@hakobu/hakobu 1.0.0

package/lib-es5/packager.js

@@ -0,0 +1,1036 @@
+"use strict";
+/**
+ * Hakobu Packager
+ *
+ * End-to-end packaging: project → analysis → executable.
+ *
+ * Uses the new manifest/analyzer for project analysis, then bridges
+ * into the inherited producer/packer for binary assembly. This is the
+ * pragmatic approach: the new analysis layers feed into the proven
+ * binary injection mechanism.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageApp = exports.packageMultiple = void 0;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const hakobu_fetch_1 = require("@hakobu/hakobu-fetch");
+const analyzer_1 = require("./analyzer");
+const bundler_1 = require("./bundler");
+const fabricator_1 = require("./fabricator");
+const log_1 = require("./log");
+const common_1 = require("./common");
+const packer_1 = __importDefault(require("./packer"));
+const producer_1 = __importDefault(require("./producer"));
+const compress_type_1 = require("./compress_type");
+const chmod_1 = require("./chmod");
+const mach_o_1 = require("./mach-o");
+const windows_sign_1 = require("./windows-sign");
+const pe_metadata_1 = require("./pe-metadata");
+const app_bundle_1 = require("./app-bundle");
+const appdir_1 = require("./appdir");
+function prepareBaseBinary(targetSpec, binaryPath) {
+    if (targetSpec.platform !== 'macos') {
+        return { effectiveBinaryPath: binaryPath, cleanup: () => { } };
+    }
+    const tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'hakobu-base-'));
+    const stripped = path_1.default.join(tmpDir, path_1.default.basename(binaryPath) + '.unsigned');
+    fs_1.default.copyFileSync(binaryPath, stripped);
+    try {
+        (0, child_process_1.execFileSync)('codesign', ['--remove-signature', stripped], { stdio: 'pipe' });
+    }
+    catch {
+        // Some cache entries are already unsigned; stripping is best-effort.
+    }
+    return {
+        effectiveBinaryPath: stripped,
+        cleanup: () => {
+            try {
+                fs_1.default.rmSync(tmpDir, { recursive: true, force: true });
+            }
+            catch { }
+        },
+    };
+}
+// ─────────────────────────────────────────────────────────────────────
+// Multi-target packaging
+// ─────────────────────────────────────────────────────────────────────
+const ALL_TARGETS = [
+    'node24-linux-x64', 'node24-linux-arm64', 'node24-win-x64', 'node24-win-arm64',
+    'node24-macos-arm64', 'node24-macos-x64', 'node24-linuxstatic-x64',
+];
+async function packageMultiple(options) {
+    const { projectRoot } = options;
+    const outputDir = path_1.default.resolve(options.outputDir || '.');
+    // Expand 'all' target
+    const targetSpecs = options.targets.flatMap(t => t === 'all' ? ALL_TARGETS : t.split(',')).filter(Boolean);
+    if (targetSpecs.length === 0) {
+        throw new Error('No targets specified.');
+    }
+    // Single target → delegate to packageApp for backward compat
+    if (targetSpecs.length === 1) {
+        const result = await packageApp({
+            ...options,
+            target: targetSpecs[0],
+            output: path_1.default.join(outputDir, defaultOutputName(appIdFromProject(projectRoot), parseTarget(targetSpecs[0]))),
+        });
+        return [{
+                target: result.target,
+                status: 'success',
+                outputPath: result.outputPath,
+                fileCount: result.fileCount,
+            }];
+    }
+    log_1.log.info(`Multi-target packaging: ${targetSpecs.length} targets`);
+    // ── Shared step: bundle (if requested) ──
+    let effectiveRoot = projectRoot;
+    let effectiveOptions = { ...options };
+    let bundleOutput = null;
+    if (options.bundle) {
+        log_1.log.info('Bundling project (shared across all targets)...');
+        const bundlerName = typeof options.bundle === 'string' ? options.bundle : 'rolldown';
+        const adapter = (0, bundler_1.getAdapter)(bundlerName);
+        const entry = options.entry || resolveEntryForBundle(projectRoot);
+        const appName = appIdFromProject(projectRoot);
+        bundleOutput = await adapter.bundle({
+            projectRoot, entry,
+            external: options.bundleExternal,
+            appName,
+        });
+        for (const w of bundleOutput.warnings) {
+            log_1.log.warn(`[bundle] ${w.message}`);
+        }
+        effectiveRoot = bundleOutput.projectRoot;
+        const bundleAssets = [
+            ...(options.assets || []),
+            ...bundleOutput.mapFiles,
+        ];
+        effectiveOptions = {
+            ...effectiveOptions,
+            entry: undefined,
+            assets: bundleAssets.length > 0 ? bundleAssets : undefined,
+        };
+    }
+    // ── Shared step: analyze ──
+    log_1.log.info('Analyzing project (shared across all targets)...');
+    const manifest = await (0, analyzer_1.analyze)({
+        projectRoot: effectiveRoot,
+        entry: effectiveOptions.entry,
+        assets: effectiveOptions.assets,
+        externals: effectiveOptions.externals,
+    });
+    log_1.log.info(`  entry: ${manifest.entry.snapshotPath} (${manifest.entry.format})`);
+    log_1.log.info(`  files: ${Object.keys(manifest.files).length}`);
+    // ── Pre-fetch: download all base binaries in parallel ──
+    // Each target has a unique platform-arch, so no cache file races.
+    const parsedTargets = targetSpecs.map(spec => ({
+        spec,
+        ...parseTarget(spec),
+    }));
+    log_1.log.info(`\nFetching ${parsedTargets.length} base binaries...`);
+    const fetchResults = await Promise.allSettled(parsedTargets.map(t => (0, hakobu_fetch_1.need)({ nodeRange: t.nodeRange, platform: t.platform, arch: t.arch, forceBuild: options.forceBuild })
+        .then(binaryPath => {
+        log_1.log.info(`  fetched: ${t.platform}-${t.arch}`);
+        return binaryPath;
+    })));
+    // Map fetch results by spec for lookup during per-target assembly
+    const fetchedBinaries = new Map();
+    for (let i = 0; i < parsedTargets.length; i++) {
+        const result = fetchResults[i];
+        if (result.status === 'fulfilled') {
+            fetchedBinaries.set(parsedTargets[i].spec, result.value);
+        }
+    }
+    // ── Per-target: pack, produce ──
+    fs_1.default.mkdirSync(outputDir, { recursive: true });
+    const results = [];
+    for (const spec of targetSpecs) {
+        const targetSpec = parseTarget(spec);
+        const outputName = defaultOutputName(manifest.appId, targetSpec);
+        const outputPath = path_1.default.join(outputDir, outputName);
+        log_1.log.info(`\n  [${targetSpec.platform}-${targetSpec.arch}]`);
+        // Check if fetch succeeded for this target
+        const prefetchedBinary = fetchedBinaries.get(spec);
+        if (!prefetchedBinary) {
+            const fetchResult = fetchResults[targetSpecs.indexOf(spec)];
+            const fetchError = fetchResult.status === 'rejected' ? fetchResult.reason?.message : 'unknown';
+            results.push({
+                target: targetSpec,
+                status: 'failed',
+                outputPath,
+                fileCount: 0,
+                error: `Base binary fetch failed: ${fetchError}`,
+            });
+            continue;
+        }
+        try {
+            const result = await packageAppForTarget(effectiveRoot, manifest, targetSpec, outputPath, effectiveOptions);
+            const sizeMB = fs_1.default.existsSync(result.outputPath)
+                ? (fs_1.default.statSync(result.outputPath).size / 1024 / 1024).toFixed(0) + ' MB'
+                : '';
+            results.push({
+                target: targetSpec,
+                status: 'success',
+                outputPath: result.outputPath,
+                fileCount: result.fileCount,
+                sizeMB,
+            });
+        }
+        catch (err) {
+            results.push({
+                target: targetSpec,
+                status: 'failed',
+                outputPath,
+                fileCount: 0,
+                error: err.message,
+            });
+        }
+    }
+    // Clean up bundle
+    if (bundleOutput)
+        bundleOutput.cleanup();
+    // Summary table
+    log_1.log.info('\n=== Packaging Results ===\n');
+    for (const r of results) {
+        const label = `${r.target.platform}-${r.target.arch}`;
+        if (r.status === 'success') {
+            log_1.log.info(`  OK    ${label.padEnd(20)} → ${r.outputPath}  (${r.sizeMB})`);
+        }
+        else {
+            log_1.log.error(`  FAIL  ${label.padEnd(20)} ${r.error}`);
+        }
+    }
+    const ok = results.filter(r => r.status === 'success').length;
+    const fail = results.filter(r => r.status === 'failed').length;
+    log_1.log.info(`\n${ok} succeeded, ${fail} failed`);
+    return results;
+}
+exports.packageMultiple = packageMultiple;
+/**
+ * Package a single target using a pre-analyzed manifest.
+ * This is the per-target inner loop for multi-target packaging.
+ */
+async function packageAppForTarget(projectRoot, manifest, targetSpec, outputPath, options) {
+    // Fetch base binary
+    const binaryPath = await (0, hakobu_fetch_1.need)({
+        nodeRange: targetSpec.nodeRange,
+        platform: targetSpec.platform,
+        arch: targetSpec.arch,
+        forceBuild: options.forceBuild,
+    });
+    const preparedBase = prepareBaseBinary(targetSpec, binaryPath);
+    try {
+        // Build payload
+        const { records, entrypoint, symLinks } = manifestToRecords(manifest, options.bytecode);
+        const slash = targetSpec.platform === 'win' ? '\\' : '/';
+        const backpack = (0, packer_1.default)({ records, entrypoint, bytecode: !!options.bytecode, symLinks });
+        // In app-bundle/appdir mode, write the raw executable to a temp path
+        const usesTempOutput = (options.appBundle && targetSpec.platform === 'macos')
+            || (options.appDir && (0, appdir_1.isLinuxPlatform)(targetSpec.platform));
+        const producerOutput = usesTempOutput
+            ? path_1.default.join(os_1.default.tmpdir(), `hakobu-wrap-${manifest.appId}-${Date.now()}`)
+            : outputPath;
+        fs_1.default.mkdirSync(path_1.default.dirname(path_1.default.resolve(producerOutput)), { recursive: true });
+        const target = {
+            nodeRange: targetSpec.nodeRange,
+            platform: targetSpec.platform,
+            arch: targetSpec.arch,
+            binaryPath: preparedBase.effectiveBinaryPath,
+            output: path_1.default.resolve(producerOutput),
+            fabricator: {
+                nodeRange: targetSpec.nodeRange,
+                platform: hakobu_fetch_1.system.hostPlatform,
+                arch: hakobu_fetch_1.system.hostArch,
+                // For bytecode compilation, the fabricator must use the patched base binary
+                // (which has sourceless: true support). For source-only mode, it doesn't matter
+                // because STORE_BLOB stripes are removed by the packer.
+                binaryPath: options.bytecode ? binaryPath : process.execPath,
+                output: '',
+                fabricator: null,
+            },
+        };
+        log_1.log.debug(`Producer input:`, [
+            `  target: ${JSON.stringify(target.output)}`,
+            `  bakes: ${JSON.stringify(options.options || [])}`,
+            `  compress: ${options.compress || 'none'}`,
+            `  stripes: ${backpack.stripes.length}`,
+        ]);
+        await (0, producer_1.default)({
+            backpack, bakes: options.options || [], slash, target, symLinks,
+            doCompress: resolveCompressType(options.compress), nativeBuild: false,
+        });
+        // Post-production
+        let finalOutputPath = path_1.default.resolve(outputPath);
+        if (targetSpec.platform === 'macos') {
+            // Mach-O patch is always needed (fixes __LINKEDIT after payload injection)
+            const buf = (0, mach_o_1.patchMachOExecutable)(fs_1.default.readFileSync(target.output));
+            fs_1.default.writeFileSync(target.output, buf);
+            await (0, chmod_1.plusx)(target.output);
+            if (options.appBundle) {
+                // Bundle mode: wrap first, then sign/notarize the bundle
+                finalOutputPath = (0, app_bundle_1.createAppBundle)({
+                    executablePath: target.output,
+                    outputPath: outputPath,
+                    appName: manifest.appId,
+                    macos: options.macos,
+                });
+                try {
+                    (0, mach_o_1.signAppBundle)(finalOutputPath, options.signIdentity);
+                }
+                catch { }
+                if (options.notarize) {
+                    await (0, mach_o_1.notarizeAppBundle)({ executable: finalOutputPath });
+                }
+            }
+            else {
+                // Raw executable mode: sign/notarize the executable directly
+                try {
+                    (0, mach_o_1.signMachOExecutable)(target.output, options.signIdentity);
+                }
+                catch { }
+                if (options.notarize) {
+                    await (0, mach_o_1.notarizeMachOExecutable)({ executable: target.output });
+                }
+            }
+        }
+        else if (targetSpec.platform === 'win') {
+            // Metadata injection must happen BEFORE signing
+            if (options.metadata) {
+                await (0, pe_metadata_1.injectPeMetadata)(target.output, options.metadata);
+            }
+            if ((0, windows_sign_1.hasWindowsSigningCredentials)(options.winCertPath)) {
+                (0, windows_sign_1.signWindowsExecutable)({
+                    executable: target.output,
+                    certPath: options.winCertPath,
+                    certPassword: options.winCertPassword,
+                });
+            }
+        }
+        else {
+            await (0, chmod_1.plusx)(target.output);
+            // AppDir wrapping (Linux only, opt-in)
+            if (options.appDir && (0, appdir_1.isLinuxPlatform)(targetSpec.platform)) {
+                const appDirPath = (0, appdir_1.createAppDir)({
+                    executablePath: target.output,
+                    outputPath: outputPath,
+                    appName: manifest.appId,
+                    linux: options.linux,
+                });
+                if (options.appImage) {
+                    // AppImage: build from AppDir, then clean up the AppDir
+                    finalOutputPath = (0, appdir_1.createAppImage)({
+                        appDirPath,
+                        outputPath: outputPath,
+                        arch: targetSpec.arch,
+                    });
+                    try {
+                        fs_1.default.rmSync(appDirPath, { recursive: true, force: true });
+                    }
+                    catch { }
+                }
+                else {
+                    finalOutputPath = appDirPath;
+                }
+            }
+        }
+        // Kill fabricator child processes (bytecode compilation spawns long-lived workers)
+        (0, fabricator_1.shutdown)();
+        return {
+            outputPath: finalOutputPath,
+            manifest,
+            fileCount: Object.keys(manifest.files).length,
+            target: targetSpec,
+        };
+    }
+    finally {
+        preparedBase.cleanup();
+    }
+}
+function appIdFromProject(projectRoot) {
+    const pkgJsonPath = path_1.default.join(projectRoot, 'package.json');
+    if (fs_1.default.existsSync(pkgJsonPath)) {
+        try {
+            const pkg = JSON.parse(fs_1.default.readFileSync(pkgJsonPath, 'utf8'));
+            return pkg.name || 'app';
+        }
+        catch { }
+    }
+    return 'app';
+}
+function defaultOutputName(appId, target) {
+    const ext = target.platform === 'win' ? '.exe' : '';
+    return `${appId}-${target.platform}-${target.arch}${ext}`;
+}
+// ─────────────────────────────────────────────────────────────────────
+// Core package function (single target — unchanged)
+// ─────────────────────────────────────────────────────────────────────
+async function packageApp(options) {
+    // ── App bundle validation ──
+    if (options.appBundle) {
+        const targetSpec = parseTarget(options.target || '');
+        if (targetSpec.platform !== 'macos') {
+            throw new Error(`--app-bundle is only supported for macOS targets (got ${targetSpec.platform}).\n` +
+                'macOS .app bundles require a Mach-O executable.');
+        }
+    }
+    // ── AppImage implies AppDir ──
+    if (options.appImage) {
+        options.appDir = true;
+    }
+    // ── AppDir validation ──
+    if (options.appDir) {
+        const targetSpec = parseTarget(options.target || '');
+        if (!(0, appdir_1.isLinuxPlatform)(targetSpec.platform)) {
+            throw new Error(`--appdir is only supported for Linux targets (got ${targetSpec.platform}).\n` +
+                'AppDir requires an ELF executable.');
+        }
+    }
+    // ── Bytecode mode validation ──
+    if (options.bytecode && options.bundle) {
+        throw new Error('Bytecode mode (--bytecode) cannot be combined with bundle mode (--bundle).\n' +
+            'Bundle mode produces ESM output which is not compatible with V8 bytecode compilation.\n' +
+            'Use one or the other, not both.');
+    }
+    let { projectRoot } = options;
+    let bundleOutput = null;
+    // ── 0. Bundle mode (optional pre-processing) ──
+    if (options.bundle) {
+        log_1.log.info('Bundling project...');
+        const bundlerName = typeof options.bundle === 'string' ? options.bundle : 'rolldown';
+        const adapter = (0, bundler_1.getAdapter)(bundlerName);
+        // Determine entry for bundling
+        const entry = options.entry || resolveEntryForBundle(projectRoot);
+        // Determine app name from package.json
+        let appName = 'app';
+        const pkgJsonPath = path_1.default.join(projectRoot, 'package.json');
+        if (fs_1.default.existsSync(pkgJsonPath)) {
+            try {
+                const pkg = JSON.parse(fs_1.default.readFileSync(pkgJsonPath, 'utf8'));
+                appName = pkg.name || 'app';
+            }
+            catch { }
+        }
+        bundleOutput = await adapter.bundle({
+            projectRoot,
+            entry,
+            external: options.bundleExternal,
+            appName,
+        });
+        for (const w of bundleOutput.warnings) {
+            log_1.log.warn(`[bundle] ${w.message}`);
+        }
+        // Switch to the bundled project for the rest of the pipeline
+        projectRoot = bundleOutput.projectRoot;
+        // Clear entry override — the bundle's package.json has the right main
+        // Include source map files as assets so they end up in the snapshot
+        const bundleAssets = [
+            ...(options.assets || []),
+            ...bundleOutput.mapFiles,
+        ];
+        options = { ...options, entry: undefined, assets: bundleAssets.length > 0 ? bundleAssets : undefined };
+    }
+    try {
+        return await packageAppInner(projectRoot, options, bundleOutput);
+    }
+    finally {
+        // Clean up bundle temp directory
+        if (bundleOutput)
+            bundleOutput.cleanup();
+    }
+}
+exports.packageApp = packageApp;
+function resolveEntryForBundle(projectRoot) {
+    const pkgJsonPath = path_1.default.join(projectRoot, 'package.json');
+    if (fs_1.default.existsSync(pkgJsonPath)) {
+        try {
+            const pkg = JSON.parse(fs_1.default.readFileSync(pkgJsonPath, 'utf8'));
+            if (pkg.main)
+                return pkg.main;
+            if (pkg.module)
+                return pkg.module;
+        }
+        catch { }
+    }
+    // Fallback: common entry patterns
+    for (const candidate of ['src/index.ts', 'src/index.js', 'index.ts', 'index.js']) {
+        if (fs_1.default.existsSync(path_1.default.join(projectRoot, candidate)))
+            return candidate;
+    }
+    throw new Error('Cannot determine entry for bundling. Specify --entry.');
+}
+async function packageAppInner(projectRoot, options, bundleOutput) {
+    log_1.log.info('Analyzing project...');
+    // ── 1. Analyze using new manifest pipeline ──
+    const manifest = await (0, analyzer_1.analyze)({
+        projectRoot,
+        entry: options.entry,
+        assets: options.assets,
+        externals: options.externals,
+    });
+    log_1.log.info(`  entry: ${manifest.entry.snapshotPath} (${manifest.entry.format})`);
+    log_1.log.info(`  files: ${Object.keys(manifest.files).length}`);
+    log_1.log.debug('Manifest details:', [
+        `  projectRoot: ${projectRoot}`,
+        `  appId: ${manifest.appId}`,
+        `  file count: ${Object.keys(manifest.files).length}`,
+        `  warnings: ${manifest.warnings.length}`,
+    ]);
+    if (manifest.warnings.length > 0) {
+        for (const w of manifest.warnings) {
+            if (w.severity === 'error') {
+                log_1.log.error(`[${w.category}] ${w.message}`);
+            }
+            else if (w.severity === 'warning') {
+                log_1.log.warn(`[${w.category}] ${w.message}`);
+            }
+            if (w.suggestion) {
+                log_1.log.info(`  → ${w.suggestion}`);
+            }
+        }
+    }
+    // ── 2. Parse target ──
+    const targetSpec = parseTarget(options.target);
+    log_1.log.info(`Target: ${targetSpec.nodeRange}-${targetSpec.platform}-${targetSpec.arch}`);
+    // ── 3. Fetch base binary ──
+    log_1.log.info('Fetching base binary...');
+    const binaryPath = await (0, hakobu_fetch_1.need)({
+        nodeRange: targetSpec.nodeRange,
+        platform: targetSpec.platform,
+        arch: targetSpec.arch,
+        forceBuild: options.forceBuild,
+    });
+    log_1.log.info(`  base: ${binaryPath}`);
+    // ── 3b. Strip macOS code signature before payload injection ──
+    // The producer appends data past __LINKEDIT, which invalidates the adhoc
+    // signature and makes subsequent codesign operations fail. Stripping the
+    // signature first lets us patch + re-sign cleanly after production.
+    const preparedBase = prepareBaseBinary(targetSpec, binaryPath);
+    try {
+        // ── 4. Bridge: manifest → inherited FileRecords + Stripe format ──
+        log_1.log.info('Building payload...');
+        const { records, entrypoint, symLinks } = manifestToRecords(manifest, options.bytecode);
+        // ── 5. Pack using inherited packer ──
+        const slash = targetSpec.platform === 'win' ? '\\' : '/';
+        const backpack = (0, packer_1.default)({
+            records,
+            entrypoint,
+            bytecode: !!options.bytecode,
+            symLinks,
+        });
+        // ── 6. Build target object for producer ──
+        const requestedOutput = options.output || defaultOutputPath(manifest.appId, targetSpec);
+        // In app-bundle/appdir mode, the producer writes to a temp file; wrapper moves it in
+        const usesTempOutput = (options.appBundle && targetSpec.platform === 'macos')
+            || (options.appDir && (0, appdir_1.isLinuxPlatform)(targetSpec.platform));
+        const outputPath = usesTempOutput
+            ? path_1.default.join(os_1.default.tmpdir(), `hakobu-wrap-${manifest.appId}-${Date.now()}`)
+            : requestedOutput;
+        fs_1.default.mkdirSync(path_1.default.dirname(path_1.default.resolve(outputPath)), { recursive: true });
+        const target = {
+            nodeRange: targetSpec.nodeRange,
+            platform: targetSpec.platform,
+            arch: targetSpec.arch,
+            binaryPath: preparedBase.effectiveBinaryPath,
+            output: path_1.default.resolve(outputPath),
+            fabricator: {
+                nodeRange: targetSpec.nodeRange,
+                platform: hakobu_fetch_1.system.hostPlatform,
+                arch: hakobu_fetch_1.system.hostArch,
+                binaryPath: options.bytecode ? binaryPath : process.execPath,
+                output: '',
+                fabricator: null,
+            },
+        };
+        // ── 7. Produce executable using inherited producer ──
+        log_1.log.info(`Writing ${outputPath}...`);
+        log_1.log.debug('Producer input:', [
+            `  output: ${path_1.default.resolve(outputPath)}`,
+            `  bakes: ${JSON.stringify(options.options || [])}`,
+            `  compress: ${options.compress || 'none'}`,
+            `  bytecode: ${!!options.bytecode}`,
+            `  stripes: ${backpack.stripes.length}`,
+        ]);
+        await (0, producer_1.default)({
+            backpack,
+            bakes: options.options || [],
+            slash,
+            target,
+            symLinks,
+            doCompress: resolveCompressType(options.compress),
+            nativeBuild: false,
+        });
+        // ── 8. Post-production: signing + chmod ──
+        log_1.log.debug(`Post-production: platform=${targetSpec.platform}, appBundle=${!!options.appBundle}, appDir=${!!options.appDir}`);
+        let finalOutputPath = path_1.default.resolve(requestedOutput);
+        if (targetSpec.platform === 'macos') {
+            // Base was pre-stripped in step 3b, so __LINKEDIT patch + fresh sign works cleanly
+            const buf = (0, mach_o_1.patchMachOExecutable)(fs_1.default.readFileSync(target.output));
+            fs_1.default.writeFileSync(target.output, buf);
+            await (0, chmod_1.plusx)(target.output);
+            if (options.appBundle) {
+                // Bundle mode: wrap first, then sign/notarize the bundle
+                finalOutputPath = (0, app_bundle_1.createAppBundle)({
+                    executablePath: target.output,
+                    outputPath: requestedOutput,
+                    appName: manifest.appId,
+                    macos: options.macos,
+                });
+                try {
+                    (0, mach_o_1.signAppBundle)(finalOutputPath, options.signIdentity);
+                }
+                catch {
+                    if (targetSpec.arch === 'arm64') {
+                        log_1.log.warn('Unable to sign the macOS app bundle — it may not run on ARM64.');
+                    }
+                }
+                if (options.notarize) {
+                    await (0, mach_o_1.notarizeAppBundle)({ executable: finalOutputPath });
+                }
+            }
+            else {
+                // Raw executable mode: sign/notarize the executable directly
+                try {
+                    (0, mach_o_1.signMachOExecutable)(target.output, options.signIdentity);
+                }
+                catch {
+                    if (targetSpec.arch === 'arm64') {
+                        log_1.log.warn('Unable to sign the macOS executable — it may not run on ARM64.');
+                    }
+                }
+                if (options.notarize) {
+                    await (0, mach_o_1.notarizeMachOExecutable)({ executable: target.output });
+                }
+            }
+        }
+        else if (targetSpec.platform === 'win') {
+            // Metadata injection must happen BEFORE signing
+            if (options.metadata) {
+                await (0, pe_metadata_1.injectPeMetadata)(target.output, options.metadata);
+            }
+            if ((0, windows_sign_1.hasWindowsSigningCredentials)(options.winCertPath)) {
+                (0, windows_sign_1.signWindowsExecutable)({
+                    executable: target.output,
+                    certPath: options.winCertPath,
+                    certPassword: options.winCertPassword,
+                });
+            }
+        }
+        else {
+            await (0, chmod_1.plusx)(target.output);
+            // AppDir wrapping (Linux only, opt-in)
+            if (options.appDir && (0, appdir_1.isLinuxPlatform)(targetSpec.platform)) {
+                const appDirPath = (0, appdir_1.createAppDir)({
+                    executablePath: target.output,
+                    outputPath: requestedOutput,
+                    appName: manifest.appId,
+                    linux: options.linux,
+                });
+                if (options.appImage) {
+                    finalOutputPath = (0, appdir_1.createAppImage)({
+                        appDirPath,
+                        outputPath: requestedOutput,
+                        arch: targetSpec.arch,
+                    });
+                    try {
+                        fs_1.default.rmSync(appDirPath, { recursive: true, force: true });
+                    }
+                    catch { }
+                }
+                else {
+                    finalOutputPath = appDirPath;
+                }
+            }
+        }
+        (0, fabricator_1.shutdown)();
+        log_1.log.info(`Done. Packaged ${Object.keys(manifest.files).length} files → ${finalOutputPath}`);
+        return {
+            outputPath: finalOutputPath,
+            manifest,
+            fileCount: Object.keys(manifest.files).length,
+            target: targetSpec,
+        };
+    }
+    finally {
+        preparedBase.cleanup();
+    }
+}
+// ─────────────────────────────────────────────────────────────────────
+// Bridge: manifest → inherited FileRecords
+// ─────────────────────────────────────────────────────────────────────
+function manifestToRecords(manifest, bytecode) {
+    const records = {};
+    const dirContents = new Map();
+    const isEsmEntry = manifest.entry.format === 'esm';
+    // Add all manifest files to records
+    for (const [snapshotPath, file] of Object.entries(manifest.files)) {
+        const absPath = file.absolutePath;
+        const content = fs_1.default.readFileSync(absPath);
+        const record = {
+            file: absPath,
+            body: content,
+            [common_1.STORE_CONTENT]: content,
+            [common_1.STORE_STAT]: {
+                size: content.length,
+                isFileValue: true,
+                isDirectoryValue: false,
+                isSocketValue: false,
+                isSymbolicLinkValue: false,
+            },
+        };
+        // Bytecode mode: add STORE_BLOB for CJS scripts.
+        // The fabricator will compile the source to V8 cached data.
+        // ESM scripts are NOT bytecode-compiled (vm.Script is CJS-only).
+        if (bytecode && file.kind === 'script' && file.format === 'cjs') {
+            record[common_1.STORE_BLOB] = content;
+        }
+        records[absPath] = record;
+        // Build the full directory tree — not just direct parents, but all
+        // intermediate dirs up to the project root. This is needed for CJS
+        // node_modules resolution: require('pkg') walks up directories
+        // checking node_modules/pkg, so the VFS must have directory entries
+        // at every level.
+        let dir = path_1.default.dirname(absPath);
+        if (!dirContents.has(dir))
+            dirContents.set(dir, []);
+        dirContents.get(dir).push(path_1.default.basename(absPath));
+        // Walk up and register intermediate directories as children of their parents
+        const projectRoot = fs_1.default.realpathSync(manifest.projectRoot || path_1.default.dirname(manifest.entry.absolutePath));
+        while (dir !== projectRoot && dir !== path_1.default.dirname(dir)) {
+            const parent = path_1.default.dirname(dir);
+            if (!dirContents.has(parent))
+                dirContents.set(parent, []);
+            const dirBasename = path_1.default.basename(dir);
+            if (!dirContents.get(parent).includes(dirBasename)) {
+                dirContents.get(parent).push(dirBasename);
+            }
+            dir = parent;
+        }
+    }
+    // Inject CJS shim that registers ESM hooks for snapshot-aware resolution.
+    // Always needed: CJS entries may use import() to load ESM dependencies,
+    // and ESM entries need the hooks for all import resolution.
+    let entrypoint = manifest.entry.absolutePath;
+    const { shimPath, shimContent, shimDir } = buildEsmBridge(manifest, isEsmEntry);
+    records[shimPath] = {
+        file: shimPath,
+        body: shimContent,
+        [common_1.STORE_CONTENT]: shimContent,
+        [common_1.STORE_STAT]: {
+            size: shimContent.length,
+            isFileValue: true,
+            isDirectoryValue: false,
+            isSocketValue: false,
+            isSymbolicLinkValue: false,
+        },
+    };
+    entrypoint = shimPath;
+    // Add shim to its directory listing
+    if (!dirContents.has(shimDir))
+        dirContents.set(shimDir, []);
+    if (!dirContents.get(shimDir).includes(path_1.default.basename(shimPath))) {
+        dirContents.get(shimDir).push(path_1.default.basename(shimPath));
+    }
+    // Add directory records with STORE_LINKS
+    for (const [dir, files] of dirContents) {
+        if (!records[dir]) {
+            records[dir] = {
+                file: dir,
+                [common_1.STORE_LINKS]: files,
+                [common_1.STORE_STAT]: {
+                    size: 0,
+                    isFileValue: false,
+                    isDirectoryValue: true,
+                    isSocketValue: false,
+                    isSymbolicLinkValue: false,
+                },
+            };
+        }
+    }
+    return { records, entrypoint, symLinks: {} };
+}
+// ─────────────────────────────────────────────────────────────────────
+// ESM Bridge
+// ─────────────────────────────────────────────────────────────────────
+/**
+ * Build a CJS shim that registers ESM hooks and loads the real entry.
+ *
+ * Always injected (not just for ESM entries) because CJS code may use
+ * import() to load ESM dependencies — those calls need the snapshot-aware
+ * ESM resolver hooks to be registered first.
+ *
+ * For ESM entries: registers hooks + import()s the real entry
+ * For CJS entries: registers hooks + require()s the real entry
+ */
+function buildEsmBridge(manifest, isEsm = true) {
+    const entryAbsPath = manifest.entry.absolutePath;
+    const shimDir = path_1.default.dirname(entryAbsPath);
+    const shimPath = path_1.default.join(shimDir, '__hakobu_esm_shim__.cjs');
+    // Collect package.json paths for module format detection at runtime
+    const pkgJsonAbsPaths = Object.values(manifest.files)
+        .filter(f => f.kind === 'package-json')
+        .map(f => f.absolutePath);
+    const shimSource = `'use strict';
+// Hakobu ESM Bridge — bootstraps ESM loading from the inherited CJS VFS
+
+// Enable source maps before any module loading. The patched base binary is
+// built with --without-node-options which ignores NODE_OPTIONS, so
+// --enable-source-maps via env has no effect. This programmatic call
+// ensures source maps work when .map files are present in the snapshot.
+if (typeof process.setSourceMapsEnabled === 'function') {
+  process.setSourceMapsEnabled(true);
+}
+
+var { registerHooks } = require('node:module');
+var fs = require('fs');
+var pathMod = require('path');
+var { pathToFileURL, fileURLToPath } = require('url');
+
+// Platform detection: Windows uses C:\\snapshot, POSIX uses /snapshot
+var isWin = process.platform === 'win32';
+var snapRoot = isWin ? 'C:\\\\snapshot' : '/snapshot';
+var sep = isWin ? '\\\\' : '/';
+
+// Normalize a snapshot path to POSIX for URL/map keys (internal canonical form)
+function toCanonical(p) {
+  if (isWin && p.startsWith('C:\\\\snapshot')) return p.slice(2).replace(/\\\\/g, '/');
+  return p;
+}
+
+// Convert canonical back to native snapshot path for fs operations
+function toNative(p) {
+  if (isWin && p.startsWith('/snapshot')) return 'C:' + p.replace(/\\//g, '\\\\');
+  return p;
+}
+
+// Read package.json data for module type detection (using patched fs)
+// absPath is a host absolute path (e.g. /home/user/project/package.json or D:\\a\\project\\package.json)
+// Convert to canonical snapshot path: strip drive letter, normalize to POSIX, prepend /snapshot
+var pkgJsons = {};
+${JSON.stringify(pkgJsonAbsPaths)}.forEach(function(absPath) {
+  var posix = absPath.replace(/\\\\/g, '/');
+  if (/^[A-Z]:/i.test(posix)) posix = posix.slice(2);
+  var canonical = '/snapshot' + posix;
+  var native = toNative(canonical);
+  try { pkgJsons[canonical] = JSON.parse(fs.readFileSync(native, 'utf8')); } catch {}
+});
+
+function isSnapshotUrl(url) {
+  if (url.startsWith('file:///snapshot/')) return true;
+  // Windows: file:///C:/snapshot/
+  if (isWin && /^file:\\/\\/\\/[A-Z]:\\/snapshot\\//i.test(url)) return true;
+  return false;
+}
+
+function urlToCanonical(url) {
+  var p = fileURLToPath(url);
+  return toCanonical(p);
+}
+
+function canonicalToUrl(canonical) {
+  return pathToFileURL(toNative(canonical)).href;
+}
+
+function getModuleFormat(canonical) {
+  if (canonical.endsWith('.mjs')) return 'module';
+  if (canonical.endsWith('.cjs')) return 'commonjs';
+  if (canonical.endsWith('.json')) return 'json';
+  var dir = canonical;
+  while (dir !== '/') {
+    dir = dir.substring(0, dir.lastIndexOf('/')) || '/';
+    var pkgPath = dir + '/package.json';
+    if (pkgJsons[pkgPath]) return pkgJsons[pkgPath].type === 'module' ? 'module' : 'commonjs';
+  }
+  return 'commonjs';
+}
+
+function snapshotExists(canonical) {
+  try { return fs.existsSync(toNative(canonical)); } catch { return false; }
+}
+
+function resolveFromSnapshot(specifier, parentCanonical) {
+  var parentDir = parentCanonical.substring(0, parentCanonical.lastIndexOf('/'));
+  var resolved;
+  if (specifier.startsWith('./') || specifier.startsWith('../')) {
+    var parts = (parentDir + '/' + specifier).split('/');
+    var normalized = [];
+    for (var i = 0; i < parts.length; i++) {
+      if (parts[i] === '..') normalized.pop();
+      else if (parts[i] !== '.' && parts[i] !== '') normalized.push(parts[i]);
+    }
+    resolved = '/' + normalized.join('/');
+  } else {
+    resolved = specifier;
+  }
+  if (snapshotExists(resolved)) return resolved;
+  if (snapshotExists(resolved + '.js')) return resolved + '.js';
+  if (snapshotExists(resolved + '.mjs')) return resolved + '.mjs';
+  if (snapshotExists(resolved + '/index.js')) return resolved + '/index.js';
+  if (snapshotExists(resolved + '/index.mjs')) return resolved + '/index.mjs';
+  return null;
+}
+
+registerHooks({
+  resolve: function(specifier, context, nextResolve) {
+    if (specifier.startsWith('node:') || specifier.startsWith('data:')) {
+      return nextResolve(specifier, context);
+    }
+    // Stub unsupported runtime-specific protocols (bun:, deno:, etc.)
+    if (specifier.startsWith('bun:') || specifier.startsWith('deno:')) {
+      return { url: 'data:text/javascript,export default undefined;export var Database=class{constructor(){throw new Error("' + specifier + ' not available")}};', shortCircuit: true };
+    }
+    // Resolve file:// URLs to snapshot paths
+    if (isSnapshotUrl(specifier)) {
+      var canonical = urlToCanonical(specifier);
+      if (snapshotExists(canonical)) {
+        return { url: canonicalToUrl(canonical), shortCircuit: true };
+      }
+    }
+    // Absolute snapshot path (POSIX)
+    if (specifier.startsWith('/snapshot/') && snapshotExists(specifier)) {
+      return { url: canonicalToUrl(specifier), shortCircuit: true };
+    }
+    // Relative/bare imports from snapshot
+    if (context.parentURL && isSnapshotUrl(context.parentURL)) {
+      var parentCanonical = urlToCanonical(context.parentURL);
+      if (specifier.startsWith('.')) {
+        var resolved = resolveFromSnapshot(specifier, parentCanonical);
+        if (resolved) return { url: canonicalToUrl(resolved), shortCircuit: true };
+      }
+      // #imports specifier — resolve from nearest package.json imports map
+      if (specifier.startsWith('#')) {
+        var dir = parentCanonical;
+        while (dir.startsWith('/snapshot/')) {
+          dir = dir.substring(0, dir.lastIndexOf('/')) || '/';
+          var pkgPath = dir + '/package.json';
+          if (pkgJsons[pkgPath] && pkgJsons[pkgPath].imports) {
+            var mapping = pkgJsons[pkgPath].imports[specifier];
+            if (typeof mapping === 'string') {
+              var target = resolveFromSnapshot(mapping, dir + '/dummy');
+              if (target) return { url: canonicalToUrl(target), shortCircuit: true };
+            }
+          }
+        }
+      }
+      // Bare specifier — resolve from node_modules with exports map support
+      if (!specifier.startsWith('.') && !specifier.startsWith('/') && !specifier.startsWith('#')) {
+        var parts = specifier.split('/');
+        var pkgName = parts[0].startsWith('@') ? parts[0] + '/' + parts[1] : parts[0];
+        var subpath = '.' + specifier.slice(pkgName.length);
+        if (subpath === '.') subpath = '.';
+        var searchDir = parentCanonical;
+        while (searchDir.startsWith('/snapshot/')) {
+          searchDir = searchDir.substring(0, searchDir.lastIndexOf('/')) || '/';
+          var nmPkgJson = searchDir + '/node_modules/' + pkgName + '/package.json';
+          if (pkgJsons[nmPkgJson]) {
+            var pkg = pkgJsons[nmPkgJson];
+            var pkgDir = nmPkgJson.substring(0, nmPkgJson.lastIndexOf('/'));
+            var resolved = null;
+            if (pkg.exports) {
+              var exportEntry = null;
+              if (typeof pkg.exports === 'string') {
+                if (subpath === '.') exportEntry = pkg.exports;
+              } else if (typeof pkg.exports === 'object') {
+                exportEntry = pkg.exports[subpath];
+                if (typeof exportEntry === 'object' && exportEntry !== null) {
+                  exportEntry = exportEntry.import || exportEntry.node || exportEntry.default || null;
+                }
+              }
+              if (typeof exportEntry === 'string') {
+                resolved = resolveFromSnapshot(exportEntry, pkgDir + '/dummy');
+              }
+            } else if (subpath === '.' && pkg.main) {
+              resolved = resolveFromSnapshot('./' + pkg.main, pkgDir + '/dummy');
+            }
+            if (resolved) return { url: canonicalToUrl(resolved), shortCircuit: true };
+          }
+        }
+      }
+    }
+    return nextResolve(specifier, context);
+  },
+  load: function(url, context, nextLoad) {
+    if (isSnapshotUrl(url)) {
+      var canonical = urlToCanonical(url);
+      try {
+        var source = fs.readFileSync(toNative(canonical), 'utf8');
+        var format = getModuleFormat(canonical);
+        // Inline sidecar source maps so --enable-source-maps works in packaged mode.
+        // Node reads source maps from the source text, not from separate fs reads,
+        // when the map is a data: URL. This avoids depending on Node internals
+        // reading .map files through the prelude's patched fs.
+        var mapMatch = source.match(/\\/\\/# sourceMappingURL=([^\\n]+\\.map)\\s*$/);
+        if (mapMatch) {
+          var mapFile = mapMatch[1];
+          var mapCanonical = canonical.substring(0, canonical.lastIndexOf('/') + 1) + mapFile;
+          try {
+            var mapData = fs.readFileSync(toNative(mapCanonical), 'utf8');
+            var mapBase64 = Buffer.from(mapData).toString('base64');
+            source = source.replace(
+              mapMatch[0],
+              '//# sourceMappingURL=data:application/json;base64,' + mapBase64
+            );
+          } catch {}
+        }
+        return { format: format, source: source, shortCircuit: true };
+      } catch {}
+    }
+    return nextLoad(url, context);
+  }
+});
+
+// Load the real entry
+var entryCanonical = '${(0, common_1.snapshotify)(entryAbsPath, '/').replace(/\\/g, '/')}';
+${isEsm
+        ? `var entryUrl = canonicalToUrl(entryCanonical);
+import(entryUrl).catch(function(err) { console.error(err); process.exit(1); });`
+        : `require(toNative(entryCanonical));`}
+`;
+    return {
+        shimPath,
+        shimContent: Buffer.from(shimSource),
+        shimDir,
+    };
+}
+// ─────────────────────────────────────────────────────────────────────
+// Helpers
+// ─────────────────────────────────────────────────────────────────────
+function resolveCompressType(value) {
+    if (!value)
+        return compress_type_1.CompressType.None;
+    switch (value) {
+        case 'brotli': return compress_type_1.CompressType.Brotli;
+        case 'gzip': return compress_type_1.CompressType.GZip;
+        default: return compress_type_1.CompressType.None;
+    }
+}
+function parseTarget(spec) {
+    if (!spec || spec === 'host') {
+        return {
+            nodeRange: 'node24',
+            platform: hakobu_fetch_1.system.hostPlatform,
+            arch: hakobu_fetch_1.system.hostArch,
+        };
+    }
+    const parts = spec.split('-');
+    let nodeRange = 'node24';
+    let platform = hakobu_fetch_1.system.hostPlatform;
+    let arch = hakobu_fetch_1.system.hostArch;
+    for (const part of parts) {
+        if (part.startsWith('node'))
+            nodeRange = part;
+        else if (['linux', 'macos', 'win', 'alpine', 'linuxstatic'].includes(part))
+            platform = part;
+        else if (['x64', 'arm64'].includes(part))
+            arch = part;
+    }
+    return { nodeRange, platform, arch };
+}
+function defaultOutputPath(appId, target) {
+    const ext = target.platform === 'win' ? '.exe' : '';
+    return path_1.default.resolve(`${appId}-${target.platform}-${target.arch}${ext}`);
+}
+//# sourceMappingURL=packager.js.map