akanjs 3.0.0-beta.30 → 3.0.0-beta.32

package/vendor/@akanjs/native/packages/cli/src/platforms/desktop.ts

@@ -4,6 +4,7 @@ import { createHash } from "node:crypto";
 import { cpSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
+import { addonReport } from "../lib/addons.ts";
 import type { ParsedArgs } from "../lib/args.ts";
 import { makeNativeBoot } from "../lib/boot.ts";
 import { exec, execOrThrow } from "../lib/exec.ts";
@@ -13,7 +14,7 @@ import { desktopModuleProblems, pluginFile } from "../lib/native-plugins.ts";
 import type { BuildContext } from "../lib/prepare.ts";
 import { PACKAGE_ROOT } from "../lib/root.ts";
 import { akanNativeHome } from "../lib/toolchains.ts";
-import { updatesResource } from "../lib/updates.ts";
+import { type DesktopArch, hostArch, updatesResource } from "../lib/updates.ts";
 
 export const NATIVE_DIR = join(PACKAGE_ROOT, "native", "desktop");
 const DESKTOP_PKG = join(PACKAGE_ROOT, "packages", "desktop", "src");
@@ -70,12 +71,12 @@ const TRIPLE_OS: Record<DesktopOs, string> = {
 };
 
 /**
- * The target the library must be built for: the architecture of the Bun that compiles (and so
- * runs) the app, which can differ from rustc's host (x64 Bun on an ARM64 PC, under emulation).
- * Null when it is rustc's host, so the usual target/<profile> folder is used.
+ * The target the library must be built for: the app's CPU, which can differ from rustc's host (an x64 app built on
+ * an ARM64 Mac, or x64 Bun on an ARM64 PC under emulation). Null when it is rustc's host, so the usual
+ * target/<profile> folder is used.
  */
-async function libraryTarget(os: DesktopOs): Promise<string | null> {
-  const wanted = `${ARCH[process.arch] ?? process.arch}-${TRIPLE_OS[os]}`;
+async function libraryTarget(os: DesktopOs, arch: DesktopArch): Promise<string | null> {
+  const wanted = `${ARCH[arch] ?? arch}-${TRIPLE_OS[os]}`;
   const verbose = await exec(["rustc", "-vV"], { cwd: NATIVE_DIR, env: cargoEnv(), echo: false });
   const host = /^host: (\S+)/m.exec(verbose.stdout)?.[1];
   return host && host !== wanted ? wanted : null;
@@ -93,16 +94,14 @@ export function cargoTargetDir(): string {
 }
 
 /** Builds (incrementally) the Rust cdylib and returns its path. */
-export async function buildNativeLibrary(os: DesktopOs, release: boolean): Promise<string> {
-  log.step("native: cargo build (TAO + WRY)");
-  const target = await libraryTarget(os);
+export async function buildNativeLibrary(os: DesktopOs, release: boolean, arch = hostArch()): Promise<string> {
+  log.step(`native: cargo build (TAO + WRY)${arch === hostArch() ? "" : ` for ${arch}`}`);
+  const target = await libraryTarget(os, arch);
   
   const args = ["cargo", "build", "--locked", "--manifest-path", join(NATIVE_DIR, "Cargo.toml"), "--quiet"];
   if (release) args.push("--release");
   if (target) {
-    log.info(
-      dim(`for ${target} (Bun is ${process.arch}); if the standard library is missing: rustup target add ${target}`),
-    );
+    log.info(dim(`for ${target}; if its standard library is missing: rustup target add ${target}`));
     args.push("--target", target);
   }
   await execOrThrow(args, {
@@ -153,8 +152,19 @@ startMain(new URL("./host-entry.ts", import.meta.url).href);
  */
 export const COMPILE_FLAGS = ["--no-compile-autoload-dotenv", "--no-compile-autoload-bunfig"];
 
-/** bun build --compile of the main thread entry and the plugin host Worker into `outfile`. */
+/** The CPU a desktop build makes code for. */
+export function targetArch(ctx: Pick<BuildContext, "arch">): DesktopArch {
+  return ctx.arch ?? hostArch();
+}
+
+const BUN_OS: Record<DesktopOs, string> = { macos: "darwin", windows: "windows", linux: "linux" };
+
+/**
+ * bun build --compile of the main thread entry and the plugin host Worker into `outfile`, for the build's CPU: another
+ * CPU's Bun is a cross-compilation target Bun downloads once.
+ */
 export async function compileExecutable(ctx: BuildContext, outfile: string, extra: string[] = []): Promise<void> {
+  const arch = targetArch(ctx);
   const problems = (await Promise.all(ctx.project.plugins.map(desktopModuleProblems))).flat();
   if (problems.length)
     throw new CliError(`desktop plugin modules do not match their manifests:\n  - ${problems.join("\n  - ")}`);
@@ -171,6 +181,7 @@ export async function compileExecutable(ctx: BuildContext, outfile: string, extr
       "--outfile",
       outfile,
       ...(ctx.dev ? [] : ["--minify"]),
+      ...(arch === hostArch() ? [] : [`--target=bun-${BUN_OS[ctx.platform as DesktopOs]}-${arch}`]),
       ...extra,
     ],
     {
@@ -214,6 +225,12 @@ export function writeDesktopResources(
       log.warn(
         "desktop.server without the single-instance plugin: every launch starts another server on the same data",
       );
+    const addons = addonReport(server.dir, os, targetArch(ctx));
+    for (const warning of addons.warnings) log.warn(warning);
+    if (addons.problems.length)
+      throw new CliError(
+        `the server's native addons would not load on a user's computer:\n  - ${addons.problems.join("\n  - ")}`,
+      );
     cpSync(server.dir, join(resources, "server"), { recursive: true, verbatimSymlinks: true });
     writeFileSync(join(resources, "server.json"), JSON.stringify({ entry: server.entry, env: server.env }));
     writeFileSync(join(resources, "server.bunfig.toml"), "");

package/vendor/@akanjs/native/packages/cli/src/platforms/linux-appimage.ts

@@ -0,0 +1,84 @@
+
+
+import { chmodSync, cpSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { execOrThrow } from "../lib/exec.ts";
+import { iconArt } from "../lib/icons.ts";
+import { resize } from "../lib/image.ts";
+import { log, ToolchainError } from "../lib/log.ts";
+import { encodePng } from "../lib/png.ts";
+import type { BuildContext } from "../lib/prepare.ts";
+import { ensureInstalled, TOOLCHAIN } from "../lib/toolchains.ts";
+import { targetArch } from "./desktop.ts";
+
+/** The launcher entry (freedesktop Desktop Entry): what a menu shows and which link schemes open the app. */
+export function desktopEntry(input: { name: string; fileName: string; schemes: string[] }): string {
+  const escape = (value: string) => value.replace(/\\/g, "\\\\").replace(/\n/g, "\\n");
+  return [
+    "[Desktop Entry]",
+    "Type=Application",
+    `Name=${escape(input.name)}`,
+    `Exec=${input.fileName} %u`,
+    `Icon=${input.fileName}`,
+    "Terminal=false",
+    "Categories=Utility;",
+    ...(input.schemes.length ? [`MimeType=${input.schemes.map((s) => `x-scheme-handler/${s};`).join("")}`] : []),
+    "",
+  ].join("\n");
+}
+
+/** AppRun: the runtime starts it from the mounted image; it starts the app from beside itself. */
+export function appRun(exe: string): string {
+  return `#!/bin/sh
+HERE="$(dirname "$(readlink -f "$0")")"
+exec "$HERE/${exe}" "$@"
+`;
+}
+
+/** Writes the AppImage beside the app folder and answers its path. */
+export async function buildAppImage(ctx: BuildContext, folder: string): Promise<string> {
+  const mksquashfs = Bun.which("mksquashfs");
+  if (!mksquashfs)
+    throw new ToolchainError("mksquashfs packs the AppImage: apt install squashfs-tools (dnf install squashfs-tools)");
+  const { config } = ctx.project;
+  const arch = targetArch(ctx);
+  const spec = TOOLCHAIN.appimageRuntime.downloads[arch];
+  if (!spec) throw new ToolchainError(`no pinned AppImage runtime for ${arch}`);
+  const runtime = join(
+    await ensureInstalled("appimage-runtime", `${TOOLCHAIN.appimageRuntime.version}-${arch}`, spec),
+    spec.root,
+  );
+  if (config.updates)
+    log.warn(
+      "an AppImage runs from a read-only image, so the updates plugin cannot replace it: publish a new AppImage for each release",
+    );
+
+  const appDir = join(ctx.outDir, "gen", "AppDir");
+  rmSync(appDir, { recursive: true, force: true });
+  cpSync(folder, appDir, { recursive: true, verbatimSymlinks: true });
+  writeFileSync(join(appDir, "AppRun"), appRun(config.app.fileName));
+  chmodSync(join(appDir, "AppRun"), 0o755);
+  writeFileSync(
+    join(appDir, `${config.app.fileName}.desktop`),
+    desktopEntry({ name: config.app.name, fileName: config.app.fileName, schemes: config.deepLinks.schemes }),
+  );
+  const art = iconArt(config);
+  if (art) {
+    writeFileSync(join(appDir, `${config.app.fileName}.png`), encodePng(resize(art.master, 256, 256)));
+    symlinkSync(`${config.app.fileName}.png`, join(appDir, ".DirIcon"));
+  }
+
+  log.step("installer: AppImage");
+  const squashfs = join(ctx.outDir, "gen", "app.squashfs");
+  rmSync(squashfs, { force: true });
+  await execOrThrow(
+    [mksquashfs, appDir, squashfs, "-root-owned", "-noappend", "-comp", "zstd", "-no-progress", "-quiet"],
+    { echo: false },
+  );
+  const outFile = join(ctx.outDir, `${config.app.fileName}-${config.app.version}-${arch}.AppImage`);
+  writeFileSync(outFile, Buffer.concat([readFileSync(runtime), readFileSync(squashfs)]));
+  chmodSync(outFile, 0o755);
+  rmSync(squashfs, { force: true });
+  log.info(`installer ${outFile} (${Math.round(readFileSync(outFile).length / 1024 / 1024)} MB)`);
+  return outFile;
+}

package/vendor/@akanjs/native/packages/cli/src/platforms/linux.ts

@@ -16,8 +16,10 @@ import {
   requireHost,
   resourcesOf,
   runExecutable,
+  targetArch,
   writeDesktopResources,
 } from "./desktop.ts";
+import { buildAppImage } from "./linux-appimage.ts";
 
 const exePath = (ctx: BuildContext, dir: string) => join(dir, ctx.project.config.app.fileName);
 
@@ -25,7 +27,7 @@ export async function buildLinux(ctx: BuildContext): Promise<string> {
   requireHost("linux");
   const { outDir } = ctx;
   const { config } = ctx.project;
-  const lib = await buildNativeLibrary("linux", !ctx.dev);
+  const lib = await buildNativeLibrary("linux", !ctx.dev, targetArch(ctx));
 
   const dir = join(outDir, config.app.fileName);
   rmSync(outDir, { recursive: true, force: true });
@@ -38,6 +40,7 @@ export async function buildLinux(ctx: BuildContext): Promise<string> {
   writeDesktopResources(ctx, resources, "linux");
   const art = iconArt(config);
   if (art) writeFileSync(join(resources, "icon.rgba"), windowIcon(art.master));
+  if (ctx.linux?.appImage) ctx.artifacts.push({ kind: "installer", path: await buildAppImage(ctx, dir) });
   const size = await folderSize(dir);
   if (size) log.info(dim(`size ${size}`));
   return dir;

package/vendor/@akanjs/native/packages/cli/src/platforms/macos.ts

@@ -12,16 +12,30 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import type { ParsedArgs } from "../lib/args.ts";
 import { execOrThrow } from "../lib/exec.ts";
 import { icns, iconArt, macosIconImage } from "../lib/icons.ts";
 import type { Launched, LaunchOptions } from "../lib/launch.ts";
 import { dim, log } from "../lib/log.ts";
+import {
+  appEntitlements,
+  assessGatekeeper,
+  buildDmg,
+  codesign,
+  notarize,
+  type ResolvedMacosIdentity,
+  staple,
+  withMacosIdentity,
+  writeEntitlements,
+  zipForNotary,
+} from "../lib/macossigning.ts";
 import { permissionPlist } from "../lib/permissions.ts";
 import { type PlistValue, toPlist } from "../lib/plist.ts";
 import type { BuildContext } from "../lib/prepare.ts";
+import { SigningError } from "../lib/prepare.ts";
 import { devIdentity } from "../lib/signing.ts";
+import { hostArch } from "../lib/updates.ts";
 import {
   buildNativeLibrary,
   compileExecutable,
@@ -30,6 +44,7 @@ import {
   NATIVE_LIB,
   requireHost,
   runExecutable,
+  targetArch,
   writeDesktopResources,
 } from "./desktop.ts";
 
@@ -39,7 +54,7 @@ export async function buildMacos(ctx: BuildContext): Promise<string> {
   requireHost("macos");
   const { project, outDir } = ctx;
   const { config } = project;
-  const lib = await buildNativeLibrary("macos", !ctx.dev);
+  const lib = await buildNativeLibrary("macos", !ctx.dev, targetArch(ctx));
 
   const appPath = join(outDir, `${config.app.name}.app`);
   const contents = join(appPath, "Contents");
@@ -51,53 +66,110 @@ export async function buildMacos(ctx: BuildContext): Promise<string> {
   cpSync(lib, join(contents, "Frameworks", NATIVE_LIB.macos));
 
   const resources = join(contents, "Resources");
-
-  const identity = await devIdentity();
-  writeDesktopResources(ctx, resources, "macos", { signing: identity ? "identity" : "adhoc" });
-
-  const art = iconArt(config);
-  if (art) writeFileSync(join(resources, "AppIcon.icns"), icns(macosIconImage(art)));
-
   const usage: Record<string, PlistValue> = {};
   for (const plugin of project.plugins) Object.assign(usage, plugin.manifest.macos?.infoPlist ?? {});
   Object.assign(usage, permissionPlist(config.permissions, "macos")); 
   for (const key of Object.keys(usage)) if (config.usageDescriptions[key]) usage[key] = config.usageDescriptions[key]!;
-  writeFileSync(
-    join(contents, "Info.plist"),
-    toPlist({
-      CFBundleDevelopmentRegion: "en",
-      CFBundleExecutable: exe,
-      CFBundleIdentifier: config.app.id,
-      CFBundleName: config.app.name,
-      CFBundleDisplayName: config.app.name,
-      CFBundlePackageType: "APPL",
-      CFBundleShortVersionString: config.app.version,
-      CFBundleVersion: String(config.app.build),
-      CFBundleInfoDictionaryVersion: "6.0",
-      LSMinimumSystemVersion: MACOS_MIN,
-      NSHighResolutionCapable: true,
-      NSSupportsAutomaticGraphicsSwitching: true,
-      ...(art ? { CFBundleIconFile: "AppIcon" } : {}),
-      ...(config.deepLinks.schemes.length
-        ? { CFBundleURLTypes: [{ CFBundleURLName: config.app.id, CFBundleURLSchemes: config.deepLinks.schemes }] }
-        : {}),
-      ...usage,
-    }),
+
+  return withMacosIdentity(
+    ctx.macos?.signing,
+    async (identity) => {
+      if (ctx.macos?.notarize && identity.kind !== "distribution")
+        throw new SigningError(
+          `notarization takes a Developer ID Application identity, and the build is signed with "${identity.name}"`,
+        );
+      if (ctx.macos?.notarize && ctx.dev) throw new SigningError("a debug build is never notarized: build a release");
+      writeDesktopResources(ctx, resources, "macos", { signing: shellSigning(identity) });
+
+      const art = iconArt(config);
+      if (art) writeFileSync(join(resources, "AppIcon.icns"), icns(macosIconImage(art)));
+      writeFileSync(
+        join(contents, "Info.plist"),
+        toPlist({
+          CFBundleDevelopmentRegion: "en",
+          CFBundleExecutable: exe,
+          CFBundleIdentifier: config.app.id,
+          CFBundleName: config.app.name,
+          CFBundleDisplayName: config.app.name,
+          CFBundlePackageType: "APPL",
+          CFBundleShortVersionString: config.app.version,
+          CFBundleVersion: String(config.app.build),
+          CFBundleInfoDictionaryVersion: "6.0",
+          LSMinimumSystemVersion: MACOS_MIN,
+          NSHighResolutionCapable: true,
+          NSSupportsAutomaticGraphicsSwitching: true,
+          ...(art ? { CFBundleIconFile: "AppIcon" } : {}),
+          ...(config.deepLinks.schemes.length
+            ? { CFBundleURLTypes: [{ CFBundleURLName: config.app.id, CFBundleURLSchemes: config.deepLinks.schemes }] }
+            : {}),
+          ...usage,
+        }),
+      );
+
+      log.step(`sign: ${identity.name}`);
+      
+      await execOrThrow(["xattr", "-cr", appPath], { echo: false });
+      
+      const team = identity.kind === "development" || identity.kind === "distribution";
+      for (const addon of carriedNativeCode(resources)) await codesign(identity, addon, { hardened: team });
+      await codesign(identity, join(contents, "Frameworks", NATIVE_LIB.macos), { hardened: team });
+      const entitlements = team
+        ? writeEntitlements(
+            join(outDir, "gen"),
+            appEntitlements(usage, (config.native?.macos?.entitlements ?? {}) as Record<string, PlistValue>),
+          )
+        : undefined;
+      await codesign(identity, appPath, { hardened: team, ...(entitlements ? { entitlements } : {}) });
+      await execOrThrow(["codesign", "--verify", "--deep", "--strict", appPath], { echo: false });
+      ctx.signedAs =
+        identity.kind === "distribution" ? "distribution" : identity.kind === "development" ? "development" : "adhoc";
+      if (identity.kind !== "distribution" && !ctx.dev)
+        log.warn(
+          "not signed with a Developer ID: Gatekeeper blocks this app once it is downloaded to another Mac (set AKAN_NATIVE_MACOS_IDENTITY or AKAN_NATIVE_MACOS_CERTIFICATE)",
+        );
+
+      const notarization = ctx.macos?.notarize;
+      if (notarization) {
+        const zip = join(outDir, "gen", `${config.app.fileName}-notarize.zip`);
+        await zipForNotary(appPath, zip);
+        await notarize(zip, notarization);
+        rmSync(zip, { force: true });
+        await staple(appPath);
+        await assessGatekeeper(appPath, "execute");
+      } else if (identity.kind === "distribution" && !ctx.dev)
+        log.warn(
+          "signed with a Developer ID but not notarized: Gatekeeper still blocks a downloaded copy (set AKAN_NATIVE_MACOS_NOTARY_KEY, _KEY_ID and _ISSUER)",
+        );
+
+      if (ctx.macos?.dmg) {
+        const dmg = join(outDir, `${config.app.fileName}-${config.app.version}-${ctx.arch ?? hostArch()}.dmg`);
+        log.step(`dmg: ${basename(dmg)}`);
+        await buildDmg(appPath, dmg, config.app.name, join(outDir, "gen"));
+        
+        if (identity.sign !== "-") await codesign(identity, dmg, { hardened: false, timestamp: team });
+        if (notarization) {
+          await notarize(dmg, notarization);
+          await staple(dmg);
+          await assessGatekeeper(dmg, "open");
+        }
+        ctx.artifacts.push({ kind: "installer", path: dmg });
+      }
+      const size = await folderSize(appPath);
+      if (size) log.info(dim(`size ${size}`));
+      return appPath;
+    },
+    async () => {
+
+      const dev = await devIdentity();
+      return dev ? { sign: dev.hash, name: dev.name, kind: "identity" } : { sign: "-", name: "ad-hoc", kind: "adhoc" };
+    },
   );
+}
 
-  const sign = identity?.hash ?? "-";
-  log.step(`sign: ${identity ? identity.name : "ad-hoc"}`);
-  
-  await execOrThrow(["xattr", "-cr", appPath], { echo: false });
-  for (const addon of carriedNativeCode(resources))
-    await execOrThrow(["codesign", "--force", "--sign", sign, addon], { echo: false });
-  await execOrThrow(["codesign", "--force", "--sign", sign, join(contents, "Frameworks", NATIVE_LIB.macos)], {
-    echo: false,
-  });
-  await execOrThrow(["codesign", "--force", "--sign", sign, appPath], { echo: false });
-  const size = await folderSize(appPath);
-  if (size) log.info(dim(`size ${size}`));
-  return appPath;
+/** shell.json `signing`: secure-storage keeps its items in-process only under a team's signature. */
+function shellSigning(identity: ResolvedMacosIdentity): "team" | "identity" | "adhoc" {
+  if (identity.kind === "development" || identity.kind === "distribution") return "team";
+  return identity.kind === "identity" ? "identity" : "adhoc";
 }
 
 /**

package/vendor/@akanjs/native/packages/cli/src/platforms/windows-installer.ts

@@ -7,6 +7,7 @@ import { CliError, log, ToolchainError } from "../lib/log.ts";
 import type { BuildContext } from "../lib/prepare.ts";
 import { akanNativeHome } from "../lib/toolchains.ts";
 import { hostArch } from "../lib/updates.ts";
+import { signWindowsFiles } from "../lib/windowssigning.ts";
 import { windowsVersion } from "./windows.ts";
 
 /** Microsoft's permanent link to the Evergreen Bootstrapper (MicrosoftEdgeWebview2Setup.exe). */
@@ -41,6 +42,8 @@ export interface InstallerInput {
   bootstrapper: string;
   stopScript: string;
   outFile: string;
+  /** A command that signs the uninstaller makensis writes into the setup program, `%1` its path. */
+  signUninstaller?: string;
 }
 
 /** `$` is NSIS's variable sigil; the names that reach a script cannot hold a quote (config.ts app.name). */
@@ -96,6 +99,7 @@ RequestExecutionLevel user
 
 Name "\${APP_NAME}"
 OutFile "${nsis(input.outFile)}"
+${input.signUninstaller ? `!uninstfinalize '${input.signUninstaller}' = 0\n` : ""}
 InstallDir "$LOCALAPPDATA\\Programs\\\${APP_NAME}"
 InstallDirRegKey HKCU "\${UNINSTALL_KEY}" "InstallLocation"
 BrandingText "\${APP_NAME} ${nsis(input.version)}"
@@ -551,6 +555,22 @@ async function webview2Bootstrapper(): Promise<string> {
   return file;
 }
 
+const SIGNING_ENV = "AKAN_NATIVE_WINDOWS_SIGNING";
+
+/** The command `!uninstfinalize` runs on the uninstaller: this Bun on a script that signs it as the app was signed. */
+function uninstallerSigner(gen: string, description: string): string {
+  const script = join(gen, "sign-uninstaller.ts");
+  writeFileSync(
+    script,
+    `// Generated by akan-native build. Do not edit.
+import { signWindowsFiles } from ${JSON.stringify(join(import.meta.dir, "..", "lib", "windowssigning.ts"))};
+
+await signWindowsFiles(JSON.parse(process.env.${SIGNING_ENV} ?? "{}"), [process.argv[2] ?? ""], ${JSON.stringify(description)});
+`,
+  );
+  return `"${process.execPath}" "${script}" "%1"`;
+}
+
 /** Writes the setup program next to the app folder and answers its path. */
 export async function buildWindowsInstaller(ctx: BuildContext, folder: string): Promise<string> {
   const makensis = findMakensis();
@@ -564,7 +584,7 @@ export async function buildWindowsInstaller(ctx: BuildContext, folder: string):
   const stopScript = join(gen, "stop-app.ps1");
   writeFileSync(stopScript, STOP_SCRIPT);
   const icon = join(gen, "app.ico");
-  const outFile = join(ctx.outDir, `${config.app.fileName}-${config.app.version}-${hostArch()}-setup.exe`);
+  const outFile = join(ctx.outDir, `${config.app.fileName}-${config.app.version}-${ctx.arch ?? hostArch()}-setup.exe`);
   const script = join(gen, "installer.nsi");
   const deepest = deepestPath(folder);
   const longest = installedPathLength(config.app.name, config.app.version, deepest);
@@ -590,12 +610,19 @@ export async function buildWindowsInstaller(ctx: BuildContext, folder: string):
       bootstrapper,
       stopScript,
       outFile,
+      ...(ctx.windows?.signing ? { signUninstaller: uninstallerSigner(gen, `${config.app.name} Uninstall`) } : {}),
     })}`,
   );
   log.step("installer: makensis");
-  const result = await exec([makensis, "/V2", script], { echo: false });
+  const signing = ctx.windows?.signing;
+  const result = await exec([makensis, "/V2", script], {
+    echo: false,
+    
+    ...(signing ? { env: { [SIGNING_ENV]: JSON.stringify(signing) } } : {}),
+  });
   if (result.code !== 0 || !existsSync(outFile))
     throw new CliError(`makensis failed:\n${(result.stdout + result.stderr).trim().split("\n").slice(-20).join("\n")}`);
+  if (signing) await signWindowsFiles(signing, [outFile], `${config.app.name} Setup`);
   log.info(`installer ${outFile} (${Math.round(readFileSync(outFile).length / 1024 / 1024)} MB)`);
   return outFile;
 }

package/vendor/@akanjs/native/packages/cli/src/platforms/windows.ts

@@ -7,6 +7,7 @@ import { ico, iconArt, windowIcon } from "../lib/icons.ts";
 import type { Launched, LaunchOptions } from "../lib/launch.ts";
 import { log } from "../lib/log.ts";
 import type { BuildContext } from "../lib/prepare.ts";
+import { peFiles, signWindowsFiles } from "../lib/windowssigning.ts";
 import {
   buildNativeLibrary,
   compileExecutable,
@@ -15,6 +16,7 @@ import {
   requireHost,
   resourcesOf,
   runExecutable,
+  targetArch,
   writeDesktopResources,
 } from "./desktop.ts";
 import { buildWindowsInstaller } from "./windows-installer.ts";
@@ -39,7 +41,7 @@ export async function buildWindows(ctx: BuildContext): Promise<string> {
   requireHost("windows");
   const { outDir } = ctx;
   const { config } = ctx.project;
-  const lib = await buildNativeLibrary("windows", !ctx.dev);
+  const lib = await buildNativeLibrary("windows", !ctx.dev, targetArch(ctx));
 
   if (config.app.id.length > WEBVIEW2_ID_BUDGET) {
     log.warn(
@@ -71,6 +73,15 @@ export async function buildWindows(ctx: BuildContext): Promise<string> {
   const resources = resourcesOf("windows", dir);
   writeDesktopResources(ctx, resources, "windows");
   if (art) writeFileSync(join(resources, "icon.rgba"), windowIcon(art.master));
+  const signing = ctx.windows?.signing;
+  if (signing) {
+    log.step("sign: Authenticode");
+    await signWindowsFiles(signing, peFiles(dir), config.app.name);
+    ctx.signedAs = "distribution";
+  } else if (!ctx.dev)
+    log.warn(
+      "not signed: SmartScreen warns on a downloaded copy (set AKAN_NATIVE_WINDOWS_CERTIFICATE, _THUMBPRINT or _SIGN_COMMAND)",
+    );
   if (ctx.windows?.installer) ctx.artifacts.push({ kind: "installer", path: await buildWindowsInstaller(ctx, dir) });
   return dir;
 }