CLI reference

murasaki dev         Start the Vite dev server + native window (HMR, Fast Refresh)
murasaki build       Production Vite build → dist/client
murasaki bundle      Native app folder / .app for the current platform
murasaki installer   Distributable installer for the current platform
murasaki demo        Run a checksum-verified macOS developer preview
murasaki init        Install the Rust toolchain (only if you're hacking on @murasakijs/native)
murasaki icon        Generate .icns / .ico / .png from a single PNG
murasaki release     Auto-update manifest helpers
murasaki help        Show this help

murasaki dev

Boots the Vite dev server in a child process and attaches a native window pointed at it — React Fast Refresh + HMR work as usual; edit and save, the window updates. Runs on config.devPort (default 5178), auto-incrementing if that port is taken.

murasaki build

A production Vite build → dist/client.

murasaki bundle

Packages dist/client + the compiled server-actions registry + a portable Node runtime + the native launcher binary into dist/bundle/ — a <productName>.app on macOS, a <productName>/ folder with <productName>.exe on Windows, or an AppDir plus .AppImage on Linux.

murasaki bundle                       # host platform + arch, unsigned
murasaki bundle --arch x64            # cross-arch (macOS): x64 .app on Apple Silicon
murasaki bundle --target win32-arm64  # cross-target: an arm64 Windows bundle
murasaki bundle --target linux-x64    # Linux AppDir + AppImage
murasaki bundle --sign                # macOS Developer ID or Windows Authenticode signing
murasaki bundle --no-build            # reuse an existing dist/client

• --arch arm64|x64 / --target <platform>-<arch> — target arch / platform (defaults to the host). Targets include darwin-arm64, darwin-x64, win32-x64, win32-arm64, linux-x64, and linux-arm64.
• --sign — Developer ID-sign the .app on macOS, Authenticode-sign the app executable before the Windows portable ZIP is created, or GPG-sign the produced .AppImage on Linux. Windows signing must run on Windows with SignTool. See Distribution.
• --no-build — skip the Vite rebuild if dist/client already exists.

murasaki installer

Turns the bundle output into a distributable installer for the target platform: a drag-to-install, styled .dmg on macOS (dist/<productName>-<version>.dmg, falling back to a plain DMG if Finder-styling fails); an NSIS .exe on Windows, plus an MSI .msi when the built-in updater is disabled; and a .deb on Linux. The portable Windows ZIP comes from the bundle step. The Linux bundle step also keeps the AppDir and .AppImage artifacts.

murasaki installer                     # installer(s) for the host platform (re-bundles first)
murasaki installer --target win32-x64  # Windows x64 installers
murasaki installer --target linux-x64  # Linux amd64 .deb + bundle artifacts
murasaki installer --sign --notarize   # macOS: Developer ID sign + notarize + staple
murasaki installer --target win32-x64 --sign # Windows: sign app + generated installer(s)
murasaki installer --no-build          # reuse an existing dist/bundle

• --target <platform>-<arch> / --arch arm64|x64 — forwarded to bundle.
• --sign — macOS Developer ID, Windows Authenticode, or Linux GPG signing. On Windows it signs and verifies the app executable and every generated installer. Updater-enabled builds require per-user NSIS and skip MSI. On Linux it GPG-signs the .AppImage, the .deb, and a combined SHA256SUMS (see Distribution).
• The command fails when the platform packaging tool produces no installer. Use murasaki bundle when a portable ZIP/AppImage is the intended output.
• --notarize — macOS only; submits the signed .dmg to Apple's notary service and staples the ticket (--notarize requires --sign).

murasaki demo

Downloads and launches a packaged macOS developer preview in one command. The runner selects Apple silicon or Intel automatically, verifies the release asset against its published SHA-256 and strict ad-hoc code signature, caches the verified app, and only then removes the quarantine attribute.

pnpm dlx murasaki@latest demo papelle
pnpm dlx murasaki@latest demo oscilla
pnpm dlx murasaki@latest demo orglia

• murasaki demo --list lists every available preview.
• --refresh ignores the verified local cache and downloads the asset again.
• --no-open prepares and verifies the app without launching it.
• Running murasaki demo without a name launches the packaged default create-murasaki scaffold.

These are ad-hoc-signed developer previews for CLI users, not notarized consumer downloads. Production apps should be signed and notarized by their publisher.

murasaki init

Checks for rustc and prints an install command if it's missing. Only needed if you're hacking on @murasakijs/native itself — end users of Murasaki never need Rust; prebuilt binaries come down from npm.

murasaki icon

murasaki icon assets/logo.png

Generates platform icon resources from one square 1024px PNG. On macOS with a full Xcode installation, the output contains Assets.car with an AppIcon asset as well as icon.icns: current macOS applies its own icon mask and appearance rendering from the asset catalog, while .icns remains the legacy fallback. With Command Line Tools only, Murasaki warns and produces the .icns fallback. The command is PNG-only off macOS for now.

You rarely need to run it directly — murasaki bundle embeds the same resources from config.icon automatically. Do not bake macOS's rounded mask into the canonical source image; provide a square design and let the system mask the asset-catalog version. Windows builds generate an .ico and embed it into the .exe.

murasaki release

murasaki release --keygen [--force]
murasaki release --manifest --base-url <url> --version <v> [--notes <md>] [--mandatory] [--rollout <0-100>]
murasaki release --sign

Three independent modes for publishing signed auto-updates — see the Auto-update guide for the full flow.

• --keygen — generates the Ed25519 keypair used to sign update manifests. Writes .murasaki/update-key.pub (commit it) and .murasaki/update-key (mode 0600, gitignored automatically). It never prints the private key; it shows an stdin-based command for storing the file as a MURASAKI_UPDATE_KEY GitHub secret. Refuses to overwrite an existing key without --force.
• --manifest — scans dist/ for this version's payloads (the macOS .app.zip, the Windows -setup-<arch>.exe — the legacy un-suffixed -setup.exe name is still recognized for win32-x64), and Linux -linux-<arch>.AppImage payloads, hashes whichever exist, and writes dist/latest.json with a generatedAt timestamp. Linux .deb packages are intentionally not update payloads because the system package manager owns their lifecycle. Missing targets are skipped, not errors. --rollout <0-100> writes an optional staged-rollout percentage.
• --sign — signs dist/latest.json into dist/latest.json.sig. Key from $MURASAKI_UPDATE_KEY, falling back to .murasaki/update-key. Also writes a keyId rotation hint into the manifest when .murasaki/update-key.pub is available.

--generate-manifest still works as a deprecated alias of --manifest.

Next