Clean release snapshot

.packages/README.md

@@ -0,0 +1,70 @@
+# Package lists
+
+System packages and Python dependencies required to build Slopsmith Desktop.
+
+## Files
+
+| File | Purpose |
+|---|---|
+| `apt.txt` | Ubuntu/Debian system packages (apt) |
+| `brew.txt` | macOS system packages (Homebrew) |
+| `choco.txt` | Windows system packages (Chocolatey) |
+| `python.txt` | Python packages (pip) - **shared across all platforms** |
+
+## Purpose
+
+Single source of truth for dependencies across:
+- **Local development** (via `.devcontainer/`)
+- **GitHub Actions CI** (`.github/workflows/build.yml`)
+- **Manual installation** by contributors
+
+## Usage
+
+### System packages
+
+For system packages, filter out comments and blank lines before piping:
+
+```bash
+# Ubuntu/Debian
+grep -v '^[[:space:]]*#' .packages/apt.txt | grep -v '^[[:space:]]*$' | xargs sudo apt-get install -y
+
+# macOS
+grep -v '^[[:space:]]*#' .packages/brew.txt | grep -v '^[[:space:]]*$' | xargs brew install
+
+# Windows (PowerShell)
+Get-Content .packages/choco.txt | Where-Object { $_ -notmatch '^\s*#' -and $_ -notmatch '^\s*$' } | ForEach-Object { choco install $_ -y }
+```
+
+### Python packages
+
+The `python.txt` file is used directly by pip during the bundle step:
+
+```bash
+pip install -r .packages/python.txt
+```
+
+This file is referenced from:
+- `scripts/build-windows.sh` (Windows)
+- `scripts/build-macos.sh` (macOS)
+- `scripts/bundle-python.sh` (Linux)
+
+## Format
+
+- One package per line
+- Lines starting with `#` are comments
+- Blank lines are ignored
+- Standard `pip install -r` format for `python.txt`
+
+## Updating
+
+### Adding system dependencies
+1. Add to the appropriate `.packages/*.txt` for each OS
+2. Update `.devcontainer/` if applicable
+3. Test locally
+
+### Adding Python dependencies
+1. Add to `.packages/python.txt` (one file for all platforms)
+2. Ensure the package is available on all platforms
+3. Test builds on all three platforms
+
+Changes affect both local builds and CI, so verify end-to-end before merging.

.packages/apt.txt

@@ -0,0 +1,53 @@
+# Ubuntu/Debian packages for building Slopsmith Desktop.
+# Kept in sync with .github/workflows/build.yml — change both places together.
+
+# Audio libraries
+libasound2-dev
+libjack-jackd2-dev
+
+# Graphics/X11 libraries (required by JUCE)
+# fontconfig is a hard requirement of juce_graphics (declared linuxPackages:
+# "freetype2 fontconfig"), pulled in once slopsmith-vst-host — which links
+# juce_gui_basics/juce_graphics — builds on Linux. Without it CMake configure
+# fails at pkg_check_modules(freetype2 fontconfig) on a clean machine.
+libfreetype-dev
+libfontconfig1-dev
+libx11-dev
+libxrandr-dev
+libxcursor-dev
+libxinerama-dev
+libxext-dev
+
+# Web/WebKit (required by Electron webview)
+libcurl4-openssl-dev
+libwebkit2gtk-4.1-dev
+
+# Build tools
+pkg-config
+cmake
+build-essential
+# GCC 12+ for the NAM A2 (slimmable) sources, which use
+# std::atomic<std::shared_ptr<...>> — a C++20 library feature libstdc++ only
+# implements from GCC 12. ubuntu-22.04's default (build-essential) g++ is 11;
+# build-audio.sh selects g++-12 when the default is older.
+g++-12
+
+# File operations (used by bundle-slopsmith.sh to resolve symlinked plugins)
+rsync
+
+# Binary patching (used by bundle-binaries.sh to point bundled fluidsynth
+# at sibling shared libraries at runtime)
+patchelf
+
+# MIDI → audio renderer used by GP5 import (`gp2midi.py`). `fluidsynth`
+# here is the CLI; bundle-binaries.sh copies its full dylib chain.
+fluidsynth
+
+# Media tools (for audio processing)
+ffmpeg
+
+# Version control
+git
+
+# Archive utilities (required by electron-builder)
+xz-utils

.packages/brew.txt

@@ -0,0 +1,39 @@
+# macOS Homebrew packages for building Slopsmith Desktop.
+# Kept in sync with .github/workflows/build.yml — change both places together.
+
+# Build tools
+cmake
+pkg-config
+
+# Media tools
+#
+# ffmpeg is installed for its *dylibs* (libavformat / libavcodec /
+# libswresample / libavutil) — vgmstream-cli is linked against
+# /opt/homebrew/opt/ffmpeg/lib/lib*.dylib, and dylibbundler hangs in a
+# stdin-EOF prompt loop on CI if those files don't exist at bundle
+# time. We do NOT bundle brew's ffmpeg *binary*: Homebrew's stock
+# formula (8.1.1+) no longer ships --enable-libvorbis (sloppak's
+# encoder of choice), so build-macos.sh overwrites resources/bin/ffmpeg
+# with a static build from osxexperts.net (arm64) / evermeet.cx (x86_64)
+# instead. See `.external.ffmpeg_macos_*` in `.build-config.json`.
+ffmpeg
+
+# MIDI → audio renderer used by GP5 import (`gp2midi.py`).
+# Homebrew calls the formula `fluid-synth` (with a hyphen); the binary
+# it installs is still named `fluidsynth`.
+fluid-synth
+
+# Audio codec library required by vgmstream-cli
+speex
+
+# vgmstream-cli decodes WEM audio. build-macos.sh copies the
+# Homebrew-installed binary (`command -v vgmstream-cli`) so it matches the
+# build host's architecture — on the macos-14 CI runner that's arm64; on an
+# Intel host it's x86_64. (Previously a prebuilt vgmstream-mac.zip was
+# downloaded, which handed Intel hosts an arm64 binary → "Bad CPU type".)
+vgmstream
+
+# Used by the CI / local build to rewrite Mach-O load paths on the
+# bundled fluidsynth and vgmstream-cli binaries so they load their
+# dylibs via @executable_path instead of /opt/homebrew/lib.
+dylibbundler

.packages/choco.txt

@@ -0,0 +1,12 @@
+# Windows Chocolatey packages for building Slopsmith Desktop.
+# Kept in sync with .github/workflows/build.yml — change both places together.
+#
+# NOTE: cmake requires special install args in GitHub Actions:
+#   choco install cmake --installargs 'ADD_CMAKE_TO_PATH=System'
+#
+# Fluidsynth + vgmstream on Windows are NOT installed via choco; they're
+# downloaded as pinned release archives in the CI workflow because the
+# choco packages lag upstream and we need specific versions.
+
+cmake
+ffmpeg

.packages/python.txt

@@ -0,0 +1,19 @@
+# Desktop-only Python extras for the bundled runtime.
+#
+# Slopsmith's runtime requirements are installed from
+# $SLOPSMITH_DIR/requirements.txt by the platform build scripts
+# (bundle-python.sh / build-macos.sh / build-windows.sh) BEFORE this
+# file is processed. That's the single source of truth for server-
+# side runtime deps — DO NOT duplicate slopsmith's requirements here.
+#
+# This file is reserved for packages the desktop bundle needs that
+# are NOT in slopsmith's requirements.txt. Today that's:
+#
+#   - `requests`: pulled by some desktop-side helpers and a handful
+#     of community plugins; keep it explicit in the bundle.
+#   - `certifi`: the desktop main process points SSL_CERT_FILE at
+#     certifi's bundle so stdlib urllib (Slopsmith's update checker,
+#     the slopsmith-update-manager plugin, etc.) can verify HTTPS
+#     without falling back to a missing system CA path.
+requests
+certifi