@mirinjs/cli 0.1.0-alpha.25 → 0.1.0-alpha.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mirinjs/cli",
-  "version": "0.1.0-alpha.25",
+  "version": "0.1.0-alpha.27",
   "description": "CLI for mirin apps: dev, build, init.",
   "type": "module",
   "license": "MIT",
@@ -27,15 +27,15 @@
     "bun": ">=1.2.0"
   },
   "dependencies": {
-    "create-mirinjs": "0.1.0-alpha.25",
-    "mirinjs": "0.1.0-alpha.25"
+    "create-mirinjs": "0.1.0-alpha.27",
+    "mirinjs": "0.1.0-alpha.27"
   },
   "optionalDependencies": {
-    "@mirinjs/darwin-arm64": "0.1.0-alpha.25",
-    "@mirinjs/win32-x64": "0.1.0-alpha.25",
-    "@mirinjs/win32-arm64": "0.1.0-alpha.25",
-    "@mirinjs/linux-arm64": "0.1.0-alpha.25",
-    "@mirinjs/linux-x64": "0.1.0-alpha.25"
+    "@mirinjs/darwin-arm64": "0.1.0-alpha.27",
+    "@mirinjs/win32-x64": "0.1.0-alpha.27",
+    "@mirinjs/win32-arm64": "0.1.0-alpha.27",
+    "@mirinjs/linux-arm64": "0.1.0-alpha.27",
+    "@mirinjs/linux-x64": "0.1.0-alpha.27"
   },
   "publishConfig": {
     "access": "public"

package/src/build.ts

@@ -9,6 +9,8 @@
  * from inside the bundle, and webviews load their `app://` URLs served from
  * Contents/Resources by the native scheme handler.
  *
+ * Release channel / feed: MIRIN_RELEASE_CHANNEL and MIRIN_RELEASE_BASE_URL override
+ * config.release so one config can produce stable and nightly builds.
  * Codesign identity: ad-hoc by default; set MIRIN_SIGN_IDENTITY to a Developer
  * ID to produce a distributable, notarizable app.
  */
@@ -21,7 +23,7 @@ import { buildLinuxBundle } from "./bundle/linux/index.ts";
 import { buildAppBundle, stampMacSdk } from "./bundle/macos/index.ts";
 import { normalizeCefLocales } from "./bundle/shared/cef-locales.ts";
 import { buildWindowsBundle } from "./bundle/windows/index.ts";
-import { compileWorkers, normalizeSidecars } from "./extras.ts";
+import { compileWorkers, normalizeResources, normalizeSidecars } from "./extras.ts";
 import { resolveIconFallback, resolveIconSource } from "./icons/sources.ts";
 import { makeWindowsIcon } from "./icons/windows/index.ts";
 import { buildLinuxPackages, resolveLinuxFormats } from "./package/linux/index.ts";
@@ -186,8 +188,9 @@ export async function build(
   const bundleId: string = config.id ?? "dev.mirin.app";
   const mainEntry = join(projectDir, config.main ?? "main/main.ts");
   const version = opts.version ?? appVersion(projectDir);
-  const channel: string = config.release?.channel ?? "stable";
-  const baseUrl: string | undefined = config.release?.baseUrl;
+  // A release pipeline builds several channels from one config: the env wins.
+  const channel: string = process.env.MIRIN_RELEASE_CHANNEL || config.release?.channel || "stable";
+  const baseUrl: string | undefined = process.env.MIRIN_RELEASE_BASE_URL || config.release?.baseUrl;
   const releaseNotes: string | undefined = config.release?.notes;
   const dmg: boolean | import("mirinjs").DmgConfig = config.dmg ?? true;
   const nsis: boolean | import("mirinjs").NsisConfig = config.nsis ?? true;
@@ -209,10 +212,12 @@ export async function build(
 
   // Host compilation, main Worker bundling, and extra Worker bundling are independent.
   console.log("[mirin build] compiling host + bundling workers…");
-  const signIdentity = process.env.MIRIN_SIGN_IDENTITY;
+  // An empty value (a CI job that exports it unconditionally) means ad-hoc, not an identity named "".
+  const signIdentity = process.env.MIRIN_SIGN_IDENTITY || undefined;
   const hostExe = join(work, IS_WINDOWS ? "host-release.exe" : "host-release");
   const workerJs = join(work, "worker.release.js");
   const sidecars = normalizeSidecars(projectDir, config.sidecars);
+  const extraResources = normalizeResources(projectDir, config.resources);
   const hostBuild = (async (): Promise<void> => {
     // Bun's Windows arm64 build currently has no bun:ffi/TinyCC runtime. The
     // win32-arm64 Mirin package therefore carries an x64 compatibility payload,
@@ -256,9 +261,12 @@ export async function build(
       singleInstance: config.singleInstance,
       // Lets a diagnostic build opt in via `devtools.production`; otherwise fully off.
       devtools: config.devtools,
+      // Production: names resolve under the bundle resources directory.
+      resources: Object.fromEntries(extraResources.map((r) => [r.name, r.name])),
     }),
     versionJson,
     workers: extraWorkers,
+    extra: extraResources,
   };
   const { app } = IS_WINDOWS
     ? await buildWindowsBundle({

package/src/bundle/linux/app.ts

@@ -61,6 +61,8 @@ export interface LinuxBundleOptions {
     versionJson?: string; // serialized version.json → resources/version.json (updater)
     sidecars?: { name: string; src: string }[]; // → resources/sidecars/<name>
     workers?: Record<string, string>; // name → abs path → resources/workers/<name>.js
+    /** Extra resource directories (name -> abs dir) copied verbatim -> resources/<name>. */
+    extra?: { name: string; src: string }[];
   };
 }
 
@@ -234,6 +236,9 @@ export async function buildLinuxBundle(
         cpSync(src, join(workersDir, `${name}.js`));
       }
     }
+    for (const extra of opts.resources?.extra ?? []) {
+      cpSync(extra.src, join(res, extra.name), { recursive: true });
+    }
     if (opts.resources.sidecars?.length) {
       const sidecarsDir = join(res, "sidecars");
       mkdirSync(sidecarsDir, { recursive: true });

package/src/bundle/macos/app.ts

@@ -24,6 +24,7 @@ import { join } from "node:path";
 import { $ } from "bun";
 import { isIconComposerDoc, writeAppearanceCatalog } from "../../icons/macos/index.ts";
 import { pruneMacCefLocales } from "../shared/cef-locales.ts";
+import { findMachOFiles } from "./macho.ts";
 
 const FRAMEWORK = "Chromium Embedded Framework.framework";
 
@@ -68,6 +69,8 @@ export interface BundleOptions {
     sidecars?: SidecarBundle[];
     /** Compiled extra-worker JS (name -> abs path) -> Resources/workers/<name>.js. */
     workers?: Record<string, string>;
+    /** Extra resource directories (name -> abs dir) copied verbatim -> Resources/<name>. */
+    extra?: { name: string; src: string }[];
   };
 }
 
@@ -292,6 +295,15 @@ export async function buildAppBundle(opts: BundleOptions): Promise<{ app: string
       cpSync(src, join(workersDir, `${name}.js`));
     }
   }
+  // Extra resource dirs -> Resources/<name>. Any Mach-O inside (a bundled server's
+  // native addons, helper executables) is signed below: notarization rejects
+  // unsigned code anywhere in the bundle.
+  const extraDirs: string[] = [];
+  for (const extra of opts.resources?.extra ?? []) {
+    const dest = join(resources, extra.name);
+    cpSync(extra.src, dest, { recursive: true });
+    extraDirs.push(dest);
+  }
   // Sidecar binaries -> Resources/sidecars/<name> (chmod +x; signed below). Paths
   // collected here so the codesign loop can sign them inside-out with the app.
   const sidecarDests: SidecarBundle[] = [];
@@ -385,6 +397,10 @@ export async function buildAppBundle(opts: BundleOptions): Promise<{ app: string
         await sign(sc.src);
       }
     }
+    // 3c. Mach-O files shipped inside resource dirs (.node addons, dylibs, CLIs).
+    for (const dir of extraDirs) {
+      for (const binary of findMachOFiles(dir)) await sign(binary);
+    }
     // 4. each helper: the inner executable, then the .app wrapper (entitlements
     //    on both — the renderer/GPU helpers are what actually JIT).
     for (const { suffix } of HELPER_TYPES) {

package/src/bundle/macos/macho.ts

@@ -0,0 +1,42 @@
+import { closeSync, lstatSync, openSync, readdirSync, readSync } from "node:fs";
+import { join } from "node:path";
+
+// Thin (LE/BE, 32/64-bit) and fat Mach-O magics. A fat header shares 0xCAFEBABE
+// with Java class files; `nfat_arch` separates them (a class file has a version there).
+const THIN_MAGICS = new Set([0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe]);
+const FAT_MAGICS = new Set([0xcafebabe, 0xcafebabf]);
+const MAX_FAT_ARCHS = 32;
+
+/** True when the file starts with a Mach-O header (thin or fat), regardless of extension. */
+export function isMachO(path: string): boolean {
+  const fd = openSync(path, "r");
+  try {
+    const header = Buffer.alloc(8);
+    if (readSync(fd, header, 0, 8, 0) < 8) return false;
+    const magic = header.readUInt32BE(0);
+    if (THIN_MAGICS.has(magic)) return true;
+    if (!FAT_MAGICS.has(magic)) return false;
+    const archCount = header.readUInt32BE(4);
+    return archCount > 0 && archCount <= MAX_FAT_ARCHS;
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** Every regular Mach-O file under `root` (symlinks skipped), sorted for stable signing. */
+export function findMachOFiles(root: string): string[] {
+  const found: string[] = [];
+  const walk = (dir: string) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const path = join(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        walk(path);
+        continue;
+      }
+      if (entry.isFile() && lstatSync(path).size >= 8 && isMachO(path)) found.push(path);
+    }
+  };
+  walk(root);
+  return found.sort();
+}

package/src/bundle/windows/app.ts

@@ -48,6 +48,8 @@ export interface WinBundleOptions {
     versionJson?: string; // serialized version.json → resources/version.json (updater)
     sidecars?: { name: string; src: string }[]; // → resources/sidecars/<name>
     workers?: Record<string, string>; // name → abs path → resources/workers/<name>.js
+    /** Extra resource directories (name -> abs dir) copied verbatim -> resources/<name>. */
+    extra?: { name: string; src: string }[];
   };
 }
 
@@ -94,6 +96,9 @@ export async function buildWindowsBundle(
         cpSync(src, join(workersDir, `${name}.js`));
       }
     }
+    for (const extra of opts.resources?.extra ?? []) {
+      cpSync(extra.src, join(res, extra.name), { recursive: true });
+    }
     if (opts.resources.sidecars?.length) {
       const sidecarsDir = join(res, "sidecars");
       mkdirSync(sidecarsDir, { recursive: true });

package/src/dev.ts

@@ -29,7 +29,7 @@ import { buildWindowsBundle } from "./bundle/windows/index.ts";
 const IS_WINDOWS = process.platform === "win32";
 const IS_LINUX = process.platform === "linux";
 
-import { compileWorkers, normalizeSidecars } from "./extras.ts";
+import { compileWorkers, normalizeResources, normalizeSidecars } from "./extras.ts";
 import { resolveIconFallback, resolveIconSource } from "./icons/sources.ts";
 import { createReporter } from "./shared/report.ts";
 import { DevSession } from "./shared/session.ts";
@@ -247,6 +247,10 @@ export async function dev(projectDir = process.cwd(), options?: DevOptions): Pro
         id: bundleId,
         windows: config.windows,
         devtools: config.devtools,
+        // Dev: resources resolve straight to their source directories.
+        resources: Object.fromEntries(
+          normalizeResources(projectDir, config.resources).map((r) => [r.name, r.src]),
+        ),
       }),
       // dev: true → enables inspect-element AND gives this run its own `-dev`
       // CEF cache dir, so `mirin dev` can run alongside the installed app.

package/src/extras.ts

@@ -5,7 +5,7 @@
  * place so the two CLI paths stay in sync.
  */
 
-import { mkdirSync } from "node:fs";
+import { mkdirSync, statSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { $ } from "bun";
 import { createReporter, type Reporter } from "./shared/report.ts";
@@ -13,6 +13,13 @@ import { createReporter, type Reporter } from "./shared/report.ts";
 /** Config shapes (mirrors packages/mirin/src/config/index.ts; CLI can't import the runtime). */
 export type SidecarConfig = Record<string, string | { bin: string; entitlements?: string[] }>;
 export type WorkersConfig = Record<string, string>;
+export type ResourcesConfig = Record<string, string>;
+
+/** A resource directory resolved to an absolute source path. */
+export interface NormalizedResource {
+  name: string;
+  src: string;
+}
 
 /** A sidecar resolved to an absolute source path + its requested entitlements. */
 export interface NormalizedSidecar {
@@ -53,6 +60,25 @@ function projectRelativePath(projectDir: string, file: string, label: string): s
   return full;
 }
 
+/** Resolve `config.resources` to absolute source directories. */
+export function normalizeResources(
+  projectDir: string,
+  resources: ResourcesConfig | undefined,
+): NormalizedResource[] {
+  return Object.entries(resources ?? {}).map(([name, dir]) => {
+    const safeName = safeExtraAssetName(name, "resource name");
+    const src = projectRelativePath(projectDir, dir, `resource "${safeName}" path`);
+    let isDirectory = false;
+    try {
+      isDirectory = statSync(src).isDirectory();
+    } catch {
+      isDirectory = false;
+    }
+    if (!isDirectory) throw new Error(`[mirin] resource "${safeName}" is not a directory: ${dir}`);
+    return { name: safeName, src };
+  });
+}
+
 /** Resolve `config.sidecars` to absolute source paths. */
 export function normalizeSidecars(
   projectDir: string,