@gjsify/rolldown-native 0.24.1 → 0.25.1

package/README.md

@@ -30,6 +30,40 @@ if (hasNativeRolldown()) {
 
 Under normal usage `@gjsify/rolldown-native` is consumed automatically by the gjsify CLI (`gjsify build`) — direct use is only needed when embedding the bundler in custom build tooling.
 
+## Building from source
+
+The Rust shim path-deps into the `refs/rolldown` submodule, pinned to the tag matching the
+workspace's npm `rolldown` version (`package.json#gjsify.refsLockstep` — the two are builds of the
+same bundler and must be the same release):
+
+```bash
+git submodule update --init refs/rolldown
+gjsify workspace @gjsify/rolldown-native build:prebuilds   # needs meson + vala + cargo
+```
+
+### Dependency lock
+
+`src/rust/Cargo.lock` is **committed**. It pins the crates.io half of the graph the way
+[`scripts/check-refs-pin.mjs`](../../../scripts/check-refs-pin.mjs) pins the `refs/` half, so the
+prebuild in this repository can be re-linked against the exact transitive set it was built from.
+CI builds with `--locked` (`${CI:+--locked}` on the `cargo build` in `meson.build`; every CI leg
+runs with `CI=true`), so a lock that no longer satisfies `Cargo.toml` fails the run instead of
+being silently rewritten. Local builds are unlocked, so editing `Cargo.toml` still just works —
+commit the resulting lock diff with the change.
+
+Updating a dependency is a deliberate act:
+
+```bash
+cd packages/infra/rolldown-native/src/rust
+cargo update -p <crate>        # or plain `cargo update` for the whole registry side
+cargo tree -d                  # no crate may appear as BOTH a path and a registry entry
+cd -
+gjsify workspace @gjsify/rolldown-native build:prebuilds
+```
+
+Bumping `refs/rolldown` moves the `rolldown*` path crates' own versions and therefore invalidates
+the lock — regenerate it in the same commit as the submodule pin and the npm `rolldown` bump.
+
 ## Platform coverage
 
 | Platform | Prebuild | Built by |

package/meson.build

@@ -74,6 +74,7 @@ cargo = find_program('cargo')
 
 rust_sources = files(
     'src/rust/Cargo.toml',
+    'src/rust/Cargo.lock',
     'src/rust/src/lib.rs',
     'src/rust/src/plugin_proxy.rs',
     'src/rust/src/session.rs',
@@ -82,11 +83,18 @@ rust_sources = files(
 
 rust_target_dir = meson.current_build_dir() / 'cargo-target'
 
+# `${CI:+--locked}` — on a CI runner (GitHub Actions always exports CI=true) the
+# committed src/rust/Cargo.lock is ENFORCED: cargo fails loudly instead of
+# re-resolving the registry and rewriting the lock, so a lock that no longer
+# satisfies Cargo.toml (or a refs/rolldown bump that moved a path crate's
+# version) reds the run rather than silently shipping a differently-linked
+# prebuild. Locally the flag expands to nothing, so editing Cargo.toml still
+# just works — commit the resulting lock diff together with the change.
 rust_cdylib = custom_target('gjsify-rolldown-rust',
     input:  rust_sources,
     output: rust_cdylib_name,
     command: ['sh', '-c',
-              'cargo build --release --manifest-path "$1" --target-dir "$2" && cp "$2/release/'
+              'cargo build --release ${CI:+--locked} --manifest-path "$1" --target-dir "$2" && cp "$2/release/'
                   + rust_cdylib_name + '" "$3"' + rust_cdylib_post,
               'sh',
               meson.current_source_dir() / 'src/rust/Cargo.toml',

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/rolldown-native",
-    "version": "0.24.1",
+    "version": "0.25.1",
     "description": "Phase D-2 POC: Vala/GObject + Rust cdylib bridge to rolldown for GJS. Wraps `rolldown::Bundler::generate()` (async, tokio) in a per-call current-thread runtime so JS sees a sync `bundle()` call. JSON-encoded BundlerOptions in, JSON-encoded BundleOutput out — the boundary stays small even though rolldown's option surface is enormous. POC scope: no JS plugins (Phase B), no watch/HMR, no incremental builds. Companion to `@gjsify/lightningcss-native`; together they remove the last two Rust-crate runtime blockers from the gjsify build pipeline (Phase D-3 unblock).",
     "type": "module",
     "main": "lib/esm/index.js",
@@ -58,7 +58,7 @@
         "@girs/gobject-2.0": "^4.1.0"
     },
     "devDependencies": {
-        "@gjsify/cli": "^0.24.1",
+        "@gjsify/cli": "^0.25.1",
         "@types/node": "^25.9.2",
         "typescript": "^6.0.3"
     },