@gtkx/cli 1.1.0 → 1.2.0

package/src/deploy/install-hints.ts

@@ -47,10 +47,14 @@ const PACKAGE_FOR_TOOL: Record<string, FamilyPackages> = {
     tar: { arch: "tar", debian: "tar", fedora: "tar", suse: "tar" },
 };
 
-const EXTRA_HINTS: Record<string, string> = {
-    "flatpak-builder": "or: flatpak install --user -y flathub org.flatpak.Builder",
-    "flatpak-node-generator":
-        "pipx install git+https://github.com/flatpak/flatpak-builder-tools.git#subdirectory=node",
+const GENERATOR_SOURCE = "git+https://github.com/flatpak/flatpak-builder-tools.git#subdirectory=node";
+
+const EXTRA_HINTS: Record<string, string[]> = {
+    "flatpak-builder": ["or: flatpak install --user -y flathub org.flatpak.Builder"],
+    "flatpak-node-generator": [
+        `pipx install ${GENERATOR_SOURCE}`,
+        `or, when the installed copy is too old to vendor pnpm: pipx install --force ${GENERATOR_SOURCE}`,
+    ],
 };
 
 const unquote = (value: string): string => QUOTED.exec(value)?.[1] ?? value;
@@ -99,10 +103,9 @@ const detectPackageFamily = (): PackageFamily => {
 const installHints = (tool: string, family: PackageFamily): string[] => {
     const packageName = PACKAGE_FOR_TOOL[tool]?.[family];
     const command = INSTALL_COMMAND[family];
-    const extra = EXTRA_HINTS[tool];
     const install = packageName !== undefined && command !== undefined ? [`${command} ${packageName}`] : [];
 
-    return extra === undefined ? install : [...install, extra];
+    return [...install, ...(EXTRA_HINTS[tool] ?? [])];
 };
 
 export { detectPackageFamily, installHints };

package/src/deploy/run-deploy.ts

@@ -22,11 +22,13 @@ import { DEFAULT_TARGETS, parseTargetList, targetsFor } from "./registry.js";
 import { resolveDeploySettings } from "./settings/index.js";
 import { readPackageManifest } from "./settings/package-manifest.js";
 import { missingDeployError } from "./settings/starter.js";
+import { detectPackageManager } from "./targets/flatpak-sources.js";
 import {
     APPSTREAMCLI,
     assertTools,
     DESKTOP_FILE_VALIDATE,
     FLATPAK_NODE_GENERATOR,
+    FLATPAK_NODE_GENERATOR_PNPM,
     probeTools,
     STRIP,
     TAR,
@@ -93,7 +95,11 @@ const warnMissingNetwork = (settings: DeploySettings): void => {
 const sourceModeTools = (targets: DeployTarget[], settings: DeploySettings): DeployTool[] => {
     const isFlatpakSource = settings.deploy.flatpak?.mode === "source";
 
-    return isFlatpakSource && targets.some((target) => target.name === "flatpak") ? [FLATPAK_NODE_GENERATOR] : [];
+    if (!isFlatpakSource || targets.every((target) => target.name !== "flatpak")) {
+        return [];
+    }
+
+    return detectPackageManager(settings) === "pnpm" ? [FLATPAK_NODE_GENERATOR_PNPM] : [FLATPAK_NODE_GENERATOR];
 };
 
 const isNodeRequired = (targets: DeployTarget[], settings: DeploySettings): boolean =>

package/src/deploy/settings/package-manifest.ts

@@ -13,6 +13,7 @@ type PackageManifest = {
     description: string | null;
     license: string | null;
     homepage: string | null;
+    packageManager: string | null;
     author: ManifestAuthor;
 };
 
@@ -59,6 +60,7 @@ const readPackageManifest = (root: string): PackageManifest => {
         description: optionalString(manifest.description),
         license: optionalString(manifest.license),
         homepage: optionalString(manifest.homepage),
+        packageManager: optionalString(manifest.packageManager),
         author: parseAuthor(manifest.author),
     };
 };

package/src/deploy/targets/flatpak-pnpm.ts

@@ -0,0 +1,115 @@
+import type { DeploySettings } from "../types.js";
+import type { FlatpakModule } from "./flatpak-prebuilt.js";
+import { readPackageManifest } from "../settings/package-manifest.js";
+
+type PnpmPin = {
+    version: string;
+    major: number;
+    minor: number;
+    sha512: string;
+};
+
+const PNPM_VERSION = "11.21.0";
+const PNPM_MAJOR = 11;
+const PNPM_MINOR = 21;
+
+const PNPM_SHA512 = "521705bce689924eac72f5a3587122f362689ef6571e55ba80076fd637c11132ecffada26" +
+    "fad4ea79c485bfddbfd3d5a2a5b05805a77e893de71ec8a6cca3bb1";
+
+const PNPM_DIR = "flatpak-pnpm";
+const PNPM_COMMAND = "pnpm";
+const PNPM_PREFIX = "pnpm@";
+const PNPM_TARBALL_URL = "https://registry.npmjs.org/pnpm/-/pnpm-";
+const PNPM_INSTALL = "pnpm install --offline --frozen-lockfile";
+const TRUST_LOCKFILE = "--trust-lockfile";
+const STORE_V10 = "v10";
+const STORE_V11 = "v11";
+const STORE_V10_MAJOR = 10;
+const STORE_V11_MAJOR = 11;
+const TRUST_LOCKFILE_MINOR = 3;
+
+const DEFAULT_PIN: PnpmPin = {
+    version: PNPM_VERSION,
+    major: PNPM_MAJOR,
+    minor: PNPM_MINOR,
+    sha512: PNPM_SHA512,
+};
+
+const PNPM_PIN_FIELD =
+    /^pnpm@(?<version>(?<major>\d+)\.(?<minor>\d+)\.\d+)\+sha512\.(?<sha512>[\da-f]{128})$/;
+
+const pinFromGroups = (groups: Record<string, string | undefined>): PnpmPin | null => {
+    const { major, minor, sha512, version } = groups;
+
+    if (major === undefined || minor === undefined || sha512 === undefined || version === undefined) {
+        return null;
+    }
+
+    return { version, major: Number(major), minor: Number(minor), sha512 };
+};
+
+const isSupportedPin = (pin: PnpmPin): boolean =>
+    pin.major === STORE_V10_MAJOR || (pin.major === STORE_V11_MAJOR && pin.minor >= TRUST_LOCKFILE_MINOR);
+
+const resolvePnpmPin = (settings: DeploySettings): PnpmPin => {
+    const field = readPackageManifest(settings.paths.root).packageManager;
+
+    if (field === null) {
+        return DEFAULT_PIN;
+    }
+
+    if (!field.startsWith(PNPM_PREFIX)) {
+        throw new Error(
+            `Cannot vendor pnpm for the Flathub sandbox: "packageManager" is "${field}" but the offline install ` +
+            "resolves from a pnpm lockfile. Run `corepack use pnpm@<version>` to pin it to pnpm, or point " +
+            "`deploy.flatpak.packageManager` at the manager whose lockfile the build should install from.",
+        );
+    }
+
+    const pin = pinFromGroups(PNPM_PIN_FIELD.exec(field)?.groups ?? {});
+
+    if (pin === null) {
+        throw new Error(
+            `Cannot vendor pnpm for the Flathub sandbox: "packageManager" is "${field}", which carries no sha512 ` +
+            "integrity digest, and every source in a Flathub build has to be hash-pinned. Run " +
+            "`corepack use pnpm@<version>` to rewrite it with its digest.",
+        );
+    }
+
+    if (!isSupportedPin(pin)) {
+        throw new Error(
+            `Cannot vendor pnpm ${pin.version} for the Flathub sandbox: the offline install runs on pnpm 10, or on ` +
+            "pnpm 11 from 11.3.0 on, where `--trust-lockfile` exists. Earlier pnpm 11 releases reach the registry " +
+            'during the supply-chain check and the sandbox has no network. Pin "packageManager" to one of those.',
+        );
+    }
+
+    return pin;
+};
+
+const pnpmPathFor = (moduleDir: string): string => `${moduleDir}/${PNPM_DIR}`;
+
+const pnpmSources = (pin: PnpmPin, moduleDir: string): FlatpakModule[] => [
+    { type: "archive", url: `${PNPM_TARBALL_URL}${pin.version}.tgz`, sha512: pin.sha512, dest: PNPM_DIR },
+    {
+        type: "script",
+        dest: PNPM_DIR,
+        "dest-filename": PNPM_COMMAND,
+        commands: [`exec node ${pnpmPathFor(moduleDir)}/bin/pnpm.cjs "$@"`],
+    },
+];
+
+const pnpmInstallCommand = (pin: PnpmPin): string =>
+    pin.major === STORE_V11_MAJOR ? `${PNPM_INSTALL} ${TRUST_LOCKFILE}` : PNPM_INSTALL;
+
+const pnpmStoreVersionFor = (pin: PnpmPin): string =>
+    pin.major === STORE_V10_MAJOR ? STORE_V10 : STORE_V11;
+
+export {
+    pnpmInstallCommand,
+    pnpmPathFor,
+    type PnpmPin,
+    pnpmSources,
+    pnpmStoreVersionFor,
+    resolvePnpmPin,
+};

package/src/deploy/targets/flatpak-source.ts

@@ -8,6 +8,7 @@ import { renderMetainfo } from "../freedesktop/metainfo.js";
 import { optional } from "../nfpm/optional.js";
 import { iconPathFor } from "../payload/icons.js";
 import { renderLauncher } from "../payload/launcher.js";
+import { pnpmPathFor, type PnpmPin, pnpmSources } from "./flatpak-pnpm.js";
 import { DESTINATION, type FlatpakModule, postInstallCommands, validationCommands } from "./flatpak-prebuilt.js";
 import {
     detectPackageManager,
@@ -15,6 +16,7 @@ import {
     installCommandFor,
     nodeExtensionPathFor,
     type PackageManager,
+    pnpmPinFor,
     resolveGitSource,
 } from "./flatpak-sources.js";
 
@@ -118,19 +120,29 @@ const iconInstallCommands = (settings: DeploySettings): string[] => {
     return listFilesRecursive(iconsDir).map((icon) => iconInstallCommand(settings, icon.absPath, icon.rel));
 };
 
+const moduleDirFor = (settings: DeploySettings): string => `${MODULE_BUILD_ROOT}/${settings.binaryName}`;
+
 const offlineEnvFor = (manager: PackageManager, settings: DeploySettings): Record<string, string> => {
-    const moduleDir = `${MODULE_BUILD_ROOT}/${settings.binaryName}`;
+    if (manager === "pnpm") {
+        return {};
+    }
 
     if (manager === "yarn") {
-        return { YARN_OFFLINE_MIRROR: `${moduleDir}/${YARN_MIRROR_DIR}` };
+        return { YARN_OFFLINE_MIRROR: `${moduleDirFor(settings)}/${YARN_MIRROR_DIR}` };
     }
 
-    return { npm_config_cache: `${moduleDir}/${NPM_CACHE_DIR}`, npm_config_offline: "true" };
+    return { npm_config_cache: `${moduleDirFor(settings)}/${NPM_CACHE_DIR}`, npm_config_offline: "true" };
 };
 
+const appendPathFor = (settings: DeploySettings, pin: PnpmPin | null, nodeExtensionPath: string): string =>
+    pin === null
+        ? `${nodeExtensionPath}/bin`
+        : `${pnpmPathFor(moduleDirFor(settings))}:${nodeExtensionPath}/bin`;
+
 const flatpakSourceModule = (payload: DeployPayload): FlatpakModule => {
     const settings = payload.settings;
     const manager = detectPackageManager(settings);
+    const pin = pnpmPinFor(settings, manager);
     const postInstall = postInstallCommands(payload);
     const nodeExtensionPath = nodeExtensionPathFor(settings);
 
@@ -138,13 +150,14 @@ const flatpakSourceModule = (payload: DeployPayload): FlatpakModule => {
         name: settings.binaryName,
         buildsystem: "simple",
         "build-options": {
-            "append-path": `${nodeExtensionPath}/bin`,
+            "append-path": appendPathFor(settings, pin, nodeExtensionPath),
             env: { npm_config_nodedir: nodeExtensionPath, ...offlineEnvFor(manager, settings) },
             strip: false,
             "no-debuginfo": true,
         },
         sources: [
             resolveGitSource(settings),
+            ...(pin === null ? [] : pnpmSources(pin, moduleDirFor(settings))),
             GENERATED_SOURCES,
             inlineSource(`${settings.applicationId}.desktop`, renderDesktopEntry(settings)),
             inlineSource(`${settings.applicationId}.metainfo.xml`, renderMetainfo(settings)),
@@ -152,7 +165,7 @@ const flatpakSourceModule = (payload: DeployPayload): FlatpakModule => {
             ...activationSource(settings),
         ],
         "build-commands": [
-            installCommandFor(manager),
+            installCommandFor(settings, manager),
             "npx gtkx build",
             ...runtimeInstallCommands(settings, nodeExtensionPath),
             ...metadataInstallCommands(settings),

package/src/deploy/targets/flatpak-sources.ts

@@ -5,8 +5,11 @@ import type { DeploySettings } from "../types.js";
 import { runCliTool } from "../../internal/run-cli-tool.js";
 import { gitRemoteUrl, runGit } from "../git.js";
 import { optional } from "../nfpm/optional.js";
+import { FLATPAK_NODE_GENERATOR, GENERATOR_PNPM_OPTION } from "../tools.js";
+import { pnpmInstallCommand, type PnpmPin, pnpmStoreVersionFor, resolvePnpmPin } from "./flatpak-pnpm.js";
 
 type PackageManager = "npm" | "pnpm" | "yarn";
+type VendoredManager = Exclude<PackageManager, "pnpm">;
 
 type GitSource = {
     type: "git";
@@ -21,7 +24,7 @@ type GitRevision = {
 };
 
 const GENERATED_SOURCES = "generated-sources.json";
-const GENERATOR = "flatpak-node-generator";
+const COMMIT_PEEL = "^{commit}";
 const FETCHABLE_URL = /^https?:\/\//;
 const DEFAULT_NODE_EXTENSION = "org.freedesktop.Sdk.Extension.node24";
 const NODE_EXTENSION_PREFIX = "org.freedesktop.Sdk.Extension.";
@@ -33,9 +36,8 @@ const LOCKFILE_BY_MANAGER: Record<PackageManager, string> = {
     yarn: "yarn.lock",
 };
 
-const INSTALL_COMMAND: Record<PackageManager, string> = {
+const INSTALL_COMMAND: Record<VendoredManager, string> = {
     npm: "npm ci --offline",
-    pnpm: "pnpm install --offline --frozen-lockfile",
     yarn: "yarn install --offline",
 };
 
@@ -59,7 +61,11 @@ const detectPackageManager = (settings: DeploySettings): PackageManager => {
     return found;
 };
 
-const installCommandFor = (manager: PackageManager): string => INSTALL_COMMAND[manager];
+const pnpmPinFor = (settings: DeploySettings, manager: PackageManager): PnpmPin | null =>
+    manager === "pnpm" ? resolvePnpmPin(settings) : null;
+
+const installCommandFor = (settings: DeploySettings, manager: PackageManager): string =>
+    manager === "pnpm" ? pnpmInstallCommand(resolvePnpmPin(settings)) : INSTALL_COMMAND[manager];
 
 const nodeExtensionFor = (settings: DeploySettings): string =>
     settings.deploy.flatpak?.nodeExtension ?? DEFAULT_NODE_EXTENSION;
@@ -98,6 +104,19 @@ const resolveSourceUrl = (settings: DeploySettings): string => {
     return url;
 };
 
+const commitForTag = (root: string, tag: string): string => {
+    const commit = runGit(root, ["rev-parse", `${tag}${COMMIT_PEEL}`]);
+
+    if (commit === null) {
+        throw new Error(
+            `Cannot pin the Flathub source to "${tag}": Flathub builds a fixed tree, not a movable tag, and that ` +
+            `tag does not resolve in ${root}. Create or fetch it, or set \`deploy.flatpak.source.commit\`.`,
+        );
+    }
+
+    return commit;
+};
+
 const configuredRevision = (settings: DeploySettings): GitRevision | null => {
     const source = settings.deploy.flatpak?.source ?? {};
 
@@ -105,7 +124,11 @@ const configuredRevision = (settings: DeploySettings): GitRevision | null => {
         return { ...optional("tag", source.tag), commit: source.commit };
     }
 
-    return source.tag === undefined ? null : { tag: source.tag };
+    if (source.tag === undefined) {
+        return null;
+    }
+
+    return { tag: source.tag, commit: commitForTag(settings.paths.root, source.tag) };
 };
 
 const workingTreeRevision = (settings: DeploySettings): GitRevision => {
@@ -141,7 +164,10 @@ const isolateLockfile = (root: string, lockfile: string): string => {
     return dir;
 };
 
-const generateNodeSources = (settings: DeploySettings, manager: PackageManager): void => {
+const storeVersionArgs = (pin: PnpmPin | null): string[] =>
+    pin === null ? [] : [GENERATOR_PNPM_OPTION, pnpmStoreVersionFor(pin)];
+
+const generateNodeSources = (settings: DeploySettings, manager: PackageManager, pin: PnpmPin | null): void => {
     const lockfile = settings.deploy.flatpak?.lockfile ?? LOCKFILE_BY_MANAGER[manager];
     const output = generatedSourcesPath(settings);
     mkdirSync(dirname(output), { recursive: true });
@@ -149,9 +175,9 @@ const generateNodeSources = (settings: DeploySettings, manager: PackageManager):
 
     try {
         runCliTool({
-            tool: GENERATOR,
-            args: [manager, join(isolated, basename(lockfile)), "-o", output],
-            target: "the offline npm sources",
+            tool: FLATPAK_NODE_GENERATOR.command,
+            args: [manager, join(isolated, basename(lockfile)), ...storeVersionArgs(pin), "-o", output],
+            target: "the offline dependency sources",
             shouldStream: true,
         });
     } finally {
@@ -167,5 +193,6 @@ export {
     nodeExtensionFor,
     nodeExtensionPathFor,
     type PackageManager,
+    pnpmPinFor,
     resolveGitSource,
 };

package/src/deploy/targets/flatpak.ts

@@ -6,7 +6,7 @@ import type { DeployArtifact, DeployManifest, DeployPayload, DeploySettings, Dep
 import { runCliTool } from "../../internal/run-cli-tool.js";
 import { APPSTREAMCLI, DESKTOP_FILE_VALIDATE, FLATPAK, FLATPAK_BUILDER } from "../tools.js";
 import { branchFor, renderFlatpakManifest } from "./flatpak-manifest.js";
-import { detectPackageManager, generateNodeSources } from "./flatpak-sources.js";
+import { detectPackageManager, generateNodeSources, pnpmPinFor } from "./flatpak-sources.js";
 
 type BuilderInvocation = {
     tool: string;
@@ -45,7 +45,8 @@ const renderManifests = (payload: DeployPayload): DeployManifest[] => {
     const settings = payload.settings;
 
     if (isSourceMode(settings)) {
-        generateNodeSources(settings, detectPackageManager(settings));
+        const manager = detectPackageManager(settings);
+        generateNodeSources(settings, manager, pnpmPinFor(settings, manager));
     }
 
     return [{

package/src/deploy/tools.ts

@@ -10,6 +10,8 @@ type ToolReport = {
 
 const DETAIL_COLUMN = 26;
 const FLATPAK_BUILDER_REF = "org.flatpak.Builder";
+const FLATPAK_NODE_GENERATOR_COMMAND = "flatpak-node-generator";
+const GENERATOR_PNPM_OPTION = "--pnpm-store-version";
 
 const APPSTREAMCLI: DeployTool = {
     command: "appstreamcli",
@@ -44,11 +46,16 @@ const FLATPAK_BUILDER: DeployTool = {
 };
 
 const FLATPAK_NODE_GENERATOR: DeployTool = {
-    command: "flatpak-node-generator",
-    purpose: "vendors the npm dependencies a Flathub build installs offline",
+    command: FLATPAK_NODE_GENERATOR_COMMAND,
+    purpose: "vendors the dependencies a Flathub build installs offline",
     isOptional: false,
 };
 
+const FLATPAK_NODE_GENERATOR_PNPM: DeployTool = {
+    ...FLATPAK_NODE_GENERATOR,
+    isPresent: () => hasGeneratorPnpmSupport(),
+};
+
 const STRIP: DeployTool = {
     command: "strip",
     purpose: "would shrink the bundled Node.js by removing its symbols",
@@ -71,6 +78,18 @@ const isFlatpakRefInstalled = (ref: string): boolean => {
     return spawnSync(flatpak, ["info", ref], { stdio: "ignore" }).status === 0;
 };
 
+const hasGeneratorPnpmSupport = (): boolean => {
+    const generator = tryResolveExecutable(FLATPAK_NODE_GENERATOR_COMMAND);
+
+    if (generator === undefined) {
+        return false;
+    }
+
+    const help = spawnSync(generator, ["--help"], { encoding: "utf8" });
+
+    return help.error === undefined && help.output.join("").includes(GENERATOR_PNPM_OPTION);
+};
+
 const isToolPresent = (tool: DeployTool): boolean =>
     tool.isPresent === undefined ? tryResolveExecutable(tool.command) !== undefined : tool.isPresent();
 
@@ -123,6 +142,8 @@ const warnMissingOptional = (report: ToolReport): void => {
 export {
     APPSTREAMCLI,
     FLATPAK_NODE_GENERATOR,
+    FLATPAK_NODE_GENERATOR_PNPM,
+    GENERATOR_PNPM_OPTION,
     assertTools,
     DESKTOP_FILE_VALIDATE,
     FILE_TOOL,