@mirinjs/cli 0.1.0-alpha.0 → 0.1.0-alpha.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mirinjs/cli",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.10",
   "description": "CLI for mirin apps: dev, build, init.",
   "type": "module",
   "license": "MIT",
@@ -27,12 +27,12 @@
     "bun": ">=1.2.0"
   },
   "dependencies": {
-    "create-mirinjs": "0.1.0-alpha.0",
-    "mirinjs": "0.1.0-alpha.0"
+    "create-mirinjs": "0.1.0-alpha.10",
+    "mirinjs": "0.1.0-alpha.10"
   },
   "optionalDependencies": {
-    "@mirinjs/darwin-arm64": "0.1.0-alpha.0",
-    "@mirinjs/win32-x64": "0.1.0-alpha.0"
+    "@mirinjs/darwin-arm64": "0.1.0-alpha.10",
+    "@mirinjs/win32-x64": "0.1.0-alpha.10"
   },
   "publishConfig": {
     "access": "public"

package/src/build.ts

@@ -16,16 +16,90 @@
  */
 
 import { $ } from "bun";
-import { mkdirSync, rmSync, readFileSync, existsSync } from "node:fs";
+import { mkdirSync, rmSync, readFileSync, writeFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { buildAppBundle } from "./bundle.ts";
 import { buildWindowsBundle } from "./bundle-win.ts";
+import { makeWindowsIcon } from "./icon-win.ts";
 import { resolveArtifacts } from "./artifacts.ts";
 import { sweepBuildTemps } from "./temps.ts";
 import { normalizeSidecars, compileWorkers } from "./extras.ts";
 
 const IS_WINDOWS = process.platform === "win32";
 
+/** A PE FILEVERSION (`x.y.z.w`) from a semver string (pre-release suffix dropped). */
+function winFileVersion(v: string): string {
+  const m = v.match(/^(\d+)\.(\d+)\.(\d+)/);
+  return m ? `${m[1]}.${m[2]}.${m[3]}.0` : "0.0.0.0";
+}
+
+/**
+ * Flip a PE exe from the CONSOLE subsystem (3) to GUI (2) so Windows allocates
+ * **no console window** when it's launched from a shortcut. Bun's
+ * `--windows-hide-console` only hides the console at runtime (a brief flash);
+ * GUI subsystem prevents it entirely — the equivalent of Electrobun's
+ * `exe.subsystem = .Windows`. The optional-header Subsystem field is at
+ * `e_lfanew + 24 (PE sig + COFF) + 68`.
+ */
+function patchPeToGuiSubsystem(exePath: string): void {
+  const buf = readFileSync(exePath);
+  const peOff = buf.readUInt32LE(0x3c);
+  if (buf.readUInt32LE(peOff) !== 0x0000_4550) return; // not "PE\0\0"
+  const subsystemOff = peOff + 92;
+  if (buf.readUInt16LE(subsystemOff) === 3 /* CONSOLE */) {
+    buf.writeUInt16LE(2 /* GUI */, subsystemOff);
+    writeFileSync(exePath, buf);
+  }
+}
+
+/**
+ * Stamp a Bun-compiled Windows exe with the app icon + version metadata via
+ * rcedit. Bun's `--windows-icon` is a silent no-op on Windows hosts, so without
+ * this the exe keeps Bun's icon — which the Start Menu / Desktop shortcut, the
+ * taskbar, and Explorer all show. Uses a single largest-size icon: rcedit's
+ * multi-size replacement silently fails on Bun's appended-payload exes, while a
+ * single 256 entry takes and Windows downscales it cleanly for smaller views.
+ * Best-effort — warns (doesn't fail the build) if rcedit isn't installed.
+ */
+async function brandWindowsExe(
+  exe: string,
+  opts: {
+    projectDir: string;
+    work: string;
+    appName: string;
+    version: string;
+    icon?: string;
+    publisher: string;
+  },
+): Promise<void> {
+  if (!Bun.which("rcedit")) {
+    console.warn(
+      "[mirin build] rcedit not found — the Windows exe keeps Bun's default icon. " +
+        "Install it: `scoop install rcedit` (or `choco install rcedit`).",
+    );
+    return;
+  }
+  const args: string[] = [];
+  if (opts.icon) {
+    const ico = makeWindowsIcon(join(opts.projectDir, opts.icon), join(opts.work, "exe-icon.ico"), {
+      onlyLargest: true,
+    });
+    if (ico) args.push("--set-icon", ico);
+  }
+  const fv = winFileVersion(opts.version);
+  args.push(
+    "--set-version-string", "ProductName", opts.appName,
+    "--set-version-string", "FileDescription", opts.appName,
+    "--set-version-string", "CompanyName", opts.publisher,
+    "--set-file-version", fv,
+    "--set-product-version", fv,
+  );
+  const res = await $`rcedit ${exe} ${args}`.nothrow();
+  if (res.exitCode !== 0) {
+    console.warn(`[mirin build] rcedit failed (exit ${res.exitCode}) — exe branding skipped.`);
+  }
+}
+
 export interface BuildResult {
   /** Path to the assembled .app. */
   app: string;
@@ -43,6 +117,12 @@ export interface BuildResult {
   projectDir: string;
   /** DMG config from mirin.config.ts (`true`/object/`false`); default `true`. */
   dmg: boolean | import("mirinjs").DmgConfig;
+  /** NSIS installer config (Windows) — `true`/object/`false`; default `true`. */
+  nsis: boolean | import("mirinjs").NsisConfig;
+  /** Inno Setup installer config (Windows) — preferred over NSIS; default `true`. */
+  inno: boolean | import("mirinjs").InnoConfig;
+  /** Publisher / company name (config.publisher ?? appName). */
+  publisher: string;
   /** Codesign identity used for the bundle, if any (MIRIN_SIGN_IDENTITY). */
   signIdentity?: string;
 }
@@ -73,6 +153,9 @@ export async function build(projectDir = process.cwd()): Promise<BuildResult> {
   const channel: string = config.release?.channel ?? "stable";
   const baseUrl: string | undefined = config.release?.baseUrl;
   const dmg: boolean | import("mirinjs").DmgConfig = config.dmg ?? true;
+  const nsis: boolean | import("mirinjs").NsisConfig = config.nsis ?? true;
+  const inno: boolean | import("mirinjs").InnoConfig = config.inno ?? true;
+  const publisher: string = config.publisher ?? appName;
 
   console.log(`[mirin build] ${appName} ${version}`);
 
@@ -89,6 +172,17 @@ export async function build(projectDir = process.cwd()): Promise<BuildResult> {
   const hostExe = join(work, IS_WINDOWS ? "host-release.exe" : "host-release");
   const workerJs = join(work, "worker.release.js");
   await $`bun build --compile --minify ${artifacts.hostEntry} --outfile ${hostExe}`.cwd(projectDir);
+  if (IS_WINDOWS) {
+    patchPeToGuiSubsystem(hostExe);
+    await brandWindowsExe(hostExe, {
+      projectDir,
+      work,
+      appName,
+      version,
+      icon: config.icon,
+      publisher,
+    });
+  }
   await $`bun build ${mainEntry} --target=bun --minify --outfile ${workerJs}`.cwd(projectDir);
 
   // Extra assets: resolve sidecar binaries + compile any extra worker entries.
@@ -105,7 +199,11 @@ export async function build(projectDir = process.cwd()): Promise<BuildResult> {
   const resources = {
     uiDir: join(projectDir, "dist"),
     workerJs,
-    manifestJson: JSON.stringify({ windows: config.windows }),
+    manifestJson: JSON.stringify({
+      id: bundleId,
+      windows: config.windows,
+      singleInstance: config.singleInstance,
+    }),
     versionJson,
     workers: extraWorkers,
   };
@@ -146,6 +244,9 @@ export async function build(projectDir = process.cwd()): Promise<BuildResult> {
     coreDylib: artifacts.coreDylib,
     projectDir,
     dmg,
+    nsis,
+    inno,
+    publisher,
     signIdentity,
   };
 }

package/src/dev.ts

@@ -112,7 +112,7 @@ export async function dev(projectDir = process.cwd()): Promise<number> {
         : join(app, "Contents", "MacOS", "libmirin_core.dylib"),
       MIRIN_WORKER: workerJs,
       MIRIN_DEV_URL: devUrl,
-      MIRIN_MANIFEST_JSON: JSON.stringify({ windows: config.windows }),
+      MIRIN_MANIFEST_JSON: JSON.stringify({ id: bundleId, windows: config.windows }),
       // dev: true → enables inspect-element AND gives this run its own `-dev`
       // CEF cache dir, so `mirin dev` can run alongside the installed app.
       MIRIN_CONFIG_JSON: JSON.stringify({ dev: true }),

package/src/dmg.ts

@@ -93,6 +93,34 @@ export async function notarizeAndStaple(target: string): Promise<boolean> {
   return true;
 }
 
+/**
+ * `hdiutil create` with retries. "Resource busy" is a transient CI flake — a
+ * Spotlight/antivirus/`fseventsd` process touches the staging folder (or a prior
+ * image hasn't fully detached) while hdiutil tries to read it. A short backoff
+ * clears it; only a non-busy error fails immediately.
+ */
+async function hdiutilCreate(
+  vol: string,
+  staging: string,
+  format: string,
+  dmgPath: string,
+): Promise<void> {
+  let stderr = "";
+  for (let attempt = 1; attempt <= 4; attempt++) {
+    const res =
+      await $`hdiutil create -volname ${vol} -srcfolder ${staging} -ov -format ${format} ${dmgPath}`
+        .quiet()
+        .nothrow();
+    if (res.exitCode === 0) return;
+    stderr = res.stderr.toString().trim();
+    if (!/busy/i.test(stderr)) break; // not the transient flake — fail now
+    console.warn(`[mirin release] hdiutil create busy (attempt ${attempt}/4); retrying…`);
+    rmSync(dmgPath, { force: true });
+    await Bun.sleep(3000 * attempt);
+  }
+  throw new Error(`hdiutil create failed: ${stderr}`);
+}
+
 /** Does this config ask for a styled Finder window (vs. a plain DMG)? */
 function wantsLayout(o: DmgOptions): boolean {
   return !!(o.background || o.appPosition || o.applicationsPosition || o.windowSize || o.iconSize);
@@ -131,7 +159,7 @@ export async function buildDmg(input: BuildDmgInput): Promise<string> {
       }
     }
     if (!built) {
-      await $`hdiutil create -volname ${vol} -srcfolder ${staging} -ov -format ${format} ${dmgPath}`.quiet();
+      await hdiutilCreate(vol, staging, format, dmgPath);
     }
   } finally {
     rmSync(staging, { recursive: true, force: true });

package/src/icon-win.ts

@@ -1,58 +1,210 @@
 /**
  * Produce a Windows `.ico` from the app's icon source (mirrors the macOS `.icns`
- * path in `bundle.ts`). mirin loads it at runtime and sets it as the window icon
- * (taskbar / Alt-Tab / title). Accepts a `.ico` (copied), a `.iconset` directory
- * (its `icon_NxN.png` renditions packed as multi-size PNG entries — Vista+ icons
- * embed PNGs directly, so no rescaling is needed), or a single `.png`.
+ * path in `bundle.ts`). Emits **classic DIB/BMP icon entries** (32bpp BGRA + AND
+ * mask), NOT PNG-compressed entries: Bun's `--windows-icon` embedder silently
+ * ignores PNG-format ICOs (the exe keeps Bun's default icon), and some shells
+ * mis-scale them. Accepts a `.ico` (copied), a `.iconset` directory (its
+ * `icon_NxN.png` renditions), or a single square `.png`.
  */
 
 import { copyFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { inflateSync } from "node:zlib";
 import { join } from "node:path";
 
-/** The iconset renditions worth packing (small sizes render crisper than scaling 256). */
+/** Standard Windows icon sizes; intermediate sizes are downscaled from these by
+ *  the shell, so the 256 entry keeps large views crisp. */
 const ICO_SIZES = [16, 32, 48, 64, 128, 256];
 
-interface IconEntry {
+interface IcoEntry {
   size: number;
-  png: Uint8Array;
+  /** DIB image (small sizes) or raw PNG bytes (256) — see {@link rendition}. */
+  data: Buffer;
+  /** True when `data` is a PNG blob (the 256 convention) rather than a DIB. */
+  png: boolean;
 }
 
-/** Pack PNG renditions into a multi-image `.ico` (each entry is a PNG blob). */
-function packIco(entries: IconEntry[]): Uint8Array {
-  const headerSize = 6 + entries.length * 16;
-  const header = new Uint8Array(headerSize);
-  const dv = new DataView(header.buffer);
-  dv.setUint16(0, 0, true); // reserved
-  dv.setUint16(2, 1, true); // type 1 = icon
-  dv.setUint16(4, entries.length, true);
+/**
+ * Minimal PNG decoder → top-down RGBA. Handles 8-bit, non-interlaced, color
+ * types 0/2/4/6 (the renditions macOS `iconutil`/`sips` and design tools emit).
+ * Throws on anything else so the caller skips just that rendition.
+ */
+function decodePng(buf: Buffer): { width: number; height: number; rgba: Buffer } {
+  if (buf.readUInt32BE(0) !== 0x89504e47) throw new Error("not a PNG");
+  let width = 0;
+  let height = 0;
+  let bitDepth = 0;
+  let colorType = 0;
+  let interlace = 0;
+  const idat: Buffer[] = [];
+  let pos = 8;
+  while (pos + 8 <= buf.length) {
+    const len = buf.readUInt32BE(pos);
+    const type = buf.toString("latin1", pos + 4, pos + 8);
+    const data = buf.subarray(pos + 8, pos + 8 + len);
+    if (type === "IHDR") {
+      width = data.readUInt32BE(0);
+      height = data.readUInt32BE(4);
+      bitDepth = data[8]!;
+      colorType = data[9]!;
+      interlace = data[12]!;
+    } else if (type === "IDAT") {
+      idat.push(data);
+    } else if (type === "IEND") {
+      break;
+    }
+    pos += 12 + len;
+  }
+  if (bitDepth !== 8 || interlace !== 0) {
+    throw new Error(`unsupported PNG (depth ${bitDepth}, interlace ${interlace})`);
+  }
+  const channels = colorType === 6 ? 4 : colorType === 2 ? 3 : colorType === 4 ? 2 : colorType === 0 ? 1 : 0;
+  if (!channels) throw new Error(`unsupported color type ${colorType}`);
+
+  const raw = inflateSync(Buffer.concat(idat));
+  const stride = width * channels;
+  const rgba = Buffer.alloc(width * height * 4);
+  let prev = Buffer.alloc(stride);
+  let rp = 0;
+  for (let y = 0; y < height; y++) {
+    const filter = raw[rp++]!;
+    const cur = Buffer.from(raw.subarray(rp, rp + stride));
+    rp += stride;
+    unfilter(filter, cur, prev, channels);
+    for (let x = 0; x < width; x++) {
+      const s = x * channels;
+      let r: number;
+      let g: number;
+      let b: number;
+      let a: number;
+      if (channels === 4) {
+        r = cur[s]!;
+        g = cur[s + 1]!;
+        b = cur[s + 2]!;
+        a = cur[s + 3]!;
+      } else if (channels === 3) {
+        r = cur[s]!;
+        g = cur[s + 1]!;
+        b = cur[s + 2]!;
+        a = 255;
+      } else if (channels === 2) {
+        r = g = b = cur[s]!;
+        a = cur[s + 1]!;
+      } else {
+        r = g = b = cur[s]!;
+        a = 255;
+      }
+      const d = (y * width + x) * 4;
+      rgba[d] = r;
+      rgba[d + 1] = g;
+      rgba[d + 2] = b;
+      rgba[d + 3] = a;
+    }
+    prev = cur;
+  }
+  return { width, height, rgba };
+}
+
+/** Reverse a PNG scanline filter in place (None/Sub/Up/Average/Paeth). */
+function unfilter(filter: number, cur: Buffer, prev: Buffer, bpp: number): void {
+  for (let i = 0; i < cur.length; i++) {
+    const a = i >= bpp ? cur[i - bpp]! : 0;
+    const b = prev[i]!;
+    const c = i >= bpp ? prev[i - bpp]! : 0;
+    let v = cur[i]!;
+    if (filter === 1) v += a;
+    else if (filter === 2) v += b;
+    else if (filter === 3) v += (a + b) >> 1;
+    else if (filter === 4) {
+      const p = a + b - c;
+      const pa = Math.abs(p - a);
+      const pb = Math.abs(p - b);
+      const pc = Math.abs(p - c);
+      v += pa <= pb && pa <= pc ? a : pb <= pc ? b : c;
+    }
+    cur[i] = v & 0xff;
+  }
+}
+
+/** Encode one icon image as a DIB: BITMAPINFOHEADER + bottom-up 32bpp BGRA + a
+ *  (zeroed) 1bpp AND mask — the alpha channel drives transparency. */
+function dibEntry(size: number, rgba: Buffer): Buffer {
+  const xor = Buffer.alloc(size * size * 4);
+  for (let dy = 0; dy < size; dy++) {
+    const sy = size - 1 - dy; // DIB rows run bottom-to-top
+    for (let x = 0; x < size; x++) {
+      const s = (sy * size + x) * 4;
+      const d = (dy * size + x) * 4;
+      xor[d] = rgba[s + 2]!; // B
+      xor[d + 1] = rgba[s + 1]!; // G
+      xor[d + 2] = rgba[s]!; // R
+      xor[d + 3] = rgba[s + 3]!; // A
+    }
+  }
+  const andStride = Math.ceil(size / 32) * 4; // 1bpp, rows padded to 4 bytes
+  const andMask = Buffer.alloc(andStride * size, 0);
+  const hdr = Buffer.alloc(40);
+  hdr.writeUInt32LE(40, 0); // biSize
+  hdr.writeInt32LE(size, 4); // biWidth
+  hdr.writeInt32LE(size * 2, 8); // biHeight = XOR rows + AND rows
+  hdr.writeUInt16LE(1, 12); // biPlanes
+  hdr.writeUInt16LE(32, 14); // biBitCount
+  hdr.writeUInt32LE(0, 16); // BI_RGB
+  hdr.writeUInt32LE(xor.length + andMask.length, 20);
+  return Buffer.concat([hdr, xor, andMask]);
+}
 
-  let offset = headerSize;
+/** Assemble the ICONDIR + entries into a `.ico`. */
+function packIco(entries: IcoEntry[]): Buffer {
+  const dirSize = 6 + entries.length * 16;
+  const dir = Buffer.alloc(dirSize);
+  dir.writeUInt16LE(0, 0); // reserved
+  dir.writeUInt16LE(1, 2); // type 1 = icon
+  dir.writeUInt16LE(entries.length, 4);
+  let offset = dirSize;
   entries.forEach((e, i) => {
     const base = 6 + i * 16;
-    header[base] = e.size >= 256 ? 0 : e.size; // width (0 = 256)
-    header[base + 1] = e.size >= 256 ? 0 : e.size; // height
-    header[base + 2] = 0; // palette
-    header[base + 3] = 0; // reserved
-    dv.setUint16(base + 4, 1, true); // planes
-    dv.setUint16(base + 6, 32, true); // bits per pixel
-    dv.setUint32(base + 8, e.png.length, true); // bytes in resource
-    dv.setUint32(base + 12, offset, true); // image offset
-    offset += e.png.length;
+    dir[base] = e.size >= 256 ? 0 : e.size; // width (0 = 256)
+    dir[base + 1] = e.size >= 256 ? 0 : e.size; // height
+    dir.writeUInt16LE(1, base + 4); // planes
+    dir.writeUInt16LE(32, base + 6); // bits per pixel
+    dir.writeUInt32LE(e.data.length, base + 8); // bytes in resource
+    dir.writeUInt32LE(offset, base + 12); // image offset
+    offset += e.data.length;
   });
+  return Buffer.concat([dir, ...entries.map((e) => e.data)]);
+}
 
-  const out = new Uint8Array(offset);
-  out.set(header, 0);
-  let pos = headerSize;
-  for (const e of entries) {
-    out.set(e.png, pos);
-    pos += e.png.length;
+/**
+ * Build one icon entry from a square PNG rendition. Sizes ≥256 are stored as the
+ * raw PNG blob (the Windows convention — a 256×256 DIB is non-standard and is
+ * rejected by Bun/rcedit/the resource compiler); smaller sizes are decoded to a
+ * DIB. Returns undefined if the file isn't the expected square size.
+ */
+function rendition(file: string, size: number): IcoEntry | undefined {
+  try {
+    const buf = readFileSync(file);
+    if (size >= 256) return { size, data: buf, png: true };
+    const { width, height, rgba } = decodePng(buf);
+    if (width !== size || height !== size) return undefined;
+    return { size, data: dibEntry(size, rgba), png: false };
+  } catch (e) {
+    console.warn(`[mirin] icon: skipping ${file} (${e instanceof Error ? e.message : e})`);
+    return undefined;
   }
-  return out;
 }
 
-/** Write `outPath` (an `.ico`) from `iconSrc`, returning it, or undefined if no
- *  usable source was found. */
-export function makeWindowsIcon(iconSrc: string, outPath: string): string | undefined {
+/**
+ * Write `outPath` (an `.ico`) from `iconSrc`, returning it, or undefined if no
+ * usable source was found. With `onlyLargest`, emits a single (largest) entry —
+ * needed for the **exe** icon, since rcedit's multi-size icon replacement fails on
+ * Bun-compiled exes (single-entry works, and Windows downscales 256 cleanly for
+ * small views). The full multi-size form is fine for `icon.ico` (NSIS + WM_SETICON).
+ */
+export function makeWindowsIcon(
+  iconSrc: string,
+  outPath: string,
+  opts?: { onlyLargest?: boolean },
+): string | undefined {
   if (!existsSync(iconSrc)) {
     console.warn(`[mirin] icon not found, skipping: ${iconSrc}`);
     return undefined;
@@ -62,14 +214,33 @@ export function makeWindowsIcon(iconSrc: string, outPath: string): string | unde
     return outPath;
   }
 
-  const entries: IconEntry[] = [];
+  const entries: IcoEntry[] = [];
   if (iconSrc.endsWith(".iconset")) {
-    for (const size of ICO_SIZES) {
+    const sizes = opts?.onlyLargest ? [...ICO_SIZES].reverse() : ICO_SIZES;
+    for (const size of sizes) {
       const png = join(iconSrc, `icon_${size}x${size}.png`);
-      if (existsSync(png)) entries.push({ size, png: readFileSync(png) });
+      if (existsSync(png)) {
+        const e = rendition(png, size);
+        if (e) {
+          entries.push(e);
+          if (opts?.onlyLargest) break;
+        }
+      }
     }
   } else if (iconSrc.endsWith(".png")) {
-    entries.push({ size: 256, png: readFileSync(iconSrc) });
+    try {
+      const buf = readFileSync(iconSrc);
+      const { width, height, rgba } = decodePng(buf);
+      if (width !== height || width > 256) {
+        console.warn(`[mirin] icon png must be square ≤256px (got ${width}×${height})`);
+      } else if (width === 256) {
+        entries.push({ size: 256, data: buf, png: true });
+      } else {
+        entries.push({ size: width, data: dibEntry(width, rgba), png: false });
+      }
+    } catch (e) {
+      console.warn(`[mirin] icon: cannot decode ${iconSrc} (${e instanceof Error ? e.message : e})`);
+    }
   }
 
   if (!entries.length) {

package/src/installer-inno.ts

@@ -0,0 +1,130 @@
+/**
+ * Windows installer via **Inno Setup** — a modern, clean wizard (the installer VS
+ * Code ships). Generates an `.iss` script from the app folder + config and compiles
+ * it with `iscc`. Like the NSIS path it installs per-user (`%LOCALAPPDATA%\Programs`,
+ * no elevation) or per-machine (Program Files), creates Start Menu + Desktop
+ * shortcuts, and registers an uninstaller / Add-Remove-Programs entry — but with
+ * Inno's `WizardStyle=modern` flat UI instead of NSIS's dated one.
+ *
+ * Requires `iscc` (Inno Setup 6+) on PATH; the caller checks `hasInno()` and falls
+ * back to NSIS / the portable `.zip` when it's absent.
+ */
+
+import { $ } from "bun";
+import { existsSync, rmSync, writeFileSync } from "node:fs";
+import { join, isAbsolute } from "node:path";
+import type { InnoConfig } from "mirinjs";
+import { makeWindowsIcon } from "./icon-win.ts";
+
+export interface BuildInnoInput {
+  appDir: string; // the assembled app folder (build/<App>)
+  appName: string;
+  exeName: string; // <App>.exe
+  version: string;
+  bundleId: string; // reverse-DNS id → AppId / uninstall key
+  outDir: string; // build/release
+  fileName: string; // e.g. stable-win32-x64-Anko-setup.exe
+  options: InnoConfig;
+  projectDir: string;
+}
+
+/** Whether the Inno Setup compiler `iscc` is on PATH. */
+export function hasInno(): boolean {
+  return Bun.which("iscc") != null;
+}
+
+const resolve = (projectDir: string, p: string) => (isAbsolute(p) ? p : join(projectDir, p));
+/** Escape an Inno directive value: `{` is the constant sigil. */
+const v = (s: string) => s.replace(/\{/g, "{{");
+
+/** Build the installer with `iscc`, returning the setup.exe path. */
+export async function buildInnoInstaller(input: BuildInnoInput): Promise<string> {
+  const { appDir, appName, exeName, version, bundleId, outDir, fileName, options, projectDir } = input;
+  const out = join(outDir, fileName);
+  rmSync(out, { force: true });
+  if (!fileName.endsWith(".exe")) throw new Error("inno: fileName must end with .exe");
+  const baseName = fileName.slice(0, -".exe".length);
+
+  const perMachine = options.perMachine === true;
+  const minimal = options.oneClick === true;
+  const desktop = options.desktopShortcut !== false;
+  const startMenu = options.startMenuShortcut !== false;
+  const runAfter = options.runAfterFinish !== false;
+  const changeDir = options.allowChangeInstallDir !== false && !minimal;
+  const publisher = options.publisher ?? appName;
+  const installDir =
+    options.installDir ?? (perMachine ? "{autopf}\\" + appName : "{localappdata}\\Programs\\" + appName);
+
+  // Setup icon: an explicit .ico, else the app's bundled icon.ico.
+  let icon: string | undefined;
+  if (options.installerIcon) {
+    icon = makeWindowsIcon(resolve(projectDir, options.installerIcon), join(outDir, "_inno.ico"));
+  } else if (existsSync(join(appDir, "icon.ico"))) {
+    icon = join(appDir, "icon.ico");
+  }
+  const license = options.license ? resolve(projectDir, options.license) : undefined;
+  if (license && !existsSync(license)) throw new Error(`inno: license not found: ${license}`);
+
+  const L: string[] = [];
+  L.push("[Setup]");
+  L.push(`AppId={{${bundleId}}`);
+  L.push(`AppName=${v(appName)}`);
+  L.push(`AppVersion=${v(version)}`);
+  // Without this, Inno's display name defaults to "<name> version <x>" (shown in
+  // the wizard title + Add/Remove Programs); pin it to the app name.
+  L.push(`AppVerName=${v(appName)}`);
+  L.push(`AppPublisher=${v(publisher)}`);
+  L.push("WizardStyle=modern");
+  L.push(`DefaultDirName=${installDir}`);
+  L.push(`DefaultGroupName=${v(appName)}`);
+  L.push(`PrivilegesRequired=${perMachine ? "admin" : "lowest"}`);
+  L.push(`OutputDir=${outDir}`);
+  L.push(`OutputBaseFilename=${baseName}`);
+  L.push("Compression=lzma2/max");
+  L.push("SolidCompression=yes");
+  L.push("ArchitecturesAllowed=x64compatible");
+  L.push("ArchitecturesInstallIn64BitMode=x64compatible");
+  L.push(`UninstallDisplayIcon={app}\\${exeName}`);
+  if (icon) L.push(`SetupIconFile=${icon}`);
+  if (license) L.push(`LicenseFile=${license}`);
+  if (minimal) {
+    L.push("DisableWelcomePage=yes");
+    L.push("DisableReadyPage=yes");
+  }
+  if (!changeDir) L.push("DisableDirPage=yes");
+  if (!startMenu) L.push("DisableProgramGroupPage=yes");
+  if (options.include) L.push("", "; --- user include ---", options.include, "");
+
+  L.push("", "[Files]");
+  L.push(`Source: "${appDir}\\*"; DestDir: "{app}"; Flags: ignoreversion recursesubdirs createallsubdirs`);
+
+  if (desktop) {
+    L.push("", "[Tasks]");
+    L.push(`Name: "desktopicon"; Description: "Create a desktop shortcut"; GroupDescription: "Additional:"`);
+  }
+
+  L.push("", "[Icons]");
+  if (startMenu) L.push(`Name: "{group}\\${v(appName)}"; Filename: "{app}\\${exeName}"`);
+  if (desktop) {
+    L.push(`Name: "{autodesktop}\\${v(appName)}"; Filename: "{app}\\${exeName}"; Tasks: desktopicon`);
+  }
+
+  if (runAfter) {
+    L.push("", "[Run]");
+    L.push(
+      `Filename: "{app}\\${exeName}"; Description: "Launch ${v(appName)}"; ` +
+        "Flags: nowait postinstall skipifsilent",
+    );
+  }
+
+  const script = join(outDir, "_installer.iss");
+  writeFileSync(script, L.join("\n") + "\n");
+  console.log(`[mirin release] compiling Inno Setup installer → ${fileName}`);
+  const res = await $`iscc /Q ${script}`.nothrow();
+  rmSync(script, { force: true });
+  rmSync(join(outDir, "_inno.ico"), { force: true });
+  if (res.exitCode !== 0 || !existsSync(out)) {
+    throw new Error(`iscc failed (exit ${res.exitCode})`);
+  }
+  return out;
+}

package/src/installer-win.ts

@@ -0,0 +1,166 @@
+/**
+ * Windows installer (NSIS) for `mirin release` — the Windows analogue of `dmg.ts`.
+ *
+ * Generates an NSIS script from the app folder + config and compiles it with
+ * `makensis` into a single `…-setup.exe`. The installer copies the app into
+ * Program Files (per-machine) or `%LOCALAPPDATA%\Programs` (per-user, the
+ * default — no elevation, and the in-app updater can swap the folder), creates
+ * Start Menu + Desktop shortcuts, writes an uninstaller, and registers an
+ * Add/Remove Programs entry. Customizable via {@link NsisConfig}.
+ *
+ * Requires `makensis` (NSIS 3+) on PATH; the caller checks `hasMakensis()` and
+ * falls back to the portable `.zip` when it's absent.
+ */
+
+import { $ } from "bun";
+import { existsSync, rmSync, writeFileSync } from "node:fs";
+import { join, isAbsolute } from "node:path";
+import type { NsisConfig } from "mirinjs";
+import { makeWindowsIcon } from "./icon-win.ts";
+
+export interface BuildNsisInput {
+  /** The assembled app folder (build/<App>). */
+  appDir: string;
+  appName: string;
+  /** Host exe name inside the folder (<App>.exe). */
+  exeName: string;
+  version: string;
+  /** Reverse-DNS app id → the Add/Remove Programs registry key. */
+  bundleId: string;
+  /** Output directory (build/release). */
+  outDir: string;
+  /** Output file name (e.g. stable-win32-x64-Anko-setup.exe). */
+  fileName: string;
+  options: NsisConfig;
+  /** Project root, for resolving a relative license / installerIcon. */
+  projectDir: string;
+}
+
+/** Whether `makensis` is on PATH. */
+export async function hasMakensis(): Promise<boolean> {
+  return (await $`makensis -VERSION`.quiet().nothrow()).exitCode === 0;
+}
+
+/** NSIS double-quoted string escaping (`"` and `$` are special). */
+function nsis(s: string): string {
+  return s.replace(/\$/g, "$$$$").replace(/"/g, '$\\"');
+}
+
+const resolve = (projectDir: string, p: string) => (isAbsolute(p) ? p : join(projectDir, p));
+
+/** Build the installer with `makensis`, returning the setup.exe path. */
+export async function buildNsisInstaller(input: BuildNsisInput): Promise<string> {
+  const { appDir, appName, exeName, version, bundleId, outDir, fileName, options, projectDir } = input;
+  const out = join(outDir, fileName);
+  rmSync(out, { force: true });
+
+  const perMachine = options.perMachine === true;
+  const assisted = options.oneClick !== true;
+  const desktop = options.desktopShortcut !== false;
+  const startMenu = options.startMenuShortcut !== false;
+  const runAfter = options.runAfterFinish !== false;
+  const changeDir = options.allowChangeInstallDir !== false;
+  const publisher = options.publisher ?? appName;
+  const root = perMachine ? "HKLM" : "HKCU";
+  const installDir =
+    options.installDir ?? (perMachine ? `$PROGRAMFILES64\\${appName}` : `$LOCALAPPDATA\\Programs\\${appName}`);
+
+  // Installer/uninstaller icon: an explicit .ico, else the app's bundled icon.ico.
+  let icon: string | undefined;
+  if (options.installerIcon) {
+    icon = makeWindowsIcon(resolve(projectDir, options.installerIcon), join(outDir, "_installer.ico"));
+  } else if (existsSync(join(appDir, "icon.ico"))) {
+    icon = join(appDir, "icon.ico");
+  }
+
+  const license = options.license ? resolve(projectDir, options.license) : undefined;
+  if (license && !existsSync(license)) throw new Error(`nsis: license not found: ${license}`);
+
+  const L: string[] = [];
+  L.push("Unicode True");
+  L.push("SetCompressor /SOLID lzma");
+  L.push('!include "MUI2.nsh"');
+  L.push('!include "FileFunc.nsh"');
+  L.push(`Name "${nsis(appName)}"`);
+  L.push(`OutFile "${nsis(out)}"`);
+  L.push(`InstallDir "${installDir}"`);
+  L.push(`RequestExecutionLevel ${perMachine ? "admin" : "user"}`);
+  L.push(`!define MUI_ABORTWARNING`);
+  if (icon) {
+    L.push(`!define MUI_ICON "${nsis(icon)}"`);
+    L.push(`!define MUI_UNICON "${nsis(icon)}"`);
+  }
+
+  // Pages. Assisted shows the full wizard; one-click is just the progress page.
+  if (assisted) L.push("!insertmacro MUI_PAGE_WELCOME");
+  if (license) L.push(`!insertmacro MUI_PAGE_LICENSE "${nsis(license)}"`);
+  if (assisted && changeDir) L.push("!insertmacro MUI_PAGE_DIRECTORY");
+  if (assisted && runAfter) {
+    L.push(`!define MUI_FINISHPAGE_RUN "$INSTDIR\\${nsis(exeName)}"`);
+  }
+  L.push("!insertmacro MUI_PAGE_INSTFILES");
+  if (assisted) L.push("!insertmacro MUI_PAGE_FINISH");
+  L.push("!insertmacro MUI_UNPAGE_CONFIRM");
+  L.push("!insertmacro MUI_UNPAGE_INSTFILES");
+  L.push('!insertmacro MUI_LANGUAGE "English"');
+
+  if (options.include) L.push("", "; --- user include ---", options.include, "");
+
+  const key = `Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\${bundleId}`;
+  const ctx = perMachine ? "all" : "current";
+
+  // Install section.
+  L.push("Section");
+  L.push(`  SetShellVarContext ${ctx}`);
+  L.push(`  SetOutPath "$INSTDIR"`);
+  L.push(`  File /r "${nsis(appDir)}\\*"`);
+  L.push(`  WriteUninstaller "$INSTDIR\\Uninstall.exe"`);
+  if (desktop) {
+    L.push(`  CreateShortcut "$DESKTOP\\${nsis(appName)}.lnk" "$INSTDIR\\${nsis(exeName)}"`);
+  }
+  if (startMenu) {
+    L.push(`  CreateDirectory "$SMPROGRAMS\\${nsis(appName)}"`);
+    L.push(
+      `  CreateShortcut "$SMPROGRAMS\\${nsis(appName)}\\${nsis(appName)}.lnk" "$INSTDIR\\${nsis(exeName)}"`,
+    );
+  }
+  // Estimated size for Add/Remove Programs.
+  L.push(`  \${GetSize} "$INSTDIR" "/S=0K" $0 $1 $2`);
+  L.push(`  IntFmt $0 "0x%08X" $0`);
+  const reg = (name: string, val: string) => L.push(`  WriteRegStr ${root} "${key}" "${name}" "${val}"`);
+  reg("DisplayName", nsis(appName));
+  reg("DisplayVersion", nsis(version));
+  reg("Publisher", nsis(publisher));
+  reg("DisplayIcon", `$INSTDIR\\${nsis(exeName)}`);
+  reg("InstallLocation", "$INSTDIR");
+  reg("UninstallString", '$INSTDIR\\Uninstall.exe');
+  reg("QuietUninstallString", '$INSTDIR\\Uninstall.exe /S');
+  L.push(`  WriteRegDWORD ${root} "${key}" "NoModify" 1`);
+  L.push(`  WriteRegDWORD ${root} "${key}" "NoRepair" 1`);
+  L.push(`  WriteRegDWORD ${root} "${key}" "EstimatedSize" $0`);
+  if (!assisted && runAfter) L.push(`  Exec '"$INSTDIR\\${nsis(exeName)}"'`);
+  L.push("SectionEnd");
+
+  // Uninstall section.
+  L.push("Section \"Uninstall\"");
+  L.push(`  SetShellVarContext ${ctx}`);
+  if (desktop) L.push(`  Delete "$DESKTOP\\${nsis(appName)}.lnk"`);
+  if (startMenu) {
+    L.push(`  Delete "$SMPROGRAMS\\${nsis(appName)}\\${nsis(appName)}.lnk"`);
+    L.push(`  RMDir "$SMPROGRAMS\\${nsis(appName)}"`);
+  }
+  L.push(`  RMDir /r "$INSTDIR"`);
+  L.push(`  DeleteRegKey ${root} "${key}"`);
+  L.push("SectionEnd");
+
+  const script = join(outDir, "_installer.nsi");
+  writeFileSync(script, L.join("\n") + "\n");
+  console.log(`[mirin release] compiling NSIS installer → ${fileName}`);
+  const res = await $`makensis -V2 ${script}`.nothrow();
+  rmSync(script, { force: true });
+  rmSync(join(outDir, "_installer.ico"), { force: true });
+  if (res.exitCode !== 0 || !existsSync(out)) {
+    throw new Error(`makensis failed (exit ${res.exitCode})`);
+  }
+  return out;
+}

package/src/release.ts

@@ -22,6 +22,8 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { build } from "./build.ts";
 import { buildDmg, notarizeAndStaple, type DmgOptions } from "./dmg.ts";
+import { buildNsisInstaller, hasMakensis } from "./installer-win.ts";
+import { buildInnoInstaller, hasInno } from "./installer-inno.ts";
 import { loadCodec } from "mirinjs/codec";
 
 const sha256File = (path: string) =>
@@ -129,28 +131,81 @@ export async function release(projectDir = process.cwd()): Promise<number> {
   let installerName: string | undefined;
   let installerSize = 0;
   if (isWindows) {
-    installerName = `${prefix}-${safeName}.zip`;
-    console.log(`[mirin release] zipping installer → ${installerName}`);
-    const zipPath = join(outDir, installerName);
-    rmSync(zipPath, { force: true });
-    // bsdtar (Windows `tar`) creates a .zip from the extension with `-a`.
-    await $`tar -a -cf ${zipPath} -C ${buildDir} ${appArtifact}`;
-    installerSize = readFileSync(zipPath).byteLength;
-  } else if (result.dmg !== false) {
-    installerName = `${prefix}-${safeName}.dmg`;
-    console.log(`[mirin release] building installer → ${installerName}`);
-    const options: DmgOptions = typeof result.dmg === "object" ? result.dmg : {};
-    const dmgPath = await buildDmg({
-      app: result.app,
+    // A real installer (Program Files / per-user install, Start Menu + Desktop
+    // shortcuts, uninstaller, Add/Remove Programs): Inno Setup (modern wizard)
+    // preferred, then NSIS, then a portable .zip if neither toolchain is present.
+    const setupName = `${prefix}-${safeName}-setup.exe`;
+    const installerArgs = {
+      appDir: result.app,
       appName: result.appName,
+      exeName: `${result.appName}.exe`,
+      version: result.version,
+      bundleId: result.bundleId,
       outDir,
-      fileName: installerName,
-      options,
+      fileName: setupName,
       projectDir: result.projectDir,
-      signIdentity: result.signIdentity,
-    });
-    await notarizeAndStaple(dmgPath); // no-op without notary credentials
-    installerSize = readFileSync(dmgPath).byteLength;
+    };
+    const innoWanted = result.inno !== false;
+    const nsisWanted = result.nsis !== false;
+    const innoOpts = typeof result.inno === "object" ? result.inno : {};
+    const nsisOpts = typeof result.nsis === "object" ? result.nsis : {};
+    let exePath: string | undefined;
+    if (innoWanted && hasInno()) {
+      exePath = await buildInnoInstaller({
+        ...installerArgs,
+        options: { ...innoOpts, publisher: innoOpts.publisher ?? result.publisher },
+      });
+    } else if (nsisWanted && (await hasMakensis())) {
+      exePath = await buildNsisInstaller({
+        ...installerArgs,
+        options: { ...nsisOpts, publisher: nsisOpts.publisher ?? result.publisher },
+      });
+    }
+    if (exePath) {
+      installerName = setupName;
+      installerSize = readFileSync(exePath).byteLength;
+    } else {
+      if (innoWanted || nsisWanted) {
+        console.warn(
+          "[mirin release] no installer toolchain found — shipping the portable .zip. " +
+            "Install Inno Setup (`scoop install inno-setup`) or NSIS (`scoop install nsis`).",
+        );
+      }
+      installerName = `${prefix}-${safeName}.zip`;
+      console.log(`[mirin release] zipping → ${installerName}`);
+      const zipPath = join(outDir, installerName);
+      rmSync(zipPath, { force: true });
+      // bsdtar (Windows `tar`) creates a .zip from the extension with `-a`.
+      await $`tar -a -cf ${zipPath} -C ${buildDir} ${appArtifact}`;
+      installerSize = readFileSync(zipPath).byteLength;
+    }
+  } else if (result.dmg !== false) {
+    // The DMG is the first-install convenience; the updater bundle + manifest (the
+    // critical artifacts) are already built. Never fail the whole release over a
+    // flaky installer step — warn loudly and ship the rest.
+    const dmgName = `${prefix}-${safeName}.dmg`;
+    console.log(`[mirin release] building installer → ${dmgName}`);
+    try {
+      const options: DmgOptions = typeof result.dmg === "object" ? result.dmg : {};
+      const dmgPath = await buildDmg({
+        app: result.app,
+        appName: result.appName,
+        outDir,
+        fileName: dmgName,
+        options,
+        projectDir: result.projectDir,
+        signIdentity: result.signIdentity,
+      });
+      await notarizeAndStaple(dmgPath); // no-op without notary credentials
+      installerName = dmgName;
+      installerSize = readFileSync(dmgPath).byteLength;
+    } catch (e) {
+      console.warn(
+        `\n[mirin release] ⚠️  DMG build failed: ${e instanceof Error ? e.message : e}\n` +
+          `[mirin release] shipping the updater bundle + manifest WITHOUT a .dmg installer.\n`,
+      );
+      rmSync(join(outDir, dmgName), { force: true });
+    }
   }
 
   const mb = (n: number) => (n / 1e6).toFixed(1);