ruby_everywhere 0.0.1 → 0.1.0

data/lib/everywhere/png.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require "zlib"
+
+module Everywhere
+  # Minimal PNG surgery: Tauri requires RGBA icons, users hand us whatever
+  # their design tool exported. Converts 8-bit RGB (color type 2) to RGBA
+  # (color type 6); passes RGBA through untouched. No image libraries needed.
+  module PNG
+    SIGNATURE = "\x89PNG\r\n\x1a\n".b
+
+    module_function
+
+    # Writes an RGBA copy of src to dst. Returns true on success, false for
+    # PNG flavors we don't handle (palette, 16-bit, interlaced...).
+    def ensure_rgba(src, dst)
+      data = File.binread(src)
+      return false unless data.start_with?(SIGNATURE)
+
+      chunks = read_chunks(data)
+      ihdr = chunks.find { |type, _| type == "IHDR" }&.last or return false
+      width, height, depth, color, _comp, _filter, interlace = ihdr.unpack("NNC5")
+      return false unless depth == 8 && interlace.zero?
+
+      if color == 6 # already RGBA
+        FileUtils.cp(src, dst)
+        return true
+      end
+      return false unless color == 2 # 8-bit RGB
+
+      raw = Zlib::Inflate.inflate(chunks.select { |t, _| t == "IDAT" }.map(&:last).join)
+      rgba = add_alpha(raw, width, height)
+
+      out = SIGNATURE.dup
+      out << chunk("IHDR", [width, height, 8, 6, 0, 0, 0].pack("NNC5"))
+      out << chunk("IDAT", Zlib::Deflate.deflate(rgba))
+      out << chunk("IEND", "")
+      File.binwrite(dst, out)
+      true
+    end
+
+    def read_chunks(data)
+      chunks = []
+      pos = 8
+      while pos < data.bytesize
+        length = data[pos, 4].unpack1("N")
+        type = data[pos + 4, 4]
+        chunks << [type, data[pos + 8, length]]
+        pos += 12 + length
+        break if type == "IEND"
+      end
+      chunks
+    end
+
+    # Unfilter RGB scanlines, emit unfiltered (filter 0) RGBA scanlines.
+    def add_alpha(raw, width, height)
+      bpp = 3
+      stride = width * bpp
+      prev = "\0".b * stride
+      out = +"".b
+
+      height.times do |y|
+        filter = raw.getbyte(y * (stride + 1))
+        line = raw.byteslice(y * (stride + 1) + 1, stride).dup
+        unfilter!(line, prev, filter, bpp)
+
+        out << "\0"
+        width.times do |x|
+          out << line.byteslice(x * bpp, bpp) << "\xFF".b
+        end
+        prev = line
+      end
+      out
+    end
+
+    def unfilter!(line, prev, filter, bpp)
+      stride = line.bytesize
+      case filter
+      when 0 # None
+      when 1 # Sub
+        bpp.upto(stride - 1) { |i| line.setbyte(i, (line.getbyte(i) + line.getbyte(i - bpp)) & 0xFF) }
+      when 2 # Up
+        0.upto(stride - 1) { |i| line.setbyte(i, (line.getbyte(i) + prev.getbyte(i)) & 0xFF) }
+      when 3 # Average
+        0.upto(stride - 1) do |i|
+          left = i >= bpp ? line.getbyte(i - bpp) : 0
+          line.setbyte(i, (line.getbyte(i) + ((left + prev.getbyte(i)) >> 1)) & 0xFF)
+        end
+      when 4 # Paeth
+        0.upto(stride - 1) do |i|
+          left = i >= bpp ? line.getbyte(i - bpp) : 0
+          up = prev.getbyte(i)
+          up_left = i >= bpp ? prev.getbyte(i - bpp) : 0
+          p = left + up - up_left
+          pa = (p - left).abs
+          pb = (p - up).abs
+          pc = (p - up_left).abs
+          predictor = pa <= pb && pa <= pc ? left : (pb <= pc ? up : up_left)
+          line.setbyte(i, (line.getbyte(i) + predictor) & 0xFF)
+        end
+      else
+        raise Error, "unknown PNG filter #{filter}"
+      end
+    end
+
+    def chunk(type, payload)
+      [payload.bytesize].pack("N") + type + payload + [Zlib.crc32(type + payload)].pack("N")
+    end
+  end
+end

data/lib/everywhere/receipt.rb

@@ -0,0 +1,185 @@
+# frozen_string_literal: true
+
+require "json"
+require "digest"
+require_relative "version"
+require_relative "shellout"
+require_relative "ignore"
+
+module Everywhere
+  # Builds the machine-readable build receipt (release.json) — the same shape
+  # emitted by local, CI, and Platform builds. See platform/docs/build-engine.md
+  # §7.
+  #
+  # Two layers:
+  #   * the *resolved manifest* — the deterministic build request (app,
+  #     framework, ruby, toolchain versions, source checksums, target,
+  #     permissions). Everything here is knowable BEFORE the build runs and
+  #     carries no volatile fields, so the same source + toolchain hashes
+  #     identically (manifest_checksum).
+  #   * the *artifact* record — filename, checksum, size, and the generic
+  #     `signing` block, layered on once a build has produced something.
+  class Receipt
+    SCHEMA = 1
+
+    def initialize(root:, config:, framework:, ruby:, target:, channel:, shell_dir: nil)
+      @root = File.expand_path(root)
+      @config = config
+      @framework = framework
+      @ruby = ruby
+      @target = parse_target(target, channel)
+      @shell_dir = shell_dir
+    end
+
+    # The deterministic build request.
+    def manifest
+      {
+        "app" => {
+          "name" => @config.name,
+          "bundle_id" => @config.bundle_id,
+          "version" => @config.version
+        },
+        "framework" => framework_info,
+        "ruby" => @ruby,
+        "versions" => versions,
+        "source" => {
+          "checksum" => source_checksum,
+          "lockfile_checksum" => lockfile_checksum
+        },
+        "target" => @target,
+        "permissions" => @config.permissions
+      }
+    end
+
+    # sha256 over the canonical (sorted-key) JSON of the manifest. Ties a receipt
+    # to the exact request that produced it.
+    def manifest_checksum
+      "sha256:#{Digest::SHA256.hexdigest(canonical_json(manifest))}"
+    end
+
+    # The full receipt: manifest + artifact record. `signing` is the generic
+    # block from the spec — common fields + a platform-specific bag.
+    def to_h(artifact:, signing:, build_id: nil, logs_url: nil)
+      {
+        "schema" => SCHEMA,
+        "build_id" => build_id,
+        "manifest_checksum" => manifest_checksum
+      }.merge(manifest).merge(
+        "artifact" => artifact_record(artifact).merge("signing" => signing),
+        "logs_url" => logs_url
+      )
+    end
+
+    def write(path, **kwargs)
+      File.write(path, "#{JSON.pretty_generate(to_h(**kwargs))}\n")
+      path
+    end
+
+    private
+
+    def parse_target(target, channel)
+      os, arch = target.to_s.split("-", 2)
+      { "os" => os, "arch" => arch, "distribution_channel" => channel }
+    end
+
+    # Remote-mode apps package no local framework/runtime.
+    def framework_info
+      return { "name" => "remote", "version" => nil } unless @framework
+
+      { "name" => @framework.name, "version" => lockfile_gem_version(@framework.name) }
+    end
+
+    def artifact_record(path)
+      {
+        "filename" => File.basename(path),
+        "checksum" => "sha256:#{Digest::SHA256.file(path).hexdigest}",
+        "size_bytes" => File.size(path)
+      }
+    end
+
+    # ---- versions ------------------------------------------------------------
+
+    def versions
+      {
+        "cli" => Everywhere::VERSION,
+        "bridge" => bridge_version,
+        "shell" => shell_version,
+        "tebako" => tebako_version
+      }
+    end
+
+    def bridge_version
+      # Package installs: read the version straight from package.json.
+      [
+        File.join(@root, "node_modules", "@rubyeverywhere", "bridge", "package.json"),
+        File.join(@root, "vendor", "javascript", "@rubyeverywhere", "bridge", "package.json")
+      ].each { |p| (v = json_version(p)) and return v }
+
+      # Single-file vendored install: read a `// version: x.y.z` header marker
+      # if `every install` stamped one (best-effort until it does).
+      flat = File.join(@root, "vendor", "javascript", "@rubyeverywhere--bridge.js")
+      File.exist?(flat) ? File.foreach(flat).first(6).join[/version:\s*([\d.]+)/i, 1] : nil
+    end
+
+    def shell_version
+      return nil unless @shell_dir
+
+      json_version(File.join(@shell_dir, "tauri.conf.json")) ||
+        json_version(File.join(@shell_dir, "..", "tauri.conf.json"))
+    end
+
+    # The rbe-tebako fork prints its banner ("...version 0.15.0") on every
+    # invocation and exits non-zero for unknown subcommands, so parse the output
+    # rather than gate on the exit status.
+    def tebako_version
+      out, = Shellout.capture("rbe-tebako", "--version")
+      out[/version\s+([\d.]+)/i, 1]
+    end
+
+    # ---- checksums -----------------------------------------------------------
+
+    def lockfile_checksum
+      lock = File.join(@root, "Gemfile.lock")
+      File.exist?(lock) ? "sha256:#{Digest::SHA256.file(lock).hexdigest}" : nil
+    end
+
+    def lockfile_gem_version(gem_name)
+      lock = File.join(@root, "Gemfile.lock")
+      return nil unless File.exist?(lock)
+
+      File.read(lock)[/^\s{4}#{Regexp.escape(gem_name)} \(([^)]+)\)/, 1]
+    end
+
+    # Deterministic digest of the app's source: for every non-ignored file,
+    # "relpath\0<sha256>\n", sorted, then hashed. Order-stable across machines.
+    # Uses the SAME ignore rules as the (future) snapshot, so the checksum
+    # describes exactly what ships.
+    def source_checksum
+      digest = Digest::SHA256.new
+      Ignore.for(@root).files(@root).each do |rel|
+        digest << rel << "\0" << Digest::SHA256.file(File.join(@root, rel)).hexdigest << "\n"
+      end
+      "sha256:#{digest.hexdigest}"
+    end
+
+    # ---- helpers -------------------------------------------------------------
+
+    def json_version(path)
+      return nil unless File.exist?(path)
+
+      JSON.parse(File.read(path))["version"]
+    rescue JSON::ParserError
+      nil
+    end
+
+    def canonical_json(obj) = JSON.generate(sort_deep(obj))
+
+    def sort_deep(obj)
+      case obj
+      when Hash  then obj.sort_by { |k, _| k.to_s }.to_h.transform_values { |v| sort_deep(v) }
+      when Array then obj.map { |v| sort_deep(v) }
+      else obj
+      end
+    end
+  end
+end

data/lib/everywhere/shellout.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require_relative "ui"
+
+module Everywhere
+  # All external commands (tebako, cargo, the app's own bin/dev) run outside
+  # this gem's bundle — they have their own gem environments.
+  module Shellout
+    module_function
+
+    def unbundled(&block)
+      defined?(Bundler) ? Bundler.with_unbundled_env(&block) : yield
+    end
+
+    def run!(env, *cmd, chdir: Dir.pwd)
+      success = unbundled { system(env, *cmd, chdir: chdir) }
+      UI.die!("command failed: #{cmd.join(" ")}") unless success
+    end
+
+    def run?(*cmd)
+      unbundled { system(*cmd) }
+    end
+
+    # Run a command and capture its combined stdout+stderr. Returns
+    # [output_string, Process::Status]. For probing tool output (codesign,
+    # stapler, notarytool) rather than driving a build.
+    def capture(*cmd)
+      require "open3"
+      unbundled { Open3.capture2e(*cmd) }
+    rescue Errno::ENOENT
+      ["", nil]
+    end
+
+    # Run a command streaming to the console while also capturing to a log file.
+    def run_logged!(env, cmd, log:)
+      require "shellwords"
+      line = "#{cmd.shelljoin} 2>&1 | tee #{log.shellescape}"
+      success = unbundled { system(env, "/bin/bash", "-o", "pipefail", "-c", line) }
+      UI.die!("command failed: #{cmd.join(" ")} (full log: #{log})") unless success
+    end
+
+    def spawn(env, cmd, chdir:)
+      unbundled { Process.spawn(env, cmd, chdir: chdir) }
+    end
+  end
+end

data/lib/everywhere/ui.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Everywhere
+  # Terminal output helpers. Colors follow the informal standard:
+  # on when stdout is a TTY or CLICOLOR_FORCE=1, always off when NO_COLOR is set.
+  module UI
+    module_function
+
+    def color?
+      return false if ENV["NO_COLOR"]
+      return true if ENV["CLICOLOR_FORCE"] == "1"
+
+      $stdout.tty?
+    end
+
+    def paint(text, *codes)
+      color? ? "\e[#{codes.join(";")}m#{text}\e[0m" : text.to_s
+    end
+
+    def bold(t)   = paint(t, 1)
+    def dim(t)    = paint(t, 2)
+    def red(t)    = paint(t, 31)
+    def green(t)  = paint(t, 32)
+    def yellow(t) = paint(t, 33)
+    def cyan(t)   = paint(t, 36)
+
+    def step(msg)    = puts("#{cyan("→")} #{msg}")
+    def ok(msg)      = puts("#{green("✓")} #{msg}")
+    def bad(msg)     = puts("#{red("✗")} #{msg}")
+    def warn(msg)    = puts("#{yellow("!")} #{msg}")
+    def success(msg) = puts("#{green("✓")} #{bold(msg)}")
+
+    def die!(msg)
+      abort "#{red("✗")} #{red(msg)}"
+    end
+  end
+end

data/lib/everywhere/version.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Everywhere
+  VERSION = "0.1.0"
+
+  # Version of the vendored @rubyeverywhere/bridge JS this gem ships. Tracks
+  # bridge/package.json — bump it whenever lib/everywhere/javascript/bridge.js is
+  # refreshed. `every install` stamps it into the vendored file so the build
+  # receipt can record which bridge shipped; it versions independently of the CLI.
+  BRIDGE_VERSION = "0.1.0"
+end

data/lib/everywhere.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# Runtime entry point: what an app gets from `require "ruby_everywhere"`.
+# The CLI lives in everywhere/cli and is only loaded by the every/rbe executables.
+require_relative "everywhere/version"
+require_relative "everywhere/config"
+require_relative "everywhere/framework"
+require_relative "everywhere/database"
+require_relative "everywhere/boot"
+
+module Everywhere
+  class Error < StandardError; end
+
+  # App-facing runtime configuration. Apps register overrides at load time:
+  #
+  #   # config/initializers/everywhere.rb (Rails) or anywhere loaded by config.ru
+  #   Everywhere.configure do |c|
+  #     c.database { MyMigrator.run! }   # override the default ORM-driven prep
+  #   end
+  #
+  # Read back by the boot path (Everywhere::Database, etc.).
+  class Configuration
+    # A callable that fully owns database preparation. When set, it replaces the
+    # ORM auto-detection in Everywhere::Database entirely.
+    attr_reader :database_hook
+
+    # An explicit Sequel database handle for frameworks (e.g. Hanami) where the
+    # connection lives inside a container rather than a top-level constant.
+    attr_accessor :sequel_db
+
+    def database(&block)
+      @database_hook = block
+    end
+  end
+
+  class << self
+    def config
+      @config ||= Configuration.new
+    end
+
+    def configure
+      yield config
+    end
+
+    # Test/reset seam.
+    def reset_config!
+      @config = Configuration.new
+    end
+  end
+end

data/lib/ruby_everywhere.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
 
-module RubyEverywhere
-  VERSION = "0.0.1"
-end
+# Conventional require path for the ruby_everywhere gem.
+require_relative "everywhere"

data/support/github/build.yml

@@ -0,0 +1,85 @@
+# RubyEverywhere Platform — reusable build workflow.
+#
+# Lives in the RunnerDispatch build repo (private, RubyEverywhere-owned). The
+# Platform triggers it via workflow_dispatch (see app/models/runner_dispatch.rb);
+# it runs one artifact on an ephemeral, single-use macOS runner and reports back
+# through the Runner API. No customer source lives in this repo — it arrives as
+# the snapshot the runner downloads.
+#
+# The heavy part is provisioning the toolchain (rbe-tebako fork + deps + Xcode
+# shims). Cache it aggressively; a warm runner builds in minutes.
+
+name: RubyEverywhere Platform Build
+
+on:
+  workflow_dispatch:
+    inputs:
+      artifact_id:
+        description: Artifact public id (art_…)
+        required: true
+      runner_token:
+        description: Per-artifact runner token
+        required: true
+      callback_base_url:
+        description: Platform base URL the runner reports back to
+        required: true
+
+# One in-flight job per artifact.
+concurrency:
+  group: build-${{ inputs.artifact_id }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    # macOS/iOS → macos; Android → ubuntu; Windows → windows (routed by the
+    # dispatcher today only macOS is live).
+    runs-on: macos-14 # Apple Silicon
+    timeout-minutes: 45
+
+    steps:
+      - name: Set up Ruby (to run the every CLI itself)
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+
+      - name: Provision the RubyEverywhere toolchain
+        run: |
+          set -euo pipefail
+          # The signing engine needs the rbe-tebako fork + build deps. This is the
+          # slow step — restore it from cache in a real setup (actions/cache on
+          # ~/.tebako, ~/.tebako-shims, brew).
+          brew install bison
+          gem install ruby_everywhere        # provides `every`
+          # gem install rbe-tebako           # the fork (or build from source)
+          # bin/setup-xcode-shims             # Xcode 26 CXX shim, rbconfig patch
+          every doctor || true                # surfaces any missing toolchain bits
+
+      - name: Install Apple intermediate certificates
+        run: |
+          set -euo pipefail
+          # The delivered .p12 holds only the leaf; codesign needs the Developer
+          # ID intermediate to build a complete chain (a clean runner has none).
+          for cert in DeveloperIDG2CA AppleWWDRCAG3; do
+            curl -fsSL "https://www.apple.com/certificateauthority/$cert.cer" -o "$RUNNER_TEMP/$cert.cer"
+            sudo security import "$RUNNER_TEMP/$cert.cer" -k /Library/Keychains/System.keychain || true
+          done
+
+      - name: Provision the generic Tauri shell
+        run: |
+          set -euo pipefail
+          # The shell (src-tauri) is generic — same for every app. Pull the
+          # pinned prebuilt shell for this platform.
+          echo "SHELL_DIR=$RUNNER_TEMP/shell/src-tauri" >> "$GITHUB_ENV"
+          # gh release download --repo rubyeverywhere/shell --pattern 'src-tauri-*' ...
+          # OR: git clone --depth 1 https://github.com/rubyeverywhere/shell "$RUNNER_TEMP/shell"
+
+      - name: Run the build
+        run: |
+          every platform runner \
+            --artifact "${{ inputs.artifact_id }}" \
+            --token "${{ inputs.runner_token }}" \
+            --url "${{ inputs.callback_base_url }}" \
+            --shell-dir "$SHELL_DIR"
+        # Signing credentials are pulled JIT from the Platform into a throwaway
+        # keychain by the runner itself — they are never GitHub secrets, and the
+        # ephemeral runner is destroyed after this job.

data/support/macos/entitlements.plist

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <!--
+    Hardened-runtime entitlements required to notarize a tebako-packed Ruby app.
+
+    A tebako binary embeds Ruby + all gems in a DwarFS memfs and, at runtime,
+    dlopen()s native gem extensions (.bundle) straight out of that memfs. Those
+    .bundle files are NOT signed with our Developer ID, so the hardened runtime's
+    library validation would reject them — hence disable-library-validation.
+
+    Ruby 4's YJIT/ZJIT allocate + execute JIT code, which the hardened runtime
+    blocks unless we allow JIT and unsigned executable memory.
+  -->
+  <key>com.apple.security.cs.disable-library-validation</key>
+  <true/>
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+</dict>
+</plist>

data/support/macos/notarize.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+#
+# Sign (Developer ID + hardened runtime), notarize, and staple a .app bundle
+# so it launches without Gatekeeper warnings on other Macs.
+#
+# Secrets never live in this script. Provide them via the environment — the
+# easiest way is to source your release env first:
+#
+#     source ~/Projects/atlastools.dev/atlas-workspaces/.env.release
+#     cli/support/macos/notarize.sh "example/dist/Example Notes.app"
+#
+# Required env vars (these match Tauri's names, so your existing .env works):
+#   APPLE_SIGNING_IDENTITY   e.g. "Developer ID Application: Your Name (TEAMID)"
+#   APPLE_ID                 your Apple ID email
+#   APPLE_PASSWORD           app-specific password (NOT your Apple account password)
+#   APPLE_TEAM_ID            your 10-char team id
+#
+# Optional:
+#   NOTARY_PROFILE           if set, uses `--keychain-profile "$NOTARY_PROFILE"`
+#                            instead of APPLE_ID/APPLE_PASSWORD/APPLE_TEAM_ID.
+#                            Create it once with:
+#                              xcrun notarytool store-credentials "$NOTARY_PROFILE" \
+#                                --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" \
+#                                --password "$APPLE_PASSWORD"
+
+set -euo pipefail
+
+APP="${1:?usage: notarize.sh /path/to/App.app}"
+[ -d "$APP" ] || { echo "not a .app bundle: $APP" >&2; exit 1; }
+
+# Load secrets from a dotenv-style file when ENV_FILE is set. This parses
+# KEY=VALUE line-by-line and exports each var, so it handles unquoted values
+# containing spaces/parens (e.g. APPLE_SIGNING_IDENTITY=Developer ID
+# Application: Name (TEAM)) that plain `source .env.release` cannot.
+#
+#   ENV_FILE=.env.release cli/support/macos/notarize.sh "App.app"
+if [ -n "${ENV_FILE:-}" ]; then
+  [ -f "$ENV_FILE" ] || { echo "ENV_FILE not found: $ENV_FILE" >&2; exit 1; }
+  while IFS= read -r line || [ -n "$line" ]; do
+    line="${line%$'\r'}"                        # strip trailing CR (CRLF files)
+    case "$line" in ''|'#'*) continue ;; esac   # skip blank / comment lines
+    [ "${line#*=}" = "$line" ] && continue       # no '=' on the line -> skip
+    key="${line%%=*}"; val="${line#*=}"
+    key="${key#export }"                         # allow "export KEY=..."
+    key="${key#"${key%%[![:space:]]*}"}"         # trim leading whitespace
+    key="${key%"${key##*[![:space:]]}"}"         # trim trailing whitespace
+    # strip one layer of matching surrounding quotes from the value
+    if   [ "${val#\"}" != "$val" ] && [ "${val%\"}" != "$val" ]; then val="${val#\"}"; val="${val%\"}"
+    elif [ "${val#\'}" != "$val" ] && [ "${val%\'}" != "$val" ]; then val="${val#\'}"; val="${val%\'}"
+    fi
+    export "$key=$val"
+  done < "$ENV_FILE"
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ENTITLEMENTS="$SCRIPT_DIR/entitlements.plist"
+
+: "${APPLE_SIGNING_IDENTITY:?set APPLE_SIGNING_IDENTITY (source your .env.release)}"
+
+# --- 1. Sign inside-out: nested Mach-O first, then the bundle --------------
+echo "==> signing with: $APPLE_SIGNING_IDENTITY"
+# Sign every executable/dylib under Contents/MacOS individually so nested
+# helpers (app-server, the tebako binary) each carry the entitlements. The
+# bundle sign at the end seals resources and the main executable.
+while IFS= read -r -d '' bin; do
+  echo "    sign $bin"
+  codesign --force --timestamp --options runtime \
+    --entitlements "$ENTITLEMENTS" \
+    --sign "$APPLE_SIGNING_IDENTITY" "$bin"
+done < <(find "$APP/Contents/MacOS" -type f -print0)
+
+echo "    sign $APP"
+codesign --force --timestamp --options runtime \
+  --entitlements "$ENTITLEMENTS" \
+  --sign "$APPLE_SIGNING_IDENTITY" "$APP"
+
+echo "==> verifying signature"
+codesign --verify --deep --strict --verbose=2 "$APP"
+
+# --- 2. Notarize ----------------------------------------------------------
+ZIP="${APP%.app}.zip"
+echo "==> zipping for notarization: $ZIP"
+rm -f "$ZIP"
+ditto -c -k --keepParent "$APP" "$ZIP"
+
+echo "==> submitting to Apple notary service (this can take a few minutes)"
+if [ -n "${NOTARY_KEY:-}" ]; then
+  # App Store Connect API key (.p8) — how the Platform runner notarizes with a
+  # custodied key. NOTARY_KEY is a path to the .p8.
+  : "${NOTARY_KEY_ID:?set NOTARY_KEY_ID with NOTARY_KEY}"
+  : "${NOTARY_ISSUER:?set NOTARY_ISSUER with NOTARY_KEY}"
+  xcrun notarytool submit "$ZIP" \
+    --key "$NOTARY_KEY" --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER" --wait
+elif [ -n "${NOTARY_PROFILE:-}" ]; then
+  xcrun notarytool submit "$ZIP" --keychain-profile "$NOTARY_PROFILE" --wait
+else
+  # Accept APPLE_APP_SPECIFIC_PASSWORD as an alias for APPLE_PASSWORD.
+  APPLE_PASSWORD="${APPLE_PASSWORD:-${APPLE_APP_SPECIFIC_PASSWORD:-}}"
+  : "${APPLE_ID:?set APPLE_ID or NOTARY_PROFILE}"
+  : "${APPLE_PASSWORD:?set APPLE_PASSWORD (or APPLE_APP_SPECIFIC_PASSWORD) or NOTARY_PROFILE}"
+  : "${APPLE_TEAM_ID:?set APPLE_TEAM_ID or NOTARY_PROFILE}"
+  xcrun notarytool submit "$ZIP" \
+    --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_PASSWORD" \
+    --wait
+fi
+
+# --- 3. Staple + verify ---------------------------------------------------
+echo "==> stapling ticket"
+xcrun stapler staple "$APP"
+xcrun stapler validate "$APP"
+
+echo "==> Gatekeeper assessment"
+spctl -a -vvv "$APP"
+
+# --- 4. Re-zip the stapled app for distribution ---------------------------
+echo "==> re-zipping stapled app for distribution"
+rm -f "$ZIP"
+ditto -c -k --keepParent "$APP" "$ZIP"
+
+echo ""
+echo "✅ Done. Send this to your friend: $ZIP"
+echo "   (Stapled, so it works even offline. Send the .zip, not the raw .app —"
+echo "    zipping preserves the signature; AirDrop/Finder-copy of a bare .app can strip it.)"