@mirinjs/cli 0.1.0-alpha.14 → 0.1.0-alpha.16

package/src/package/linux/lib/defaults.ts

@@ -0,0 +1,53 @@
+import type { LinuxPackageFormat } from "../types.ts";
+
+/** CEF/GTK runtime deps on Debian/Ubuntu package naming (best-effort; overridable). */
+export const DEFAULT_DEB_DEPENDS = [
+  "libgtk-3-0",
+  "libnss3",
+  "libnspr4",
+  "libasound2",
+  "libx11-6",
+  "libxcomposite1",
+  "libxdamage1",
+  "libxext6",
+  "libxfixes3",
+  "libxrandr2",
+  "libgbm1",
+  "libxkbcommon0",
+  "libpango-1.0-0",
+  "libcairo2",
+  "libatk1.0-0",
+  "libatk-bridge2.0-0",
+  "libcups2",
+  "libdrm2",
+  "libdbus-1-3",
+];
+
+/** CEF/GTK runtime deps on RPM (Fedora/RHEL/openSUSE) package naming. */
+export const DEFAULT_RPM_DEPENDS = [
+  "gtk3",
+  "nss",
+  "nspr",
+  "alsa-lib",
+  "libX11",
+  "libXcomposite",
+  "libXdamage",
+  "libXext",
+  "libXfixes",
+  "libXrandr",
+  "mesa-libgbm",
+  "libxkbcommon",
+  "pango",
+  "cairo",
+  "atk",
+  "at-spi2-atk",
+  "cups-libs",
+  "libdrm",
+  "dbus-libs",
+];
+
+export const LINUX_FORMATS = [
+  "appimage",
+  "deb",
+  "rpm",
+] as const satisfies readonly LinuxPackageFormat[];

package/src/package/linux/lib/tools.ts

@@ -0,0 +1,45 @@
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/**
+ * Resolve an external tool path: an explicit `$ENV` override (if it exists), then
+ * PATH, then the first existing `fallback`. Throws a clear, actionable error when
+ * none resolve (no user-specific absolute path is baked into committed code).
+ */
+function resolveTool(bin: string, envVar: string, fallbacks: string[]): string {
+  const fromEnv = process.env[envVar];
+  if (fromEnv && existsSync(fromEnv)) return fromEnv;
+  const onPath = Bun.which(bin);
+  if (onPath) return onPath;
+  for (const f of fallbacks) if (existsSync(f)) return f;
+  throw new Error(
+    `[mirin] "${bin}" not found — install it and put it on PATH, or set $${envVar} ` +
+      "to its absolute path.",
+  );
+}
+
+/** `~/.local/share/gem/ruby/<ver>/bin` (RubyGems user install dir), if resolvable. */
+function gemUserBin(): string | undefined {
+  const ruby = Bun.which("ruby");
+  if (!ruby) return undefined;
+  try {
+    const dir = Bun.spawnSync([ruby, "-e", "print Gem.user_dir"]).stdout.toString().trim();
+    return dir ? join(dir, "bin") : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function resolveFpm(): string {
+  const fallbacks: string[] = [];
+  const gemBin = gemUserBin();
+  if (gemBin) fallbacks.push(join(gemBin, "fpm"));
+  return resolveTool("fpm", "MIRIN_FPM", fallbacks);
+}
+
+export function resolveAppimagetool(): string {
+  return resolveTool("appimagetool", "MIRIN_APPIMAGETOOL", [
+    join(homedir(), ".local", "bin", "appimagetool"),
+  ]);
+}

package/src/package/linux/lib/validation.ts

@@ -0,0 +1,71 @@
+import type { LinuxPackageFormat, LinuxPackageInput } from "../types.ts";
+import { LINUX_FORMATS } from "./defaults.ts";
+
+/** A Debian/RPM-friendly package name: lowercase, alnum + `.-+`, no leading sigil. */
+function shortName(input: string): string {
+  return (
+    input
+      .toLowerCase()
+      .replace(/[^a-z0-9.\-+]/g, "-")
+      .replace(/^[.\-+]+/, "") || "app"
+  );
+}
+
+export function safeLinuxPackageInput(input: LinuxPackageInput): LinuxPackageInput {
+  return {
+    ...input,
+    appName: safeAppBinaryName(input.appName),
+    bundleId: safeLinuxIdentifier(input.bundleId),
+    version: safePackageVersion(input.version),
+  };
+}
+
+function safeLinuxIdentifier(value: string): string {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value) || value === "." || value === "..") {
+    throw new Error(
+      `[mirin] invalid Linux app id "${value}" — use a reverse-DNS style id with letters, ` +
+        'digits, ".", "_" or "-".',
+    );
+  }
+  return value;
+}
+
+function safeAppBinaryName(value: string): string {
+  if (value.length === 0 || value === "." || value === ".." || /[\0\r\n/"\\`$]/.test(value)) {
+    throw new Error(
+      `[mirin] invalid Linux app name "${value}" — it becomes a binary path segment, ` +
+        "so it cannot contain path separators, quotes, shell expansion characters, or newlines.",
+    );
+  }
+  return value;
+}
+
+function safePackageVersion(value: string): string {
+  if (!/^[A-Za-z0-9][A-Za-z0-9.+:~_-]*$/.test(value)) {
+    throw new Error(
+      `[mirin] invalid Linux package version "${value}" — use only letters, digits, ".", "+", ":", "~", "_" or "-".`,
+    );
+  }
+  return value;
+}
+
+export function safePackageName(value: string): string {
+  return shortName(value);
+}
+
+export function validateLinuxFormats(
+  formats: readonly string[],
+  source: string,
+): LinuxPackageFormat[] {
+  const allowed = new Set<string>(LINUX_FORMATS);
+  const out: LinuxPackageFormat[] = [];
+  for (const format of formats) {
+    if (!allowed.has(format)) {
+      throw new Error(
+        `[mirin] invalid Linux package format "${format}" in ${source}; expected appimage, deb, or rpm.`,
+      );
+    }
+    if (!out.includes(format as LinuxPackageFormat)) out.push(format as LinuxPackageFormat);
+  }
+  return out;
+}

package/src/{package-linux.ts → package/linux/package.ts}

@@ -25,136 +25,55 @@
  *     so it works on hosts without FUSE).
  */
 
-import { $ } from "bun";
 import {
+  chmodSync,
   cpSync,
+  existsSync,
   mkdirSync,
   rmSync,
-  writeFileSync,
-  chmodSync,
-  existsSync,
-  symlinkSync,
   statSync,
+  symlinkSync,
+  writeFileSync,
 } from "node:fs";
 import { join } from "node:path";
-import { homedir } from "node:os";
-import { desktopEntry, resolveLinuxDesktopIconPng } from "./bundle-linux.ts";
-import type { LinuxConfig, LinuxPackageFormat } from "mirinjs";
-
-export interface LinuxPackageInput {
-  /** The assembled Linux app folder (build/<App>): the whole relocatable payload. */
-  appDir: string;
-  /** App display name; also the host-binary stem inside `appDir`. */
-  appName: string;
-  /** Reverse-DNS app id, e.g. "dev.netko.anko" (install prefix + `.desktop`/icon name). */
-  bundleId: string;
-  version: string;
-  /** Publisher / company (deb/rpm vendor + maintainer fallback). */
-  publisher: string;
-  /** Directory the artifacts are written into. */
-  outDir: string;
-  projectDir: string;
-  /** Abs path to the app icon source (`.png` / `.iconset`); resolved to a PNG. */
-  icon?: string;
-  /** Resolved Linux config (maintainer, depends, category, …). */
-  options: LinuxConfig;
-  /** Which formats to build. */
-  formats: LinuxPackageFormat[];
-}
-
-export interface LinuxPackageResult {
-  format: LinuxPackageFormat;
-  path: string;
-  size: number;
-}
-
-/** CEF/GTK runtime deps on Debian/Ubuntu package naming (best-effort; overridable). */
-const DEFAULT_DEB_DEPENDS = [
-  "libgtk-3-0", "libnss3", "libnspr4", "libasound2", "libx11-6", "libxcomposite1",
-  "libxdamage1", "libxext6", "libxfixes3", "libxrandr2", "libgbm1", "libxkbcommon0",
-  "libpango-1.0-0", "libcairo2", "libatk1.0-0", "libatk-bridge2.0-0", "libcups2",
-  "libdrm2", "libdbus-1-3",
-];
-
-/** CEF/GTK runtime deps on RPM (Fedora/RHEL/openSUSE) package naming. */
-const DEFAULT_RPM_DEPENDS = [
-  "gtk3", "nss", "nspr", "alsa-lib", "libX11", "libXcomposite", "libXdamage",
-  "libXext", "libXfixes", "libXrandr", "mesa-libgbm", "libxkbcommon", "pango",
-  "cairo", "atk", "at-spi2-atk", "cups-libs", "libdrm", "dbus-libs",
-];
-
-/**
- * Resolve an external tool path: an explicit `$ENV` override (if it exists), then
- * PATH, then the first existing `fallback`. Throws a clear, actionable error when
- * none resolve (no user-specific absolute path is baked into committed code).
- */
-function resolveTool(bin: string, envVar: string, fallbacks: string[]): string {
-  const fromEnv = process.env[envVar];
-  if (fromEnv && existsSync(fromEnv)) return fromEnv;
-  const onPath = Bun.which(bin);
-  if (onPath) return onPath;
-  for (const f of fallbacks) if (existsSync(f)) return f;
-  throw new Error(
-    `[mirin] "${bin}" not found — install it and put it on PATH, or set $${envVar} ` +
-      `to its absolute path.`,
-  );
-}
-
-/** `~/.local/share/gem/ruby/<ver>/bin` (RubyGems user install dir), if resolvable. */
-function gemUserBin(): string | undefined {
-  const ruby = Bun.which("ruby");
-  if (!ruby) return undefined;
-  try {
-    const dir = Bun.spawnSync([ruby, "-e", "print Gem.user_dir"]).stdout.toString().trim();
-    return dir ? join(dir, "bin") : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function resolveFpm(): string {
-  const fallbacks: string[] = [];
-  const gemBin = gemUserBin();
-  if (gemBin) fallbacks.push(join(gemBin, "fpm"));
-  return resolveTool("fpm", "MIRIN_FPM", fallbacks);
-}
-
-function resolveAppimagetool(): string {
-  return resolveTool("appimagetool", "MIRIN_APPIMAGETOOL", [
-    join(homedir(), ".local", "bin", "appimagetool"),
-  ]);
-}
-
-/** A Debian/RPM-friendly package name: lowercase, alnum + `.-+`, no leading sigil. */
-function shortName(input: string): string {
-  return (
-    input.toLowerCase().replace(/[^a-z0-9.\-+]/g, "-").replace(/^[.\-+]+/, "") || "app"
-  );
-}
+import { $ } from "bun";
+import { desktopEntry, resolveLinuxDesktopIconPng } from "../../bundle/linux/index.ts";
+import { DEFAULT_DEB_DEPENDS, DEFAULT_RPM_DEPENDS, LINUX_FORMATS } from "./lib/defaults.ts";
+import { resolveAppimagetool, resolveFpm } from "./lib/tools.ts";
+import { safeLinuxPackageInput, safePackageName, validateLinuxFormats } from "./lib/validation.ts";
+import type {
+  LinuxConfig,
+  LinuxPackageFormat,
+  LinuxPackageInput,
+  LinuxPackageResult,
+} from "./types.ts";
 
 const size = (p: string) => statSync(p).size;
 
 /** Build every requested Linux package; returns each artifact's path + size. */
-export async function buildLinuxPackages(
-  input: LinuxPackageInput,
-): Promise<LinuxPackageResult[]> {
-  mkdirSync(input.outDir, { recursive: true });
-  const binName = input.options.binName ?? shortName(input.bundleId.split(".").pop() ?? input.appName);
-  const results: LinuxPackageResult[] = [];
-
+export async function buildLinuxPackages(input: LinuxPackageInput): Promise<LinuxPackageResult[]> {
+  const safeInput = safeLinuxPackageInput(input);
+  mkdirSync(safeInput.outDir, { recursive: true });
+  const binName = safePackageName(
+    safeInput.options.binName ?? safeInput.bundleId.split(".").pop() ?? safeInput.appName,
+  );
   // deb + rpm share one staged filesystem tree (payload under /opt, launcher,
-  // .desktop, icon). Build it once and reuse.
-  const needFsTree = input.formats.includes("deb") || input.formats.includes("rpm");
+  // .desktop, icon). Build it once and reuse. Package compressors only read the
+  // staged tree, so all requested formats can run concurrently.
+  const needFsTree = safeInput.formats.includes("deb") || safeInput.formats.includes("rpm");
   let fsRoot: string | undefined;
   try {
-    if (needFsTree) fsRoot = stageFsTree(input, binName);
-    if (input.formats.includes("deb")) results.push(await buildFpm(input, binName, fsRoot!, "deb"));
-    if (input.formats.includes("rpm")) results.push(await buildFpm(input, binName, fsRoot!, "rpm"));
-    if (input.formats.includes("appimage")) results.push(await buildAppImage(input, binName));
+    if (needFsTree) fsRoot = stageFsTree(safeInput, binName);
+    return await Promise.all(
+      safeInput.formats.map((format) =>
+        format === "appimage"
+          ? buildAppImage(safeInput, binName)
+          : buildFpm(safeInput, binName, fsRoot!, format),
+      ),
+    );
   } finally {
     if (fsRoot) rmSync(fsRoot, { recursive: true, force: true });
   }
-  return results;
 }
 
 /**
@@ -218,7 +137,7 @@ async function buildFpm(
   kind: "deb" | "rpm",
 ): Promise<LinuxPackageResult> {
   const fpm = resolveFpm();
-  const arch = kind === "deb" ? "amd64" : "x86_64";
+  const arch = linuxPackageArch(kind);
   const fileName =
     kind === "deb"
       ? `${binName}_${input.version}_${arch}.deb`
@@ -228,25 +147,44 @@ async function buildFpm(
 
   const depends =
     kind === "deb"
-      ? input.options.debDepends ?? DEFAULT_DEB_DEPENDS
-      : input.options.rpmDepends ?? DEFAULT_RPM_DEPENDS;
+      ? (input.options.debDepends ?? DEFAULT_DEB_DEPENDS)
+      : (input.options.rpmDepends ?? DEFAULT_RPM_DEPENDS);
 
   const args: string[] = [
-    "-s", "dir",
-    "-t", kind,
-    "-C", fsRoot,
-    "--package", out,
-    "--name", binName,
-    "--version", input.version,
-    "--iteration", "1",
-    "--architecture", arch,
-    "--maintainer", input.options.maintainer ?? input.publisher,
-    "--vendor", input.publisher,
-    "--description", input.options.description ?? input.appName,
+    "-s",
+    "dir",
+    "-t",
+    kind,
+    "-C",
+    fsRoot,
+    "--package",
+    out,
+    "--name",
+    binName,
+    "--version",
+    input.version,
+    "--iteration",
+    "1",
+    "--architecture",
+    arch,
+    "--maintainer",
+    input.options.maintainer ?? input.publisher,
+    "--vendor",
+    input.publisher,
+    "--description",
+    input.options.description ?? input.appName,
   ];
   if (input.options.homepage) args.push("--url", input.options.homepage);
   if (input.options.license) args.push("--license", input.options.license);
   for (const d of depends) args.push("--depends", d);
+  // CEF dominates the payload. Level 3 avoids spending minutes chasing small
+  // gains while retaining gzip compatibility across Debian and RPM families.
+  args.push(
+    kind === "deb" ? "--deb-compression" : "--rpm-compression",
+    kind === "deb" ? "gz" : "gzip",
+    kind === "deb" ? "--deb-compression-level" : "--rpm-compression-level",
+    "3",
+  );
   // Package the whole staged tree ('.' relative to the -C chdir).
   args.push(".");
 
@@ -304,7 +242,8 @@ async function buildAppImage(
     stageHicolorIcon(appDirRoot, input);
   }
 
-  const fileName = `${input.appName}-${input.version}-x86_64.AppImage`;
+  const arch = linuxPackageArch("appimage");
+  const fileName = `${input.appName}-${input.version}-${arch}.AppImage`;
   const out = join(input.outDir, fileName);
   rmSync(out, { force: true });
 
@@ -312,7 +251,7 @@ async function buildAppImage(
   // --appimage-extract-and-run: run appimagetool without FUSE. ARCH is required by
   // appimagetool; NO_STRIP avoids stripping the Bun-compiled host (which would break it).
   const res = await $`${appimagetool} --appimage-extract-and-run ${appDirRoot} ${out}`
-    .env({ ...process.env, ARCH: "x86_64", NO_STRIP: "1" })
+    .env({ ...process.env, ARCH: arch, NO_STRIP: "1" })
     .nothrow()
     .quiet();
   rmSync(appDirRoot, { recursive: true, force: true });
@@ -323,12 +262,32 @@ async function buildAppImage(
   return { format: "appimage", path: out, size: size(out) };
 }
 
+function linuxPackageArch(kind: "appimage" | "deb" | "rpm"): string {
+  if (process.arch === "arm64") {
+    return kind === "deb" ? "arm64" : "aarch64";
+  }
+  return kind === "deb" ? "amd64" : "x86_64";
+}
+
 /** Resolve the effective set of formats from config + an optional CLI/caller override. */
 export function resolveLinuxFormats(
   linux: boolean | LinuxConfig | undefined,
   override?: LinuxPackageFormat[],
 ): LinuxPackageFormat[] {
-  if (override && override.length) return override;
+  if (override && override.length) return validateLinuxFormats(override, "CLI override");
   const fromConfig = typeof linux === "object" ? linux.formats : undefined;
-  return fromConfig && fromConfig.length ? fromConfig : ["appimage", "deb", "rpm"];
+  return fromConfig && fromConfig.length
+    ? validateLinuxFormats(fromConfig, "mirin.config.ts linux.formats")
+    : [...LINUX_FORMATS];
+}
+
+export function parseLinuxFormats(raw: string): LinuxPackageFormat[] {
+  const formats = raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  if (!formats.length) {
+    throw new Error("[mirin] --linux-target needs at least one format: appimage, deb, or rpm.");
+  }
+  return validateLinuxFormats(formats, "--linux-target");
 }

package/src/package/linux/types.ts

@@ -0,0 +1,30 @@
+import type { LinuxConfig, LinuxPackageFormat } from "mirinjs";
+
+export type { LinuxConfig, LinuxPackageFormat };
+
+export interface LinuxPackageInput {
+  /** The assembled Linux app folder (build/<App>): the whole relocatable payload. */
+  appDir: string;
+  /** App display name; also the host-binary stem inside `appDir`. */
+  appName: string;
+  /** Reverse-DNS app id, e.g. "dev.netko.anko" (install prefix + `.desktop`/icon name). */
+  bundleId: string;
+  version: string;
+  /** Publisher / company (deb/rpm vendor + maintainer fallback). */
+  publisher: string;
+  /** Directory the artifacts are written into. */
+  outDir: string;
+  projectDir: string;
+  /** Abs path to the app icon source (`.png` / `.iconset`); resolved to a PNG. */
+  icon?: string;
+  /** Resolved Linux config (maintainer, depends, category, ...). */
+  options: LinuxConfig;
+  /** Which formats to build. */
+  formats: LinuxPackageFormat[];
+}
+
+export interface LinuxPackageResult {
+  format: LinuxPackageFormat;
+  path: string;
+  size: number;
+}

package/src/release/installers.ts

@@ -0,0 +1,148 @@
+import { rmSync, statSync } from "node:fs";
+import { basename, join } from "node:path";
+import { $ } from "bun";
+import type { BuildResult } from "../build.ts";
+import { buildDmg, type DmgOptions, notarizeAndStaple } from "../dmg.ts";
+import { buildInnoInstaller, hasInno } from "../installer-inno.ts";
+import { buildNsisInstaller, hasMakensis } from "../installer-win.ts";
+import { buildLinuxPackages, resolveLinuxFormats } from "../package/linux/index.ts";
+
+export interface ReleaseInstallerResult {
+  installerName?: string;
+  installerSize: number;
+}
+
+export interface ReleaseInstallerInput {
+  result: BuildResult;
+  buildDir: string;
+  outDir: string;
+  appArtifact: string;
+  prefix: string;
+  safeName: string;
+  isWindows: boolean;
+  isLinux: boolean;
+}
+
+/** Build first-install artifacts independently from updater compression and deltas. */
+export async function buildReleaseInstaller(
+  input: ReleaseInstallerInput,
+): Promise<ReleaseInstallerResult> {
+  const { result, isWindows, isLinux } = input;
+  if (isWindows) return buildWindowsInstaller(input);
+  if (isLinux) return buildLinuxInstallers(input);
+  if (result.dmg !== false) return buildMacInstaller(input);
+  return { installerSize: 0 };
+}
+
+async function buildWindowsInstaller(
+  input: ReleaseInstallerInput,
+): Promise<ReleaseInstallerResult> {
+  const { result, buildDir, outDir, appArtifact, prefix, safeName } = input;
+  const setupName = `${prefix}-${safeName}-setup.exe`;
+  const installerArgs = {
+    appDir: result.app,
+    appName: result.appName,
+    exeName: `${result.appName}.exe`,
+    version: result.version,
+    bundleId: result.bundleId,
+    outDir,
+    fileName: setupName,
+    projectDir: result.projectDir,
+  };
+  const innoWanted = result.inno !== false;
+  const nsisWanted = result.nsis !== false;
+  const innoOpts = typeof result.inno === "object" ? result.inno : {};
+  const nsisOpts = typeof result.nsis === "object" ? result.nsis : {};
+  let exePath: string | undefined;
+
+  if (innoWanted && hasInno()) {
+    exePath = await buildInnoInstaller({
+      ...installerArgs,
+      options: { ...innoOpts, publisher: innoOpts.publisher ?? result.publisher },
+    });
+  } else if (nsisWanted && (await hasMakensis())) {
+    exePath = await buildNsisInstaller({
+      ...installerArgs,
+      options: { ...nsisOpts, publisher: nsisOpts.publisher ?? result.publisher },
+    });
+  }
+
+  if (exePath) return { installerName: setupName, installerSize: statSync(exePath).size };
+  if (innoWanted || nsisWanted) {
+    console.warn(
+      "[mirin release] no installer toolchain found — shipping the portable .zip. " +
+        "Install Inno Setup (`scoop install inno-setup`) or NSIS (`scoop install nsis`).",
+    );
+  }
+
+  const installerName = `${prefix}-${safeName}.zip`;
+  const zipPath = join(outDir, installerName);
+  console.log(`[mirin release] zipping → ${installerName}`);
+  rmSync(zipPath, { force: true });
+  await $`tar -a -cf ${zipPath} -C ${buildDir} ${appArtifact}`;
+  return { installerName, installerSize: statSync(zipPath).size };
+}
+
+async function buildLinuxInstallers(input: ReleaseInstallerInput): Promise<ReleaseInstallerResult> {
+  const { result, outDir } = input;
+  if (result.linux === false) return { installerSize: 0 };
+
+  try {
+    const formats = resolveLinuxFormats(result.linux);
+    console.log(`[mirin release] building Linux packages (${formats.join(", ")})…`);
+    const packages = await buildLinuxPackages({
+      appDir: result.app,
+      appName: result.appName,
+      bundleId: result.bundleId,
+      version: result.version,
+      publisher: result.publisher,
+      outDir,
+      projectDir: result.projectDir,
+      icon: result.icon,
+      options: typeof result.linux === "object" ? result.linux : {},
+      formats,
+    });
+    const primary = packages.find((artifact) => artifact.format === "appimage") ?? packages[0];
+    for (const artifact of packages) {
+      if (artifact !== primary) {
+        console.log(`  ${basename(artifact.path)} (${(artifact.size / 1e6).toFixed(1)} MB)`);
+      }
+    }
+    return primary
+      ? { installerName: basename(primary.path), installerSize: primary.size }
+      : { installerSize: 0 };
+  } catch (error) {
+    console.warn(
+      `\n[mirin release] Linux packaging failed: ${error instanceof Error ? error.message : error}\n` +
+        "[mirin release] shipping the updater bundle + manifest WITHOUT packages.\n",
+    );
+    return { installerSize: 0 };
+  }
+}
+
+async function buildMacInstaller(input: ReleaseInstallerInput): Promise<ReleaseInstallerResult> {
+  const { result, outDir, prefix, safeName } = input;
+  const installerName = `${prefix}-${safeName}.dmg`;
+  console.log(`[mirin release] building installer → ${installerName}`);
+  try {
+    const options: DmgOptions = typeof result.dmg === "object" ? result.dmg : {};
+    const path = await buildDmg({
+      app: result.app,
+      appName: result.appName,
+      outDir,
+      fileName: installerName,
+      options,
+      projectDir: result.projectDir,
+      signIdentity: result.signIdentity,
+    });
+    await notarizeAndStaple(path);
+    return { installerName, installerSize: statSync(path).size };
+  } catch (error) {
+    console.warn(
+      `\n[mirin release] DMG build failed: ${error instanceof Error ? error.message : error}\n` +
+        "[mirin release] shipping the updater bundle + manifest WITHOUT a .dmg installer.\n",
+    );
+    rmSync(join(outDir, installerName), { force: true });
+    return { installerSize: 0 };
+  }
+}