@mirinjs/cli 0.0.1-alpha.9 → 0.1.0-alpha.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mirinjs/cli",
-  "version": "0.0.1-alpha.9",
+  "version": "0.1.0-alpha.0",
   "description": "CLI for mirin apps: dev, build, init.",
   "type": "module",
   "license": "MIT",
@@ -27,10 +27,12 @@
     "bun": ">=1.2.0"
   },
   "dependencies": {
-    "create-mirinjs": "0.0.1-alpha.9"
+    "create-mirinjs": "0.1.0-alpha.0",
+    "mirinjs": "0.1.0-alpha.0"
   },
   "optionalDependencies": {
-    "@mirinjs/darwin-arm64": "0.0.1-alpha.9"
+    "@mirinjs/darwin-arm64": "0.1.0-alpha.0",
+    "@mirinjs/win32-x64": "0.1.0-alpha.0"
   },
   "publishConfig": {
     "access": "public"

package/src/artifacts.ts

@@ -49,8 +49,8 @@ export async function resolveArtifacts(opts: { release: boolean }): Promise<Arti
     await $`cargo build -p mirin-core -p mirin-helper ${flags}`.cwd(REPO_ROOT);
     const target = join(REPO_ROOT, "target", profile);
     return {
-      coreDylib: join(target, "libmirin_core.dylib"),
-      helperBin: join(target, "mirin-helper"),
+      coreDylib: join(target, coreFileName()),
+      helperBin: join(target, helperFileName()),
       hostEntry: join(REPO_ROOT, "packages", "mirin", "src", "host.ts"),
       cefPath,
     };
@@ -58,17 +58,30 @@ export async function resolveArtifacts(opts: { release: boolean }): Promise<Arti
 
   const nativeDir = resolveNativeDir();
   return {
-    coreDylib: join(nativeDir, "libmirin_core.dylib"),
-    helperBin: join(nativeDir, "mirin-helper"),
+    coreDylib: join(nativeDir, coreFileName()),
+    helperBin: join(nativeDir, helperFileName()),
     hostEntry: resolvePackageFile("mirinjs/host"),
     cefPath,
   };
 }
 
+/** The native core library file name for the host platform (MSVC has no `lib` prefix). */
+function coreFileName(): string {
+  return process.platform === "win32" ? "mirin_core.dll" : "libmirin_core.dylib";
+}
+
+/** The CEF subprocess binary name for the host platform. */
+function helperFileName(): string {
+  return process.platform === "win32" ? "mirin-helper.exe" : "mirin-helper";
+}
+
 function assertSupportedPlatform(): void {
-  if (process.platform !== "darwin" || process.arch !== "arm64") {
+  const supported =
+    (process.platform === "darwin" && process.arch === "arm64") ||
+    (process.platform === "win32" && process.arch === "x64");
+  if (!supported) {
     throw new Error(
-      `mirin alpha supports macOS arm64 only (got ${process.platform}/${process.arch}).`,
+      `mirin alpha supports macOS arm64 and Windows x64 (got ${process.platform}/${process.arch}).`,
     );
   }
 }
@@ -99,10 +112,16 @@ function cliVersion(): string {
   return pkg.version as string;
 }
 
+/** A file/dir that, if present in a CEF dir, means the distribution is unpacked.
+ *  macOS ships the framework bundle; Windows ships a flat dir with libcef.dll. */
+function cefMarker(): string {
+  return process.platform === "win32" ? "libcef.dll" : "Chromium Embedded Framework.framework";
+}
+
 async function ensureCef(): Promise<string> {
   if (IN_REPO) {
     const vendor = join(REPO_ROOT, "vendor", "cef");
-    if (existsSync(join(vendor, "Chromium Embedded Framework.framework"))) return vendor;
+    if (existsSync(join(vendor, cefMarker()))) return vendor;
     console.error(
       "[mirin] vendor/cef missing — run `bun scripts/fetch-cef.ts` in the monorepo first.",
     );
@@ -111,7 +130,7 @@ async function ensureCef(): Promise<string> {
 
   const version = cliVersion();
   const cacheDir = join(homedir(), ".mirinjs", "cef", `${version}-${platformTag()}`);
-  if (existsSync(join(cacheDir, "Chromium Embedded Framework.framework"))) return cacheDir;
+  if (existsSync(join(cacheDir, cefMarker()))) return cacheDir;
 
   mkdirSync(cacheDir, { recursive: true });
   const asset = `cef-${platformTag()}.tar.gz`;

package/src/build.ts

@@ -16,23 +16,65 @@
  */
 
 import { $ } from "bun";
-import { mkdirSync, rmSync } from "node:fs";
+import { mkdirSync, rmSync, readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { buildAppBundle } from "./bundle.ts";
+import { buildWindowsBundle } from "./bundle-win.ts";
 import { resolveArtifacts } from "./artifacts.ts";
+import { sweepBuildTemps } from "./temps.ts";
+import { normalizeSidecars, compileWorkers } from "./extras.ts";
 
-export async function build(projectDir = process.cwd()): Promise<number> {
+const IS_WINDOWS = process.platform === "win32";
+
+export interface BuildResult {
+  /** Path to the assembled .app. */
+  app: string;
+  appName: string;
+  bundleId: string;
+  /** App version (from the project's package.json). */
+  version: string;
+  /** Update channel (config.release.channel ?? "stable"). */
+  channel: string;
+  /** Update baseUrl, if `release` is configured. */
+  baseUrl?: string;
+  /** libmirin_core path (for the updater codec at release time). */
+  coreDylib: string;
+  /** Project root (so `mirin release` can resolve relative asset paths). */
+  projectDir: string;
+  /** DMG config from mirin.config.ts (`true`/object/`false`); default `true`. */
+  dmg: boolean | import("mirinjs").DmgConfig;
+  /** Codesign identity used for the bundle, if any (MIRIN_SIGN_IDENTITY). */
+  signIdentity?: string;
+}
+
+/** Read the project's package.json version (the single source of app version). */
+function appVersion(projectDir: string): string {
+  const pkgPath = join(projectDir, "package.json");
+  if (!existsSync(pkgPath)) return "0.0.0";
+  try {
+    return JSON.parse(readFileSync(pkgPath, "utf8")).version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
+export async function build(projectDir = process.cwd()): Promise<BuildResult> {
   const outDir = join(projectDir, "build");
   const work = join(projectDir, ".mirin");
   mkdirSync(outDir, { recursive: true });
   mkdirSync(work, { recursive: true });
+  sweepBuildTemps(projectDir);
 
   const config = (await import(join(projectDir, "mirin.config.ts"))).default;
   const appName: string = config.name ?? "Mirin App";
   const bundleId: string = config.id ?? "dev.mirin.app";
   const mainEntry = join(projectDir, config.main ?? "main/main.ts");
+  const version = appVersion(projectDir);
+  const channel: string = config.release?.channel ?? "stable";
+  const baseUrl: string | undefined = config.release?.baseUrl;
+  const dmg: boolean | import("mirinjs").DmgConfig = config.dmg ?? true;
 
-  console.log(`[mirin build] ${appName}`);
+  console.log(`[mirin build] ${appName} ${version}`);
 
   // 1. production UI
   console.log("[mirin build] vite build…");
@@ -43,32 +85,67 @@ export async function build(projectDir = process.cwd()): Promise<number> {
 
   // 3 + 4. host + worker (minified)
   console.log("[mirin build] compiling host + bundling main process…");
-  const hostExe = join(work, "host-release");
+  const signIdentity = process.env.MIRIN_SIGN_IDENTITY;
+  const hostExe = join(work, IS_WINDOWS ? "host-release.exe" : "host-release");
   const workerJs = join(work, "worker.release.js");
   await $`bun build --compile --minify ${artifacts.hostEntry} --outfile ${hostExe}`.cwd(projectDir);
   await $`bun build ${mainEntry} --target=bun --minify --outfile ${workerJs}`.cwd(projectDir);
 
-  // 5. assemble + sign
-  console.log("[mirin build] assembling .app…");
-  rmSync(join(outDir, `${appName}.app`), { recursive: true, force: true });
-  const { app } = await buildAppBundle({
+  // Extra assets: resolve sidecar binaries + compile any extra worker entries.
+  const sidecars = normalizeSidecars(projectDir, config.sidecars);
+  const extraWorkers = await compileWorkers(projectDir, config.workers, join(work, "workers"), true);
+
+  // 5. assemble (+ sign on macOS)
+  console.log(`[mirin build] assembling ${IS_WINDOWS ? "app folder" : ".app"}…`);
+  // version.json embeds the running app's update identity (read by app.updater).
+  // Only when `release` is configured — otherwise the app has no updater.
+  const versionJson = baseUrl
+    ? JSON.stringify({ version, channel, baseUrl, name: appName, identifier: bundleId })
+    : undefined;
+  const resources = {
+    uiDir: join(projectDir, "dist"),
+    workerJs,
+    manifestJson: JSON.stringify({ windows: config.windows }),
+    versionJson,
+    workers: extraWorkers,
+  };
+  const { app } = IS_WINDOWS
+    ? await buildWindowsBundle({
+        appName,
+        outDir,
+        hostExe,
+        coreDll: artifacts.coreDylib,
+        helperExe: artifacts.helperBin,
+        cefPath: artifacts.cefPath,
+        icon: config.icon ? join(projectDir, config.icon) : undefined,
+        resources: { ...resources, sidecars: sidecars.map((s) => ({ name: s.name, src: s.src })) },
+      })
+    : await buildAppBundle({
+        appName,
+        bundleId,
+        outDir,
+        hostExe,
+        coreDylib: artifacts.coreDylib,
+        helperBin: artifacts.helperBin,
+        cefPath: artifacts.cefPath,
+        version,
+        icon: config.icon ? join(projectDir, config.icon) : undefined,
+        signIdentity,
+        urlSchemes: config.urlSchemes,
+        resources: { ...resources, sidecars },
+      });
+
+  console.log(`\n[mirin build] done → ${app}`);
+  return {
+    app,
     appName,
     bundleId,
-    outDir,
-    hostExe,
+    version,
+    channel,
+    baseUrl,
     coreDylib: artifacts.coreDylib,
-    helperBin: artifacts.helperBin,
-    cefPath: artifacts.cefPath,
-    icon: config.icon ? join(projectDir, config.icon) : undefined,
-    signIdentity: process.env.MIRIN_SIGN_IDENTITY,
-    resources: {
-      uiDir: join(projectDir, "dist"),
-      workerJs,
-      manifestJson: JSON.stringify({ windows: config.windows }),
-    },
-  });
-
-  console.log(`\n[mirin build] done → ${app}`);
-  console.log(`  open "${app}"`);
-  return 0;
+    projectDir,
+    dmg,
+    signIdentity,
+  };
 }

package/src/bundle-win.ts

@@ -0,0 +1,118 @@
+/**
+ * Assemble a Windows app folder for a mirin app. Windows has no `.app` bundle and
+ * no codesign step in the MVP — just a flat directory the OS loader can resolve
+ * libcef.dll + the CEF runtime from, next to the host exe:
+ *
+ *   <App>/
+ *     <App>.exe                compiled Bun host (process.execPath)
+ *     mirin_core.dll           loaded by the host via bun:ffi
+ *     mirin-helper.exe         CEF subprocess (browser_subprocess_path)
+ *     libcef.dll, *.pak, icudtl.dat, v8_context_snapshot.bin, locales/, …  (CEF runtime)
+ *     resources/               (production only — dev serves from the Vite URL)
+ *       ui/, worker.js, mirin.manifest.json, version.json, sidecars/, workers/
+ *
+ * The CEF subprocess name (`mirin-helper.exe`) and the `resources/` layout match
+ * what mirin-core derives at runtime (engine::derive_subprocess_path, host.ts).
+ */
+
+import { cpSync, mkdirSync, rmSync, writeFileSync, existsSync, readdirSync } from "node:fs";
+import { join, extname } from "node:path";
+import { makeWindowsIcon } from "./icon-win.ts";
+
+/** Source dir (vendor/cef on Windows) must contain libcef.dll. */
+const CEF_MARKER = "libcef.dll";
+
+/** CEF runtime files copied next to the host exe. Everything else in the Windows
+ *  distribution (libcef.lib, include/, cmake/, archive.json, bootstrap*.exe) is
+ *  build-time only and intentionally left out. */
+const CEF_RUNTIME_EXTS = new Set([".dll", ".bin", ".pak", ".dat"]);
+const CEF_RUNTIME_EXTRAS = ["vk_swiftshader_icd.json", "locales"];
+
+export interface WinBundleOptions {
+  appName: string; // also the host exe stem → <appName>.exe
+  outDir: string;
+  hostExe: string; // compiled Bun host (.exe)
+  coreDll: string; // mirin_core.dll
+  helperExe: string; // mirin-helper.exe
+  cefPath: string; // dir containing the Windows CEF runtime (vendor/cef)
+  /** App icon source (.ico / .iconset / .png) → <App>/icon.ico, set as the window icon. */
+  icon?: string;
+  /** Production-only resources placed under <App>/resources. */
+  resources?: {
+    uiDir?: string; // Vite dist/ → resources/ui (served via app://ui)
+    workerJs?: string; // bundled main-process Worker → resources/worker.js
+    manifestJson?: string; // serialized manifest → resources/mirin.manifest.json
+    versionJson?: string; // serialized version.json → resources/version.json (updater)
+    sidecars?: { name: string; src: string }[]; // → resources/sidecars/<name>
+    workers?: Record<string, string>; // name → abs path → resources/workers/<name>.js
+  };
+}
+
+/** Build the Windows app folder and return its path + the host exe to launch. */
+export async function buildWindowsBundle(
+  opts: WinBundleOptions,
+): Promise<{ app: string; exe: string }> {
+  const { appName, cefPath } = opts;
+  if (!existsSync(join(cefPath, CEF_MARKER))) {
+    throw new Error(`CEF runtime not found at ${cefPath} — run: bun scripts/fetch-cef.ts`);
+  }
+
+  const app = join(opts.outDir, appName);
+  rmSync(app, { recursive: true, force: true });
+  mkdirSync(app, { recursive: true });
+
+  const exe = join(app, `${appName}.exe`);
+  cpSync(opts.hostExe, exe);
+  cpSync(opts.coreDll, join(app, "mirin_core.dll"));
+  cpSync(opts.helperExe, join(app, "mirin-helper.exe"));
+
+  copyCefRuntime(cefPath, app);
+
+  // App icon → <App>/icon.ico, loaded at runtime by the core and set as the window
+  // icon (taskbar / Alt-Tab / title). Sits beside the exe so the core finds it.
+  if (opts.icon) makeWindowsIcon(opts.icon, join(app, "icon.ico"));
+
+  // Production resources (dev passes none — paths come from env + the Vite URL).
+  if (opts.resources) {
+    const res = join(app, "resources");
+    mkdirSync(res, { recursive: true });
+    if (opts.resources.uiDir) cpSync(opts.resources.uiDir, join(res, "ui"), { recursive: true });
+    if (opts.resources.workerJs) cpSync(opts.resources.workerJs, join(res, "worker.js"));
+    if (opts.resources.manifestJson != null) {
+      writeFileSync(join(res, "mirin.manifest.json"), opts.resources.manifestJson);
+    }
+    if (opts.resources.versionJson != null) {
+      writeFileSync(join(res, "version.json"), opts.resources.versionJson);
+    }
+    if (opts.resources.workers && Object.keys(opts.resources.workers).length) {
+      const workersDir = join(res, "workers");
+      mkdirSync(workersDir, { recursive: true });
+      for (const [name, src] of Object.entries(opts.resources.workers)) {
+        cpSync(src, join(workersDir, `${name}.js`));
+      }
+    }
+    if (opts.resources.sidecars?.length) {
+      const sidecarsDir = join(res, "sidecars");
+      mkdirSync(sidecarsDir, { recursive: true });
+      for (const sc of opts.resources.sidecars) {
+        if (!existsSync(sc.src)) throw new Error(`sidecar "${sc.name}" not found: ${sc.src}`);
+        cpSync(sc.src, join(sidecarsDir, sc.name));
+      }
+    }
+  }
+
+  return { app, exe };
+}
+
+/** Copy the CEF runtime (dlls, paks, snapshot, icu data, locales) into `dest`. */
+function copyCefRuntime(cefPath: string, dest: string): void {
+  for (const entry of readdirSync(cefPath)) {
+    if (CEF_RUNTIME_EXTS.has(extname(entry).toLowerCase())) {
+      cpSync(join(cefPath, entry), join(dest, entry));
+    }
+  }
+  for (const extra of CEF_RUNTIME_EXTRAS) {
+    const src = join(cefPath, extra);
+    if (existsSync(src)) cpSync(src, join(dest, extra), { recursive: true });
+  }
+}

package/src/bundle.ts

@@ -12,7 +12,7 @@
  */
 
 import { $ } from "bun";
-import { cpSync, mkdirSync, rmSync, writeFileSync, existsSync } from "node:fs";
+import { cpSync, mkdirSync, rmSync, writeFileSync, existsSync, readdirSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 
 const FRAMEWORK = "Chromium Embedded Framework.framework";
@@ -33,18 +33,57 @@ export interface BundleOptions {
   coreDylib: string; // libmirin_core.dylib
   helperBin: string; // compiled mirin-helper binary
   cefPath: string; // dir containing the CEF framework (vendor/cef)
+  /** App version → Info.plist CFBundleShortVersionString/CFBundleVersion. */
+  version?: string;
   /** App icon source: a .icns, a .iconset dir, or a square .png. Optional. */
   icon?: string;
   /** Codesign identity; "-" (default) is ad-hoc. Set to a Developer ID to ship. */
   signIdentity?: string;
+  /** Custom URL schemes -> Info.plist CFBundleURLTypes (deep links). */
+  urlSchemes?: string[];
   /** Production-only resources placed under Contents/Resources. */
   resources?: {
     uiDir?: string; // Vite dist/, copied to Resources/ui (served via app://ui)
     workerJs?: string; // bundled main-process Worker entry -> Resources/worker.js
     manifestJson?: string; // serialized manifest -> Resources/mirin.manifest.json
+    versionJson?: string; // serialized version.json -> Resources/version.json (updater)
+    /** Bundled sidecar binaries -> Resources/sidecars/<name> (copied + signed). */
+    sidecars?: SidecarBundle[];
+    /** Compiled extra-worker JS (name -> abs path) -> Resources/workers/<name>.js. */
+    workers?: Record<string, string>;
   };
 }
 
+/** A sidecar binary to bundle: logical name, source path, hardened-runtime entitlements. */
+export interface SidecarBundle {
+  name: string;
+  src: string;
+  entitlements: string[];
+}
+
+/** Short entitlement name -> the full `com.apple.security.cs.*` key. */
+const SIDECAR_ENTITLEMENT_KEYS: Record<string, string> = {
+  "allow-jit": "com.apple.security.cs.allow-jit",
+  "allow-unsigned-executable-memory": "com.apple.security.cs.allow-unsigned-executable-memory",
+  "disable-library-validation": "com.apple.security.cs.disable-library-validation",
+};
+
+function entitlementsPlist(names: string[]): string {
+  const keys = names
+    .map((n) => SIDECAR_ENTITLEMENT_KEYS[n])
+    .filter(Boolean)
+    .map((k) => `  <key>${k}</key><true/>`)
+    .join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+${keys}
+</dict>
+</plist>
+`;
+}
+
 /** The 10 standard iconset renditions (point size + @1x/@2x pixel size). */
 const ICONSET_RENDITIONS = [
   { name: "icon_16x16.png", px: 16 },
@@ -89,14 +128,18 @@ async function writeIcon(iconSrc: string, resources: string): Promise<string | u
   return "icon";
 }
 
-type PlistValue = string | boolean | Record<string, string>;
+type PlistValue = string | boolean | PlistValue[] | { [k: string]: PlistValue };
+
+const xmlEscape = (s: string) =>
+  s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 
 function plist(entries: Record<string, PlistValue>): string {
   const render = (v: PlistValue): string => {
     if (typeof v === "boolean") return v ? "<true/>" : "<false/>";
-    if (typeof v === "string") return `<string>${v}</string>`;
+    if (typeof v === "string") return `<string>${xmlEscape(v)}</string>`;
+    if (Array.isArray(v)) return `<array>${v.map(render).join("")}</array>`;
     const inner = Object.entries(v)
-      .map(([k, val]) => `<key>${k}</key><string>${val}</string>`)
+      .map(([k, val]) => `<key>${k}</key>${render(val)}`)
       .join("");
     return `<dict>${inner}</dict>`;
   };
@@ -136,6 +179,7 @@ export async function buildAppBundle(opts: BundleOptions): Promise<{ app: string
   // Render the icon (if any) into Resources before writing the plist, so we
   // only set CFBundleIconFile when an icon was actually produced.
   const iconFile = opts.icon ? await writeIcon(opts.icon, join(contents, "Resources")) : undefined;
+  const version = opts.version ?? "0.0.1";
 
   const info: Record<string, PlistValue> = {
     CFBundleDevelopmentRegion: "en",
@@ -145,8 +189,8 @@ export async function buildAppBundle(opts: BundleOptions): Promise<{ app: string
     CFBundleInfoDictionaryVersion: "6.0",
     CFBundleName: appName,
     CFBundlePackageType: "APPL",
-    CFBundleShortVersionString: "0.0.1",
-    CFBundleVersion: "0.0.1",
+    CFBundleShortVersionString: version,
+    CFBundleVersion: version,
     LSMinimumSystemVersion: "13.0",
     NSHighResolutionCapable: true,
     NSSupportsAutomaticGraphicsSwitching: true,
@@ -154,6 +198,13 @@ export async function buildAppBundle(opts: BundleOptions): Promise<{ app: string
     LSEnvironment: { MallocNanoZone: "0" },
   };
   if (iconFile) info.CFBundleIconFile = iconFile;
+  // Deep-link schemes: register this app as the macOS handler for app://-style
+  // URLs (e.g. anko://…). Delivered at runtime via app.on("open-url").
+  if (opts.urlSchemes?.length) {
+    info.CFBundleURLTypes = [
+      { CFBundleURLName: bundleId, CFBundleURLSchemes: opts.urlSchemes },
+    ];
+  }
 
   writeFileSync(join(contents, "Info.plist"), plist(info));
 
@@ -173,6 +224,33 @@ export async function buildAppBundle(opts: BundleOptions): Promise<{ app: string
   if (opts.resources?.manifestJson != null) {
     writeFileSync(join(resources, "mirin.manifest.json"), opts.resources.manifestJson);
   }
+  // version.json is the running app's self-knowledge for the updater. Written
+  // before the codesign loop below so the signature covers it.
+  if (opts.resources?.versionJson != null) {
+    writeFileSync(join(resources, "version.json"), opts.resources.versionJson);
+  }
+  // Extra Bun Worker bundles -> Resources/workers/<name>.js (resolveWorker()).
+  if (opts.resources?.workers && Object.keys(opts.resources.workers).length) {
+    const workersDir = join(resources, "workers");
+    mkdirSync(workersDir, { recursive: true });
+    for (const [name, src] of Object.entries(opts.resources.workers)) {
+      cpSync(src, join(workersDir, `${name}.js`));
+    }
+  }
+  // Sidecar binaries -> Resources/sidecars/<name> (chmod +x; signed below). Paths
+  // collected here so the codesign loop can sign them inside-out with the app.
+  const sidecarDests: SidecarBundle[] = [];
+  if (opts.resources?.sidecars?.length) {
+    const sidecarsDir = join(resources, "sidecars");
+    mkdirSync(sidecarsDir, { recursive: true });
+    for (const sc of opts.resources.sidecars) {
+      if (!existsSync(sc.src)) throw new Error(`sidecar "${sc.name}" not found: ${sc.src}`);
+      const dest = join(sidecarsDir, sc.name);
+      cpSync(sc.src, dest);
+      chmodSync(dest, 0o755);
+      sidecarDests.push({ name: sc.name, src: dest, entitlements: sc.entitlements });
+    }
+  }
 
   for (const { suffix, id } of HELPER_TYPES) {
     const name = `${appName} Helper${suffix}`;
@@ -189,8 +267,8 @@ export async function buildAppBundle(opts: BundleOptions): Promise<{ app: string
         CFBundleInfoDictionaryVersion: "6.0",
         CFBundleName: name,
         CFBundlePackageType: "APPL",
-        CFBundleShortVersionString: "0.0.1",
-        CFBundleVersion: "0.0.1",
+        CFBundleShortVersionString: version,
+        CFBundleVersion: version,
         LSMinimumSystemVersion: "13.0",
         LSUIElement: "1",
         NSHighResolutionCapable: true,
@@ -199,14 +277,81 @@ export async function buildAppBundle(opts: BundleOptions): Promise<{ app: string
     );
   }
 
-  // Sign inside-out: framework, helpers, then the outer app. Ad-hoc ("-") by
-  // default; pass a Developer ID to produce a distributable, notarizable app.
+  // Sign inside-out. Ad-hoc ("-") by default for local builds; pass a Developer
+  // ID to produce a distributable, notarizable app. Notarization requires the
+  // hardened runtime (--options runtime), a secure timestamp (--timestamp), and
+  // entitlements that let CEF + Bun JIT and load unsigned executable memory —
+  // without all three the Apple notary service returns "Invalid".
   const identity = opts.signIdentity ?? "-";
-  await $`codesign --force --sign ${identity} ${join(frameworks, FRAMEWORK)}`.quiet();
-  for (const { suffix } of HELPER_TYPES) {
-    await $`codesign --force --sign ${identity} ${join(frameworks, `${appName} Helper${suffix}.app`)}`.quiet();
+  const notarizable = identity !== "-";
+  const cef = join(frameworks, FRAMEWORK);
+
+  if (notarizable) {
+    // Mirrors the entitlement set Electrobun ships for Bun + CEF under hardened
+    // runtime (electrobun-reference/package/src/cli/index.ts).
+    const entitlements = join(opts.outDir, "_entitlements.plist");
+    writeFileSync(
+      entitlements,
+      `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-jit</key><true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
+  <key>com.apple.security.cs.disable-library-validation</key><true/>
+</dict>
+</plist>
+`,
+    );
+    const sign = (path: string, ents = false) =>
+      ents
+        ? $`codesign --force --timestamp --options runtime --entitlements ${entitlements} --sign ${identity} ${path}`.quiet()
+        : $`codesign --force --timestamp --options runtime --sign ${identity} ${path}`.quiet();
+
+    // 1. CEF's nested libraries, then 2. the framework bundle itself.
+    const cefLibs = join(cef, "Libraries");
+    if (existsSync(cefLibs)) {
+      for (const lib of readdirSync(cefLibs)) {
+        if (lib.endsWith(".dylib")) await sign(join(cefLibs, lib));
+      }
+    }
+    await sign(cef);
+    // 3. our FFI core dylib.
+    await sign(join(macos, "libmirin_core.dylib"));
+    // 3b. sidecars: hardened runtime + timestamp; per-binary entitlements only
+    //     when the spec asks (most CLIs need none — over-entitling is a smell).
+    for (const sc of sidecarDests) {
+      if (sc.entitlements.length) {
+        const ent = join(opts.outDir, `_sidecar_${sc.name}.plist`);
+        writeFileSync(ent, entitlementsPlist(sc.entitlements));
+        await $`codesign --force --timestamp --options runtime --entitlements ${ent} --sign ${identity} ${sc.src}`.quiet();
+        rmSync(ent, { force: true });
+      } else {
+        await sign(sc.src);
+      }
+    }
+    // 4. each helper: the inner executable, then the .app wrapper (entitlements
+    //    on both — the renderer/GPU helpers are what actually JIT).
+    for (const { suffix } of HELPER_TYPES) {
+      const name = `${appName} Helper${suffix}`;
+      const helperApp = join(frameworks, `${name}.app`);
+      await sign(join(helperApp, "Contents", "MacOS", name), true);
+      await sign(helperApp, true);
+    }
+    // 5. finally the outer app.
+    await sign(app, true);
+    rmSync(entitlements, { force: true });
+  } else {
+    // Ad-hoc: enough to launch locally; not distributable or notarizable.
+    await $`codesign --force --sign ${identity} ${cef}`.quiet();
+    for (const sc of sidecarDests) {
+      await $`codesign --force --sign ${identity} ${sc.src}`.quiet();
+    }
+    for (const { suffix } of HELPER_TYPES) {
+      await $`codesign --force --sign ${identity} ${join(frameworks, `${appName} Helper${suffix}.app`)}`.quiet();
+    }
+    await $`codesign --force --sign ${identity} ${app}`.quiet();
   }
-  await $`codesign --force --sign ${identity} ${app}`.quiet();
 
   return { app, exe: join(macos, appName) };
 }