@legendapp/spark 0.0.1-next.2

package/vendor/node_modules/@legendapp/spark-cli/dist/local.js

@@ -0,0 +1,124 @@
+import { installedRelease } from "./release.js";
+import { architecture } from "./platform.js";
+import { existsSync, readdirSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createServer } from "node:net";
+import { digest, incompatible, readJson, VERSION, writeJson } from "./project.js";
+export function sparkHome() {
+    return path.resolve(process.env.SPARK_HOME ?? path.join(os.homedir(), ".spark"));
+}
+export function findFramework(start = import.meta.dirname) {
+    let dir = path.resolve(start);
+    while (true) {
+        const pkg = path.join(dir, "package.json");
+        if (existsSync(pkg) && readJson(pkg).name === "spark-workspace")
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+export function findProject(start) {
+    let dir = path.resolve(start);
+    while (true) {
+        if ((existsSync(path.join(dir, "app.json")) || existsSync(path.join(dir, "desktop.config.json"))) && existsSync(path.join(dir, "package.json")))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            throw new Error("No spark app found. Run this command inside your app, or create one with spark create MyApp.");
+        dir = parent;
+    }
+}
+export function readRuntime(app) {
+    try {
+        const windows = existsSync(path.join(app, "spark-runtime.json"));
+        const runtime = readJson(path.join(app, windows ? "spark-runtime.json" : "Contents/Resources/spark-runtime.json"));
+        if (runtime.schema !== 1 || runtime.framework !== VERSION || !["macos", "windows"].includes(runtime.platform) || !(runtime.platform === "windows" ? ["arm64", "x64"] : ["arm64"]).includes(runtime.arch) || !runtime.modules || typeof runtime.modules !== "object" || typeof runtime.fingerprint !== "string")
+            return undefined;
+        if (!existsSync(path.join(app, windows ? "MyApp.exe" : "Contents/MacOS")) || windows !== (runtime.platform === "windows"))
+            return undefined;
+        return runtime;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function registerRuntime(app) {
+    app = path.resolve(app);
+    const runtime = readRuntime(app);
+    if (!runtime || runtime.mode !== "go")
+        throw new Error(`Not a compatible Spark Runner: ${app}`);
+    // One record per path preserves multiple local builds of the same SDK.
+    writeJson(path.join(sparkHome(), "runtimes", `${digest(app)}.json`), { app });
+    return { app, runtime };
+}
+export function registerPackages(manifest) {
+    manifest = path.resolve(manifest);
+    const archives = readJson(manifest);
+    for (const name of ["@legendapp/spark"]) {
+        if (typeof archives[name] !== "string" || !existsSync(path.resolve(path.dirname(manifest), archives[name]))) {
+            throw new Error(`Missing local archive for ${name}. Run spark sdk pack in the framework checkout.`);
+        }
+    }
+    writeJson(path.join(sparkHome(), "sdks", `${VERSION}.json`), { manifest });
+    for (const name of ["SparkRunner.app", "SparkPrebuilt.app"]) {
+        const savedRunner = path.resolve(path.dirname(manifest), "../runtimes", name);
+        if (readRuntime(savedRunner)?.mode === "go")
+            registerRuntime(savedRunner);
+    }
+    return manifest;
+}
+export function creationManifest(explicit) {
+    return !explicit && installedRelease() ? undefined : packageManifest(explicit);
+}
+export function packageManifest(explicit) {
+    if (explicit)
+        return registerPackages(explicit);
+    const framework = findFramework(process.cwd()) ?? findFramework();
+    if (framework) {
+        const manifest = path.join(framework, "artifacts/packages/manifest.json");
+        if (existsSync(manifest))
+            return registerPackages(manifest);
+        throw new Error("Local SDK packages have not been packed. Run spark sdk pack, then retry.");
+    }
+    const record = path.join(sparkHome(), "sdks", `${VERSION}.json`);
+    if (existsSync(record))
+        return registerPackages(readJson(record).manifest);
+    throw new Error(`No local SDK ${VERSION} is registered. Run spark sdk pack in the framework checkout. Public SDK downloads are not available yet.`);
+}
+export function findGo(required, preferred, platform = "macos") {
+    const apps = preferred ? [path.resolve(preferred)] : [];
+    const dir = path.join(sparkHome(), "runtimes");
+    if (existsSync(dir))
+        for (const file of readdirSync(dir).filter((f) => f.endsWith(".json")).sort()) {
+            try {
+                const record = readJson(path.join(dir, file));
+                if (typeof record.app === "string")
+                    apps.push(record.app);
+            }
+            catch { /* Ignore stale/corrupt registry entries; never launch without validation. */ }
+        }
+    const candidates = [...new Set(apps)].flatMap((app) => {
+        const runtime = readRuntime(app);
+        return runtime?.mode === "go" && runtime.platform === platform && runtime.arch === architecture(platform) ? [{ app, runtime }] : [];
+    });
+    return candidates.find(({ runtime }) => incompatible(runtime, required, platform).length === 0) ?? candidates[0];
+}
+export async function availablePort(explicit) {
+    if (explicit !== undefined && (!Number.isInteger(explicit) || explicit < 1 || explicit > 65535))
+        throw new Error("Port must be an integer between 1 and 65535.");
+    for (let port = explicit ?? 19120; port < (explicit === undefined ? 19220 : explicit + 1); port++) {
+        const free = await new Promise((resolve, reject) => {
+            const server = createServer();
+            server.once("error", (error) => error.code === "EADDRINUSE" ? resolve(false) : reject(error));
+            // Match Metro's wildcard bind. On macOS a loopback-only bind can succeed
+            // even while another process owns the wildcard IPv6 listener.
+            server.listen(port, () => server.close(() => resolve(true)));
+        });
+        if (free)
+            return port;
+    }
+    throw new Error(explicit ? `Port ${explicit} is already in use. Omit --port to choose one automatically.` : "No development port is available between 19120 and 19219.");
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/macos-release.js

@@ -0,0 +1,7 @@
+// Shared by the compiler invocation and runtime cache fingerprint.
+export const macOSReleaseSettings = [
+    "DEPLOYMENT_POSTPROCESSING=YES",
+    "DEAD_CODE_STRIPPING=YES",
+    "LLVM_LTO=YES_THIN",
+    "GCC_OPTIMIZATION_LEVEL=z",
+];

package/vendor/node_modules/@legendapp/spark-cli/dist/metro-gate.cjs

@@ -0,0 +1,33 @@
+const fs = require("node:fs");
+const { statePath, supportedPlatforms } = require("@legendapp/spark-desktop-config/config.cjs");
+// Builds/export operate independently. Only a managed live session enables this gate.
+exports.gate = (root, middleware) => (req, res, next) => {
+  if (/\.(bundle|delta)(\?|$)/.test(req.url || "")) {
+    const platform = new URL(req.url, "http://localhost").searchParams.get("platform");
+    // Mobile and web never depend on the desktop binary's native module set.
+    if (platform && !["macos", "windows"].includes(platform)) return middleware(req, res, next);
+    if (platform && !supportedPlatforms(root).includes(platform)) return middleware(req, res, next);
+    const file = statePath(root, "session.json", platform ?? undefined);
+    if (fs.existsSync(file)) {
+      let session;
+      try {
+        session = JSON.parse(fs.readFileSync(file, "utf8"));
+      } catch {
+        res.statusCode = 503;
+        res.end(
+          "spark: runtime compatibility is being checked. Retry in a moment.",
+        );
+        return;
+      }
+      if (session && !session.compatible) {
+        res.statusCode = 409;
+        res.end(
+          "spark: custom development build required. Press g to switch desktop runtime or b to build in the development terminal. " +
+            (session.reason || ""),
+        );
+        return;
+      }
+    }
+  }
+  return middleware(req, res, next);
+};

package/vendor/node_modules/@legendapp/spark-cli/dist/metro.cjs

@@ -0,0 +1,63 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { gate } = require("./metro-gate.cjs");
+const ENTRY = "@legendapp/spark/runtime-entry";
+
+// Production discovery omits the registry: otherwise scanning an unused task
+// would itself make that task (and all its native dependencies) reachable.
+function runtimePlan(root, env = process.env) {
+  if (env.SPARK_RUNTIME_DISCOVERY === "1") return { enabled: false, roots: [] };
+  if (env.SPARK_RUNTIME_SOURCES) {
+    const sources = JSON.parse(fs.readFileSync(env.SPARK_RUNTIME_SOURCES, "utf8"));
+    return { enabled: sources.enabled, roots: sources.roots, production: true };
+  }
+  return { enabled: true, roots: fs.readdirSync(root, { withFileTypes: true })
+    .filter(e => e.isFile() && /\.[jt]sx?$/.test(e.name) && !/^(metro|babel|react-native)\.config\./.test(e.name))
+    .map(e => e.name).concat(["src"]) };
+}
+function withDesktop(config, options = {}) {
+  // Expo 54 sets the react-native export condition only for iOS/Android.
+  // Desktop must also select native package exports (e.g. Uniwind's runtime).
+  const conditions = { ...config.resolver?.unstable_conditionsByPlatform };
+  for (const platform of ["macos", "windows"]) {
+    conditions[platform] = [...new Set([...(conditions[platform] || []), "react-native"])];
+  }
+  config = { ...config, resolver: { ...config.resolver, unstable_conditionsByPlatform: conditions } };
+  const root = path.resolve(config.projectRoot || process.cwd());
+  // Prebuilt hosts request /index.bundle and /.threaded-runtime/entry.bundle.
+  // Keep those URLs relative to the app inside a monorepo; Expo still discovers
+  // workspace watch folders and package dependencies.
+  config = { ...config, server: { ...config.server, unstable_serverRoot: root } };
+  let core;
+  try { core = require.resolve("@react-native-runtimes/core/metro", { paths: [root] }); } catch {}
+  if (!core || options.runtimes === false) {
+    const enhance = config.server?.enhanceMiddleware;
+    return { ...config, server: { ...config.server, enhanceMiddleware(middleware, server) {
+      return gate(root, enhance ? enhance(middleware, server) : middleware);
+    } } };
+  }
+  const { withThreadedRuntime, generateThreadedRuntimeEntry } = require(core);
+  const plan = runtimePlan(root);
+  const generatedEntry = path.join(root, ".threaded-runtime/entry.js");
+  if (plan.enabled) {
+    config = withThreadedRuntime(config, { ...options, roots: plan.roots, watch: plan.production ? false : options.watch });
+    // Production roots come from Metro's resolved graph, including worker files
+    // shipped by dependencies. Do not register unrelated index.<name>.ts files.
+    if (plan.production) generateThreadedRuntimeEntry({ projectRoot: root, generatedEntry, roots: plan.roots, runtimeEntries: [] });
+  } else {
+    config = { ...config, transformer: { ...config.transformer,
+      babelTransformerPath: path.join(path.dirname(core), "metro-transformer.js") } };
+  }
+  const resolveRequest = config.resolver?.resolveRequest;
+  const enhanceMiddleware = config.server?.enhanceMiddleware;
+  return { ...config,
+    resolver: { ...config.resolver, resolveRequest(context, name, platform) {
+      if (name === ENTRY || name === "@legendapp/spark-cli/src/runtime-entry.cjs") return { type: "sourceFile", filePath: plan.enabled ? generatedEntry : path.join(__dirname, "runtime-entry.cjs") };
+      return resolveRequest ? resolveRequest(context, name, platform) : context.resolveRequest(context, name, platform);
+    } },
+    server: { ...config.server, enhanceMiddleware(middleware, server) {
+      return gate(root, enhanceMiddleware ? enhanceMiddleware(middleware, server) : middleware);
+    } },
+  };
+}
+module.exports = { withDesktop, runtimePlan };

package/vendor/node_modules/@legendapp/spark-cli/dist/metro.js

@@ -0,0 +1,25 @@
+import WebSocket from "ws";
+// React Native packager message protocol v2, shared by Expo's Metro server.
+export function reload(port) {
+    return new Promise((resolve, reject) => {
+        const socket = new WebSocket(`ws://127.0.0.1:${port}/message`, {
+            headers: { Origin: `http://127.0.0.1:${port}` },
+        });
+        const timeout = setTimeout(() => {
+            socket.close();
+            reject(new Error("Metro reload timed out."));
+        }, 3000);
+        socket.onopen = () => socket.send(JSON.stringify({ version: 2, method: "reload" }));
+        socket.onmessage = (event) => {
+            if (JSON.parse(String(event.data)).method === "reload") {
+                clearTimeout(timeout);
+                socket.close();
+                resolve();
+            }
+        };
+        socket.onerror = () => {
+            clearTimeout(timeout);
+            reject(new Error("Cannot connect to Metro's reload endpoint."));
+        };
+    });
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/npm-bin/npm

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+// npm 11's CLI; avoid installer-specific shell wrappers and global npm versions.
+import { createRequire } from 'node:module';
+import path from 'node:path';
+const require = createRequire(import.meta.url);
+require(path.join(path.dirname(require.resolve('npm/package.json')), 'bin/npm-cli.js'));

package/vendor/node_modules/@legendapp/spark-cli/dist/npm-bin/npm.cmd

@@ -0,0 +1 @@
+@node "%~dp0npm" %*

package/vendor/node_modules/@legendapp/spark-cli/dist/pack-archive.js

@@ -0,0 +1,23 @@
+import { createRequire } from "node:module";
+import { mkdirSync, mkdtempSync, renameSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnProcess } from "./process.js";
+/** npm is pinned tooling for tarball format, independently of the app's installer. */
+export async function packArchive(directory, destination) {
+    const req = createRequire(import.meta.url);
+    const npm = path.join(path.dirname(req.resolve("npm/package.json")), "bin/npm-cli.js");
+    const temporary = mkdtempSync(path.join(os.tmpdir(), "spark-pack-"));
+    try {
+        const child = spawnProcess([process.execPath, npm, "pack", "--json", "--ignore-scripts", "--cache", path.join(temporary, "cache"), "--pack-destination", temporary], { cwd: directory });
+        const [stdout, stderr, code] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+        if (code)
+            throw new Error(`Could not pack ${directory}: ${stderr}\n${stdout}`);
+        const [result] = JSON.parse(stdout);
+        mkdirSync(path.dirname(destination), { recursive: true });
+        renameSync(path.join(temporary, result.filename), destination);
+    }
+    finally {
+        rmSync(temporary, { recursive: true, force: true });
+    }
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/package-manager.js

@@ -0,0 +1,45 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { which } from "./executable.js";
+export const managers = ["npm", "pnpm", "yarn", "bun"];
+export function packageManager(root, explicit, env = process.env) {
+    const file = path.join(root, "package.json");
+    const pkg = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {};
+    const declared = explicit ?? pkg.packageManager?.split("@")[0];
+    let selected = declared;
+    if (!selected) {
+        const locks = { npm: ["package-lock.json", "npm-shrinkwrap.json"], pnpm: ["pnpm-lock.yaml"], yarn: ["yarn.lock"], bun: ["bun.lock", "bun.lockb"] };
+        const found = managers.filter(manager => locks[manager].some(lock => existsSync(path.join(root, lock))));
+        if (found.length > 1)
+            throw new Error("Set packageManager in package.json or pass --package-manager to choose between the existing lockfiles.");
+        const agent = env.npm_config_user_agent?.split("/")[0];
+        selected = found[0] ?? (managers.includes(agent) ? agent : undefined) ?? managers.find(manager => which(manager, env));
+    }
+    if (!managers.includes(selected))
+        throw new Error(`Unsupported or unavailable package manager: ${selected ?? "none"}. Install npm, pnpm, Yarn, or Bun.`);
+    if (!which(selected, env) && !(env.npm_execpath && env.npm_config_user_agent?.startsWith(selected + "/")))
+        throw new Error(`This project uses ${selected}, but it is not installed. Install it or choose --package-manager explicitly.`);
+    return selected;
+}
+export function managerCommand(manager, args, env = process.env) {
+    // npm run / pnpm exec / Corepack expose their actual JS entry point. Using it
+    // preserves the caller's version and avoids platform-specific shell shims.
+    const entry = env.npm_execpath;
+    return entry && env.npm_config_user_agent?.startsWith(`${manager}/`) && /\.[cm]?js$/.test(entry)
+        ? [process.execPath, entry, ...args]
+        : [manager, ...args];
+}
+export function applyOverrides(pkg, overrides, manager) {
+    const existing = { ...pkg.overrides, ...pkg.resolutions, ...pkg.pnpm?.overrides };
+    delete pkg.overrides;
+    delete pkg.resolutions;
+    if (pkg.pnpm)
+        delete pkg.pnpm.overrides;
+    if (manager === "pnpm")
+        pkg.pnpm = { ...pkg.pnpm, overrides: { ...existing, ...overrides } };
+    else if (manager === "yarn")
+        pkg.resolutions = { ...existing, ...overrides };
+    else
+        pkg.overrides = { ...existing, ...overrides };
+}
+export function localArchive(file) { return `file:${path.resolve(file).replaceAll("\\", "/")}`; }

package/vendor/node_modules/@legendapp/spark-cli/dist/package.js

@@ -0,0 +1,199 @@
+import { setTimeout as sleep } from "node:timers/promises";
+import { readAppConfig } from "./project.js";
+import { prepareUpdate } from "./updates.js";
+import { createHash } from "node:crypto";
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, readlinkSync, lstatSync, rmSync, renameSync, openSync, closeSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { build } from "./build.js";
+import { credentials, notaryAuth } from "./credentials.js";
+import { run } from "./commands.js";
+import { appEntitlements, distributionEntitlements, signApp, validateApp } from "./signing.js";
+import { digest, readJson, stateFile, writeJson } from "./project.js";
+export function artifactHash(file) {
+    const hash = createHash("sha256");
+    function visit(current) {
+        const stat = lstatSync(current);
+        hash.update(path.relative(file, current)).update(`:${stat.mode & 0o777}:`);
+        if (stat.isSymbolicLink())
+            hash.update(`link:${readlinkSync(current)}`);
+        else if (stat.isDirectory())
+            for (const name of readdirSync(current).sort())
+                visit(path.join(current, name));
+        else
+            hash.update(readFileSync(current));
+    }
+    visit(file);
+    return hash.digest("hex");
+}
+const defaults = { run, build, credentials, wait: (ms) => sleep(ms) };
+export async function packageApp(root, options = {}, dependencies = defaults) {
+    if (options.submissionId && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(options.submissionId))
+        throw new Error("Submission ID must be a UUID returned by Apple.");
+    mkdirSync(stateFile(root, "packaging"), { recursive: true });
+    const lock = stateFile(root, "package.lock");
+    try {
+        const fd = openSync(lock, "wx");
+        writeFileSync(fd, String(process.pid));
+        closeSync(fd);
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        const pid = Number(readFileSync(lock, "utf8"));
+        if (Number.isInteger(pid) && pid > 0) {
+            try {
+                process.kill(pid, 0);
+            }
+            catch (check) {
+                if (check.code === "ESRCH") {
+                    rmSync(lock);
+                    return packageApp(root, options, dependencies);
+                }
+            }
+        }
+        throw new Error(`Another packaging run owns this app (${lock}). Wait for it to finish; check the recorded PID before removing a stale lock.`);
+    }
+    try {
+        return await packageUnlocked(root, options, dependencies);
+    }
+    finally {
+        rmSync(lock, { force: true });
+    }
+}
+async function packageUnlocked(root, options, deps) {
+    const execute = deps.run;
+    const identity = await deps.credentials(root);
+    console.log(`Signing identity: ${identity.name}`);
+    const result = await deps.build(root, options.runner ? "go" : "release", options.force);
+    const config = readAppConfig(root).expo;
+    if (config.extra?.spark?.updates && !result.runtime.modules["@legendapp/spark-updates"])
+        throw new Error("Updates are configured but the module was pruned. Import @legendapp/spark/updates from the app entry.");
+    const entitlements = distributionEntitlements(appEntitlements(root, result.runtime.modules));
+    const byPath = config.extra?.spark?.signing?.macos?.entitlementsByPath ?? {};
+    const info = JSON.parse(await execute(root, ["plutil", "-convert", "json", "-o", "-", path.join(result.app, "Contents/Info.plist")], { capture: true }));
+    const expected = { runner: options.runner, bundleId: config.macos.bundleIdentifier, version: config.version, buildVersion: info.CFBundleVersion, entitlements, byPath };
+    if (!expected.bundleId || !expected.version || !expected.buildVersion)
+        throw new Error("Bundle identifier and release version metadata must be configured before packaging.");
+    const inputHash = artifactHash(result.app);
+    const key = digest(JSON.stringify({ recipe: 1, inputHash, identity: identity.hash, entitlements, byPath }));
+    const folder = stateFile(root, `packaging/${key}`);
+    const app = path.join(folder, path.basename(result.app));
+    const safeName = `${config.slug ?? config.name}-${config.version}-arm64`.replace(/[^A-Za-z0-9._-]/g, "-");
+    const upload = path.join(folder, `${safeName}-${key.slice(0, 16)}-notary.zip`);
+    const statePath = path.join(folder, "state.json");
+    mkdirSync(folder, { recursive: true });
+    let state;
+    if (existsSync(statePath)) {
+        state = readJson(statePath);
+        if (!existsSync(app) || artifactHash(app) !== state.stagedHash || !existsSync(upload) || createHash("sha256").update(readFileSync(upload)).digest("hex") !== state.archiveHash) {
+            throw new Error(`The staged notarization artifacts changed. Preserve ${statePath} for submission recovery; rebuild from clean inputs before retrying.`);
+        }
+    }
+    else {
+        rmSync(app, { recursive: true, force: true });
+        cpSync(result.app, app, { recursive: true, verbatimSymlinks: true });
+        if (artifactHash(app) !== inputHash)
+            throw new Error("The release app changed while copying it. Retry packaging after the other build finishes.");
+        await signApp(root, app, identity, entitlements, byPath, execute);
+        await validateApp(root, app, identity, expected, false, execute);
+        console.log("✓ Release app signed and verified");
+        await execute(root, ["ditto", "-c", "-k", "--sequesterRsrc", "--keepParent", app, upload], { capture: true });
+        state = { phase: "signed", stagedHash: artifactHash(app), archiveHash: createHash("sha256").update(readFileSync(upload)).digest("hex") };
+        writeJson(statePath, state);
+    }
+    // Reuse the exact verified distribution bytes on retries, including when feed
+    // signing failed after notarization. Re-stapling could change the archive.
+    if (state.phase === "complete" && state.output && state.outputHash && existsSync(state.output)) {
+        if (createHash("sha256").update(readFileSync(state.output)).digest("hex") !== state.outputHash)
+            throw new Error("The completed distribution archive changed. Restore it or package a new build number.");
+        const update = await (options.runner ? Promise.resolve(undefined) : (deps.prepareUpdate ?? prepareUpdate)(root, state.output, String(expected.buildVersion)));
+        console.log(`Ready: ${state.output}`);
+        return { pending: false, output: state.output, update, submissionId: state.submissionId };
+    }
+    const notary = async (command, ...args) => JSON.parse(await execute(root, ["xcrun", "notarytool", command, ...args, ...notaryAuth(identity), "--output-format", "json"], { capture: true }));
+    if (options.submissionId) {
+        if (state.submissionId && state.submissionId !== options.submissionId)
+            throw new Error("This artifact already has a different notarization submission ID.");
+        const recovered = await notary("info", options.submissionId);
+        if (recovered.id !== options.submissionId || recovered.name !== path.basename(upload))
+            throw new Error("That notarization submission does not match this upload filename.");
+        state.submissionId = options.submissionId;
+        state.phase = "submitted";
+        writeJson(statePath, state);
+    }
+    if (!state.submissionId) {
+        if (state.phase !== "signed")
+            throw new Error("The previous notarization submission has an unknown outcome. Find its ID using notarytool history, then run spark package --submission-id <id>. spark will not submit it twice automatically.");
+        state.phase = "submitting";
+        writeJson(statePath, state);
+        console.log("Submitting the signed app to Apple for notarization…");
+        const submitted = await notary("submit", upload, "--no-wait");
+        if (typeof submitted.id !== "string" || !/^[0-9a-f-]{36}$/i.test(submitted.id))
+            throw new Error("Apple did not return a valid submission ID. Run spark package again for recovery instructions.");
+        state.submissionId = submitted.id;
+        state.phase = "submitted";
+        writeJson(statePath, state);
+    }
+    const submissionId = state.submissionId;
+    if (!submissionId || !/^[0-9a-f-]{36}$/i.test(submissionId))
+        throw new Error("Invalid saved notarization submission ID.");
+    const deadline = Date.now() + (options.waitMs ?? 120_000);
+    while (true) {
+        const response = await notary("info", submissionId);
+        if (response.status === "Accepted")
+            break;
+        if (response.status !== "In Progress") {
+            const log = await notary("log", submissionId);
+            writeJson(path.join(folder, "notary-log.json"), log);
+            throw new Error(`Notarization ${response.status}. See ${path.join(folder, "notary-log.json")}. Fix the reported issues and package a new build.`);
+        }
+        console.log(`Apple is processing submission ${state.submissionId}…`);
+        if (Date.now() >= deadline) {
+            console.log("Notarization is still pending. Run spark package again to resume; the app will not be rebuilt or resubmitted if its inputs are unchanged.");
+            return { pending: true, submissionId: state.submissionId };
+        }
+        await deps.wait(Math.min(15_000, Math.max(0, deadline - Date.now())));
+    }
+    const log = await notary("log", submissionId);
+    writeJson(path.join(folder, "notary-log.json"), log);
+    if (log.sha256?.toLowerCase() !== state.archiveHash)
+        throw new Error("Apple’s notarization log does not match the uploaded archive hash.");
+    state.phase = "accepted";
+    writeJson(statePath, state);
+    console.log("✓ Notarization accepted");
+    // Keep the submitted artifact immutable. An interrupted staple/validation run
+    // can recreate this final copy without losing its accepted submission.
+    const finalApp = path.join(folder, "final", path.basename(app));
+    rmSync(path.dirname(finalApp), { recursive: true, force: true });
+    mkdirSync(path.dirname(finalApp), { recursive: true });
+    cpSync(app, finalApp, { recursive: true, verbatimSymlinks: true });
+    await execute(root, ["xcrun", "stapler", "staple", finalApp], { capture: true });
+    await validateApp(root, finalApp, identity, expected, true, execute);
+    const archive = path.join(folder, `${safeName}.zip`);
+    await execute(root, ["ditto", "-c", "-k", "--sequesterRsrc", "--keepParent", finalApp, archive], { capture: true });
+    const extracted = path.join(folder, "verify-archive");
+    rmSync(extracted, { recursive: true, force: true });
+    mkdirSync(extracted, { recursive: true });
+    try {
+        await execute(root, ["ditto", "-x", "-k", archive, extracted], { capture: true });
+        const entries = readdirSync(extracted).filter((name) => name !== "__MACOSX");
+        if (entries.length !== 1 || !entries[0].endsWith(".app"))
+            throw new Error("Distribution archive must contain exactly one app.");
+        await validateApp(root, path.join(extracted, entries[0]), identity, expected, true, execute);
+    }
+    finally {
+        rmSync(extracted, { recursive: true, force: true });
+    }
+    const output = path.join(root, "dist", `${safeName}.zip`);
+    mkdirSync(path.dirname(output), { recursive: true });
+    const temporary = `${output}.${process.pid}.tmp`;
+    cpSync(archive, temporary);
+    renameSync(temporary, output);
+    state.phase = "complete";
+    state.output = output;
+    state.outputHash = createHash("sha256").update(readFileSync(output)).digest("hex");
+    writeJson(statePath, state);
+    const update = await (options.runner ? Promise.resolve(undefined) : (deps.prepareUpdate ?? prepareUpdate)(root, output, String(expected.buildVersion)));
+    console.log(`✓ Notarization ticket attached\n✓ Distribution archive verified\n\nReady: ${output}`);
+    return { pending: false, output, update, submissionId: state.submissionId };
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/platform.js

@@ -0,0 +1,34 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { machine } from "node:os";
+import { readConfig } from "@legendapp/spark-desktop-config/config.cjs";
+export const hostPlatform = () => process.platform === "win32" ? "windows" : "macos";
+export function windowsArchitecture(host = process.platform, machineArch = machine(), env = process.env) {
+    const explicit = env.SPARK_WINDOWS_ARCH?.toLowerCase();
+    if (explicit !== undefined) {
+        if (explicit === "arm64" || explicit === "x64")
+            return explicit;
+        throw new Error("SPARK_WINDOWS_ARCH must be arm64 or x64.");
+    }
+    // Use the OS CPU rather than process.arch: Node/Bun may run under emulation.
+    if (host === "win32") {
+        if (machineArch.toLowerCase() === "arm64" || machineArch.toLowerCase() === "aarch64")
+            return "arm64";
+        const native = (env.PROCESSOR_ARCHITEW6432 ?? env.PROCESSOR_ARCHITECTURE ?? machineArch).toLowerCase();
+        if (native === "arm64")
+            return "arm64";
+        if (["amd64", "x64", "x86_64"].includes(native))
+            return "x64";
+        throw new Error(`Unsupported Windows architecture: ${native}. Use Windows x64 or ARM64.`);
+    }
+    return "x64";
+}
+export const architecture = (platform) => platform === "windows" ? windowsArchitecture() : "arm64";
+export function projectPlatform(root) {
+    if (!["app.json", "desktop.config.json"].some(name => existsSync(path.join(root, name))))
+        return "macos";
+    const platforms = readConfig(root).expo?.platforms ?? ["macos"];
+    if (platforms.length !== 1 || !["macos", "windows"].includes(platforms[0]))
+        throw new Error("Select a desktop target with --platform macos or --platform windows.");
+    return platforms[0];
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/process.js

@@ -0,0 +1,57 @@
+import path from "node:path";
+import { spawn as nodeSpawn } from "node:child_process";
+import { createRequire } from "node:module";
+import { constants as osConstants } from "node:os";
+import { openSync, closeSync, mkdirSync } from "node:fs";
+import { Readable } from "node:stream";
+const spawn = createRequire(import.meta.url)("cross-spawn");
+export function processLog(file) { return { file }; }
+/** Process ownership shared by builds, native runners and Expo's terminal/IPC. */
+export function spawnProcess(argv, options = {}) {
+    const descriptors = new Map();
+    function output(value) {
+        if (value && typeof value === "object") {
+            if (!descriptors.has(value.file)) {
+                mkdirSync(path.dirname(value.file), { recursive: true });
+                descriptors.set(value.file, openSync(value.file, "w"));
+            }
+            return descriptors.get(value.file);
+        }
+        return value ?? "pipe";
+    }
+    let child;
+    try {
+        const stdio = [options.stdin ?? "ignore", output(options.stdout), output(options.stderr), ...(options.ipc ? ["ipc"] : [])];
+        child = spawn(argv[0], argv.slice(1), { cwd: options.cwd, env: options.env ?? process.env, stdio, detached: options.detached, serialization: options.serialization ?? "json" });
+    }
+    finally {
+        // The child owns duplicated handles; do not leak parent descriptors.
+        for (const descriptor of descriptors.values())
+            closeSync(descriptor);
+    }
+    let exitCode = null;
+    const exited = new Promise((resolve, reject) => {
+        child.once("error", error => { exitCode = 1; reject(error); });
+        child.once("exit", (code, signal) => { exitCode = code ?? 128 + (osConstants.signals[signal] ?? 1); });
+        // close guarantees piped output has drained, unlike exit.
+        child.once("close", (code, signal) => { exitCode = code ?? 128 + (osConstants.signals[signal] ?? 1); resolve(exitCode); });
+    });
+    // A caller may be draining output before awaiting completion.
+    void exited.catch(() => { });
+    const result = {
+        get exitCode() { return exitCode; },
+        get signalCode() { return child.signalCode; },
+        get stdin() { return child.stdin; },
+        get pid() { return child.pid; },
+        stdout: child.stdout ? Readable.toWeb(child.stdout) : null,
+        stderr: child.stderr ? Readable.toWeb(child.stderr) : null,
+        exited,
+        kill(signal = "SIGTERM") { child.kill(signal); },
+        send(message) { if (child.connected)
+            child.send(message, () => { }); },
+    };
+    if (options.ipc)
+        child.on("message", message => options.ipc(message, result));
+    return result;
+}
+export { which } from "./executable.js";