@gtkx/cli 2.0.0-beta.6 → 2.0.0-beta.8

package/dist/vitest-plugin.js

@@ -1,5 +1,6 @@
 import gtkxVitest, {} from "@gtkx/vitest";
 import { gtkxEnsureStore } from "./vite-plugins/ensure-store.js";
+import { gtkxFontWorkerEnv } from "./vite-plugins/font-worker-env.js";
 import { gtkxVitePlugins } from "./vite-plugins/index.js";
 import { gtkxSettingsWorkerEnv } from "./vite-plugins/settings-worker-env.js";
 /**
@@ -13,6 +14,7 @@ const gtkx = (options = {}) => [
     gtkxEnsureStore(options.configFile),
     ...gtkxVitePlugins({ configFile: options.configFile }),
     gtkxSettingsWorkerEnv(options.configFile),
+    gtkxFontWorkerEnv(options.configFile),
     gtkxVitest(options),
 ];
 export default gtkx;

package/dist/vitest-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"vitest-plugin.js","sourceRoot":"","sources":["../src/vitest-plugin.ts"],"names":[],"mappings":"AACA,OAAO,UAAU,EAAE,EAAsB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,IAAI,GAAG,CAAC,UAAyB,EAAE,EAAY,EAAE,CAAC;IACpD,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;IACnC,GAAG,eAAe,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;IACtD,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;IACzC,UAAU,CAAC,OAAO,CAAC;CACtB,CAAC;AAEF,eAAe,IAAI,CAAC","sourcesContent":["import type { Plugin } from \"vite\";\nimport gtkxVitest, { type PluginOptions } from \"@gtkx/vitest\";\nimport { gtkxEnsureStore } from \"./vite-plugins/ensure-store.js\";\nimport { gtkxVitePlugins } from \"./vite-plugins/index.js\";\nimport { gtkxSettingsWorkerEnv } from \"./vite-plugins/settings-worker-env.js\";\n\n/**\n * Vite plugin stack for testing a GTKX application: the generated bindings the tests import,\n * the plugins the app is built with, the project's compiled GSettings schemas exposed to every\n * test worker, and a headless display per worker.\n *\n * @returns The plugins to spread into a Vitest config.\n */\nconst gtkx = (options: PluginOptions = {}): Plugin[] => [\n    gtkxEnsureStore(options.configFile),\n    ...gtkxVitePlugins({ configFile: options.configFile }),\n    gtkxSettingsWorkerEnv(options.configFile),\n    gtkxVitest(options),\n];\n\nexport default gtkx;\n"]}
+{"version":3,"file":"vitest-plugin.js","sourceRoot":"","sources":["../src/vitest-plugin.ts"],"names":[],"mappings":"AACA,OAAO,UAAU,EAAE,EAAsB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,IAAI,GAAG,CAAC,UAAyB,EAAE,EAAY,EAAE,CAAC;IACpD,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;IACnC,GAAG,eAAe,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;IACtD,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;IACzC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC;IACrC,UAAU,CAAC,OAAO,CAAC;CACtB,CAAC;AAEF,eAAe,IAAI,CAAC","sourcesContent":["import type { Plugin } from \"vite\";\nimport gtkxVitest, { type PluginOptions } from \"@gtkx/vitest\";\nimport { gtkxEnsureStore } from \"./vite-plugins/ensure-store.js\";\nimport { gtkxFontWorkerEnv } from \"./vite-plugins/font-worker-env.js\";\nimport { gtkxVitePlugins } from \"./vite-plugins/index.js\";\nimport { gtkxSettingsWorkerEnv } from \"./vite-plugins/settings-worker-env.js\";\n\n/**\n * Vite plugin stack for testing a GTKX application: the generated bindings the tests import,\n * the plugins the app is built with, the project's compiled GSettings schemas exposed to every\n * test worker, and a headless display per worker.\n *\n * @returns The plugins to spread into a Vitest config.\n */\nconst gtkx = (options: PluginOptions = {}): Plugin[] => [\n    gtkxEnsureStore(options.configFile),\n    ...gtkxVitePlugins({ configFile: options.configFile }),\n    gtkxSettingsWorkerEnv(options.configFile),\n    gtkxFontWorkerEnv(options.configFile),\n    gtkxVitest(options),\n];\n\nexport default gtkx;\n"]}

package/env.d.ts

@@ -14,6 +14,15 @@ declare module "*?icon" {
     export default iconName;
 }
 
+declare module "*?font" {
+    /**
+     * Font family name of the bundled font. Importing the module bundles the font file with the application and
+     * puts it where fontconfig finds it, so the family is available to Pango without any runtime registration.
+     */
+    const fontFamily: string;
+    export default fontFamily;
+}
+
 declare module "*.css?url" {
     /**
      * Absolute filesystem path of the source stylesheet under `gtkx dev` or the emitted stylesheet once built,

package/package.json

@@ -1,11 +1,13 @@
 {
   "name": "@gtkx/cli",
-  "version": "2.0.0-beta.6",
-  "description": "GTK app toolchain for React: scaffold, dev server, build, docs.",
+  "version": "2.0.0-beta.8",
+  "description": "Adwaita-first GNOME app toolchain for React and TypeScript.",
   "keywords": [
     "gtkx",
     "gtk",
     "gtk4",
+    "adwaita",
+    "gnome",
     "react",
     "typescript",
     "native",
@@ -70,33 +72,33 @@
   "dependencies": {
     "@babel/core": "^8.0.1",
     "@babel/preset-typescript": "^8.0.1",
-    "@gtkx/codegen": "2.0.0-beta.6",
-    "@gtkx/config": "2.0.0-beta.6",
-    "@gtkx/mcp": "2.0.0-beta.6",
-    "@gtkx/native": "2.0.0-beta.6",
-    "@gtkx/runtime": "2.0.0-beta.6",
-    "@gtkx/utils": "2.0.0-beta.6",
-    "@gtkx/vitest": "2.0.0-beta.6",
-    "@swc/core": "^1.16.1",
+    "@gtkx/codegen": "2.0.0-beta.8",
+    "@gtkx/config": "2.0.0-beta.8",
+    "@gtkx/mcp": "2.0.0-beta.8",
+    "@gtkx/native": "2.0.0-beta.8",
+    "@gtkx/runtime": "2.0.0-beta.8",
+    "@gtkx/utils": "2.0.0-beta.8",
+    "@gtkx/vitest": "2.0.0-beta.8",
+    "@swc/core": "^1.16.2",
     "babel-plugin-react-compiler": "^1.0.0",
     "citty": "^0.2.2",
-    "confbox": "^0.2.4",
-    "create-gtkx": "2.0.0-beta.6",
+    "confbox": "^0.3.1",
+    "create-gtkx": "2.0.0-beta.8",
     "fast-xml-builder": "^1.3.1",
     "fast-xml-parser": "^5.11.1",
     "hosted-git-info": "^10.1.1",
-    "i18next-cli": "1.72.1",
+    "i18next-cli": "1.73.1",
     "jiti": "^2.7.0",
     "react-refresh": "^0.18.0",
     "vite": "^8.2.2",
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@gtkx/testing": "2.0.0-beta.6",
+    "@gtkx/testing": "2.0.0-beta.8",
     "@types/babel__core": "^7.20.5",
     "@types/hosted-git-info": "^3.0.5",
     "@types/react-refresh": "^0.14.7",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   },
   "peerDependencies": {
     "react": "^19"

package/src/cli.ts

@@ -18,7 +18,7 @@ const main = defineCommand({
     meta: {
         name: "gtkx",
         version,
-        description: "CLI for GTKX: create and develop GTK4 React applications",
+        description: "CLI for GTKX: create and develop Adwaita-first GNOME applications",
     },
     subCommands: {
         dev: async () => {

package/src/codegen/freshness.ts

@@ -1,5 +1,6 @@
 import type { Config } from "@gtkx/config";
 import { resolveGirPath, resolveLibraries } from "@gtkx/codegen";
+import { resolveBoundLibraries } from "@gtkx/codegen/internal";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { type CodegenStore, resolveCodegenStore } from "./store-resolver.js";
@@ -86,7 +87,10 @@ const hasStoreExports = (storeDir: string, required: string[], forbidden: string
 };
 
 const isGiStoreStale = (store: CodegenStore, libraries: string[]): boolean => {
-    const required = [PACKAGE_EXPORT, ...libraries.map((library) => namespaceExport(library))];
+    const required = [
+        PACKAGE_EXPORT,
+        ...resolveBoundLibraries(libraries).map((library) => namespaceExport(library)),
+    ];
 
     return !hasStoreExports(store.giStoreDir, required);
 };

package/src/commands/deploy.ts

@@ -1,6 +1,7 @@
 import { defineCommand } from "citty";
 import { KNOWN_NAMES } from "../deploy/registry.js";
 import { runDeploy } from "../deploy/run-deploy.js";
+import { KNOWN_ARCH_NAMES } from "../deploy/settings/arch.js";
 import { configArg, entryArg } from "../internal/entry-arg.js";
 import { resolveProject } from "../internal/prepare-project.js";
 
@@ -18,6 +19,10 @@ const deploy = defineCommand({
             type: "string",
             description: `Comma-separated package formats to build (${KNOWN_NAMES})`,
         },
+        arch: {
+            type: "string",
+            description: `Comma-separated architectures to build (${KNOWN_ARCH_NAMES}; default: the host)`,
+        },
         out: {
             type: "string",
             description: "Output directory relative to the project root (default: build)",
@@ -39,6 +44,7 @@ const deploy = defineCommand({
             cwd,
             configFile,
             targets: args.target,
+            arches: args.arch,
             outDir: args.out,
             shouldPrintManifests: args["print-manifests"] === true,
             shouldSkipBuild: args["skip-build"] === true,

package/src/deploy/download.ts

@@ -11,17 +11,23 @@ type DigestRequest = {
     subject: string;
 };
 
+type DigestAlgorithm = "sha256" | "sha512";
+
 type DownloadRequest = {
     url: string;
     dest: string;
     label: string;
-    sha256: string;
-    freshSha256?: (() => Promise<string>) | undefined;
+    digest: string;
+    algorithm?: DigestAlgorithm | undefined;
+    freshDigest?: (() => Promise<string>) | undefined;
     mode?: number | undefined;
 };
 
 const CACHE_NAMESPACE = "gtkx";
-const DIGEST_PATTERN = /^[\da-f]{64}$/;
+const DIGEST_PATTERN: Record<DigestAlgorithm, RegExp> = {
+    sha256: /^[\da-f]{64}$/,
+    sha512: /^[\da-f]{128}$/,
+};
 
 const cacheRoot = (): string => {
     const base = process.env.XDG_CACHE_HOME;
@@ -36,10 +42,11 @@ const cacheDir = (segments: string[]): string => {
     return dir;
 };
 
-const getDigest = (contents: Buffer): string => createHash("sha256").update(contents).digest("hex");
+const getDigest = (contents: Buffer, algorithm: DigestAlgorithm): string =>
+    createHash(algorithm).update(contents).digest("hex");
 
-const assertDigest = (url: string, contents: Buffer, expected: string): void => {
-    const actual = getDigest(contents);
+const assertDigest = (url: string, contents: Buffer, expected: string, algorithm: DigestAlgorithm): void => {
+    const actual = getDigest(contents, algorithm);
 
     if (actual !== expected) {
         throw new Error(`Checksum mismatch for ${url}\n  expected ${expected}\n  received ${actual}`);
@@ -62,11 +69,11 @@ const fetchText = async (url: string): Promise<string> => {
     return bytes.toString("utf8");
 };
 
-const readCachedDigest = (dest: string): string | undefined => {
+const readCachedDigest = (dest: string, algorithm: DigestAlgorithm): string | undefined => {
     try {
         const cached = readFileSync(dest, "utf8").trim();
 
-        return DIGEST_PATTERN.test(cached) ? cached : undefined;
+        return DIGEST_PATTERN[algorithm].test(cached) ? cached : undefined;
     } catch {
         return undefined;
     }
@@ -82,7 +89,7 @@ const publishedDigest = async (request: DigestRequest): Promise<string> => {
     const checksums = await fetchText(request.url);
     const digest = digestFromChecksums(checksums, request.assetName, request.subject);
 
-    if (!DIGEST_PATTERN.test(digest)) {
+    if (!DIGEST_PATTERN.sha256.test(digest)) {
         throw new Error(`${request.subject} published a malformed checksum for ${request.assetName}: "${digest}"`);
     }
 
@@ -92,17 +99,17 @@ const publishedDigest = async (request: DigestRequest): Promise<string> => {
 };
 
 const cachedDigest = async (request: DigestRequest): Promise<string> => {
-    const cached = readCachedDigest(request.dest);
+    const cached = readCachedDigest(request.dest, "sha256");
 
     return cached ?? publishedDigest(request);
 };
 
-const isCacheUsable = (dest: string, sha256: string): boolean => {
+const isCacheUsable = (dest: string, digest: string, algorithm: DigestAlgorithm): boolean => {
     if (!existsSync(dest)) {
         return false;
     }
 
-    if (getDigest(readFileSync(dest)) === sha256) {
+    if (getDigest(readFileSync(dest), algorithm) === digest) {
         return true;
     }
 
@@ -112,16 +119,17 @@ const isCacheUsable = (dest: string, sha256: string): boolean => {
 };
 
 const downloadFile = async (request: DownloadRequest): Promise<string> => {
-    const { url, dest, label, sha256, mode } = request;
+    const { url, dest, label, digest, mode } = request;
+    const algorithm = request.algorithm ?? "sha256";
 
-    if (isCacheUsable(dest, sha256)) {
+    if (isCacheUsable(dest, digest, algorithm)) {
         return dest;
     }
 
     info(`Downloading ${label}`);
-    const expected = request.freshSha256 === undefined ? sha256 : await request.freshSha256();
+    const expected = request.freshDigest === undefined ? digest : await request.freshDigest();
     const contents = await fetchBytes(url);
-    assertDigest(url, contents, expected);
+    assertDigest(url, contents, expected, algorithm);
     const staging = `${dest}.partial`;
     writeFileSync(staging, contents);
 
@@ -145,4 +153,12 @@ const digestFromChecksums = (checksums: string, assetName: string, subject: stri
     return digest;
 };
 
-export { cacheDir, cachedDigest, type DigestRequest, downloadFile, publishedDigest };
+export {
+    cacheDir,
+    cachedDigest,
+    type DigestRequest,
+    downloadFile,
+    publishedDigest,
+    readCachedDigest,
+    writeAtomically,
+};

package/src/deploy/native-addon.ts

@@ -0,0 +1,183 @@
+import { existsSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import type { DeployArchName, DeploySettings } from "./types.js";
+import { runCliTool } from "../internal/run-cli-tool.js";
+import { cacheDir, downloadFile, readCachedDigest, writeAtomically } from "./download.js";
+import { isHostArch } from "./settings/arch.js";
+
+type ProjectRequire = ReturnType<typeof createRequire>;
+type Tarball = { url: string; digest: string };
+
+const BINDING_FILENAME = "gtkx.node";
+const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+const NATIVE_MANIFEST = "@gtkx/native/package.json";
+const PACKAGE_ROOT = "package";
+const REQUEST_TIMEOUT = 30_000;
+const SRI_PREFIX = "sha512-";
+const STRIP_COMPONENTS = "1";
+const VERSION_PATTERN = /^[\w.+-]+$/;
+
+const binaryFilename = (arch: DeployArchName): string => `native.linux-${arch}-gnu.node`;
+const platformStem = (arch: DeployArchName): string => `native-linux-${arch}-gnu`;
+const platformPackage = (arch: DeployArchName): string => `@gtkx/${platformStem(arch)}`;
+
+const withoutTrailingSlash = (value: string): string => {
+    let end = value.length;
+
+    while (end > 0 && value[end - 1] === "/") {
+        end -= 1;
+    }
+
+    return value.slice(0, end);
+};
+
+const registryUrl = (): string => {
+    const configured = process.env.npm_config_registry;
+
+    return withoutTrailingSlash(configured !== undefined && configured.length > 0 ? configured : DEFAULT_REGISTRY);
+};
+
+const projectRequireFor = (root: string): ProjectRequire => createRequire(join(root, "package.json"));
+
+const localBinary = (projectRequire: ProjectRequire, arch: DeployArchName): string | null => {
+    const nativeRoot = dirname(projectRequire.resolve(NATIVE_MANIFEST));
+    const candidate = join(nativeRoot, binaryFilename(arch));
+
+    return existsSync(candidate) ? candidate : null;
+};
+
+const installedBinary = (projectRequire: ProjectRequire, arch: DeployArchName): string | null => {
+    try {
+        return projectRequire.resolve(platformPackage(arch));
+    } catch {
+        return null;
+    }
+};
+
+const manifestVersion = (manifest: unknown): string | null => {
+    if (typeof manifest !== "object" || manifest === null || !("version" in manifest)) {
+        return null;
+    }
+
+    const version = manifest.version;
+
+    return typeof version === "string" && VERSION_PATTERN.test(version) ? version : null;
+};
+
+const nativeVersion = (projectRequire: ProjectRequire): string => {
+    const parsed: unknown = JSON.parse(readFileSync(projectRequire.resolve(NATIVE_MANIFEST), "utf8"));
+    const version = manifestVersion(parsed);
+
+    if (version === null) {
+        throw new Error("Cannot read a usable version from @gtkx/native; is it installed?");
+    }
+
+    return version;
+};
+
+const hexFromIntegrity = (integrity: unknown, subject: string): string => {
+    if (typeof integrity !== "string" || !integrity.startsWith(SRI_PREFIX)) {
+        throw new Error(`The npm registry publishes no sha512 integrity for ${subject}`);
+    }
+
+    return Buffer.from(integrity.slice(SRI_PREFIX.length), "base64").toString("hex");
+};
+
+const fetchVersionDocument = async (url: string, subject: string): Promise<Record<string, unknown>> => {
+    const response = await fetch(url, { signal: AbortSignal.timeout(REQUEST_TIMEOUT) });
+
+    if (!response.ok) {
+        throw new Error(
+            `Cannot fetch ${subject}: HTTP ${String(response.status)} ${response.statusText}. ` +
+            `Install ${subject} directly, or drop that architecture from --arch.`,
+        );
+    }
+
+    const document: unknown = await response.json();
+
+    if (typeof document !== "object" || document === null) {
+        throw new Error(`The npm registry returned no metadata for ${subject}`);
+    }
+
+    return document as Record<string, unknown>;
+};
+
+const publishedTarball = async (arch: DeployArchName, version: string): Promise<Tarball> => {
+    const registry = registryUrl();
+    const subject = `${platformPackage(arch)}@${version}`;
+    const url = `${registry}/${encodeURIComponent(platformPackage(arch))}/${version}`;
+    const document = await fetchVersionDocument(url, subject);
+    const dist: unknown = document.dist;
+
+    if (typeof dist !== "object" || dist === null) {
+        throw new Error(`The npm registry returned no tarball for ${subject}`);
+    }
+
+    const entry = dist as Record<string, unknown>;
+    const tarball = entry.tarball;
+
+    if (typeof tarball !== "string" || new URL(tarball).origin !== new URL(registry).origin) {
+        throw new Error(`The npm registry returned an unusable tarball URL for ${subject}`);
+    }
+
+    return { url: tarball, digest: hexFromIntegrity(entry.integrity, subject) };
+};
+
+const extractAddon = (archive: string, dir: string, arch: DeployArchName): void => {
+    runCliTool({
+        tool: "tar",
+        args: ["-xzf", archive, "-C", dir, "--strip-components", STRIP_COMPONENTS,
+            `${PACKAGE_ROOT}/${binaryFilename(arch)}`],
+        target: platformPackage(arch),
+    });
+};
+
+const cachedTarballUrl = (arch: DeployArchName, version: string): string =>
+    `${registryUrl()}/${platformPackage(arch)}/-/${platformStem(arch)}-${version}.tgz`;
+
+const tarballFor = async (arch: DeployArchName, version: string, sidecar: string): Promise<Tarball> => {
+    const cached = readCachedDigest(sidecar, "sha512");
+
+    if (cached !== undefined) {
+        return { url: cachedTarballUrl(arch, version), digest: cached };
+    }
+
+    const published = await publishedTarball(arch, version);
+    writeAtomically(sidecar, published.digest);
+
+    return published;
+};
+
+const downloadedBinary = async (arch: DeployArchName, version: string): Promise<string> => {
+    const dir = cacheDir(["native", `${version}-linux-${arch}`]);
+    const archive = join(dir, `${platformStem(arch)}-${version}.tgz`);
+    const tarball = await tarballFor(arch, version, `${archive}.sha512`);
+
+    await downloadFile({
+        url: tarball.url,
+        dest: archive,
+        label: `${platformPackage(arch)} ${version}`,
+        digest: tarball.digest,
+        algorithm: "sha512",
+    });
+
+    extractAddon(archive, dir, arch);
+
+    return join(dir, binaryFilename(arch));
+};
+
+const resolveStagedAddon = async (settings: DeploySettings): Promise<string | null> => {
+    const arch = settings.arch.node;
+
+    if (isHostArch(arch)) {
+        return null;
+    }
+
+    const projectRequire = projectRequireFor(settings.paths.root);
+    const resolved = localBinary(projectRequire, arch) ?? installedBinary(projectRequire, arch);
+
+    return resolved ?? await downloadedBinary(arch, nativeVersion(projectRequire));
+};
+
+export { BINDING_FILENAME, resolveStagedAddon };

package/src/deploy/node-runtime/download.ts

@@ -44,8 +44,8 @@ const downloadNode = async (version: string, arch: string, destDir: string): Pro
         url: `${DIST_BASE_URL}/v${version}/${assetName}`,
         dest: join(dir, assetName),
         label: `Node.js ${version} for linux-${arch}`,
-        sha256: await cachedDigest(request),
-        freshSha256: () => publishedDigest(request),
+        digest: await cachedDigest(request),
+        freshDigest: () => publishedDigest(request),
     });
 
     mkdirSync(destDir, { recursive: true });

package/src/deploy/node-runtime/elf.ts

@@ -7,6 +7,7 @@ type ElfSection = {
 };
 
 type ElfInfo = {
+    machine: number;
     needed: string[];
     glibcMinimum: string | null;
 };
@@ -22,6 +23,7 @@ const CLASS_64 = 2;
 const LITTLE_ENDIAN = 1;
 const OFFSET_CLASS = 4;
 const OFFSET_DATA = 5;
+const OFFSET_MACHINE = 0x12;
 const OFFSET_SECTION_HEADERS = 0x28;
 const OFFSET_SECTION_ENTRY_SIZE = 0x3A;
 const OFFSET_SECTION_COUNT = 0x3C;
@@ -140,6 +142,7 @@ const readElfBuffer = (buffer: Buffer, path: string): ElfInfo => {
     const strings = stringTable(buffer, sectionFor(sections, ".dynstr"));
 
     return {
+        machine: buffer.readUInt16LE(OFFSET_MACHINE),
         needed: readNeeded(buffer, sectionFor(sections, ".dynamic"), strings),
         glibcMinimum: readGlibcMinimum(strings),
     };
@@ -180,4 +183,4 @@ const glibcMinimumForFiles = (paths: Iterable<string>): string | null => {
     return formatVersion(highestVersion(versions));
 };
 
-export { type ElfInfo, glibcMinimumForFiles, readElfInfo };
+export { type ElfInfo, glibcMinimumForFiles, readElfInfo, readOptionalElfInfo };

package/src/deploy/node-runtime/index.ts

@@ -1,12 +1,13 @@
 import { MINIMUM_NODE_VERSION } from "@gtkx/config/internal";
-import { info, tryResolveExecutable } from "@gtkx/utils";
+import { info, tryResolveExecutable, warn } from "@gtkx/utils";
 import { execFileSync } from "node:child_process";
 import { chmodSync, copyFileSync, mkdirSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
-import type { DeploySettings, NodeRuntime } from "../types.js";
+import type { DeployConfig, DeploySettings, NodeRuntime } from "../types.js";
 import { runCliTool } from "../../internal/run-cli-tool.js";
+import { elfMachineFor, hostArchName } from "../settings/arch.js";
 import { downloadNode } from "./download.js";
-import { readElfInfo } from "./elf.js";
+import { type ElfInfo, readElfInfo } from "./elf.js";
 import { assertPortableNode } from "./guard.js";
 import { licenseBesideNode } from "./license.js";
 
@@ -171,13 +172,32 @@ const stageFromSource = async (
     return { path: stageNode(settings, sourcePath), licenseFile: licenseBesideNode(sourcePath) };
 };
 
+type DeployNodeConfig = NonNullable<DeployConfig["node"]>;
+
+const shouldStripRuntime = (settings: DeploySettings, node: DeployNodeConfig, elf: ElfInfo): boolean => {
+    if (node.shouldStrip === false) {
+        return false;
+    }
+
+    if (elf.machine === elfMachineFor(hostArchName())) {
+        return true;
+    }
+
+    warn(
+        `Skipping \`strip\` on the bundled Node.js: it was built for ${settings.arch.node} and \`strip\` reads ` +
+        `only ${hostArchName()}. The ${settings.arch.node} packages carry an unstripped runtime.`,
+    );
+
+    return false;
+};
+
 const resolveNodeRuntime = async (settings: DeploySettings): Promise<NodeRuntime> => {
     const node = settings.deploy.node ?? {};
     const source = nodeSourceFor(settings);
     const version = resolveNodeVersion(settings);
     const staged = await stageFromSource(settings, version, source);
-    const isStripped = node.shouldStrip === false ? false : didStripBinary(staged.path);
     const elf = readElfInfo(staged.path);
+    const isStripped = shouldStripRuntime(settings, node, elf) && didStripBinary(staged.path);
     const glibcMinimum = elf.glibcMinimum ?? "unknown";
     info(`Bundled Node.js v${version} (${megabytes(staged.path)} MiB, runtime glibc >= ${glibcMinimum})`);
 

package/src/deploy/payload/stage.ts

@@ -8,7 +8,10 @@ import { listFilesRecursive } from "../../internal/list-files.js";
 import { BUNDLE_FILENAME } from "../../vite-plugins/esm-extension.js";
 import { renderCopyright } from "../freedesktop/copyright.js";
 import { renderDbusService } from "../freedesktop/dbus-service.js";
+import { BINDING_FILENAME } from "../native-addon.js";
+import { readOptionalElfInfo } from "../node-runtime/elf.js";
 import { renderNotices } from "../notices/render.js";
+import { elfMachineFor } from "../settings/arch.js";
 import { copyInto, EXECUTABLE_MODE, executableModeFor, writeInto } from "./copy-tree.js";
 import { stageIcons } from "./icons.js";
 import { NODE_FILENAME, renderLauncher } from "./launcher.js";
@@ -17,6 +20,7 @@ import { stageSchemas } from "./schemas.js";
 type StageRequest = {
     settings: DeploySettings;
     node: NodeRuntime | null;
+    addon: string | null;
     metadata: StagedMetadata;
 };
 
@@ -67,6 +71,29 @@ const stageRuntimeFiles = (settings: DeploySettings, root: string): StagedFile[]
         .map((file) => copyInto(root, join(libDirFor(settings), file.rel), file.absPath));
 };
 
+const stageAddon = (settings: DeploySettings, root: string, addon: string | null): StagedFile[] =>
+    addon === null ? [] : [copyInto(root, join(libDirFor(settings), BINDING_FILENAME), addon)];
+
+const architectureMismatch = (settings: DeploySettings, file: StagedFile): Error =>
+    new Error(
+        `Cannot deploy ${file.rel} for ${settings.arch.node}: it was built for another architecture. ` +
+        "Run `gtkx build` again, or drop --skip-build.",
+    );
+
+const assertStagedArchitecture = (settings: DeploySettings, staged: StagedFile[]): void => {
+    const expected = elfMachineFor(settings.arch.node);
+    const lib = libDirFor(settings);
+    const checked = new Set([join(lib, BINDING_FILENAME), join(lib, NODE_FILENAME)]);
+
+    const binaries = staged.filter((entry) => checked.has(entry.rel));
+
+    for (const file of binaries) {
+        if (readOptionalElfInfo(file.abs)?.machine !== expected) {
+            throw architectureMismatch(settings, file);
+        }
+    }
+};
+
 const stageCatalogs = (settings: DeploySettings, root: string): StagedFile[] =>
     listFilesRecursive(join(settings.paths.dist, LOCALE_DIRNAME))
         .map((file) => copyInto(root, join(SHARE_LOCALE, file.rel), file.absPath));
@@ -138,20 +165,25 @@ const byRelativePath = (files: StagedFile[]): StagedFile[] => {
     return sortStringsBy(latest.values(), (file) => file.rel);
 };
 
-const stagePayload = ({ settings, node, metadata }: StageRequest): StagedFile[] => {
+const stagePayload = ({ settings, node, addon, metadata }: StageRequest): StagedFile[] => {
     const root = settings.paths.stage;
     rmSync(root, { recursive: true, force: true, maxRetries: 5 });
 
-    return byRelativePath([
+    const staged = byRelativePath([
         writeInto(root, join("bin", settings.binaryName), renderLauncher(settings), EXECUTABLE_MODE),
         ...stageNodeBinary(settings, root, node),
         ...stageRuntimeFiles(settings, root),
+        ...stageAddon(settings, root, addon),
         ...stageCatalogs(settings, root),
         ...stageExtraFiles(settings, root, metadata),
         ...stageMetadata(settings, root, metadata),
         ...stageIcons(settings, root),
         ...stageSchemas(settings, root),
     ]);
+
+    assertStagedArchitecture(settings, staged);
+
+    return staged;
 };
 
 const withoutDbusActivation = (desktopEntry: string): string =>