electrobun 0.0.19-beta.12 → 0.0.19-beta.128

package/src/cli/index.ts

@@ -1,103 +1,128 @@
-import { join, dirname, basename } from "path";
+import { join, dirname, basename, relative } from "path";
 import {
   existsSync,
   readFileSync,
+  writeFileSync,
   cpSync,
   rmdirSync,
   mkdirSync,
   createWriteStream,
   unlinkSync,
+  readdirSync,
+  rmSync,
+  symlinkSync,
+  statSync,
+  copyFileSync,
 } from "fs";
 import { execSync } from "child_process";
+import * as readline from "readline";
 import tar from "tar";
+import archiver from "archiver";
 import { ZstdInit } from "@oneidentity/zstd-js/wasm";
-import {platform, arch} from 'os';
+import { OS, ARCH } from '../shared/platform';
+import { getTemplate, getTemplateNames } from './templates/embedded';
 // import { loadBsdiff, loadBspatch } from 'bsdiff-wasm';
 // MacOS named pipes hang at around 4KB
 const MAX_CHUNK_SIZE = 1024 * 2;
 
-// TODO: dedup with built.ts
-const OS: 'win' | 'linux' | 'macos' = getPlatform();
-const ARCH: 'arm64' | 'x64' = getArch();
-
-function getPlatform() {
-  switch (platform()) {
-      case "win32":
-          return 'win';
-      case "darwin":
-          return 'macos';
-      case 'linux':
-          return 'linux';
-      default:
-          throw 'unsupported platform';
-  }
-}
 
-function getArch() {
-  switch (arch()) {
-      case "arm64":
-          return 'arm64';
-      case "x64":
-          return 'x64';
-      default:
-          throw 'unsupported arch'
-  }
-}
-
-
-const binExt = OS === 'win' ? '.exe' : '';
+// const binExt = OS === 'win' ? '.exe' : '';
 
 // this when run as an npm script this will be where the folder where package.json is.
 const projectRoot = process.cwd();
-const configName = "electrobun.config";
-const configPath = join(projectRoot, configName);
+
+// Find TypeScript ESM config file
+function findConfigFile(): string | null {
+  const configFile = join(projectRoot, 'electrobun.config.ts');
+  return existsSync(configFile) ? configFile : null;
+}
 
 // Note: cli args can be called via npm bun /path/to/electorbun/binary arg1 arg2
 const indexOfElectrobun = process.argv.findIndex((arg) =>
   arg.includes("electrobun")
 );
-const commandArg = process.argv[indexOfElectrobun + 1] || "launcher";
+const commandArg = process.argv[indexOfElectrobun + 1] || "build";
 
 const ELECTROBUN_DEP_PATH = join(projectRoot, "node_modules", "electrobun");
 
 // When debugging electrobun with the example app use the builds (dev or release) right from the source folder
 // For developers using electrobun cli via npm use the release versions in /dist
 // This lets us not have to commit src build folders to git and provide pre-built binaries
-const PATHS = {
-  BUN_BINARY: join(ELECTROBUN_DEP_PATH, "dist", "bun") + binExt,
-  LAUNCHER_DEV: join(ELECTROBUN_DEP_PATH, "dist", "electrobun") + binExt,
-  LAUNCHER_RELEASE: join(ELECTROBUN_DEP_PATH, "dist", "launcher") + binExt,
-  MAIN_JS: join(ELECTROBUN_DEP_PATH, "dist", "main.js"),  
-  NATIVE_WRAPPER_MACOS: join(
-    ELECTROBUN_DEP_PATH,
-    "dist",
-    "libNativeWrapper.dylib"
-  ),
-  NATIVE_WRAPPER_WIN: join(ELECTROBUN_DEP_PATH, "dist", "libNativeWrapper.dll"),
-  NATIVE_WRAPPER_LINUX: join(ELECTROBUN_DEP_PATH, "dist", "libNativeWrapper.so"),
-  WEBVIEW2LOADER_WIN: join(ELECTROBUN_DEP_PATH, "dist", "WebView2Loader.dll"),
-  BSPATCH: join(ELECTROBUN_DEP_PATH, "dist", "bspatch") + binExt,
-  EXTRACTOR: join(ELECTROBUN_DEP_PATH, "dist", "extractor") + binExt,
-  BSDIFF: join(ELECTROBUN_DEP_PATH, "dist", "bsdiff") + binExt,
-  CEF_FRAMEWORK_MACOS: join(
-    ELECTROBUN_DEP_PATH,
-    "dist",
-    "cef",
-    "Chromium Embedded Framework.framework"
-  ),
-  CEF_HELPER_MACOS: join(ELECTROBUN_DEP_PATH, "dist", "cef", "process_helper"),
-  CEF_HELPER_WIN: join(ELECTROBUN_DEP_PATH, "dist", "cef", "process_helper.exe"),
-  CEF_HELPER_LINUX: join(ELECTROBUN_DEP_PATH, "dist", "cef", "process_helper"),
-  CEF_DIR: join(ELECTROBUN_DEP_PATH, "dist", "cef"),
-};
 
-async function ensureCoreDependencies() {
-  // Check if core dependencies already exist
-  if (existsSync(PATHS.BUN_BINARY) && existsSync(PATHS.LAUNCHER_RELEASE)) {
+// Function to get platform-specific paths
+function getPlatformPaths(targetOS: 'macos' | 'win' | 'linux', targetArch: 'arm64' | 'x64') {
+  const binExt = targetOS === 'win' ? '.exe' : '';
+  const platformDistDir = join(ELECTROBUN_DEP_PATH, `dist-${targetOS}-${targetArch}`);
+  const sharedDistDir = join(ELECTROBUN_DEP_PATH, "dist");
+  
+  return {
+    // Platform-specific binaries (from dist-OS-ARCH/)
+    BUN_BINARY: join(platformDistDir, "bun") + binExt,
+    LAUNCHER_DEV: join(platformDistDir, "electrobun") + binExt,
+    LAUNCHER_RELEASE: join(platformDistDir, "launcher") + binExt,
+    NATIVE_WRAPPER_MACOS: join(platformDistDir, "libNativeWrapper.dylib"),
+    NATIVE_WRAPPER_WIN: join(platformDistDir, "libNativeWrapper.dll"),
+    NATIVE_WRAPPER_LINUX: join(platformDistDir, "libNativeWrapper.so"),
+    NATIVE_WRAPPER_LINUX_CEF: join(platformDistDir, "libNativeWrapper_cef.so"),
+    WEBVIEW2LOADER_WIN: join(platformDistDir, "WebView2Loader.dll"),
+    BSPATCH: join(platformDistDir, "bspatch") + binExt,
+    EXTRACTOR: join(platformDistDir, "extractor") + binExt,
+    BSDIFF: join(platformDistDir, "bsdiff") + binExt,
+    CEF_FRAMEWORK_MACOS: join(platformDistDir, "cef", "Chromium Embedded Framework.framework"),
+    CEF_HELPER_MACOS: join(platformDistDir, "cef", "process_helper"),
+    CEF_HELPER_WIN: join(platformDistDir, "cef", "process_helper.exe"),
+    CEF_HELPER_LINUX: join(platformDistDir, "cef", "process_helper"),
+    CEF_DIR: join(platformDistDir, "cef"),
+    
+    // Shared platform-independent files (from dist/)
+    // These work with existing package.json and development workflow
+    MAIN_JS: join(sharedDistDir, "main.js"),
+    API_DIR: join(sharedDistDir, "api"),
+  };
+}
+
+// Default PATHS for host platform (backward compatibility)
+const PATHS = getPlatformPaths(OS, ARCH);
+
+async function ensureCoreDependencies(targetOS?: 'macos' | 'win' | 'linux', targetArch?: 'arm64' | 'x64') {
+  // Use provided target platform or default to host platform
+  const platformOS = targetOS || OS;
+  const platformArch = targetArch || ARCH;
+  
+  // Get platform-specific paths
+  const platformPaths = getPlatformPaths(platformOS, platformArch);
+  
+  // Check platform-specific binaries
+  const requiredBinaries = [
+    platformPaths.BUN_BINARY,
+    platformPaths.LAUNCHER_RELEASE,
+    // Platform-specific native wrapper
+    platformOS === 'macos' ? platformPaths.NATIVE_WRAPPER_MACOS :
+    platformOS === 'win' ? platformPaths.NATIVE_WRAPPER_WIN :
+    platformPaths.NATIVE_WRAPPER_LINUX
+  ];
+  
+  // Check shared files (main.js should be in shared dist/)
+  const requiredSharedFiles = [
+    platformPaths.MAIN_JS
+  ];
+  
+  const missingBinaries = requiredBinaries.filter(file => !existsSync(file));
+  const missingSharedFiles = requiredSharedFiles.filter(file => !existsSync(file));
+  
+  // If only shared files are missing, that's expected in production (they come via npm)
+  if (missingBinaries.length === 0 && missingSharedFiles.length > 0) {
+    console.log(`Shared files missing (expected in production): ${missingSharedFiles.map(f => f.replace(ELECTROBUN_DEP_PATH, '.')).join(', ')}`);
+  }
+  
+  // Only download if platform-specific binaries are missing
+  if (missingBinaries.length === 0) {
     return;
   }
 
-  console.log('Core dependencies not found, downloading...');
+  // Show which binaries are missing
+  console.log(`Core dependencies not found for ${platformOS}-${platformArch}. Missing files:`, missingBinaries.map(f => f.replace(ELECTROBUN_DEP_PATH, '.')).join(', '));
+  console.log(`Downloading core binaries for ${platformOS}-${platformArch}...`);
   
   // Get the current Electrobun version from package.json
   const packageJsonPath = join(ELECTROBUN_DEP_PATH, 'package.json');
@@ -112,61 +137,157 @@ async function ensureCoreDependencies() {
     }
   }
 
-  const platformName = OS === 'macos' ? 'darwin' : OS === 'win' ? 'win32' : 'linux';
-  const archName = ARCH;
-  const mainTarballUrl = `https://github.com/blackboardsh/electrobun/releases/download/${version}/electrobun-${platformName}-${archName}.tar.gz`;
+  const platformName = platformOS === 'macos' ? 'darwin' : platformOS === 'win' ? 'win' : 'linux';
+  const archName = platformArch;
+  const coreTarballUrl = `https://github.com/blackboardsh/electrobun/releases/download/${version}/electrobun-core-${platformName}-${archName}.tar.gz`;
   
-  console.log(`Downloading core binaries from: ${mainTarballUrl}`);
+  console.log(`Downloading core binaries from: ${coreTarballUrl}`);
   
   try {
-    // Download main tarball
-    const response = await fetch(mainTarballUrl);
+    // Download core binaries tarball
+    const response = await fetch(coreTarballUrl);
     if (!response.ok) {
       throw new Error(`Failed to download binaries: ${response.status} ${response.statusText}`);
     }
     
     // Create temp file
-    const tempFile = join(ELECTROBUN_DEP_PATH, 'main-temp.tar.gz');
+    const tempFile = join(ELECTROBUN_DEP_PATH, `core-${platformOS}-${platformArch}-temp.tar.gz`);
     const fileStream = createWriteStream(tempFile);
     
     // Write response to file
     if (response.body) {
       const reader = response.body.getReader();
+      let totalBytes = 0;
       while (true) {
         const { done, value } = await reader.read();
         if (done) break;
-        fileStream.write(Buffer.from(value));
+        const buffer = Buffer.from(value);
+        fileStream.write(buffer);
+        totalBytes += buffer.length;
       }
+      console.log(`Downloaded ${totalBytes} bytes for ${platformOS}-${platformArch}`);
     }
-    fileStream.end();
     
-    // Extract to dist directory
-    console.log('Extracting core dependencies...');
-    await tar.x({
-      file: tempFile,
-      cwd: join(ELECTROBUN_DEP_PATH, 'dist'),
+    // Ensure file is properly closed before proceeding
+    await new Promise((resolve, reject) => {
+      fileStream.end((err) => {
+        if (err) reject(err);
+        else resolve(null);
+      });
     });
     
+    // Verify the downloaded file exists and has content
+    if (!existsSync(tempFile)) {
+      throw new Error(`Downloaded file not found: ${tempFile}`);
+    }
+    
+    const fileSize = require('fs').statSync(tempFile).size;
+    if (fileSize === 0) {
+      throw new Error(`Downloaded file is empty: ${tempFile}`);
+    }
+    
+    console.log(`Verified download: ${tempFile} (${fileSize} bytes)`);
+    
+    // Extract to platform-specific dist directory
+    console.log(`Extracting core dependencies for ${platformOS}-${platformArch}...`);
+    const platformDistPath = join(ELECTROBUN_DEP_PATH, `dist-${platformOS}-${platformArch}`);
+    mkdirSync(platformDistPath, { recursive: true });
+    
+    // Use Windows native tar.exe on Windows due to npm tar library issues
+    if (OS === 'win') {
+      console.log('Using Windows native tar.exe for reliable extraction...');
+      const relativeTempFile = relative(platformDistPath, tempFile);
+      execSync(`tar -xf "${relativeTempFile}"`, { 
+        stdio: 'inherit',
+        cwd: platformDistPath 
+      });
+    } else {
+      await tar.x({
+        file: tempFile,
+        cwd: platformDistPath,
+        preservePaths: false,
+        strip: 0,
+      });
+    }
+    
+    // NOTE: We no longer copy main.js from platform-specific downloads
+    // Platform-specific downloads should only contain native binaries
+    // main.js and api/ should be shipped via npm in the shared dist/ folder
+    
     // Clean up temp file
     unlinkSync(tempFile);
     
-    console.log('Core dependencies downloaded and cached successfully');
+    // Debug: List what was actually extracted
+    try {
+      const extractedFiles = readdirSync(platformDistPath);
+      console.log(`Extracted files to ${platformDistPath}:`, extractedFiles);
+      
+      // Check if files are in subdirectories
+      for (const file of extractedFiles) {
+        const filePath = join(platformDistPath, file);
+        const stat = require('fs').statSync(filePath);
+        if (stat.isDirectory()) {
+          const subFiles = readdirSync(filePath);
+          console.log(`  ${file}/: ${subFiles.join(', ')}`);
+        }
+      }
+    } catch (e) {
+      console.error('Could not list extracted files:', e);
+    }
     
-  } catch (error) {
-    console.error('Failed to download core dependencies:', error.message);
+    // Verify extraction completed successfully - check platform-specific binaries only
+    const requiredBinaries = [
+      platformPaths.BUN_BINARY,
+      platformPaths.LAUNCHER_RELEASE,
+      platformOS === 'macos' ? platformPaths.NATIVE_WRAPPER_MACOS :
+      platformOS === 'win' ? platformPaths.NATIVE_WRAPPER_WIN :
+      platformPaths.NATIVE_WRAPPER_LINUX
+    ];
+    
+    const missingBinaries = requiredBinaries.filter(file => !existsSync(file));
+    if (missingBinaries.length > 0) {
+      console.error(`Missing binaries after extraction: ${missingBinaries.map(f => f.replace(ELECTROBUN_DEP_PATH, '.')).join(', ')}`);
+      console.error('This suggests the tarball structure is different than expected');
+    }
+    
+    // Note: We no longer need to remove or re-add signatures from downloaded binaries
+    // The CI-added adhoc signatures are actually required for macOS to run the binaries
+    
+    // For development: if main.js doesn't exist in shared dist/, copy from platform-specific download as fallback
+    const sharedDistPath = join(ELECTROBUN_DEP_PATH, 'dist');
+    const extractedMainJs = join(platformDistPath, 'main.js');
+    const sharedMainJs = join(sharedDistPath, 'main.js');
+    
+    if (existsSync(extractedMainJs) && !existsSync(sharedMainJs)) {
+      console.log('Development fallback: copying main.js from platform-specific download to shared dist/');
+      mkdirSync(sharedDistPath, { recursive: true });
+      cpSync(extractedMainJs, sharedMainJs);
+    }
+    
+    console.log(`Core dependencies for ${platformOS}-${platformArch} downloaded and cached successfully`);
+    
+  } catch (error: any) {
+    console.error(`Failed to download core dependencies for ${platformOS}-${platformArch}:`, error.message);
     console.error('Please ensure you have an internet connection and the release exists.');
     process.exit(1);
   }
 }
 
-async function ensureCEFDependencies() {
+async function ensureCEFDependencies(targetOS?: 'macos' | 'win' | 'linux', targetArch?: 'arm64' | 'x64') {
+  // Use provided target platform or default to host platform
+  const platformOS = targetOS || OS;
+  const platformArch = targetArch || ARCH;
+  
+  // Get platform-specific paths
+  const platformPaths = getPlatformPaths(platformOS, platformArch);
+  
   // Check if CEF dependencies already exist
-  if (existsSync(PATHS.CEF_DIR)) {
-    console.log('CEF dependencies found, using cached version');
+  if (existsSync(platformPaths.CEF_DIR)) {
+    console.log(`CEF dependencies found for ${platformOS}-${platformArch}, using cached version`);
     return;
   }
 
-  console.log('CEF dependencies not found, downloading...');
+  console.log(`CEF dependencies not found for ${platformOS}-${platformArch}, downloading...`);
   
   // Get the current Electrobun version from package.json
   const packageJsonPath = join(ELECTROBUN_DEP_PATH, 'package.json');
@@ -181,8 +302,8 @@ async function ensureCEFDependencies() {
     }
   }
 
-  const platformName = OS === 'macos' ? 'darwin' : OS === 'win' ? 'win32' : 'linux';
-  const archName = ARCH;
+  const platformName = platformOS === 'macos' ? 'darwin' : platformOS === 'win' ? 'win' : 'linux';
+  const archName = platformArch;
   const cefTarballUrl = `https://github.com/blackboardsh/electrobun/releases/download/${version}/electrobun-cef-${platformName}-${archName}.tar.gz`;
   
   console.log(`Downloading CEF from: ${cefTarballUrl}`);
@@ -195,7 +316,7 @@ async function ensureCEFDependencies() {
     }
     
     // Create temp file
-    const tempFile = join(ELECTROBUN_DEP_PATH, 'cef-temp.tar.gz');
+    const tempFile = join(ELECTROBUN_DEP_PATH, `cef-${platformOS}-${platformArch}-temp.tar.gz`);
     const fileStream = createWriteStream(tempFile);
     
     // Write response to file
@@ -209,20 +330,50 @@ async function ensureCEFDependencies() {
     }
     fileStream.end();
     
-    // Extract to dist directory
-    console.log('Extracting CEF dependencies...');
-    await tar.x({
-      file: tempFile,
-      cwd: join(ELECTROBUN_DEP_PATH, 'dist'),
-    });
+    // Extract to platform-specific dist directory
+    console.log(`Extracting CEF dependencies for ${platformOS}-${platformArch}...`);
+    const platformDistPath = join(ELECTROBUN_DEP_PATH, `dist-${platformOS}-${platformArch}`);
+    mkdirSync(platformDistPath, { recursive: true });
+    
+    // Use Windows native tar.exe on Windows due to npm tar library issues
+    if (OS === 'win') {
+      console.log('Using Windows native tar.exe for reliable extraction...');
+      const relativeTempFile = relative(platformDistPath, tempFile);
+      execSync(`tar -xf "${relativeTempFile}"`, { 
+        stdio: 'inherit',
+        cwd: platformDistPath 
+      });
+    } else {
+      await tar.x({
+        file: tempFile,
+        cwd: platformDistPath,
+        preservePaths: false,
+        strip: 0,
+      });
+    }
     
     // Clean up temp file
     unlinkSync(tempFile);
     
-    console.log('CEF dependencies downloaded and cached successfully');
+    // Debug: List what was actually extracted for CEF
+    try {
+      const extractedFiles = readdirSync(platformDistPath);
+      console.log(`CEF extracted files to ${platformDistPath}:`, extractedFiles);
+      
+      // Check if CEF directory was created
+      const cefDir = join(platformDistPath, 'cef');
+      if (existsSync(cefDir)) {
+        const cefFiles = readdirSync(cefDir);
+        console.log(`CEF directory contents: ${cefFiles.slice(0, 10).join(', ')}${cefFiles.length > 10 ? '...' : ''}`);
+      }
+    } catch (e) {
+      console.error('Could not list CEF extracted files:', e);
+    }
+    
+    console.log(`CEF dependencies for ${platformOS}-${platformArch} downloaded and cached successfully`);
     
-  } catch (error) {
-    console.error('Failed to download CEF dependencies:', error.message);
+  } catch (error: any) {
+    console.error(`Failed to download CEF dependencies for ${platformOS}-${platformArch}:`, error.message);
     console.error('Please ensure you have an internet connection and the release exists.');
     process.exit(1);
   }
@@ -241,10 +392,6 @@ const commandDefaults = {
     projectRoot,
     config: "electrobun.config",
   },
-  launcher: {
-    projectRoot,
-    config: "electrobun.config",
-  },
 };
 
 // todo (yoav): add types for config
@@ -257,6 +404,7 @@ const defaultConfig = {
   build: {
     buildFolder: "build",
     artifactFolder: "artifacts",
+    targets: undefined, // Will default to current platform if not specified
     mac: {
       codesign: false,
       notarize: false,
@@ -264,9 +412,22 @@ const defaultConfig = {
       entitlements: {
         // This entitlement is required for Electrobun apps with a hardened runtime (required for notarization) to run on macos
         "com.apple.security.cs.allow-jit": true,
+        // Required for bun runtime to work with dynamic code execution and JIT compilation when signed
+        "com.apple.security.cs.allow-unsigned-executable-memory": true,
+        "com.apple.security.cs.disable-library-validation": true,
       },
       icons: "icon.iconset",
     },
+    win: {
+      bundleCEF: false,
+    },
+    linux: {
+      bundleCEF: false,
+    },
+    bun: {
+      entrypoint: "src/bun/index.ts",
+      external: [],
+    },
   },
   scripts: {
     postBuild: "",
@@ -283,19 +444,192 @@ if (!command) {
   process.exit(1);
 }
 
-const config = getConfig();
+// Main execution function
+async function main() {
+  const config = await getConfig();
+
+  const envArg =
+    process.argv.find((arg) => arg.startsWith("--env="))?.split("=")[1] || "";
 
-const envArg =
-  process.argv.find((arg) => arg.startsWith("env="))?.split("=")[1] || "";
+  const targetsArg =
+    process.argv.find((arg) => arg.startsWith("--targets="))?.split("=")[1] || "";
 
-const validEnvironments = ["dev", "canary", "stable"];
+  const validEnvironments = ["dev", "canary", "stable"];
 
-// todo (yoav): dev, canary, and stable;
-const buildEnvironment: "dev" | "canary" | "stable" =
-  validEnvironments.includes(envArg) ? envArg : "dev";
+  // todo (yoav): dev, canary, and stable;
+  const buildEnvironment: "dev" | "canary" | "stable" =
+    validEnvironments.includes(envArg || "dev") ? (envArg || "dev") : "dev";
+
+// Determine build targets
+type BuildTarget = { os: 'macos' | 'win' | 'linux', arch: 'arm64' | 'x64' };
+
+function parseBuildTargets(): BuildTarget[] {
+  // If explicit targets provided via CLI
+  if (targetsArg) {
+    if (targetsArg === 'current') {
+      return [{ os: OS, arch: ARCH }];
+    } else if (targetsArg === 'all') {
+      return parseConfigTargets();
+    } else {
+      // Parse comma-separated targets like "macos-arm64,win-x64"
+      return targetsArg.split(',').map(target => {
+        const [os, arch] = target.trim().split('-') as [string, string];
+        if (!['macos', 'win', 'linux'].includes(os) || !['arm64', 'x64'].includes(arch)) {
+          console.error(`Invalid target: ${target}. Format should be: os-arch (e.g., macos-arm64)`);
+          process.exit(1);
+        }
+        return { os, arch } as BuildTarget;
+      });
+    }
+  }
+
+  // Default behavior: always build for current platform only
+  // This ensures predictable, fast builds unless explicitly requesting multi-platform
+  return [{ os: OS, arch: ARCH }];
+}
+
+function parseConfigTargets(): BuildTarget[] {
+  // If config has targets, use them
+  if (config.build.targets && config.build.targets.length > 0) {
+    return config.build.targets.map(target => {
+      if (target === 'current') {
+        return { os: OS, arch: ARCH };
+      }
+      const [os, arch] = target.split('-') as [string, string];
+      if (!['macos', 'win', 'linux'].includes(os) || !['arm64', 'x64'].includes(arch)) {
+        console.error(`Invalid target in config: ${target}. Format should be: os-arch (e.g., macos-arm64)`);
+        process.exit(1);
+      }
+      return { os, arch } as BuildTarget;
+    });
+  }
+  
+  // If no config targets and --targets=all, use all available platforms
+  if (targetsArg === 'all') {
+    console.log('No targets specified in config, using all available platforms');
+    return [
+      { os: 'macos', arch: 'arm64' },
+      { os: 'macos', arch: 'x64' },
+      { os: 'win', arch: 'x64' },
+      { os: 'linux', arch: 'x64' },
+      { os: 'linux', arch: 'arm64' }
+    ];
+  }
+  
+  // Default to current platform
+  return [{ os: OS, arch: ARCH }];
+}
+
+const buildTargets = parseBuildTargets();
+
+// Show build targets to user
+if (buildTargets.length === 1) {
+  console.log(`Building for ${buildTargets[0].os}-${buildTargets[0].arch} (${buildEnvironment})`);
+} else {
+  const targetList = buildTargets.map(t => `${t.os}-${t.arch}`).join(', ');
+  console.log(`Building for multiple targets: ${targetList} (${buildEnvironment})`);
+  console.log(`Running ${buildTargets.length} parallel builds...`);
+  
+  // Spawn parallel build processes
+  const buildPromises = buildTargets.map(async (target) => {
+    const targetString = `${target.os}-${target.arch}`;
+    const prefix = `[${targetString}]`;
+    
+    try {
+      // Try to find the electrobun binary in node_modules/.bin or use bunx
+      const electrobunBin = join(projectRoot, 'node_modules', '.bin', 'electrobun');
+      let command: string[];
+      
+      if (existsSync(electrobunBin)) {
+        command = [electrobunBin, 'build', `--env=${buildEnvironment}`, `--targets=${targetString}`];
+      } else {
+        // Fallback to bunx which should resolve node_modules binaries
+        command = ['bunx', 'electrobun', 'build', `--env=${buildEnvironment}`, `--targets=${targetString}`];
+      }
+      
+      console.log(`${prefix} Running:`, command.join(' '));
+      
+      const result = await Bun.spawn(command, {
+        stdio: ['inherit', 'pipe', 'pipe'],
+        env: process.env,
+        cwd: projectRoot // Ensure we're in the right directory
+      });
+
+      // Pipe output with prefix
+      if (result.stdout) {
+        const reader = result.stdout.getReader();
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          const text = new TextDecoder().decode(value);
+          // Add prefix to each line
+          const prefixedText = text.split('\n').map(line => 
+            line ? `${prefix} ${line}` : line
+          ).join('\n');
+          process.stdout.write(prefixedText);
+        }
+      }
+
+      if (result.stderr) {
+        const reader = result.stderr.getReader();
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          const text = new TextDecoder().decode(value);
+          const prefixedText = text.split('\n').map(line => 
+            line ? `${prefix} ${line}` : line
+          ).join('\n');
+          process.stderr.write(prefixedText);
+        }
+      }
+
+      const exitCode = await result.exited;
+      return { target, exitCode, success: exitCode === 0 };
+      
+    } catch (error) {
+      console.error(`${prefix} Failed to start build:`, error);
+      return { target, exitCode: 1, success: false, error };
+    }
+  });
+
+  // Wait for all builds to complete
+  const results = await Promise.allSettled(buildPromises);
+  
+  // Report final results
+  console.log('\n=== Build Results ===');
+  let allSucceeded = true;
+  
+  for (const result of results) {
+    if (result.status === 'fulfilled') {
+      const { target, success, exitCode } = result.value;
+      const status = success ? '✅ SUCCESS' : '❌ FAILED';
+      console.log(`${target.os}-${target.arch}: ${status} (exit code: ${exitCode})`);
+      if (!success) allSucceeded = false;
+    } else {
+      console.log(`Build rejected: ${result.reason}`);
+      allSucceeded = false;
+    }
+  }
+  
+  if (!allSucceeded) {
+    console.log('\nSome builds failed. Check the output above for details.');
+    process.exit(1);
+  } else {
+    console.log('\nAll builds completed successfully! 🎉');
+  }
+  
+  process.exit(0);
+}
 
 // todo (yoav): dev builds should include the branch name, and/or allow configuration via external config
-const buildSubFolder = `${buildEnvironment}`;
+// For now, assume single target build (we'll refactor for multi-target later)
+const currentTarget = buildTargets[0];
+const buildSubFolder = `${buildEnvironment}-${currentTarget.os}-${currentTarget.arch}`;
+
+// Use target OS/ARCH for build logic (instead of current machine's OS/ARCH)
+const targetOS = currentTarget.os;
+const targetARCH = currentTarget.arch;
+const targetBinExt = targetOS === 'win' ? '.exe' : '';
 
 const buildFolder = join(projectRoot, config.build.buildFolder, buildSubFolder);
 
@@ -359,6 +693,13 @@ function escapePathForTerminal(filePath: string) {
 
   return escapedPath;
 }
+
+function sanitizeVolumeNameForHdiutil(volumeName: string) {
+  // Remove or replace characters that cause issues with hdiutil volume mounting
+  // Parentheses and other special characters can cause "Operation not permitted" errors
+  return volumeName.replace(/[()]/g, '');
+}
+
 // MyApp
 
 // const appName = config.app.name.replace(/\s/g, '-').toLowerCase();
@@ -370,16 +711,131 @@ const appFileName = (
 )
   .replace(/\s/g, "")
   .replace(/\./g, "-");
-const bundleFileName = OS === 'macos' ? `${appFileName}.app` : appFileName;
+const bundleFileName = targetOS === 'macos' ? `${appFileName}.app` : appFileName;
 
 // const logPath = `/Library/Logs/Electrobun/ExampleApp/dev/out.log`;
 
 let proc = null;
 
 if (commandArg === "init") {
-  // todo (yoav): init a repo folder structure
-  console.log("initializing electrobun project");
+  await (async () => {
+    const secondArg = process.argv[indexOfElectrobun + 2];
+    const availableTemplates = getTemplateNames();
+    
+    let projectName: string;
+    let templateName: string;
+    
+    // Check if --template= flag is used
+    const templateFlag = process.argv.find(arg => arg.startsWith("--template="));
+    if (templateFlag) {
+      // Traditional usage: electrobun init my-project --template=photo-booth
+      projectName = secondArg || "my-electrobun-app";
+      templateName = templateFlag.split("=")[1];
+    } else if (secondArg && availableTemplates.includes(secondArg)) {
+      // New intuitive usage: electrobun init photo-booth
+      projectName = secondArg; // Use template name as project name
+      templateName = secondArg;
+    } else {
+      // Interactive menu when no template specified
+      console.log("🚀 Welcome to Electrobun!");
+      console.log("");
+      console.log("Available templates:");
+      availableTemplates.forEach((template, index) => {
+        console.log(`  ${index + 1}. ${template}`);
+      });
+      console.log("");
+      
+      // Simple CLI selection using readline
+      const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      
+      const choice = await new Promise<string>((resolve) => {
+        rl.question('Select a template (enter number): ', (answer) => {
+          rl.close();
+          resolve(answer.trim());
+        });
+      });
+      
+      const templateIndex = parseInt(choice) - 1;
+      if (templateIndex < 0 || templateIndex >= availableTemplates.length) {
+        console.error(`❌ Invalid selection. Please enter a number between 1 and ${availableTemplates.length}.`);
+        process.exit(1);
+      }
+      
+      templateName = availableTemplates[templateIndex];
+      
+      // Ask for project name
+      const rl2 = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      
+      projectName = await new Promise<string>((resolve) => {
+        rl2.question(`Enter project name (default: my-${templateName}-app): `, (answer) => {
+          rl2.close();
+          resolve(answer.trim() || `my-${templateName}-app`);
+        });
+      });
+    }
+    
+    console.log(`🚀 Initializing Electrobun project: ${projectName}`);
+    console.log(`📋 Using template: ${templateName}`);
+    
+    // Validate template name
+    if (!availableTemplates.includes(templateName)) {
+      console.error(`❌ Template "${templateName}" not found.`);
+      console.log(`Available templates: ${availableTemplates.join(", ")}`);
+      process.exit(1);
+    }
+    
+    const template = getTemplate(templateName);
+    if (!template) {
+      console.error(`❌ Could not load template "${templateName}"`);
+      process.exit(1);
+    }
+    
+    // Create project directory
+    const projectPath = join(process.cwd(), projectName);
+    if (existsSync(projectPath)) {
+      console.error(`❌ Directory "${projectName}" already exists.`);
+      process.exit(1);
+    }
+    
+    mkdirSync(projectPath, { recursive: true });
+    
+    // Extract template files
+    let fileCount = 0;
+    for (const [relativePath, content] of Object.entries(template.files)) {
+      const fullPath = join(projectPath, relativePath);
+      const dir = dirname(fullPath);
+      
+      // Create directory if it doesn't exist
+      mkdirSync(dir, { recursive: true });
+      
+      // Write file
+      writeFileSync(fullPath, content, 'utf-8');
+      fileCount++;
+    }
+    
+    console.log(`✅ Created ${fileCount} files from "${templateName}" template`);
+    console.log(`📁 Project created at: ${projectPath}`);
+    console.log("");
+    console.log("📦 Next steps:");
+    console.log(`   cd ${projectName}`);
+    console.log("   bun install");
+    console.log("   bun start");
+    console.log("");
+    console.log("🎉 Happy building with Electrobun!");
+  })();
 } else if (commandArg === "build") {
+  // Ensure core binaries are available for the target platform before starting build
+  await ensureCoreDependencies(currentTarget.os, currentTarget.arch);
+  
+  // Get platform-specific paths for the current target
+  const targetPaths = getPlatformPaths(currentTarget.os, currentTarget.arch);
+  
   // refresh build folder  
   if (existsSync(buildFolder)) {
     rmdirSync(buildFolder, { recursive: true });
@@ -403,7 +859,7 @@ if (commandArg === "init") {
     appBundleMacOSPath,
     appBundleFolderResourcesPath,
     appBundleFolderFrameworksPath,
-  } = createAppBundle(appFileName, buildFolder);
+  } = createAppBundle(appFileName, buildFolder, targetOS);
 
   const appBundleAppCodePath = join(appBundleFolderResourcesPath, "app");
 
@@ -473,13 +929,9 @@ if (commandArg === "init") {
   //     mkdirSync(destLauncherFolder, {recursive: true});
   // }
   // cpSync(zigLauncherBinarySource, zigLauncherDestination, {recursive: true, dereference: true});
-  const bunCliLauncherBinarySource =
-    buildEnvironment === "dev"
-      ? // Note: in dev use the cli as the launcher
-        PATHS.LAUNCHER_DEV
-      : // Note: for release use the zig launcher optimized for smol size
-        PATHS.LAUNCHER_RELEASE;
-  const bunCliLauncherDestination = join(appBundleMacOSPath, "launcher") + binExt;
+  // Copy zig launcher for all builds (dev, canary, stable)
+  const bunCliLauncherBinarySource = targetPaths.LAUNCHER_RELEASE;
+  const bunCliLauncherDestination = join(appBundleMacOSPath, "launcher") + targetBinExt;
   const destLauncherFolder = dirname(bunCliLauncherDestination);
   if (!existsSync(destLauncherFolder)) {
     // console.info('creating folder: ', destFolder);
@@ -491,14 +943,14 @@ if (commandArg === "init") {
     dereference: true,
   });
 
-  cpSync(PATHS.MAIN_JS, join(appBundleMacOSPath, 'main.js'));
+  cpSync(targetPaths.MAIN_JS, join(appBundleFolderResourcesPath, 'main.js'));
 
   // Bun runtime binary
   // todo (yoav): this only works for the current architecture
-  const bunBinarySourcePath = PATHS.BUN_BINARY;
+  const bunBinarySourcePath = targetPaths.BUN_BINARY;
   // Note: .bin/bun binary in node_modules is a symlink to the versioned one in another place
   // in node_modules, so we have to dereference here to get the actual binary in the bundle.
-  const bunBinaryDestInBundlePath = join(appBundleMacOSPath, "bun") + binExt;
+  const bunBinaryDestInBundlePath = join(appBundleMacOSPath, "bun") + targetBinExt;
   const destFolder2 = dirname(bunBinaryDestInBundlePath);
   if (!existsSync(destFolder2)) {
     // console.info('creating folder: ', destFolder);
@@ -507,8 +959,8 @@ if (commandArg === "init") {
   cpSync(bunBinarySourcePath, bunBinaryDestInBundlePath, { dereference: true });
 
   // copy native wrapper dynamic library
-  if (OS === 'macos') {
-  const nativeWrapperMacosSource = PATHS.NATIVE_WRAPPER_MACOS;
+  if (targetOS === 'macos') {
+  const nativeWrapperMacosSource = targetPaths.NATIVE_WRAPPER_MACOS;
   const nativeWrapperMacosDestination = join(
     appBundleMacOSPath,
     "libNativeWrapper.dylib"
@@ -516,8 +968,8 @@ if (commandArg === "init") {
   cpSync(nativeWrapperMacosSource, nativeWrapperMacosDestination, {
     dereference: true,
   });
-} else if (OS === 'win') {
-  const nativeWrapperMacosSource = PATHS.NATIVE_WRAPPER_WIN;
+} else if (targetOS === 'win') {
+  const nativeWrapperMacosSource = targetPaths.NATIVE_WRAPPER_WIN;
   const nativeWrapperMacosDestination = join(
     appBundleMacOSPath,
     "libNativeWrapper.dll"
@@ -526,7 +978,7 @@ if (commandArg === "init") {
     dereference: true,
   });
 
-  const webview2LibSource = PATHS.WEBVIEW2LOADER_WIN;
+  const webview2LibSource = targetPaths.WEBVIEW2LOADER_WIN;
   const webview2LibDestination = join(
     appBundleMacOSPath,
     "WebView2Loader.dll"
@@ -534,30 +986,34 @@ if (commandArg === "init") {
   // copy webview2 system webview library
   cpSync(webview2LibSource, webview2LibDestination);
   
-} else if (OS === 'linux') {
-  const nativeWrapperLinuxSource = PATHS.NATIVE_WRAPPER_LINUX;
+} else if (targetOS === 'linux') {
+  // Choose the appropriate native wrapper based on bundleCEF setting
+  const useCEF = config.build.linux?.bundleCEF;
+  const nativeWrapperLinuxSource = useCEF ? targetPaths.NATIVE_WRAPPER_LINUX_CEF : targetPaths.NATIVE_WRAPPER_LINUX;
   const nativeWrapperLinuxDestination = join(
     appBundleMacOSPath,
     "libNativeWrapper.so"
   );
+  
   if (existsSync(nativeWrapperLinuxSource)) {
     cpSync(nativeWrapperLinuxSource, nativeWrapperLinuxDestination, {
       dereference: true,
     });
+    console.log(`Using ${useCEF ? 'CEF' : 'GTK'} native wrapper for Linux`);
+  } else {
+    throw new Error(`Native wrapper not found: ${nativeWrapperLinuxSource}`);
   }
 }
   
-  // Ensure core binaries are available
-  await ensureCoreDependencies();
 
   // Download CEF binaries if needed when bundleCEF is enabled
-  if ((OS === 'macos' && config.build.mac?.bundleCEF) || 
-      (OS === 'win' && config.build.win?.bundleCEF) || 
-      (OS === 'linux' && config.build.linux?.bundleCEF)) {
+  if ((targetOS === 'macos' && config.build.mac?.bundleCEF) || 
+      (targetOS === 'win' && config.build.win?.bundleCEF) || 
+      (targetOS === 'linux' && config.build.linux?.bundleCEF)) {
     
-    await ensureCEFDependencies();    
-    if (OS === 'macos') {
-      const cefFrameworkSource = PATHS.CEF_FRAMEWORK_MACOS;
+    await ensureCEFDependencies(currentTarget.os, currentTarget.arch);    
+    if (targetOS === 'macos') {
+      const cefFrameworkSource = targetPaths.CEF_FRAMEWORK_MACOS;
       const cefFrameworkDestination = join(
         appBundleFolderFrameworksPath,
         "Chromium Embedded Framework.framework"
@@ -578,7 +1034,7 @@ if (commandArg === "init") {
         "bun Helper (Renderer)",
       ];
 
-      const helperSourcePath = PATHS.CEF_HELPER_MACOS;
+      const helperSourcePath = targetPaths.CEF_HELPER_MACOS;
       cefHelperNames.forEach((helperName) => {
         const destinationPath = join(
           appBundleFolderFrameworksPath,
@@ -598,10 +1054,9 @@ if (commandArg === "init") {
           dereference: true,
         });
       });
-    } else if (OS === 'win') {
-      // Copy CEF DLLs from dist/cef/ to the main executable directory
-      const electrobunDistPath = join(ELECTROBUN_DEP_PATH, "dist");
-      const cefSourcePath = join(electrobunDistPath, "cef");
+    } else if (targetOS === 'win') {
+      // Copy CEF DLLs from platform-specific dist/cef/ to the main executable directory
+      const cefSourcePath = targetPaths.CEF_DIR;
       const cefDllFiles = [
         'libcef.dll',
         'chrome_elf.dll', 
@@ -641,7 +1096,7 @@ if (commandArg === "init") {
       });
       
       // Copy CEF resources to MacOS/cef/ subdirectory for other resources like locales
-      const cefResourcesSource = join(electrobunDistPath, 'cef');
+      const cefResourcesSource = targetPaths.CEF_DIR;
       const cefResourcesDestination = join(appBundleMacOSPath, 'cef');
       
       if (existsSync(cefResourcesSource)) {
@@ -660,7 +1115,7 @@ if (commandArg === "init") {
         "bun Helper (Renderer)",
       ];
 
-      const helperSourcePath = PATHS.CEF_HELPER_WIN;
+      const helperSourcePath = targetPaths.CEF_HELPER_WIN;
       if (existsSync(helperSourcePath)) {
         cefHelperNames.forEach((helperName) => {
           const destinationPath = join(appBundleMacOSPath, `${helperName}.exe`);
@@ -670,10 +1125,9 @@ if (commandArg === "init") {
       } else {
         console.log(`WARNING: Missing CEF helper: ${helperSourcePath}`);
       }
-    } else if (OS === 'linux') {
-      // Copy CEF shared libraries from dist/cef/ to the main executable directory
-      const electrobunDistPath = join(ELECTROBUN_DEP_PATH, "dist");
-      const cefSourcePath = join(electrobunDistPath, "cef");
+    } else if (targetOS === 'linux') {
+      // Copy CEF shared libraries from platform-specific dist/cef/ to the main executable directory
+      const cefSourcePath = targetPaths.CEF_DIR;
       
       if (existsSync(cefSourcePath)) {
         const cefSoFiles = [
@@ -684,11 +1138,13 @@ if (commandArg === "init") {
           'libvulkan.so.1'
         ];
         
+        // Copy CEF .so files to main directory as symlinks to cef/ subdirectory
         cefSoFiles.forEach(soFile => {
           const sourcePath = join(cefSourcePath, soFile);
           const destPath = join(appBundleMacOSPath, soFile);
           if (existsSync(sourcePath)) {
-            cpSync(sourcePath, destPath);
+            // We'll create the actual file in cef/ and symlink from main directory
+            // This will be done after the cef/ directory is populated
           }
         });
         
@@ -750,6 +1206,30 @@ if (commandArg === "init") {
           }
         });
         
+        // Create symlinks from main directory to cef/ subdirectory for .so files
+        console.log('Creating symlinks for CEF libraries...');
+        cefSoFiles.forEach(soFile => {
+          const cefFilePath = join(cefResourcesDestination, soFile);
+          const mainDirPath = join(appBundleMacOSPath, soFile);
+          
+          if (existsSync(cefFilePath)) {
+            try {
+              // Remove any existing file/symlink in main directory
+              if (existsSync(mainDirPath)) {
+                rmSync(mainDirPath);
+              }
+              // Create symlink from main directory to cef/ subdirectory
+              symlinkSync(join('cef', soFile), mainDirPath);
+              console.log(`Created symlink for CEF library: ${soFile} -> cef/${soFile}`);
+            } catch (error) {
+              console.log(`WARNING: Failed to create symlink for ${soFile}: ${error}`);
+              // Fallback to copying the file
+              cpSync(cefFilePath, mainDirPath);
+              console.log(`Fallback: Copied CEF library to main directory: ${soFile}`);
+            }
+          }
+        });
+        
         // Copy CEF helper processes with different names
         const cefHelperNames = [
           "bun Helper",
@@ -759,12 +1239,12 @@ if (commandArg === "init") {
           "bun Helper (Renderer)",
         ];
 
-        const helperSourcePath = PATHS.CEF_HELPER_LINUX;
+        const helperSourcePath = targetPaths.CEF_HELPER_LINUX;
         if (existsSync(helperSourcePath)) {
           cefHelperNames.forEach((helperName) => {
             const destinationPath = join(appBundleMacOSPath, helperName);
             cpSync(helperSourcePath, destinationPath);
-            console.log(`Copied CEF helper: ${helperName}`);
+            // console.log(`Copied CEF helper: ${helperName}`);
           });
         } else {
           console.log(`WARNING: Missing CEF helper: ${helperSourcePath}`);
@@ -775,8 +1255,8 @@ if (commandArg === "init") {
 
 
   // copy native bindings
-  const bsPatchSource = PATHS.BSPATCH;
-  const bsPatchDestination = join(appBundleMacOSPath, "bspatch") + binExt;
+  const bsPatchSource = targetPaths.BSPATCH;
+  const bsPatchDestination = join(appBundleMacOSPath, "bspatch") + targetBinExt;
   const bsPatchDestFolder = dirname(bsPatchDestination);
   if (!existsSync(bsPatchDestFolder)) {
     mkdirSync(bsPatchDestFolder, { recursive: true });
@@ -871,14 +1351,37 @@ if (commandArg === "init") {
   
   // Run postBuild script
   if (config.scripts.postBuild) {
-
-    Bun.spawnSync([bunBinarySourcePath, config.scripts.postBuild], {
+    console.log("Running postBuild script:", config.scripts.postBuild);
+    // Use host platform's bun binary for running scripts, not target platform's
+    const hostPaths = getPlatformPaths(OS, ARCH);
+    
+    const result = Bun.spawnSync([hostPaths.BUN_BINARY, config.scripts.postBuild], {
       stdio: ["ignore", "inherit", "inherit"],
+      cwd: projectRoot, // Add cwd to ensure script runs from project root
       env: {
         ...process.env,
         ELECTROBUN_BUILD_ENV: buildEnvironment,
+        ELECTROBUN_OS: targetOS, // Use target OS for environment variables
+        ELECTROBUN_ARCH: targetARCH, // Use target ARCH for environment variables
+        ELECTROBUN_BUILD_DIR: buildFolder,
+        ELECTROBUN_APP_NAME: appFileName,
+        ELECTROBUN_APP_VERSION: config.app.version,
+        ELECTROBUN_APP_IDENTIFIER: config.app.identifier,
+        ELECTROBUN_ARTIFACT_DIR: artifactFolder,
       },
     });
+    
+    if (result.exitCode !== 0) {
+      console.error("postBuild script failed with exit code:", result.exitCode);
+      if (result.stderr) {
+        console.error("stderr:", result.stderr.toString());
+      }
+      // Also log which bun binary we're trying to use
+      console.error("Tried to run with bun at:", hostPaths.BUN_BINARY);
+      console.error("Script path:", config.scripts.postBuild);
+      console.error("Working directory:", projectRoot);
+      process.exit(1);
+    }
   }
   // All the unique files are in the bundle now. Create an initial temporary tar file
   // for hashing the contents
@@ -920,8 +1423,9 @@ if (commandArg === "init") {
   );
 
   // todo (yoav): add these to config
+  // Only codesign/notarize when building macOS targets on macOS host
   const shouldCodesign =
-    buildEnvironment !== "dev" && config.build.mac.codesign;
+    buildEnvironment !== "dev" && targetOS === 'macos' && OS === 'macos' && config.build.mac.codesign;
   const shouldNotarize = shouldCodesign && config.build.mac.notarize;
 
   if (shouldCodesign) {
@@ -956,6 +1460,8 @@ if (commandArg === "init") {
     // 6.5. code sign and notarize the dmg
     // 7. copy artifacts to directory [self-extractor dmg, zstd app bundle, bsdiff patch, update.json]
 
+    // Platform suffix is only used for folder names, not file names
+    const platformSuffix = `-${targetOS}-${targetARCH}`;
     const tarPath = `${appBundleFolderPath}.tar`;
 
     // tar the signed and notarized app bundle
@@ -978,7 +1484,7 @@ if (commandArg === "init") {
     // zstd is the clear winner here. dev iteration speed gain of 1min 15s per build is much more valubale
     // than saving 1 more MB of space/bandwidth.
 
-    const compressedTarPath = `${tarPath}.zst`;
+    let compressedTarPath = `${tarPath}.zst`;
     artifactsToUpload.push(compressedTarPath);
 
     // zstd compress tarball
@@ -988,19 +1494,21 @@ if (commandArg === "init") {
     await ZstdInit().then(async ({ ZstdSimple, ZstdStream }) => {
       // Note: Simple is much faster than stream, but stream is better for large files
       // todo (yoav): consider a file size cutoff to switch to stream instead of simple.
+      const useStream = tarball.size > 100 * 1024 * 1024;
+      
       if (tarball.size > 0) {
         // Uint8 array filestream of the tar file
-
         const data = new Uint8Array(tarBuffer);
-        const compressionLevel = 22;
+        
+        const compressionLevel = 22;  // Maximum compression - now safe with stripped CEF libraries
         const compressedData = ZstdSimple.compress(data, compressionLevel);
 
         console.log(
           "compressed",
-          compressedData.length,
+          data.length,
           "bytes",
           "from",
-          data.length,
+          tarBuffer.byteLength,
           "bytes"
         );
 
@@ -1012,7 +1520,7 @@ if (commandArg === "init") {
     // now and it needs the same name as the original app bundle.
     rmdirSync(appBundleFolderPath, { recursive: true });
 
-    const selfExtractingBundle = createAppBundle(appFileName, buildFolder);
+    const selfExtractingBundle = createAppBundle(appFileName, buildFolder, targetOS);
     const compressedTarballInExtractingBundlePath = join(
       selfExtractingBundle.appBundleFolderResourcesPath,
       `${hash}.tar.zst`
@@ -1021,7 +1529,7 @@ if (commandArg === "init") {
     // copy the zstd tarball to the self-extracting app bundle
     cpSync(compressedTarPath, compressedTarballInExtractingBundlePath);
 
-    const selfExtractorBinSourcePath = PATHS.EXTRACTOR;
+    const selfExtractorBinSourcePath = targetPaths.EXTRACTOR;
     const selfExtractorBinDestinationPath = join(
       selfExtractingBundle.appBundleMacOSPath,
       "launcher"
@@ -1031,7 +1539,7 @@ if (commandArg === "init") {
       dereference: true,
     });
 
-    buildIcons(appBundleFolderResourcesPath);
+    buildIcons(selfExtractingBundle.appBundleFolderResourcesPath);
     await Bun.write(
       join(selfExtractingBundle.appBundleFolderContentsPath, "Info.plist"),
       InfoPlistContents
@@ -1053,28 +1561,117 @@ if (commandArg === "init") {
       console.log("skipping notarization");
     }
 
-    console.log("creating dmg...");
-    // make a dmg
-    const dmgPath = join(buildFolder, `${appFileName}.dmg`);
-    artifactsToUpload.push(dmgPath);
-    // hdiutil create -volname "YourAppName" -srcfolder /path/to/YourApp.app -ov -format UDZO YourAppName.dmg
-    // Note: use UDBZ for better compression vs. UDZO
-    execSync(
-      `hdiutil create -volname "${appFileName}" -srcfolder ${escapePathForTerminal(
-        appBundleFolderPath
-      )} -ov -format UDBZ ${escapePathForTerminal(dmgPath)}`
-    );
+    // DMG creation for macOS only
+    if (targetOS === 'macos') {
+      console.log("creating dmg...");
+      // make a dmg
+      const dmgPath = join(buildFolder, `${appFileName}.dmg`);
+      artifactsToUpload.push(dmgPath);
+      // hdiutil create -volname "YourAppName" -srcfolder /path/to/YourApp.app -ov -format UDZO YourAppName.dmg
+      // Note: use ULFO (lzfse) for better compatibility with large CEF frameworks and modern macOS
+      execSync(
+        `hdiutil create -volname "${sanitizeVolumeNameForHdiutil(appFileName)}" -srcfolder ${escapePathForTerminal(
+          selfExtractingBundle.appBundleFolderPath
+        )} -ov -format ULFO ${escapePathForTerminal(dmgPath)}`
+      );
 
-    if (shouldCodesign) {
-      codesignAppBundle(dmgPath);
-    } else {
-      console.log("skipping codesign");
-    }
+      if (shouldCodesign) {
+        codesignAppBundle(dmgPath);
+      } else {
+        console.log("skipping codesign");
+      }
 
-    if (shouldNotarize) {
-      notarizeAndStaple(dmgPath);
+      if (shouldNotarize) {
+        notarizeAndStaple(dmgPath);
+      } else {
+        console.log("skipping notarization");
+      }
     } else {
-      console.log("skipping notarization");
+      // For Windows and Linux, add the self-extracting bundle directly
+      const platformBundlePath = join(buildFolder, `${appFileName}${platformSuffix}${targetOS === 'win' ? '.exe' : ''}`);
+      // Copy the self-extracting bundle to platform-specific filename
+      if (targetOS === 'win') {
+        // On Windows, create a self-extracting exe
+        const selfExtractingExePath = await createWindowsSelfExtractingExe(
+          buildFolder,
+          compressedTarPath,
+          appFileName,
+          targetPaths,
+          buildEnvironment,
+          hash
+        );
+        
+        // Wrap Windows installer files in zip for distribution
+        const wrappedExePath = await wrapWindowsInstallerInZip(selfExtractingExePath, buildFolder);
+        artifactsToUpload.push(wrappedExePath);
+        
+        // Also keep the raw exe for backwards compatibility (optional)
+        // artifactsToUpload.push(selfExtractingExePath);
+      } else if (targetOS === 'linux') {
+        // Create desktop file for Linux
+        const desktopFileContent = `[Desktop Entry]
+Version=1.0
+Type=Application
+Name=${config.package?.name || config.app.name}
+Comment=${config.package?.description || config.app.description || ''}
+Exec=${appFileName}
+Icon=${appFileName}
+Terminal=false
+StartupWMClass=${appFileName}
+Categories=Application;
+`;
+        
+        const desktopFilePath = join(appBundleFolderPath, `${appFileName}.desktop`);
+        writeFileSync(desktopFilePath, desktopFileContent);
+        
+        // Make desktop file executable
+        execSync(`chmod +x ${escapePathForTerminal(desktopFilePath)}`);
+        
+        // Create user-friendly launcher script
+        const launcherScriptContent = `#!/bin/bash
+# ${config.package?.name || config.app.name} Launcher
+# This script launches the application from any location
+
+# Get the directory where this script is located
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+
+# Find the launcher binary relative to this script
+LAUNCHER_BINARY="\$SCRIPT_DIR/bin/launcher"
+
+if [ ! -x "\$LAUNCHER_BINARY" ]; then
+    echo "Error: Could not find launcher binary at \$LAUNCHER_BINARY"
+    exit 1
+fi
+
+# Launch the application
+exec "\$LAUNCHER_BINARY" "\$@"
+`;
+        
+        const launcherScriptPath = join(appBundleFolderPath, `${appFileName}.sh`);
+        writeFileSync(launcherScriptPath, launcherScriptContent);
+        execSync(`chmod +x ${escapePathForTerminal(launcherScriptPath)}`);
+        
+        // Create self-extracting Linux binary (similar to Windows approach)
+        const selfExtractingLinuxPath = await createLinuxSelfExtractingBinary(
+          buildFolder,
+          compressedTarPath,
+          appFileName,
+          targetPaths,
+          buildEnvironment
+        );
+        
+        // Wrap Linux .run file in tar.gz to preserve permissions
+        const wrappedRunPath = await wrapInArchive(selfExtractingLinuxPath, buildFolder, 'tar.gz');
+        artifactsToUpload.push(wrappedRunPath);
+        
+        // Also keep the raw .run for backwards compatibility (optional)
+        // artifactsToUpload.push(selfExtractingLinuxPath);
+        
+        // On Linux, create a tar.gz of the bundle
+        const linuxTarPath = join(buildFolder, `${appFileName}.tar.gz`);
+        execSync(`tar -czf ${escapePathForTerminal(linuxTarPath)} -C ${escapePathForTerminal(buildFolder)} ${escapePathForTerminal(basename(appBundleFolderPath))}`);
+        artifactsToUpload.push(linuxTarPath);
+      }
     }
 
     // refresh artifacts folder
@@ -1093,39 +1690,48 @@ if (commandArg === "init") {
       // the download button or display on your marketing site or in the app.
       version: config.app.version,
       hash: hash.toString(),
+      platform: OS,
+      arch: ARCH,
       // channel: buildEnvironment,
       // bucketUrl: config.release.bucketUrl
     });
 
-    await Bun.write(join(artifactFolder, "update.json"), updateJsonContent);
+    // update.json (no platform suffix in filename, platform is in folder name)
+    await Bun.write(join(artifactFolder, 'update.json'), updateJsonContent);
 
     // generate bsdiff
     // https://storage.googleapis.com/eggbun-static/electrobun-playground/canary/ElectrobunPlayground-canary.app.tar.zst
     console.log("bucketUrl: ", config.release.bucketUrl);
 
     console.log("generating a patch from the previous version...");
-    const urlToPrevUpdateJson = join(
-      config.release.bucketUrl,
-      buildEnvironment,
-      `update.json`
-    );
-    const cacheBuster = Math.random().toString(36).substring(7);
-    const updateJsonResponse = await fetch(
-      urlToPrevUpdateJson + `?${cacheBuster}`
-    ).catch((err) => {
-      console.log("bucketURL not found: ", err);
-    });
+    
+    // Skip patch generation if bucketUrl is not configured
+    if (!config.release.bucketUrl || config.release.bucketUrl.trim() === '') {
+      console.log("No bucketUrl configured, skipping patch generation");
+      console.log("To enable patch generation, configure bucketUrl in your electrobun.config");
+    } else {
+      const urlToPrevUpdateJson = join(
+        config.release.bucketUrl,
+        buildSubFolder,
+        'update.json'
+      );
+      const cacheBuster = Math.random().toString(36).substring(7);
+      const updateJsonResponse = await fetch(
+        urlToPrevUpdateJson + `?${cacheBuster}`
+      ).catch((err) => {
+        console.log("bucketURL not found: ", err);
+      });
 
     const urlToLatestTarball = join(
       config.release.bucketUrl,
-      buildEnvironment,
+      buildSubFolder,
       `${appFileName}.app.tar.zst`
     );
 
 
     // attempt to get the previous version to create a patch file
-    if (updateJsonResponse.ok) {
-      const prevUpdateJson = await updateJsonResponse.json();
+    if (updateJsonResponse && updateJsonResponse.ok) {
+      const prevUpdateJson = await updateJsonResponse!.json();
 
       const prevHash = prevUpdateJson.hash;
       console.log("PREVIOUS HASH", prevHash);
@@ -1164,7 +1770,7 @@ if (commandArg === "init") {
         console.log("diff previous and new tarballs...");
         // Run it as a separate process to leverage multi-threadedness
         // especially for creating multiple diffs in parallel
-        const bsdiffpath = PATHS.BSDIFF;
+        const bsdiffpath = targetPaths.BSDIFF;
         const patchFilePath = join(buildFolder, `${prevHash}.patch`);
         artifactsToUpload.push(patchFilePath);
         const result = Bun.spawnSync(
@@ -1181,6 +1787,7 @@ if (commandArg === "init") {
       console.log("prevoius version not found at: ", urlToLatestTarball);
       console.log("skipping diff generation");
     }
+    } // End of bucketUrl validation block
 
     // compress all the upload files
     console.log("copying artifacts...");
@@ -1209,10 +1816,7 @@ if (commandArg === "init") {
   // todo (yoav): rename to start
 
   // run the project in dev mode
-  // this runs the cli in debug mode, on macos executes the app bundle,
-  // there is another copy of the cli in the app bundle that will execute the app
-  // the two cli processes communicate via named pipes and together manage the dev
-  // lifecycle and debug functionality
+  // this runs the bundled bun binary with main.js directly
 
   // Note: this cli will be a bun single-file-executable
   // Note: we want to use the version of bun that's packaged with electrobun
@@ -1231,24 +1835,27 @@ if (commandArg === "init") {
 
   let mainProc;
   let bundleExecPath: string;
+  let bundleResourcesPath: string;
   
   if (OS === 'macos') {
     bundleExecPath = join(buildFolder, bundleFileName, "Contents", 'MacOS');
+    bundleResourcesPath = join(buildFolder, bundleFileName, "Contents", 'Resources');
   } else if (OS === 'linux' || OS === 'win') {
     bundleExecPath = join(buildFolder, bundleFileName, "bin");
+    bundleResourcesPath = join(buildFolder, bundleFileName, "Resources");
   } else {
     throw new Error(`Unsupported OS: ${OS}`);
   }
 
   if (OS === 'macos') {
-
-    mainProc = Bun.spawn([join(bundleExecPath,'bun'), join(bundleExecPath, 'main.js')], {
+    // Use the zig launcher for all builds (dev, canary, stable)
+    mainProc = Bun.spawn([join(bundleExecPath, 'launcher')], {
       stdio: ['inherit', 'inherit', 'inherit'],
       cwd: bundleExecPath
     })
   } else if (OS === 'win') {  
-    // Try the main process
-    mainProc =  Bun.spawn(['./bun.exe', './main.js'], {
+    // Try the main process - use relative path to Resources folder
+    mainProc =  Bun.spawn(['./bun.exe', '../Resources/main.js'], {
       stdio: ['inherit', 'inherit', 'inherit'],
       cwd: bundleExecPath,
       onExit: (proc, exitCode, signalCode, error) => {
@@ -1269,7 +1876,7 @@ if (commandArg === "init") {
       }
     }
     
-    mainProc = Bun.spawn([join(bundleExecPath, 'bun'), join(bundleExecPath, 'main.js')], {
+    mainProc = Bun.spawn([join(bundleExecPath, 'bun'), join(bundleResourcesPath, 'main.js')], {
       stdio: ['inherit', 'inherit', 'inherit'],
       cwd: bundleExecPath,
       env
@@ -1277,20 +1884,51 @@ if (commandArg === "init") {
   }
 
   process.on("SIGINT", () => {
-    console.log('exit command')
-    // toLauncherPipe.write("exit command\n");      
-    mainProc.kill();
-    process.exit();
+    console.log('[electrobun dev] Received SIGINT, initiating graceful shutdown...')
+    
+    if (mainProc) {
+      // First attempt graceful shutdown by sending SIGINT to child
+      console.log('[electrobun dev] Requesting graceful shutdown from app...')
+      mainProc.kill("SIGINT");
+      
+      // Give the app time to clean up (e.g., call killApp())
+      setTimeout(() => {
+        if (mainProc && !mainProc.killed) {
+          console.log('[electrobun dev] App did not exit gracefully, forcing termination...')
+          mainProc.kill("SIGKILL");
+        }
+        process.exit(0);
+      }, 2000); // 2 second timeout for graceful shutdown
+    } else {
+      process.exit(0);
+    }
   });
 
 } 
 
-function getConfig() {
+async function getConfig() {
   let loadedConfig = {};
-  if (existsSync(configPath)) {
-    const configFileContents = readFileSync(configPath, "utf8");
-    // Note: we want this to hard fail if there's a syntax error
-    loadedConfig = JSON.parse(configFileContents);
+  const foundConfigPath = findConfigFile();
+  
+  if (foundConfigPath) {
+    console.log(`Using config file: ${basename(foundConfigPath)}`);
+    
+    try {
+      // Use dynamic import for TypeScript ESM files
+      // Bun handles TypeScript natively, no transpilation needed
+      const configModule = await import(foundConfigPath);
+      loadedConfig = configModule.default || configModule;
+      
+      // Validate that we got a valid config object
+      if (!loadedConfig || typeof loadedConfig !== 'object') {
+        console.error("Config file must export a default object");
+        console.error("using default config instead");
+        loadedConfig = {};
+      }
+    } catch (error) {
+      console.error("Failed to load config file:", error);
+      console.error("using default config instead");
+    }
   }
 
   // todo (yoav): write a deep clone fn
@@ -1312,6 +1950,18 @@ function getConfig() {
           ...(loadedConfig?.build?.mac?.entitlements || {}),
         },
       },
+      win: {
+        ...defaultConfig.build.win,
+        ...(loadedConfig?.build?.win || {}),
+      },
+      linux: {
+        ...defaultConfig.build.linux,
+        ...(loadedConfig?.build?.linux || {}),
+      },
+      bun: {
+        ...defaultConfig.build.bun,
+        ...(loadedConfig?.build?.bun || {}),
+      }
     },
     scripts: {
       ...defaultConfig.scripts,
@@ -1347,6 +1997,303 @@ function getEntitlementValue(value: boolean | string) {
   }
 }
 
+async function createWindowsSelfExtractingExe(
+  buildFolder: string,
+  compressedTarPath: string,
+  appFileName: string,
+  targetPaths: any,
+  buildEnvironment: string,
+  hash: string
+): Promise<string> {
+  console.log("Creating Windows installer with separate archive...");
+  
+  // Format: MyApp-Setup.exe (stable) or MyApp-Setup-canary.exe (non-stable)
+  const setupFileName = buildEnvironment === "stable" 
+    ? `${config.app.name}-Setup.exe`
+    : `${config.app.name}-Setup-${buildEnvironment}.exe`;
+  
+  const outputExePath = join(buildFolder, setupFileName);
+  
+  // Copy the extractor exe
+  const extractorExe = readFileSync(targetPaths.EXTRACTOR);
+  writeFileSync(outputExePath, extractorExe);
+  
+  // Create metadata JSON file
+  const metadata = {
+    identifier: config.app.identifier,
+    name: config.app.name,
+    channel: buildEnvironment,
+    hash: hash
+  };
+  const metadataJson = JSON.stringify(metadata, null, 2);
+  const metadataFileName = setupFileName.replace('.exe', '.metadata.json');
+  const metadataPath = join(buildFolder, metadataFileName);
+  writeFileSync(metadataPath, metadataJson);
+  
+  // Copy the compressed archive with matching name
+  const archiveFileName = setupFileName.replace('.exe', '.tar.zst');
+  const archivePath = join(buildFolder, archiveFileName);
+  copyFileSync(compressedTarPath, archivePath);
+  
+  // Make the exe executable (though Windows doesn't need chmod)
+  if (OS !== 'win') {
+    execSync(`chmod +x ${escapePathForTerminal(outputExePath)}`);
+  }
+  
+  const exeSize = statSync(outputExePath).size;
+  const archiveSize = statSync(archivePath).size;
+  const totalSize = exeSize + archiveSize;
+  
+  console.log(`Created Windows installer:`);
+  console.log(`  - Extractor: ${outputExePath} (${(exeSize / 1024 / 1024).toFixed(2)} MB)`);
+  console.log(`  - Archive: ${archivePath} (${(archiveSize / 1024 / 1024).toFixed(2)} MB)`);
+  console.log(`  - Metadata: ${metadataPath}`);
+  console.log(`  - Total size: ${(totalSize / 1024 / 1024).toFixed(2)} MB`);
+  
+  return outputExePath;
+}
+
+async function createLinuxSelfExtractingBinary(
+  buildFolder: string,
+  compressedTarPath: string,
+  appFileName: string,
+  targetPaths: any,
+  buildEnvironment: string
+): Promise<string> {
+  console.log("Creating self-extracting Linux binary...");
+  
+  // Format: MyApp-Setup.run (stable) or MyApp-Setup-canary.run (non-stable)
+  const setupFileName = buildEnvironment === "stable" 
+    ? `${config.app.name}-Setup.run`
+    : `${config.app.name}-Setup-${buildEnvironment}.run`;
+  
+  const outputPath = join(buildFolder, setupFileName);
+  
+  // Read the extractor binary
+  const extractorBinary = readFileSync(targetPaths.EXTRACTOR);
+  
+  // Read the compressed archive
+  const compressedArchive = readFileSync(compressedTarPath);
+  
+  // Create metadata JSON
+  const metadata = {
+    identifier: config.app.identifier,
+    name: config.app.name,
+    channel: buildEnvironment
+  };
+  const metadataJson = JSON.stringify(metadata);
+  const metadataBuffer = Buffer.from(metadataJson, 'utf8');
+  
+  // Create marker buffers
+  const metadataMarker = Buffer.from('ELECTROBUN_METADATA_V1', 'utf8');
+  const archiveMarker = Buffer.from('ELECTROBUN_ARCHIVE_V1', 'utf8');
+  
+  // Combine extractor + metadata marker + metadata + archive marker + archive
+  const combinedBuffer = Buffer.concat([
+    extractorBinary,
+    metadataMarker,
+    metadataBuffer,
+    archiveMarker,
+    compressedArchive
+  ]);
+  
+  // Write the self-extracting binary
+  writeFileSync(outputPath, combinedBuffer, { mode: 0o755 });
+  
+  // Ensure it's executable (redundant but explicit)
+  execSync(`chmod +x ${escapePathForTerminal(outputPath)}`);
+  
+  console.log(`Created self-extracting Linux binary: ${outputPath} (${(combinedBuffer.length / 1024 / 1024).toFixed(2)} MB)`);
+  
+  return outputPath;
+}
+
+async function wrapWindowsInstallerInZip(exePath: string, buildFolder: string): Promise<string> {
+  const exeName = basename(exePath);
+  const exeStem = exeName.replace('.exe', '');
+  
+  // Derive the paths for metadata and archive files
+  const metadataPath = join(buildFolder, `${exeStem}.metadata.json`);
+  const archivePath = join(buildFolder, `${exeStem}.tar.zst`);
+  const zipPath = join(buildFolder, `${exeStem}.zip`);
+  
+  // Verify all files exist
+  if (!existsSync(exePath)) {
+    throw new Error(`Installer exe not found: ${exePath}`);
+  }
+  if (!existsSync(metadataPath)) {
+    throw new Error(`Metadata file not found: ${metadataPath}`);
+  }
+  if (!existsSync(archivePath)) {
+    throw new Error(`Archive file not found: ${archivePath}`);
+  }
+  
+  // Create zip archive
+  const output = createWriteStream(zipPath);
+  const archive = archiver('zip', {
+    zlib: { level: 9 } // Maximum compression
+  });
+  
+  return new Promise((resolve, reject) => {
+    output.on('close', () => {
+      console.log(`Created Windows installer package: ${zipPath} (${(archive.pointer() / 1024 / 1024).toFixed(2)} MB)`);
+      resolve(zipPath);
+    });
+    
+    archive.on('error', (err) => {
+      reject(err);
+    });
+    
+    archive.pipe(output);
+    
+    // Add all three files to the archive
+    archive.file(exePath, { name: basename(exePath) });
+    archive.file(metadataPath, { name: basename(metadataPath) });
+    archive.file(archivePath, { name: basename(archivePath) });
+    
+    archive.finalize();
+  });
+}
+
+async function wrapInArchive(filePath: string, buildFolder: string, archiveType: 'tar.gz' | 'zip'): Promise<string> {
+  const fileName = basename(filePath);
+  const fileDir = dirname(filePath);
+  
+  if (archiveType === 'tar.gz') {
+    // Output filename: Setup.exe -> Setup.exe.tar.gz or Setup.run -> Setup.run.tar.gz
+    const archivePath = filePath + '.tar.gz';
+    
+    // For Linux files, ensure they have executable permissions before archiving
+    if (fileName.endsWith('.run')) {
+      try {
+        // Try to set executable permissions (will only work on Unix-like systems)
+        execSync(`chmod +x ${escapePathForTerminal(filePath)}`, { stdio: 'ignore' });
+      } catch {
+        // Ignore errors on Windows hosts
+      }
+    }
+    
+    // Create tar.gz archive preserving permissions
+    // Using the tar package for cross-platform compatibility
+    await tar.c(
+      {
+        gzip: true,
+        file: archivePath,
+        cwd: fileDir,
+        portable: true,  // Ensures consistent behavior across platforms
+        preservePaths: false,
+        // The tar package should preserve file modes when creating archives
+      },
+      [fileName]
+    );
+    
+    console.log(`Created archive: ${archivePath} (preserving executable permissions)`);
+    return archivePath;
+  } else if (archiveType === 'zip') {
+    // Output filename: Setup.exe -> Setup.zip
+    const archivePath = filePath.replace(/\.[^.]+$/, '.zip');
+    
+    // Create zip archive
+    const output = createWriteStream(archivePath);
+    const archive = archiver('zip', {
+      zlib: { level: 9 } // Maximum compression
+    });
+    
+    return new Promise((resolve, reject) => {
+      output.on('close', () => {
+        console.log(`Created archive: ${archivePath} (${(archive.pointer() / 1024 / 1024).toFixed(2)} MB)`);
+        resolve(archivePath);
+      });
+      
+      archive.on('error', (err) => {
+        reject(err);
+      });
+      
+      archive.pipe(output);
+      
+      // Add the file to the archive
+      archive.file(filePath, { name: fileName });
+      
+      archive.finalize();
+    });
+  }
+}
+
+async function createAppImage(buildFolder: string, appBundlePath: string, appFileName: string, config: any): Promise<string | null> {
+  try {
+    console.log("Creating AppImage...");
+    
+    // Create AppDir structure
+    const appDirPath = join(buildFolder, `${appFileName}.AppDir`);
+    mkdirSync(appDirPath, { recursive: true });
+    
+    // Copy app bundle contents to AppDir
+    const appDirAppPath = join(appDirPath, "app");
+    cpSync(appBundlePath, appDirAppPath, { recursive: true });
+    
+    // Create AppRun script (main executable for AppImage)
+    const appRunContent = `#!/bin/bash
+HERE="$(dirname "$(readlink -f "\${0}")")"
+export APPDIR="\$HERE"
+cd "\$HERE"
+exec "\$HERE/app/bin/launcher" "\$@"
+`;
+    
+    const appRunPath = join(appDirPath, "AppRun");
+    writeFileSync(appRunPath, appRunContent);
+    execSync(`chmod +x ${escapePathForTerminal(appRunPath)}`);
+    
+    // Create desktop file in AppDir root
+    const desktopContent = `[Desktop Entry]
+Version=1.0
+Type=Application
+Name=${config.package?.name || config.app.name}
+Comment=${config.package?.description || config.app.description || ''}
+Exec=AppRun
+Icon=${appFileName}
+Terminal=false
+StartupWMClass=${appFileName}
+Categories=Application;
+`;
+    
+    const appDirDesktopPath = join(appDirPath, `${appFileName}.desktop`);
+    writeFileSync(appDirDesktopPath, desktopContent);
+    
+    // Copy icon if it exists
+    const iconPath = config.build.linux?.appImageIcon;
+    if (iconPath && existsSync(iconPath)) {
+      const iconDestPath = join(appDirPath, `${appFileName}.png`);
+      cpSync(iconPath, iconDestPath);
+    }
+    
+    // Try to create AppImage using available tools
+    const appImagePath = join(buildFolder, `${appFileName}.AppImage`);
+    
+    // Check for appimagetool
+    try {
+      execSync('which appimagetool', { stdio: 'pipe' });
+      console.log("Using appimagetool to create AppImage...");
+      execSync(`appimagetool ${escapePathForTerminal(appDirPath)} ${escapePathForTerminal(appImagePath)}`, { stdio: 'inherit' });
+      return appImagePath;
+    } catch {
+      // Check for Docker
+      try {
+        execSync('which docker', { stdio: 'pipe' });
+        console.log("Using Docker to create AppImage...");
+        execSync(`docker run --rm -v "${buildFolder}:/workspace" linuxserver/appimagetool "/workspace/${basename(appDirPath)}" "/workspace/${basename(appImagePath)}"`, { stdio: 'inherit' });
+        return appImagePath;
+      } catch {
+        console.warn("Neither appimagetool nor Docker found. AppImage creation skipped.");
+        console.warn("To create AppImages, install appimagetool or Docker.");
+        return null;
+      }
+    }
+  } catch (error) {
+    console.error("Failed to create AppImage:", error);
+    return null;
+  }
+}
+
 function codesignAppBundle(
   appBundleOrDmgPath: string,
   entitlementsFilePath?: string
@@ -1363,30 +2310,189 @@ function codesignAppBundle(
     process.exit(1);
   }
 
-  // list of entitlements https://developer.apple.com/documentation/security/hardened_runtime?language=objc
-  // todo (yoav): consider allowing separate entitlements config for each binary
-  // const entitlementsFilePath = join(buildFolder, 'entitlements.plist');
-
-  // codesign --deep --force --verbose --timestamp --sign "ELECTROBUN_DEVELOPER_ID" --options runtime --entitlements entitlementsFilePath appBundleOrDmgPath`
+  // If this is a DMG file, sign it directly
+  if (appBundleOrDmgPath.endsWith('.dmg')) {
+    execSync(
+      `codesign --force --verbose --timestamp --sign "${ELECTROBUN_DEVELOPER_ID}" ${escapePathForTerminal(
+        appBundleOrDmgPath
+      )}`
+    );
+    return;
+  }
 
+  // For app bundles, sign binaries individually to avoid --deep issues with notarization
+  const contentsPath = join(appBundleOrDmgPath, 'Contents');
+  const macosPath = join(contentsPath, 'MacOS');
+  
+  // Prepare entitlements if provided
   if (entitlementsFilePath) {
     const entitlementsFileContents = buildEntitlementsFile(
       config.build.mac.entitlements
     );
     Bun.write(entitlementsFilePath, entitlementsFileContents);
+  }
 
-    execSync(
-      `codesign --deep --force --verbose --timestamp --sign "${ELECTROBUN_DEVELOPER_ID}" --options runtime --entitlements ${entitlementsFilePath} ${escapePathForTerminal(
-        appBundleOrDmgPath
-      )}`
-    );
-  } else {
-    execSync(
-      `codesign --deep --force --verbose --timestamp --sign "${ELECTROBUN_DEVELOPER_ID}" ${escapePathForTerminal(
-        appBundleOrDmgPath
-      )}`
-    );
+  // Sign frameworks first (CEF framework requires special handling)
+  const frameworksPath = join(contentsPath, 'Frameworks');
+  if (existsSync(frameworksPath)) {
+    try {
+      const frameworks = readdirSync(frameworksPath);
+      for (const framework of frameworks) {
+        if (framework.endsWith('.framework')) {
+          const frameworkPath = join(frameworksPath, framework);
+          
+          if (framework === 'Chromium Embedded Framework.framework') {
+            console.log(`Signing CEF framework components: ${framework}`);
+            
+            // Sign CEF libraries first
+            const librariesPath = join(frameworkPath, 'Libraries');
+            if (existsSync(librariesPath)) {
+              const libraries = readdirSync(librariesPath);
+              for (const library of libraries) {
+                if (library.endsWith('.dylib')) {
+                  const libraryPath = join(librariesPath, library);
+                  console.log(`Signing CEF library: ${library}`);
+                  execSync(
+                    `codesign --force --verbose --timestamp --sign "${ELECTROBUN_DEVELOPER_ID}" --options runtime ${escapePathForTerminal(libraryPath)}`
+                  );
+                }
+              }
+            }
+            
+            // CEF helper apps are in the main Frameworks directory, not inside the CEF framework
+            // We'll sign them after signing all frameworks
+          }
+          
+          // Sign the framework bundle itself (for CEF and any other frameworks)
+          console.log(`Signing framework bundle: ${framework}`);
+          execSync(
+            `codesign --force --verbose --timestamp --sign "${ELECTROBUN_DEVELOPER_ID}" --options runtime ${escapePathForTerminal(frameworkPath)}`
+          );
+        }
+      }
+    } catch (err) {
+      console.log("Error signing frameworks:", err);
+      throw err; // Re-throw to fail the build since framework signing is critical
+    }
+  }
+  
+  // Sign CEF helper apps (they're in the main Frameworks directory, not inside CEF framework)
+  const cefHelperApps = [
+    'bun Helper.app',
+    'bun Helper (GPU).app', 
+    'bun Helper (Plugin).app',
+    'bun Helper (Alerts).app',
+    'bun Helper (Renderer).app'
+  ];
+  
+  for (const helperApp of cefHelperApps) {
+    const helperPath = join(frameworksPath, helperApp);
+    if (existsSync(helperPath)) {
+      const helperExecutablePath = join(helperPath, 'Contents', 'MacOS', helperApp.replace('.app', ''));
+      if (existsSync(helperExecutablePath)) {
+        console.log(`Signing CEF helper executable: ${helperApp}`);
+        const entitlementFlag = entitlementsFilePath ? `--entitlements ${entitlementsFilePath}` : '';
+        execSync(
+          `codesign --force --verbose --timestamp --sign "${ELECTROBUN_DEVELOPER_ID}" --options runtime ${entitlementFlag} ${escapePathForTerminal(helperExecutablePath)}`
+        );
+      }
+      
+      console.log(`Signing CEF helper bundle: ${helperApp}`);
+      const entitlementFlag = entitlementsFilePath ? `--entitlements ${entitlementsFilePath}` : '';
+      execSync(
+        `codesign --force --verbose --timestamp --sign "${ELECTROBUN_DEVELOPER_ID}" --options runtime ${entitlementFlag} ${escapePathForTerminal(helperPath)}`
+      );
+    }
   }
+
+  // Sign all binaries and libraries in MacOS folder and subdirectories
+  console.log("Signing all binaries in MacOS folder...");
+  
+  // Recursively find all executables and libraries in MacOS folder
+  function findExecutables(dir: string): string[] {
+    let executables: string[] = [];
+    
+    try {
+      const entries = readdirSync(dir, { withFileTypes: true });
+      
+      for (const entry of entries) {
+        const fullPath = join(dir, entry.name);
+        
+        if (entry.isDirectory()) {
+          // Recursively search subdirectories
+          executables = executables.concat(findExecutables(fullPath));
+        } else if (entry.isFile()) {
+          // Check if it's an executable or library
+          try {
+            const fileInfo = execSync(`file -b "${fullPath}"`, { encoding: 'utf8' }).trim();
+            if (fileInfo.includes('Mach-O') || entry.name.endsWith('.dylib')) {
+              executables.push(fullPath);
+            }
+          } catch {
+            // If file command fails, check by extension
+            if (entry.name.endsWith('.dylib') || !entry.name.includes('.')) {
+              // No extension often means executable
+              executables.push(fullPath);
+            }
+          }
+        }
+      }
+    } catch (err) {
+      console.error(`Error scanning directory ${dir}:`, err);
+    }
+    
+    return executables;
+  }
+  
+  const executablesInMacOS = findExecutables(macosPath);
+  
+  // Sign each found executable
+  for (const execPath of executablesInMacOS) {
+    const fileName = basename(execPath);
+    const relativePath = execPath.replace(macosPath + '/', '');
+    
+    // Use filename as identifier (without extension)
+    const identifier = fileName.replace(/\.[^.]+$/, '');
+    
+    console.log(`Signing ${relativePath} with identifier ${identifier}`);
+    const entitlementFlag = entitlementsFilePath ? `--entitlements ${entitlementsFilePath}` : '';
+    
+    try {
+      execSync(
+        `codesign --force --verbose --timestamp --sign "${ELECTROBUN_DEVELOPER_ID}" --options runtime --identifier ${identifier} ${entitlementFlag} ${escapePathForTerminal(execPath)}`
+      );
+    } catch (err) {
+      console.error(`Failed to sign ${relativePath}:`, err.message);
+      // Continue signing other files even if one fails
+    }
+  }
+
+  // Note: main.js is now in Resources and will be automatically sealed when signing the app bundle
+  
+  // Sign the main executable (launcher) - this should use the app's bundle identifier, not "launcher"
+  const launcherPath = join(macosPath, 'launcher');
+  if (existsSync(launcherPath)) {
+    console.log("Signing main executable (launcher)");
+    const entitlementFlag = entitlementsFilePath ? `--entitlements ${entitlementsFilePath}` : '';
+    try {
+      execSync(
+        `codesign --force --verbose --timestamp --sign "${ELECTROBUN_DEVELOPER_ID}" --options runtime ${entitlementFlag} ${escapePathForTerminal(launcherPath)}`
+      );
+    } catch (error) {
+      console.error("Failed to sign launcher:", error.message);
+      console.log("Attempting to sign launcher without runtime hardening...");
+      execSync(
+        `codesign --force --verbose --timestamp --sign "${ELECTROBUN_DEVELOPER_ID}" ${entitlementFlag} ${escapePathForTerminal(launcherPath)}`
+      );
+    }
+  }
+
+  // Finally, sign the app bundle itself (without --deep)
+  console.log("Signing app bundle");
+  const entitlementFlag = entitlementsFilePath ? `--entitlements ${entitlementsFilePath}` : '';
+  execSync(
+    `codesign --force --verbose --timestamp --sign "${ELECTROBUN_DEVELOPER_ID}" --options runtime ${entitlementFlag} ${escapePathForTerminal(appBundleOrDmgPath)}`
+  );
 }
 
 function notarizeAndStaple(appOrDmgPath: string) {
@@ -1473,8 +2579,8 @@ function notarizeAndStaple(appOrDmgPath: string) {
 // have the same name but different subfolders in our build directory. or I guess delete the first one after tar/compression and then create the other one.
 // either way you can pass in the parent folder here for that flexibility.
 // for intel/arm builds on mac we'll probably have separate subfolders as well and build them in parallel.
-function createAppBundle(bundleName: string, parentFolder: string) {
-  if (OS === 'macos') {
+function createAppBundle(bundleName: string, parentFolder: string, targetOS: 'macos' | 'win' | 'linux') {
+  if (targetOS === 'macos') {
     // macOS bundle structure
     const bundleFileName = `${bundleName}.app`;
     const appBundleFolderPath = join(parentFolder, bundleFileName);
@@ -1501,7 +2607,7 @@ function createAppBundle(bundleName: string, parentFolder: string) {
       appBundleFolderResourcesPath,
       appBundleFolderFrameworksPath,
     };
-  } else if (OS === 'linux' || OS === 'win') {
+  } else if (targetOS === 'linux' || targetOS === 'win') {
     // Linux/Windows simpler structure
     const appBundleFolderPath = join(parentFolder, bundleName);
     const appBundleFolderContentsPath = appBundleFolderPath; // No Contents folder needed
@@ -1522,6 +2628,14 @@ function createAppBundle(bundleName: string, parentFolder: string) {
       appBundleFolderFrameworksPath,
     };
   } else {
-    throw new Error(`Unsupported OS: ${OS}`);
+    throw new Error(`Unsupported OS: ${targetOS}`);
   }
 }
+
+} // End of main() function
+
+// Run the main function
+main().catch((error) => {
+  console.error('Fatal error:', error);
+  process.exit(1);
+});