@mirinjs/cli 0.1.0-alpha.24 → 0.1.0-alpha.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mirinjs/cli",
-  "version": "0.1.0-alpha.24",
+  "version": "0.1.0-alpha.26",
   "description": "CLI for mirin apps: dev, build, init.",
   "type": "module",
   "license": "MIT",
@@ -27,15 +27,15 @@
     "bun": ">=1.2.0"
   },
   "dependencies": {
-    "create-mirinjs": "0.1.0-alpha.24",
-    "mirinjs": "0.1.0-alpha.24"
+    "create-mirinjs": "0.1.0-alpha.26",
+    "mirinjs": "0.1.0-alpha.26"
   },
   "optionalDependencies": {
-    "@mirinjs/darwin-arm64": "0.1.0-alpha.24",
-    "@mirinjs/win32-x64": "0.1.0-alpha.24",
-    "@mirinjs/win32-arm64": "0.1.0-alpha.24",
-    "@mirinjs/linux-arm64": "0.1.0-alpha.24",
-    "@mirinjs/linux-x64": "0.1.0-alpha.24"
+    "@mirinjs/darwin-arm64": "0.1.0-alpha.26",
+    "@mirinjs/win32-x64": "0.1.0-alpha.26",
+    "@mirinjs/win32-arm64": "0.1.0-alpha.26",
+    "@mirinjs/linux-arm64": "0.1.0-alpha.26",
+    "@mirinjs/linux-x64": "0.1.0-alpha.26"
   },
   "publishConfig": {
     "access": "public"

package/src/build.ts

@@ -9,6 +9,8 @@
  * from inside the bundle, and webviews load their `app://` URLs served from
  * Contents/Resources by the native scheme handler.
  *
+ * Release channel / feed: MIRIN_RELEASE_CHANNEL and MIRIN_RELEASE_BASE_URL override
+ * config.release so one config can produce stable and nightly builds.
  * Codesign identity: ad-hoc by default; set MIRIN_SIGN_IDENTITY to a Developer
  * ID to produce a distributable, notarizable app.
  */
@@ -18,10 +20,10 @@ import { join } from "node:path";
 import { $ } from "bun";
 import { resolveArtifacts } from "./artifacts.ts";
 import { buildLinuxBundle } from "./bundle/linux/index.ts";
-import { buildAppBundle } from "./bundle/macos/index.ts";
+import { buildAppBundle, stampMacSdk } from "./bundle/macos/index.ts";
 import { normalizeCefLocales } from "./bundle/shared/cef-locales.ts";
 import { buildWindowsBundle } from "./bundle/windows/index.ts";
-import { compileWorkers, normalizeSidecars } from "./extras.ts";
+import { compileWorkers, normalizeResources, normalizeSidecars } from "./extras.ts";
 import { resolveIconFallback, resolveIconSource } from "./icons/sources.ts";
 import { makeWindowsIcon } from "./icons/windows/index.ts";
 import { buildLinuxPackages, resolveLinuxFormats } from "./package/linux/index.ts";
@@ -186,8 +188,9 @@ export async function build(
   const bundleId: string = config.id ?? "dev.mirin.app";
   const mainEntry = join(projectDir, config.main ?? "main/main.ts");
   const version = opts.version ?? appVersion(projectDir);
-  const channel: string = config.release?.channel ?? "stable";
-  const baseUrl: string | undefined = config.release?.baseUrl;
+  // A release pipeline builds several channels from one config: the env wins.
+  const channel: string = process.env.MIRIN_RELEASE_CHANNEL || config.release?.channel || "stable";
+  const baseUrl: string | undefined = process.env.MIRIN_RELEASE_BASE_URL || config.release?.baseUrl;
   const releaseNotes: string | undefined = config.release?.notes;
   const dmg: boolean | import("mirinjs").DmgConfig = config.dmg ?? true;
   const nsis: boolean | import("mirinjs").NsisConfig = config.nsis ?? true;
@@ -213,6 +216,7 @@ export async function build(
   const hostExe = join(work, IS_WINDOWS ? "host-release.exe" : "host-release");
   const workerJs = join(work, "worker.release.js");
   const sidecars = normalizeSidecars(projectDir, config.sidecars);
+  const extraResources = normalizeResources(projectDir, config.resources);
   const hostBuild = (async (): Promise<void> => {
     // Bun's Windows arm64 build currently has no bun:ffi/TinyCC runtime. The
     // win32-arm64 Mirin package therefore carries an x64 compatibility payload,
@@ -221,6 +225,7 @@ export async function build(
     await $`bun build --compile --minify ${target} ${artifacts.hostEntry} --outfile ${hostExe}`.cwd(
       projectDir,
     );
+    await stampMacSdk(hostExe);
     if (IS_WINDOWS) {
       patchPeToGuiSubsystem(hostExe);
       await brandWindowsExe(hostExe, {
@@ -255,9 +260,12 @@ export async function build(
       singleInstance: config.singleInstance,
       // Lets a diagnostic build opt in via `devtools.production`; otherwise fully off.
       devtools: config.devtools,
+      // Production: names resolve under the bundle resources directory.
+      resources: Object.fromEntries(extraResources.map((r) => [r.name, r.name])),
     }),
     versionJson,
     workers: extraWorkers,
+    extra: extraResources,
   };
   const { app } = IS_WINDOWS
     ? await buildWindowsBundle({

package/src/bundle/linux/app.ts

@@ -61,6 +61,8 @@ export interface LinuxBundleOptions {
     versionJson?: string; // serialized version.json → resources/version.json (updater)
     sidecars?: { name: string; src: string }[]; // → resources/sidecars/<name>
     workers?: Record<string, string>; // name → abs path → resources/workers/<name>.js
+    /** Extra resource directories (name -> abs dir) copied verbatim -> resources/<name>. */
+    extra?: { name: string; src: string }[];
   };
 }
 
@@ -234,6 +236,9 @@ export async function buildLinuxBundle(
         cpSync(src, join(workersDir, `${name}.js`));
       }
     }
+    for (const extra of opts.resources?.extra ?? []) {
+      cpSync(extra.src, join(res, extra.name), { recursive: true });
+    }
     if (opts.resources.sidecars?.length) {
       const sidecarsDir = join(res, "sidecars");
       mkdirSync(sidecarsDir, { recursive: true });

package/src/bundle/macos/app.ts

@@ -24,6 +24,7 @@ import { join } from "node:path";
 import { $ } from "bun";
 import { isIconComposerDoc, writeAppearanceCatalog } from "../../icons/macos/index.ts";
 import { pruneMacCefLocales } from "../shared/cef-locales.ts";
+import { findMachOFiles } from "./macho.ts";
 
 const FRAMEWORK = "Chromium Embedded Framework.framework";
 
@@ -68,6 +69,8 @@ export interface BundleOptions {
     sidecars?: SidecarBundle[];
     /** Compiled extra-worker JS (name -> abs path) -> Resources/workers/<name>.js. */
     workers?: Record<string, string>;
+    /** Extra resource directories (name -> abs dir) copied verbatim -> Resources/<name>. */
+    extra?: { name: string; src: string }[];
   };
 }
 
@@ -292,6 +295,15 @@ export async function buildAppBundle(opts: BundleOptions): Promise<{ app: string
       cpSync(src, join(workersDir, `${name}.js`));
     }
   }
+  // Extra resource dirs -> Resources/<name>. Any Mach-O inside (a bundled server's
+  // native addons, helper executables) is signed below: notarization rejects
+  // unsigned code anywhere in the bundle.
+  const extraDirs: string[] = [];
+  for (const extra of opts.resources?.extra ?? []) {
+    const dest = join(resources, extra.name);
+    cpSync(extra.src, dest, { recursive: true });
+    extraDirs.push(dest);
+  }
   // Sidecar binaries -> Resources/sidecars/<name> (chmod +x; signed below). Paths
   // collected here so the codesign loop can sign them inside-out with the app.
   const sidecarDests: SidecarBundle[] = [];
@@ -385,6 +397,10 @@ export async function buildAppBundle(opts: BundleOptions): Promise<{ app: string
         await sign(sc.src);
       }
     }
+    // 3c. Mach-O files shipped inside resource dirs (.node addons, dylibs, CLIs).
+    for (const dir of extraDirs) {
+      for (const binary of findMachOFiles(dir)) await sign(binary);
+    }
     // 4. each helper: the inner executable, then the .app wrapper (entitlements
     //    on both — the renderer/GPU helpers are what actually JIT).
     for (const { suffix } of HELPER_TYPES) {

package/src/bundle/macos/index.ts

@@ -1 +1,2 @@
 export * from "./app.ts";
+export { stampMacSdk } from "./sdk-stamp.ts";

package/src/bundle/macos/macho.ts

@@ -0,0 +1,42 @@
+import { closeSync, lstatSync, openSync, readdirSync, readSync } from "node:fs";
+import { join } from "node:path";
+
+// Thin (LE/BE, 32/64-bit) and fat Mach-O magics. A fat header shares 0xCAFEBABE
+// with Java class files; `nfat_arch` separates them (a class file has a version there).
+const THIN_MAGICS = new Set([0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe]);
+const FAT_MAGICS = new Set([0xcafebabe, 0xcafebabf]);
+const MAX_FAT_ARCHS = 32;
+
+/** True when the file starts with a Mach-O header (thin or fat), regardless of extension. */
+export function isMachO(path: string): boolean {
+  const fd = openSync(path, "r");
+  try {
+    const header = Buffer.alloc(8);
+    if (readSync(fd, header, 0, 8, 0) < 8) return false;
+    const magic = header.readUInt32BE(0);
+    if (THIN_MAGICS.has(magic)) return true;
+    if (!FAT_MAGICS.has(magic)) return false;
+    const archCount = header.readUInt32BE(4);
+    return archCount > 0 && archCount <= MAX_FAT_ARCHS;
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** Every regular Mach-O file under `root` (symlinks skipped), sorted for stable signing. */
+export function findMachOFiles(root: string): string[] {
+  const found: string[] = [];
+  const walk = (dir: string) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const path = join(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        walk(path);
+        continue;
+      }
+      if (entry.isFile() && lstatSync(path).size >= 8 && isMachO(path)) found.push(path);
+    }
+  };
+  walk(root);
+  return found.sort();
+}

package/src/bundle/macos/sdk-stamp.ts

@@ -0,0 +1,38 @@
+/**
+ * Stamp the compiled host with the macOS 26 SDK version.
+ *
+ * `bun build --compile` clones the Bun runtime binary, so the host inherits
+ * Bun's LC_BUILD_VERSION (SDK 15.x). AppKit gates the macOS 26 window design
+ * ("linked-on-or-after") on the MAIN executable's SDK, which leaves mirin apps
+ * with the pre-Tahoe compatibility chrome — flat traffic lights, old window
+ * metrics. Rewriting the load command opts the app into the current design.
+ * Must run before codesigning; vtool invalidates the signature.
+ */
+
+import { existsSync, renameSync } from "node:fs";
+import { $ } from "bun";
+
+/** Matches the LSMinimumSystemVersion mirin writes into Info.plist. */
+const MIN_OS = "13.0";
+/** The design-gate threshold; the number is declarative, no SDK needs to exist locally. */
+const SDK = "26.0";
+
+/** Best-effort: a missing vtool (bare machines) keeps Bun's original header. */
+export async function stampMacSdk(hostExe: string): Promise<void> {
+  if (process.platform !== "darwin") return;
+  if (!Bun.which("vtool")) {
+    console.warn("[mirin] vtool not found — the app keeps the compatibility window design.");
+    return;
+  }
+  const out = `${hostExe}.sdkstamp`;
+  const res =
+    await $`vtool -set-build-version macos ${MIN_OS} ${SDK} -replace -output ${out} ${hostExe}`
+      .nothrow()
+      .quiet();
+  if (res.exitCode !== 0 || !existsSync(out)) {
+    console.warn(`[mirin] vtool failed (exit ${res.exitCode}) — keeping Bun's SDK header.`);
+    return;
+  }
+  renameSync(out, hostExe);
+  await $`chmod +x ${hostExe}`.quiet();
+}

package/src/bundle/windows/app.ts

@@ -48,6 +48,8 @@ export interface WinBundleOptions {
     versionJson?: string; // serialized version.json → resources/version.json (updater)
     sidecars?: { name: string; src: string }[]; // → resources/sidecars/<name>
     workers?: Record<string, string>; // name → abs path → resources/workers/<name>.js
+    /** Extra resource directories (name -> abs dir) copied verbatim -> resources/<name>. */
+    extra?: { name: string; src: string }[];
   };
 }
 
@@ -94,6 +96,9 @@ export async function buildWindowsBundle(
         cpSync(src, join(workersDir, `${name}.js`));
       }
     }
+    for (const extra of opts.resources?.extra ?? []) {
+      cpSync(extra.src, join(res, extra.name), { recursive: true });
+    }
     if (opts.resources.sidecars?.length) {
       const sidecarsDir = join(res, "sidecars");
       mkdirSync(sidecarsDir, { recursive: true });

package/src/dev.ts

@@ -23,13 +23,13 @@ import {
   resolveLinuxDesktopIconPng,
   resolveLinuxIconPng,
 } from "./bundle/linux/index.ts";
-import { buildAppBundle } from "./bundle/macos/index.ts";
+import { buildAppBundle, stampMacSdk } from "./bundle/macos/index.ts";
 import { buildWindowsBundle } from "./bundle/windows/index.ts";
 
 const IS_WINDOWS = process.platform === "win32";
 const IS_LINUX = process.platform === "linux";
 
-import { compileWorkers, normalizeSidecars } from "./extras.ts";
+import { compileWorkers, normalizeResources, normalizeSidecars } from "./extras.ts";
 import { resolveIconFallback, resolveIconSource } from "./icons/sources.ts";
 import { createReporter } from "./shared/report.ts";
 import { DevSession } from "./shared/session.ts";
@@ -104,6 +104,7 @@ export async function dev(projectDir = process.cwd(), options?: DevOptions): Pro
       projectDir,
     ),
   );
+  await stampMacSdk(hostExe);
   await reporter.build(
     $`bun build ${mainEntry} --target=bun --outfile ${workerJs}`.cwd(projectDir),
   );
@@ -246,6 +247,10 @@ export async function dev(projectDir = process.cwd(), options?: DevOptions): Pro
         id: bundleId,
         windows: config.windows,
         devtools: config.devtools,
+        // Dev: resources resolve straight to their source directories.
+        resources: Object.fromEntries(
+          normalizeResources(projectDir, config.resources).map((r) => [r.name, r.src]),
+        ),
       }),
       // dev: true → enables inspect-element AND gives this run its own `-dev`
       // CEF cache dir, so `mirin dev` can run alongside the installed app.

package/src/extras.ts

@@ -5,7 +5,7 @@
  * place so the two CLI paths stay in sync.
  */
 
-import { mkdirSync } from "node:fs";
+import { mkdirSync, statSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { $ } from "bun";
 import { createReporter, type Reporter } from "./shared/report.ts";
@@ -13,6 +13,13 @@ import { createReporter, type Reporter } from "./shared/report.ts";
 /** Config shapes (mirrors packages/mirin/src/config/index.ts; CLI can't import the runtime). */
 export type SidecarConfig = Record<string, string | { bin: string; entitlements?: string[] }>;
 export type WorkersConfig = Record<string, string>;
+export type ResourcesConfig = Record<string, string>;
+
+/** A resource directory resolved to an absolute source path. */
+export interface NormalizedResource {
+  name: string;
+  src: string;
+}
 
 /** A sidecar resolved to an absolute source path + its requested entitlements. */
 export interface NormalizedSidecar {
@@ -53,6 +60,25 @@ function projectRelativePath(projectDir: string, file: string, label: string): s
   return full;
 }
 
+/** Resolve `config.resources` to absolute source directories. */
+export function normalizeResources(
+  projectDir: string,
+  resources: ResourcesConfig | undefined,
+): NormalizedResource[] {
+  return Object.entries(resources ?? {}).map(([name, dir]) => {
+    const safeName = safeExtraAssetName(name, "resource name");
+    const src = projectRelativePath(projectDir, dir, `resource "${safeName}" path`);
+    let isDirectory = false;
+    try {
+      isDirectory = statSync(src).isDirectory();
+    } catch {
+      isDirectory = false;
+    }
+    if (!isDirectory) throw new Error(`[mirin] resource "${safeName}" is not a directory: ${dir}`);
+    return { name: safeName, src };
+  });
+}
+
 /** Resolve `config.sidecars` to absolute source paths. */
 export function normalizeSidecars(
   projectDir: string,