@legendapp/spark 0.0.1-next.2 → 0.0.1-next.3

package/vendor/node_modules/@legendapp/spark-cli/dist/native-preparation.js

@@ -0,0 +1,88 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync } from "node:fs";
+import path from "node:path";
+import { stateFile } from "./project.js";
+export async function preserveMacOSPods(root, prepare) {
+    const native = path.join(root, "macos");
+    const cache = stateFile(root, "prebuild-cache/macos");
+    const entries = ["Pods", "Podfile.lock"];
+    function restore() {
+        for (const entry of entries) {
+            const saved = path.join(cache, entry);
+            const destination = path.join(native, entry);
+            if (!existsSync(saved))
+                continue;
+            if (existsSync(destination))
+                throw new Error(`Cannot restore CocoaPods cache: both ${saved} and ${destination} exist.`);
+            mkdirSync(native, { recursive: true });
+            renameSync(saved, destination);
+        }
+        rmSync(cache, { recursive: true, force: true });
+    }
+    // A terminated prebuild may leave the only copy of Pods in the cache.
+    restore();
+    try {
+        for (const entry of entries) {
+            const source = path.join(native, entry);
+            if (!existsSync(source))
+                continue;
+            mkdirSync(cache, { recursive: true });
+            renameSync(source, path.join(cache, entry));
+        }
+        await prepare();
+    }
+    finally {
+        restore();
+    }
+}
+export function preparationChanges(previous, current) {
+    if (!previous?.inputs)
+        return ["native preparation provenance missing"];
+    const reasons = [];
+    if (JSON.stringify(previous.inputs.config) !== JSON.stringify(current.inputs?.config)) {
+        const updatesChanged = JSON.stringify(previous.inputs.config.expo?.extra?.spark?.updates) !== JSON.stringify(current.inputs?.config.expo?.extra?.spark?.updates);
+        reasons.push(updatesChanged ? "native configuration changed (updater settings)" : "native configuration changed");
+    }
+    if (previous.inputs.plugin !== current.inputs?.plugin)
+        reasons.push("native host/config plugin changed");
+    const before = new Map(previous.inputs.packages.map(([name, root, contents]) => [name, { root, contents }]));
+    for (const [name, root, contents] of current.inputs?.packages ?? []) {
+        const prior = before.get(name);
+        if (!prior)
+            reasons.push(`${name} added`);
+        else {
+            if (prior.root !== root)
+                reasons.push(`${name} location changed`);
+            if (prior.contents !== contents)
+                reasons.push(`${name} preparation sources changed`);
+        }
+        before.delete(name);
+    }
+    for (const name of before.keys())
+        reasons.push(`${name} removed`);
+    return reasons.length ? reasons : previous.fingerprint !== current.fingerprint ? ["native preparation inputs changed"] : [];
+}
+export function missingNativeFrameworks(root) {
+    const pods = path.join(root, "macos/Pods");
+    const support = path.join(pods, "Target Support Files");
+    if (!existsSync(support))
+        return [support];
+    const missing = new Set();
+    for (const target of readdirSync(support)) {
+        const script = path.join(support, target, `${target}-xcframeworks.sh`);
+        if (!existsSync(script))
+            continue;
+        // CocoaPods lists only the frameworks and slices selected for this target.
+        for (const match of readFileSync(script, "utf8").matchAll(/^install_xcframework "([^"]+)" "[^"]+" "[^"]+" (.+)$/gm)) {
+            const framework = match[1].replaceAll("${PODS_ROOT}", pods).replaceAll("$(PODS_ROOT)", pods);
+            if (framework.includes("$"))
+                throw new Error(`Cannot resolve native framework input: ${framework}`);
+            if (!existsSync(path.join(framework, "Info.plist")))
+                missing.add(path.normalize(framework));
+            for (const slice of match[2].matchAll(/"([^"]+)"/g)) {
+                if (!existsSync(path.join(framework, slice[1])))
+                    missing.add(path.join(framework, slice[1]));
+            }
+        }
+    }
+    return [...missing];
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/notary-profiles.js

@@ -0,0 +1,75 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { run } from "./commands.js";
+import { stateFile } from "./project.js";
+// Security returns attributes only. Never request or print credential data.
+const discovery = String.raw `
+import Foundation
+import Security
+import LocalAuthentication
+
+struct KeychainError: Error { let status: OSStatus }
+func check(_ status: OSStatus) throws {
+    if status != errSecSuccess { throw KeychainError(status: status) }
+}
+func profiles(_ query: [CFString: Any]) throws -> [String] {
+    var result: CFTypeRef?
+    let status = SecItemCopyMatching(query as CFDictionary, &result)
+    var names: [String] = []
+    if status != errSecItemNotFound {
+        try check(status)
+        let prefix = "com.apple.gke.notary.tool.saved-creds."
+        for item in result as? [[String: Any]] ?? [] {
+            if let account = item[kSecAttrAccount as String] as? String, account.hasPrefix(prefix) {
+                let name = String(account.dropFirst(prefix.count))
+                if !name.isEmpty { names.append(name) }
+            }
+        }
+    }
+    return names
+}
+
+do {
+    let context = LAContext()
+    context.interactionNotAllowed = true
+    var query: [CFString: Any] = [
+        kSecClass: kSecClassGenericPassword,
+        kSecAttrLabel: "com.apple.gke.notary.tool",
+        kSecMatchLimit: kSecMatchLimitAll,
+        kSecReturnAttributes: true,
+        kSecReturnData: false,
+        kSecUseAuthenticationContext: context
+    ]
+    if CommandLine.arguments.count > 1 {
+        var keychain: SecKeychain?
+        try check(SecKeychainOpen(CommandLine.arguments[1], &keychain))
+        if let keychain { query[kSecMatchSearchList] = [keychain] }
+    }
+    var names = try profiles(query)
+    if CommandLine.arguments.count == 1 {
+        query[kSecUseDataProtectionKeychain] = true
+        query[kSecAttrSynchronizable] = kSecAttrSynchronizableAny
+        names += try profiles(query)
+    }
+    let data = try JSONSerialization.data(withJSONObject: Array(Set(names)).sorted())
+    print(String(decoding: data, as: UTF8.self))
+} catch {
+    let message: String
+    if let error = error as? KeychainError {
+        message = SecCopyErrorMessageString(error.status, nil) as String? ?? "OSStatus \(error.status)"
+    } else { message = String(describing: error) }
+    FileHandle.standardError.write(Data("Cannot list notarization Keychain profiles: \(message)\n".utf8))
+    exit(1)
+}
+`;
+export async function listNotaryProfiles(root, keychain, execute = run) {
+    const file = stateFile(root, "notary-profiles.swift");
+    mkdirSync(path.dirname(file), { recursive: true });
+    writeFileSync(file, discovery);
+    const output = await execute(root, ["xcrun", "swift", "-suppress-warnings", file, ...(keychain ? [keychain] : [])], { capture: true });
+    const profiles = JSON.parse(output);
+    if (!Array.isArray(profiles) || !profiles.every(profile => typeof profile === "string" && profile.length > 0)) {
+        throw new Error("Invalid notarization profile discovery result.");
+    }
+    return [...new Set(profiles)].sort();
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/package.js

@@ -69,16 +69,18 @@ async function packageUnlocked(root, options, deps) {
     if (config.extra?.spark?.updates && !result.runtime.modules["@legendapp/spark-updates"])
         throw new Error("Updates are configured but the module was pruned. Import @legendapp/spark/updates from the app entry.");
     const entitlements = distributionEntitlements(appEntitlements(root, result.runtime.modules));
+    if (!config.macos?.bundleIdentifier || !config.version)
+        throw new Error("Packaging requires macos.bundleIdentifier and version");
     const byPath = config.extra?.spark?.signing?.macos?.entitlementsByPath ?? {};
     const info = JSON.parse(await execute(root, ["plutil", "-convert", "json", "-o", "-", path.join(result.app, "Contents/Info.plist")], { capture: true }));
-    const expected = { runner: options.runner, bundleId: config.macos.bundleIdentifier, version: config.version, buildVersion: info.CFBundleVersion, entitlements, byPath };
+    const expected = { arch: result.runtime.arch, runner: options.runner, bundleId: config.macos.bundleIdentifier, version: config.version, buildVersion: info.CFBundleVersion, entitlements, byPath };
     if (!expected.bundleId || !expected.version || !expected.buildVersion)
         throw new Error("Bundle identifier and release version metadata must be configured before packaging.");
     const inputHash = artifactHash(result.app);
     const key = digest(JSON.stringify({ recipe: 1, inputHash, identity: identity.hash, entitlements, byPath }));
     const folder = stateFile(root, `packaging/${key}`);
     const app = path.join(folder, path.basename(result.app));
-    const safeName = `${config.slug ?? config.name}-${config.version}-arm64`.replace(/[^A-Za-z0-9._-]/g, "-");
+    const safeName = `${config.slug ?? config.name}-${config.version}-${result.runtime.arch}`.replace(/[^A-Za-z0-9._-]/g, "-");
     const upload = path.join(folder, `${safeName}-${key.slice(0, 16)}-notary.zip`);
     const statePath = path.join(folder, "state.json");
     mkdirSync(folder, { recursive: true });

package/vendor/node_modules/@legendapp/spark-cli/dist/platform.js

@@ -23,12 +23,26 @@ export function windowsArchitecture(host = process.platform, machineArch = machi
     }
     return "x64";
 }
-export const architecture = (platform) => platform === "windows" ? windowsArchitecture() : "arm64";
+export function macOSArchitecture(machineArch = machine(), env = process.env) {
+    const explicit = env.SPARK_MACOS_ARCH?.toLowerCase();
+    if (explicit !== undefined) {
+        if (explicit === "arm64" || explicit === "x64")
+            return explicit;
+        throw new Error("SPARK_MACOS_ARCH must be arm64 or x64.");
+    }
+    if (machineArch === "arm64" || machineArch === "aarch64")
+        return "arm64";
+    if (["x64", "x86_64"].includes(machineArch))
+        return "x64";
+    throw new Error(`Unsupported macOS architecture: ${machineArch}.`);
+}
+export const macOSXcodeArchitecture = (arch) => arch === "x64" ? "x86_64" : "arm64";
+export const architecture = (platform) => platform === "windows" ? windowsArchitecture() : macOSArchitecture();
 export function projectPlatform(root) {
     if (!["app.json", "desktop.config.json"].some(name => existsSync(path.join(root, name))))
         return "macos";
     const platforms = readConfig(root).expo?.platforms ?? ["macos"];
-    if (platforms.length !== 1 || !["macos", "windows"].includes(platforms[0]))
+    if (platforms.length !== 1 || (platforms[0] !== "macos" && platforms[0] !== "windows"))
         throw new Error("Select a desktop target with --platform macos or --platform windows.");
     return platforms[0];
 }

package/vendor/node_modules/@legendapp/spark-cli/dist/project.js

@@ -1,3 +1,4 @@
+import { nativeWindowOptions } from "@legendapp/spark-window-options";
 import { macOSReleaseSettings } from "./macos-release.js";
 import { projectPlatform, architecture } from "./platform.js";
 import { resolveHelpers } from "./helpers.js";
@@ -7,7 +8,7 @@ import { createHash } from "node:crypto";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync, renameSync, } from "node:fs";
 import path from "node:path";
-export const VERSION = "0.0.1-next.2";
+export const VERSION = "0.0.1-next.3";
 export function readJson(file) {
     return JSON.parse(readFileSync(file, "utf8"));
 }
@@ -38,13 +39,13 @@ export function entryFile(root) {
 }
 export function installedPackages(root) {
     const found = new Map();
-    const queue = [
-        { root, json: readJson(path.join(root, "package.json")), app: true },
-    ];
+    const manifest = readJson(path.join(root, "package.json"));
+    const appRequire = createRequire(path.join(root, "package.json"));
+    const queue = [{ root, json: manifest, app: true }];
     const visited = new Set();
     while (queue.length) {
         const current = queue.shift();
-        const req = createRequire(path.join(current.root, current.json.spark?.bundledModuleRoot ?? ".", "package.json"));
+        const contextualRequire = createRequire(path.join(current.root, current.json.spark?.bundledModuleRoot ?? ".", "package.json"));
         const bundled = current.json.spark?.bundledModules ?? current.json.bundledDependencies ?? current.json.bundleDependencies;
         const names = Object.keys({
             ...Object.fromEntries((Array.isArray(bundled) ? bundled : []).map(name => [name, true])),
@@ -57,6 +58,9 @@ export function installedPackages(root) {
                 .filter(([name]) => !current.json.peerDependenciesMeta?.[name]?.optional)),
         }).sort();
         for (const name of names) {
+            // Linked workspace packages resolve peers from their original checkout.
+            // Explicit app overrides must select the app's installed native copy.
+            const req = Object.hasOwn(manifest.overrides ?? {}, name) ? appRequire : contextualRequire;
             let file;
             try {
                 file = req.resolve(`${name}/package.json`);
@@ -64,11 +68,19 @@ export function installedPackages(root) {
             catch {
                 // Packages with exports hiding package.json still have an owning directory.
                 try {
-                    let dir = path.dirname(req.resolve(name));
-                    while ((!existsSync(path.join(dir, "package.json")) || typeof readJson(path.join(dir, "package.json")).name !== "string") &&
-                        dir !== path.dirname(dir))
-                        dir = path.dirname(dir);
-                    file = path.join(dir, "package.json");
+                    // Subpath-only packages (e.g. @legendapp/list/react-native) may
+                    // expose neither package.json nor a root entry. Inspect Node's
+                    // package search locations without requiring a public root export.
+                    const manifest = req.resolve.paths(name)?.map(base => path.join(base, name, "package.json"))
+                        .find(candidate => existsSync(candidate));
+                    if (manifest)
+                        file = manifest;
+                    else {
+                        let dir = path.dirname(req.resolve(name));
+                        while ((!existsSync(path.join(dir, "package.json")) || typeof readJson(path.join(dir, "package.json")).name !== "string") && dir !== path.dirname(dir))
+                            dir = path.dirname(dir);
+                        file = path.join(dir, "package.json");
+                    }
                 }
                 catch {
                     if (current.app &&
@@ -130,7 +142,8 @@ export function nativePackages(root) {
     // Fold it into the mandatory app module's compatibility signature for Go.
     const adapters = installed.filter(pkg => ["@legendapp/spark-desktop-host", "@legendapp/spark-desktop-config"].includes(pkg.name))
         .map(pkg => hashFiles(pkg.root, ["package.json", "AppDelegate.mm", ...readdirSync(pkg.root).filter(name => name.endsWith(".cjs"))])).join(":");
-    const excluded = isUniversal(root) ? readAppConfig(root).expo?.autolinking?.exclude ?? [] : [];
+    const excluded = ["app.json", "desktop.config.json"].some(file => existsSync(path.join(root, file)))
+        ? readAppConfig(root).expo?.autolinking?.exclude ?? [] : [];
     return installed.filter(pkg => !excluded.includes(pkg.name))
         .filter((pkg) => pkg.json.codegenConfig ||
         pkg.json.spark?.nativeModules ||
@@ -218,6 +231,43 @@ export function hostSourceSignature(root) {
         .filter(pkg => ["@legendapp/spark-desktop-host", "@legendapp/spark-desktop-config"].includes(pkg.name))
         .map(pkg => [pkg.name, hashFiles(pkg.root, ["package.json", "AppDelegate.mm", "windows", ...readdirSync(pkg.root).filter(file => file.endsWith(".cjs"))])])));
 }
+export function nativePreparationInputs(root, packages) {
+    return {
+        config: readAppConfig(root),
+        packages: packages.map((p) => [
+            p.name,
+            // CocoaPods records physical source paths, even for identical packages.
+            p.root,
+            hashFiles(p.root, [
+                "package.json",
+                p.json.codegenConfig?.jsSrcsDir ?? "src",
+                ...readdirSync(p.root).filter((name) => name.endsWith(".podspec")),
+            ]),
+        ]),
+        plugin: hostSourceSignature(root),
+    };
+}
+export function nativePreparationFingerprint(root, packages) {
+    return digest(JSON.stringify(nativePreparationInputs(root, packages)));
+}
+export function nativeProjectFingerprint(inputs, packages) {
+    return digest(JSON.stringify({
+        config: inputs.config,
+        plugin: inputs.plugin,
+        packages: packages.map(p => [p.name, p.root, hashFiles(p.root, ["package.json"])]),
+    }));
+}
+export function localSigningIdentity(root, mode) {
+    if (mode !== "dev")
+        return "-";
+    const file = stateFile(root, "settings.json");
+    const identity = existsSync(file) ? readJson(file).macOSDevelopmentIdentity : undefined;
+    if (identity === undefined)
+        return "-";
+    if (typeof identity !== "string" || !identity.trim() || identity.startsWith("-"))
+        throw new Error("macOSDevelopmentIdentity must name a signing certificate or its SHA-1 fingerprint");
+    return identity;
+}
 export function runtimeFor(root, packages, mode) {
     const platform = projectPlatform(root);
     const modules = Object.fromEntries(packages.map((p) => [p.name, p.signature]));
@@ -240,7 +290,10 @@ export function runtimeFor(root, packages, mode) {
         mode,
         modules,
         fingerprint: digest(JSON.stringify({
-            ...(platform === "windows" ? { arch: architecture(platform) } : {}),
+            arch: architecture(platform),
+            // Rebuild cached hosts generated before canonical plist restoration.
+            ...(platform === "macos" ? { nativeMetadataVersion: 1 } : {}),
+            ...(platform === "macos" && mode === "dev" ? { developmentIdentity: localSigningIdentity(root, mode) } : {}),
             ...(platform === "macos" && mode === "release" ? { releaseSettings: macOSReleaseSettings } : {}),
             modules,
             pins,
@@ -297,7 +350,7 @@ export function projectEnvironment(root) {
     if (typeof projectId !== "string" || !projectId.length || projectId.length > 200)
         throw new Error("Set extra.spark.projectId to a stable project identifier before launching the Spark Runner.");
     return {
-        SPARK_WINDOW_CONFIG: JSON.stringify(config.extra?.spark?.window ?? {}),
+        SPARK_WINDOW_CONFIG: JSON.stringify(nativeWindowOptions(config.extra?.spark?.window ?? {})),
         SPARK_PROJECT_ID: projectId,
         SPARK_PROJECT_NAME: typeof config.name === "string" ? config.name : path.basename(root),
         SPARK_PROJECT_VERSION: typeof config.version === "string" ? config.version : "0.0.0",

package/vendor/node_modules/@legendapp/spark-cli/dist/release.js

@@ -1,4 +1,5 @@
-import { existsSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeSync } from "node:fs";
 import path from "node:path";
 import { readJson, VERSION } from "./project.js";
 import { localArchive } from "./package-manager.js";
@@ -6,13 +7,15 @@ export const releaseBase = (version) => `https://github.com/LegendApp/legend-spa
 export function validateRelease(value) {
     if (value?.schema !== 1 || value.version !== VERSION || !/^[a-f0-9]{40}$/.test(value.revision) || !value.packages || !value.runners)
         throw new Error("Invalid or incompatible Spark release manifest");
+    if (Object.keys(value.packages).some(name => !/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(name)))
+        throw new Error("Invalid Spark package name");
     for (const asset of [...Object.values(value.packages), ...Object.values(value.runners)]) {
         const url = new URL(asset.url);
         if (url.href !== asset.url || !/^[A-Za-z0-9._-]+$/.test(url.pathname.split("/").at(-1) ?? "") || !asset.url.startsWith(releaseBase(VERSION) + "/") || url.search || url.hash || !/^[a-f0-9]{64}$/.test(asset.sha256) || !Number.isSafeInteger(asset.size) || asset.size <= 0)
             throw new Error("Invalid Spark release asset");
     }
     for (const [target, asset] of Object.entries(value.runners)) {
-        if (target !== "macos-arm64" || path.basename(asset.app) !== asset.app || !asset.app.endsWith(".app") || !/^[A-Z0-9]{10}$/.test(asset.teamId) || !/^[a-f0-9]+$/.test(asset.fingerprint))
+        if (!["macos-arm64", "macos-x64"].includes(target) || path.basename(asset.app) !== asset.app || !asset.app.endsWith(".app") || !/^[A-Z0-9]{10}$/.test(asset.teamId) || !/^[a-f0-9]+$/.test(asset.fingerprint))
             throw new Error("Invalid Runner release target");
     }
     return value;
@@ -21,7 +24,7 @@ export function installedRelease() {
     const file = path.join(import.meta.dirname, "release.json");
     return existsSync(file) ? validateRelease(readJson(file)) : undefined;
 }
-/** Registry versions and immutable HTTPS archives survive project moves and clones. */
+/** Local SDK archives keep their manifest-relative paths; release archives become portable project-relative files. */
 export function packageSources(manifest, release = installedRelease()) {
     let sources;
     if (manifest) {
@@ -36,7 +39,84 @@ export function packageSources(manifest, release = installedRelease()) {
         if (!release)
             throw new Error("This SDK has no published release metadata. Pack or register a local SDK first.");
         validateRelease(release);
-        sources = { ...Object.fromEntries(Object.entries(release.packages).map(([name, asset]) => [name, asset.url])), "@legendapp/spark": VERSION };
+        sources = { ...Object.fromEntries(Object.entries(release.packages).map(([name, asset]) => [name, `file:./spark-packages/${packageArchiveName(name, asset)}`])), "@legendapp/spark": VERSION };
     }
     return sources;
 }
+function packageArchiveName(name, asset) {
+    return `${name.replace(/^@/, "").replaceAll("/", "-")}-${asset.sha256}.tgz`;
+}
+/** Download and verify release bytes before installing; relative vendored files survive moves and ordinary clones. */
+export async function materializeReleasePackages(release, projectRoot, fetcher = fetch) {
+    validateRelease(release);
+    const directory = path.join(projectRoot, "spark-packages");
+    mkdirSync(directory, { recursive: true });
+    const pending = Object.entries(release.packages).map(([name, asset]) => ({ name, asset, file: path.join(directory, packageArchiveName(name, asset)) }));
+    for (const { name, asset, file } of pending) {
+        if (!existsSync(file))
+            continue;
+        const bytes = readFileSync(file);
+        if (bytes.length !== asset.size || createHash("sha256").update(bytes).digest("hex") !== asset.sha256)
+            throw new Error(`Existing verified Spark package archive is corrupt: ${name}`);
+    }
+    for (const { name, asset, file } of pending) {
+        if (existsSync(file))
+            continue;
+        const response = await fetcher(asset.url, { signal: AbortSignal.timeout(120_000) });
+        if (!response.ok)
+            throw new Error(`Download Spark package ${name}: HTTP ${response.status}`);
+        const temporary = `${file}.tmp-${process.pid}-${randomUUID()}`;
+        const fd = openSync(temporary, "wx");
+        const hash = createHash("sha256");
+        let size = 0;
+        let open = true;
+        try {
+            if (!response.body)
+                throw new Error(`Download Spark package ${name}: response has no body`);
+            const reader = response.body.getReader();
+            try {
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    size += value.byteLength;
+                    if (size > asset.size) {
+                        await reader.cancel();
+                        throw new Error(`Spark package archive exceeds its declared size: ${name}`);
+                    }
+                    hash.update(value);
+                    let offset = 0;
+                    while (offset < value.byteLength)
+                        offset += writeSync(fd, value, offset, value.byteLength - offset);
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+            if (size !== asset.size || hash.digest("hex") !== asset.sha256)
+                throw new Error(`Spark package archive checksum or size mismatch: ${name}`);
+            closeSync(fd);
+            open = false;
+            renameSync(temporary, file);
+        }
+        catch (error) {
+            if (open)
+                closeSync(fd);
+            rmSync(temporary, { force: true });
+            throw error;
+        }
+    }
+}
+/** Recheck vendored bytes immediately before a package manager can run lifecycle scripts. */
+export function verifyMaterializedReleasePackages(release, projectRoot) {
+    validateRelease(release);
+    const directory = path.join(projectRoot, "spark-packages");
+    for (const [name, asset] of Object.entries(release.packages)) {
+        const file = path.join(directory, packageArchiveName(name, asset));
+        if (!existsSync(file))
+            throw new Error(`Verified Spark package archive is missing: ${name}`);
+        const bytes = readFileSync(file);
+        if (bytes.length !== asset.size || createHash("sha256").update(bytes).digest("hex") !== asset.sha256)
+            throw new Error(`Verified Spark package archive changed before installation: ${name}`);
+    }
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/release.json

@@ -1,37 +1,42 @@
 {
   "schema": 1,
-  "version": "0.0.1-next.2",
-  "revision": "6359fee375c5b0549b43f339d4e856db4bcb7c98",
+  "version": "0.0.1-next.3",
+  "revision": "5aa7d342e3901b13b3947e61f0115e110857e940",
   "packages": {
     "@react-native-runtimes/core": {
-      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.2/runtimes-31ac67156c18.tgz",
-      "size": 53885,
-      "sha256": "a8e532d0a1e8d7c23953e94612d58f0e660a685e58645075c5180304c8462515"
+      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.3/runtimes-a216ebc90023.tgz",
+      "size": 53886,
+      "sha256": "acf7330c6e4ba50c5d81dc8459ef4195cd5220245d49bbedf44dd7d241d6e804"
     },
     "react-native-nitro-modules": {
-      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.2/react-native-nitro-modules-0.35.7-7c494d2176d7.tgz",
-      "size": 138548,
-      "sha256": "7c494d2176d7f144ee5d518fd8c03b24f29c22bba520b7cebd71ba7d60cb56d3"
+      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.3/react-native-nitro-modules-0.35.7-e26b0b759292.tgz",
+      "size": 138698,
+      "sha256": "e26b0b7592929d779a488623dbe936a37d3cd169228af8207d05faf65e452c17"
     },
     "@op-engineering/op-sqlite": {
-      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.2/op-engineering-op-sqlite-18.2.1-ebd60a4eb0d4.tgz",
-      "size": 115455003,
-      "sha256": "ebd60a4eb0d4a0a2d48c7ca455cf3668879ff64a258bed108c2393d53679cf3c"
+      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.3/op-engineering-op-sqlite-18.2.1-d347b5859c8e.tgz",
+      "size": 112508638,
+      "sha256": "d347b5859c8ede8f13a1195b62d84129d3c519ddb983c5af241953841fb2ce4a"
     },
     "react-native-webview": {
-      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.2/react-native-webview-16.0.0-33882a035641.tgz",
-      "size": 116112,
-      "sha256": "33882a03564141b8b5c56cc7e99e0d425f3a53b59db966d9412bb85ef6f0abf3"
+      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.3/react-native-webview-16.0.0-3b95dfeffdd6.tgz",
+      "size": 116287,
+      "sha256": "3b95dfeffdd6d5a12179b367c846dfdca4fa95421ba1fa9c5e20617bc89b82fc"
+    },
+    "expo-audio": {
+      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.3/expo-audio-1.1.1-226962e4b7a3.tgz",
+      "size": 381077,
+      "sha256": "226962e4b7a36596e859524104037f35d33b25ff2f675c88b54f222677ca916b"
     }
   },
   "runners": {
     "macos-arm64": {
-      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.2/spark-runner-macos-arm64.zip",
-      "size": 12455131,
-      "sha256": "77635060c84c536d67af10496e21a65fb57f279a7f165d362f1ca81829c95e69",
+      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.3/spark-runner-macos-arm64.zip",
+      "size": 13043465,
+      "sha256": "a33a4adf683579e18b05b16d680ece0c664403bdcd2f846fdb955b5d2fe3f7d8",
       "app": "SparkRunner.app",
       "teamId": "56DD97VT22",
-      "fingerprint": "fef5859c9685b017d0132277f593c732512dec23b2c57bc6c53ce695e821406d"
+      "fingerprint": "6925832e8790b3253cb7509aacc5978ee90da2e15b884492624b1b43945291f5"
     }
   }
 }