@gtkx/cli 1.6.0 → 2.0.0-beta.2

package/src/deploy/freedesktop/copyright.ts

@@ -1,6 +1,6 @@
-import { readFileSync } from "node:fs";
 import type { DeploySettings, Notice, NoticeSection } from "../types.js";
 import { BUNDLE_FILENAME } from "../../vite-plugins/esm-extension.js";
+import { readLicenseText } from "../notices/text.js";
 
 type FileStanza = {
     settings: DeploySettings;
@@ -30,18 +30,6 @@ const foldedField = (name: string, lines: string[]): string[] => {
     return first === undefined ? [] : [`${name}: ${first}`, ...rest.map((line) => indentLine(line))];
 };
 
-const licenseText = (licenseFile: string | null): string | null => {
-    if (licenseFile === null) {
-        return null;
-    }
-
-    try {
-        return readFileSync(licenseFile, "utf8").trimEnd();
-    } catch {
-        return null;
-    }
-};
-
 const shortName = (license: string): string =>
     license
         .replaceAll(SPDX_GROUPING, " ")
@@ -159,7 +147,7 @@ const applicationStanza = (settings: DeploySettings, text: string | null): strin
 ];
 
 const renderCopyright = (settings: DeploySettings, sections: NoticeSection[]): string => {
-    const own = licenseText(settings.paths.licenseFile);
+    const own = settings.paths.licenseFile === null ? null : readLicenseText(settings.paths.licenseFile);
     const reproduced: Set<string> = new Set(own === null ? [] : [own]);
 
     const stanzas = filePatterns(sections).flatMap((files) =>

package/src/deploy/freedesktop/metainfo.ts

@@ -14,6 +14,54 @@ import { element, renderDocument, text, type XmlNode } from "./xml.js";
 
 const COMPONENT_TYPE = "desktop-application";
 const DESKTOP_SUFFIX = ".desktop";
+const COMPONENT_CLOSE = "</component>\n";
+const PROVIDES_CLOSE = "    </provides>\n";
+const PROVIDES_FRAGMENT = /^<provides\s*>([\s\S]*)<\/provides>$/;
+
+const normalizeExtraFragment = (fragment: string, index: number): string => {
+    const normalized = fragment.trim();
+
+    if (normalized.length === 0) {
+        throw new Error(`Cannot render deploy.metainfoExtra entry ${String(index + 1)}: it is empty`);
+    }
+
+    return normalized;
+};
+
+const indentFragment = (fragment: string, depth: number): string => {
+    const indentation = " ".repeat(depth * 4);
+
+    return fragment.split(/\r?\n/).map((line) => `${indentation}${line}`).join("\n");
+};
+
+const appendExtraFragments = (document: string, fragments: string[]): string => {
+    if (fragments.length === 0) {
+        return document;
+    }
+
+    let merged = document;
+    const componentFragments: string[] = [];
+
+    for (const [index, rawFragment] of fragments.entries()) {
+        const fragment = normalizeExtraFragment(rawFragment, index);
+        const provides = PROVIDES_FRAGMENT.exec(fragment)?.[1]?.trim();
+
+        if (provides === undefined) {
+            componentFragments.push(fragment);
+            continue;
+        }
+
+        merged = merged.replace(PROVIDES_CLOSE, () => `${indentFragment(provides, 2)}\n${PROVIDES_CLOSE}`);
+    }
+
+    if (componentFragments.length === 0) {
+        return merged;
+    }
+
+    const extra = componentFragments.map((fragment) => indentFragment(fragment, 1)).join("\n");
+
+    return merged.replace(COMPONENT_CLOSE, () => `${extra}\n${COMPONENT_CLOSE}`);
+};
 
 const launchable = (applicationId: string): XmlNode => ({
     tag: "launchable",
@@ -21,26 +69,30 @@ const launchable = (applicationId: string): XmlNode => ({
     text: `${applicationId}${DESKTOP_SUFFIX}`,
 });
 
-const renderMetainfo = (settings: DeploySettings): string =>
-    renderDocument(
-        element("component", { type: COMPONENT_TYPE }, [
-            text("id", settings.applicationId),
-            text("name", settings.name),
-            text("summary", settings.summary),
-            text("metadata_license", settings.metadataLicense),
-            text("project_license", settings.license),
-            ...developerSection(settings),
-            ...descriptionSection(settings),
-            launchable(settings.applicationId),
-            ...providesSection(settings),
-            ...listSection("categories", "category", settings.categories),
-            ...listSection("keywords", "keyword", settings.keywords),
-            ...urlsSection(settings),
-            ...screenshotsSection(settings),
-            ...releasesSection(settings),
-            ...contentRatingSection(settings),
-            ...brandingSection(settings),
-        ]),
-    );
+const metainfoRoot = (settings: DeploySettings): XmlNode =>
+    element("component", { type: COMPONENT_TYPE }, [
+        text("id", settings.applicationId),
+        text("name", settings.name),
+        text("summary", settings.summary),
+        text("metadata_license", settings.metadataLicense),
+        text("project_license", settings.license),
+        ...developerSection(settings),
+        ...descriptionSection(settings),
+        launchable(settings.applicationId),
+        ...providesSection(settings),
+        ...listSection("categories", "category", settings.categories),
+        ...listSection("keywords", "keyword", settings.keywords),
+        ...urlsSection(settings),
+        ...screenshotsSection(settings),
+        ...releasesSection(settings),
+        ...contentRatingSection(settings),
+        ...brandingSection(settings),
+    ]);
+
+const renderMetainfo = (settings: DeploySettings): string => {
+    const document = renderDocument(metainfoRoot(settings));
+
+    return appendExtraFragments(document, settings.deploy.metainfoExtra ?? []);
+};
 
 export { renderMetainfo };

package/src/deploy/freedesktop/xml.ts

@@ -1,3 +1,5 @@
+import XMLBuilder from "fast-xml-builder";
+
 type XmlNode = {
     tag: string;
     attributes?: Record<string, string>;
@@ -5,23 +7,26 @@ type XmlNode = {
     text?: string;
 };
 
-const XML_DECLARATION = '<?xml version="1.0" encoding="UTF-8"?>';
-const INDENT = " ".repeat(4);
+type OrderedNode = Record<string, unknown>;
 
-const ESCAPES: Record<string, string> = {
-    '"': "&quot;",
-    "&": "&amp;",
-    "<": "&lt;",
-    ">": "&gt;",
-};
+const XML_ENCODING = ["UTF", "8"].join("-");
 
-const escapeXml = (value: string): string =>
-    value.replaceAll(/["&<>]/g, (character) => ESCAPES[character] ?? character);
+const builder = new XMLBuilder({
+    format: true,
+    ignoreAttributes: false,
+    indentBy: " ".repeat(4),
+    preserveOrder: true,
+    suppressEmptyNode: true,
+});
 
-const renderAttributes = (attributes: Record<string, string> | undefined): string =>
-    Object.entries(attributes ?? {})
-        .map(([key, value]) => ` ${key}="${escapeXml(value)}"`)
-        .join("");
+const orderedNode = (node: XmlNode): OrderedNode => ({
+    [node.tag]: node.text === undefined
+        ? (node.children ?? []).map((child) => orderedNode(child))
+        : [{ "#text": node.text }],
+    ...(node.attributes && {
+        ":@": Object.fromEntries(Object.entries(node.attributes).map(([key, value]) => [`@_${key}`, value])),
+    }),
+});
 
 const element = (tag: string, attributes: Record<string, string>, children: XmlNode[]): XmlNode => ({
     tag,
@@ -31,23 +36,10 @@ const element = (tag: string, attributes: Record<string, string>, children: XmlN
 
 const text = (tag: string, value: string): XmlNode => ({ tag, text: value });
 
-const renderNode = (node: XmlNode, depth: number): string[] => {
-    const padding = INDENT.repeat(depth);
-    const open = `${padding}<${node.tag}${renderAttributes(node.attributes)}`;
-
-    if (node.text !== undefined) {
-        return [`${open}>${escapeXml(node.text)}</${node.tag}>`];
-    }
-
-    const children = node.children ?? [];
-
-    if (children.length === 0) {
-        return [`${open}/>`];
-    }
-
-    return [`${open}>`, ...children.flatMap((child) => renderNode(child, depth + 1)), `${padding}</${node.tag}>`];
-};
-
-const renderDocument = (root: XmlNode): string => [XML_DECLARATION, ...renderNode(root, 0), ""].join("\n");
+const renderDocument = (root: XmlNode): string =>
+    `${builder.build([
+        { "?xml": [{ "#text": "" }], ":@": { "@_version": "1.0", "@_encoding": XML_ENCODING } },
+        orderedNode(root),
+    ])}\n`;
 
 export { element, renderDocument, text, type XmlNode };

package/src/deploy/nfpm/config.ts

@@ -1,5 +1,6 @@
 import type { DeployPayload, DeploySettings, StagedFile } from "../types.js";
 import { resolveDepends } from "../depends.js";
+import { glibcMinimumForFiles } from "../node-runtime/elf.js";
 import { groupForCategories, sectionForCategories } from "../settings/categories.js";
 import { nfpmContents } from "./contents.js";
 import { debDescription, rpmDescription } from "./description.js";
@@ -125,7 +126,9 @@ const descriptionFor = (settings: DeploySettings, packager: NfpmPackager): strin
 const renderNfpmConfig = (payload: DeployPayload, packager: NfpmPackager): NfpmConfig => {
     const settings = payload.settings;
     const isRpm = packager === "rpm";
-    const depends = resolveDepends(settings, payload.node?.glibcMinimum ?? null);
+    const staged = stagedFilesFor(payload, packager);
+    const glibcMinimum = glibcMinimumForFiles(staged.map((file) => file.abs));
+    const depends = resolveDepends(settings, glibcMinimum);
 
     return {
         name: packageNameFor(settings, packager),
@@ -146,7 +149,7 @@ const renderNfpmConfig = (payload: DeployPayload, packager: NfpmPackager): NfpmC
         ...relationsFor(settings, packager),
         ...optional("scripts", scriptsFor(settings)),
         [packager]: packagerSettings(settings, packager),
-        contents: nfpmContents(PREFIX, stagedFilesFor(payload, packager), isRpm),
+        contents: nfpmContents(PREFIX, staged, isRpm),
     };
 };
 

package/src/deploy/nfpm/contents.ts

@@ -13,10 +13,16 @@ const FILESYSTEM_OWNED_PREFIXES = new Set([
     "/usr",
     "/usr/bin",
     "/usr/lib",
+    "/usr/lib/systemd",
+    "/usr/lib/systemd/system",
+    "/usr/lib/systemd/user",
+    "/usr/libexec",
     "/usr/share",
     "/usr/share/applications",
     "/usr/share/dbus-1",
     "/usr/share/dbus-1/services",
+    "/usr/share/dbus-1/system-services",
+    "/usr/share/dbus-1/system.d",
     "/usr/share/doc",
     "/usr/share/glib-2.0",
     "/usr/share/glib-2.0/schemas",
@@ -25,6 +31,8 @@ const FILESYSTEM_OWNED_PREFIXES = new Set([
     "/usr/share/metainfo",
     "/usr/share/mime",
     "/usr/share/mime/packages",
+    "/usr/share/polkit-1",
+    "/usr/share/polkit-1/actions",
 ]);
 
 const ICON_THEME_PREFIX = "/usr/share/icons/";

package/src/deploy/node-runtime/elf.ts

@@ -1,4 +1,4 @@
-import { readFileSync } from "node:fs";
+import { closeSync, openSync, readFileSync, readSync } from "node:fs";
 
 type ElfSection = {
     name: string;
@@ -17,6 +17,7 @@ type DynamicEntry = {
 };
 
 const ELF_MAGIC = "ELF";
+const ELF_MAGIC_SIZE = 4;
 const CLASS_64 = 2;
 const LITTLE_ENDIAN = 1;
 const OFFSET_CLASS = 4;
@@ -35,8 +36,11 @@ const DYNAMIC_VALUE_OFFSET = 8;
 const GLIBC_VERSION = /GLIBC_(\d+)\.(\d+)/g;
 const VERSION_RADIX = 1000;
 
+const hasElfMagic = (buffer: Buffer): boolean =>
+    buffer.length >= OFFSET_CLASS && buffer.subarray(0, 4).toString("latin1") === ELF_MAGIC;
+
 const assertElf64 = (buffer: Buffer, path: string): void => {
-    if (buffer.length < OFFSET_SECTION_NAME_INDEX || buffer.subarray(0, 4).toString("latin1") !== ELF_MAGIC) {
+    if (buffer.length < OFFSET_SECTION_NAME_INDEX || !hasElfMagic(buffer)) {
         throw new Error(`Cannot read ${path}: it is not an ELF binary`);
     }
 
@@ -130,8 +134,7 @@ const readGlibcMinimum = (strings: Buffer): string | null => {
 const stringTable = (buffer: Buffer, dynstr: ElfSection | undefined): Buffer =>
     dynstr === undefined ? Buffer.alloc(0) : buffer.subarray(dynstr.offset, dynstr.offset + dynstr.size);
 
-const readElfInfo = (path: string): ElfInfo => {
-    const buffer = readFileSync(path);
+const readElfBuffer = (buffer: Buffer, path: string): ElfInfo => {
     assertElf64(buffer, path);
     const sections = readSections(buffer);
     const strings = stringTable(buffer, sectionFor(sections, ".dynstr"));
@@ -142,4 +145,39 @@ const readElfInfo = (path: string): ElfInfo => {
     };
 };
 
-export { type ElfInfo, readElfInfo };
+const readElfInfo = (path: string): ElfInfo => readElfBuffer(readFileSync(path), path);
+
+const readFilePrefix = (descriptor: number, size: number): Buffer => {
+    const buffer = Buffer.alloc(size);
+    const bytesRead = readSync(descriptor, buffer, 0, size, 0);
+
+    return buffer.subarray(0, bytesRead);
+};
+
+const readOptionalElfInfo = (path: string): ElfInfo | null => {
+    const descriptor = openSync(path, "r");
+
+    try {
+        const prefix = readFilePrefix(descriptor, ELF_MAGIC_SIZE);
+
+        return hasElfMagic(prefix) ? readElfBuffer(readFileSync(descriptor), path) : null;
+    } finally {
+        closeSync(descriptor);
+    }
+};
+
+const glibcMinimumForFiles = (paths: Iterable<string>): string | null => {
+    const versions: number[][] = [];
+
+    for (const path of paths) {
+        const minimum = readOptionalElfInfo(path)?.glibcMinimum;
+
+        if (minimum !== undefined && minimum !== null) {
+            versions.push(minimum.split(".").map(Number));
+        }
+    }
+
+    return formatVersion(highestVersion(versions));
+};
+
+export { type ElfInfo, glibcMinimumForFiles, readElfInfo };

package/src/deploy/node-runtime/index.ts

@@ -1,4 +1,6 @@
+import { MINIMUM_NODE_VERSION } from "@gtkx/config/internal";
 import { info, tryResolveExecutable } from "@gtkx/utils";
+import { execFileSync } from "node:child_process";
 import { chmodSync, copyFileSync, mkdirSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import type { DeploySettings, NodeRuntime } from "../types.js";
@@ -13,13 +15,92 @@ type StagedRuntime = {
     licenseFile: string | null;
 };
 
+type NodeSource = "download" | "host" | "path";
+
 const BYTES_PER_MIB = 1024 * 1024;
 const EXECUTABLE_MODE = 0o755;
 const NODE_FILENAME = "node";
+const NODE_VERSION_PATTERN = /^v?(\d+)\.(\d+)\.(\d+)$/;
+const VERSION_PROBE_TIMEOUT_MS = 10_000;
+const VERSION_PROBE_MAX_BUFFER = 1024;
+
+const nodeSourceFor = (settings: DeploySettings): NodeSource => settings.deploy.node?.source ?? "download";
+
+const parseNodeVersion = (value: string, subject: string): { parts: number[]; version: string } => {
+    const match = NODE_VERSION_PATTERN.exec(value.trim());
+
+    if (match === null) {
+        throw new Error(`Cannot determine the Node.js version for ${subject}: expected a version such as 26.7.0`);
+    }
+
+    const parts = match.slice(1).map(Number);
+
+    return { parts, version: parts.map(String).join(".") };
+};
+
+const compareVersions = (left: number[], right: number[]): number => {
+    for (let index = 0; index < Math.max(left.length, right.length); index += 1) {
+        const difference = (left[index] ?? 0) - (right[index] ?? 0);
+
+        if (difference !== 0) {
+            return difference;
+        }
+    }
+
+    return 0;
+};
+
+const supportedNodeVersion = (value: string, subject: string): string => {
+    const parsed = parseNodeVersion(value, subject);
+    const minimum = parseNodeVersion(MINIMUM_NODE_VERSION, "GTKX");
+
+    if (compareVersions(parsed.parts, minimum.parts) < 0) {
+        throw new Error(
+            `Cannot bundle Node.js ${parsed.version} for ${subject}: GTKX requires ${MINIMUM_NODE_VERSION} or newer`,
+        );
+    }
+
+    return parsed.version;
+};
+
+const probeNodeVersion = (path: string): string => {
+    try {
+        const output = execFileSync(path, ["--version"], {
+            encoding: "utf8",
+            env: { ...process.env, NODE_OPTIONS: "" },
+            maxBuffer: VERSION_PROBE_MAX_BUFFER,
+            timeout: VERSION_PROBE_TIMEOUT_MS,
+        });
+
+        return supportedNodeVersion(output, path);
+    } catch (error) {
+        if (error instanceof Error && error.message.startsWith("Cannot bundle Node.js")) {
+            throw error;
+        }
+
+        throw new Error(`Cannot determine the Node.js version from ${path}`, { cause: error });
+    }
+};
+
+const assertExpectedVersion = (configured: string | undefined, actual: string, source: NodeSource): string => {
+    if (configured === undefined) {
+        return actual;
+    }
+
+    const expected = parseNodeVersion(configured, `deploy.node.source: "${source}"`).version;
+
+    if (expected !== actual) {
+        throw new Error(
+            `The Node.js runtime from deploy.node.source "${source}" is ${actual}, not the configured ${expected}`,
+        );
+    }
+
+    return actual;
+};
 
 const sourcePathFor = (settings: DeploySettings): string => {
     const node = settings.deploy.node ?? {};
-    const source = node.source ?? "download";
+    const source = nodeSourceFor(settings);
 
     if (source === "host") {
         return process.execPath;
@@ -32,6 +113,21 @@ const sourcePathFor = (settings: DeploySettings): string => {
     return resolve(settings.paths.root, node.path);
 };
 
+const resolveNodeVersion = (settings: DeploySettings): string => {
+    const node = settings.deploy.node ?? {};
+    const source = nodeSourceFor(settings);
+
+    if (source === "download") {
+        return supportedNodeVersion(node.version ?? MINIMUM_NODE_VERSION, 'deploy.node.source: "download"');
+    }
+
+    const actual = source === "host"
+        ? supportedNodeVersion(process.versions.node, 'deploy.node.source: "host"')
+        : probeNodeVersion(sourcePathFor(settings));
+
+    return assertExpectedVersion(node.version, actual, source);
+};
+
 const didStripBinary = (path: string): boolean => {
     if (tryResolveExecutable("strip") === undefined) {
         return false;
@@ -60,7 +156,11 @@ const stageDownloadedNode = async (settings: DeploySettings, version: string): P
     return downloaded;
 };
 
-const stageFromSource = async (settings: DeploySettings, version: string, source: string): Promise<StagedRuntime> => {
+const stageFromSource = async (
+    settings: DeploySettings,
+    version: string,
+    source: NodeSource,
+): Promise<StagedRuntime> => {
     if (source === "download") {
         return stageDownloadedNode(settings, version);
     }
@@ -73,8 +173,8 @@ const stageFromSource = async (settings: DeploySettings, version: string, source
 
 const resolveNodeRuntime = async (settings: DeploySettings): Promise<NodeRuntime> => {
     const node = settings.deploy.node ?? {};
-    const source = node.source ?? "download";
-    const version = node.version ?? process.versions.node;
+    const source = nodeSourceFor(settings);
+    const version = resolveNodeVersion(settings);
     const staged = await stageFromSource(settings, version, source);
     const isStripped = node.shouldStrip === false ? false : didStripBinary(staged.path);
     const elf = readElfInfo(staged.path);
@@ -83,4 +183,4 @@ const resolveNodeRuntime = async (settings: DeploySettings): Promise<NodeRuntime
     return { ...staged, version, glibcMinimum: elf.glibcMinimum, isStripped };
 };
 
-export { resolveNodeRuntime, sourcePathFor };
+export { resolveNodeRuntime, resolveNodeVersion, sourcePathFor };

package/src/deploy/node-runtime/license.ts

@@ -1,5 +1,5 @@
-import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { readLicenseText } from "../notices/text.js";
 
 const LICENSE_FILENAME = "LICENSE";
 const NODE_MARKER = "Node.js";
@@ -10,13 +10,7 @@ const licenseCandidates = (binary: string): string[] => {
     return [join(dir, LICENSE_FILENAME), join(dir, "..", LICENSE_FILENAME)];
 };
 
-const isNodeLicense = (path: string): boolean => {
-    try {
-        return readFileSync(path, "utf8").includes(NODE_MARKER);
-    } catch {
-        return false;
-    }
-};
+const isNodeLicense = (path: string): boolean => readLicenseText(path)?.includes(NODE_MARKER) === true;
 
 const licenseBesideNode = (binary: string): string | null =>
     licenseCandidates(binary).find((candidate) => isNodeLicense(candidate)) ?? null;

package/src/deploy/notices/node-runtime.ts

@@ -1,6 +1,6 @@
 import { warn } from "@gtkx/utils";
 import type { DeploySettings, NodeRuntime, NoticeSection } from "../types.js";
-import { sourcePathFor } from "../node-runtime/index.js";
+import { resolveNodeVersion, sourcePathFor } from "../node-runtime/index.js";
 import { licenseBesideNode } from "../node-runtime/license.js";
 import { NODE_FILENAME } from "../payload/launcher.js";
 import { nodeLicenseDestination } from "../payload/stage.js";
@@ -32,7 +32,7 @@ const MISSING_LICENSE =
 const isSourceMode = (settings: DeploySettings): boolean => settings.deploy.flatpak?.mode === "source";
 
 const versionFor = (settings: DeploySettings, node: NodeRuntime | null): string =>
-    node?.version ?? settings.deploy.node?.version ?? process.versions.node;
+    node?.version ?? resolveNodeVersion(settings);
 
 const licenseFileFor = (settings: DeploySettings, node: NodeRuntime | null): string | null => {
     if (node !== null) {

package/src/deploy/notices/packages.ts

@@ -1,4 +1,5 @@
 import { sortStringsBy, warn } from "@gtkx/utils";
+import hostedGitInfo from "hosted-git-info";
 import { existsSync, realpathSync } from "node:fs";
 import { join, resolve } from "node:path";
 import type { RecordedPackage } from "../../internal/build-manifest.js";
@@ -17,10 +18,6 @@ type BundledPackage = {
 };
 
 const MANIFEST_FILENAME = "package.json";
-const GIT_PREFIX = /^git\+/;
-const GIT_SUFFIX = /\.git$/;
-const GIT_SCHEME = /^git:\/\//;
-const GITHUB_SLUG = /^(?:github:)?(?<slug>[\w.-]+\/[\w.-]+)$/;
 
 const realPath = (path: string): string => {
     try {
@@ -47,14 +44,9 @@ const sourceUrl = (manifest: PackageManifest): string | null => {
         return null;
     }
 
-    const url = configured.replace(GIT_PREFIX, "").replace(GIT_SUFFIX, "").replace(GIT_SCHEME, "https://");
-    const slug = GITHUB_SLUG.exec(url)?.groups?.slug;
+    const url = configured.replace(/^git\+/, "").replace(/\.git$/, "").replace(/^git:\/\//, "https://");
 
-    if (slug !== undefined) {
-        return `https://github.com/${slug}`;
-    }
-
-    return url.startsWith("http") ? url : null;
+    return hostedGitInfo.fromUrl(url)?.browse() ?? (url.startsWith("http") ? url : null);
 };
 
 const missingPackage = (entry: RecordedPackage): BundledPackage => ({

package/src/deploy/payload/copy-tree.ts

@@ -1,5 +1,6 @@
+import { isPathInside } from "@gtkx/utils";
 import { chmodSync, copyFileSync, mkdirSync, statSync, writeFileSync } from "node:fs";
-import { dirname, isAbsolute, join, relative } from "node:path";
+import { dirname, join } from "node:path";
 import type { StagedFile } from "../types.js";
 import { listFilesRecursive } from "../../internal/list-files.js";
 
@@ -16,9 +17,7 @@ const modeFor = (rel: string): number => {
 };
 
 const assertInsideRoot = (root: string, rel: string, abs: string): void => {
-    const escape = relative(root, abs);
-
-    if (escape.length === 0 || escape.startsWith("..") || isAbsolute(escape)) {
+    if (!isPathInside(root, abs)) {
         throw new Error(`Cannot stage "${rel}": it resolves outside the staging directory`);
     }
 };

package/src/deploy/payload/launcher.ts

@@ -2,6 +2,8 @@ import type { DeploySettings } from "../types.js";
 import { BUNDLE_FILENAME } from "../../vite-plugins/esm-extension.js";
 
 const NODE_FILENAME = "node";
+const SHELL_SINGLE_QUOTE = "'";
+const SHELL_SINGLE_QUOTE_ESCAPE = "'\"'\"'";
 
 const compileCacheLines = (binaryName: string): string[] => [
     "cache_home=${XDG_CACHE_HOME:-${HOME:-/tmp}/.cache}",
@@ -9,6 +11,22 @@ const compileCacheLines = (binaryName: string): string[] => [
     "export NODE_COMPILE_CACHE",
 ];
 
+const shellQuote = (value: string): string =>
+    SHELL_SINGLE_QUOTE + value.split(SHELL_SINGLE_QUOTE).join(SHELL_SINGLE_QUOTE_ESCAPE) + SHELL_SINGLE_QUOTE;
+
+const launcherEnvLines = (settings: DeploySettings): string[] =>
+    Object.entries(settings.deploy.launcherEnv ?? {})
+        .toSorted(([left], [right]) => left.localeCompare(right))
+        .map(([name, value]) => `export ${name}=${shellQuote(value)}`);
+
+const launcherCommand = (settings: DeploySettings, libDir: string): string =>
+    [
+        `"${libDir}/${NODE_FILENAME}"`,
+        ...(settings.deploy.nodeFlags ?? []).map((flag) => shellQuote(flag)),
+        `"${libDir}/${BUNDLE_FILENAME}"`,
+        '"$@"',
+    ].join(" ");
+
 const renderLauncher = (settings: DeploySettings): string => {
     const libDir = `$prefix/lib/${settings.binaryName}`;
     const shouldUseCompileCache = settings.deploy.node?.shouldUseCompileCache !== false;
@@ -21,7 +39,8 @@ const renderLauncher = (settings: DeploySettings): string => {
         'GTKX_LOCALE_DIR="$prefix/share/locale"',
         "export GTKX_LOCALE_DIR",
         ...(shouldUseCompileCache ? compileCacheLines(settings.binaryName) : []),
-        `exec "${libDir}/${NODE_FILENAME}" "${libDir}/${BUNDLE_FILENAME}" "$@"`,
+        ...launcherEnvLines(settings),
+        `exec ${launcherCommand(settings, libDir)}`,
         "",
     ].join("\n");
 };