@crossbind/extension-dmg 0.0.0-stage → 2.0.0-beta.69

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Buğra Sarı and crossbind contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,24 @@
-# Temporary Holding Version
+# @crossbind/extension-dmg
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A macOS disk image, which is also what Apple notarizes.
+
+An app has it by having `@crossbind/core-app-host`, which lists it as a dependency: there is nothing to install or list.
+
+## Use
+
+```sh
+npx crossbind app build
+```
+
+A macOS build writes a `.dmg` named after the app beside it: a window with the app and a link to Applications, which its
+user drags it to. With a Developer ID and an App Store Connect key, the disk image is what Apple notarizes.
+
+## Platforms
+
+macOS.
+
+## Replace or leave out
+
+An extension named `dmg` with an installer takes its place, and `app: { without: ['dmg'] }` in `crossbind.config.js` leaves it out. [extensions.md](https://github.com/crossbind/crossbind/blob/main/docs/api/extensions.md#installers) says what one gives.
+
+[app.md](https://github.com/crossbind/crossbind/blob/main/docs/api/app.md#installers) has every installer, and `app.installers` names those a build runs, as `['dmg']`.

package/crossbind.extension.js

@@ -0,0 +1,33 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+// crossbind's installer of a macOS app: a disk image that holds the app beside a link to /Applications, onto which its
+// user drags it. hdiutil copies a link inside the folder it is given as a link, where it would copy all of
+// /Applications for the link itself. The image is not signed: Gatekeeper would then judge it as well, where the app in
+// it is what Apple notarizes.
+export default function dmg() {
+    return {
+        name: 'dmg',
+        contract: 1,
+        root: import.meta.dirname,
+        installer: {
+            platform: 'macos',
+            make(api, { app }) {
+                const image = app.replace(/\.app$/, '.dmg');
+                const folder = fs.mkdtempSync(path.join(os.tmpdir(), 'crossbind-dmg-'));
+                try {
+                    // The image's root takes the folder's permissions, which mkdtemp keeps to its owner.
+                    fs.chmodSync(folder, 0o755);
+                    fs.cpSync(app, path.join(folder, path.basename(app)), { recursive: true, verbatimSymlinks: true });
+                    fs.symlinkSync('/Applications', path.join(folder, 'Applications'));
+                    fs.rmSync(image, { force: true });
+                    api.run(['hdiutil', 'create', '-quiet', '-volname', api.app.name, '-srcfolder', folder, '-fs', 'HFS+', '-format', 'UDZO', image], { cwd: path.dirname(app) });
+                } finally {
+                    fs.rmSync(folder, { recursive: true, force: true });
+                }
+                return [image];
+            },
+        },
+    };
+}

package/package.json

@@ -1,6 +1,28 @@
 {
   "name": "@crossbind/extension-dmg",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "2.0.0-beta.69",
+  "description": "crossbind app extension: a macOS disk image, which is also what Apple notarizes.",
+  "homepage": "https://github.com/crossbind/crossbind/tree/main/extensions/dmg#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/crossbind/crossbind.git"
+  },
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    "./crossbind.extension.js": "./crossbind.extension.js"
+  },
+  "files": [
+    "crossbind.extension.js"
+  ],
+  "crossbind": {
+    "extension": "./crossbind.extension.js"
+  },
+  "keywords": [
+    "crossbind-extension",
+    "crossbind",
+    "dmg",
+    "installer",
+    "app"
+  ]
 }