@legendapp/spark 0.0.1-next.2

package/vendor/node_modules/@legendapp/spark-cli/dist/project.js

@@ -0,0 +1,324 @@
+import { macOSReleaseSettings } from "./macos-release.js";
+import { projectPlatform, architecture } from "./platform.js";
+import { resolveHelpers } from "./helpers.js";
+import { readConfig as readAppConfig, prepareConfig, writeUpdates, statePath, isUniversal, isExpoProject } from "@legendapp/spark-desktop-config/config.cjs";
+export { readAppConfig, prepareConfig, writeUpdates, statePath, isUniversal };
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync, renameSync, } from "node:fs";
+import path from "node:path";
+export const VERSION = "0.0.1-next.2";
+export function readJson(file) {
+    return JSON.parse(readFileSync(file, "utf8"));
+}
+export function writeJson(file, value) {
+    const content = JSON.stringify(value, null, 2) + "\n";
+    // Metro watches JSON too: rewriting unchanged session state on every runtime
+    // check causes empty Fast Refresh updates even when app code has not changed.
+    if (existsSync(file) && readFileSync(file, "utf8") === content)
+        return;
+    mkdirSync(path.dirname(file), { recursive: true });
+    const temporary = `${file}.${process.pid}.tmp`;
+    writeFileSync(temporary, content);
+    renameSync(temporary, file);
+}
+export function digest(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export function stateFile(root, name) {
+    return statePath(root, name);
+}
+export function entryFile(root) {
+    if (isExpoProject(root)) {
+        const appRequire = createRequire(path.join(root, "package.json"));
+        const expoRequire = createRequire(appRequire.resolve("expo/package.json"));
+        return path.relative(root, expoRequire("@expo/config/paths").resolveEntryPoint(root, { platform: projectPlatform(root) }));
+    }
+    return readJson(path.join(root, "package.json")).main ?? "index.ts";
+}
+export function installedPackages(root) {
+    const found = new Map();
+    const queue = [
+        { root, json: readJson(path.join(root, "package.json")), app: true },
+    ];
+    const visited = new Set();
+    while (queue.length) {
+        const current = queue.shift();
+        const req = createRequire(path.join(current.root, current.json.spark?.bundledModuleRoot ?? ".", "package.json"));
+        const bundled = current.json.spark?.bundledModules ?? current.json.bundledDependencies ?? current.json.bundleDependencies;
+        const names = Object.keys({
+            ...Object.fromEntries((Array.isArray(bundled) ? bundled : []).map(name => [name, true])),
+            ...current.json.dependencies,
+            ...(current.app ? current.json.devDependencies : {}),
+            // Optional peers do not require a native module. If an application uses
+            // one, its own dependency edge includes it. Resolving optional peers here
+            // can accidentally pull native modules from a parent workspace.
+            ...Object.fromEntries(Object.entries(current.json.peerDependencies ?? {})
+                .filter(([name]) => !current.json.peerDependenciesMeta?.[name]?.optional)),
+        }).sort();
+        for (const name of names) {
+            let file;
+            try {
+                file = req.resolve(`${name}/package.json`);
+            }
+            catch {
+                // Packages with exports hiding package.json still have an owning directory.
+                try {
+                    let dir = path.dirname(req.resolve(name));
+                    while ((!existsSync(path.join(dir, "package.json")) || typeof readJson(path.join(dir, "package.json")).name !== "string") &&
+                        dir !== path.dirname(dir))
+                        dir = path.dirname(dir);
+                    file = path.join(dir, "package.json");
+                }
+                catch {
+                    if (current.app &&
+                        (current.json.dependencies?.[name] ||
+                            current.json.devDependencies?.[name]))
+                        throw new Error(`Dependency ${name} is not installed yet. Finish the package installation, then retry.`);
+                    continue;
+                }
+            }
+            const dir = realpathSync(path.dirname(file));
+            if (visited.has(dir))
+                continue;
+            visited.add(dir);
+            const json = readJson(file);
+            const prior = found.get(json.name);
+            if (prior &&
+                prior.json.version !== json.version &&
+                (json.codegenConfig ||
+                    json.spark ||
+                    existsSync(path.join(dir, "expo-module.config.json")))) {
+                throw new Error(`Conflicting native versions for ${json.name}: ${prior.json.version} and ${json.version}`);
+            }
+            found.set(json.name, { name: json.name, root: dir, json });
+            queue.push({ root: dir, json, app: false });
+        }
+    }
+    return [...found.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+export function hashFiles(root, entries, windows = false) {
+    const hash = createHash("sha256");
+    function visit(relative) {
+        const file = path.join(root, relative);
+        if (!existsSync(file))
+            return;
+        try {
+            const children = readdirSync(file, { withFileTypes: true });
+            for (const child of children.sort((a, b) => a.name.localeCompare(b.name))) {
+                if (["node_modules", "build", ".git", "Pods"].includes(child.name) || child.isSymbolicLink() ||
+                    (windows && (["Generated Files", "codegen", "obj", "x64", "ARM64", "Debug", "Release", ".vs", "packages", "packages.lock.json"].includes(child.name) || child.name.endsWith(".vcxproj.user") || child.name.startsWith("AutolinkedNativeModules.g."))))
+                    continue;
+                visit(path.join(relative, child.name));
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOTDIR")
+                throw error;
+            hash.update(relative.split(path.sep).join("/")).update(readFileSync(file));
+        }
+    }
+    for (const entry of entries.sort())
+        visit(entry);
+    return hash.digest("hex");
+}
+export function nativePackages(root) {
+    const installed = installedPackages(root);
+    if (projectPlatform(root) === "windows")
+        return windowsNativePackages(root, installed);
+    // Host/CNG code can change the native ABI without adding a TurboModule.
+    // Fold it into the mandatory app module's compatibility signature for Go.
+    const adapters = installed.filter(pkg => ["@legendapp/spark-desktop-host", "@legendapp/spark-desktop-config"].includes(pkg.name))
+        .map(pkg => hashFiles(pkg.root, ["package.json", "AppDelegate.mm", ...readdirSync(pkg.root).filter(name => name.endsWith(".cjs"))])).join(":");
+    const excluded = isUniversal(root) ? readAppConfig(root).expo?.autolinking?.exclude ?? [] : [];
+    return installed.filter(pkg => !excluded.includes(pkg.name))
+        .filter((pkg) => pkg.json.codegenConfig ||
+        pkg.json.spark?.nativeModules ||
+        readdirSync(pkg.root).some((name) => name.endsWith(".podspec") || name === "expo-module.config.json"))
+        .map((pkg) => ({
+        ...pkg,
+        sdk: pkg.json.spark?.sdk === true || ["@react-native-async-storage/async-storage", "react-native-webview", "@op-engineering/op-sqlite", "@react-native-runtimes/core", "react-native-nitro-modules"].includes(pkg.name),
+        requires: pkg.json.spark?.requires ?? [],
+        signature: (signature => pkg.name === "@legendapp/spark-desktop-app" ? digest(signature + adapters) : signature)(hashFiles(pkg.root, [
+            "package.json",
+            "ios",
+            "macos",
+            "apple",
+            "cpp",
+            "src",
+            "common", "nitrogen/generated", "nitro.json",
+            "expo-module.config.json",
+            "react-native.config.js",
+            ...readdirSync(pkg.root).filter((name) => name.endsWith(".podspec")),
+        ])),
+    }));
+}
+export function dependencyStamp(root) {
+    return hashFiles(root, [
+        "package.json",
+        "bun.lock",
+        "package-lock.json",
+        "yarn.lock",
+        "pnpm-lock.yaml",
+        "app.json",
+        "desktop.config.json",
+        "app.config.js",
+        "app.config.ts",
+        "metro.config.js",
+        "react-native.config.js",
+    ]);
+}
+export function selection(packages, used, include = []) {
+    const selected = new Set([
+        ...packages.filter((p) => !p.sdk).map((p) => p.name),
+        ...used,
+        ...include,
+    ]);
+    const reasons = {};
+    for (const pkg of packages)
+        if (selected.has(pkg.name))
+            reasons[pkg.name] = include.includes(pkg.name)
+                ? "explicit include"
+                : pkg.sdk
+                    ? "reachable production import"
+                    : "conservative native dependency";
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const pkg of packages.filter((p) => selected.has(p.name))) {
+            const nativeDeps = [
+                ...pkg.requires,
+                ...Object.keys({
+                    ...pkg.json.dependencies,
+                    ...Object.fromEntries(Object.entries(pkg.json.peerDependencies ?? {}).filter(([name]) => !pkg.json.peerDependenciesMeta?.[name]?.optional)),
+                }).filter((n) => packages.some((p) => p.name === n)),
+            ];
+            for (const name of nativeDeps) {
+                if (!packages.some((p) => p.name === name))
+                    throw new Error(`${pkg.name} requires missing native package ${name}`);
+                if (!selected.has(name)) {
+                    selected.add(name);
+                    reasons[name] = `native dependency of ${pkg.name}`;
+                    changed = true;
+                }
+            }
+        }
+    }
+    for (const name of include)
+        if (!packages.some((p) => p.name === name))
+            throw new Error(`Explicit native include is not installed: ${name}`);
+    return {
+        included: packages.filter((p) => selected.has(p.name)),
+        excluded: packages.filter((p) => !selected.has(p.name)),
+        reasons,
+    };
+}
+export function hostSourceSignature(root) {
+    return digest(JSON.stringify(installedPackages(root)
+        .filter(pkg => ["@legendapp/spark-desktop-host", "@legendapp/spark-desktop-config"].includes(pkg.name))
+        .map(pkg => [pkg.name, hashFiles(pkg.root, ["package.json", "AppDelegate.mm", "windows", ...readdirSync(pkg.root).filter(file => file.endsWith(".cjs"))])])));
+}
+export function runtimeFor(root, packages, mode) {
+    const platform = projectPlatform(root);
+    const modules = Object.fromEntries(packages.map((p) => [p.name, p.signature]));
+    const pins = installedPackages(root)
+        .filter((p) => [
+        "react",
+        "react-native",
+        "react-native-macos",
+        "react-native-windows",
+        "expo",
+        "@legendapp/spark-desktop-host",
+        "@legendapp/spark-desktop-config",
+    ].includes(p.name))
+        .map((p) => [p.name, p.json.version]);
+    return {
+        schema: 1,
+        framework: VERSION,
+        platform,
+        arch: architecture(platform),
+        mode,
+        modules,
+        fingerprint: digest(JSON.stringify({
+            ...(platform === "windows" ? { arch: architecture(platform) } : {}),
+            ...(platform === "macos" && mode === "release" ? { releaseSettings: macOSReleaseSettings } : {}),
+            modules,
+            pins,
+            config: readAppConfig(root),
+            helpers: resolveHelpers(root, readAppConfig(root).expo?.extra?.spark?.helpers, platform).map(helper => ({ name: helper.name, contents: hashFiles(root, helper.files), modes: helper.modes, directories: helper.directories })),
+            adapter: hostSourceSignature(root),
+        })),
+    };
+}
+export function incompatible(runtime, required, platform = "macos") {
+    if (runtime.schema !== 1 ||
+        runtime.framework !== VERSION ||
+        runtime.arch !== architecture(platform) ||
+        runtime.platform !== platform)
+        return ["framework runtime version/platform mismatch"];
+    return required
+        .filter((pkg) => runtime.modules[pkg.name] !== pkg.signature)
+        .map((pkg) => pkg.name);
+}
+export function goConfigurationIssues(config) {
+    const expo = config.expo ?? config;
+    const issues = [];
+    if (expo.scheme || expo.extra?.spark?.documentTypes?.length)
+        issues.push("URL schemes and document associations require a custom runtime");
+    if (expo.extra?.spark?.menuBarOnly)
+        issues.push("Menu-bar-only activation requires a custom runtime");
+    if (expo.extra?.spark?.updates)
+        issues.push("Update feed configuration requires a custom runtime");
+    if (Object.keys(expo.extra?.spark?.helpers ?? {}).length)
+        issues.push("Bundled helpers require a custom runtime");
+    if (expo.extra?.spark?.customRuntime)
+        issues.push("app configuration requires a custom runtime");
+    if ((expo.plugins ?? []).some((plugin) => !["@legendapp/spark-desktop-config", "@legendapp/spark/config-plugin"].includes(Array.isArray(plugin) ? plugin[0] : plugin)))
+        issues.push("additional configuration plugins require a custom runtime");
+    if (Object.keys(expo.macos ?? {}).some((key) => !["bundleIdentifier", "infoPlist"].includes(key)))
+        issues.push("macOS native configuration requires a custom runtime");
+    if (Object.keys(expo.macos?.infoPlist ?? {}).some((key) => key !== "CFBundleName"))
+        issues.push("app-specific Info.plist configuration requires a custom runtime");
+    return issues;
+}
+export function validateBuildModules(mode, packages) {
+    if (mode === "go" && packages.some(pkg => pkg.name === "@legendapp/spark-native-greeting" || pkg.json.spark?.testOnly))
+        throw new Error("Build the Spark Runner from the clean SDK starter, not a custom-module test fixture.");
+    if (mode === "release" && packages.some(pkg => pkg.json.spark?.testOnly))
+        throw new Error("Test-only native modules cannot be included in distribution builds.");
+}
+export function projectEnvironment(root) {
+    const file = path.join(root, "app.json");
+    // Explicit `spark open /path/App.app` also works outside a project.
+    if (!existsSync(file) && !existsSync(path.join(root, "desktop.config.json")))
+        return {};
+    const config = readAppConfig(root).expo ?? {};
+    const projectId = config.extra?.spark?.projectId ?? config.macos?.bundleIdentifier;
+    if (typeof projectId !== "string" || !projectId.length || projectId.length > 200)
+        throw new Error("Set extra.spark.projectId to a stable project identifier before launching the Spark Runner.");
+    return {
+        SPARK_WINDOW_CONFIG: JSON.stringify(config.extra?.spark?.window ?? {}),
+        SPARK_PROJECT_ID: projectId,
+        SPARK_PROJECT_NAME: typeof config.name === "string" ? config.name : path.basename(root),
+        SPARK_PROJECT_VERSION: typeof config.version === "string" ? config.version : "0.0.0",
+    };
+}
+function windowsNativePackages(root, installed) {
+    const direct = readJson(path.join(root, "package.json")).dependencies ?? {};
+    const supported = (pkg) => pkg.name !== "expo-desktop-template-bare-minimum" && (existsSync(path.join(pkg.root, "windows")) ||
+        ["react-native", "react-native-windows", "@legendapp/spark-desktop-host", "@legendapp/spark-desktop-app", "@legendapp/spark-desktop-windows", "@legendapp/spark-desktop-shortcuts", "@legendapp/spark-native-menu", "@legendapp/spark-updates"].includes(pkg.name));
+    const explicitlyExcluded = isUniversal(root) ? readAppConfig(root).expo?.autolinking?.exclude ?? [] : [];
+    for (const pkg of installed) {
+        const platformAdapter = isUniversal(root) && ["src/index.windows.ts", "src/index.windows.tsx"].some(file => existsSync(path.join(pkg.root, file)));
+        if (!platformAdapter && !explicitlyExcluded.includes(pkg.name) && direct[pkg.name] && pkg.name !== "expo" && !supported(pkg) && (pkg.json.codegenConfig || pkg.json.spark?.nativeModules || readdirSync(pkg.root).some(name => name.endsWith(".podspec") || name === "expo-module.config.json"))) {
+            throw new Error(`${pkg.name} has no Windows implementation. Remove it from this Windows development app until it is ported.`);
+        }
+    }
+    const adapter = installed.filter(pkg => ["@legendapp/spark-desktop-host", "@legendapp/spark-desktop-config"].includes(pkg.name))
+        .map(pkg => hashFiles(pkg.root, ["package.json", "windows", ...readdirSync(pkg.root).filter(name => name.endsWith(".cjs"))], true)).join(":");
+    const versions = installed.filter(pkg => ["react", "expo", "react-native", "react-native-windows"].includes(pkg.name)).map(pkg => [pkg.name, pkg.json.version]);
+    return installed.filter(supported).map(pkg => ({ ...pkg,
+        sdk: pkg.json.spark?.sdk === true || pkg.name === "@react-native-async-storage/async-storage", requires: pkg.json.spark?.requires ?? [],
+        signature: digest(hashFiles(pkg.root, ["package.json", "windows", "src", "cpp", "common", "react-native.config.js"], true) + (pkg.name === "@legendapp/spark-desktop-host" ? adapter + JSON.stringify(versions) : "")),
+    }));
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/release.js

@@ -0,0 +1,42 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { readJson, VERSION } from "./project.js";
+import { localArchive } from "./package-manager.js";
+export const releaseBase = (version) => `https://github.com/LegendApp/legend-spark/releases/download/v${version}`;
+export function validateRelease(value) {
+    if (value?.schema !== 1 || value.version !== VERSION || !/^[a-f0-9]{40}$/.test(value.revision) || !value.packages || !value.runners)
+        throw new Error("Invalid or incompatible Spark release manifest");
+    for (const asset of [...Object.values(value.packages), ...Object.values(value.runners)]) {
+        const url = new URL(asset.url);
+        if (url.href !== asset.url || !/^[A-Za-z0-9._-]+$/.test(url.pathname.split("/").at(-1) ?? "") || !asset.url.startsWith(releaseBase(VERSION) + "/") || url.search || url.hash || !/^[a-f0-9]{64}$/.test(asset.sha256) || !Number.isSafeInteger(asset.size) || asset.size <= 0)
+            throw new Error("Invalid Spark release asset");
+    }
+    for (const [target, asset] of Object.entries(value.runners)) {
+        if (target !== "macos-arm64" || path.basename(asset.app) !== asset.app || !asset.app.endsWith(".app") || !/^[A-Z0-9]{10}$/.test(asset.teamId) || !/^[a-f0-9]+$/.test(asset.fingerprint))
+            throw new Error("Invalid Runner release target");
+    }
+    return value;
+}
+export function installedRelease() {
+    const file = path.join(import.meta.dirname, "release.json");
+    return existsSync(file) ? validateRelease(readJson(file)) : undefined;
+}
+/** Registry versions and immutable HTTPS archives survive project moves and clones. */
+export function packageSources(manifest, release = installedRelease()) {
+    let sources;
+    if (manifest) {
+        sources = Object.fromEntries(Object.entries(readJson(manifest)).map(([name, relative]) => {
+            const file = path.resolve(path.dirname(manifest), relative);
+            if (!existsSync(file))
+                throw new Error(`Missing SDK archive: ${file}`);
+            return [name, localArchive(file)];
+        }));
+    }
+    else {
+        if (!release)
+            throw new Error("This SDK has no published release metadata. Pack or register a local SDK first.");
+        validateRelease(release);
+        sources = { ...Object.fromEntries(Object.entries(release.packages).map(([name, asset]) => [name, asset.url])), "@legendapp/spark": VERSION };
+    }
+    return sources;
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/release.json

@@ -0,0 +1,37 @@
+{
+  "schema": 1,
+  "version": "0.0.1-next.2",
+  "revision": "6359fee375c5b0549b43f339d4e856db4bcb7c98",
+  "packages": {
+    "@react-native-runtimes/core": {
+      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.2/runtimes-31ac67156c18.tgz",
+      "size": 53885,
+      "sha256": "a8e532d0a1e8d7c23953e94612d58f0e660a685e58645075c5180304c8462515"
+    },
+    "react-native-nitro-modules": {
+      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.2/react-native-nitro-modules-0.35.7-7c494d2176d7.tgz",
+      "size": 138548,
+      "sha256": "7c494d2176d7f144ee5d518fd8c03b24f29c22bba520b7cebd71ba7d60cb56d3"
+    },
+    "@op-engineering/op-sqlite": {
+      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.2/op-engineering-op-sqlite-18.2.1-ebd60a4eb0d4.tgz",
+      "size": 115455003,
+      "sha256": "ebd60a4eb0d4a0a2d48c7ca455cf3668879ff64a258bed108c2393d53679cf3c"
+    },
+    "react-native-webview": {
+      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.2/react-native-webview-16.0.0-33882a035641.tgz",
+      "size": 116112,
+      "sha256": "33882a03564141b8b5c56cc7e99e0d425f3a53b59db966d9412bb85ef6f0abf3"
+    }
+  },
+  "runners": {
+    "macos-arm64": {
+      "url": "https://github.com/LegendApp/legend-spark/releases/download/v0.0.1-next.2/spark-runner-macos-arm64.zip",
+      "size": 12455131,
+      "sha256": "77635060c84c536d67af10496e21a65fb57f279a7f165d362f1ca81829c95e69",
+      "app": "SparkRunner.app",
+      "teamId": "56DD97VT22",
+      "fingerprint": "fef5859c9685b017d0132277f593c732512dec23b2c57bc6c53ce695e821406d"
+    }
+  }
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/runner-install.js

@@ -0,0 +1,138 @@
+import { createHash } from "node:crypto";
+import { closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { open } from "node:fs/promises";
+import path from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+import { run } from "./commands.js";
+import { sparkHome, readRuntime, registerRuntime } from "./local.js";
+import { architecture } from "./platform.js";
+import { VERSION } from "./project.js";
+import { installedRelease } from "./release.js";
+const defaults = { fetch: globalThis.fetch, run };
+export async function downloadAsset(asset, file, request = globalThis.fetch) {
+    for (let attempt = 0; attempt < 3; attempt++) {
+        let handle;
+        try {
+            const response = await request(asset.url, { signal: AbortSignal.timeout(300_000) });
+            if (!response.ok || !response.body)
+                throw new Error(`Download failed: HTTP ${response.status}`);
+            handle = await open(file, "w", 0o600);
+            const hash = createHash("sha256");
+            let bytes = 0, reported = -1;
+            for await (const chunk of response.body) {
+                bytes += chunk.byteLength;
+                if (bytes > asset.size)
+                    throw new Error("Download exceeds its declared size");
+                hash.update(chunk);
+                await handle.writeFile(chunk);
+                const percent = Math.floor(bytes / asset.size * 10) * 10;
+                if (percent !== reported) {
+                    console.log(`Downloading Spark Runner: ${percent}%`);
+                    reported = percent;
+                }
+            }
+            if (bytes !== asset.size || hash.digest("hex") !== asset.sha256)
+                throw new Error("Download checksum or size mismatch");
+            await handle.close();
+            handle = undefined;
+            break;
+        }
+        catch (error) {
+            await handle?.close();
+            handle = undefined;
+            rmSync(file, { force: true });
+            if (attempt === 2)
+                throw error;
+            console.log(`Runner download interrupted; retrying (${attempt + 1}/2)…`);
+            await sleep(500 * (attempt + 1));
+        }
+    }
+}
+async function verify(app, asset, deps) {
+    const runtime = readRuntime(app);
+    if (!runtime || runtime.mode !== "go" || runtime.platform !== "macos" || runtime.arch !== "arm64" || runtime.fingerprint !== asset.fingerprint)
+        throw new Error("Downloaded Runner has incompatible runtime metadata");
+    await deps.run(path.dirname(app), ["codesign", "--verify", "--deep", "--strict", app], { capture: true });
+    const signature = await deps.run(path.dirname(app), ["codesign", "-dvvv", app], { capture: true });
+    if (!signature.includes(`TeamIdentifier=${asset.teamId}\n`) || !signature.includes("Authority=Developer ID Application:"))
+        throw new Error("Runner publisher signature does not match this SDK");
+    await deps.run(path.dirname(app), ["spctl", "--assess", "--type", "execute", app], { capture: true });
+}
+/** A checksum-pinned, signed app is promoted atomically and registered only after validation. */
+export async function installRunner(asset, cache = sparkHome(), deps = defaults) {
+    const parent = path.join(cache, "downloads", VERSION);
+    const destination = path.join(parent, asset.sha256);
+    const app = path.join(destination, asset.app);
+    mkdirSync(parent, { recursive: true });
+    const lock = `${destination}.lock`;
+    let owned = false;
+    for (let attempt = 0; !owned && attempt < 600; attempt++) {
+        try {
+            const fd = openSync(lock, "wx");
+            writeFileSync(fd, String(process.pid));
+            closeSync(fd);
+            owned = true;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const pid = Number(readFileSync(lock, "utf8"));
+            if (Number.isInteger(pid) && pid > 0) {
+                try {
+                    process.kill(pid, 0);
+                }
+                catch (probe) {
+                    if (probe.code === "ESRCH")
+                        rmSync(lock, { force: true });
+                }
+            }
+            await sleep(1000);
+        }
+    }
+    if (!owned)
+        throw new Error("Another process is installing Runner. Retry desktop launch when it finishes.");
+    let staging;
+    try {
+        if (existsSync(app)) {
+            try {
+                await verify(app, asset, deps);
+            }
+            catch {
+                rmSync(destination, { recursive: true, force: true });
+            }
+        }
+        if (!existsSync(app)) {
+            staging = mkdtempSync(path.join(parent, ".runner-"));
+            const archive = path.join(staging, "runner.zip");
+            await downloadAsset(asset, archive, deps.fetch);
+            const unpacked = path.join(staging, "unpacked");
+            mkdirSync(unpacked);
+            // Only publisher-pinned bytes reach the platform extractor.
+            await deps.run(staging, ["ditto", "-x", "-k", archive, unpacked], { capture: true });
+            await verify(path.join(unpacked, asset.app), asset, deps);
+            renameSync(unpacked, destination);
+        }
+        registerRuntime(app);
+        console.log("Spark Runner installed and verified.");
+        return app;
+    }
+    finally {
+        if (staging)
+            rmSync(staging, { recursive: true, force: true });
+        rmSync(lock, { force: true });
+    }
+}
+export async function acquireRunner(platform) {
+    const release = installedRelease();
+    let app;
+    if (release) {
+        const target = `${platform}-${architecture(platform)}`;
+        const asset = release.runners[target];
+        if (!asset)
+            throw new Error(`This Spark release has no Runner for ${target}. Use a custom development build.`);
+        if (process.platform !== "darwin" || process.arch !== "arm64")
+            throw new Error("This release's Runner requires Apple Silicon macOS and arm64 Node.");
+        app = await installRunner(asset);
+    }
+    return app;
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/runtime-entry.cjs

@@ -0,0 +1 @@
+// Replaced by withDesktop with the app-specific worker registry.

package/vendor/node_modules/@legendapp/spark-cli/dist/sdk-install.js

@@ -0,0 +1,66 @@
+import { spawnSync } from "node:child_process";
+import { parseArgs } from "node:util";
+import { packageManager, managerCommand, applyOverrides, localArchive } from "./package-manager.js";
+// Standalone bootstrap, copied into SDK bundles. Requires Node; no framework checkout.
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, mkdirSync, writeFileSync } from "node:fs";
+import path from "node:path";
+const root = import.meta.dirname;
+const metadata = JSON.parse(readFileSync(path.join(root, "sdk.json"), "utf8"));
+const actual = {};
+function visit(relative) {
+    const file = path.join(root, relative), stat = lstatSync(file);
+    if (stat.isDirectory())
+        for (const name of readdirSync(file).sort())
+            visit(path.join(relative, name));
+    else {
+        let content;
+        if (stat.isSymbolicLink()) {
+            const target = readlinkSync(file);
+            if (!path.resolve(path.dirname(file), target).startsWith(root + path.sep))
+                throw new Error("SDK symlink escapes bundle");
+            content = `symlink:${target}`;
+        }
+        else if (stat.isFile())
+            content = readFileSync(file);
+        else
+            throw new Error("Unsupported SDK file");
+        actual[relative.replaceAll(path.sep, "/")] = createHash("sha256").update(content).digest("hex");
+    }
+}
+for (const name of ["packages", "runtimes"])
+    if (existsSync(path.join(root, name)))
+        visit(name);
+if (metadata.schema !== 1 || JSON.stringify(actual) !== JSON.stringify(metadata.sha256))
+    throw new Error("SDK checksum mismatch");
+const manifest = JSON.parse(readFileSync(path.join(root, "packages/manifest.json"), "utf8"));
+const overrides = {};
+for (const [name, file] of Object.entries(manifest)) {
+    if (typeof file !== "string" || path.basename(file) !== file || !actual[`packages/${file}`])
+        throw new Error("Invalid SDK manifest");
+    overrides[name] = localArchive(path.join(root, "packages", file));
+}
+if (!overrides["@legendapp/spark"])
+    throw new Error("SDK has no CLI");
+const tooling = path.join(root, ".cli");
+mkdirSync(tooling, { recursive: true });
+const { values } = parseArgs({ options: { "package-manager": { type: "string" } } });
+const manager = packageManager(root, values["package-manager"]);
+const pkg = { name: "spark-sdk-tools", private: true, dependencies: { ...metadata.tooling?.dependencies, "@legendapp/spark": overrides["@legendapp/spark"] } };
+applyOverrides(pkg, { ...metadata.tooling?.overrides, ...overrides }, manager);
+writeFileSync(path.join(tooling, "package.json"), JSON.stringify(pkg, null, 2));
+if (manager === "yarn")
+    writeFileSync(path.join(tooling, ".yarnrc.yml"), "nodeLinker: node-modules\n");
+if (manager === "pnpm")
+    writeFileSync(path.join(tooling, ".npmrc"), "node-linker=hoisted\n");
+const [executable, ...args] = managerCommand(manager, ["install"]);
+// Only fixed manager names + 'install' use a Windows shell; paths/CLI arguments
+// are always passed directly to Node without shell interpolation.
+const install = spawnSync(executable, args, { cwd: tooling, stdio: "inherit", env: { ...process.env, ...(manager === "yarn" ? { YARN_ENABLE_IMMUTABLE_INSTALLS: "false" } : {}) }, shell: process.platform === "win32" && executable === manager });
+if (install.error || install.status !== 0)
+    throw new Error(`SDK CLI installation failed: ${install.error ?? install.status}`);
+const cli = path.join(tooling, "node_modules/@legendapp/spark/bin/spark.cjs");
+const register = spawnSync(process.execPath, [cli, "sdk", "import", root], { cwd: root, stdio: "inherit" });
+if (register.error || register.status !== 0)
+    throw new Error("SDK registration failed");
+console.log(`SDK installed. Keep this directory in place.\nCreate an app: node ${JSON.stringify(cli)} create MyApp --universal --package-manager ${manager}`);