@mirinjs/cli 0.1.0-alpha.14 → 0.1.0-alpha.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mirinjs/cli",
-  "version": "0.1.0-alpha.14",
+  "version": "0.1.0-alpha.16",
   "description": "CLI for mirin apps: dev, build, init.",
   "type": "module",
   "license": "MIT",
@@ -27,13 +27,15 @@
     "bun": ">=1.2.0"
   },
   "dependencies": {
-    "create-mirinjs": "0.1.0-alpha.14",
-    "mirinjs": "0.1.0-alpha.14"
+    "create-mirinjs": "0.1.0-alpha.16",
+    "mirinjs": "0.1.0-alpha.16"
   },
   "optionalDependencies": {
-    "@mirinjs/darwin-arm64": "0.1.0-alpha.14",
-    "@mirinjs/win32-x64": "0.1.0-alpha.14",
-    "@mirinjs/linux-x64": "0.1.0-alpha.14"
+    "@mirinjs/darwin-arm64": "0.1.0-alpha.16",
+    "@mirinjs/win32-x64": "0.1.0-alpha.16",
+    "@mirinjs/win32-arm64": "0.1.0-alpha.16",
+    "@mirinjs/linux-arm64": "0.1.0-alpha.16",
+    "@mirinjs/linux-x64": "0.1.0-alpha.16"
   },
   "publishConfig": {
     "access": "public"

package/src/artifacts.ts

@@ -9,13 +9,22 @@
  *    entry from the `mirin` package, and a CEF framework downloaded once from
  *    the matching GitHub Release into `~/.mirinjs/cef/<version>`. No Rust needed.
  *
- * Alpha supports macOS arm64 only.
+ * Alpha supports macOS arm64, Windows x64/arm64, and Linux x64/arm64.
  */
 
-import { $ } from "bun";
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  readlinkSync,
+  renameSync,
+  rmSync,
+} from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { $ } from "bun";
 
 const REPO_SLUG = "Netko-Labs/mirin";
 
@@ -80,11 +89,11 @@ function helperFileName(): string {
 function assertSupportedPlatform(): void {
   const supported =
     (process.platform === "darwin" && process.arch === "arm64") ||
-    (process.platform === "win32" && process.arch === "x64") ||
-    (process.platform === "linux" && process.arch === "x64");
+    (process.platform === "win32" && (process.arch === "x64" || process.arch === "arm64")) ||
+    (process.platform === "linux" && (process.arch === "x64" || process.arch === "arm64"));
   if (!supported) {
     throw new Error(
-      `mirin alpha supports macOS arm64, Windows x64, and Linux x64 ` +
+      "mirin alpha supports macOS arm64, Windows x64/arm64, and Linux x64/arm64 " +
         `(got ${process.platform}/${process.arch}).`,
     );
   }
@@ -101,7 +110,7 @@ function resolveNativeDir(): string {
   } catch {
     throw new Error(
       `mirin: prebuilt native package "${pkg}" is not installed. Run \`bun install\` ` +
-        `(it is an optional dependency of @mirinjs/cli for your platform).`,
+        "(it is an optional dependency of @mirinjs/cli for your platform).",
     );
   }
 }
@@ -136,10 +145,11 @@ async function ensureCef(): Promise<string> {
   }
 
   const version = cliVersion();
-  const cacheDir = join(homedir(), ".mirinjs", "cef", `${version}-${platformTag()}`);
+  const cacheRoot = join(homedir(), ".mirinjs", "cef");
+  const cacheDir = join(cacheRoot, `${version}-${platformTag()}`);
   if (existsSync(join(cacheDir, cefMarker()))) return cacheDir;
 
-  mkdirSync(cacheDir, { recursive: true });
+  mkdirSync(cacheRoot, { recursive: true });
   const asset = `cef-${platformTag()}.tar.gz`;
   const url = `https://github.com/${REPO_SLUG}/releases/download/v${version}/${asset}`;
   console.log(`[mirin] downloading CEF for ${platformTag()} (one-time, ~hundreds of MB)…`);
@@ -147,14 +157,113 @@ async function ensureCef(): Promise<string> {
   // Download with curl, not `Bun.write(file, await fetch(url))`: the latter
   // pins a core at 100% CPU and never completes on large gzip responses
   // (the streaming write path). curl is fast and ubiquitous.
-  const archive = join(tmpdir(), asset);
+  const downloadDir = mkdtempSync(join(tmpdir(), "mirin-cef-download-"));
+  const stagingDir = mkdtempSync(join(cacheRoot, ".staging-"));
+  const archive = join(downloadDir, asset);
+  const checksum = `${archive}.sha256`;
+  const checksumUrl = `${url}.sha256`;
+  const httpsOnly = "=https";
   try {
-    await $`curl -fSL --retry 3 -o ${archive} ${url}`;
-    await $`tar -xzf ${archive} -C ${cacheDir}`;
+    await $`curl --fail --show-error --location --retry 3 --proto ${httpsOnly} --proto-redir ${httpsOnly} -o ${checksum} ${checksumUrl}`;
+    await $`curl --fail --show-error --location --retry 3 --proto ${httpsOnly} --proto-redir ${httpsOnly} -o ${archive} ${url}`;
+    await verifyFileSha256(archive, readFileSync(checksum, "utf8"));
+    const listing = await $`tar -tzf ${archive}`.quiet().text();
+    validateArchiveEntries(listing);
+    await $`tar -xzf ${archive} -C ${stagingDir}`;
+    validateExtractedSymlinks(stagingDir);
+    if (!existsSync(join(stagingDir, cefMarker()))) {
+      throw new Error(`CEF archive is missing ${cefMarker()}`);
+    }
+
+    // Another process may have populated the cache while this one downloaded.
+    if (existsSync(join(cacheDir, cefMarker()))) return cacheDir;
+    rmSync(cacheDir, { recursive: true, force: true });
+    renameSync(stagingDir, cacheDir);
   } catch (err) {
-    rmSync(archive, { force: true });
     throw new Error(`mirin: failed to download CEF from ${url} (${err}).`);
+  } finally {
+    rmSync(downloadDir, { recursive: true, force: true });
+    rmSync(stagingDir, { recursive: true, force: true });
   }
-  rmSync(archive, { force: true });
   return cacheDir;
 }
+
+/** Reject absolute paths and parent traversal before a downloaded tar is extracted. */
+export function validateArchiveEntries(listing: string): void {
+  for (const rawEntry of listing.split(/\r?\n/)) {
+    if (rawEntry.length === 0) continue;
+    const entry = archivePath(rawEntry);
+    if (entry == null) throw new Error(`unsafe CEF archive entry: ${rawEntry}`);
+  }
+}
+
+/** Verify a downloaded release asset before parsing or extracting it. */
+export async function verifyFileSha256(path: string, checksum: string): Promise<void> {
+  const expected = checksum.trim().toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(expected)) {
+    throw new Error("invalid CEF SHA-256 checksum");
+  }
+
+  const hasher = new Bun.CryptoHasher("sha256");
+  for await (const chunk of Bun.file(path).stream()) {
+    hasher.update(chunk);
+  }
+  const actual = hasher.digest("hex");
+  if (actual !== expected) {
+    throw new Error(`CEF SHA-256 mismatch (expected ${expected}, got ${actual})`);
+  }
+}
+
+/** Reject extracted symlinks whose lexical target escapes the staging directory. */
+export function validateExtractedSymlinks(root: string): void {
+  const absoluteRoot = resolve(root);
+  const pending = [absoluteRoot];
+
+  while (pending.length > 0) {
+    const directory = pending.pop();
+    if (!directory) continue;
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      const path = join(directory, entry.name);
+      if (entry.isSymbolicLink()) {
+        const target = readlinkSync(path);
+        const resolvedTarget = resolve(dirname(path), target);
+        const fromRoot = relative(absoluteRoot, resolvedTarget);
+        if (
+          isAbsolute(target) ||
+          fromRoot === ".." ||
+          fromRoot.startsWith(`..${sep}`) ||
+          isAbsolute(fromRoot)
+        ) {
+          throw new Error(`CEF archive symlink escapes its cache: ${path} -> ${target}`);
+        }
+      } else if (entry.isDirectory()) {
+        pending.push(path);
+      }
+    }
+  }
+}
+
+function archivePath(raw: string): string | null {
+  let path = raw.replaceAll("\\", "/");
+  while (path.startsWith("./")) path = path.slice(2);
+  if (path.length === 0 || path === ".") return "";
+  if (path.startsWith("/") || /^[A-Za-z]:/.test(path) || hasControlCharacter(path)) {
+    return null;
+  }
+
+  const parts: string[] = [];
+  for (const part of path.split("/")) {
+    if (part.length === 0 || part === ".") continue;
+    if (part === "..") return null;
+    parts.push(part);
+  }
+  return parts.length > 0 ? parts.join("/") : "";
+}
+
+function hasControlCharacter(value: string): boolean {
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code <= 0x1f || code === 0x7f) return true;
+  }
+  return false;
+}

package/src/build.ts

@@ -1,11 +1,9 @@
 /**
  * `mirin build` — package a standalone, signed .app (docs/macos-mvp.md).
  *
- * 1. vite build               → production UI in dist/
- * 2. resolve native artifacts → core + helper (in-repo build or prebuilt)
- * 3. compile host (minified)  → Contents/MacOS/<exe>
- * 4. bundle Worker (minified) → Resources/worker.js
- * 5. assemble + sign the .app → dist/ui, manifest, dylib, helpers, CEF
+ * 1. vite build + native artifact resolution run in parallel.
+ * 2. compile host + bundle Workers run in parallel.
+ * 3. assemble + sign the app from the completed artifacts.
  *
  * The result runs with no env and no dev server: the host resolves everything
  * from inside the bundle, and webviews load their `app://` URLs served from
@@ -15,17 +13,18 @@
  * ID to produce a distributable, notarizable app.
  */
 
-import { $ } from "bun";
-import { mkdirSync, rmSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { buildAppBundle } from "./bundle.ts";
-import { buildWindowsBundle } from "./bundle-win.ts";
-import { buildLinuxBundle } from "./bundle-linux.ts";
-import { buildLinuxPackages, resolveLinuxFormats } from "./package-linux.ts";
-import { makeWindowsIcon } from "./icon-win.ts";
+import { $ } from "bun";
 import { resolveArtifacts } from "./artifacts.ts";
+import { buildLinuxBundle } from "./bundle/linux/index.ts";
+import { buildAppBundle } from "./bundle/macos/index.ts";
+import { normalizeCefLocales } from "./bundle/shared/cef-locales.ts";
+import { buildWindowsBundle } from "./bundle/windows/index.ts";
+import { compileWorkers, normalizeSidecars } from "./extras.ts";
+import { makeWindowsIcon } from "./icons/windows/index.ts";
+import { buildLinuxPackages, resolveLinuxFormats } from "./package/linux/index.ts";
 import { sweepBuildTemps } from "./temps.ts";
-import { normalizeSidecars, compileWorkers } from "./extras.ts";
 
 const IS_WINDOWS = process.platform === "win32";
 const IS_LINUX = process.platform === "linux";
@@ -91,11 +90,19 @@ async function brandWindowsExe(
   }
   const fv = winFileVersion(opts.version);
   args.push(
-    "--set-version-string", "ProductName", opts.appName,
-    "--set-version-string", "FileDescription", opts.appName,
-    "--set-version-string", "CompanyName", opts.publisher,
-    "--set-file-version", fv,
-    "--set-product-version", fv,
+    "--set-version-string",
+    "ProductName",
+    opts.appName,
+    "--set-version-string",
+    "FileDescription",
+    opts.appName,
+    "--set-version-string",
+    "CompanyName",
+    opts.publisher,
+    "--set-file-version",
+    fv,
+    "--set-product-version",
+    fv,
   );
   const res = await $`rcedit ${exe} ${args}`.nothrow();
   if (res.exitCode !== 0) {
@@ -114,6 +121,8 @@ export interface BuildResult {
   channel: string;
   /** Update baseUrl, if `release` is configured. */
   baseUrl?: string;
+  /** Markdown release notes embedded in the updater manifest, if configured. */
+  releaseNotes?: string;
   /** libmirin_core path (for the updater codec at release time). */
   coreDylib: string;
   /** Project root (so `mirin release` can resolve relative asset paths). */
@@ -176,43 +185,50 @@ export async function build(
   const version = opts.version ?? appVersion(projectDir);
   const channel: string = config.release?.channel ?? "stable";
   const baseUrl: string | undefined = config.release?.baseUrl;
+  const releaseNotes: string | undefined = config.release?.notes;
   const dmg: boolean | import("mirinjs").DmgConfig = config.dmg ?? true;
   const nsis: boolean | import("mirinjs").NsisConfig = config.nsis ?? true;
   const inno: boolean | import("mirinjs").InnoConfig = config.inno ?? true;
   const linux: boolean | import("mirinjs").LinuxConfig = config.linux ?? true;
   const publisher: string = config.publisher ?? appName;
+  const cefLocales = normalizeCefLocales(config.cef?.locales);
 
   console.log(`[mirin build] ${appName} ${version}`);
 
-  // 1. production UI
-  console.log("[mirin build] vite build…");
-  await $`bunx vite build`.cwd(projectDir);
-
-  // 2. native artifacts (release)
-  const artifacts = await resolveArtifacts({ release: true });
+  // Production UI and native artifacts do not share outputs, so overlap them.
+  console.log("[mirin build] building UI + native artifacts…");
+  const [, artifacts] = await Promise.all([
+    $`bunx vite build`.cwd(projectDir),
+    resolveArtifacts({ release: true }),
+  ]);
 
-  // 3 + 4. host + worker (minified)
-  console.log("[mirin build] compiling host + bundling main process…");
+  // Host compilation, main Worker bundling, and extra Worker bundling are independent.
+  console.log("[mirin build] compiling host + bundling workers…");
   const signIdentity = process.env.MIRIN_SIGN_IDENTITY;
   const hostExe = join(work, IS_WINDOWS ? "host-release.exe" : "host-release");
   const workerJs = join(work, "worker.release.js");
-  await $`bun build --compile --minify ${artifacts.hostEntry} --outfile ${hostExe}`.cwd(projectDir);
-  if (IS_WINDOWS) {
-    patchPeToGuiSubsystem(hostExe);
-    await brandWindowsExe(hostExe, {
-      projectDir,
-      work,
-      appName,
-      version,
-      icon: config.icon,
-      publisher,
-    });
-  }
-  await $`bun build ${mainEntry} --target=bun --minify --outfile ${workerJs}`.cwd(projectDir);
-
-  // Extra assets: resolve sidecar binaries + compile any extra worker entries.
   const sidecars = normalizeSidecars(projectDir, config.sidecars);
-  const extraWorkers = await compileWorkers(projectDir, config.workers, join(work, "workers"), true);
+  const hostBuild = (async (): Promise<void> => {
+    await $`bun build --compile --minify ${artifacts.hostEntry} --outfile ${hostExe}`.cwd(
+      projectDir,
+    );
+    if (IS_WINDOWS) {
+      patchPeToGuiSubsystem(hostExe);
+      await brandWindowsExe(hostExe, {
+        projectDir,
+        work,
+        appName,
+        version,
+        icon: config.icon,
+        publisher,
+      });
+    }
+  })();
+  const workerBuild = $`bun build ${mainEntry} --target=bun --minify --outfile ${workerJs}`.cwd(
+    projectDir,
+  );
+  const extraWorkersBuild = compileWorkers(projectDir, config.workers, join(work, "workers"), true);
+  const [, , extraWorkers] = await Promise.all([hostBuild, workerBuild, extraWorkersBuild]);
 
   // 5. assemble (+ sign on macOS)
   const artifactKind = IS_WINDOWS ? "app folder" : IS_LINUX ? "app folder" : ".app";
@@ -241,34 +257,40 @@ export async function build(
         coreDll: artifacts.coreDylib,
         helperExe: artifacts.helperBin,
         cefPath: artifacts.cefPath,
+        cefLocales,
         icon: config.icon ? join(projectDir, config.icon) : undefined,
         resources: { ...resources, sidecars: sidecars.map((s) => ({ name: s.name, src: s.src })) },
       })
     : IS_LINUX
-    ? await buildLinuxBundle({
-        appName,
-        outDir,
-        hostExe,
-        coreDll: artifacts.coreDylib,
-        helperExe: artifacts.helperBin,
-        cefPath: artifacts.cefPath,
-        icon: config.icon ? join(projectDir, config.icon) : undefined,
-        resources: { ...resources, sidecars: sidecars.map((s) => ({ name: s.name, src: s.src })) },
-      })
-    : await buildAppBundle({
-        appName,
-        bundleId,
-        outDir,
-        hostExe,
-        coreDylib: artifacts.coreDylib,
-        helperBin: artifacts.helperBin,
-        cefPath: artifacts.cefPath,
-        version,
-        icon: config.icon ? join(projectDir, config.icon) : undefined,
-        signIdentity,
-        urlSchemes: config.urlSchemes,
-        resources: { ...resources, sidecars },
-      });
+      ? await buildLinuxBundle({
+          appName,
+          outDir,
+          hostExe,
+          coreDll: artifacts.coreDylib,
+          helperExe: artifacts.helperBin,
+          cefPath: artifacts.cefPath,
+          cefLocales,
+          icon: config.icon ? join(projectDir, config.icon) : undefined,
+          resources: {
+            ...resources,
+            sidecars: sidecars.map((s) => ({ name: s.name, src: s.src })),
+          },
+        })
+      : await buildAppBundle({
+          appName,
+          bundleId,
+          outDir,
+          hostExe,
+          coreDylib: artifacts.coreDylib,
+          helperBin: artifacts.helperBin,
+          cefPath: artifacts.cefPath,
+          cefLocales,
+          version,
+          icon: config.icon ? join(projectDir, config.icon) : undefined,
+          signIdentity,
+          urlSchemes: config.urlSchemes,
+          resources: { ...resources, sidecars },
+        });
 
   console.log(`\n[mirin build] done → ${app}`);
 
@@ -301,6 +323,7 @@ export async function build(
     version,
     channel,
     baseUrl,
+    releaseNotes,
     coreDylib: artifacts.coreDylib,
     projectDir,
     dmg,

package/src/{bundle-linux.ts → bundle/linux/app.ts}

@@ -18,8 +18,18 @@
  * LD_LIBRARY_PATH set on the host (dev.ts) or an rpath at build time.
  */
 
-import { cpSync, mkdirSync, rmSync, writeFileSync, existsSync, readdirSync, chmodSync, statSync } from "node:fs";
-import { join, extname, basename } from "node:path";
+import {
+  chmodSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, extname, join } from "node:path";
+import { copyFlatCefLocales } from "../shared/cef-locales.ts";
 
 /** Source dir (vendor/cef on Linux) must contain libcef.so. */
 const CEF_MARKER = "libcef.so";
@@ -29,7 +39,7 @@ const CEF_MARKER = "libcef.so";
  *  build-time only and intentionally left out. `.so` covers libcef/libEGL/
  *  libGLESv2/libvk_swiftshader; the extras list catches the non-extension names. */
 const CEF_RUNTIME_EXTS = new Set([".so", ".bin", ".pak", ".dat"]);
-const CEF_RUNTIME_EXTRAS = ["locales", "vk_swiftshader_icd.json", "libvulkan.so.1", "chrome-sandbox"];
+const CEF_RUNTIME_EXTRAS = ["vk_swiftshader_icd.json", "libvulkan.so.1", "chrome-sandbox"];
 
 export interface LinuxBundleOptions {
   appName: string; // also the host binary stem → <appName>
@@ -38,6 +48,8 @@ export interface LinuxBundleOptions {
   coreDll: string; // libmirin_core.so
   helperExe: string; // mirin-helper
   cefPath: string; // dir containing the Linux CEF runtime (vendor/cef)
+  /** Production CEF locale allowlist. Undefined keeps every locale. */
+  cefLocales?: string[];
   /** App icon source (.png / .iconset); resolved to a PNG at resources/icon.png for
    *  the window's `_NET_WM_ICON` (taskbar/dock). */
   icon?: string;
@@ -70,13 +82,13 @@ export function resolveLinuxIconPng(icon: string): string | undefined {
     // a 256×256 icon (≈ 256 KB) can exceed it and get dropped. Fall back to the
     // largest available under that ceiling (by pixels parsed from the iconset name).
     const preferred = ["icon_128x128.png", "icon_64x64.png", "icon_256x256.png"];
-    const MAX_SIDE = 128;
+    const MaxSide = 128;
     const pick =
       preferred.find((p) => pngs.includes(p)) ??
       pngs
         .slice()
         .sort((a, b) => iconsetPixels(b) - iconsetPixels(a))
-        .find((p) => iconsetPixels(p) <= MAX_SIDE * MAX_SIDE) ??
+        .find((p) => iconsetPixels(p) <= MaxSide * MaxSide) ??
       pngs.sort((a, b) => iconsetPixels(a) - iconsetPixels(b))[0];
     return pick ? join(icon, pick) : undefined;
   }
@@ -119,21 +131,49 @@ export function desktopEntry(opts: {
   /** Optional Comment= (tooltip / description) line. */
   comment?: string;
 }): string {
-  const lines = ["[Desktop Entry]", "Type=Application", `Name=${opts.name}`];
-  if (opts.comment) lines.push(`Comment=${opts.comment}`);
+  const lines = ["[Desktop Entry]", "Type=Application", `Name=${desktopValue("Name", opts.name)}`];
+  if (opts.comment) lines.push(`Comment=${desktopValue("Comment", opts.comment)}`);
   lines.push(
-    `Exec=${opts.exec}`,
-    `Icon=${opts.iconPng}`,
-    `StartupWMClass=${opts.wmClass}`,
+    `Exec=${desktopExec(opts.exec)}`,
+    `Icon=${desktopValue("Icon", opts.iconPng)}`,
+    `StartupWMClass=${desktopValue("StartupWMClass", opts.wmClass)}`,
     "Terminal=false",
   );
   if (opts.categories) {
-    lines.push(`Categories=${opts.categories.endsWith(";") ? opts.categories : `${opts.categories};`}`);
+    lines.push(`Categories=${desktopCategories(opts.categories)}`);
   }
   lines.push("");
   return lines.join("\n");
 }
 
+function desktopValue(field: string, value: string): string {
+  assertDesktopScalar(field, value);
+  return value.replace(/\\/g, "\\\\").replace(/\t/g, "\\t");
+}
+
+function desktopExec(value: string): string {
+  assertDesktopScalar("Exec", value);
+  if (/^[A-Za-z0-9._/+:-]+$/.test(value)) return value;
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+
+function desktopCategories(value: string): string {
+  const normalized = value.endsWith(";") ? value : `${value};`;
+  assertDesktopScalar("Categories", normalized);
+  if (!/^[A-Za-z0-9][A-Za-z0-9-]*(;[A-Za-z0-9][A-Za-z0-9-]*)*;$/.test(normalized)) {
+    throw new Error(
+      `[mirin] invalid Linux desktop category "${value}" — use freedesktop category names separated by semicolons.`,
+    );
+  }
+  return normalized;
+}
+
+function assertDesktopScalar(field: string, value: string): void {
+  if (value.length === 0 || /[\0\r\n]/.test(value)) {
+    throw new Error(`[mirin] invalid Linux desktop ${field} value.`);
+  }
+}
+
 /** Effective pixel count encoded in an iconset filename (`icon_256x256@2x.png` → 512²). */
 function iconsetPixels(name: string): number {
   const m = basename(name).match(/(\d+)x(\d+)(@(\d+)x)?/);
@@ -163,7 +203,7 @@ export async function buildLinuxBundle(
   cpSync(opts.helperExe, helper);
   chmodSync(helper, 0o755);
 
-  copyCefRuntime(cefPath, app);
+  copyCefRuntime(cefPath, app, opts.cefLocales);
 
   // The window taskbar/dock icon (`_NET_WM_ICON`) is set by the core from a PNG at
   // `resources/icon.png`; host.ts points the init config's `icon_path` there in prod.
@@ -210,7 +250,7 @@ export async function buildLinuxBundle(
 }
 
 /** Copy the CEF runtime (shared libs, paks, snapshot, icu data, locales) into `dest`. */
-function copyCefRuntime(cefPath: string, dest: string): void {
+function copyCefRuntime(cefPath: string, dest: string, locales: string[] | undefined): void {
   for (const entry of readdirSync(cefPath)) {
     if (CEF_RUNTIME_EXTS.has(extname(entry).toLowerCase())) {
       cpSync(join(cefPath, entry), join(dest, entry));
@@ -220,6 +260,7 @@ function copyCefRuntime(cefPath: string, dest: string): void {
     const src = join(cefPath, extra);
     if (existsSync(src)) cpSync(src, join(dest, extra), { recursive: true });
   }
+  copyFlatCefLocales(join(cefPath, "locales"), join(dest, "locales"), locales);
   // chrome-sandbox works setuid-root (mode 4755) or, on kernels with unprivileged
   // user namespaces, via the namespace sandbox with no special perms. We can't
   // setuid without root here; leave it executable and let CEF pick the userns path.

package/src/bundle/linux/index.ts

@@ -0,0 +1 @@
+export * from "./app.ts";

package/src/{bundle.ts → bundle/macos/app.ts}

@@ -11,9 +11,18 @@
  * "<exe> Helper (Renderer).app/Contents/MacOS/<exe> Helper (Renderer)".
  */
 
-import { $ } from "bun";
-import { cpSync, mkdirSync, rmSync, writeFileSync, existsSync, readdirSync, chmodSync } from "node:fs";
+import {
+  chmodSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { join } from "node:path";
+import { $ } from "bun";
+import { pruneMacCefLocales } from "../shared/cef-locales.ts";
 
 const FRAMEWORK = "Chromium Embedded Framework.framework";
 
@@ -33,6 +42,8 @@ export interface BundleOptions {
   coreDylib: string; // libmirin_core.dylib
   helperBin: string; // compiled mirin-helper binary
   cefPath: string; // dir containing the CEF framework (vendor/cef)
+  /** Production CEF locale allowlist. Undefined keeps every locale. */
+  cefLocales?: string[];
   /** App version → Info.plist CFBundleShortVersionString/CFBundleVersion. */
   version?: string;
   /** App icon source: a .icns, a .iconset dir, or a square .png. Optional. */
@@ -201,17 +212,17 @@ export async function buildAppBundle(opts: BundleOptions): Promise<{ app: string
   // Deep-link schemes: register this app as the macOS handler for app://-style
   // URLs (e.g. anko://…). Delivered at runtime via app.on("open-url").
   if (opts.urlSchemes?.length) {
-    info.CFBundleURLTypes = [
-      { CFBundleURLName: bundleId, CFBundleURLSchemes: opts.urlSchemes },
-    ];
+    info.CFBundleURLTypes = [{ CFBundleURLName: bundleId, CFBundleURLSchemes: opts.urlSchemes }];
   }
 
   writeFileSync(join(contents, "Info.plist"), plist(info));
 
-  cpSync(join(cefPath, FRAMEWORK), join(frameworks, FRAMEWORK), {
+  const bundledFramework = join(frameworks, FRAMEWORK);
+  cpSync(join(cefPath, FRAMEWORK), bundledFramework, {
     recursive: true,
     verbatimSymlinks: true,
   });
+  pruneMacCefLocales(bundledFramework, opts.cefLocales);
 
   // Production resources: the served UI, the Worker bundle, and the manifest.
   const resources = join(contents, "Resources");

package/src/bundle/macos/index.ts

@@ -0,0 +1 @@
+export * from "./app.ts";