '--options',
+                'runtime',
+                ...(entitlements === undefined ? [] : ['--entitlements', entitlements]),
+                ...(adhoc ? [] : ['--timestamp']),
+                ...(derived === undefined ? [] : ['--identifier', derived]),
+                file,
+            ];
+        },
         // FIVE OF THE REFERENCE'S SIX for an ad-hoc identity, FOUR for a real one,
         // and the difference is the one § A16 left open — now MEASURED, on
         // darwin-arm64 with the published `@gjsify/gtk-runtime-darwin-arm64` staged
@@ -182,7 +235,9 @@ export const SIGNERS = {
         gap: 'the images are signed and the bundle is sealed, and the seal survives both the `.zip` and the ' +
             '`.dmg` round trip; § A16 stands measured in ONE direction only — library validation refuses an ' +
             'ad-hoc-signed dylib, so the ad-hoc identity grants `disable-library-validation` while a named ' +
-            'one does not, and no run in this repository has ever held the named one',
+            'one does not; a named Developer ID was signed and notarised on 2026-10-30 for an ASCII-named ' +
+            'app, and a non-ASCII image name verifies only with the explicit ASCII `--identifier` this ' +
+            'signer now passes',
     },
     win32: {
         layoutOs: 'win32',
@@ -335,8 +390,14 @@ export async function signPayload(input) {
         writeFileSync(input.entitlementsPath, renderEntitlements(granted));
         entitlements = input.entitlementsPath;
     }
-    const run = async (file, what) => {
-        const args = signer.args({ identity: input.identity, file, adhoc, ...(entitlements ? { entitlements } : {}) });
+    const run = async (file, what, seal) => {
+        const args = signer.args({
+            identity: input.identity,
+            file,
+            adhoc,
+            seal,
+            ...(entitlements ? { entitlements } : {}),
+        });
         if (input.verbose)
             input.log(`${signer.tool} ${args.join(' ')}`);
         const result = await spawnToCompletion(signer.tool, args, {
@@ -367,7 +428,7 @@ export async function signPayload(input) {
         return [...payload];
     }
     for (const entry of signable) {
-        await run(join(workDir, entry.path.split('/').join(sep)), entry.path);
+        await run(join(workDir, entry.path.split('/').join(sep)), entry.path, false);
     }
     // THE IMAGES FIRST, THE SEAL LAST, and the order is not stylistic: a bundle
     // seal hashes the files it seals, so sealing before the closure is signed
@@ -381,7 +442,7 @@ export async function signPayload(input) {
                 'stage would sign the payload of every other format beside it.');
         }
         sealPrefix = signer.sealAddPrefix(input.bundleRoot);
-        await run(join(workDir, input.bundleRoot.split('/').join(sep)), `${input.bundleRoot} (bundle seal)`);
+        await run(join(workDir, input.bundleRoot.split('/').join(sep)), `${input.bundleRoot} (bundle seal)`, true);
     }
     // THE FILE SET MAY ONLY GROW WHERE THE SEAL WRITES. Both tools rewrite an
     // image in place, so any other new path means something else ran — and a file

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.64.13-next.283",
+    "version": "0.64.14",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -142,22 +142,22 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/blueprint": "0.64.13-next.283",
-        "@gjsify/buffer": "0.64.13-next.283",
-        "@gjsify/create-app": "0.64.13-next.283",
-        "@gjsify/node-globals": "0.64.13-next.283",
-        "@gjsify/node-polyfills": "0.64.13-next.283",
-        "@gjsify/npm-registry": "0.64.13-next.283",
-        "@gjsify/resolve-npm": "0.64.13-next.283",
-        "@gjsify/rolldown-plugin-gjsify": "0.64.13-next.283",
-        "@gjsify/vite-plugin-blueprint": "0.64.13-next.283",
-        "@gjsify/rolldown-plugin-pnp": "0.64.13-next.283",
-        "@gjsify/semver": "0.64.13-next.283",
-        "@gjsify/tar": "0.64.13-next.283",
-        "@gjsify/tsc": "0.64.13-next.283",
-        "@gjsify/utils": "0.64.13-next.283",
-        "@gjsify/web-polyfills": "0.64.13-next.283",
-        "@gjsify/workspace": "0.64.13-next.283",
+        "@gjsify/blueprint": "^0.64.14",
+        "@gjsify/buffer": "^0.64.14",
+        "@gjsify/create-app": "^0.64.14",
+        "@gjsify/node-globals": "^0.64.14",
+        "@gjsify/node-polyfills": "^0.64.14",
+        "@gjsify/npm-registry": "^0.64.14",
+        "@gjsify/resolve-npm": "^0.64.14",
+        "@gjsify/rolldown-plugin-gjsify": "^0.64.14",
+        "@gjsify/vite-plugin-blueprint": "^0.64.14",
+        "@gjsify/rolldown-plugin-pnp": "^0.64.14",
+        "@gjsify/semver": "^0.64.14",
+        "@gjsify/tar": "^0.64.14",
+        "@gjsify/tsc": "^0.64.14",
+        "@gjsify/utils": "^0.64.14",
+        "@gjsify/web-polyfills": "^0.64.14",
+        "@gjsify/workspace": "^0.64.14",
         "acorn": "^8.17.0",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
@@ -166,13 +166,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "0.64.13-next.283",
+        "@gjsify/unit": "^0.64.14",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "0.64.13-next.283",
-        "@gjsify/rolldown-native": "0.64.13-next.283"
+        "@gjsify/oxfmt-native": "^0.64.14",
+        "@gjsify/rolldown-native": "^0.64.14"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {
@@ -191,6 +191,5 @@
     "bugs": {
         "url": "https://github.com/gjsify/gjsify/issues"
     },
-    "homepage": "https://github.com/gjsify/gjsify/tree/main/packages/infra/cli#readme",
-    "gitHead": "05fae97125a374e84bf57c2d2d086fb53523f205"
+    "homepage": "https://github.com/gjsify/gjsify/tree/main/packages/infra/cli#readme"
 }