@mirinjs/cli 0.1.0-alpha.2 → 0.1.0-alpha.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mirinjs/cli",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.20",
   "description": "CLI for mirin apps: dev, build, init.",
   "type": "module",
   "license": "MIT",
@@ -27,12 +27,15 @@
     "bun": ">=1.2.0"
   },
   "dependencies": {
-    "create-mirinjs": "0.1.0-alpha.2",
-    "mirinjs": "0.1.0-alpha.2"
+    "create-mirinjs": "0.1.0-alpha.20",
+    "mirinjs": "0.1.0-alpha.20"
   },
   "optionalDependencies": {
-    "@mirinjs/darwin-arm64": "0.1.0-alpha.2",
-    "@mirinjs/win32-x64": "0.1.0-alpha.2"
+    "@mirinjs/darwin-arm64": "0.1.0-alpha.20",
+    "@mirinjs/win32-x64": "0.1.0-alpha.20",
+    "@mirinjs/win32-arm64": "0.1.0-alpha.20",
+    "@mirinjs/linux-arm64": "0.1.0-alpha.20",
+    "@mirinjs/linux-x64": "0.1.0-alpha.20"
   },
   "publishConfig": {
     "access": "public"

package/src/artifacts.ts

@@ -9,13 +9,23 @@
  *    entry from the `mirin` package, and a CEF framework downloaded once from
  *    the matching GitHub Release into `~/.mirinjs/cef/<version>`. No Rust needed.
  *
- * Alpha supports macOS arm64 only.
+ * Alpha supports macOS arm64, Windows x64/arm64, and Linux x64/arm64.
  */
 
-import { $ } from "bun";
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  readlinkSync,
+  renameSync,
+  rmSync,
+} from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { $ } from "bun";
+import { createReporter, type Reporter } from "./shared/report.ts";
 
 const REPO_SLUG = "Netko-Labs/mirin";
 
@@ -26,6 +36,8 @@ const IN_REPO = existsSync(join(REPO_ROOT, "crates", "mirin-core"));
 export interface Artifacts {
   /** libmirin_core.dylib — dlopened by the host. */
   coreDylib: string;
+  /** Standalone updater codec used by `mirin release`. */
+  codecBin: string;
   /** mirin-helper — the CEF subprocess binary. */
   helperBin: string;
   /** host entry (TS/JS) compiled with `bun build --compile`. */
@@ -38,18 +50,33 @@ export function isInRepo(): boolean {
   return IN_REPO;
 }
 
-export async function resolveArtifacts(opts: { release: boolean }): Promise<Artifacts> {
+/** The in-repo CEF distribution. `present` checks the framework marker, not just
+ *  the directory: an interrupted `fetch-cef.ts` leaves an empty one behind. */
+export function vendoredCef(): { path: string; present: boolean } {
+  const path = join(REPO_ROOT, "vendor", "cef");
+  return { path, present: existsSync(join(path, cefMarker())) };
+}
+
+export async function resolveArtifacts(opts: {
+  release: boolean;
+  /** Where build chatter goes. Defaults to human mode, which prints it. */
+  reporter?: Reporter;
+}): Promise<Artifacts> {
   assertSupportedPlatform();
-  const cefPath = await ensureCef();
+  const reporter = opts.reporter ?? createReporter(false);
+  const cefPath = await ensureCef(reporter);
 
   if (IN_REPO) {
     const profile = opts.release ? "release" : "debug";
-    console.log(`[mirin] building native core + helper (${profile})…`);
+    reporter.info(`[mirin] building native core + helpers (${profile})…`);
     const flags = opts.release ? ["--release"] : [];
-    await $`cargo build -p mirin-core -p mirin-helper ${flags}`.cwd(REPO_ROOT);
+    await reporter.build(
+      $`cargo build -p mirin-codec -p mirin-core -p mirin-helper ${flags}`.cwd(REPO_ROOT),
+    );
     const target = join(REPO_ROOT, "target", profile);
     return {
       coreDylib: join(target, coreFileName()),
+      codecBin: join(target, codecFileName()),
       helperBin: join(target, helperFileName()),
       hostEntry: join(REPO_ROOT, "packages", "mirin", "src", "host.ts"),
       cefPath,
@@ -59,6 +86,7 @@ export async function resolveArtifacts(opts: { release: boolean }): Promise<Arti
   const nativeDir = resolveNativeDir();
   return {
     coreDylib: join(nativeDir, coreFileName()),
+    codecBin: join(nativeDir, codecFileName()),
     helperBin: join(nativeDir, helperFileName()),
     hostEntry: resolvePackageFile("mirinjs/host"),
     cefPath,
@@ -67,7 +95,9 @@ export async function resolveArtifacts(opts: { release: boolean }): Promise<Arti
 
 /** The native core library file name for the host platform (MSVC has no `lib` prefix). */
 function coreFileName(): string {
-  return process.platform === "win32" ? "mirin_core.dll" : "libmirin_core.dylib";
+  if (process.platform === "win32") return "mirin_core.dll";
+  if (process.platform === "linux") return "libmirin_core.so";
+  return "libmirin_core.dylib";
 }
 
 /** The CEF subprocess binary name for the host platform. */
@@ -75,13 +105,19 @@ function helperFileName(): string {
   return process.platform === "win32" ? "mirin-helper.exe" : "mirin-helper";
 }
 
+function codecFileName(): string {
+  return process.platform === "win32" ? "mirin-codec.exe" : "mirin-codec";
+}
+
 function assertSupportedPlatform(): void {
   const supported =
     (process.platform === "darwin" && process.arch === "arm64") ||
-    (process.platform === "win32" && process.arch === "x64");
+    (process.platform === "win32" && (process.arch === "x64" || process.arch === "arm64")) ||
+    (process.platform === "linux" && (process.arch === "x64" || process.arch === "arm64"));
   if (!supported) {
     throw new Error(
-      `mirin alpha supports macOS arm64 and Windows x64 (got ${process.platform}/${process.arch}).`,
+      "mirin alpha supports macOS arm64, Windows x64/arm64, and Linux x64/arm64 " +
+        `(got ${process.platform}/${process.arch}).`,
     );
   }
 }
@@ -97,7 +133,7 @@ function resolveNativeDir(): string {
   } catch {
     throw new Error(
       `mirin: prebuilt native package "${pkg}" is not installed. Run \`bun install\` ` +
-        `(it is an optional dependency of @mirinjs/cli for your platform).`,
+        "(it is an optional dependency of @mirinjs/cli for your platform).",
     );
   }
 }
@@ -113,41 +149,144 @@ function cliVersion(): string {
 }
 
 /** A file/dir that, if present in a CEF dir, means the distribution is unpacked.
- *  macOS ships the framework bundle; Windows ships a flat dir with libcef.dll. */
+ *  macOS ships the framework bundle; Windows ships a flat dir with libcef.dll;
+ *  Linux ships a flat dir with libcef.so. */
 function cefMarker(): string {
-  return process.platform === "win32" ? "libcef.dll" : "Chromium Embedded Framework.framework";
+  if (process.platform === "win32") return "libcef.dll";
+  if (process.platform === "linux") return "libcef.so";
+  return "Chromium Embedded Framework.framework";
 }
 
-async function ensureCef(): Promise<string> {
+async function ensureCef(reporter: Reporter): Promise<string> {
   if (IN_REPO) {
-    const vendor = join(REPO_ROOT, "vendor", "cef");
-    if (existsSync(join(vendor, cefMarker()))) return vendor;
+    const vendor = vendoredCef();
+    if (vendor.present) return vendor.path;
     console.error(
       "[mirin] vendor/cef missing — run `bun scripts/fetch-cef.ts` in the monorepo first.",
     );
-    return vendor;
+    return vendor.path;
   }
 
   const version = cliVersion();
-  const cacheDir = join(homedir(), ".mirinjs", "cef", `${version}-${platformTag()}`);
+  const cacheRoot = join(homedir(), ".mirinjs", "cef");
+  const cacheDir = join(cacheRoot, `${version}-${platformTag()}`);
   if (existsSync(join(cacheDir, cefMarker()))) return cacheDir;
 
-  mkdirSync(cacheDir, { recursive: true });
+  mkdirSync(cacheRoot, { recursive: true });
   const asset = `cef-${platformTag()}.tar.gz`;
   const url = `https://github.com/${REPO_SLUG}/releases/download/v${version}/${asset}`;
-  console.log(`[mirin] downloading CEF for ${platformTag()} (one-time, ~hundreds of MB)…`);
+  reporter.info(`[mirin] downloading CEF for ${platformTag()} (one-time, ~hundreds of MB)…`);
 
   // Download with curl, not `Bun.write(file, await fetch(url))`: the latter
   // pins a core at 100% CPU and never completes on large gzip responses
   // (the streaming write path). curl is fast and ubiquitous.
-  const archive = join(tmpdir(), asset);
+  const downloadDir = mkdtempSync(join(tmpdir(), "mirin-cef-download-"));
+  const stagingDir = mkdtempSync(join(cacheRoot, ".staging-"));
+  const archive = join(downloadDir, asset);
+  const checksum = `${archive}.sha256`;
+  const checksumUrl = `${url}.sha256`;
+  const httpsOnly = "=https";
   try {
-    await $`curl -fSL --retry 3 -o ${archive} ${url}`;
-    await $`tar -xzf ${archive} -C ${cacheDir}`;
+    await $`curl --fail --show-error --location --retry 3 --proto ${httpsOnly} --proto-redir ${httpsOnly} -o ${checksum} ${checksumUrl}`;
+    await $`curl --fail --show-error --location --retry 3 --proto ${httpsOnly} --proto-redir ${httpsOnly} -o ${archive} ${url}`;
+    await verifyFileSha256(archive, readFileSync(checksum, "utf8"));
+    const listing = await $`tar -tzf ${archive}`.quiet().text();
+    validateArchiveEntries(listing);
+    await $`tar -xzf ${archive} -C ${stagingDir}`;
+    validateExtractedSymlinks(stagingDir);
+    if (!existsSync(join(stagingDir, cefMarker()))) {
+      throw new Error(`CEF archive is missing ${cefMarker()}`);
+    }
+
+    // Another process may have populated the cache while this one downloaded.
+    if (existsSync(join(cacheDir, cefMarker()))) return cacheDir;
+    rmSync(cacheDir, { recursive: true, force: true });
+    renameSync(stagingDir, cacheDir);
   } catch (err) {
-    rmSync(archive, { force: true });
     throw new Error(`mirin: failed to download CEF from ${url} (${err}).`);
+  } finally {
+    rmSync(downloadDir, { recursive: true, force: true });
+    rmSync(stagingDir, { recursive: true, force: true });
   }
-  rmSync(archive, { force: true });
   return cacheDir;
 }
+
+/** Reject absolute paths and parent traversal before a downloaded tar is extracted. */
+export function validateArchiveEntries(listing: string): void {
+  for (const rawEntry of listing.split(/\r?\n/)) {
+    if (rawEntry.length === 0) continue;
+    const entry = archivePath(rawEntry);
+    if (entry == null) throw new Error(`unsafe CEF archive entry: ${rawEntry}`);
+  }
+}
+
+/** Verify a downloaded release asset before parsing or extracting it. */
+export async function verifyFileSha256(path: string, checksum: string): Promise<void> {
+  const expected = checksum.trim().toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(expected)) {
+    throw new Error("invalid CEF SHA-256 checksum");
+  }
+
+  const hasher = new Bun.CryptoHasher("sha256");
+  for await (const chunk of Bun.file(path).stream()) {
+    hasher.update(chunk);
+  }
+  const actual = hasher.digest("hex");
+  if (actual !== expected) {
+    throw new Error(`CEF SHA-256 mismatch (expected ${expected}, got ${actual})`);
+  }
+}
+
+/** Reject extracted symlinks whose lexical target escapes the staging directory. */
+export function validateExtractedSymlinks(root: string): void {
+  const absoluteRoot = resolve(root);
+  const pending = [absoluteRoot];
+
+  while (pending.length > 0) {
+    const directory = pending.pop();
+    if (!directory) continue;
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      const path = join(directory, entry.name);
+      if (entry.isSymbolicLink()) {
+        const target = readlinkSync(path);
+        const resolvedTarget = resolve(dirname(path), target);
+        const fromRoot = relative(absoluteRoot, resolvedTarget);
+        if (
+          isAbsolute(target) ||
+          fromRoot === ".." ||
+          fromRoot.startsWith(`..${sep}`) ||
+          isAbsolute(fromRoot)
+        ) {
+          throw new Error(`CEF archive symlink escapes its cache: ${path} -> ${target}`);
+        }
+      } else if (entry.isDirectory()) {
+        pending.push(path);
+      }
+    }
+  }
+}
+
+function archivePath(raw: string): string | null {
+  let path = raw.replaceAll("\\", "/");
+  while (path.startsWith("./")) path = path.slice(2);
+  if (path.length === 0 || path === ".") return "";
+  if (path.startsWith("/") || /^[A-Za-z]:/.test(path) || hasControlCharacter(path)) {
+    return null;
+  }
+
+  const parts: string[] = [];
+  for (const part of path.split("/")) {
+    if (part.length === 0 || part === ".") continue;
+    if (part === "..") return null;
+    parts.push(part);
+  }
+  return parts.length > 0 ? parts.join("/") : "";
+}
+
+function hasControlCharacter(value: string): boolean {
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code <= 0x1f || code === 0x7f) return true;
+  }
+  return false;
+}

package/src/build.ts

@@ -1,11 +1,9 @@
 /**
  * `mirin build` — package a standalone, signed .app (docs/macos-mvp.md).
  *
- * 1. vite build               → production UI in dist/
- * 2. resolve native artifacts → core + helper (in-repo build or prebuilt)
- * 3. compile host (minified)  → Contents/MacOS/<exe>
- * 4. bundle Worker (minified) → Resources/worker.js
- * 5. assemble + sign the .app → dist/ui, manifest, dylib, helpers, CEF
+ * 1. vite build + native artifact resolution run in parallel.
+ * 2. compile host + bundle Workers run in parallel.
+ * 3. assemble + sign the app from the completed artifacts.
  *
  * The result runs with no env and no dev server: the host resolves everything
  * from inside the bundle, and webviews load their `app://` URLs served from
@@ -15,16 +13,102 @@
  * ID to produce a distributable, notarizable app.
  */
 
-import { $ } from "bun";
-import { mkdirSync, rmSync, readFileSync, existsSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { buildAppBundle } from "./bundle.ts";
-import { buildWindowsBundle } from "./bundle-win.ts";
+import { $ } from "bun";
 import { resolveArtifacts } from "./artifacts.ts";
+import { buildLinuxBundle } from "./bundle/linux/index.ts";
+import { buildAppBundle } from "./bundle/macos/index.ts";
+import { normalizeCefLocales } from "./bundle/shared/cef-locales.ts";
+import { buildWindowsBundle } from "./bundle/windows/index.ts";
+import { compileWorkers, normalizeSidecars } from "./extras.ts";
+import { makeWindowsIcon } from "./icons/windows/index.ts";
+import { buildLinuxPackages, resolveLinuxFormats } from "./package/linux/index.ts";
 import { sweepBuildTemps } from "./temps.ts";
-import { normalizeSidecars, compileWorkers } from "./extras.ts";
 
 const IS_WINDOWS = process.platform === "win32";
+const IS_LINUX = process.platform === "linux";
+
+/** A PE FILEVERSION (`x.y.z.w`) from a semver string (pre-release suffix dropped). */
+function winFileVersion(v: string): string {
+  const m = v.match(/^(\d+)\.(\d+)\.(\d+)/);
+  return m ? `${m[1]}.${m[2]}.${m[3]}.0` : "0.0.0.0";
+}
+
+/**
+ * Flip a PE exe from the CONSOLE subsystem (3) to GUI (2) so Windows allocates
+ * **no console window** when it's launched from a shortcut. Bun's
+ * `--windows-hide-console` only hides the console at runtime (a brief flash);
+ * GUI subsystem prevents it entirely — the equivalent of Electrobun's
+ * `exe.subsystem = .Windows`. The optional-header Subsystem field is at
+ * `e_lfanew + 24 (PE sig + COFF) + 68`.
+ */
+function patchPeToGuiSubsystem(exePath: string): void {
+  const buf = readFileSync(exePath);
+  const peOff = buf.readUInt32LE(0x3c);
+  if (buf.readUInt32LE(peOff) !== 0x0000_4550) return; // not "PE\0\0"
+  const subsystemOff = peOff + 92;
+  if (buf.readUInt16LE(subsystemOff) === 3 /* CONSOLE */) {
+    buf.writeUInt16LE(2 /* GUI */, subsystemOff);
+    writeFileSync(exePath, buf);
+  }
+}
+
+/**
+ * Stamp a Bun-compiled Windows exe with the app icon + version metadata via
+ * rcedit. Bun's `--windows-icon` is a silent no-op on Windows hosts, so without
+ * this the exe keeps Bun's icon — which the Start Menu / Desktop shortcut, the
+ * taskbar, and Explorer all show. Uses a single largest-size icon: rcedit's
+ * multi-size replacement silently fails on Bun's appended-payload exes, while a
+ * single 256 entry takes and Windows downscales it cleanly for smaller views.
+ * Best-effort — warns (doesn't fail the build) if rcedit isn't installed.
+ */
+async function brandWindowsExe(
+  exe: string,
+  opts: {
+    work: string;
+    appName: string;
+    version: string;
+    /** Absolute path to the icon source. */
+    icon?: string;
+    publisher: string;
+  },
+): Promise<void> {
+  if (!Bun.which("rcedit")) {
+    console.warn(
+      "[mirin build] rcedit not found — the Windows exe keeps Bun's default icon. " +
+        "Install it: `scoop install rcedit` (or `choco install rcedit`).",
+    );
+    return;
+  }
+  const args: string[] = [];
+  if (opts.icon) {
+    const ico = makeWindowsIcon(opts.icon, join(opts.work, "exe-icon.ico"), {
+      onlyLargest: true,
+    });
+    if (ico) args.push("--set-icon", ico);
+  }
+  const fv = winFileVersion(opts.version);
+  args.push(
+    "--set-version-string",
+    "ProductName",
+    opts.appName,
+    "--set-version-string",
+    "FileDescription",
+    opts.appName,
+    "--set-version-string",
+    "CompanyName",
+    opts.publisher,
+    "--set-file-version",
+    fv,
+    "--set-product-version",
+    fv,
+  );
+  const res = await $`rcedit ${exe} ${args}`.nothrow();
+  if (res.exitCode !== 0) {
+    console.warn(`[mirin build] rcedit failed (exit ${res.exitCode}) — exe branding skipped.`);
+  }
+}
 
 export interface BuildResult {
   /** Path to the assembled .app. */
@@ -37,20 +121,37 @@ export interface BuildResult {
   channel: string;
   /** Update baseUrl, if `release` is configured. */
   baseUrl?: string;
+  /** Markdown release notes embedded in the updater manifest, if configured. */
+  releaseNotes?: string;
   /** libmirin_core path (for the updater codec at release time). */
   coreDylib: string;
+  /** Standalone updater codec executable used at release time. */
+  codecBin: string;
   /** Project root (so `mirin release` can resolve relative asset paths). */
   projectDir: string;
   /** DMG config from mirin.config.ts (`true`/object/`false`); default `true`. */
   dmg: boolean | import("mirinjs").DmgConfig;
   /** NSIS installer config (Windows) — `true`/object/`false`; default `true`. */
   nsis: boolean | import("mirinjs").NsisConfig;
+  /** Inno Setup installer config (Windows) — preferred over NSIS; default `true`. */
+  inno: boolean | import("mirinjs").InnoConfig;
+  /** Linux packaging config (`mirin.config.ts` `linux`) — `true`/object/`false`; default `true`. */
+  linux: boolean | import("mirinjs").LinuxConfig;
+  /** Publisher / company name (config.publisher ?? appName). */
+  publisher: string;
+  /** Absolute path to the app icon source (config.icon), if set — for Linux packaging. */
+  icon?: string;
   /** Codesign identity used for the bundle, if any (MIRIN_SIGN_IDENTITY). */
   signIdentity?: string;
 }
 
-/** Read the project's package.json version (the single source of app version). */
+/**
+ * The app version: `$MIRIN_APP_VERSION` (release-pipeline override) wins, otherwise
+ * the project's package.json `version` (the single source of truth).
+ */
 function appVersion(projectDir: string): string {
+  const override = process.env.MIRIN_APP_VERSION;
+  if (override) return override;
   const pkgPath = join(projectDir, "package.json");
   if (!existsSync(pkgPath)) return "0.0.0";
   try {
@@ -60,7 +161,19 @@ function appVersion(projectDir: string): string {
   }
 }
 
-export async function build(projectDir = process.cwd()): Promise<BuildResult> {
+export interface BuildOptions {
+  /** Override the app version (else `$MIRIN_APP_VERSION` / package.json). */
+  version?: string;
+  /** On Linux, also emit distributable packages (AppImage/deb/rpm) after assembling. */
+  packageLinux?: boolean;
+  /** Restrict Linux packaging to these formats (else config.linux.formats / all). */
+  linuxFormats?: import("mirinjs").LinuxPackageFormat[];
+}
+
+export async function build(
+  projectDir = process.cwd(),
+  opts: BuildOptions = {},
+): Promise<BuildResult> {
   const outDir = join(projectDir, "build");
   const work = join(projectDir, ".mirin");
   mkdirSync(outDir, { recursive: true });
@@ -71,35 +184,61 @@ export async function build(projectDir = process.cwd()): Promise<BuildResult> {
   const appName: string = config.name ?? "Mirin App";
   const bundleId: string = config.id ?? "dev.mirin.app";
   const mainEntry = join(projectDir, config.main ?? "main/main.ts");
-  const version = appVersion(projectDir);
+  const version = opts.version ?? appVersion(projectDir);
   const channel: string = config.release?.channel ?? "stable";
   const baseUrl: string | undefined = config.release?.baseUrl;
+  const releaseNotes: string | undefined = config.release?.notes;
   const dmg: boolean | import("mirinjs").DmgConfig = config.dmg ?? true;
   const nsis: boolean | import("mirinjs").NsisConfig = config.nsis ?? true;
+  const inno: boolean | import("mirinjs").InnoConfig = config.inno ?? true;
+  const linux: boolean | import("mirinjs").LinuxConfig = config.linux ?? true;
+  const publisher: string = config.publisher ?? appName;
+  const cefLocales = normalizeCefLocales(config.cef?.locales);
+  const appIconPath: string | undefined = config.icon ? join(projectDir, config.icon) : undefined;
 
   console.log(`[mirin build] ${appName} ${version}`);
 
-  // 1. production UI
-  console.log("[mirin build] vite build…");
-  await $`bunx vite build`.cwd(projectDir);
-
-  // 2. native artifacts (release)
-  const artifacts = await resolveArtifacts({ release: true });
+  // Production UI and native artifacts do not share outputs, so overlap them.
+  console.log("[mirin build] building UI + native artifacts…");
+  const [, artifacts] = await Promise.all([
+    $`bunx vite build`.cwd(projectDir),
+    resolveArtifacts({ release: true }),
+  ]);
 
-  // 3 + 4. host + worker (minified)
-  console.log("[mirin build] compiling host + bundling main process…");
+  // Host compilation, main Worker bundling, and extra Worker bundling are independent.
+  console.log("[mirin build] compiling host + bundling workers…");
   const signIdentity = process.env.MIRIN_SIGN_IDENTITY;
   const hostExe = join(work, IS_WINDOWS ? "host-release.exe" : "host-release");
   const workerJs = join(work, "worker.release.js");
-  await $`bun build --compile --minify ${artifacts.hostEntry} --outfile ${hostExe}`.cwd(projectDir);
-  await $`bun build ${mainEntry} --target=bun --minify --outfile ${workerJs}`.cwd(projectDir);
-
-  // Extra assets: resolve sidecar binaries + compile any extra worker entries.
   const sidecars = normalizeSidecars(projectDir, config.sidecars);
-  const extraWorkers = await compileWorkers(projectDir, config.workers, join(work, "workers"), true);
+  const hostBuild = (async (): Promise<void> => {
+    // Bun's Windows arm64 build currently has no bun:ffi/TinyCC runtime. The
+    // win32-arm64 Mirin package therefore carries an x64 compatibility payload,
+    // which Windows 11 ARM executes through its built-in x64 emulation layer.
+    const target = IS_WINDOWS && process.arch === "arm64" ? ["--target=bun-windows-x64"] : [];
+    await $`bun build --compile --minify ${target} ${artifacts.hostEntry} --outfile ${hostExe}`.cwd(
+      projectDir,
+    );
+    if (IS_WINDOWS) {
+      patchPeToGuiSubsystem(hostExe);
+      await brandWindowsExe(hostExe, {
+        work,
+        appName,
+        version,
+        icon: appIconPath,
+        publisher,
+      });
+    }
+  })();
+  const workerBuild = $`bun build ${mainEntry} --target=bun --minify --outfile ${workerJs}`.cwd(
+    projectDir,
+  );
+  const extraWorkersBuild = compileWorkers(projectDir, config.workers, join(work, "workers"), true);
+  const [, , extraWorkers] = await Promise.all([hostBuild, workerBuild, extraWorkersBuild]);
 
   // 5. assemble (+ sign on macOS)
-  console.log(`[mirin build] assembling ${IS_WINDOWS ? "app folder" : ".app"}…`);
+  const artifactKind = IS_WINDOWS ? "app folder" : IS_LINUX ? "app folder" : ".app";
+  console.log(`[mirin build] assembling ${artifactKind}…`);
   // version.json embeds the running app's update identity (read by app.updater).
   // Only when `release` is configured — otherwise the app has no updater.
   const versionJson = baseUrl
@@ -108,7 +247,13 @@ export async function build(projectDir = process.cwd()): Promise<BuildResult> {
   const resources = {
     uiDir: join(projectDir, "dist"),
     workerJs,
-    manifestJson: JSON.stringify({ windows: config.windows }),
+    manifestJson: JSON.stringify({
+      id: bundleId,
+      windows: config.windows,
+      singleInstance: config.singleInstance,
+      // Lets a diagnostic build opt in via `devtools.production`; otherwise fully off.
+      devtools: config.devtools,
+    }),
     versionJson,
     workers: extraWorkers,
   };
@@ -120,25 +265,65 @@ export async function build(projectDir = process.cwd()): Promise<BuildResult> {
         coreDll: artifacts.coreDylib,
         helperExe: artifacts.helperBin,
         cefPath: artifacts.cefPath,
-        icon: config.icon ? join(projectDir, config.icon) : undefined,
+        cefLocales,
+        icon: appIconPath,
         resources: { ...resources, sidecars: sidecars.map((s) => ({ name: s.name, src: s.src })) },
       })
-    : await buildAppBundle({
-        appName,
-        bundleId,
-        outDir,
-        hostExe,
-        coreDylib: artifacts.coreDylib,
-        helperBin: artifacts.helperBin,
-        cefPath: artifacts.cefPath,
-        version,
-        icon: config.icon ? join(projectDir, config.icon) : undefined,
-        signIdentity,
-        urlSchemes: config.urlSchemes,
-        resources: { ...resources, sidecars },
-      });
+    : IS_LINUX
+      ? await buildLinuxBundle({
+          appName,
+          outDir,
+          hostExe,
+          coreDll: artifacts.coreDylib,
+          helperExe: artifacts.helperBin,
+          cefPath: artifacts.cefPath,
+          cefLocales,
+          icon: appIconPath,
+          resources: {
+            ...resources,
+            sidecars: sidecars.map((s) => ({ name: s.name, src: s.src })),
+          },
+        })
+      : await buildAppBundle({
+          appName,
+          bundleId,
+          outDir,
+          hostExe,
+          coreDylib: artifacts.coreDylib,
+          helperBin: artifacts.helperBin,
+          cefPath: artifacts.cefPath,
+          cefLocales,
+          version,
+          icon: appIconPath,
+          signIdentity,
+          urlSchemes: config.urlSchemes,
+          resources: { ...resources, sidecars },
+        });
 
   console.log(`\n[mirin build] done → ${app}`);
+
+  // Linux: optionally emit distributable packages (AppImage/deb/rpm) straight from
+  // `mirin build`. `mirin release` does its own packaging into build/release, so it
+  // never sets `packageLinux` — this path only runs for a direct build request.
+  if (IS_LINUX && opts.packageLinux && linux !== false) {
+    const formats = resolveLinuxFormats(linux, opts.linuxFormats);
+    console.log(`[mirin build] packaging Linux artifacts (${formats.join(", ")})…`);
+    const pkgs = await buildLinuxPackages({
+      appDir: app,
+      appName,
+      bundleId,
+      version,
+      publisher,
+      outDir,
+      projectDir,
+      icon: appIconPath,
+      options: typeof linux === "object" ? linux : {},
+      formats,
+    });
+    const mb = (n: number) => (n / 1e6).toFixed(1);
+    for (const p of pkgs) console.log(`  ${p.path} (${mb(p.size)} MB)`);
+  }
+
   return {
     app,
     appName,
@@ -146,10 +331,16 @@ export async function build(projectDir = process.cwd()): Promise<BuildResult> {
     version,
     channel,
     baseUrl,
+    releaseNotes,
     coreDylib: artifacts.coreDylib,
+    codecBin: artifacts.codecBin,
     projectDir,
     dmg,
     nsis,
+    inno,
+    linux,
+    publisher,
+    icon: appIconPath,
     signIdentity,
   };
 }