@nativedesktop/cli 0.1.0

package/src/package/payload.ts

@@ -0,0 +1,160 @@
+// Bundle payload assembly: the app-root tree both platform packagers embed
+// (Resources/app on mac, AppDir/app on linux). The app root mirrors the
+// configured workspaceRoot, so the app's own files land at their
+// workspace-relative path and relative imports keep resolving packaged.
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, join, relative, resolve, sep } from "node:path";
+import { buildNativePlugins, type NativeDesktopConfig, type PackageConfig } from "../config.ts";
+import type { ResolvedIdentity } from "./identity.ts";
+import { assertResolvableEntries, flattenRuntimeModules } from "./modules.ts";
+
+export const DEFAULT_ENTRY = "src/main.tsx";
+
+/** The compiled entry: the source entry with its first path segment replaced by the compile outDir. */
+export function compiledEntryFor(entry: string, outDir: string): string {
+  const segments = entry.split("/");
+  if (segments.length < 2) throw new Error(`nd: cannot derive a compiled entry from "${entry}" (set package.compile.entry)`);
+  segments[0] = outDir;
+  return segments.join("/");
+}
+
+/** POSIX-separated path of `to` relative to `from` ("" when equal). Rejects escapes above `from`. */
+export function workspaceRelative(from: string, to: string): string {
+  const rel = relative(from, to);
+  if (rel.startsWith("..")) throw new Error(`nd: app dir ${to} lies outside workspaceRoot ${from}`);
+  return rel.split(sep).join("/");
+}
+
+export interface PayloadResult {
+  /** App-root-relative entry script. */
+  entry: string;
+  /** App-root-relative working directory for the packaged app. */
+  cwd: string;
+  /** App-root-relative native plugin paths. */
+  pluginPaths: string[];
+}
+
+export interface PayloadOptions {
+  appDir: string;
+  config: NativeDesktopConfig;
+  identity: ResolvedIdentity;
+  /** The bundle's app root (Resources/app or AppDir/app). */
+  appRoot: string;
+  /** CLI --entry override (app-relative source entry). */
+  entry?: string;
+  /** false forces raw source (--no-compile). */
+  compile?: boolean;
+}
+
+const skipNodeModules = (src: string) => basename(src) !== "node_modules";
+
+/**
+ * Copies a payload tree without ever descending into the bundle output
+ * (`appRoot`), which nests inside the copied tree under the default config
+ * (compile outDir == package outDir == "dist"). cpSync refuses a destination
+ * inside its source outright, so that case walks the top level by hand.
+ */
+function copyPayloadTree(src: string, dest: string, appRoot: string, filter: (p: string) => boolean): void {
+  const bundle = resolve(appRoot);
+  const containsBundle = (p: string) => {
+    const r = resolve(p);
+    return r === bundle || bundle.startsWith(r + sep);
+  };
+  if (!containsBundle(src)) {
+    cpSync(src, dest, { recursive: true, dereference: true, filter });
+    return;
+  }
+  mkdirSync(dest, { recursive: true });
+  for (const name of readdirSync(src)) {
+    const child = join(src, name);
+    if (!filter(child) || containsBundle(child)) continue;
+    cpSync(child, join(dest, name), { recursive: true, dereference: true, filter });
+  }
+}
+
+async function runCompile(appDir: string, script: string): Promise<void> {
+  const proc = Bun.spawn(["bun", "run", script], {
+    cwd: appDir,
+    env: process.env,
+    stdin: "ignore",
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  if (await proc.exited !== 0) throw new Error(`nd: compile failed (bun run ${script})`);
+}
+
+export async function assemblePayload(o: PayloadOptions): Promise<PayloadResult> {
+  const pkg = o.config.package ?? {};
+  const appDir = resolve(o.appDir);
+  const workspaceRoot = resolve(appDir, pkg.workspaceRoot ?? ".");
+  const appRel = workspaceRelative(workspaceRoot, appDir);
+  const destAppDir = appRel ? join(o.appRoot, appRel) : o.appRoot;
+  const sourceEntry = o.entry ?? pkg.entry ?? DEFAULT_ENTRY;
+
+  // Compile step: "auto" runs the app's `compile` script when declared.
+  const compileCfg = o.compile === false ? false : pkg.compile ?? "auto";
+  const appPkg = JSON.parse(readFileSync(join(appDir, "package.json"), "utf8")) as {
+    scripts?: Record<string, string>;
+  };
+  let entry = sourceEntry;
+  if (compileCfg !== false) {
+    const script = typeof compileCfg === "object" ? compileCfg.script ?? "compile" : "compile";
+    const outDir = typeof compileCfg === "object" ? compileCfg.outDir ?? "dist" : "dist";
+    if (typeof compileCfg === "object" || appPkg.scripts?.[script]) {
+      await runCompile(appDir, script);
+      entry = typeof compileCfg === "object" && compileCfg.entry ? compileCfg.entry : compiledEntryFor(sourceEntry, outDir);
+    } else {
+      console.error('nd: no "compile" script - packaging raw src/ (react-compiler pass skipped)');
+    }
+  }
+
+  mkdirSync(destAppDir, { recursive: true });
+  const entryDir = entry.includes("/") ? entry.split("/")[0]! : null;
+  if (entryDir) {
+    copyPayloadTree(join(appDir, entryDir), join(destAppDir, entryDir), o.appRoot, skipNodeModules);
+  } else {
+    // Root-level entry: ship the whole app dir (minus node_modules and any
+    // build output nested inside it, which would recurse into the copy).
+    const bundleOut = resolve(workspaceRoot, pkg.outDir ?? "dist");
+    const skip = (src: string) => skipNodeModules(src) && resolve(src) !== bundleOut;
+    copyPayloadTree(appDir, destAppDir, o.appRoot, skip);
+  }
+  cpSync(join(appDir, "package.json"), join(destAppDir, "package.json"));
+
+  for (const inc of pkg.include ?? []) {
+    const src = join(workspaceRoot, inc);
+    if (!existsSync(src)) throw new Error(`nd: package.include path not found: ${src}`);
+    cpSync(src, join(o.appRoot, inc), { recursive: true, dereference: true, filter: skipNodeModules });
+  }
+
+  const flat = flattenRuntimeModules({
+    appDir,
+    extraRoots: pkg.runtimeDependencies,
+    dest: join(o.appRoot, "node_modules"),
+  });
+  assertResolvableEntries(o.appRoot, flat);
+
+  // Native plugins: build (or reuse) the app's declared outputs, ship them
+  // under app/native/, and record app-root-relative paths for the bootstrap.
+  const outputs = await buildNativePlugins(o.config, appDir);
+  const pluginPaths: string[] = [];
+  for (const output of outputs) {
+    const dest = join("native", basename(output));
+    mkdirSync(join(o.appRoot, "native"), { recursive: true });
+    cpSync(output, join(o.appRoot, dest), { dereference: true });
+    pluginPaths.push(dest);
+  }
+
+  const cwd = appRel || ".";
+  const appEntry = appRel ? `${appRel}/${entry}` : entry;
+  writeFileSync(join(o.appRoot, "nd-app.json"), `${JSON.stringify({
+    id: o.identity.id,
+    name: o.identity.name,
+    version: o.identity.version,
+    entry: appEntry,
+    cwd,
+    pluginPaths,
+  }, null, 2)}\n`);
+
+  return { entry: appEntry, cwd, pluginPaths };
+}

package/src/package/templates.ts

@@ -0,0 +1,104 @@
+// In-code packaging templates: default Info.plist, entitlements, AppRun, and
+// .desktop entry. Strings instead of template files so packages/nd's
+// `files: ["src"]` ships everything `nd package` needs.
+
+export interface InfoPlistFields {
+  name: string;
+  displayName: string;
+  id: string;
+  executable: string;
+  version: string;
+  minimumSystemVersion: string;
+  category?: string;
+  iconFile?: string;
+}
+
+export function infoPlistSkeleton(f: InfoPlistFields): string {
+  let body =
+    `    <key>CFBundleName</key><string>${f.name}</string>\n` +
+    `    <key>CFBundleDisplayName</key><string>${f.displayName}</string>\n` +
+    `    <key>CFBundleIdentifier</key><string>${f.id}</string>\n` +
+    `    <key>CFBundleExecutable</key><string>${f.executable}</string>\n` +
+    "    <key>CFBundlePackageType</key><string>APPL</string>\n" +
+    `    <key>CFBundleShortVersionString</key><string>${f.version}</string>\n` +
+    `    <key>CFBundleVersion</key><string>${f.version}</string>\n` +
+    `    <key>LSMinimumSystemVersion</key><string>${f.minimumSystemVersion}</string>\n` +
+    "    <key>NSHighResolutionCapable</key><true/>\n";
+  if (f.category) body += `    <key>LSApplicationCategoryType</key><string>${f.category}</string>\n`;
+  if (f.iconFile) {
+    body += `    <key>CFBundleIconFile</key><string>${f.iconFile}</string>\n`;
+    body += `    <key>CFBundleIconName</key><string>${f.iconFile}</string>\n`;
+  }
+  return (
+    '<?xml version="1.0" encoding="UTF-8"?>\n' +
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n' +
+    '<plist version="1.0">\n<dict>\n' +
+    body +
+    "</dict>\n</plist>\n"
+  );
+}
+
+/** Hardened-runtime entitlements. JSC-under-Bun needs allow-jit on Apple Silicon. */
+export const ENTITLEMENTS_PLIST =
+  '<?xml version="1.0" encoding="UTF-8"?>\n' +
+  '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n' +
+  '<plist version="1.0">\n<dict>\n' +
+  "    <key>com.apple.security.cs.allow-jit</key>\n    <true/>\n" +
+  "    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>\n    <true/>\n" +
+  "</dict>\n</plist>\n";
+
+export interface AppRunSpec {
+  /** App-root-relative script the host boots. */
+  entry: string;
+  /** App-root-relative working directory. */
+  cwd: string;
+  /** usr/bin/<slug> executable name. */
+  slug: string;
+  appId?: string;
+  /** App-root-relative native plugin paths. */
+  pluginPaths: string[];
+}
+
+export function appRunTemplate(s: AppRunSpec): string {
+  let script =
+    "#!/usr/bin/env bash\n" +
+    'HERE="$(dirname "$(readlink -f "$0")")"\n' +
+    `export ND_SCRIPT="$HERE/app/${s.entry}"\n` +
+    'export PATH="$HERE/usr/bin:$PATH"\n';
+  if (s.appId) script += `export ND_APP_ID="${s.appId}"\n`;
+  if (s.pluginPaths.length) {
+    script += 'export ND_PLUGINS="1"\n';
+    script += `export ND_PLUGIN_PATHS="${s.pluginPaths.map((p) => `$HERE/app/${p}`).join(":")}"\n`;
+  }
+  script += `cd "$HERE/app/${s.cwd}"\n`;
+  script += `exec "$HERE/usr/bin/${s.slug}" "$@"\n`;
+  return script;
+}
+
+export interface DesktopEntrySpec {
+  displayName: string;
+  slug: string;
+  categories: string[];
+  appId?: string;
+  /** Extra/overriding lines from LinuxPackageConfig.desktopEntry. */
+  extra?: Record<string, string>;
+}
+
+export function desktopEntryTemplate(s: DesktopEntrySpec): string {
+  const lines = new Map<string, string>([
+    ["Type", "Application"],
+    ["Name", s.displayName],
+    ["Exec", "AppRun"],
+    ["Icon", s.slug],
+    ["Categories", `${s.categories.join(";")};`],
+  ]);
+  if (s.appId) lines.set("StartupWMClass", s.appId);
+  for (const [k, v] of Object.entries(s.extra ?? {})) lines.set(k, v);
+  return `[Desktop Entry]\n${[...lines].map(([k, v]) => `${k}=${v}`).join("\n")}\n`;
+}
+
+/** 1x1 RGBA PNG, the no-icon-configured placeholder (appimagetool requires a root icon). */
+export const PLACEHOLDER_PNG: Uint8Array = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR4nGP4z8DwHwAFAAH/iZk9HQAAAABJRU5ErkJggg==",
+  "base64",
+);

package/src/package/updates.ts

@@ -0,0 +1,118 @@
+// Update artifacts: minisign-signed full archive + manifest JSON matching
+// src/core/update.zig's `Manifest` struct. Shells out to the `minisign` CLI.
+// Opt-in per app: no `package.updates` config, no artifacts.
+import { $ } from "bun";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import type { UpdatesConfig } from "../config.ts";
+import type { ResolvedIdentity } from "./identity.ts";
+
+export interface ManifestOpts {
+  appId: string;
+  version: string;
+  from: string | null;
+  archivePath: string;
+  url: string;
+  secKey: string;
+  pubKey: string;
+}
+
+// Returns { manifestPath, manifestSigPath }.
+export async function buildAndSignManifest(o: ManifestOpts) {
+  // Sign the archive (minisign -S writes <archive>.minisig).
+  await $`minisign -S -s ${o.secKey} -m ${o.archivePath}`.quiet();
+  const archiveSig = `${o.archivePath}.minisig`;
+  // The second line of the .minisig is the base64 algo/keyid/sig blob the Zig
+  // verifier decodes directly; pass it through as full_sig_b64.
+  const sigB64 = readFileSync(archiveSig, "utf8").split("\n")[1]!.trim();
+  const manifest = {
+    app_id: o.appId,
+    version: o.version,
+    from: o.from,
+    full_url: o.url,
+    full_sig_b64: sigB64,
+  };
+  const manifestPath = `${o.archivePath.replace(/[^/]+$/, "")}manifest-${o.version}.json`;
+  writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
+  await $`minisign -S -s ${o.secKey} -m ${manifestPath}`.quiet();
+  return { manifestPath, manifestSigPath: `${manifestPath}.minisig` };
+}
+
+// Ephemeral key helper for CI/tests (no real signing identity in this env).
+// Reads ND_MINISIGN_SEC/ND_MINISIGN_PUB if set; otherwise generates a
+// throwaway no-password keypair under `dir`.
+export async function ensureEphemeralKey(dir: string) {
+  if (process.env.ND_MINISIGN_SEC && process.env.ND_MINISIGN_PUB) {
+    return { sec: process.env.ND_MINISIGN_SEC, pub: process.env.ND_MINISIGN_PUB };
+  }
+  const sec = `${dir}/nd-sign.sec`, pub = `${dir}/nd-sign.pub`;
+  if (!existsSync(sec)) await $`minisign -G -W -p ${pub} -s ${sec}`.quiet();
+  return { sec, pub };
+}
+
+export interface PublishOptions {
+  identity: ResolvedIdentity;
+  platform: "mac" | "linux";
+  /** dist/<platform> directory the archive member lives in. */
+  distDir: string;
+  /** The archive member inside distDir (Gallery.app / AppDir). */
+  member: string;
+  /** Resolved output root; update artifacts land in <outDir>/update. */
+  outDir: string;
+}
+
+export interface PublishResult {
+  manifestPath: string;
+  publicKey: string;
+}
+
+/**
+ * Archives + signs when `package.updates` is configured; otherwise prints
+ * ND_PACKAGE_UPDATES_SKIPPED and returns undefined. Tar invocations stay
+ * exactly as the update flow's consumers expect (.tar.gz mac / .tar.zst linux,
+ * zstd via the CLI).
+ */
+export async function maybePublishUpdate(cfg: UpdatesConfig | undefined, o: PublishOptions): Promise<PublishResult | undefined> {
+  if (!cfg) {
+    console.error("ND_PACKAGE_UPDATES_SKIPPED reason=not-configured");
+    return undefined;
+  }
+  if (!o.identity.id) throw new Error("nd: package.updates needs app.id (the manifest's app_id)");
+
+  const updDir = join(o.outDir, "update");
+  mkdirSync(updDir, { recursive: true });
+  const format = cfg.format ?? (o.platform === "mac" ? "tar.gz" : "tar.zst");
+  const archive = join(updDir, `${o.identity.slug}-${o.identity.version}-${o.platform}.${format}`);
+  rmSync(archive, { force: true });
+  if (format === "tar.gz") {
+    await $`tar -C ${o.distDir} -czf ${archive} ${o.member}`;
+  } else {
+    await $`tar -C ${o.distDir} -cf - ${o.member} | zstd -q -o ${archive}`.quiet();
+  }
+
+  let sec: string, pub: string;
+  if (cfg.secretKey) {
+    if (!cfg.publicKey) throw new Error("nd: package.updates.secretKey needs publicKey too");
+    sec = cfg.secretKey;
+    pub = cfg.publicKey;
+  } else if (process.env.ND_MINISIGN_SEC && process.env.ND_MINISIGN_PUB) {
+    sec = process.env.ND_MINISIGN_SEC;
+    pub = process.env.ND_MINISIGN_PUB;
+  } else if (cfg.ephemeralKey) {
+    ({ sec, pub } = await ensureEphemeralKey(updDir));
+  } else {
+    throw new Error("nd: package.updates has no signing key (set secretKey/publicKey, ND_MINISIGN_SEC/ND_MINISIGN_PUB, or ephemeralKey: true)");
+  }
+
+  const { manifestPath } = await buildAndSignManifest({
+    appId: o.identity.id,
+    version: o.identity.version,
+    from: null,
+    archivePath: archive,
+    url: `${cfg.baseUrl.replace(/\/$/, "")}/${basename(archive)}`,
+    secKey: sec,
+    pubKey: pub,
+  });
+  console.error(`ND_PACKAGE_MANIFEST ${manifestPath} pub=${pub}`);
+  return { manifestPath, publicKey: pub };
+}