@owear/cli 0.1.2 → 0.1.4

package/src/ow.js

@@ -65,12 +65,16 @@ function runtimePackageDir() {
  * - monorepo:     cada build/<preset>/api/<nombre>/ (el loader NO recursiona)
  */
 function stockModulesPath() {
-  const rt = runtimePackageDir()
-  if (rt) {
-    const m = path.join(rt, 'bin', 'modules')
+  // Dev: si el usuario fija el kernel (OW_KERNEL_BIN), sus módulos viven junto
+  // a él (<exe>/modules). Es la fuente correcta: kernel y módulos del mismo build.
+  const kb = process.env.OW_KERNEL_BIN
+  if (kb) {
+    const m = path.join(path.dirname(kb), 'modules')
     if (fs.existsSync(m)) return m
   }
-  const api = path.resolve(__dirname, '../../../build', platformPreset(), 'api')
+  // Dev en el monorepo: preferir el BUILD LOCAL (mismo build que el kernel)
+  // ANTES del runtime package, que puede ser un artefacto prebuilt antiguo.
+  const api = path.resolve(__dirname, '../../../build', platformPreset(), 'src', 'api')
   if (fs.existsSync(api)) {
     const dirs = fs
       .readdirSync(api, { withFileTypes: true })
@@ -78,6 +82,11 @@ function stockModulesPath() {
       .map((d) => path.join(api, d.name))
     if (dirs.length) return dirs.join(path.delimiter)
   }
+  const rt = runtimePackageDir()
+  if (rt) {
+    const m = path.join(rt, 'bin', 'modules')
+    if (fs.existsSync(m)) return m
+  }
   return ''
 }
 
@@ -139,6 +148,7 @@ async function main() {
     case 'dev':    return cmdDev(rest)
     case 'build':  return cmdBuild(rest)
     case 'api':    return cmdApi(rest)
+    case 'update': return cmdUpdate(rest)
     default:
       die(`comando desconocido: ${cmd} (usa --help)`)
   }
@@ -148,35 +158,64 @@ function printHelp() {
   console.log(`
 ${C.cyan}owear${C.reset} — framework desktop nativo
 
-  ${C.green}ow create <dir>${C.reset}   crea una app nueva
-  ${C.green}ow dev${C.reset}            desarrollo: vite + kernel + sidecar node
-  ${C.green}ow build${C.reset}          build de producción
-  ${C.green}ow api list${C.reset}       lista las APIs del repo y sus manifiestos
-  ${C.green}ow api new <nombre>${C.reset}  scaffoldea una API (api/<nombre>/ + manifiesto)
+  ${C.green}ow create <dir>${C.reset}              crea una app nueva
+  ${C.green}ow create installer <dir>${C.reset}    scaffoldea el instalador
+  ${C.green}ow create uninstaller <dir>${C.reset}  scaffoldea el desinstalador
+  ${C.green}ow dev${C.reset}                       desarrollo: vite + kernel + sidecar node
+  ${C.green}ow build${C.reset}                     build de producción (dist/)
+  ${C.green}ow build app${C.reset}                 payload de la app (--format binary|deb|appimage)
+  ${C.green}ow build installer${C.reset}           binario instalador (linux) / .exe (win)
+  ${C.green}ow build uninstaller${C.reset}         binario desinstalador
+  ${C.green}ow api list${C.reset}                  lista las APIs del repo y sus manifiestos
+  ${C.green}ow api new <nombre>${C.reset}          scaffoldea una API (api/<nombre>/ + manifiesto)
+  ${C.green}ow update --file <bin> --version <v>${C.reset}  publica un update (blockmap + manifiesto YAML firmado)
+  ${C.green}ow update --gen-key <ruta>${C.reset}   genera un par de claves Ed25519 para firmar
 
 Variables útiles:
   OW_KERNEL_BIN     ruta al binario owear
+  OW_SIGN_KEY       clave privada Ed25519 para firmar artefactos (→ <file>.sig)
+  OW_SIGN_PFX       certificado PKCS#12 para Authenticode (Windows PE/MSI)
+  OW_SIGN_PFX_PASSWORD  contraseña del PFX (o --pfx-password-env)
+
+Firma (ow build app|installer|uninstaller):
+  --sign-key <pem>           firma Ed25519 desprendida del artefacto
+  --pfx <p12>                Authenticode (requiere osslsigncode/signtool)
+  --timestamp <url>          sellado de tiempo Authenticode
+  --require-sign             falla el build si no se firma
 `)
 }
 
 function cmdCreate(args) {
-  const dir = args[0]
-  if (!dir) die('uso: ow create <dir>')
+  const sub = args[0]
+  if (sub === 'installer') {
+    return scaffold('template-installer', args[1] ?? 'installer', 'instalador')
+  }
+  if (sub === 'uninstaller') {
+    return scaffold('template-installer/uninstaller', args[1] ?? 'uninstaller', 'desinstalador')
+  }
+  const dir = sub
+  if (!dir) die('uso: ow create [installer|uninstaller] <dir>')
+  const target = scaffold('template', dir, 'app')
+  log('siguientes pasos:')
+  console.log(`  cd ${path.basename(target)}`)
+  console.log('  npm install')
+  console.log('  npm run dev')
+}
+
+/** Copia un template del CLI a `dir` y sustituye placeholders. */
+function scaffold(templateRel, dir, what) {
   const target = path.resolve(dir)
   if (fs.existsSync(target) && fs.readdirSync(target).length) {
     die(`el directorio ya existe y no está vacío: ${target}`)
   }
-  const templateDir = path.resolve(__dirname, '../template')
+  const templateDir = path.resolve(__dirname, '..', templateRel)
   if (!fs.existsSync(templateDir)) {
     die(`template no encontrado en ${templateDir} (instala @owear/cli completo)`)
   }
   fs.cpSync(templateDir, target, { recursive: true })
   applyAppName(target)
-  log(`app creada en ${target}`)
-  log('siguientes pasos:')
-  console.log(`  cd ${path.basename(target)}`)
-  console.log('  npm install')
-  console.log('  npm run dev')
+  log(`${what} en ${target}`)
+  return target
 }
 
 /**
@@ -228,7 +267,7 @@ function cmdApi(args) {
 }
 
 function readApiManifests(root) {
-  const apiDir = path.join(root, 'api')
+  const apiDir = path.join(root, 'src', 'api')
   const out = []
   for (const d of fs.readdirSync(apiDir, { withFileTypes: true })) {
     if (!d.isDirectory()) continue
@@ -260,7 +299,7 @@ function cmdApiList(root) {
 function cmdApiNew(root, name) {
   if (!name) die('uso: ow api new <nombre>')
   if (!/^[a-z][a-z0-9-]*$/.test(name)) die('nombre inválido (minúsculas, dígitos y guiones; debe empezar por letra)')
-  const dir = path.join(root, 'api', name)
+  const dir = path.join(root, 'src', 'api', name)
   if (fs.existsSync(dir) && fs.readdirSync(dir).length) die(`api/${name}/ ya existe y no está vacío`)
 
   fs.mkdirSync(path.join(dir, 'src'), { recursive: true })
@@ -353,7 +392,7 @@ function findMainEntry(cwd) {
  * así que compilamos con esbuild (viene con vite). De este modo el runtime del
  * sistema sirve y el arranque no depende de la versión que tenga el usuario.
  */
-function prepareMain(cwd, outDir) {
+function prepareMain(cwd, outDir, bundle = false) {
   const entry = findMainEntry(cwd)
   if (!entry) return null
   if (entry.endsWith('.js') || entry.endsWith('.mjs')) return entry
@@ -366,7 +405,11 @@ function prepareMain(cwd, outDir) {
     [
       'esbuild', entry,
       '--bundle', '--platform=node', '--format=esm',
-      '--packages=external', `--outfile=${out}`, '--log-level=warning',
+      // En producción se EMBEBE @owear/core (y deps) en main.js: el payload de
+      // un single-binary/instalador no lleva node_modules. En dev se dejan
+      // externas (node_modules está presente).
+      ...(bundle ? [] : ['--packages=external']),
+      `--outfile=${out}`, '--log-level=warning',
     ],
     { cwd, stdio: 'inherit', shell: process.platform === 'win32' }
   )
@@ -376,6 +419,59 @@ function prepareMain(cwd, outDir) {
   return out
 }
 
+/**
+ * Entries de worker de la app: `app/workers/**\/*.{ts,mts,js,mjs}`.
+ * Se compilan a <outDir>/workers/ conservando la ruta relativa, y el kernel
+ * expone el directorio al main vía OW_APP_WORKERS para `app.forkWorker()`.
+ */
+function findWorkerEntries(cwd) {
+  const dir = path.join(cwd, 'app', 'workers')
+  if (!fs.existsSync(dir)) return []
+  const out = []
+  const walk = (d) => {
+    for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+      const p = path.join(d, e.name)
+      if (e.isDirectory()) walk(p)
+      else if (/\.(ts|mts|js|mjs)$/.test(e.name)) out.push(p)
+    }
+  }
+  walk(dir)
+  return out
+}
+
+function prepareWorkers(cwd, outDir) {
+  const entries = findWorkerEntries(cwd)
+  if (!entries.length) return null
+
+  const root = path.join(cwd, 'app', 'workers')
+  const workersDir = path.join(outDir, 'workers')
+  const built = []
+
+  for (const entry of entries) {
+    const rel = path.relative(root, entry)
+    const out = path.join(workersDir, rel.replace(/\.(ts|mts)$/, '.js'))
+    fs.mkdirSync(path.dirname(out), { recursive: true })
+
+    if (entry.endsWith('.js') || entry.endsWith('.mjs')) {
+      fs.copyFileSync(entry, out)
+    } else {
+      log(`compilando worker ${path.relative(cwd, entry)}…`)
+      const r = spawnSync(
+        'npx',
+        [
+          'esbuild', entry,
+          '--bundle', '--platform=node', '--format=esm',
+          '--packages=external', `--outfile=${out}`, '--log-level=warning',
+        ],
+        { cwd, stdio: 'inherit', shell: process.platform === 'win32' }
+      )
+      if (r.status !== 0) die(`no se pudo compilar el worker ${path.relative(cwd, entry)}`)
+    }
+    built.push(out)
+  }
+  return workersDir
+}
+
 async function cmdDev() {
   const cwd = process.cwd()
   if (!fs.existsSync(path.join(cwd, 'package.json'))) die('ejecuta dentro de tu app')
@@ -411,6 +507,9 @@ async function cmdDev() {
   const mainJs = prepareMain(cwd, path.join(cwd, '.owear'))
   if (mainJs) log(`proceso principal: ${path.relative(cwd, mainJs)}`)
 
+  const workersDir = prepareWorkers(cwd, path.join(cwd, '.owear'))
+  if (workersDir) log(`workers: ${path.relative(cwd, workersDir)}`)
+
   log(`lanzando kernel: ${kernelBin}`)
   const kernel = spawn(kernelBin, [], {
     stdio: 'inherit',
@@ -418,7 +517,8 @@ async function cmdDev() {
       ...process.env,
       OW_APP_NAME: JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8')).name ?? 'Owear App',
       OW_DEV_SERVER_URL: 'http://localhost:5173/',
-      ...(mainJs ? { OW_APP_MAIN: mainJs } : {}),
+      ...(mainJs ? { OW_APP_MAIN: mainJs } : { OW_START_URL: 'http://localhost:5173/' }),
+      ...(workersDir ? { OW_APP_WORKERS: workersDir } : {}),
       ...(() => {
         // módulos stock (fs/path/…) + los nativos de la app, si los hay
         const dirs = [stockModulesPath(), modulesDir].filter(Boolean)
@@ -438,13 +538,26 @@ async function cmdDev() {
   })
 }
 
-async function cmdBuild() {
-  const cwd = process.cwd()
+// ── ow build [app|installer|uninstaller] ─────────────────────────────────────
+
+async function cmdBuild(args) {
+  const sub = args[0]
+  if (sub === 'installer') return cmdBuildInstaller(process.cwd(), args.slice(1), false)
+  if (sub === 'uninstaller') return cmdBuildInstaller(process.cwd(), args.slice(1), true)
+  if (sub === 'app') return cmdBuildApp(process.cwd(), args.slice(1))
+  return cmdBuildBundle(process.cwd())
+}
+
+/** Build de la app → dist/ (vite + main.js + workers + módulos nativos). */
+async function cmdBuildBundle(cwd) {
   log('vite build…')
   const code = await runProc('npx', ['vite', 'build'], { cwd, shell: process.platform === 'win32' })
   if (code !== 0) die('vite build falló')
 
-  const mainJs = prepareMain(cwd, path.join(cwd, 'dist'))
+  const mainJs = prepareMain(cwd, path.join(cwd, 'dist'), true)
+
+  const workersDir = prepareWorkers(cwd, path.join(cwd, 'dist'))
+  if (workersDir) log(`workers: ${path.relative(cwd, workersDir)}`)
 
   const nativeDir = path.join(cwd, 'native')
   if (fs.existsSync(nativeDir)) {
@@ -466,8 +579,418 @@ async function cmdBuild() {
     .join(path.delimiter)
   console.log(
     `  OW_ASSETS_DIR=dist${mainJs ? ' OW_APP_MAIN=dist/main.js' : ''}` +
+      `${workersDir ? ' OW_APP_WORKERS=dist/workers' : ''}` +
       `${runMods ? ` OW_MODULES_DIR="${runMods}"` : ''} ./owear`
   )
+  return { dist: path.join(cwd, 'dist'), mainJs, workersDir }
+}
+
+// ── empaquetado (D1) ─────────────────────────────────────────────────────────
+
+/** Ruta a un script de empaquetado incluido en el paquete @owear/cli. */
+function packTool(name) {
+  const local = path.resolve(__dirname, '..', 'tools', name)
+  if (fs.existsSync(local)) return local
+  const root = owearRepoRoot()
+  if (root && fs.existsSync(path.join(root, 'tools', name))) {
+    return path.join(root, 'tools', name)
+  }
+  die(`no encuentro ${name} (reinstala @owear/cli)`)
+}
+
+/** Plataforma del destino (para elegir target del bridge). */
+function platformKey() {
+  return process.platform === 'win32' ? 'win' : process.platform === 'darwin' ? 'mac' : 'linux'
+}
+
+/** Slug del proyecto (nombre de package.json sin scope). */
+function appSlug(cwd) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'))
+    return (pkg.name ?? 'app').replace(/^@[^/]+\//, '')
+  } catch {
+    return path.basename(cwd)
+  }
+}
+
+function flag(args, name, def = null) {
+  return args.includes(name) ? args[args.indexOf(name) + 1] : def
+}
+
+function readPackConfig(cwd) {
+  const p = path.join(cwd, 'owear.pack.json')
+  if (!fs.existsSync(p)) return {}
+  try {
+    return JSON.parse(fs.readFileSync(p, 'utf8'))
+  } catch (e) {
+    die(`owear.pack.json inválido: ${e.message}`)
+  }
+}
+
+/** Ensambla el bundle `{app/,modules/,manifest.json}` que espera el kernel. */
+function assembleAppBundle(cwd, built) {
+  const bundle = path.join(cwd, '.owear', 'app-bundle')
+  fs.rmSync(bundle, { recursive: true, force: true })
+  fs.mkdirSync(bundle, { recursive: true })
+  fs.cpSync(built.dist, path.join(bundle, 'app'), { recursive: true })
+  const mods = path.join(built.dist, 'modules')
+  if (fs.existsSync(mods)) fs.cpSync(mods, path.join(bundle, 'modules'), { recursive: true })
+  fs.writeFileSync(
+    path.join(bundle, 'manifest.json'),
+    JSON.stringify({ name: appSlug(cwd), createdAt: Date.now() }, null, 2) + '\n'
+  )
+  return bundle
+}
+
+function packDir(kernel, inDir, out) {
+  const r = spawnSync(
+    process.execPath,
+    [packTool('owear-pack.mjs'), '--kernel', kernel, '--in', inDir, '--out', out],
+    { stdio: 'inherit' }
+  )
+  if (r.status !== 0) die('falló owear-pack')
+}
+
+/** Compila `owear.bridge.ts` → `.owear/bridge.json` y devuelve el objeto. */
+async function buildBridge(cwd, optional = false) {
+  const { pathToFileURL } = await import('node:url')
+  const src = ['owear.bridge.ts', 'owear.bridge.mts', 'owear.bridge.js', 'owear.bridge.mjs']
+    .map((n) => path.join(cwd, n))
+    .find((p) => fs.existsSync(p))
+  if (!src) {
+    if (optional) return null
+    die('no encuentro owear.bridge.ts — el instalador necesita el bridge de la app')
+  }
+  const outMjs = path.join(cwd, '.owear', 'bridge.mjs')
+  fs.mkdirSync(path.dirname(outMjs), { recursive: true })
+  log(`compilando ${path.basename(src)}…`)
+  const r = spawnSync(
+    'npx',
+    ['esbuild', src, '--bundle', '--platform=node', '--format=esm', '--packages=external',
+      `--outfile=${outMjs}`, '--log-level=warning'],
+    { cwd, stdio: 'inherit', shell: process.platform === 'win32' }
+  )
+  if (r.status !== 0) die('no se pudo compilar owear.bridge')
+  const mod = await import(`${pathToFileURL(outMjs).href}?t=${Date.now()}`)
+  const obj = mod.default ?? mod
+  const jsonPath = path.join(cwd, '.owear', 'bridge.json')
+  fs.writeFileSync(jsonPath, JSON.stringify(obj, null, 2) + '\n')
+  return { obj, jsonPath }
+}
+
+/** Compila la UI del instalador/desinstalador → `ui-dist/` (+ sidecar main.js). */
+async function buildInstallerUI(cwd, which) {
+  const dir =
+    which === 'uninstaller' ? path.join(cwd, 'installer', 'uninstaller') : path.join(cwd, 'installer')
+  if (!fs.existsSync(dir)) {
+    die(`no existe ${path.relative(cwd, dir)} — créalo con: ow create installer`)
+  }
+  log(`vite build (${which})…`)
+  const code = await runProc('npx', ['vite', 'build'], { cwd: dir, shell: process.platform === 'win32' })
+  if (code !== 0) die(`vite build del ${which} falló`)
+  const uiDist = path.join(dir, 'ui-dist')
+
+  // sidecar del instalador (Node): se empaqueta dentro del propio ui/
+  const entry = path.join(dir, 'app', 'main.ts')
+  if (fs.existsSync(entry)) {
+    const out = path.join(uiDist, 'main.js')
+    log(`compilando ${which}/app/main.ts…`)
+    const r = spawnSync(
+      'npx',
+      ['esbuild', entry, '--bundle', '--platform=node', '--format=esm', `--outfile=${out}`, '--log-level=warning'],
+      { cwd: dir, stdio: 'inherit', shell: process.platform === 'win32' }
+    )
+    if (r.status !== 0) die(`no se pudo compilar ${which}/app/main.ts`)
+  }
+  return uiDist
+}
+
+/** Ejecuta un script de tools/ del repo con Node. */
+function runTool(name, args) {
+  const r = spawnSync(process.execPath, [packTool(name), ...args], { stdio: 'inherit' })
+  if (r.status !== 0) die(`falló ${name}`)
+}
+
+/**
+ * Firma un artefacto recién construido. Authenticode si hay `--pfx`
+ * (`OW_SIGN_PFX`), Ed25519 desprendida (`<file>.sig`) si hay `--sign-key`
+ * (`OW_SIGN_KEY`). Nunca rompe el build: sin material de firma no hace nada;
+ * con `--require-sign` la firma pasa a ser obligatoria.
+ */
+function signArtifact(args, file) {
+  const key = flag(args, '--sign-key', process.env.OW_SIGN_KEY ?? '')
+  const pfx = flag(args, '--pfx', process.env.OW_SIGN_PFX ?? '')
+  if (!key && !pfx) return
+  const extra = []
+  if (key) extra.push('--ed25519-key', key)
+  if (pfx) {
+    extra.push('--pfx', pfx, '--pfx-password-env', flag(args, '--pfx-password-env', 'OW_SIGN_PFX_PASSWORD'))
+  }
+  const ts = flag(args, '--timestamp', process.env.OW_SIGN_TIMESTAMP ?? '')
+  if (ts) extra.push('--timestamp', ts)
+  if (args.includes('--require-sign')) extra.push('--require')
+  runTool('owear-sign.mjs', ['--file', file, ...extra])
+}
+
+/**
+ * ow update — publica un update del auto-updater: calcula el blockmap (delta
+ * por bloques), genera el manifiesto YAML del canal y lo firma (Ed25519).
+ * Delega en tools/owear-update.mjs (mismos flags).
+ */
+function cmdUpdate(args) {
+  if (!args.length) {
+    console.log(`
+${C.cyan}ow update${C.reset} — publica un update (delta + manifiesto YAML firmado)
+
+  ${C.green}ow update --gen-key owear-signing${C.reset}
+      genera el par de claves Ed25519 (privada <ruta>.pem; pública <ruta>.pub.b64,
+      que va en el bridge como ${C.dim}updater.publicKey${C.reset})
+
+  ${C.green}ow update --file release/MiApp-1.4.0 --version 1.4.0 --key owear-signing.pem${C.reset} \\
+      [--channel latest] [--url https://up.miapp.dev] [--notes "…"|--notes @notas.md] \\
+      [--block-size 262144] [--mandatory] [--out-dir release]
+
+  Salidas: ${C.dim}<file>.blockmap${C.reset} (bloques sha256) y ${C.dim}<channel>.yml${C.reset} (manifiesto YAML).
+`)
+    return
+  }
+  runTool('owear-update.mjs', args)
+}
+
+function readPkg(cwd) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'))
+  } catch {
+    return {}
+  }
+}
+
+async function appMeta(cwd) {
+  const bridge = await buildBridge(cwd, true)
+  const pkg = readPkg(cwd)
+  const slug = appSlug(cwd)
+  return {
+    bridge,
+    slug,
+    appId: bridge?.obj?.app?.id ?? slug,
+    appName: bridge?.obj?.app?.name ?? pkg.name ?? slug,
+    version: bridge?.obj?.app?.version ?? pkg.version ?? '0.0.0',
+    publisher: bridge?.obj?.app?.publisher ?? 'unknown',
+    icon: bridge?.obj?.app?.icon ?? null,
+  }
+}
+
+/** Copia kernel + dist + modules + main/workers a `dir` (layout de app). */
+function stageAppLayout(cwd, built, dir, kernel) {
+  fs.rmSync(dir, { recursive: true, force: true })
+  fs.mkdirSync(dir, { recursive: true })
+  const exe = process.platform === 'win32' ? 'owear.exe' : 'owear'
+  fs.copyFileSync(kernel, path.join(dir, exe))
+  fs.chmodSync(path.join(dir, exe), 0o755)
+  fs.cpSync(built.dist, path.join(dir, 'app'), { recursive: true })
+  const mods = path.join(built.dist, 'modules')
+  if (fs.existsSync(mods)) fs.cpSync(mods, path.join(dir, 'modules'), { recursive: true })
+  if (built.mainJs) fs.copyFileSync(built.mainJs, path.join(dir, 'main.js'))
+  const workers = path.join(built.dist, 'workers')
+  if (fs.existsSync(workers)) fs.cpSync(workers, path.join(dir, 'workers'), { recursive: true })
+  return exe
+}
+
+function desktopEntry(meta, execLine, iconName) {
+  return (
+    `[Desktop Entry]\nType=Application\nName=${meta.appName}\n` +
+    `Comment=${meta.appName}\nExec=${execLine}\n` +
+    (iconName ? `Icon=${iconName}\n` : '') +
+    `Terminal=false\nCategories=Utility;\n`
+  )
+}
+
+function copyIcon(cwd, meta, dstBase) {
+  if (!meta.icon) return null
+  const src = path.isAbsolute(meta.icon) ? meta.icon : path.join(cwd, meta.icon)
+  if (!fs.existsSync(src)) return null
+  const ext = path.extname(src) || '.png'
+  const dst = dstBase + ext
+  fs.mkdirSync(path.dirname(dst), { recursive: true })
+  fs.copyFileSync(src, dst)
+  return path.basename(dst)
+}
+
+/** `ow build app --format binary|deb|appimage|msi` (payload de la app). */
+async function cmdBuildApp(cwd, args) {
+  const fmt = flag(args, '--format', 'binary')
+  const built = await cmdBuildBundle(cwd)
+  const meta = await appMeta(cwd)
+  const slug = meta.slug
+  const outDir = path.join(cwd, 'release')
+  fs.mkdirSync(outDir, { recursive: true })
+  const kernel = ensureKernelBuilt(cwd)
+  const isWin = process.platform === 'win32'
+
+  if (fmt === 'binary') {
+    const bundle = assembleAppBundle(cwd, built)
+    const exe = isWin ? `${slug}.exe` : slug
+    const out = path.join(outDir, exe)
+    packDir(kernel, bundle, out)
+    log(`binario único: ${out}`)
+    signArtifact(args, out)
+    return
+  }
+
+  if (fmt === 'deb') {
+    const stage = path.join(cwd, '.owear', 'linux-stage')
+    const opt = path.join(stage, 'opt', slug)
+    stageAppLayout(cwd, built, opt, kernel)
+    const bin = path.join(stage, 'usr', 'bin', slug)
+    fs.mkdirSync(path.dirname(bin), { recursive: true })
+    fs.writeFileSync(
+      bin,
+      `#!/bin/sh\nAPPDIR="/opt/${slug}"\n` +
+        `export OW_ASSETS_DIR="$APPDIR/app"\n` +
+        `[ -f "$APPDIR/main.js" ] && export OW_APP_MAIN="$APPDIR/main.js"\n` +
+        `[ -d "$APPDIR/workers" ] && export OW_APP_WORKERS="$APPDIR/workers"\n` +
+        `[ -d "$APPDIR/modules" ] && export OW_MODULES_DIR="$APPDIR/modules"\n` +
+        `exec "$APPDIR/owear" "$@"\n`,
+    )
+    fs.chmodSync(bin, 0o755)
+    const apps = path.join(stage, 'usr', 'share', 'applications')
+    fs.mkdirSync(apps, { recursive: true })
+    const icons = path.join(stage, 'usr', 'share', 'icons', 'hicolor', '256x256', 'apps')
+    const iconName = copyIcon(cwd, meta, path.join(icons, meta.appId))
+    fs.writeFileSync(path.join(apps, `${meta.appId}.desktop`), desktopEntry(meta, slug, iconName ? meta.appId : null))
+    const out = path.join(outDir, `${slug}_${meta.version}_amd64.deb`)
+    runTool('owear-linux.mjs', ['deb', '--stage', stage, '--out', out, '--name', slug,
+      '--version', meta.version, '--maintainer', meta.publisher, '--description', meta.appName])
+    log(`.deb: ${out}`)
+    signArtifact(args, out)
+    return
+  }
+
+  if (fmt === 'appimage') {
+    const appDir = path.join(cwd, '.owear', `${slug}.AppDir`)
+    fs.rmSync(appDir, { recursive: true, force: true })
+    fs.mkdirSync(appDir, { recursive: true })
+    const usr = path.join(appDir, 'usr')
+    stageAppLayout(cwd, built, usr, kernel)
+    fs.writeFileSync(
+      path.join(appDir, 'AppRun'),
+      `#!/bin/sh\nAPPDIR="$(dirname "$(readlink -f "$0")")"\n` +
+        `export OW_ASSETS_DIR="$APPDIR/usr/app"\n` +
+        `[ -f "$APPDIR/usr/main.js" ] && export OW_APP_MAIN="$APPDIR/usr/main.js"\n` +
+        `[ -d "$APPDIR/usr/workers" ] && export OW_APP_WORKERS="$APPDIR/usr/workers"\n` +
+        `[ -d "$APPDIR/usr/modules" ] && export OW_MODULES_DIR="$APPDIR/usr/modules"\n` +
+        `exec "$APPDIR/usr/owear" "$@"\n`,
+    )
+    fs.chmodSync(path.join(appDir, 'AppRun'), 0o755)
+    const iconName = copyIcon(cwd, meta, path.join(appDir, meta.appId))
+    fs.writeFileSync(path.join(appDir, `${meta.appId}.desktop`), desktopEntry(meta, slug, iconName ? meta.appId : null))
+    const out = path.join(outDir, `${slug}-${meta.version}-x86_64.AppImage`)
+    runTool('owear-linux.mjs', ['appimage', '--appdir', appDir, '--out', out, '--arch', 'x86_64'])
+    log(`AppImage: ${out}`)
+    signArtifact(args, out)
+    return
+  }
+
+  if (fmt === 'msi') {
+    const stage = path.join(cwd, '.owear', 'win-stage')
+    stageAppLayout(cwd, built, stage, kernel)
+    const out = path.join(outDir, `${slug}-${meta.version}.msi`)
+    runTool('owear-msi.mjs', ['--stage', stage, '--out', out, '--name', slug,
+      '--version', meta.version, '--publisher', meta.publisher, '--appId', meta.appId])
+    log(`.MSI: ${out}`)
+    signArtifact(args, out)
+    return
+  }
+
+  die(`formato desconocido: ${fmt} (binary|deb|appimage|msi)`)
+}
+
+/** `ow build installer|uninstaller` → binario instalador/desinstalador. */
+async function cmdBuildInstaller(cwd, args, isUninstaller) {
+  const kernel = ensureKernelBuilt(cwd)
+  const slug = appSlug(cwd)
+  const pack = readPackConfig(cwd)
+  const bridge = await buildBridge(cwd)
+  const target = bridge.obj?.targets?.[platformKey()] ?? {}
+  const mode = flag(args, '--mode', target.layout ?? pack.modes?.default ?? 'minimal')
+
+  const exe = process.platform === 'win32' ? '.exe' : ''
+  const outDir = path.join(cwd, 'release')
+  fs.mkdirSync(outDir, { recursive: true })
+
+  // 1) payload de la app (sólo para el instalador)
+  let payloadDir = null
+  if (!isUninstaller) {
+    const built = await cmdBuildBundle(cwd)
+    payloadDir = path.join(cwd, '.owear', 'installer-payload', 'payload')
+    fs.rmSync(payloadDir, { recursive: true, force: true })
+    const bundle = assembleAppBundle(cwd, built)
+    if (mode === 'minimal') {
+      fs.mkdirSync(payloadDir, { recursive: true })
+      packDir(kernel, bundle, path.join(payloadDir, `${slug}${exe}`))
+    } else {
+      fs.cpSync(bundle, payloadDir, { recursive: true })
+    }
+
+    // 1b) desinstalador (si existe installer/uninstaller) → se instala junto a la app
+    if (fs.existsSync(path.join(cwd, 'installer', 'uninstaller'))) {
+      log('build del desinstalador…')
+      // propaga solo los flags de firma (no --mode/--format, que no aplican)
+      const signArgs = []
+      for (const f of ['--sign-key', '--pfx', '--pfx-password-env', '--timestamp']) {
+        const v = flag(args, f, null)
+        if (v) signArgs.push(f, v)
+      }
+      if (args.includes('--require-sign')) signArgs.push('--require-sign')
+      await cmdBuildInstaller(cwd, signArgs, true)
+      const un = path.join(outDir, `${slug}-uninstaller${exe}`)
+      if (fs.existsSync(un)) fs.copyFileSync(un, path.join(payloadDir, path.basename(un)))
+    }
+  }
+
+  // 2) UI del instalador/desinstalador
+  const ui = await buildInstallerUI(cwd, isUninstaller ? 'uninstaller' : 'installer')
+
+  // 3) metadatos (installer.json / uninstaller.json) — el kernel los detecta
+  const iconRel = bridge.obj?.app?.icon
+  const iconAbs = iconRel ? path.resolve(cwd, iconRel) : ''
+  const iconOk = Boolean(iconAbs) && fs.existsSync(iconAbs)
+  const meta = {
+    appId: bridge.obj?.app?.id ?? slug,
+    appName: bridge.obj?.app?.name ?? slug,
+    version: bridge.obj?.app?.version ?? '0.0.0',
+    publisher: bridge.obj?.app?.publisher ?? null,
+    icon: iconOk ? 'icon' + path.extname(iconAbs) : null,
+    mode: isUninstaller ? 'uninstaller' : mode,
+    layout: target.layout ?? mode,
+    order: bridge.obj?.order ?? null,
+    protect: bridge.obj?.protect ?? null,
+    hooks: bridge.obj?.hooks ?? null,
+    node: bridge.obj?.node ?? null,
+    targets: bridge.obj?.targets ?? null,
+  }
+  const metaPath = path.join(cwd, '.owear', isUninstaller ? 'uninstaller.json' : 'installer.json')
+  fs.mkdirSync(path.dirname(metaPath), { recursive: true })
+  fs.writeFileSync(metaPath, JSON.stringify(meta, null, 2) + '\n')
+
+  // 4) ensambla el binario (kernel + payload + footer OWPK1)
+  const kind = isUninstaller ? 'uninstaller' : 'installer'
+  const out = path.join(outDir, `${slug}-${kind}${exe}`)
+  const toolArgs = [
+    packTool('owear-installer.mjs'),
+    '--kernel', kernel,
+    '--out', out,
+    '--ui', ui,
+    '--bridge', bridge.jsonPath,
+    '--meta', metaPath,
+    '--name', slug,
+  ]
+  if (payloadDir) toolArgs.push('--payload', payloadDir)
+  if (iconOk) toolArgs.push('--icon', iconAbs)
+  const r = spawnSync(process.execPath, toolArgs, { stdio: 'inherit' })
+  if (r.status !== 0) die(`falló owear-installer (${kind})`)
+  log(`${kind}: ${out}`)
+  signArtifact(args, out)
 }
 
 main().catch((e) => die(e?.stack ?? String(e)))