@mirinjs/cli 0.1.0-alpha.14 → 0.1.0-alpha.16

package/src/bundle/shared/cef-locales.ts

@@ -0,0 +1,91 @@
+import { cpSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+
+const CEF_LOCALE = /^[A-Za-z]{2,3}(?:[-_][A-Za-z0-9]{2,8})*$/;
+const MAC_VARIANTS = new Set(["FEMININE", "MASCULINE", "NEUTER"]);
+
+/** Validate and normalize an optional CEF locale allowlist. */
+export function normalizeCefLocales(locales: unknown): string[] | undefined {
+  if (locales == null) return undefined;
+  if (!Array.isArray(locales) || locales.length === 0) {
+    throw new Error("[mirin] cef.locales must contain at least one locale.");
+  }
+
+  const seen = new Set<string>();
+  const normalized: string[] = [];
+  for (const value of locales) {
+    if (typeof value !== "string" || !CEF_LOCALE.test(value)) {
+      throw new Error(`[mirin] invalid CEF locale ${JSON.stringify(value)}.`);
+    }
+    const locale = value.replaceAll("_", "-");
+    const key = locale.toLowerCase();
+    if (!seen.has(key)) {
+      seen.add(key);
+      normalized.push(locale);
+    }
+  }
+  return normalized;
+}
+
+/** Copy selected Windows/Linux `locales/<locale>.pak` files, or every locale when unset. */
+export function copyFlatCefLocales(
+  source: string,
+  destination: string,
+  locales: string[] | undefined,
+): void {
+  if (!locales) {
+    cpSync(source, destination, { recursive: true });
+    return;
+  }
+
+  const entries = readdirSync(source, { withFileTypes: true }).filter(
+    (entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".pak"),
+  );
+  const byLocale = new Map(
+    entries.map((entry) => [localeKey(entry.name.slice(0, -".pak".length)), entry.name]),
+  );
+
+  mkdirSync(destination, { recursive: true });
+  for (const locale of locales) {
+    const file = byLocale.get(localeKey(locale));
+    if (!file) throw new Error(`[mirin] CEF locale "${locale}" is not available in ${source}.`);
+    cpSync(join(source, file), join(destination, file));
+  }
+}
+
+/** Remove unselected macOS `.lproj` locale directories from a copied CEF framework. */
+export function pruneMacCefLocales(framework: string, locales: string[] | undefined): void {
+  if (!locales) return;
+
+  const resources = join(framework, "Resources");
+  const localeDirs = readdirSync(resources, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory() && entry.name.endsWith(".lproj"))
+    .map((entry) => entry.name);
+  const available = new Set(localeDirs.map((name) => name.slice(0, -".lproj".length)));
+  const keep = new Set<string>();
+
+  for (const locale of locales) {
+    const requested = locale.replaceAll("-", "_");
+    const language = requested.split("_", 1)[0] ?? requested;
+    const root = available.has(requested)
+      ? requested
+      : available.has(language)
+        ? language
+        : undefined;
+    if (!root) throw new Error(`[mirin] CEF locale "${locale}" is not available in ${resources}.`);
+
+    keep.add(`${root}.lproj`);
+    for (const variant of MAC_VARIANTS) {
+      const name = `${root}_${variant}.lproj`;
+      if (localeDirs.includes(name)) keep.add(name);
+    }
+  }
+
+  for (const directory of localeDirs) {
+    if (!keep.has(directory)) rmSync(join(resources, directory), { recursive: true, force: true });
+  }
+}
+
+function localeKey(locale: string): string {
+  return locale.replaceAll("_", "-").toLowerCase();
+}

package/src/{bundle-win.ts → bundle/windows/app.ts}

@@ -15,9 +15,10 @@
  * what mirin-core derives at runtime (engine::derive_subprocess_path, host.ts).
  */
 
-import { cpSync, mkdirSync, rmSync, writeFileSync, existsSync, readdirSync } from "node:fs";
-import { join, extname } from "node:path";
-import { makeWindowsIcon } from "./icon-win.ts";
+import { cpSync, existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { extname, join } from "node:path";
+import { makeWindowsIcon } from "../../icons/windows/index.ts";
+import { copyFlatCefLocales } from "../shared/cef-locales.ts";
 
 /** Source dir (vendor/cef on Windows) must contain libcef.dll. */
 const CEF_MARKER = "libcef.dll";
@@ -26,7 +27,7 @@ const CEF_MARKER = "libcef.dll";
  *  distribution (libcef.lib, include/, cmake/, archive.json, bootstrap*.exe) is
  *  build-time only and intentionally left out. */
 const CEF_RUNTIME_EXTS = new Set([".dll", ".bin", ".pak", ".dat"]);
-const CEF_RUNTIME_EXTRAS = ["vk_swiftshader_icd.json", "locales"];
+const CEF_RUNTIME_EXTRAS = ["vk_swiftshader_icd.json"];
 
 export interface WinBundleOptions {
   appName: string; // also the host exe stem → <appName>.exe
@@ -35,6 +36,8 @@ export interface WinBundleOptions {
   coreDll: string; // mirin_core.dll
   helperExe: string; // mirin-helper.exe
   cefPath: string; // dir containing the Windows CEF runtime (vendor/cef)
+  /** Production CEF locale allowlist. Undefined keeps every locale. */
+  cefLocales?: string[];
   /** App icon source (.ico / .iconset / .png) → <App>/icon.ico, set as the window icon. */
   icon?: string;
   /** Production-only resources placed under <App>/resources. */
@@ -66,7 +69,7 @@ export async function buildWindowsBundle(
   cpSync(opts.coreDll, join(app, "mirin_core.dll"));
   cpSync(opts.helperExe, join(app, "mirin-helper.exe"));
 
-  copyCefRuntime(cefPath, app);
+  copyCefRuntime(cefPath, app, opts.cefLocales);
 
   // App icon → <App>/icon.ico, loaded at runtime by the core and set as the window
   // icon (taskbar / Alt-Tab / title). Sits beside the exe so the core finds it.
@@ -105,7 +108,7 @@ export async function buildWindowsBundle(
 }
 
 /** Copy the CEF runtime (dlls, paks, snapshot, icu data, locales) into `dest`. */
-function copyCefRuntime(cefPath: string, dest: string): void {
+function copyCefRuntime(cefPath: string, dest: string, locales: string[] | undefined): void {
   for (const entry of readdirSync(cefPath)) {
     if (CEF_RUNTIME_EXTS.has(extname(entry).toLowerCase())) {
       cpSync(join(cefPath, entry), join(dest, entry));
@@ -115,4 +118,5 @@ function copyCefRuntime(cefPath: string, dest: string): void {
     const src = join(cefPath, extra);
     if (existsSync(src)) cpSync(src, join(dest, extra), { recursive: true });
   }
+  copyFlatCefLocales(join(cefPath, "locales"), join(dest, "locales"), locales);
 }

package/src/bundle/windows/index.ts

@@ -0,0 +1 @@
+export * from "./app.ts";

package/src/dev.ts

@@ -8,25 +8,26 @@
  * 5. launch the app pointed at the Vite URL, with RPC injected into the webview
  */
 
-import { $ } from "bun";
-import { mkdirSync, rmSync, symlinkSync, existsSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { createServer } from "node:net";
+import { homedir } from "node:os";
 import { join } from "node:path";
-import { buildAppBundle } from "./bundle.ts";
-import { buildWindowsBundle } from "./bundle-win.ts";
+import { $ } from "bun";
+import { resolveArtifacts } from "./artifacts.ts";
 import {
   buildLinuxBundle,
-  resolveLinuxIconPng,
-  resolveLinuxDesktopIconPng,
   desktopEntry,
-} from "./bundle-linux.ts";
-import { homedir } from "node:os";
-import { resolveArtifacts } from "./artifacts.ts";
+  resolveLinuxDesktopIconPng,
+  resolveLinuxIconPng,
+} from "./bundle/linux/index.ts";
+import { buildAppBundle } from "./bundle/macos/index.ts";
+import { buildWindowsBundle } from "./bundle/windows/index.ts";
 
 const IS_WINDOWS = process.platform === "win32";
 const IS_LINUX = process.platform === "linux";
+
+import { compileWorkers, normalizeSidecars } from "./extras.ts";
 import { sweepBuildTemps } from "./temps.ts";
-import { normalizeSidecars, compileWorkers } from "./extras.ts";
 
 /** Vite's default port. `mirin dev` probes upward from here for a free one, so a
  *  second dev session (or anything already on 5173) doesn't collide. */
@@ -87,26 +88,26 @@ export async function dev(projectDir = process.cwd()): Promise<number> {
         icon: iconSrc,
       })
     : IS_LINUX
-    ? await buildLinuxBundle({
-        appName,
-        outDir: work,
-        hostExe,
-        coreDll: artifacts.coreDylib,
-        helperExe: artifacts.helperBin,
-        cefPath: artifacts.cefPath,
-        icon: iconSrc,
-      })
-    : await buildAppBundle({
-        appName,
-        bundleId,
-        outDir: work,
-        hostExe,
-        coreDylib: artifacts.coreDylib,
-        helperBin: artifacts.helperBin,
-        cefPath: artifacts.cefPath,
-        icon: iconSrc,
-        urlSchemes: config.urlSchemes,
-      });
+      ? await buildLinuxBundle({
+          appName,
+          outDir: work,
+          hostExe,
+          coreDll: artifacts.coreDylib,
+          helperExe: artifacts.helperBin,
+          cefPath: artifacts.cefPath,
+          icon: iconSrc,
+        })
+      : await buildAppBundle({
+          appName,
+          bundleId,
+          outDir: work,
+          hostExe,
+          coreDylib: artifacts.coreDylib,
+          helperBin: artifacts.helperBin,
+          cefPath: artifacts.cefPath,
+          icon: iconSrc,
+          urlSchemes: config.urlSchemes,
+        });
 
   // Linux: install a dev `.desktop` entry so cosmic's dock can resolve the app's
   // icon. cosmic matches a running X11 window's `WM_CLASS` (which the core sets to
@@ -138,7 +139,17 @@ export async function dev(projectDir = process.cwd()): Promise<number> {
   const devUrl = `http://127.0.0.1:${port}`;
   console.log(`[mirin dev] starting Vite dev server on ${devUrl}…`);
   const vite = Bun.spawn(
-    ["bunx", "vite", "--clearScreen", "false", "--host", "127.0.0.1", "--port", String(port), "--strictPort"],
+    [
+      "bunx",
+      "vite",
+      "--clearScreen",
+      "false",
+      "--host",
+      "127.0.0.1",
+      "--port",
+      String(port),
+      "--strictPort",
+    ],
     {
       cwd: projectDir,
       stdio: ["ignore", "inherit", "inherit"],
@@ -155,13 +166,17 @@ export async function dev(projectDir = process.cwd()): Promise<number> {
       MIRIN_CORE: IS_WINDOWS
         ? join(app, "mirin_core.dll")
         : IS_LINUX
-        ? join(app, "libmirin_core.so")
-        : join(app, "Contents", "MacOS", "libmirin_core.dylib"),
+          ? join(app, "libmirin_core.so")
+          : join(app, "Contents", "MacOS", "libmirin_core.dylib"),
       // Linux: the flat app dir holds libcef.so + libmirin_core.so; put it on the
       // loader path so the host's dlopen and libmirin_core's NEEDED libcef.so (and
       // the spawned mirin-helper) all resolve. (macOS uses the framework loader;
       // Windows the exe-dir search — neither needs this.)
-      ...(IS_LINUX ? { LD_LIBRARY_PATH: `${app}${process.env.LD_LIBRARY_PATH ? ":" + process.env.LD_LIBRARY_PATH : ""}` } : {}),
+      ...(IS_LINUX
+        ? {
+            LD_LIBRARY_PATH: `${app}${process.env.LD_LIBRARY_PATH ? ":" + process.env.LD_LIBRARY_PATH : ""}`,
+          }
+        : {}),
       MIRIN_WORKER: workerJs,
       MIRIN_DEV_URL: devUrl,
       MIRIN_MANIFEST_JSON: JSON.stringify({ id: bundleId, windows: config.windows }),

package/src/dmg.ts

@@ -15,10 +15,10 @@
  * stapled so a fresh download opens without a Gatekeeper prompt.
  */
 
-import { $ } from "bun";
-import { cpSync, mkdirSync, rmSync, symlinkSync, existsSync } from "node:fs";
-import { join, basename, isAbsolute } from "node:path";
+import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
+import { basename, isAbsolute, join } from "node:path";
+import { $ } from "bun";
 
 export interface DmgOptions {
   volumeName?: string;
@@ -148,12 +148,20 @@ export async function buildDmg(input: BuildDmgInput): Promise<string> {
     let built = false;
     if (wantsLayout(options)) {
       try {
-        await buildLaidOutDmg({ staging, vol, format, dmgPath, options, projectDir, appFile: basename(app) });
+        await buildLaidOutDmg({
+          staging,
+          vol,
+          format,
+          dmgPath,
+          options,
+          projectDir,
+          appFile: basename(app),
+        });
         built = true;
       } catch (e) {
         console.warn(
           `[mirin release] DMG layout failed (${e instanceof Error ? e.message : e}); ` +
-            `falling back to a plain DMG.`,
+            "falling back to a plain DMG.",
         );
         rmSync(dmgPath, { force: true });
       }
@@ -190,9 +198,14 @@ async function buildLaidOutDmg(args: {
   const { staging, vol, format, dmgPath, options, projectDir, appFile } = args;
   const win = options.windowSize ?? { width: 640, height: 400 };
   const iconSize = options.iconSize ?? 128;
-  const appPos = options.appPosition ?? { x: Math.round(win.width * 0.25), y: Math.round(win.height * 0.5) };
-  const appsPos =
-    options.applicationsPosition ?? { x: Math.round(win.width * 0.75), y: Math.round(win.height * 0.5) };
+  const appPos = options.appPosition ?? {
+    x: Math.round(win.width * 0.25),
+    y: Math.round(win.height * 0.5),
+  };
+  const appsPos = options.applicationsPosition ?? {
+    x: Math.round(win.width * 0.75),
+    y: Math.round(win.height * 0.5),
+  };
 
   // Stage a background image (if any) under a hidden folder Finder can reference.
   let bgFile: string | undefined;
@@ -214,8 +227,7 @@ async function buildLaidOutDmg(args: {
   await $`hdiutil create -volname ${vol} -srcfolder ${staging} -fs HFS+ -format UDRW -ov ${rw}`.quiet();
 
   // Attach without auto-opening a Finder window; parse the real mountpoint.
-  const attach =
-    await $`hdiutil attach ${rw} -readwrite -noverify -noautoopen`.text();
+  const attach = await $`hdiutil attach ${rw} -readwrite -noverify -noautoopen`.text();
   const mount = attach
     .split("\n")
     .map((l) => l.trim())

package/src/extras.ts

@@ -5,10 +5,11 @@
  * place so the two CLI paths stay in sync.
  */
 
+import { mkdirSync } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { $ } from "bun";
-import { join } from "node:path";
 
-/** Config shapes (mirrors packages/mirin/src/config.ts; CLI can't import the runtime). */
+/** Config shapes (mirrors packages/mirin/src/config/index.ts; CLI can't import the runtime). */
 export type SidecarConfig = Record<string, string | { bin: string; entitlements?: string[] }>;
 export type WorkersConfig = Record<string, string>;
 
@@ -21,16 +22,47 @@ export interface NormalizedSidecar {
   entitlements: string[];
 }
 
+const SAFE_EXTRA_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+/**
+ * Extra asset names become bundle filenames, so keep them as path segments. This
+ * prevents config keys such as "../tool" from escaping resources/sidecars or
+ * resources/workers in dev and production bundles.
+ */
+export function safeExtraAssetName(name: string, label: string): string {
+  if (!SAFE_EXTRA_NAME.test(name) || name === "." || name === "..") {
+    throw new Error(
+      `[mirin] invalid ${label} "${name}" — use letters, digits, ".", "_" or "-", ` +
+        "and do not include path separators.",
+    );
+  }
+  return name;
+}
+
+function projectRelativePath(projectDir: string, file: string, label: string): string {
+  if (isAbsolute(file)) {
+    throw new Error(`[mirin] ${label} must be relative to the project root: ${file}`);
+  }
+  const root = resolve(projectDir);
+  const full = resolve(root, file);
+  const rel = relative(root, full);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    throw new Error(`[mirin] ${label} escapes the project root: ${file}`);
+  }
+  return full;
+}
+
 /** Resolve `config.sidecars` to absolute source paths. */
 export function normalizeSidecars(
   projectDir: string,
   sidecars: SidecarConfig | undefined,
 ): NormalizedSidecar[] {
   return Object.entries(sidecars ?? {}).map(([name, value]) => {
+    const safeName = safeExtraAssetName(name, "sidecar name");
     const spec = typeof value === "string" ? { bin: value } : value;
     return {
-      name,
-      src: join(projectDir, spec.bin),
+      name: safeName,
+      src: projectRelativePath(projectDir, spec.bin, `sidecar "${safeName}" path`),
       entitlements: spec.entitlements ?? [],
     };
   });
@@ -46,16 +78,21 @@ export async function compileWorkers(
   outDir: string,
   minify: boolean,
 ): Promise<Record<string, string>> {
+  mkdirSync(outDir, { recursive: true });
   const out: Record<string, string> = {};
-  for (const [name, entry] of Object.entries(workers ?? {})) {
-    const js = join(outDir, `${name}.js`);
-    const src = join(projectDir, entry);
+  const compiled = Object.entries(workers ?? {}).map(async ([name, entry]) => {
+    const safeName = safeExtraAssetName(name, "worker name");
+    const js = join(outDir, `${safeName}.js`);
+    const src = projectRelativePath(projectDir, entry, `worker "${safeName}" entry`);
     if (minify) {
       await $`bun build ${src} --target=bun --minify --outfile ${js}`.cwd(projectDir);
     } else {
       await $`bun build ${src} --target=bun --outfile ${js}`.cwd(projectDir);
     }
-    out[name] = js;
+    return { name: safeName, js };
+  });
+  for (const worker of await Promise.all(compiled)) {
+    out[worker.name] = worker.js;
   }
   return out;
 }

package/src/{icon-win.ts → icons/windows/icon.ts}

@@ -8,8 +8,8 @@
  */
 
 import { copyFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
-import { inflateSync } from "node:zlib";
 import { join } from "node:path";
+import { inflateSync } from "node:zlib";
 
 /** Standard Windows icon sizes; intermediate sizes are downscaled from these by
  *  the shell, so the 256 entry keeps large views crisp. */
@@ -57,7 +57,8 @@ function decodePng(buf: Buffer): { width: number; height: number; rgba: Buffer }
   if (bitDepth !== 8 || interlace !== 0) {
     throw new Error(`unsupported PNG (depth ${bitDepth}, interlace ${interlace})`);
   }
-  const channels = colorType === 6 ? 4 : colorType === 2 ? 3 : colorType === 4 ? 2 : colorType === 0 ? 1 : 0;
+  const channels =
+    colorType === 6 ? 4 : colorType === 2 ? 3 : colorType === 4 ? 2 : colorType === 0 ? 1 : 0;
   if (!channels) throw new Error(`unsupported color type ${colorType}`);
 
   const raw = inflateSync(Buffer.concat(idat));
@@ -239,7 +240,9 @@ export function makeWindowsIcon(
         entries.push({ size: width, data: dibEntry(width, rgba), png: false });
       }
     } catch (e) {
-      console.warn(`[mirin] icon: cannot decode ${iconSrc} (${e instanceof Error ? e.message : e})`);
+      console.warn(
+        `[mirin] icon: cannot decode ${iconSrc} (${e instanceof Error ? e.message : e})`,
+      );
     }
   }
 

package/src/icons/windows/index.ts

@@ -0,0 +1 @@
+export * from "./icon.ts";

package/src/index.ts

@@ -4,14 +4,17 @@
  */
 
 import { resolve } from "node:path";
-import { dev } from "./dev.ts";
+import { scaffold } from "create-mirinjs";
 import { build } from "./build.ts";
+import { dev } from "./dev.ts";
+import { parseLinuxFormats } from "./package/linux/index.ts";
 import { release } from "./release.ts";
-import { scaffold } from "create-mirinjs";
-import type { LinuxPackageFormat } from "mirinjs";
 
 /** Minimal flag parser: `--k=v`, `--k v`, and boolean `--k`; the rest are positionals. */
-function parseArgs(argv: string[]): { positionals: string[]; opts: Record<string, string | boolean> } {
+function parseArgs(argv: string[]): {
+  positionals: string[];
+  opts: Record<string, string | boolean>;
+} {
   const opts: Record<string, string | boolean> = {};
   const positionals: string[] = [];
   for (let i = 0; i < argv.length; i++) {
@@ -65,9 +68,7 @@ switch (command) {
   case "build": {
     const version = typeof opts.version === "string" ? opts.version : undefined;
     const target = typeof opts["linux-target"] === "string" ? opts["linux-target"] : undefined;
-    const linuxFormats = target
-      ? (target.split(",").map((s) => s.trim()).filter(Boolean) as LinuxPackageFormat[])
-      : undefined;
+    const linuxFormats = target ? parseLinuxFormats(target) : undefined;
     const packageLinux = opts.linux === true || linuxFormats != null;
     await build(process.cwd(), { version, packageLinux, linuxFormats });
     process.exit(0);

package/src/installer-inno.ts

@@ -10,11 +10,11 @@
  * back to NSIS / the portable `.zip` when it's absent.
  */
 
-import { $ } from "bun";
 import { existsSync, rmSync, writeFileSync } from "node:fs";
-import { join, isAbsolute } from "node:path";
+import { isAbsolute, join } from "node:path";
+import { $ } from "bun";
 import type { InnoConfig } from "mirinjs";
-import { makeWindowsIcon } from "./icon-win.ts";
+import { makeWindowsIcon } from "./icons/windows/index.ts";
 
 export interface BuildInnoInput {
   appDir: string; // the assembled app folder (build/<App>)
@@ -39,7 +39,8 @@ const v = (s: string) => s.replace(/\{/g, "{{");
 
 /** Build the installer with `iscc`, returning the setup.exe path. */
 export async function buildInnoInstaller(input: BuildInnoInput): Promise<string> {
-  const { appDir, appName, exeName, version, bundleId, outDir, fileName, options, projectDir } = input;
+  const { appDir, appName, exeName, version, bundleId, outDir, fileName, options, projectDir } =
+    input;
   const out = join(outDir, fileName);
   rmSync(out, { force: true });
   if (!fileName.endsWith(".exe")) throw new Error("inno: fileName must end with .exe");
@@ -53,7 +54,8 @@ export async function buildInnoInstaller(input: BuildInnoInput): Promise<string>
   const changeDir = options.allowChangeInstallDir !== false && !minimal;
   const publisher = options.publisher ?? appName;
   const installDir =
-    options.installDir ?? (perMachine ? "{autopf}\\" + appName : "{localappdata}\\Programs\\" + appName);
+    options.installDir ??
+    (perMachine ? "{autopf}\\" + appName : "{localappdata}\\Programs\\" + appName);
 
   // Setup icon: an explicit .ico, else the app's bundled icon.ico.
   let icon: string | undefined;
@@ -80,7 +82,10 @@ export async function buildInnoInstaller(input: BuildInnoInput): Promise<string>
   L.push(`PrivilegesRequired=${perMachine ? "admin" : "lowest"}`);
   L.push(`OutputDir=${outDir}`);
   L.push(`OutputBaseFilename=${baseName}`);
-  L.push("Compression=lzma2/max");
+  // CEF is the bulk of the installer. Normal compression plus two independent
+  // LZMA2 blocks is substantially faster on CI with a modest size tradeoff.
+  L.push("Compression=lzma2/normal");
+  L.push("LZMANumBlockThreads=2");
   L.push("SolidCompression=yes");
   L.push("ArchitecturesAllowed=x64compatible");
   L.push("ArchitecturesInstallIn64BitMode=x64compatible");
@@ -96,17 +101,23 @@ export async function buildInnoInstaller(input: BuildInnoInput): Promise<string>
   if (options.include) L.push("", "; --- user include ---", options.include, "");
 
   L.push("", "[Files]");
-  L.push(`Source: "${appDir}\\*"; DestDir: "{app}"; Flags: ignoreversion recursesubdirs createallsubdirs`);
+  L.push(
+    `Source: "${appDir}\\*"; DestDir: "{app}"; Flags: ignoreversion recursesubdirs createallsubdirs`,
+  );
 
   if (desktop) {
     L.push("", "[Tasks]");
-    L.push(`Name: "desktopicon"; Description: "Create a desktop shortcut"; GroupDescription: "Additional:"`);
+    L.push(
+      `Name: "desktopicon"; Description: "Create a desktop shortcut"; GroupDescription: "Additional:"`,
+    );
   }
 
   L.push("", "[Icons]");
   if (startMenu) L.push(`Name: "{group}\\${v(appName)}"; Filename: "{app}\\${exeName}"`);
   if (desktop) {
-    L.push(`Name: "{autodesktop}\\${v(appName)}"; Filename: "{app}\\${exeName}"; Tasks: desktopicon`);
+    L.push(
+      `Name: "{autodesktop}\\${v(appName)}"; Filename: "{app}\\${exeName}"; Tasks: desktopicon`,
+    );
   }
 
   if (runAfter) {

package/src/installer-win.ts

@@ -12,11 +12,11 @@
  * falls back to the portable `.zip` when it's absent.
  */
 
-import { $ } from "bun";
 import { existsSync, rmSync, writeFileSync } from "node:fs";
-import { join, isAbsolute } from "node:path";
+import { isAbsolute, join } from "node:path";
+import { $ } from "bun";
 import type { NsisConfig } from "mirinjs";
-import { makeWindowsIcon } from "./icon-win.ts";
+import { makeWindowsIcon } from "./icons/windows/index.ts";
 
 export interface BuildNsisInput {
   /** The assembled app folder (build/<App>). */
@@ -50,7 +50,8 @@ const resolve = (projectDir: string, p: string) => (isAbsolute(p) ? p : join(pro
 
 /** Build the installer with `makensis`, returning the setup.exe path. */
 export async function buildNsisInstaller(input: BuildNsisInput): Promise<string> {
-  const { appDir, appName, exeName, version, bundleId, outDir, fileName, options, projectDir } = input;
+  const { appDir, appName, exeName, version, bundleId, outDir, fileName, options, projectDir } =
+    input;
   const out = join(outDir, fileName);
   rmSync(out, { force: true });
 
@@ -63,12 +64,16 @@ export async function buildNsisInstaller(input: BuildNsisInput): Promise<string>
   const publisher = options.publisher ?? appName;
   const root = perMachine ? "HKLM" : "HKCU";
   const installDir =
-    options.installDir ?? (perMachine ? `$PROGRAMFILES64\\${appName}` : `$LOCALAPPDATA\\Programs\\${appName}`);
+    options.installDir ??
+    (perMachine ? `$PROGRAMFILES64\\${appName}` : `$LOCALAPPDATA\\Programs\\${appName}`);
 
   // Installer/uninstaller icon: an explicit .ico, else the app's bundled icon.ico.
   let icon: string | undefined;
   if (options.installerIcon) {
-    icon = makeWindowsIcon(resolve(projectDir, options.installerIcon), join(outDir, "_installer.ico"));
+    icon = makeWindowsIcon(
+      resolve(projectDir, options.installerIcon),
+      join(outDir, "_installer.ico"),
+    );
   } else if (existsSync(join(appDir, "icon.ico"))) {
     icon = join(appDir, "icon.ico");
   }
@@ -85,7 +90,7 @@ export async function buildNsisInstaller(input: BuildNsisInput): Promise<string>
   L.push(`OutFile "${nsis(out)}"`);
   L.push(`InstallDir "${installDir}"`);
   L.push(`RequestExecutionLevel ${perMachine ? "admin" : "user"}`);
-  L.push(`!define MUI_ABORTWARNING`);
+  L.push("!define MUI_ABORTWARNING");
   if (icon) {
     L.push(`!define MUI_ICON "${nsis(icon)}"`);
     L.push(`!define MUI_UNICON "${nsis(icon)}"`);
@@ -127,14 +132,15 @@ export async function buildNsisInstaller(input: BuildNsisInput): Promise<string>
   // Estimated size for Add/Remove Programs.
   L.push(`  \${GetSize} "$INSTDIR" "/S=0K" $0 $1 $2`);
   L.push(`  IntFmt $0 "0x%08X" $0`);
-  const reg = (name: string, val: string) => L.push(`  WriteRegStr ${root} "${key}" "${name}" "${val}"`);
+  const reg = (name: string, val: string) =>
+    L.push(`  WriteRegStr ${root} "${key}" "${name}" "${val}"`);
   reg("DisplayName", nsis(appName));
   reg("DisplayVersion", nsis(version));
   reg("Publisher", nsis(publisher));
   reg("DisplayIcon", `$INSTDIR\\${nsis(exeName)}`);
   reg("InstallLocation", "$INSTDIR");
-  reg("UninstallString", '$INSTDIR\\Uninstall.exe');
-  reg("QuietUninstallString", '$INSTDIR\\Uninstall.exe /S');
+  reg("UninstallString", "$INSTDIR\\Uninstall.exe");
+  reg("QuietUninstallString", "$INSTDIR\\Uninstall.exe /S");
   L.push(`  WriteRegDWORD ${root} "${key}" "NoModify" 1`);
   L.push(`  WriteRegDWORD ${root} "${key}" "NoRepair" 1`);
   L.push(`  WriteRegDWORD ${root} "${key}" "EstimatedSize" $0`);
@@ -142,7 +148,7 @@ export async function buildNsisInstaller(input: BuildNsisInput): Promise<string>
   L.push("SectionEnd");
 
   // Uninstall section.
-  L.push("Section \"Uninstall\"");
+  L.push('Section "Uninstall"');
   L.push(`  SetShellVarContext ${ctx}`);
   if (desktop) L.push(`  Delete "$DESKTOP\\${nsis(appName)}.lnk"`);
   if (startMenu) {

package/src/package/linux/index.ts

@@ -0,0 +1,2 @@
+export * from "./package.ts";
+export * from "./types.ts";