@nativedesktop/cli 0.1.0

package/src/package/linux.ts

@@ -0,0 +1,87 @@
+// Linux packaging: assembles a self-contained AppDir (generated AppRun +
+// .desktop + icons + mime XML, the gtk host binary, bundled Bun, the app
+// payload), then packs it into an AppImage with appimagetool, falling back to
+// mksquashfs when appimagetool isn't on PATH.
+import { $ } from "bun";
+import { chmodSync, cpSync, mkdirSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { resolveHostBinary } from "@nativedesktop/host";
+import type { NativeDesktopConfig } from "../config.ts";
+import { installLinuxIcon } from "./icons.ts";
+import { buildAppRun, buildDesktopEntry, buildMimeInfoXml, type ResolvedIdentity } from "./identity.ts";
+import { assemblePayload } from "./payload.ts";
+import { maybePublishUpdate } from "./updates.ts";
+import type { PackageOptions, PackageResult } from "./index.ts";
+
+export async function packageLinuxApp(
+  appDir: string,
+  config: NativeDesktopConfig,
+  identity: ResolvedIdentity,
+  outDir: string,
+  options: PackageOptions,
+): Promise<PackageResult> {
+  const linux = config.package?.linux;
+  const dist = join(outDir, "linux");
+  const appdir = join(dist, "AppDir");
+  if (linux?.appDirTemplate) {
+    cpSync(resolve(appDir, linux.appDirTemplate), appdir, { recursive: true });
+  }
+  mkdirSync(join(appdir, "usr", "bin"), { recursive: true });
+
+  const payload = await assemblePayload({
+    appDir,
+    config,
+    identity,
+    appRoot: join(appdir, "app"),
+    entry: options.entry,
+    compile: options.compile,
+  });
+
+  writeFileSync(join(appdir, "AppRun"), buildAppRun({
+    entry: payload.entry,
+    cwd: payload.cwd,
+    slug: identity.slug,
+    appId: identity.id,
+    pluginPaths: payload.pluginPaths,
+  }));
+  chmodSync(join(appdir, "AppRun"), 0o755);
+  writeFileSync(join(appdir, `${identity.slug}.desktop`), buildDesktopEntry(identity, linux));
+  await installLinuxIcon(identity, appDir, appdir);
+  const mimeXml = buildMimeInfoXml({ fileAssociations: identity.fileAssociations });
+  if (mimeXml) {
+    if (!identity.id) throw new Error("nd: mimeType'd file associations need app.id (the shared-mime-info package name)");
+    mkdirSync(join(appdir, "usr/share/mime/packages"), { recursive: true });
+    writeFileSync(join(appdir, `usr/share/mime/packages/${identity.id}.xml`), mimeXml);
+  }
+
+  const hostBinary = await resolveHostBinary({ backend: "gtk" });
+  const exe = join(appdir, "usr", "bin", identity.slug);
+  cpSync(hostBinary, exe, { dereference: true });
+  chmodSync(exe, 0o755);
+  const bunPath = config.package?.bunPath ?? Bun.which("bun");
+  if (!bunPath) throw new Error("nd: bun not found on PATH");
+  // dereference: true - `bun` on PATH is frequently a nix-store symlink.
+  cpSync(bunPath, join(appdir, "usr", "bin", "bun"), { dereference: true });
+  chmodSync(join(appdir, "usr", "bin", "bun"), 0o755);
+
+  let bundlePath = appdir;
+  const format = options.format ?? linux?.format ?? "appimage";
+  if (format === "appimage") {
+    const appImage = join(dist, `${identity.name}-${identity.version}.AppImage`);
+    await $`appimagetool ${appdir} ${appImage}`.quiet()
+      .catch(async () => { await $`mksquashfs ${appdir} ${appImage} -root-owned -noappend`.quiet(); });
+    console.error(`ND_PACKAGE_APPIMAGE ${appImage}`);
+    bundlePath = appImage;
+  }
+
+  const update = await maybePublishUpdate(config.package?.updates, {
+    identity,
+    platform: "linux",
+    distDir: dist,
+    member: "AppDir",
+    outDir,
+  });
+
+  console.error(`ND_PACKAGE_OK ${bundlePath}`);
+  return { bundlePath, updateManifest: update?.manifestPath, publicKey: update?.publicKey };
+}

package/src/package/mac.test.ts

@@ -0,0 +1,18 @@
+// Notarization gating: an explicit flag/config wins; the auto default must
+// not submit an unsigned bundle even with Apple credentials exported.
+import { describe, expect, test } from "bun:test";
+import { resolveNotarize } from "./mac.ts";
+
+describe("resolveNotarize", () => {
+  test("auto notarizes only with credentials AND a signed bundle", () => {
+    expect(resolveNotarize(undefined, true, true)).toBe(true);
+    expect(resolveNotarize(undefined, true, false)).toBe(false);
+    expect(resolveNotarize(undefined, false, true)).toBe(false);
+    expect(resolveNotarize(undefined, false, false)).toBe(false);
+  });
+
+  test("an explicit request or refusal wins over the auto default", () => {
+    expect(resolveNotarize(true, false, false)).toBe(true);
+    expect(resolveNotarize(false, true, true)).toBe(false);
+  });
+});

package/src/package/mac.ts

@@ -0,0 +1,113 @@
+// macOS packaging: assembles <Name>.app around the resolved host binary +
+// bundled Bun + the app payload, deep-signs inside-out (ad-hoc by default;
+// Developer-ID via config/APPLE_SIGN_IDENTITY) with the hardened runtime +
+// allow-jit entitlements, and gates notarization on Apple credential presence.
+import { $ } from "bun";
+import { chmodSync, cpSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { resolveHostBinary } from "@nativedesktop/host";
+import type { NativeDesktopConfig } from "../config.ts";
+import { installMacIcon } from "./icons.ts";
+import { buildInfoPlist, type ResolvedIdentity } from "./identity.ts";
+import { assemblePayload } from "./payload.ts";
+import { ENTITLEMENTS_PLIST } from "./templates.ts";
+import { maybePublishUpdate } from "./updates.ts";
+import type { PackageOptions, PackageResult } from "./index.ts";
+
+/** Notarization decision: an explicit flag/config wins; the auto default needs credentials AND a signed bundle. */
+export function resolveNotarize(explicit: boolean | undefined, creds: boolean, signed: boolean): boolean {
+  return explicit ?? (creds && signed);
+}
+
+export async function packageMacApp(
+  appDir: string,
+  config: NativeDesktopConfig,
+  identity: ResolvedIdentity,
+  outDir: string,
+  options: PackageOptions,
+): Promise<PackageResult> {
+  const mac = config.package?.mac;
+  const dist = join(outDir, "mac");
+  const app = join(dist, `${identity.name}.app`);
+  const c = join(app, "Contents");
+  mkdirSync(join(c, "MacOS"), { recursive: true });
+  mkdirSync(join(c, "Resources"), { recursive: true });
+  mkdirSync(join(c, "Frameworks"), { recursive: true });
+
+  await assemblePayload({
+    appDir,
+    config,
+    identity,
+    appRoot: join(c, "Resources", "app"),
+    entry: options.entry,
+    compile: options.compile,
+  });
+
+  const hostBinary = await resolveHostBinary({ backend: mac?.backend ?? "appkit" });
+  const exe = join(c, "MacOS", identity.name);
+  cpSync(hostBinary, exe, { dereference: true });
+  chmodSync(exe, 0o755);
+  const bunPath = config.package?.bunPath ?? Bun.which("bun");
+  if (!bunPath) throw new Error("nd: bun not found on PATH");
+  // dereference: true - `bun` on PATH is frequently a symlink into a read-only
+  // nix store; copying the link itself would leave a dangling/unwritable entry
+  // once relocated into the .app (chmod EPERM on the nix store target).
+  cpSync(bunPath, join(c, "MacOS", "bun"), { dereference: true });
+  chmodSync(join(c, "MacOS", "bun"), 0o755);
+
+  const iconFile = await installMacIcon(identity, appDir, join(c, "Resources"));
+  const customXml = mac?.infoPlist ? readFileSync(resolve(appDir, mac.infoPlist), "utf8") : undefined;
+  writeFileSync(join(c, "Info.plist"), buildInfoPlist(identity, mac, customXml, iconFile));
+
+  // Signing identity: --sign wins, then config, then env, then ad-hoc.
+  // --no-sign (signIdentity === null) skips codesign entirely.
+  const sign = options.signIdentity !== undefined
+    ? options.signIdentity
+    : mac?.signIdentity ?? process.env.APPLE_SIGN_IDENTITY ?? "-";
+  if (sign !== null) {
+    const ent = mac?.entitlements ? resolve(appDir, mac.entitlements) : join(dist, "entitlements.plist");
+    if (!mac?.entitlements) writeFileSync(ent, ENTITLEMENTS_PLIST);
+    // Deep-sign inside-out: nested Mach-O first, the .app last. `bun` is the
+    // process that actually needs allow-jit.
+    const nativeDir = join(c, "Resources", "app", "native");
+    const plugins = existsSync(nativeDir)
+      ? [...new Bun.Glob("*.dylib").scanSync({ cwd: nativeDir, absolute: true })].sort()
+      : [];
+    for (const nested of [join(c, "MacOS", "bun"), exe, ...plugins]) {
+      await $`codesign --force --options runtime --entitlements ${ent} --sign ${sign} ${nested}`;
+    }
+    await $`codesign --force --deep --options runtime --entitlements ${ent} --sign ${sign} ${app}`;
+    await $`codesign --verify --strict ${app}`;
+    console.error(`ND_PACKAGE_APP_SIGNED ${app} identity=${sign === "-" ? "adhoc" : "developer-id"}`);
+  }
+
+  // Notarization: explicit --notarize/--no-notarize/config wins; the default
+  // is auto (run only when all three Apple credentials are present AND the
+  // bundle was signed - Apple rejects unsigned submissions outright).
+  const { APPLE_ID, APPLE_TEAM_ID, APPLE_APP_PASSWORD } = process.env;
+  const creds = !!(APPLE_ID && APPLE_TEAM_ID && APPLE_APP_PASSWORD);
+  const notarize = resolveNotarize(options.notarize ?? mac?.notarize, creds, sign !== null);
+  if (notarize && sign === null) throw new Error("nd: notarize requested but signing is disabled (--no-sign)");
+  if (notarize && !creds) throw new Error("nd: notarize requested but APPLE_ID/APPLE_TEAM_ID/APPLE_APP_PASSWORD are not all set");
+  if (notarize) {
+    const zip = join(dist, `${identity.name}.zip`);
+    await $`ditto -c -k --keepParent ${app} ${zip}`;
+    await $`xcrun notarytool submit ${zip} --apple-id ${APPLE_ID} --team-id ${APPLE_TEAM_ID} --password ${APPLE_APP_PASSWORD} --wait`;
+    await $`xcrun stapler staple ${app}`;
+    console.error(`ND_PACKAGE_NOTARIZE_OK ${app}`);
+  } else {
+    const reason = options.notarize === false || mac?.notarize === false ? "disabled" : sign === null ? "unsigned" : "no-credentials";
+    console.error(`ND_PACKAGE_NOTARIZE_SKIPPED reason=${reason}`);
+  }
+
+  const update = await maybePublishUpdate(config.package?.updates, {
+    identity,
+    platform: "mac",
+    distDir: dist,
+    member: `${identity.name}.app`,
+    outDir,
+  });
+
+  console.error(`ND_PACKAGE_OK ${app}`);
+  return { bundlePath: app, updateManifest: update?.manifestPath, publicKey: update?.publicKey };
+}

package/src/package/modules.test.ts

@@ -0,0 +1,145 @@
+// flattenRuntimeModules against a Bun-isolated-store-shaped fixture: packages
+// live under node_modules/.bun/<pkg>@<ver>/node_modules/<pkg> with sibling
+// symlinks for their deps, and the app's node_modules only symlinks its direct
+// deps. The flattener must produce one flat, real-file node_modules.
+import { describe, expect, test } from "bun:test";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { assertResolvableEntries, flattenRuntimeModules } from "./modules.ts";
+
+interface FixturePkg {
+  name: string;
+  version: string;
+  dependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
+  main?: string;
+}
+
+/** Creates <root>/node_modules/.bun/<name>@<version>/node_modules/<name>. */
+function storePackage(root: string, pkg: FixturePkg): string {
+  const dir = join(root, "node_modules", ".bun", `${pkg.name}@${pkg.version}`, "node_modules", pkg.name);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, "package.json"), JSON.stringify({ main: "index.js", ...pkg }));
+  writeFileSync(join(dir, pkg.main ?? "index.js"), `module.exports = "${pkg.name}@${pkg.version}";\n`);
+  return dir;
+}
+
+/** Symlinks depName next to the store entry of `fromPkg` (Bun's sibling layout). */
+function storeSibling(root: string, fromPkg: string, depName: string, depDir: string): void {
+  const link = join(root, "node_modules", ".bun", fromPkg, "node_modules", depName);
+  mkdirSync(join(link, ".."), { recursive: true });
+  symlinkSync(depDir, link);
+}
+
+function makeFixture(): { appDir: string; root: string } {
+  const root = mkdtempSync(join(tmpdir(), "nd-modules-"));
+  const appDir = join(root, "app");
+  mkdirSync(appDir, { recursive: true });
+  writeFileSync(join(appDir, "package.json"), JSON.stringify({
+    name: "fixture-app",
+    dependencies: { "dep-a": "1.0.0", "dep-c": "1.0.0" },
+  }));
+
+  const depA = storePackage(root, { name: "dep-a", version: "1.0.0", dependencies: { "dep-b": "1.0.0" } });
+  const depB1 = storePackage(root, { name: "dep-b", version: "1.0.0" });
+  const depB2 = storePackage(root, { name: "dep-b", version: "2.0.0" });
+  const depC = storePackage(root, { name: "dep-c", version: "1.0.0", dependencies: { "dep-b": "2.0.0" } });
+  storeSibling(root, "dep-a@1.0.0", "dep-b", depB1);
+  storeSibling(root, "dep-c@1.0.0", "dep-b", depB2);
+
+  mkdirSync(join(appDir, "node_modules"), { recursive: true });
+  symlinkSync(depA, join(appDir, "node_modules", "dep-a"));
+  symlinkSync(depC, join(appDir, "node_modules", "dep-c"));
+  return { appDir, root };
+}
+
+describe("flattenRuntimeModules", () => {
+  test("flattens the isolated store into real directories and nests version conflicts", () => {
+    const { appDir, root } = makeFixture();
+    const dest = join(root, "out", "node_modules");
+    const flat = flattenRuntimeModules({ appDir, dest });
+
+    expect(flat.sort()).toEqual(["dep-a", "dep-b", "dep-c"]);
+    for (const name of ["dep-a", "dep-b", "dep-c"]) {
+      const dir = join(dest, name);
+      expect(existsSync(join(dir, "package.json"))).toBe(true);
+      expect(lstatSync(dir).isSymbolicLink()).toBe(false);
+    }
+    // dep-a claimed the flat dep-b@1 slot first; dep-c's dep-b@2 nests.
+    expect(JSON.parse(readFileSync(join(dest, "dep-b", "package.json"), "utf8")).version).toBe("1.0.0");
+    const nested = join(dest, "dep-c", "node_modules", "dep-b", "package.json");
+    expect(existsSync(nested)).toBe(true);
+    expect(JSON.parse(readFileSync(nested, "utf8")).version).toBe("2.0.0");
+  });
+
+  test("terminates on a dependency cycle with version conflicts and reuses reachable copies", () => {
+    // a@1 <-> b@1 at the top, with b@1 -> a@2 -> b@2 -> a@2 cycling on
+    // conflicting versions. Nesting must stop once the needed version already
+    // resolves from an ancestor slot.
+    const root = mkdtempSync(join(tmpdir(), "nd-modules-"));
+    const appDir = join(root, "app");
+    mkdirSync(appDir, { recursive: true });
+    writeFileSync(join(appDir, "package.json"), JSON.stringify({
+      name: "fixture-app",
+      dependencies: { "dep-a": "1.0.0", "dep-b": "1.0.0" },
+    }));
+    const a1 = storePackage(root, { name: "dep-a", version: "1.0.0", dependencies: { "dep-b": "1.0.0" } });
+    const b1 = storePackage(root, { name: "dep-b", version: "1.0.0", dependencies: { "dep-a": "2.0.0" } });
+    const a2 = storePackage(root, { name: "dep-a", version: "2.0.0", dependencies: { "dep-b": "2.0.0" } });
+    const b2 = storePackage(root, { name: "dep-b", version: "2.0.0", dependencies: { "dep-a": "2.0.0" } });
+    storeSibling(root, "dep-a@1.0.0", "dep-b", b1);
+    storeSibling(root, "dep-b@1.0.0", "dep-a", a2);
+    storeSibling(root, "dep-a@2.0.0", "dep-b", b2);
+    storeSibling(root, "dep-b@2.0.0", "dep-a", a2);
+    mkdirSync(join(appDir, "node_modules"), { recursive: true });
+    symlinkSync(a1, join(appDir, "node_modules", "dep-a"));
+    symlinkSync(b1, join(appDir, "node_modules", "dep-b"));
+
+    const dest = join(root, "out", "node_modules");
+    const flat = flattenRuntimeModules({ appDir, dest });
+    expect(flat.sort()).toEqual(["dep-a", "dep-b"]);
+    const version = (p: string) => JSON.parse(readFileSync(join(dest, p, "package.json"), "utf8")).version;
+    expect(version("dep-a")).toBe("1.0.0");
+    expect(version("dep-b")).toBe("1.0.0");
+    expect(version("dep-b/node_modules/dep-a")).toBe("2.0.0");
+    expect(version("dep-b/node_modules/dep-a/node_modules/dep-b")).toBe("2.0.0");
+    // b@2's dep-a@2 resolves via the copy two levels up: no deeper nesting.
+    expect(existsSync(join(dest, "dep-b/node_modules/dep-a/node_modules/dep-b/node_modules/dep-a"))).toBe(false);
+  });
+
+  test("skips unresolvable peer dependencies but throws on a missing hard dependency", () => {
+    const root = mkdtempSync(join(tmpdir(), "nd-modules-"));
+    const appDir = join(root, "app");
+    mkdirSync(appDir, { recursive: true });
+    writeFileSync(join(appDir, "package.json"), JSON.stringify({ name: "a", dependencies: { "dep-p": "1.0.0" } }));
+    const depP = storePackage(root, { name: "dep-p", version: "1.0.0", peerDependencies: { "not-installed": "*" } });
+    mkdirSync(join(appDir, "node_modules"), { recursive: true });
+    symlinkSync(depP, join(appDir, "node_modules", "dep-p"));
+
+    const dest = join(root, "out", "node_modules");
+    expect(flattenRuntimeModules({ appDir, dest }).sort()).toEqual(["dep-p"]);
+
+    writeFileSync(join(appDir, "package.json"), JSON.stringify({ name: "a", dependencies: { "dep-p": "1.0.0", missing: "*" } }));
+    expect(() => flattenRuntimeModules({ appDir, dest: join(root, "out2", "node_modules") }))
+      .toThrow('cannot resolve runtime dependency "missing"');
+  });
+});
+
+describe("assertResolvableEntries", () => {
+  test("throws a build hint when a copied package's entry target is missing", () => {
+    const root = mkdtempSync(join(tmpdir(), "nd-modules-"));
+    const broken = join(root, "node_modules", "needs-build");
+    mkdirSync(broken, { recursive: true });
+    writeFileSync(join(broken, "package.json"), JSON.stringify({ name: "needs-build", main: "./dist/index.js" }));
+    expect(() => assertResolvableEntries(root, ["needs-build"])).toThrow("bun run build");
+  });
+
+  test("tolerates a package that declares no entry point (binary carrier)", () => {
+    const root = mkdtempSync(join(tmpdir(), "nd-modules-"));
+    const carrier = join(root, "node_modules", "host-binary");
+    mkdirSync(carrier, { recursive: true });
+    writeFileSync(join(carrier, "package.json"), JSON.stringify({ name: "host-binary", files: ["bin"] }));
+    expect(() => assertResolvableEntries(root, ["host-binary"])).not.toThrow();
+  });
+});

package/src/package/modules.ts

@@ -0,0 +1,129 @@
+// Runtime node_modules flattening: BFS over the real module graph, copying
+// every package the app can reach at runtime into one flat node_modules that
+// an ordinary upward walk resolves. Subsumes Bun's isolated store
+// (node_modules/.bun/<pkg>/node_modules/<pkg> siblings), workspace symlinks,
+// and file: deps; replaces `bun install` inside the bundle.
+import { cpSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
+import { basename, dirname, join, sep } from "node:path";
+
+interface QueueEntry {
+  spec: string;
+  /** Directory the spec resolves from (the requiring package's real root). */
+  anchor: string;
+  /** Dest-relative dir of the requiring package, for version-conflict nesting. */
+  requirer?: string;
+  optional: boolean;
+}
+
+const skipNodeModules = (src: string) => basename(src) !== "node_modules";
+
+function packageRoot(spec: string, anchor: string): string {
+  // dereference to the real store/workspace directory so two symlinked routes
+  // to the same package compare equal.
+  return realpathSync(dirname(Bun.resolveSync(`${spec}/package.json`, anchor)));
+}
+
+export interface FlattenOptions {
+  /** The app directory whose package.json dependencies seed the walk. */
+  appDir: string;
+  /** Extra seed specifiers (PackageConfig.runtimeDependencies), resolved from appDir. */
+  extraRoots?: string[];
+  /** The flat node_modules directory to populate. */
+  dest: string;
+}
+
+/** Copies the app's runtime dependency closure into `dest`. Returns the flat package names. */
+export function flattenRuntimeModules({ appDir, extraRoots = [], dest }: FlattenOptions): string[] {
+  const appPkg = JSON.parse(readFileSync(join(appDir, "package.json"), "utf8")) as {
+    dependencies?: Record<string, string>;
+  };
+  const anchor = realpathSync(appDir);
+  const queue: QueueEntry[] = [
+    ...Object.keys(appPkg.dependencies ?? {}).map((spec) => ({ spec, anchor, optional: false })),
+    ...extraRoots.map((spec) => ({ spec, anchor, optional: false })),
+  ];
+  // First claim of a name wins the flat slot; a later claim with a different
+  // realpath nests under the requiring package's own node_modules.
+  const claimed = new Map<string, string>();
+  // Conflict copies already made, keyed by dest-relative slot. Consulted up
+  // the requirer chain (Node resolution order) so a dependency cycle whose
+  // version is already reachable stops instead of nesting forever.
+  const nested = new Map<string, string>();
+  const resolvedInDest = (spec: string, requirer: string): string | undefined => {
+    for (let dir = requirer; ; ) {
+      const hit = nested.get(join(dir, "node_modules", spec));
+      if (hit) return hit;
+      const cut = dir.lastIndexOf(`${sep}node_modules${sep}`);
+      if (cut === -1) break;
+      dir = dir.slice(0, cut);
+    }
+    return claimed.get(spec);
+  };
+  mkdirSync(dest, { recursive: true });
+
+  while (queue.length) {
+    const entry = queue.shift()!;
+    let root: string;
+    try {
+      root = packageRoot(entry.spec, entry.anchor);
+    } catch (err) {
+      if (entry.optional) continue;
+      throw new Error(`nd: cannot resolve runtime dependency "${entry.spec}" from ${entry.anchor}: ${err}`);
+    }
+
+    const existing = claimed.get(entry.spec);
+    let destDir: string;
+    if (existing === undefined) {
+      destDir = entry.spec;
+      claimed.set(entry.spec, root);
+    } else if (existing === root) {
+      continue;
+    } else {
+      if (!entry.requirer) throw new Error(`nd: conflicting versions of "${entry.spec}" among the app's direct dependencies`);
+      if (resolvedInDest(entry.spec, entry.requirer) === root) continue;
+      destDir = join(entry.requirer, "node_modules", entry.spec);
+      nested.set(destDir, root);
+    }
+    cpSync(root, join(dest, destDir), { recursive: true, dereference: true, filter: skipNodeModules });
+
+    const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8")) as {
+      dependencies?: Record<string, string>;
+      optionalDependencies?: Record<string, string>;
+      peerDependencies?: Record<string, string>;
+    };
+    for (const spec of Object.keys(pkg.dependencies ?? {})) {
+      queue.push({ spec, anchor: root, requirer: destDir, optional: false });
+    }
+    for (const spec of [...Object.keys(pkg.optionalDependencies ?? {}), ...Object.keys(pkg.peerDependencies ?? {})]) {
+      queue.push({ spec, anchor: root, requirer: destDir, optional: true });
+    }
+  }
+
+  return [...claimed.keys()];
+}
+
+/**
+ * Asserts each flat package's main/exports entry resolves inside the bundle.
+ * Catches a copied-but-unbuilt package (e.g. @nativedesktop/react without its
+ * dist/) before it ships as a broken bundle.
+ */
+export function assertResolvableEntries(appRoot: string, names: string[]): void {
+  for (const name of names) {
+    try {
+      Bun.resolveSync(name, appRoot);
+    } catch {
+      // A package that declares no entry point at all (binary/asset carriers
+      // like the platform host packages) is legitimately unresolvable.
+      const pkg = JSON.parse(readFileSync(join(appRoot, "node_modules", name, "package.json"), "utf8")) as {
+        main?: string;
+        module?: string;
+        exports?: unknown;
+      };
+      if (pkg.main === undefined && pkg.module === undefined && pkg.exports === undefined) continue;
+      throw new Error(
+        `nd: bundled package "${name}" has no resolvable entry (its build output is missing). ` +
+        `Run \`bun run build\` in ${name} and package again.`,
+      );
+    }
+  }
+}

package/src/package/payload.test.ts

@@ -0,0 +1,150 @@
+// Payload assembly units: entry rewriting, workspace mapping, `nd package`
+// arg parsing, and an end-to-end assemblePayload run against a temp fixture.
+import { describe, expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { parsePackageArgs } from "../index.ts";
+import { assemblePayload, compiledEntryFor, workspaceRelative } from "./payload.ts";
+import type { ResolvedIdentity } from "./identity.ts";
+
+describe("compiledEntryFor", () => {
+  test("replaces the first path segment with the compile outDir", () => {
+    expect(compiledEntryFor("src/main.tsx", "dist")).toBe("dist/main.tsx");
+    expect(compiledEntryFor("src/app/main.tsx", "out")).toBe("out/app/main.tsx");
+  });
+
+  test("rejects a root-level entry (nothing to substitute)", () => {
+    expect(() => compiledEntryFor("main.tsx", "dist")).toThrow("compiled entry");
+  });
+});
+
+describe("workspaceRelative", () => {
+  test("maps the app dir to its workspace-relative path", () => {
+    expect(workspaceRelative("/repo", "/repo/examples/gallery")).toBe("examples/gallery");
+    expect(workspaceRelative("/repo/app", "/repo/app")).toBe("");
+  });
+
+  test("rejects an app dir outside the workspace root", () => {
+    expect(() => workspaceRelative("/repo/app", "/elsewhere")).toThrow("outside workspaceRoot");
+  });
+});
+
+describe("parsePackageArgs", () => {
+  test("platform defaults to the host and flags map onto PackageOptions", () => {
+    expect(parsePackageArgs([], "darwin").platform).toBe("mac");
+    expect(parsePackageArgs([], "linux").platform).toBe("linux");
+    const opts = parsePackageArgs(
+      ["linux", "--out", "build", "--entry", "app.tsx", "--version", "2.0.0", "--cwd", "apps/x", "--no-compile", "--format", "appdir"],
+      "darwin",
+    );
+    expect(opts).toEqual({
+      platform: "linux",
+      outDir: "build",
+      entry: "app.tsx",
+      version: "2.0.0",
+      cwd: "apps/x",
+      compile: false,
+      format: "appdir",
+    });
+  });
+
+  test("--sign/--no-sign and --notarize/--no-notarize resolve to identity overrides", () => {
+    expect(parsePackageArgs(["mac", "--sign", "Developer ID"], "darwin").signIdentity).toBe("Developer ID");
+    expect(parsePackageArgs(["mac", "--no-sign"], "darwin").signIdentity).toBeNull();
+    expect(parsePackageArgs(["mac", "--notarize"], "darwin").notarize).toBe(true);
+    expect(parsePackageArgs(["mac", "--no-notarize"], "darwin").notarize).toBe(false);
+  });
+});
+
+describe("assemblePayload", () => {
+  const identity: ResolvedIdentity = {
+    id: "com.example.fixture",
+    name: "Fixture",
+    displayName: "Fixture",
+    slug: "fixture",
+    version: "1.0.0",
+    categories: ["Utility"],
+  };
+
+  test("copies the entry dir, writes nd-app.json, and mirrors the workspace layout", async () => {
+    const root = mkdtempSync(join(tmpdir(), "nd-payload-"));
+    const appDir = join(root, "apps", "fixture");
+    mkdirSync(join(appDir, "src"), { recursive: true });
+    writeFileSync(join(appDir, "package.json"), JSON.stringify({ name: "fixture", version: "1.0.0" }));
+    writeFileSync(join(appDir, "src", "main.tsx"), "export {};\n");
+    mkdirSync(join(root, "shared"), { recursive: true });
+    writeFileSync(join(root, "shared", "util.ts"), "export {};\n");
+
+    const appRoot = join(root, "out", "app");
+    const result = await assemblePayload({
+      appDir,
+      config: { package: { workspaceRoot: "../..", include: ["shared"], compile: false } },
+      identity,
+      appRoot,
+    });
+
+    expect(result).toEqual({ entry: "apps/fixture/src/main.tsx", cwd: "apps/fixture", pluginPaths: [] });
+    expect(existsSync(join(appRoot, "apps/fixture/src/main.tsx"))).toBe(true);
+    expect(existsSync(join(appRoot, "apps/fixture/package.json"))).toBe(true);
+    expect(existsSync(join(appRoot, "shared/util.ts"))).toBe(true);
+    const manifest = JSON.parse(readFileSync(join(appRoot, "nd-app.json"), "utf8"));
+    expect(manifest).toEqual({
+      id: "com.example.fixture",
+      name: "Fixture",
+      version: "1.0.0",
+      entry: "apps/fixture/src/main.tsx",
+      cwd: "apps/fixture",
+      pluginPaths: [],
+    });
+  });
+
+  test("default config: bundle output nested in the compile outDir is not copied into itself", async () => {
+    // The template shape: no `package` block, a `compile` script emitting
+    // dist/, so the bundle output (<appDir>/dist/mac/...) nests inside the
+    // copied entry dir (<appDir>/dist).
+    const appDir = mkdtempSync(join(tmpdir(), "nd-payload-default-"));
+    mkdirSync(join(appDir, "src"), { recursive: true });
+    writeFileSync(join(appDir, "package.json"), JSON.stringify({
+      name: "fixture",
+      version: "1.0.0",
+      scripts: { compile: "mkdir -p dist && cp src/main.tsx dist/main.tsx" },
+    }));
+    writeFileSync(join(appDir, "src", "main.tsx"), "export {};\n");
+
+    // appRoot exactly as mac.ts derives it from the default outDir.
+    const contents = join(appDir, "dist", "mac", "Fixture.app", "Contents");
+    for (const dir of ["MacOS", "Resources", "Frameworks"]) mkdirSync(join(contents, dir), { recursive: true });
+    const appRoot = join(contents, "Resources", "app");
+
+    const result = await assemblePayload({ appDir, config: {}, identity, appRoot });
+
+    expect(result).toEqual({ entry: "dist/main.tsx", cwd: ".", pluginPaths: [] });
+    expect(existsSync(join(appRoot, "dist/main.tsx"))).toBe(true);
+    expect(existsSync(join(appRoot, "package.json"))).toBe(true);
+    expect(existsSync(join(appRoot, "dist", "mac"))).toBe(false);
+  });
+
+  test("root-level entry ships the whole app dir minus node_modules", async () => {
+    const root = mkdtempSync(join(tmpdir(), "nd-payload-"));
+    const appDir = join(root, "app");
+    mkdirSync(join(appDir, "assets"), { recursive: true });
+    mkdirSync(join(appDir, "node_modules", "junk"), { recursive: true });
+    writeFileSync(join(appDir, "package.json"), JSON.stringify({ name: "flat", version: "1.0.0" }));
+    writeFileSync(join(appDir, "main.tsx"), "export {};\n");
+    writeFileSync(join(appDir, "assets", "a.txt"), "a\n");
+
+    const appRoot = join(root, "out", "app");
+    const result = await assemblePayload({
+      appDir,
+      config: { package: { entry: "main.tsx", compile: false } },
+      identity,
+      appRoot,
+    });
+
+    expect(result).toEqual({ entry: "main.tsx", cwd: ".", pluginPaths: [] });
+    expect(existsSync(join(appRoot, "main.tsx"))).toBe(true);
+    expect(existsSync(join(appRoot, "assets/a.txt"))).toBe(true);
+    expect(existsSync(join(appRoot, "node_modules", "junk"))).toBe(false);
+  });
+});