@mirinjs/cli 0.0.1-alpha.9 → 0.1.0-alpha.1

package/src/dev.ts

@@ -9,16 +9,27 @@
  */
 
 import { $ } from "bun";
-import { mkdirSync } from "node:fs";
+import { mkdirSync, rmSync, symlinkSync, existsSync } from "node:fs";
+import { createServer } from "node:net";
 import { join } from "node:path";
 import { buildAppBundle } from "./bundle.ts";
+import { buildWindowsBundle } from "./bundle-win.ts";
 import { resolveArtifacts } from "./artifacts.ts";
 
-const DEV_URL = "http://localhost:5173";
+const IS_WINDOWS = process.platform === "win32";
+import { sweepBuildTemps } from "./temps.ts";
+import { normalizeSidecars, compileWorkers } from "./extras.ts";
+
+/** Vite's default port. `mirin dev` probes upward from here for a free one, so a
+ *  second dev session (or anything already on 5173) doesn't collide. */
+const DEV_PORT_BASE = 5173;
 
 export async function dev(projectDir = process.cwd()): Promise<number> {
   const work = join(projectDir, ".mirin");
   mkdirSync(work, { recursive: true });
+  // `bun build --compile` drops temp *.bun-build files in the cwd; clear any left
+  // behind by a previously interrupted run so they don't pile up in the project.
+  sweepBuildTemps(projectDir);
 
   // --- load the manifest ---
   const config = (await import(join(projectDir, "mirin.config.ts"))).default;
@@ -31,31 +42,64 @@ export async function dev(projectDir = process.cwd()): Promise<number> {
 
   // --- compile the Bun host + bundle the Worker ---
   console.log("[mirin dev] compiling host + bundling main process…");
-  const hostExe = join(work, "host");
+  // `bun build --compile` emits an `.exe` on Windows; name it so explicitly.
+  const hostExe = join(work, IS_WINDOWS ? "host.exe" : "host");
   const workerJs = join(work, "worker.js");
   await $`bun build --compile ${artifacts.hostEntry} --outfile ${hostExe}`.cwd(projectDir);
   await $`bun build ${mainEntry} --target=bun --outfile ${workerJs}`.cwd(projectDir);
 
-  // --- assemble the dev .app ---
+  // Extra assets (dev): compile workers into .mirin/workers and symlink sidecar
+  // binaries into .mirin/sidecars (no copy/sign in dev — they run unsigned locally).
+  const workersDir = join(work, "workers");
+  await compileWorkers(projectDir, config.workers, workersDir, false);
+  const sidecarsDir = join(work, "sidecars");
+  mkdirSync(sidecarsDir, { recursive: true });
+  for (const sc of normalizeSidecars(projectDir, config.sidecars)) {
+    const link = join(sidecarsDir, sc.name);
+    rmSync(link, { force: true });
+    if (existsSync(sc.src)) symlinkSync(sc.src, link);
+    else console.warn(`[mirin dev] sidecar "${sc.name}" not found: ${sc.src}`);
+  }
+
+  // --- assemble the dev bundle (Windows app folder, or macOS .app) ---
   console.log("[mirin dev] assembling dev bundle…");
-  const { app, exe } = await buildAppBundle({
-    appName,
-    bundleId,
-    outDir: work,
-    hostExe,
-    coreDylib: artifacts.coreDylib,
-    helperBin: artifacts.helperBin,
-    cefPath: artifacts.cefPath,
-    icon: config.icon ? join(projectDir, config.icon) : undefined,
-  });
+  const { app, exe } = IS_WINDOWS
+    ? await buildWindowsBundle({
+        appName,
+        outDir: work,
+        hostExe,
+        coreDll: artifacts.coreDylib,
+        helperExe: artifacts.helperBin,
+        cefPath: artifacts.cefPath,
+        icon: config.icon ? join(projectDir, config.icon) : undefined,
+      })
+    : await buildAppBundle({
+        appName,
+        bundleId,
+        outDir: work,
+        hostExe,
+        coreDylib: artifacts.coreDylib,
+        helperBin: artifacts.helperBin,
+        cefPath: artifacts.cefPath,
+        icon: config.icon ? join(projectDir, config.icon) : undefined,
+        urlSchemes: config.urlSchemes,
+      });
 
-  // --- start Vite ---
-  console.log("[mirin dev] starting Vite dev server…");
-  const vite = Bun.spawn(["bunx", "vite", "--clearScreen", "false"], {
-    cwd: projectDir,
-    stdio: ["ignore", "inherit", "inherit"],
-  });
-  await waitForUrl(DEV_URL, 15_000);
+  // --- start Vite on a free port so concurrent dev sessions don't collide ---
+  // `--port <free> --strictPort` pins Vite to the port we probed (overriding any
+  // port/strictPort in the app's vite.config) and passes the real URL to the app,
+  // so the host and Vite never disagree about which port is in use.
+  const port = await findFreePort(DEV_PORT_BASE);
+  const devUrl = `http://localhost:${port}`;
+  console.log(`[mirin dev] starting Vite dev server on ${devUrl}…`);
+  const vite = Bun.spawn(
+    ["bunx", "vite", "--clearScreen", "false", "--port", String(port), "--strictPort"],
+    {
+      cwd: projectDir,
+      stdio: ["ignore", "inherit", "inherit"],
+    },
+  );
+  await waitForUrl(devUrl, 15_000);
 
   // --- launch the app ---
   console.log(`[mirin dev] launching ${appName}…`);
@@ -63,11 +107,17 @@ export async function dev(projectDir = process.cwd()): Promise<number> {
     cwd: projectDir,
     env: {
       ...process.env,
-      MIRIN_CORE: join(app, "Contents", "MacOS", "libmirin_core.dylib"),
+      MIRIN_CORE: IS_WINDOWS
+        ? join(app, "mirin_core.dll")
+        : join(app, "Contents", "MacOS", "libmirin_core.dylib"),
       MIRIN_WORKER: workerJs,
-      MIRIN_DEV_URL: DEV_URL,
+      MIRIN_DEV_URL: devUrl,
       MIRIN_MANIFEST_JSON: JSON.stringify({ windows: config.windows }),
-      MIRIN_CONFIG_JSON: "{}",
+      // dev: true → enables inspect-element AND gives this run its own `-dev`
+      // CEF cache dir, so `mirin dev` can run alongside the installed app.
+      MIRIN_CONFIG_JSON: JSON.stringify({ dev: true }),
+      MIRIN_SIDECAR_DIR: sidecarsDir,
+      MIRIN_WORKERS_DIR: workersDir,
     },
     stdio: ["ignore", "inherit", "inherit"],
   });
@@ -84,6 +134,32 @@ export async function dev(projectDir = process.cwd()): Promise<number> {
   return code;
 }
 
+/** First free TCP port at or above `start` on loopback. */
+async function findFreePort(start: number): Promise<number> {
+  for (let port = start; port < start + 100; port++) {
+    if (await isPortFree(port)) return port;
+  }
+  throw new Error(`[mirin dev] no free port in ${start}–${start + 99}`);
+}
+
+/** Free only if neither IPv4 nor IPv6 loopback reports the port in use — Vite
+ *  binds `localhost` (often `::1`), so a v4-only probe would miss an IPv6 holder. */
+async function isPortFree(port: number): Promise<boolean> {
+  const [v4, v6] = await Promise.all([portInUse(port, "127.0.0.1"), portInUse(port, "::1")]);
+  return !v4 && !v6;
+}
+
+function portInUse(port: number, host: string): Promise<boolean> {
+  return new Promise((resolve) => {
+    const srv = createServer();
+    // Only EADDRINUSE means taken; other errors (e.g. EADDRNOTAVAIL when IPv6 is
+    // off) just mean we can't test that family — treat as not-in-use.
+    srv.once("error", (err: NodeJS.ErrnoException) => resolve(err.code === "EADDRINUSE"));
+    srv.once("listening", () => srv.close(() => resolve(false)));
+    srv.listen(port, host);
+  });
+}
+
 async function waitForUrl(url: string, timeoutMs: number): Promise<void> {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {

package/src/dmg.ts

@@ -0,0 +1,236 @@
+/**
+ * macOS `.dmg` installer for `mirin release`.
+ *
+ * Two paths:
+ *  - **plain** (default): stage the `.app` + an `/Applications` symlink, then
+ *    `hdiutil create … -format ULFO`. Rock-solid in CI — this is what ships when
+ *    `dmg: true`. ULFO (lzfse) handles large CEF frameworks best on modern macOS.
+ *  - **laid-out**: when a `background` or any window/icon position is configured,
+ *    build a read-write image, style the Finder window via AppleScript, then
+ *    convert to the compressed read-only format. Best-effort — falls back to the
+ *    plain DMG if Finder automation isn't available (e.g. a headless runner).
+ *
+ * The DMG is codesigned (a DMG carries no entitlements / hardened runtime — it's
+ * not executable code) and, when notary credentials are present, notarized +
+ * stapled so a fresh download opens without a Gatekeeper prompt.
+ */
+
+import { $ } from "bun";
+import { cpSync, mkdirSync, rmSync, symlinkSync, existsSync } from "node:fs";
+import { join, basename, isAbsolute } from "node:path";
+import { tmpdir } from "node:os";
+
+export interface DmgOptions {
+  volumeName?: string;
+  format?: "ULFO" | "UDZO" | "UDBZ";
+  background?: string;
+  windowSize?: { width: number; height: number };
+  iconSize?: number;
+  appPosition?: { x: number; y: number };
+  applicationsPosition?: { x: number; y: number };
+}
+
+export interface BuildDmgInput {
+  /** Path to the (signed) `.app`. */
+  app: string;
+  appName: string;
+  /** Output directory for the `.dmg`. */
+  outDir: string;
+  /** Output file name (e.g. `stable-darwin-arm64-Anko.dmg`). */
+  fileName: string;
+  /** Resolved DMG options. */
+  options: DmgOptions;
+  /** Project root, for resolving a relative `background` path. */
+  projectDir: string;
+  /** Codesign identity ("-"/undefined → ad-hoc, no notarization). */
+  signIdentity?: string;
+}
+
+/** hdiutil volume names choke on some punctuation; keep it tame but readable. */
+function volumeName(name: string): string {
+  return name.replace(/[/:\\]/g, " ").trim() || "App";
+}
+
+/**
+ * Notarize + staple a `.app` or `.dmg` using MIRIN_NOTARY_* env credentials.
+ * No-op (returns false) when credentials are absent. Throws on rejection,
+ * printing the notary log so the failure is diagnosable.
+ */
+export async function notarizeAndStaple(target: string): Promise<boolean> {
+  const apple = process.env.MIRIN_NOTARY_APPLE_ID;
+  const pw = process.env.MIRIN_NOTARY_PASSWORD;
+  const team = process.env.MIRIN_NOTARY_TEAM_ID;
+  if (!apple || !pw || !team) return false;
+
+  const isApp = target.endsWith(".app");
+  // notarytool wants a zip for a bundle; a .dmg is submitted as-is.
+  const submitPath = isApp ? `${target}.notarize.zip` : target;
+  if (isApp) await $`ditto -c -k --keepParent ${target} ${submitPath}`;
+
+  console.log(`[mirin release] notarizing ${basename(target)} (this can take a few minutes)…`);
+  const out =
+    await $`xcrun notarytool submit ${submitPath} --apple-id ${apple} --password ${pw} --team-id ${team} --wait --output-format json`.text();
+  if (isApp) rmSync(submitPath, { force: true });
+
+  let sub: { id?: string; status?: string } = {};
+  try {
+    sub = JSON.parse(out);
+  } catch {
+    console.error(out);
+  }
+  if (sub.status !== "Accepted") {
+    console.error(`[mirin release] notarization ${sub.status ?? "failed"} (id: ${sub.id ?? "?"})`);
+    if (sub.id) {
+      const log =
+        await $`xcrun notarytool log ${sub.id} --apple-id ${apple} --password ${pw} --team-id ${team}`
+          .text()
+          .catch(() => "");
+      if (log) console.error(log);
+    }
+    throw new Error(`notarization not accepted: ${sub.status ?? "unknown"}`);
+  }
+  await $`xcrun stapler staple ${target}`;
+  return true;
+}
+
+/** Does this config ask for a styled Finder window (vs. a plain DMG)? */
+function wantsLayout(o: DmgOptions): boolean {
+  return !!(o.background || o.appPosition || o.applicationsPosition || o.windowSize || o.iconSize);
+}
+
+/**
+ * Build (and codesign) the `.dmg`, returning its path. Notarization is the
+ * caller's responsibility (so it can be sequenced with the other artifacts).
+ */
+export async function buildDmg(input: BuildDmgInput): Promise<string> {
+  const { app, appName, outDir, fileName, options, projectDir, signIdentity } = input;
+  const vol = volumeName(options.volumeName ?? appName);
+  const format = options.format ?? "ULFO";
+  const dmgPath = join(outDir, fileName);
+  rmSync(dmgPath, { force: true });
+
+  const staging = join(tmpdir(), `mirin-dmg-${process.pid}`);
+  rmSync(staging, { recursive: true, force: true });
+  mkdirSync(staging, { recursive: true });
+  try {
+    // BSD cp -R preserves the bundle's symlinks/signatures.
+    await $`cp -R ${app} ${join(staging, basename(app))}`;
+    symlinkSync("/Applications", join(staging, "Applications"));
+
+    let built = false;
+    if (wantsLayout(options)) {
+      try {
+        await buildLaidOutDmg({ staging, vol, format, dmgPath, options, projectDir, appFile: basename(app) });
+        built = true;
+      } catch (e) {
+        console.warn(
+          `[mirin release] DMG layout failed (${e instanceof Error ? e.message : e}); ` +
+            `falling back to a plain DMG.`,
+        );
+        rmSync(dmgPath, { force: true });
+      }
+    }
+    if (!built) {
+      await $`hdiutil create -volname ${vol} -srcfolder ${staging} -ov -format ${format} ${dmgPath}`.quiet();
+    }
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+  }
+
+  // Sign the image itself (Gatekeeper checks the DMG's signature too).
+  if (signIdentity && signIdentity !== "-") {
+    await $`codesign --force --timestamp --sign ${signIdentity} ${dmgPath}`.quiet();
+  } else if (signIdentity === "-") {
+    await $`codesign --force --sign - ${dmgPath}`.quiet();
+  }
+  return dmgPath;
+}
+
+/**
+ * Read-write image → style the Finder window via AppleScript → convert to the
+ * compressed read-only `format`. Throws if any step fails (caller falls back).
+ */
+async function buildLaidOutDmg(args: {
+  staging: string;
+  vol: string;
+  format: string;
+  dmgPath: string;
+  options: DmgOptions;
+  projectDir: string;
+  appFile: string;
+}): Promise<void> {
+  const { staging, vol, format, dmgPath, options, projectDir, appFile } = args;
+  const win = options.windowSize ?? { width: 640, height: 400 };
+  const iconSize = options.iconSize ?? 128;
+  const appPos = options.appPosition ?? { x: Math.round(win.width * 0.25), y: Math.round(win.height * 0.5) };
+  const appsPos =
+    options.applicationsPosition ?? { x: Math.round(win.width * 0.75), y: Math.round(win.height * 0.5) };
+
+  // Stage a background image (if any) under a hidden folder Finder can reference.
+  let bgFile: string | undefined;
+  if (options.background) {
+    const src = isAbsolute(options.background)
+      ? options.background
+      : join(projectDir, options.background);
+    if (!existsSync(src)) throw new Error(`background not found: ${src}`);
+    const bgDir = join(staging, ".background");
+    mkdirSync(bgDir, { recursive: true });
+    const ext = src.slice(src.lastIndexOf("."));
+    bgFile = `bg${ext}`;
+    cpSync(src, join(bgDir, bgFile));
+  }
+
+  const rw = `${dmgPath}.rw.dmg`;
+  rmSync(rw, { force: true });
+  // Read-write image sized to the staged contents, with slack for HFS overhead.
+  await $`hdiutil create -volname ${vol} -srcfolder ${staging} -fs HFS+ -format UDRW -ov ${rw}`.quiet();
+
+  // Attach without auto-opening a Finder window; parse the real mountpoint.
+  const attach =
+    await $`hdiutil attach ${rw} -readwrite -noverify -noautoopen`.text();
+  const mount = attach
+    .split("\n")
+    .map((l) => l.trim())
+    .find((l) => l.includes("/Volumes/"))
+    ?.split("\t")
+    .pop()
+    ?.trim();
+  if (!mount || !existsSync(mount)) {
+    await $`hdiutil detach ${rw}`.quiet().catch(() => {});
+    throw new Error("could not resolve DMG mountpoint");
+  }
+
+  try {
+    const bgClause = bgFile
+      ? `set background picture of viewOptions to file ".background:${bgFile}"`
+      : "";
+    const script = `
+      tell application "Finder"
+        tell disk "${vol}"
+          open
+          set current view of container window to icon view
+          set toolbar visible of container window to false
+          set statusbar visible of container window to false
+          set the bounds of container window to {200, 120, ${200 + win.width}, ${120 + win.height}}
+          set viewOptions to the icon view options of container window
+          set arrangement of viewOptions to not arranged
+          set icon size of viewOptions to ${iconSize}
+          ${bgClause}
+          set position of item "${appFile}" of container window to {${appPos.x}, ${appPos.y}}
+          set position of item "Applications" of container window to {${appsPos.x}, ${appsPos.y}}
+          update without registering applications
+          delay 1
+          close
+        end tell
+      end tell`;
+    await $`osascript -e ${script}`.quiet();
+    await $`sync`.quiet().catch(() => {});
+  } finally {
+    await $`hdiutil detach ${mount}`.quiet().catch(async () => {
+      await $`hdiutil detach ${rw} -force`.quiet().catch(() => {});
+    });
+  }
+
+  await $`hdiutil convert ${rw} -format ${format} -ov -o ${dmgPath}`.quiet();
+  rmSync(rw, { force: true });
+}

package/src/extras.ts

@@ -0,0 +1,61 @@
+/**
+ * Shared helpers for the two "extra asset" config blocks — `sidecars` (bundled
+ * binaries) and `workers` (extra Bun Worker entries) — used by both `mirin build`
+ * and `mirin dev`. Keeps the config normalization + worker compilation in one
+ * place so the two CLI paths stay in sync.
+ */
+
+import { $ } from "bun";
+import { join } from "node:path";
+
+/** Config shapes (mirrors packages/mirin/src/config.ts; CLI can't import the runtime). */
+export type SidecarConfig = Record<string, string | { bin: string; entitlements?: string[] }>;
+export type WorkersConfig = Record<string, string>;
+
+/** A sidecar resolved to an absolute source path + its requested entitlements. */
+export interface NormalizedSidecar {
+  name: string;
+  /** Absolute path to the source binary. */
+  src: string;
+  /** Short entitlement names (e.g. "allow-jit"); empty for most CLIs. */
+  entitlements: string[];
+}
+
+/** Resolve `config.sidecars` to absolute source paths. */
+export function normalizeSidecars(
+  projectDir: string,
+  sidecars: SidecarConfig | undefined,
+): NormalizedSidecar[] {
+  return Object.entries(sidecars ?? {}).map(([name, value]) => {
+    const spec = typeof value === "string" ? { bin: value } : value;
+    return {
+      name,
+      src: join(projectDir, spec.bin),
+      entitlements: spec.entitlements ?? [],
+    };
+  });
+}
+
+/**
+ * Compile each extra-worker entry to `<outDir>/<name>.js`. Returns name → path.
+ * `minify` matches the surrounding build (prod minifies; dev doesn't).
+ */
+export async function compileWorkers(
+  projectDir: string,
+  workers: WorkersConfig | undefined,
+  outDir: string,
+  minify: boolean,
+): Promise<Record<string, string>> {
+  const out: Record<string, string> = {};
+  for (const [name, entry] of Object.entries(workers ?? {})) {
+    const js = join(outDir, `${name}.js`);
+    const src = join(projectDir, entry);
+    if (minify) {
+      await $`bun build ${src} --target=bun --minify --outfile ${js}`.cwd(projectDir);
+    } else {
+      await $`bun build ${src} --target=bun --outfile ${js}`.cwd(projectDir);
+    }
+    out[name] = js;
+  }
+  return out;
+}

package/src/icon-win.ts

@@ -0,0 +1,81 @@
+/**
+ * Produce a Windows `.ico` from the app's icon source (mirrors the macOS `.icns`
+ * path in `bundle.ts`). mirin loads it at runtime and sets it as the window icon
+ * (taskbar / Alt-Tab / title). Accepts a `.ico` (copied), a `.iconset` directory
+ * (its `icon_NxN.png` renditions packed as multi-size PNG entries — Vista+ icons
+ * embed PNGs directly, so no rescaling is needed), or a single `.png`.
+ */
+
+import { copyFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** The iconset renditions worth packing (small sizes render crisper than scaling 256). */
+const ICO_SIZES = [16, 32, 48, 64, 128, 256];
+
+interface IconEntry {
+  size: number;
+  png: Uint8Array;
+}
+
+/** Pack PNG renditions into a multi-image `.ico` (each entry is a PNG blob). */
+function packIco(entries: IconEntry[]): Uint8Array {
+  const headerSize = 6 + entries.length * 16;
+  const header = new Uint8Array(headerSize);
+  const dv = new DataView(header.buffer);
+  dv.setUint16(0, 0, true); // reserved
+  dv.setUint16(2, 1, true); // type 1 = icon
+  dv.setUint16(4, entries.length, true);
+
+  let offset = headerSize;
+  entries.forEach((e, i) => {
+    const base = 6 + i * 16;
+    header[base] = e.size >= 256 ? 0 : e.size; // width (0 = 256)
+    header[base + 1] = e.size >= 256 ? 0 : e.size; // height
+    header[base + 2] = 0; // palette
+    header[base + 3] = 0; // reserved
+    dv.setUint16(base + 4, 1, true); // planes
+    dv.setUint16(base + 6, 32, true); // bits per pixel
+    dv.setUint32(base + 8, e.png.length, true); // bytes in resource
+    dv.setUint32(base + 12, offset, true); // image offset
+    offset += e.png.length;
+  });
+
+  const out = new Uint8Array(offset);
+  out.set(header, 0);
+  let pos = headerSize;
+  for (const e of entries) {
+    out.set(e.png, pos);
+    pos += e.png.length;
+  }
+  return out;
+}
+
+/** Write `outPath` (an `.ico`) from `iconSrc`, returning it, or undefined if no
+ *  usable source was found. */
+export function makeWindowsIcon(iconSrc: string, outPath: string): string | undefined {
+  if (!existsSync(iconSrc)) {
+    console.warn(`[mirin] icon not found, skipping: ${iconSrc}`);
+    return undefined;
+  }
+  if (iconSrc.endsWith(".ico")) {
+    copyFileSync(iconSrc, outPath);
+    return outPath;
+  }
+
+  const entries: IconEntry[] = [];
+  if (iconSrc.endsWith(".iconset")) {
+    for (const size of ICO_SIZES) {
+      const png = join(iconSrc, `icon_${size}x${size}.png`);
+      if (existsSync(png)) entries.push({ size, png: readFileSync(png) });
+    }
+  } else if (iconSrc.endsWith(".png")) {
+    entries.push({ size: 256, png: readFileSync(iconSrc) });
+  }
+
+  if (!entries.length) {
+    console.warn(`[mirin] no usable icon renditions in ${iconSrc}`);
+    return undefined;
+  }
+  writeFileSync(outPath, packIco(entries));
+  return outPath;
+}

package/src/index.ts

@@ -6,6 +6,7 @@
 import { resolve } from "node:path";
 import { dev } from "./dev.ts";
 import { build } from "./build.ts";
+import { release } from "./release.ts";
 import { scaffold } from "create-mirinjs";
 
 const [command, arg] = Bun.argv.slice(2);
@@ -15,6 +16,7 @@ const USAGE = `mirin — build desktop apps with Bun + Chromium
 Usage:
   mirin dev          run the app against the Vite dev server (HMR + typed RPC)
   mirin build        package a standalone, signed .app (output: ./build)
+  mirin release      build + emit update artifacts (output: ./build/release)
   mirin init [dir]   scaffold a new app
 `;
 
@@ -24,7 +26,12 @@ switch (command) {
     break;
   }
   case "build": {
-    process.exit(await build());
+    await build();
+    process.exit(0);
+    break;
+  }
+  case "release": {
+    process.exit(await release());
     break;
   }
   case "init": {