@quickgui/cli 0.0.1

package/src/build.ts

@@ -0,0 +1,773 @@
+import {
+  chmodSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, dirname, extname, join, relative, resolve } from "node:path";
+
+import { quickguiSolidPlugin } from "@quickgui/solid/compiler";
+import type { BunPlugin } from "bun";
+
+import type { MacOSNotarizationConfig, ResolvedQuickGuiConfig } from "./config.ts";
+import { CliError, errorMessage } from "./error.ts";
+import { targetInfo, type QuickGuiTarget } from "./targets.ts";
+
+export type BuildMode = "development" | "production";
+
+export interface BuildProjectOptions {
+  mode: BuildMode;
+  target: QuickGuiTarget;
+  outDir?: string;
+  signingIdentity?: string;
+  notarization?: MacOSNotarizationConfig;
+}
+
+export interface BuildResult {
+  artifactPath: string;
+  executablePath: string;
+  target: QuickGuiTarget;
+  mode: BuildMode;
+  dmgPath?: string;
+}
+
+export const nativeExports = [
+  "NativePowerAssertion",
+  "abortAppHost",
+  "addHostedRecentDocument",
+  "addRecentDocument",
+  "applyBatch",
+  "applyHostedBatch",
+  "checkForUpdate",
+  "clearHostedRecentDocuments",
+  "clearRecentDocuments",
+  "closeWindow",
+  "closeHostedWindow",
+  "configureApp",
+  "configureHostedApp",
+  "createApp",
+  "createSystemPopover",
+  "createHostedSystemPopover",
+  "createHostedApp",
+  "createHostedWindow",
+  "createWindow",
+  "destroyApp",
+  "destroyHostedApp",
+  "disableAutoStart",
+  "dismissHostedNotification",
+  "dismissNotification",
+  "defaultUpdateTarget",
+  "deleteSecureStorage",
+  "enableAutoStart",
+  "exitApp",
+  "exitHostedApp",
+  "focusNode",
+  "focusHostedNode",
+  "getAppInfo",
+  "getAppPaths",
+  "getCursorScreenPosition",
+  "getDesktopIntegrationSupport",
+  "getDisplays",
+  "getHostedAppInfo",
+  "getHostedAppPaths",
+  "getHostedCursorScreenPosition",
+  "getHostedDesktopIntegrationSupport",
+  "getHostedDisplays",
+  "getHostedKeyboardLayout",
+  "getHostedSystemInfo",
+  "getHostedSystemPreferences",
+  "getHostedWindowRegistry",
+  "getHostedWindowState",
+  "getKeyboardLayout",
+  "getPermissionStatus",
+  "getPowerState",
+  "getSecureStorage",
+  "getSessionState",
+  "getSystemIdleState",
+  "getSystemIdleTime",
+  "getSystemInfo",
+  "getSystemPreferences",
+  "getWindowRegistry",
+  "getWindowState",
+  "installUpdate",
+  "isAutoStartEnabled",
+  "isAutoStartSupported",
+  "isAppReady",
+  "isHostedAppReady",
+  "isProtocolRegistered",
+  "isSecureStorageSupported",
+  "performGlobalShortcutAction",
+  "performHostedGlobalShortcutAction",
+  "performHostedNotificationPermissionRequest",
+  "performHostedShellAction",
+  "performHostedWindowAction",
+  "performHostedWindowImageAction",
+  "performNotificationPermissionRequest",
+  "performShellAction",
+  "performWindowAction",
+  "performWindowImageAction",
+  "protocolVersion",
+  "prepareApp",
+  "prepareHostedApp",
+  "pumpApp",
+  "readClipboard",
+  "readHostedClipboard",
+  "registerProtocol",
+  "relaunchApp",
+  "relaunchHostedApp",
+  "releaseHostedSingleInstanceLock",
+  "releaseSingleInstanceLock",
+  "removeHostedTrayIcon",
+  "removeTrayIcon",
+  "requestFileIcon",
+  "requestHostedFileIcon",
+  "requestHostedSingleInstanceLock",
+  "requestPermission",
+  "requestSingleInstanceLock",
+  "runAppHost",
+  "setApplicationMenu",
+  "setDockBadge",
+  "setDockIcon",
+  "setDockMenu",
+  "setHostedApplicationMenu",
+  "setHostedDockBadge",
+  "setHostedDockIcon",
+  "setHostedDockMenu",
+  "setHostedTrayIcon",
+  "setHostedUserTasks",
+  "setSecureStorage",
+  "setTrayIcon",
+  "setUserTasks",
+  "showAboutPanel",
+  "showAlertDialog",
+  "showHostedAboutPanel",
+  "showHostedAlertDialog",
+  "showHostedNotification",
+  "showHostedOpenDialog",
+  "showHostedSaveDialog",
+  "showHostedTrayMenu",
+  "showOpenDialog",
+  "showSaveDialog",
+  "showTrayMenu",
+  "showNotification",
+  "startApp",
+  "startHostedApp",
+  "stageUpdate",
+  "supportsDynamicProtocolRegistration",
+  "takeEvents",
+  "waitForHostedEvents",
+  "unregisterProtocol",
+  "verifyUpdate",
+  "writeClipboard",
+  "writeHostedClipboard",
+] as const;
+
+const nativeBindingShimSuffix = ".quickgui-binding-shim.js";
+
+export async function buildProject(
+  config: ResolvedQuickGuiConfig,
+  options: BuildProjectOptions,
+): Promise<BuildResult> {
+  const info = targetInfo(options.target);
+  validateInputs(config, info.platform);
+  if (info.platform === "darwin" && options.mode === "production") {
+    validateMacPackaging(config, options);
+  }
+  const baseOutDir = options.outDir
+    ? resolve(config.projectRoot, options.outDir)
+    : options.mode === "development"
+      ? resolve(config.projectRoot, ".quickgui", "dev")
+      : config.outDir;
+  const targetOutDir = resolve(baseOutDir, options.target);
+  mkdirSync(targetOutDir, { recursive: true });
+  const stagingRoot = mkdtempSync(join(targetOutDir, ".quickgui-staging-"));
+
+  try {
+    const staged =
+      info.platform === "darwin"
+        ? await buildMacApp(config, options, stagingRoot)
+        : await buildExecutable(config, options, stagingRoot);
+    const finalPath = resolve(targetOutDir, basename(staged.artifactPath));
+    const finalDmgPath = staged.dmgPath
+      ? resolve(targetOutDir, basename(staged.dmgPath))
+      : undefined;
+    replaceArtifacts(
+      [
+        { stagedPath: staged.artifactPath, finalPath },
+        ...(staged.dmgPath && finalDmgPath
+          ? [{ stagedPath: staged.dmgPath, finalPath: finalDmgPath }]
+          : []),
+      ],
+      stagingRoot,
+    );
+    const executablePath = resolve(finalPath, relative(staged.artifactPath, staged.executablePath));
+    return {
+      artifactPath: finalPath,
+      executablePath,
+      target: options.target,
+      mode: options.mode,
+      ...(finalDmgPath ? { dmgPath: finalDmgPath } : {}),
+    };
+  } finally {
+    if (existsSync(stagingRoot)) rmSync(stagingRoot, { recursive: true, force: true });
+  }
+}
+
+async function buildMacApp(
+  config: ResolvedQuickGuiConfig,
+  options: BuildProjectOptions,
+  stagingRoot: string,
+): Promise<BuildResult> {
+  if (process.platform !== "darwin") {
+    throw new CliError("macOS .app bundles must currently be assembled and signed on macOS");
+  }
+  const identity = options.signingIdentity ?? config.macos.signingIdentity ?? "-";
+  const notarization =
+    options.mode === "production"
+      ? (options.notarization ?? config.macos.notarization)
+      : undefined;
+  const displayName = options.mode === "development" ? `${config.name} Dev` : config.name;
+  const identifier =
+    options.mode === "development" ? `${config.identifier}.dev` : config.identifier;
+  const appPath = resolve(stagingRoot, `${config.executableName}.app`);
+  const contents = resolve(appPath, "Contents");
+  const macos = resolve(contents, "MacOS");
+  const resources = resolve(contents, "Resources");
+  mkdirSync(macos, { recursive: true });
+  mkdirSync(resources, { recursive: true });
+  const executablePath = resolve(macos, config.executableName);
+  await compileExecutable(config, options, executablePath, stagingRoot);
+  chmodSync(executablePath, 0o755);
+
+  let iconFile: string | undefined;
+  if (config.macos.icon) {
+    if (extname(config.macos.icon).toLowerCase() !== ".icns") {
+      throw new CliError("macos.icon must point to an .icns file");
+    }
+    iconFile = "AppIcon.icns";
+  }
+  const reservedResources = new Set<string>([
+    ...(iconFile ? [iconFile] : []),
+  ]);
+  copyResources(config.resources, resources, reservedResources);
+  if (config.macos.icon && iconFile) {
+    cpSync(config.macos.icon, resolve(resources, iconFile));
+  }
+  writeFileSync(
+    resolve(contents, "Info.plist"),
+    macInfoPlist({
+      name: config.name,
+      displayName,
+      executableName: config.executableName,
+      identifier,
+      version: config.version,
+      buildVersion: config.buildVersion,
+      minimumSystemVersion: config.macos.minimumSystemVersion,
+      category: config.macos.category,
+      urlSchemes: config.protocols,
+      ...(iconFile ? { iconFile } : {}),
+    }),
+  );
+  writeFileSync(resolve(contents, "PkgInfo"), "APPL????");
+
+  const signArguments = ["codesign", "--force", "--deep"];
+  if (options.mode === "production" && identity !== "-") {
+    signArguments.push("--options", "runtime", "--timestamp");
+  }
+  signArguments.push("--sign", identity);
+  if (config.macos.entitlements) {
+    signArguments.push("--entitlements", config.macos.entitlements);
+  }
+  signArguments.push(appPath);
+  await run(signArguments, config.projectRoot);
+  await run(["codesign", "--verify", "--deep", "--strict", appPath], config.projectRoot);
+
+  const dmgPath =
+    options.mode === "production"
+      ? await buildMacDmg(config, appPath, stagingRoot, identity, notarization)
+      : undefined;
+
+  return {
+    artifactPath: appPath,
+    executablePath,
+    target: options.target,
+    mode: options.mode,
+    ...(dmgPath ? { dmgPath } : {}),
+  };
+}
+
+async function buildMacDmg(
+  config: ResolvedQuickGuiConfig,
+  appPath: string,
+  stagingRoot: string,
+  identity: string,
+  notarization?: MacOSNotarizationConfig,
+): Promise<string> {
+  const dmgPath = resolve(stagingRoot, macDmgFilename(config.name, config.version));
+  const dmgTitle = config.macos.dmgTitle ?? config.name;
+  const createDmgCli = resolveCreateDmgCli();
+  await run(
+    [
+      resolveNodeExecutable(),
+      createDmgCli,
+      "--overwrite",
+      "--no-code-sign",
+      `--dmg-title=${dmgTitle}`,
+      appPath,
+      stagingRoot,
+    ],
+    config.projectRoot,
+  );
+  if (!existsSync(dmgPath) || !statSync(dmgPath).isFile()) {
+    throw new CliError(`create-dmg did not produce the expected disk image: ${dmgPath}`);
+  }
+
+  if (identity !== "-") {
+    await run(
+      ["codesign", "--force", "--timestamp", "--sign", identity, dmgPath],
+      config.projectRoot,
+    );
+    await run(["codesign", "--verify", "--strict", dmgPath], config.projectRoot);
+  }
+
+  if (notarization) {
+    console.log(`[quickgui] Notarizing ${basename(dmgPath)}`);
+    await run(macNotarytoolArguments(dmgPath, notarization), config.projectRoot);
+    await run(["xcrun", "stapler", "staple", dmgPath], config.projectRoot);
+    await run(["xcrun", "stapler", "validate", dmgPath], config.projectRoot);
+  }
+
+  return dmgPath;
+}
+
+function resolveCreateDmgCli(): string {
+  try {
+    return Bun.resolveSync("create-dmg/cli.js", import.meta.dir);
+  } catch (error) {
+    throw new CliError("Could not resolve the bundled create-dmg CLI", { cause: error });
+  }
+}
+
+function resolveNodeExecutable(): string {
+  const node = Bun.which("node");
+  if (!node) {
+    throw new CliError("create-dmg requires Node.js 20 or later to build a macOS disk image");
+  }
+  return node;
+}
+
+export function macDmgFilename(name: string, version: string): string {
+  const filename = `${name} ${version}.dmg`;
+  if (filename.includes("\0") || basename(filename) !== filename) {
+    throw new CliError("Application name and version cannot contain path separators on macOS");
+  }
+  return filename;
+}
+
+export function macNotarytoolArguments(
+  dmgPath: string,
+  notarization: MacOSNotarizationConfig,
+): string[] {
+  return [
+    "xcrun",
+    "notarytool",
+    "submit",
+    dmgPath,
+    "--keychain-profile",
+    notarization.keychainProfile,
+    ...(notarization.keychain ? ["--keychain", notarization.keychain] : []),
+    "--wait",
+  ];
+}
+
+async function buildExecutable(
+  config: ResolvedQuickGuiConfig,
+  options: BuildProjectOptions,
+  stagingRoot: string,
+): Promise<BuildResult> {
+  const info = targetInfo(options.target);
+  const suffix = info.platform === "windows" ? ".exe" : "";
+  const executablePath = resolve(stagingRoot, `${config.executableName}${suffix}`);
+  await compileExecutable(config, options, executablePath, stagingRoot);
+  if (info.platform !== "windows") chmodSync(executablePath, 0o755);
+  return {
+    artifactPath: executablePath,
+    executablePath,
+    target: options.target,
+    mode: options.mode,
+  };
+}
+
+async function compileExecutable(
+  config: ResolvedQuickGuiConfig,
+  options: BuildProjectOptions,
+  executablePath: string,
+  stagingRoot: string,
+): Promise<void> {
+  const info = targetInfo(options.target);
+  const windows =
+    info.platform === "windows"
+      ? {
+          hideConsole: config.windows.hideConsole,
+          title: config.name,
+          version: windowsVersion(config.version),
+          ...(config.windows.icon ? { icon: config.windows.icon } : {}),
+          ...(config.windows.publisher ? { publisher: config.windows.publisher } : {}),
+          ...(config.windows.description ? { description: config.windows.description } : {}),
+          ...(config.windows.copyright ? { copyright: config.windows.copyright } : {}),
+        }
+      : undefined;
+
+  let result: Bun.BuildOutput;
+  try {
+    const production = options.mode === "production";
+    const hostEntrypoint = resolve(stagingRoot, "quickgui-app-host.ts");
+    const workerEntrypoint = resolve(stagingRoot, "quickgui-app-worker.ts");
+    const nativeHostModule = Bun.resolveSync("@quickgui/native/host", import.meta.dir);
+    const nativeApplicationModule = Bun.resolveSync("@quickgui/native", import.meta.dir);
+    const embeddedFonts = config.fonts.map((font) =>
+      readFileSync(font).toString("base64"),
+    );
+    writeFileSync(
+      hostEntrypoint,
+      `import { runApplicationWorker } from ${JSON.stringify(nativeHostModule)};\n` +
+        `const exitCode = await runApplicationWorker("./quickgui-app-worker.ts");\n` +
+        `process.exit(exitCode);\n`,
+    );
+    writeFileSync(
+      workerEntrypoint,
+      `import { Buffer } from "node:buffer";\n` +
+        `postMessage("quickgui:worker-ready");\n` +
+        `import { reportWorkerFailure } from ${JSON.stringify(nativeHostModule)};\n` +
+        `(globalThis as any).__QUICKGUI_APP_OPTIONS__ = ${JSON.stringify({
+          name: config.name,
+          version: config.version,
+          identifier: config.identifier,
+        }).slice(0, -1)}${
+          embeddedFonts.length > 0
+            ? `,"fonts":[${embeddedFonts
+                .map((font) => `Buffer.from(${JSON.stringify(font)},"base64")`)
+                .join(",")}]}`
+            : "}"
+        };\n` +
+        `try {\n  await import(${JSON.stringify(config.entry)});\n` +
+        `  const { app } = await import(${JSON.stringify(nativeApplicationModule)});\n` +
+        `  await app.run();\n} catch (error) {\n` +
+        `  reportWorkerFailure(error);\n  throw error;\n}\n`,
+    );
+    result = await Bun.build({
+      entrypoints: [hostEntrypoint, workerEntrypoint],
+      throw: false,
+      target: "bun",
+      format: "esm",
+      conditions: ["browser"],
+      plugins: [
+        quickguiSolidPlugin({ development: !production, projectRoot: config.projectRoot }),
+        nativeBindingPlugin(info.nativeAddon, options.target),
+      ],
+      minify: production,
+      sourcemap: production ? "none" : "inline",
+      env: "disable",
+      define: {
+        "process.env.NODE_ENV": JSON.stringify(
+          options.mode === "development" ? "development" : "production",
+        ),
+      },
+      compile: {
+        target: info.bunTarget,
+        outfile: executablePath,
+        autoloadDotenv: false,
+        autoloadBunfig: false,
+        autoloadPackageJson: !production,
+        autoloadTsconfig: !production,
+        ...(windows ? { windows } : {}),
+      },
+    });
+  } catch (error) {
+    throw new CliError(`Application compilation failed\n${errorMessage(error)}`);
+  }
+  if (!result.success) {
+    throw new CliError(
+      `Application compilation failed\n${result.logs.map((log) => String(log)).join("\n")}`,
+    );
+  }
+}
+
+export function nativeBindingPlugin(
+  addonFile: string,
+  target: QuickGuiTarget,
+): BunPlugin {
+  const packageRoots = new Map<string, string | undefined>();
+  return {
+    name: "quickgui-native-binding",
+    setup(build) {
+      build.onResolve({ filter: /^\.\/binding\.js$/ }, (arguments_) => {
+        if (!arguments_.importer) return;
+        let importer: string;
+        try {
+          importer = realpathSync(arguments_.importer);
+        } catch {
+          return;
+        }
+        let packageRoot = packageRoots.get(importer);
+        if (!packageRoots.has(importer)) {
+          packageRoot = findPackageRoot(importer, "@quickgui/native");
+          packageRoots.set(importer, packageRoot);
+        }
+        if (!packageRoot) return;
+        const addonPath = resolve(packageRoot, addonFile);
+        if (!existsSync(addonPath)) {
+          throw new CliError(
+            `The installed @quickgui/native package does not contain ${addonFile}. ` +
+              `Install a native package that supports ${target} or choose an available target.`,
+          );
+        }
+        // Keep the generated JavaScript shim and the actual `.node` module at distinct module
+        // identities. Reusing `addonPath` for both makes Bun resolve the shim's own `require()`
+        // back to itself, producing a recursive initializer in the standalone executable.
+        return {
+          path: `${addonPath}${nativeBindingShimSuffix}`,
+          namespace: "quickgui-native",
+        };
+      });
+      build.onLoad({ filter: /.*/, namespace: "quickgui-native" }, ({ path }) => ({
+        // Bun embeds directly required Node-API addons in standalone executables. The literal
+        // target path must point at the real `.node` file, not this virtual shim.
+        contents:
+          `const nativeBinding = require(${JSON.stringify(path.slice(0, -nativeBindingShimSuffix.length))});\n` +
+          `export const { ${nativeExports.join(", ")} } = nativeBinding;\n`,
+        loader: "js",
+      }));
+    },
+  };
+}
+
+function findPackageRoot(importer: string, expectedName: string): string | undefined {
+  let directory = dirname(importer);
+  for (;;) {
+    const packageJson = resolve(directory, "package.json");
+    if (existsSync(packageJson)) {
+      try {
+        const metadata = JSON.parse(readFileSync(packageJson, "utf8")) as { name?: unknown };
+        if (metadata.name === expectedName) return directory;
+      } catch {
+        return undefined;
+      }
+    }
+    const parent = dirname(directory);
+    if (parent === directory) return undefined;
+    directory = parent;
+  }
+}
+
+function replaceArtifacts(
+  artifacts: Array<{ stagedPath: string; finalPath: string }>,
+  stagingRoot: string,
+): void {
+  const backups: Array<{ finalPath: string; backupPath: string }> = [];
+  const installed: Array<{ stagedPath: string; finalPath: string }> = [];
+  try {
+    for (const [index, artifact] of artifacts.entries()) {
+      if (existsSync(artifact.finalPath)) {
+        const backupPath = resolve(stagingRoot, `.quickgui-previous-artifact-${index}`);
+        renameSync(artifact.finalPath, backupPath);
+        backups.push({ finalPath: artifact.finalPath, backupPath });
+      }
+      renameSync(artifact.stagedPath, artifact.finalPath);
+      installed.push(artifact);
+    }
+  } catch (error) {
+    for (const artifact of installed.reverse()) {
+      renameSync(artifact.finalPath, artifact.stagedPath);
+    }
+    for (const backup of backups.reverse()) {
+      renameSync(backup.backupPath, backup.finalPath);
+    }
+    throw error;
+  }
+  for (const backup of backups) {
+    rmSync(backup.backupPath, { recursive: true, force: true });
+  }
+}
+
+function validateMacPackaging(
+  config: ResolvedQuickGuiConfig,
+  options: BuildProjectOptions,
+): void {
+  resolveNodeExecutable();
+  resolveCreateDmgCli();
+  macDmgFilename(config.name, config.version);
+  const dmgTitle = config.macos.dmgTitle ?? config.name;
+  if (dmgTitle.length > 27) {
+    throw new CliError(
+      "The macOS DMG title cannot exceed 27 characters; set macos.dmgTitle to a shorter title",
+    );
+  }
+  const identity = options.signingIdentity ?? config.macos.signingIdentity ?? "-";
+  const notarization = options.notarization ?? config.macos.notarization;
+  if (notarization && identity === "-") {
+    throw new CliError(
+      "macOS notarization requires a Developer ID signing identity; configure macos.signingIdentity or pass --sign",
+    );
+  }
+}
+
+function validateInputs(
+  config: ResolvedQuickGuiConfig,
+  platform: "darwin" | "linux" | "windows",
+): void {
+  if (!existsSync(config.entry) || !statSync(config.entry).isFile()) {
+    throw new CliError(`Application entrypoint not found: ${config.entry}`);
+  }
+  for (const resource of config.resources) {
+    if (!existsSync(resource)) throw new CliError(`Resource not found: ${resource}`);
+  }
+  for (const font of config.fonts) {
+    if (!existsSync(font) || !statSync(font).isFile()) {
+      throw new CliError(`Font file not found: ${font}`);
+    }
+  }
+  if (platform === "darwin") {
+    if (config.macos.icon && !existsSync(config.macos.icon)) {
+      throw new CliError(`macOS icon not found: ${config.macos.icon}`);
+    }
+    if (config.macos.entitlements && !existsSync(config.macos.entitlements)) {
+      throw new CliError(`macOS entitlements not found: ${config.macos.entitlements}`);
+    }
+  }
+  if (platform === "windows" && config.windows.icon && !existsSync(config.windows.icon)) {
+    throw new CliError(`Windows icon not found: ${config.windows.icon}`);
+  }
+}
+
+function copyResources(
+  paths: string[],
+  destination: string,
+  reservedNames: ReadonlySet<string> = new Set(),
+): void {
+  const names = new Map(
+    [...reservedNames].map((name) => [name.toLocaleLowerCase("en-US"), name] as const),
+  );
+  for (const path of paths) {
+    const name = basename(path);
+    const normalizedName = name.toLocaleLowerCase("en-US");
+    const previous = names.get(normalizedName);
+    if (previous) {
+      throw new CliError(
+        `Resource destination name is reserved or duplicated: ${name} conflicts with ${previous}`,
+      );
+    }
+    names.set(normalizedName, name);
+    cpSync(path, resolve(destination, name), { recursive: statSync(path).isDirectory() });
+  }
+}
+
+async function run(command: string[], cwd: string): Promise<void> {
+  const child = Bun.spawn(command, {
+    cwd,
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [status, stdout, stderr] = await Promise.all([
+    child.exited,
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+  ]);
+  if (status !== 0) {
+    const detail = stderr.trim() || stdout.trim();
+    throw new CliError(`Command failed: ${command.join(" ")}${detail ? `\n${detail}` : ""}`);
+  }
+}
+
+function windowsVersion(version: string): string {
+  const parts = version
+    .split(".")
+    .slice(0, 4)
+    .map((part) => (/^\d+$/.test(part) ? Number(part) : 0));
+  while (parts.length < 4) parts.push(0);
+  return parts.map((part) => Math.max(0, Math.min(65_535, part))).join(".");
+}
+
+interface MacInfoPlistOptions {
+  name: string;
+  displayName: string;
+  executableName: string;
+  identifier: string;
+  version: string;
+  buildVersion: string;
+  minimumSystemVersion: string;
+  category: string;
+  urlSchemes?: readonly string[];
+  iconFile?: string;
+}
+
+export function macInfoPlist(options: MacInfoPlistOptions): string {
+  const icon = options.iconFile
+    ? `\n  <key>CFBundleIconFile</key>\n  <string>${xml(options.iconFile)}</string>`
+    : "";
+  const urlTypes = options.urlSchemes?.length
+    ? `
+  <key>CFBundleURLTypes</key>
+  <array>
+    <dict>
+      <key>CFBundleTypeRole</key>
+      <string>Editor</string>
+      <key>CFBundleURLName</key>
+      <string>${xml(options.identifier)}</string>
+      <key>CFBundleURLSchemes</key>
+      <array>${options.urlSchemes
+        .map((scheme) => `\n        <string>${xml(scheme)}</string>`)
+        .join("")}
+      </array>
+    </dict>
+  </array>`
+    : "";
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleDevelopmentRegion</key>
+  <string>en</string>
+  <key>CFBundleDisplayName</key>
+  <string>${xml(options.displayName)}</string>
+  <key>CFBundleExecutable</key>
+  <string>${xml(options.executableName)}</string>${icon}
+  <key>CFBundleIdentifier</key>
+  <string>${xml(options.identifier)}</string>
+  <key>CFBundleInfoDictionaryVersion</key>
+  <string>6.0</string>
+  <key>CFBundleName</key>
+  <string>${xml(options.name)}</string>
+  <key>CFBundlePackageType</key>
+  <string>APPL</string>
+  <key>CFBundleShortVersionString</key>
+  <string>${xml(options.version)}</string>
+  <key>CFBundleVersion</key>
+  <string>${xml(options.buildVersion)}</string>${urlTypes}
+  <key>LSApplicationCategoryType</key>
+  <string>${xml(options.category)}</string>
+  <key>LSMinimumSystemVersion</key>
+  <string>${xml(options.minimumSystemVersion)}</string>
+  <key>NSHighResolutionCapable</key>
+  <true/>
+</dict>
+</plist>
+`;
+}
+
+function xml(value: string): string {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&apos;");
+}