@mirinjs/cli 0.1.0-alpha.2 → 0.1.0-alpha.20

package/src/package/linux/package.ts

@@ -0,0 +1,293 @@
+/**
+ * Linux distributable packages for a mirin app — **AppImage**, **.deb**, **.rpm** —
+ * built from the assembled Linux app folder (buildLinuxBundle's output). This is the
+ * Linux analog of dmg.ts (macOS) and installer-inno.ts / installer-win.ts (Windows):
+ * `mirin build` (with packaging requested) and `mirin release` call it after the app
+ * folder is assembled.
+ *
+ * The app folder is a flat, relocatable payload — the host binary, libcef.so + the
+ * CEF runtime, and `resources/`, all resolved at runtime from an `$ORIGIN` rpath and
+ * `dirname(process.execPath)` (host.ts). Every package therefore ships the whole
+ * folder verbatim under one prefix and points a launcher at the *real* host binary
+ * inside it (never a bare PATH name — the host derives everything from its own dir):
+ *
+ *   - deb / rpm: payload → `/opt/<id>/`, a `/usr/bin/<bin>` wrapper `exec`s
+ *     `/opt/<id>/<App>`, plus `/usr/share/applications/<id>.desktop` and a
+ *     `/usr/share/icons/hicolor/256x256/apps/<id>.png`.
+ *   - AppImage: payload → `AppDir/usr/lib/<id>/`, top-level `AppRun` `exec`s it,
+ *     `<id>.desktop` + `<id>.png` (+ `.DirIcon`) at the AppDir root, packed by
+ *     appimagetool.
+ *
+ * Tooling (resolved via $MIRIN_FPM / $MIRIN_APPIMAGETOOL, then PATH, then a
+ * conventional fallback — see resolveTool):
+ *   - **fpm** builds both deb and rpm in pure Ruby (no dpkg/rpmbuild on the host).
+ *   - **appimagetool** packs the AppImage (invoked with `--appimage-extract-and-run`
+ *     so it works on hosts without FUSE).
+ */
+
+import {
+  chmodSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { $ } from "bun";
+import { desktopEntry, resolveLinuxDesktopIconPng } from "../../bundle/linux/index.ts";
+import { DEFAULT_DEB_DEPENDS, DEFAULT_RPM_DEPENDS, LINUX_FORMATS } from "./lib/defaults.ts";
+import { resolveAppimagetool, resolveFpm } from "./lib/tools.ts";
+import { safeLinuxPackageInput, safePackageName, validateLinuxFormats } from "./lib/validation.ts";
+import type {
+  LinuxConfig,
+  LinuxPackageFormat,
+  LinuxPackageInput,
+  LinuxPackageResult,
+} from "./types.ts";
+
+const size = (p: string) => statSync(p).size;
+
+/** Build every requested Linux package; returns each artifact's path + size. */
+export async function buildLinuxPackages(input: LinuxPackageInput): Promise<LinuxPackageResult[]> {
+  const safeInput = safeLinuxPackageInput(input);
+  mkdirSync(safeInput.outDir, { recursive: true });
+  const binName = safePackageName(
+    safeInput.options.binName ?? safeInput.bundleId.split(".").pop() ?? safeInput.appName,
+  );
+  // deb + rpm share one staged filesystem tree (payload under /opt, launcher,
+  // .desktop, icon). Build it once and reuse. Package compressors only read the
+  // staged tree, so all requested formats can run concurrently.
+  const needFsTree = safeInput.formats.includes("deb") || safeInput.formats.includes("rpm");
+  let fsRoot: string | undefined;
+  try {
+    if (needFsTree) fsRoot = stageFsTree(safeInput, binName);
+    return await Promise.all(
+      safeInput.formats.map((format) =>
+        format === "appimage"
+          ? buildAppImage(safeInput, binName)
+          : buildFpm(safeInput, binName, fsRoot!, format),
+      ),
+    );
+  } finally {
+    if (fsRoot) rmSync(fsRoot, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Stage the on-disk filesystem layout deb/rpm install: the whole payload under
+ * `/opt/<id>/`, a `/usr/bin/<bin>` wrapper `exec`ing the real host binary, the
+ * `.desktop` entry, and a hicolor icon. Returns the staging root (fpm's `-C` chdir).
+ */
+function stageFsTree(input: LinuxPackageInput, binName: string): string {
+  const root = join(input.outDir, `.pkgroot-${process.pid}`);
+  rmSync(root, { recursive: true, force: true });
+
+  // Payload → /opt/<id>/…
+  const prefix = join(root, "opt", input.bundleId);
+  mkdirSync(prefix, { recursive: true });
+  cpSync(input.appDir, prefix, { recursive: true });
+
+  // /usr/bin/<bin>: a wrapper that exec's the real binary so process.execPath (and
+  // thus the host's core/resources/helper resolution) points into /opt/<id>.
+  const binDir = join(root, "usr", "bin");
+  mkdirSync(binDir, { recursive: true });
+  const launcher = join(binDir, binName);
+  writeFileSync(launcher, `#!/bin/sh\nexec "/opt/${input.bundleId}/${input.appName}" "$@"\n`);
+  chmodSync(launcher, 0o755);
+
+  // /usr/share/applications/<id>.desktop — Icon= is the theme name (<id>), resolved
+  // from the hicolor icon below; Exec= is the /usr/bin launcher on PATH.
+  const appsDir = join(root, "usr", "share", "applications");
+  mkdirSync(appsDir, { recursive: true });
+  writeFileSync(join(appsDir, `${input.bundleId}.desktop`), buildDesktop(input, binName));
+
+  stageHicolorIcon(root, input);
+  return root;
+}
+
+/** Install the app icon at `usr/share/icons/hicolor/256x256/apps/<id>.png` under `root`. */
+function stageHicolorIcon(root: string, input: LinuxPackageInput): void {
+  const png = input.icon ? resolveLinuxDesktopIconPng(input.icon) : undefined;
+  if (!png) return;
+  const dir = join(root, "usr", "share", "icons", "hicolor", "256x256", "apps");
+  mkdirSync(dir, { recursive: true });
+  cpSync(png, join(dir, `${input.bundleId}.png`));
+}
+
+/** The `.desktop` body shared by deb/rpm/AppImage (Exec = launcher name, Icon = <id>). */
+function buildDesktop(input: LinuxPackageInput, binName: string): string {
+  return desktopEntry({
+    name: input.appName,
+    exec: binName,
+    iconPng: input.bundleId,
+    wmClass: input.bundleId,
+    categories: input.options.category ?? "Utility",
+    comment: input.options.description,
+  });
+}
+
+/** Build a .deb or .rpm from the staged tree via fpm. */
+async function buildFpm(
+  input: LinuxPackageInput,
+  binName: string,
+  fsRoot: string,
+  kind: "deb" | "rpm",
+): Promise<LinuxPackageResult> {
+  const fpm = resolveFpm();
+  const arch = linuxPackageArch(kind);
+  const fileName =
+    kind === "deb"
+      ? `${binName}_${input.version}_${arch}.deb`
+      : `${binName}-${input.version}-1.${arch}.rpm`;
+  const out = join(input.outDir, fileName);
+  rmSync(out, { force: true });
+
+  const depends =
+    kind === "deb"
+      ? (input.options.debDepends ?? DEFAULT_DEB_DEPENDS)
+      : (input.options.rpmDepends ?? DEFAULT_RPM_DEPENDS);
+
+  const args: string[] = [
+    "-s",
+    "dir",
+    "-t",
+    kind,
+    "-C",
+    fsRoot,
+    "--package",
+    out,
+    "--name",
+    binName,
+    "--version",
+    input.version,
+    "--iteration",
+    "1",
+    "--architecture",
+    arch,
+    "--maintainer",
+    input.options.maintainer ?? input.publisher,
+    "--vendor",
+    input.publisher,
+    "--description",
+    input.options.description ?? input.appName,
+  ];
+  if (input.options.homepage) args.push("--url", input.options.homepage);
+  if (input.options.license) args.push("--license", input.options.license);
+  for (const d of depends) args.push("--depends", d);
+  // CEF dominates the payload. Level 3 avoids spending minutes chasing small
+  // gains while retaining gzip compatibility across Debian and RPM families.
+  args.push(
+    kind === "deb" ? "--deb-compression" : "--rpm-compression",
+    kind === "deb" ? "gz" : "gzip",
+    kind === "deb" ? "--deb-compression-level" : "--rpm-compression-level",
+    "3",
+  );
+  // Package the whole staged tree ('.' relative to the -C chdir).
+  args.push(".");
+
+  console.log(`[mirin] building ${kind} → ${fileName}`);
+  const res = await $`${fpm} ${args}`.nothrow().quiet();
+  if (res.exitCode !== 0 || !existsSync(out)) {
+    throw new Error(`fpm (${kind}) failed (exit ${res.exitCode}):\n${res.stderr.toString()}`);
+  }
+  return { format: kind, path: out, size: size(out) };
+}
+
+/** Build an AppDir and pack it into a single-file AppImage via appimagetool. */
+async function buildAppImage(
+  input: LinuxPackageInput,
+  binName: string,
+): Promise<LinuxPackageResult> {
+  const appimagetool = resolveAppimagetool();
+  const appDirRoot = join(input.outDir, `.AppDir-${process.pid}`);
+  rmSync(appDirRoot, { recursive: true, force: true });
+
+  // Payload → AppDir/usr/lib/<id>/ so $ORIGIN resolves within it.
+  const payload = join(appDirRoot, "usr", "lib", input.bundleId);
+  mkdirSync(payload, { recursive: true });
+  cpSync(input.appDir, payload, { recursive: true });
+
+  // AppRun: exec the real host binary (resolves core/resources/helper from its dir).
+  const appRun = join(appDirRoot, "AppRun");
+  writeFileSync(
+    appRun,
+    [
+      "#!/bin/sh",
+      'HERE="$(dirname "$(readlink -f "$0")")"',
+      `exec "$HERE/usr/lib/${input.bundleId}/${input.appName}" "$@"`,
+      "",
+    ].join("\n"),
+  );
+  chmodSync(appRun, 0o755);
+
+  // .desktop at the AppDir root (appimagetool reads it) + the standard location.
+  const desktop = buildDesktop(input, binName);
+  writeFileSync(join(appDirRoot, `${input.bundleId}.desktop`), desktop);
+  const appsDir = join(appDirRoot, "usr", "share", "applications");
+  mkdirSync(appsDir, { recursive: true });
+  writeFileSync(join(appsDir, `${input.bundleId}.desktop`), desktop);
+
+  // Icon: <id>.png + .DirIcon at the root, plus the hicolor copy.
+  const png = input.icon ? resolveLinuxDesktopIconPng(input.icon) : undefined;
+  if (png) {
+    cpSync(png, join(appDirRoot, `${input.bundleId}.png`));
+    try {
+      symlinkSync(`${input.bundleId}.png`, join(appDirRoot, ".DirIcon"));
+    } catch {
+      /* best-effort: some filesystems disallow symlinks */
+    }
+    stageHicolorIcon(appDirRoot, input);
+  }
+
+  const arch = linuxPackageArch("appimage");
+  const fileName = `${input.appName}-${input.version}-${arch}.AppImage`;
+  const out = join(input.outDir, fileName);
+  rmSync(out, { force: true });
+
+  console.log(`[mirin] building AppImage → ${fileName}`);
+  // --appimage-extract-and-run: run appimagetool without FUSE. ARCH is required by
+  // appimagetool; NO_STRIP avoids stripping the Bun-compiled host (which would break it).
+  const res = await $`${appimagetool} --appimage-extract-and-run ${appDirRoot} ${out}`
+    .env({ ...process.env, ARCH: arch, NO_STRIP: "1" })
+    .nothrow()
+    .quiet();
+  rmSync(appDirRoot, { recursive: true, force: true });
+  if (res.exitCode !== 0 || !existsSync(out)) {
+    throw new Error(`appimagetool failed (exit ${res.exitCode}):\n${res.stderr.toString()}`);
+  }
+  chmodSync(out, 0o755);
+  return { format: "appimage", path: out, size: size(out) };
+}
+
+function linuxPackageArch(kind: "appimage" | "deb" | "rpm"): string {
+  if (process.arch === "arm64") {
+    return kind === "deb" ? "arm64" : "aarch64";
+  }
+  return kind === "deb" ? "amd64" : "x86_64";
+}
+
+/** Resolve the effective set of formats from config + an optional CLI/caller override. */
+export function resolveLinuxFormats(
+  linux: boolean | LinuxConfig | undefined,
+  override?: LinuxPackageFormat[],
+): LinuxPackageFormat[] {
+  if (override && override.length) return validateLinuxFormats(override, "CLI override");
+  const fromConfig = typeof linux === "object" ? linux.formats : undefined;
+  return fromConfig && fromConfig.length
+    ? validateLinuxFormats(fromConfig, "mirin.config.ts linux.formats")
+    : [...LINUX_FORMATS];
+}
+
+export function parseLinuxFormats(raw: string): LinuxPackageFormat[] {
+  const formats = raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  if (!formats.length) {
+    throw new Error("[mirin] --linux-target needs at least one format: appimage, deb, or rpm.");
+  }
+  return validateLinuxFormats(formats, "--linux-target");
+}

package/src/package/linux/types.ts

@@ -0,0 +1,30 @@
+import type { LinuxConfig, LinuxPackageFormat } from "mirinjs";
+
+export type { LinuxConfig, LinuxPackageFormat };
+
+export interface LinuxPackageInput {
+  /** The assembled Linux app folder (build/<App>): the whole relocatable payload. */
+  appDir: string;
+  /** App display name; also the host-binary stem inside `appDir`. */
+  appName: string;
+  /** Reverse-DNS app id, e.g. "dev.netko.anko" (install prefix + `.desktop`/icon name). */
+  bundleId: string;
+  version: string;
+  /** Publisher / company (deb/rpm vendor + maintainer fallback). */
+  publisher: string;
+  /** Directory the artifacts are written into. */
+  outDir: string;
+  projectDir: string;
+  /** Abs path to the app icon source (`.png` / `.iconset`); resolved to a PNG. */
+  icon?: string;
+  /** Resolved Linux config (maintainer, depends, category, ...). */
+  options: LinuxConfig;
+  /** Which formats to build. */
+  formats: LinuxPackageFormat[];
+}
+
+export interface LinuxPackageResult {
+  format: LinuxPackageFormat;
+  path: string;
+  size: number;
+}

package/src/release/installers.ts

@@ -0,0 +1,148 @@
+import { rmSync, statSync } from "node:fs";
+import { basename, join } from "node:path";
+import { $ } from "bun";
+import type { BuildResult } from "../build.ts";
+import { buildDmg, type DmgOptions, notarizeAndStaple } from "../dmg.ts";
+import { buildInnoInstaller, hasInno } from "../installer-inno.ts";
+import { buildNsisInstaller, hasMakensis } from "../installer-win.ts";
+import { buildLinuxPackages, resolveLinuxFormats } from "../package/linux/index.ts";
+
+export interface ReleaseInstallerResult {
+  installerName?: string;
+  installerSize: number;
+}
+
+export interface ReleaseInstallerInput {
+  result: BuildResult;
+  buildDir: string;
+  outDir: string;
+  appArtifact: string;
+  prefix: string;
+  safeName: string;
+  isWindows: boolean;
+  isLinux: boolean;
+}
+
+/** Build first-install artifacts independently from updater compression and deltas. */
+export async function buildReleaseInstaller(
+  input: ReleaseInstallerInput,
+): Promise<ReleaseInstallerResult> {
+  const { result, isWindows, isLinux } = input;
+  if (isWindows) return buildWindowsInstaller(input);
+  if (isLinux) return buildLinuxInstallers(input);
+  if (result.dmg !== false) return buildMacInstaller(input);
+  return { installerSize: 0 };
+}
+
+async function buildWindowsInstaller(
+  input: ReleaseInstallerInput,
+): Promise<ReleaseInstallerResult> {
+  const { result, buildDir, outDir, appArtifact, prefix, safeName } = input;
+  const setupName = `${prefix}-${safeName}-setup.exe`;
+  const installerArgs = {
+    appDir: result.app,
+    appName: result.appName,
+    exeName: `${result.appName}.exe`,
+    version: result.version,
+    bundleId: result.bundleId,
+    outDir,
+    fileName: setupName,
+    projectDir: result.projectDir,
+  };
+  const innoWanted = result.inno !== false;
+  const nsisWanted = result.nsis !== false;
+  const innoOpts = typeof result.inno === "object" ? result.inno : {};
+  const nsisOpts = typeof result.nsis === "object" ? result.nsis : {};
+  let exePath: string | undefined;
+
+  if (innoWanted && hasInno()) {
+    exePath = await buildInnoInstaller({
+      ...installerArgs,
+      options: { ...innoOpts, publisher: innoOpts.publisher ?? result.publisher },
+    });
+  } else if (nsisWanted && (await hasMakensis())) {
+    exePath = await buildNsisInstaller({
+      ...installerArgs,
+      options: { ...nsisOpts, publisher: nsisOpts.publisher ?? result.publisher },
+    });
+  }
+
+  if (exePath) return { installerName: setupName, installerSize: statSync(exePath).size };
+  if (innoWanted || nsisWanted) {
+    console.warn(
+      "[mirin release] no installer toolchain found — shipping the portable .zip. " +
+        "Install Inno Setup (`scoop install inno-setup`) or NSIS (`scoop install nsis`).",
+    );
+  }
+
+  const installerName = `${prefix}-${safeName}.zip`;
+  const zipPath = join(outDir, installerName);
+  console.log(`[mirin release] zipping → ${installerName}`);
+  rmSync(zipPath, { force: true });
+  await $`tar -a -cf ${zipPath} -C ${buildDir} ${appArtifact}`;
+  return { installerName, installerSize: statSync(zipPath).size };
+}
+
+async function buildLinuxInstallers(input: ReleaseInstallerInput): Promise<ReleaseInstallerResult> {
+  const { result, outDir } = input;
+  if (result.linux === false) return { installerSize: 0 };
+
+  try {
+    const formats = resolveLinuxFormats(result.linux);
+    console.log(`[mirin release] building Linux packages (${formats.join(", ")})…`);
+    const packages = await buildLinuxPackages({
+      appDir: result.app,
+      appName: result.appName,
+      bundleId: result.bundleId,
+      version: result.version,
+      publisher: result.publisher,
+      outDir,
+      projectDir: result.projectDir,
+      icon: result.icon,
+      options: typeof result.linux === "object" ? result.linux : {},
+      formats,
+    });
+    const primary = packages.find((artifact) => artifact.format === "appimage") ?? packages[0];
+    for (const artifact of packages) {
+      if (artifact !== primary) {
+        console.log(`  ${basename(artifact.path)} (${(artifact.size / 1e6).toFixed(1)} MB)`);
+      }
+    }
+    return primary
+      ? { installerName: basename(primary.path), installerSize: primary.size }
+      : { installerSize: 0 };
+  } catch (error) {
+    console.warn(
+      `\n[mirin release] Linux packaging failed: ${error instanceof Error ? error.message : error}\n` +
+        "[mirin release] shipping the updater bundle + manifest WITHOUT packages.\n",
+    );
+    return { installerSize: 0 };
+  }
+}
+
+async function buildMacInstaller(input: ReleaseInstallerInput): Promise<ReleaseInstallerResult> {
+  const { result, outDir, prefix, safeName } = input;
+  const installerName = `${prefix}-${safeName}.dmg`;
+  console.log(`[mirin release] building installer → ${installerName}`);
+  try {
+    const options: DmgOptions = typeof result.dmg === "object" ? result.dmg : {};
+    const path = await buildDmg({
+      app: result.app,
+      appName: result.appName,
+      outDir,
+      fileName: installerName,
+      options,
+      projectDir: result.projectDir,
+      signIdentity: result.signIdentity,
+    });
+    await notarizeAndStaple(path);
+    return { installerName, installerSize: statSync(path).size };
+  } catch (error) {
+    console.warn(
+      `\n[mirin release] DMG build failed: ${error instanceof Error ? error.message : error}\n` +
+        "[mirin release] shipping the updater bundle + manifest WITHOUT a .dmg installer.\n",
+    );
+    rmSync(join(outDir, installerName), { force: true });
+    return { installerSize: 0 };
+  }
+}

package/src/release/previous.ts

@@ -0,0 +1,105 @@
+export interface PreviousReleaseManifest {
+  version: string;
+  bundle: {
+    url: string;
+    sha256: string;
+    size: number;
+  };
+}
+
+const MAX_ARTIFACT_BYTES = 8 * 1024 * 1024 * 1024;
+
+export function parsePreviousReleaseManifest(
+  value: unknown,
+  expected: { channel: string; platform: string; arch: string },
+): PreviousReleaseManifest {
+  const manifest = record(value, "manifest");
+  for (const key of ["channel", "platform", "arch"] as const) {
+    if (stringField(manifest, key) !== expected[key]) {
+      throw new Error(`previous update manifest target mismatch: ${key}`);
+    }
+  }
+
+  const version = stringField(manifest, "version");
+  if (
+    version.length > 128 ||
+    !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(
+      version,
+    )
+  ) {
+    throw new Error("invalid previous update version");
+  }
+
+  const bundle = record(manifest.bundle, "bundle");
+  const url = stringField(bundle, "url");
+  releaseArtifactUrl("https://example.invalid", url);
+  const sha256 = stringField(bundle, "sha256").toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(sha256)) throw new Error("invalid previous bundle checksum");
+  const size = bundle.size;
+  if (
+    typeof size !== "number" ||
+    !Number.isSafeInteger(size) ||
+    size <= 0 ||
+    size > MAX_ARTIFACT_BYTES
+  ) {
+    throw new Error("invalid previous bundle size");
+  }
+
+  return { version, bundle: { url, sha256, size } };
+}
+
+export function trustedReleaseBaseUrl(raw: string): string {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error(`invalid release baseUrl: ${raw}`);
+  }
+  assertTrustedReleaseUrl(url.toString());
+  url.hash = "";
+  url.search = "";
+  return url.toString().replace(/\/$/, "");
+}
+
+export function assertTrustedReleaseUrl(raw: string): void {
+  const url = new URL(raw);
+  if (url.protocol === "https:") return;
+  if (url.protocol === "http:" && isLoopbackHost(url.hostname)) return;
+  throw new Error("release URLs must use HTTPS, except loopback HTTP for local testing");
+}
+
+export function releaseArtifactUrl(base: string, fileName: string): string {
+  if (
+    fileName.length === 0 ||
+    fileName.length > 255 ||
+    fileName.includes("/") ||
+    fileName.includes("\\") ||
+    fileName.includes("?") ||
+    fileName.includes("#") ||
+    fileName === "." ||
+    fileName === ".."
+  ) {
+    throw new Error(`unsafe previous update artifact name: ${fileName}`);
+  }
+  return `${base}/${fileName}`;
+}
+
+function record(value: unknown, label: string): Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`invalid previous update ${label}`);
+  }
+  return value as Record<string, unknown>;
+}
+
+function stringField(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`invalid previous update field: ${key}`);
+  }
+  return value;
+}
+
+function isLoopbackHost(hostname: string): boolean {
+  const host = hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+}