@legendapp/spark 0.0.1-next.2

package/vendor/node_modules/@legendapp/spark-cli/dist/sdk-transfer.js

@@ -0,0 +1,113 @@
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, lstatSync, readlinkSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { readJson, writeJson, VERSION } from "./project.js";
+import { readRuntime, registerPackages, registerRuntime } from "./local.js";
+export function treeHashes(root) {
+    const result = {};
+    function visit(relative) {
+        const file = path.join(root, relative), stat = lstatSync(file);
+        if (stat.isSymbolicLink()) {
+            const target = readlinkSync(file);
+            const resolved = path.resolve(path.dirname(file), target);
+            if (!resolved.startsWith(path.resolve(root) + path.sep))
+                throw new Error(`SDK link escapes bundle: ${relative}`);
+            result[relative.replaceAll(path.sep, "/")] = createHash("sha256").update(`symlink:${target}`).digest("hex");
+        }
+        else if (stat.isDirectory()) {
+            for (const name of readdirSync(file).sort())
+                visit(path.join(relative, name));
+        }
+        else if (stat.isFile())
+            result[relative.replaceAll(path.sep, "/")] = createHash("sha256").update(readFileSync(file)).digest("hex");
+        else
+            throw new Error(`Unsupported SDK file: ${relative}`);
+    }
+    for (const name of ["packages", "runtimes"])
+        if (existsSync(path.join(root, name)))
+            visit(name);
+    return result;
+}
+export function verifySDK(root) {
+    const metadata = readJson(path.join(root, "sdk.json"));
+    if (metadata.schema !== 1 || metadata.framework !== VERSION || !Array.isArray(metadata.runtimes))
+        throw new Error("Incompatible SDK bundle");
+    const actual = treeHashes(root);
+    if (JSON.stringify(actual) !== JSON.stringify(metadata.sha256))
+        throw new Error("SDK checksum mismatch; obtain an intact bundle before installing");
+    const archives = readJson(path.join(root, "packages/manifest.json"));
+    for (const file of Object.values(archives)) {
+        if (typeof file !== "string" || path.basename(file) !== file || !actual[`packages/${file}`])
+            throw new Error("Invalid SDK archive manifest");
+    }
+    for (const relative of metadata.runtimes) {
+        if (typeof relative !== "string" || !relative.startsWith("runtimes/") || relative.includes("..") || !readRuntime(path.join(root, relative)))
+            throw new Error("Invalid bundled Spark Runner");
+    }
+    return metadata;
+}
+export function importSDK(root) {
+    root = path.resolve(root);
+    const metadata = verifySDK(root);
+    // Register only after every package and client has passed verification.
+    registerPackages(path.join(root, "packages/manifest.json"));
+    for (const relative of metadata.runtimes)
+        registerRuntime(path.join(root, relative));
+    return root;
+}
+export function exportSDK(manifest, destination, runtimes = []) {
+    destination = path.resolve(destination);
+    if (existsSync(destination))
+        throw new Error(`SDK destination already exists: ${destination}`);
+    const pending = `${destination}.pending`;
+    if (existsSync(pending))
+        throw new Error(`Remove or recover the previous incomplete export: ${pending}`);
+    mkdirSync(path.join(pending, "packages"), { recursive: true });
+    try {
+        const packages = readJson(manifest);
+        for (const [name, file] of Object.entries(packages)) {
+            if (typeof file !== "string" || path.basename(file) !== file)
+                throw new Error(`Invalid archive path for ${name}`);
+            cpSync(path.join(path.dirname(manifest), file), path.join(pending, "packages", file));
+        }
+        writeJson(path.join(pending, "packages/manifest.json"), packages);
+        const clients = [];
+        for (const app of runtimes) {
+            const runtime = readRuntime(app);
+            if (!runtime || runtime.mode !== "go")
+                throw new Error(`Not a compatible Spark Runner: ${app}`);
+            const relative = `runtimes/${runtime.platform}-${runtime.arch}/${path.basename(app)}`;
+            if (clients.includes(relative))
+                throw new Error("Duplicate Spark Runner target");
+            cpSync(app, path.join(pending, relative), { recursive: true, verbatimSymlinks: true });
+            clients.push(relative);
+        }
+        const cli = existsSync(path.join(import.meta.dirname, "sdk-install.js")) ? import.meta.dirname : path.resolve(import.meta.dirname, "../dist");
+        for (const name of ["sdk-install", "package-manager", "executable"]) {
+            const source = readFileSync(path.join(cli, `${name}.js`), "utf8")
+                .replaceAll("./package-manager.js", "./package-manager.mjs").replaceAll("./executable.js", "./executable.mjs");
+            writeFileSync(path.join(pending, name === "sdk-install" ? "install.mjs" : `${name}.mjs`), source);
+        }
+        const template = readJson(path.resolve(import.meta.dirname, "../templates/universal/package.json"));
+        const tooling = {
+            dependencies: Object.fromEntries(["react", "react-native", "react-dom", "expo"].map(name => [name, template.dependencies[name]])),
+            overrides: template.overrides,
+        };
+        writeJson(path.join(pending, "sdk.json"), { schema: 1, framework: VERSION, runtimes: clients, tooling, sha256: treeHashes(pending) });
+        writeFileSync(path.join(pending, "README.md"), `# Spark SDK ${VERSION}
+
+Requires Node 24.19.0+ and npm, pnpm, Yarn, or Bun. Run \`node install.mjs\` in this directory (optionally pass \`--package-manager npm|pnpm|yarn|bun\`). The installer prints the CLI command to create an app; add \`--universal\` for Settings or \`--example document-editor\` for the editor.
+
+Keep this directory in place after installing. Its package archives and optional Spark Runner runtimes are registered by path. Transfer before installing, preserving executable permissions and symlinks. Third-party npm dependencies still require internet access.
+
+Included runtimes: ${clients.length ? clients.join(", ") : "none (install a matching Spark Runner or build a development client)"}. Compatibility checks reject mismatched native modules. Native Windows compilation and clean-machine acceptance require Windows; public hosting and production signing are separate workflows.
+`);
+        verifySDK(pending);
+        renameSync(pending, destination);
+    }
+    catch (error) {
+        rmSync(pending, { recursive: true, force: true });
+        throw error;
+    }
+    return destination;
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/session-status.js

@@ -0,0 +1,22 @@
+export function sessionStatus(target, available, issues, running = false, downloadable = false) {
+    if (!available && target === "go" && !issues.length)
+        return {
+            compatible: false,
+            canBuild: false,
+            message: downloadable ? "Spark Runner is ready to download. Press d to install and open it." : "The Spark Runner isn’t installed for this SDK.\nInstall an SDK bundle containing a matching Spark Runner (node install.mjs), or register a Spark Runner with spark sdk register <runtime directory>.",
+            actions: downloadable ? "d  Download and open Runner · g  Use development build · Ctrl+C  Exit" : "g  Use development build · Ctrl+C  Exit",
+        };
+    if (issues.length || !available)
+        return {
+            compatible: false,
+            canBuild: true,
+            message: `${target === "dev" && available ? "The development build needs rebuilding." : "A development build is needed."}${issues.length ? "\n" + issues.join("\n") : ""}`,
+            actions: `b  ${target === "dev" && available ? "Rebuild" : "Build"} and open · g  Change desktop runtime · Ctrl+C  Exit`,
+        };
+    return {
+        compatible: true,
+        canBuild: false,
+        message: `● ${running ? "Running in " : "Ready to open "}${target === "go" ? "Spark Runner" : "development build"}\n  Fast Refresh enabled`,
+        actions: "d  Open desktop · r  Reload · j  Debugger\ng  Change desktop runtime · Ctrl+C  Exit",
+    };
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/signing.js

@@ -0,0 +1,175 @@
+import { writeFile } from "node:fs/promises";
+import { readAppConfig } from "./project.js";
+import { existsSync, openSync, closeSync, readSync, readdirSync, realpathSync, lstatSync } from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { isDeepStrictEqual } from "node:util";
+import { run } from "./commands.js";
+import { digest, nativePackages, readJson, stateFile, writeJson } from "./project.js";
+const { resolveEntitlements } = createRequire(import.meta.url)("@legendapp/spark-desktop-config/entitlements.cjs");
+export function distributionEntitlements(value) {
+    for (const key of ["com.apple.security.get-task-allow", "get-task-allow"]) {
+        if (value[key] !== undefined && value[key] !== false)
+            throw new Error(`${key} must be absent or false in a distribution app.`);
+    }
+    function inspect(item) {
+        if (typeof item === "string" && item.includes("$("))
+            throw new Error("Distribution entitlements must contain resolved values, not Xcode build variables.");
+        if (item && typeof item === "object")
+            for (const nested of Object.values(item))
+                inspect(nested);
+    }
+    inspect(value);
+    return value;
+}
+export function appEntitlements(root, modules) {
+    const names = Object.keys(modules);
+    const selected = names.length ? nativePackages(root).filter((pkg) => names.includes(pkg.name)) : [];
+    if (selected.length !== names.length || selected.some((pkg) => pkg.signature !== modules[pkg.name]))
+        throw new Error("Native packages changed after the release build. Rebuild before packaging.");
+    // A cached release can coexist with a last-generated dev graph. Use the
+    // release binary's module set, not whichever selection file was written last.
+    return resolveEntitlements(readAppConfig(root), selected.map((pkg) => pkg.json));
+}
+function machOType(file) {
+    const fd = openSync(file, "r");
+    try {
+        const header = Buffer.alloc(32);
+        if (readSync(fd, header, 0, 32, 0) < 16)
+            return undefined;
+        let magic = header.readUInt32BE(0);
+        if ([0xcafebabe, 0xbebafeca, 0xcafebabf, 0xbfbafeca].includes(magic)) {
+            const little = magic === 0xbebafeca || magic === 0xbfbafeca;
+            const read32 = (offset) => little ? header.readUInt32LE(offset) : header.readUInt32BE(offset);
+            if (read32(4) < 1 || read32(4) > 128)
+                return undefined;
+            const wide = magic === 0xcafebabf || magic === 0xbfbafeca;
+            const offset = wide ? Number(little ? header.readBigUInt64LE(16) : header.readBigUInt64BE(16)) : read32(16);
+            if (!Number.isSafeInteger(offset) || readSync(fd, header, 0, 16, offset) < 16)
+                return undefined;
+            magic = header.readUInt32BE(0);
+        }
+        if (magic === 0xfeedface || magic === 0xfeedfacf)
+            return header.readUInt32BE(12);
+        if (magic === 0xcefaedfe || magic === 0xcffaedfe)
+            return header.readUInt32LE(12);
+        return undefined;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function signingOrder(app) {
+    app = realpathSync(app);
+    const code = [];
+    const bundles = [];
+    function visit(file) {
+        const stat = lstatSync(file);
+        if (stat.isSymbolicLink()) {
+            const resolved = realpathSync(file);
+            if (resolved !== app && !resolved.startsWith(app + path.sep))
+                throw new Error(`App contains a symlink outside its bundle: ${file}`);
+            return;
+        }
+        if (stat.isDirectory()) {
+            if (/\.(app|xpc|appex|framework|bundle)$/.test(file))
+                bundles.push(file);
+            for (const name of readdirSync(file).sort())
+                visit(path.join(file, name));
+        }
+        else if (stat.isFile() && [2, 6, 8].includes(machOType(file) ?? 0))
+            code.push(file);
+    }
+    visit(app);
+    if (!code.length)
+        throw new Error("App contains no Mach-O executables.");
+    const containers = bundles.filter((bundle) => code.some((file) => file.startsWith(bundle + path.sep)));
+    return [...new Set([...code, ...containers])].sort((a, b) => b.split(path.sep).length - a.split(path.sep).length || a.localeCompare(b));
+}
+async function entitlementTargets(root, app, order, entitlements, byPath, execute) {
+    const targets = new Map(order.map((file) => [file, byPath[path.relative(app, file)] ?? {}]));
+    targets.set(app, entitlements);
+    for (const container of order.filter((file) => /\.(app|xpc|appex)$/.test(file))) {
+        const plist = existsSync(path.join(container, "Contents/Info.plist")) ? path.join(container, "Contents/Info.plist") : path.join(container, "Info.plist");
+        const info = JSON.parse(await execute(root, ["plutil", "-convert", "json", "-o", "-", plist], { capture: true }));
+        if (typeof info.CFBundleExecutable !== "string" || path.basename(info.CFBundleExecutable) !== info.CFBundleExecutable)
+            throw new Error(`Invalid executable name in ${plist}`);
+        const executable = plist.endsWith("Contents/Info.plist") ? path.join(container, "Contents/MacOS", info.CFBundleExecutable) : path.join(container, info.CFBundleExecutable);
+        if (!order.includes(executable))
+            throw new Error(`Bundle executable is missing from the signing plan: ${executable}`);
+        const explicit = byPath[path.relative(app, executable)];
+        const value = targets.get(container);
+        if (explicit && !isDeepStrictEqual(explicit, value))
+            throw new Error(`Configure process entitlements on its bundle, not a conflicting executable override: ${executable}`);
+        targets.set(executable, value);
+    }
+    return targets;
+}
+export async function signApp(root, app, credentials, entitlements, byPath = {}, execute = run) {
+    app = realpathSync(app);
+    distributionEntitlements(entitlements);
+    const order = signingOrder(app);
+    const relatives = new Set(order.map((file) => path.relative(app, file) || "."));
+    for (const [relative, value] of Object.entries(byPath)) {
+        if (!relatives.has(relative) || relative === ".")
+            throw new Error(`Unknown nested signing target: ${relative}`);
+        distributionEntitlements(value);
+    }
+    const targets = await entitlementTargets(root, app, order, entitlements, byPath, execute);
+    for (const file of order) {
+        const relative = path.relative(app, file) || ".";
+        const value = targets.get(file);
+        const processTarget = /\.(app|xpc|appex)$/.test(file) || (lstatSync(file).isFile() && machOType(file) === 2);
+        if (!processTarget && Object.keys(value).length)
+            throw new Error(`Entitlements belong on executable processes, not libraries: ${relative}`);
+        const plist = stateFile(root, `packaging/entitlements/${digest(relative)}.plist`);
+        writeJson(plist, value);
+        await execute(root, ["plutil", "-convert", "xml1", plist], { capture: true });
+        await execute(root, ["codesign", "--force", "--sign", credentials.hash, "--options", "runtime", "--timestamp", ...(processTarget ? ["--entitlements", plist] : []),
+            ...(credentials.keychain ? ["--keychain", credentials.keychain] : []), file], { capture: true });
+    }
+    return order;
+}
+export async function validateApp(root, app, credentials, expected, notarized, execute = run) {
+    app = realpathSync(app);
+    if (expected.runner) {
+        const runtime = readJson(path.join(app, "Contents/Resources/spark-runtime.json"));
+        if (runtime.mode !== "go" || runtime.platform !== "macos" || runtime.arch !== "arm64")
+            throw new Error("Distribution app is not a macOS Spark Runner.");
+    }
+    else if (!existsSync(path.join(app, "Contents/Resources/main.jsbundle")))
+        throw new Error("Distribution app is missing its JavaScript bundle.");
+    const info = JSON.parse(await execute(root, ["plutil", "-convert", "json", "-o", "-", path.join(app, "Contents/Info.plist")], { capture: true }));
+    for (const [key, value] of Object.entries({ CFBundleIdentifier: expected.bundleId, CFBundleShortVersionString: expected.version, CFBundleVersion: expected.buildVersion })) {
+        if (info[key] !== value)
+            throw new Error(`Packaged ${key} does not match the release build.`);
+    }
+    const arches = (await execute(root, ["lipo", "-archs", path.join(app, "Contents/MacOS", info.CFBundleExecutable)], { capture: true })).trim().split(/\s+/);
+    if (arches.length !== 1 || arches[0] !== "arm64")
+        throw new Error("The prototype package must contain an arm64 app.");
+    await execute(root, ["codesign", "--verify", "--deep", "--strict", "--verbose=2", app], { capture: true });
+    const order = signingOrder(app);
+    const targets = await entitlementTargets(root, app, order, expected.entitlements, expected.byPath, execute);
+    for (const file of order) {
+        const signature = await execute(root, ["codesign", "-dvvv", file], { capture: true });
+        if (!signature.includes(`Authority=${credentials.name}\n`) || !signature.includes(`TeamIdentifier=${credentials.teamId}\n`) || !/flags=.*\bruntime\b/.test(signature) || !/^Timestamp=/m.test(signature)) {
+            throw new Error(`Invalid Developer ID signature, hardened runtime, or timestamp: ${file}`);
+        }
+        const signedEntitlements = await execute(root, ["codesign", "-d", "--entitlements", ":-", file], { capture: true });
+        // Inspect the final signature, not just the input entitlement file.
+        const xml = signedEntitlements.match(/<\?xml[\s\S]*?<\/plist>|<plist[\s\S]*?<\/plist>/)?.[0];
+        let actual = {};
+        if (xml) {
+            const plist = stateFile(root, "packaging/verified-entitlements.plist");
+            await writeFile(plist, xml);
+            actual = distributionEntitlements(JSON.parse(await execute(root, ["plutil", "-convert", "json", "-o", "-", plist], { capture: true })));
+        }
+        const desired = targets.get(file);
+        if (!isDeepStrictEqual(actual, desired))
+            throw new Error(`Signed entitlements do not match the release configuration: ${file}`);
+    }
+    if (notarized) {
+        await execute(root, ["xcrun", "stapler", "validate", app], { capture: true });
+        await execute(root, ["spctl", "--assess", "--type", "execute", "--verbose=4", app], { capture: true });
+    }
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/universal.cjs

@@ -0,0 +1,28 @@
+const fs = require("node:fs");
+const { readConfig, statePath, supportedPlatforms } = require("@legendapp/spark-desktop-config/config.cjs");
+
+exports.nativeConfig = root => {
+  const { expo } = readConfig(root);
+  const platform = expo.platforms[0];
+  const platforms = process.platform === "win32" ? {} : { windows: { npmPackageName: "react-native-windows" } };
+  // Expo autolinking and React Native codegen have separate exclusion inputs.
+  // An excluded desktop provider must not enter an iOS module registry either.
+  const excluded = (expo.autolinking?.exclude ?? []).map(name => [name, { platforms: { ios: null, macos: null, android: null, windows: null } }]);
+  if (!["macos", "windows"].includes(platform)) return { platforms, dependencies: Object.fromEntries(excluded) };
+  const file = statePath(root, "native-selection.json");
+  const selection = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, "utf8")) : { included: [], excluded: [] };
+  return { platforms, dependencies: Object.fromEntries([
+    ...selection.included.map(p => [p.name, { root: p.root }]),
+    ...selection.excluded.map(name => [name, { platforms: { ios: null, macos: null, android: null, windows: null } }]),
+    ...excluded,
+  ]) };
+};
+
+exports.metroConfig = root => {
+  const platform = readConfig(root).expo.platforms[0];
+  if ((process.env.SPARK_DEV_SESSION !== "1" || !supportedPlatforms(root).some(p => ["macos", "windows"].includes(p))) && ["ios", "android", "web"].includes(platform)) {
+    return require(require.resolve("expo/metro-config", { paths: [root] })).getDefaultConfig(root);
+  }
+  const config = require(require.resolve("expo-desktop-metro-config", { paths: [root] })).makeMetroConfig(root);
+  return require("./metro.cjs").withDesktop(config);
+};

package/vendor/node_modules/@legendapp/spark-cli/dist/updates.js

@@ -0,0 +1,110 @@
+import { writeFile } from "node:fs/promises";
+import { readAppConfig, writeUpdates } from "./project.js";
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { cpSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { sparkHome } from "./local.js";
+import { run } from "./commands.js";
+import { readJson, writeJson } from "./project.js";
+const { updateConfiguration } = createRequire(import.meta.url)("@legendapp/spark-desktop-config/updates.cjs");
+export const SPARKLE_VERSION = "2.9.6";
+const archiveHash = "52bf9e88cdd972fc0c81501377a880e90d47031bd8ca5462488f843e2609e192";
+export async function sparkleTools(root, execute = run) {
+    const directory = path.join(sparkHome(), "tools", `sparkle-${SPARKLE_VERSION}`);
+    if (existsSync(path.join(directory, "bin/generate_appcast")))
+        return path.join(directory, "bin");
+    const temporary = `${directory}-${crypto.randomUUID()}`;
+    mkdirSync(temporary, { recursive: true });
+    try {
+        console.log(`Downloading Sparkle ${SPARKLE_VERSION} release tools…`);
+        const response = await fetch(`https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz`, { signal: AbortSignal.timeout(120000) });
+        if (!response.ok)
+            throw new Error(`Sparkle tools download failed: HTTP ${response.status}`);
+        const bytes = new Uint8Array(await response.arrayBuffer());
+        if (createHash("sha256").update(bytes).digest("hex") !== archiveHash)
+            throw new Error("Sparkle tools archive checksum mismatch");
+        const archive = path.join(temporary, "tools.tar.xz");
+        await writeFile(archive, bytes);
+        await execute(root, ["tar", "-xJf", archive, "-C", temporary], { capture: true });
+        rmSync(archive);
+        try {
+            renameSync(temporary, directory);
+        }
+        catch (error) {
+            if (!existsSync(path.join(directory, "bin/generate_appcast")))
+                throw error;
+        }
+        return path.join(directory, "bin");
+    }
+    finally {
+        rmSync(temporary, { recursive: true, force: true });
+    }
+}
+function account(expo) { return `spark.${expo.extra?.spark?.projectId ?? expo.macos.bundleIdentifier}`; }
+export async function initializeUpdates(root, feedURL, execute = run) {
+    const config = readAppConfig(root);
+    // Validate the URL before creating a Keychain entry. This placeholder is public.
+    updateConfiguration({ extra: { spark: { updates: { feedURL, publicKey: Buffer.alloc(32).toString("base64") } } } });
+    const bin = await sparkleTools(root, execute);
+    await execute(root, [path.join(bin, "generate_keys"), "--account", account(config.expo)], { capture: true });
+    const publicKey = (await execute(root, [path.join(bin, "generate_keys"), "--account", account(config.expo), "-p"], { capture: true })).trim();
+    updateConfiguration({ extra: { spark: { updates: { feedURL, publicKey } } } });
+    if (config.expo.extra?.spark?.updates?.publicKey && config.expo.extra.spark.updates.publicKey !== publicKey)
+        throw new Error("This Mac's update key differs from the configured public key. Import the existing Sparkle key instead of replacing it.");
+    writeUpdates(root, { feedURL, publicKey });
+    console.log("Updates configured. The private key stays in Keychain. Import @legendapp/spark/updates and run spark package to generate a signed feed.");
+}
+export function verifyUpdateSignature(archive, signature, publicKey) {
+    const key = createPublicKey({ key: Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), Buffer.from(publicKey, "base64")]), format: "der", type: "spki" });
+    if (!/^[A-Za-z0-9+/]{86}==$/.test(signature) || !verify(null, readFileSync(archive), key, Buffer.from(signature, "base64")))
+        throw new Error("Update signature does not match the app's public key or archive");
+}
+export async function prepareUpdate(root, archive, buildVersion, dependencies = { run, tools: sparkleTools }) {
+    const expo = readAppConfig(root).expo;
+    const updates = updateConfiguration(expo);
+    if (!updates)
+        return undefined;
+    if (!/^[0-9]+(?:\.[0-9]+){0,2}$/.test(buildVersion))
+        throw new Error("Updates require a numeric macOS buildNumber, increasing for every release");
+    const directory = path.join(root, "dist/updates");
+    const recordsFile = path.join(directory, "releases.json");
+    const records = existsSync(recordsFile) ? readJson(recordsFile) : {};
+    const hash = createHash("sha256").update(readFileSync(archive)).digest("hex");
+    if (records[buildVersion] && records[buildVersion].sha256 !== hash)
+        throw new Error(`Build ${buildVersion} was already packaged with different bytes. Increase macos.buildNumber before publishing another update.`);
+    const bin = await dependencies.tools(root, dependencies.run);
+    const keyArgs = dependencies.keyFile ? ["--ed-key-file", dependencies.keyFile] : ["--account", account(expo)];
+    const signature = (await dependencies.run(root, [path.join(bin, "sign_update"), ...keyArgs, "-p", archive], { capture: true })).trim();
+    verifyUpdateSignature(archive, signature, updates.publicKey);
+    const staging = path.join(root, ".spark", `update-feed-${crypto.randomUUID()}`);
+    mkdirSync(staging, { recursive: true });
+    try {
+        if (existsSync(directory))
+            cpSync(directory, staging, { recursive: true });
+        const name = `${path.basename(archive, ".zip")}-build-${buildVersion}.zip`;
+        cpSync(archive, path.join(staging, name));
+        const url = new URL(updates.feedURL);
+        const feed = path.join(staging, path.basename(url.pathname));
+        await dependencies.run(root, [path.join(bin, "generate_appcast"), ...keyArgs, "--download-url-prefix", new URL(".", url).href, "--maximum-deltas", "0", "--maximum-versions", "0", "-o", feed, staging], { capture: true });
+        if (!existsSync(feed) || !readFileSync(feed, "utf8").includes(`sparkle:edSignature="${signature}"`))
+            throw new Error("Generated appcast did not include the signed update archive");
+        // Verify the signed feed using the same key; Sparkle verifies it in the app.
+        await dependencies.run(root, [path.join(bin, "sign_update"), ...keyArgs, "--verify", feed], { capture: true });
+        records[buildVersion] = { sha256: hash, archive: name };
+        writeJson(path.join(staging, "releases.json"), records);
+        mkdirSync(directory, { recursive: true });
+        // Publish archives before the feed, so a feed never points at incomplete bytes.
+        cpSync(path.join(staging, name), path.join(directory, name));
+        cpSync(path.join(staging, "releases.json"), recordsFile);
+        const target = path.join(directory, path.basename(feed));
+        const temporary = `${target}.${process.pid}.tmp`;
+        cpSync(feed, temporary);
+        renameSync(temporary, target);
+        console.log(`Signed update ready: ${target}\nUpload the ZIP and appcast to ${new URL(".", url).href}`);
+        return { feed: target, archive: path.join(directory, name) };
+    }
+    finally {
+        rmSync(staging, { recursive: true, force: true });
+    }
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/windows-associations.js

@@ -0,0 +1,45 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { existsSync, rmSync } from "node:fs";
+import { run } from "./commands.js";
+import { readAppConfig, readJson, stateFile, writeJson } from "./project.js";
+const knownTypes = { "public.plain-text": ["txt"], "public.text": ["txt"], "public.json": ["json"], "public.html": ["html", "htm"], "net.daringfireball.markdown": ["md", "markdown"], "public.png": ["png"], "public.jpeg": ["jpg", "jpeg"], "com.adobe.pdf": ["pdf"] };
+export function associationPlan(expo, executable) {
+    const project = expo.extra?.spark?.projectId;
+    if (typeof project !== "string" || !project)
+        throw new Error("Windows associations require project identity");
+    const appId = `Spark.${createHash("sha256").update(project).digest("hex")}`;
+    const protocols = [...new Set(expo.scheme === undefined ? [] : Array.isArray(expo.scheme) ? expo.scheme : [expo.scheme])];
+    for (const scheme of protocols)
+        if (!/^[a-z][a-z0-9+.-]*$/i.test(scheme))
+            throw new Error("Invalid association scheme");
+    const extensions = [];
+    for (const type of expo.extra?.spark?.documentTypes ?? []) {
+        const names = type.extensions ?? type.contentTypes?.flatMap((uti) => knownTypes[uti] ?? []);
+        if (!names?.length)
+            throw new Error(`Add extensions to document type ${type.name} for Windows; its UTIs have no known extension mapping`);
+        for (const name of names) {
+            if (typeof name !== "string" || !/^[a-z0-9][a-z0-9_-]{0,30}$/i.test(name))
+                throw new Error("Document extensions must be simple names without a dot");
+            extensions.push(name.toLowerCase());
+        }
+    }
+    if (!path.win32.isAbsolute(executable) || /["\r\n\0]/.test(executable))
+        throw new Error("Association executable must be an absolute Windows path");
+    return { appId, name: expo.name, executable, protocols, extensions: [...new Set(extensions)] };
+}
+export async function registerWindowsAssociations(root, app) {
+    const expo = readAppConfig(root).expo;
+    const plan = associationPlan(expo, path.join(app, "MyApp.exe"));
+    const file = stateFile(root, "windows-associations.json"), pending = `${file}.pending`;
+    const previous = existsSync(file) ? readJson(file) : undefined;
+    // Keep the last successful plan until registration and stale-entry cleanup succeed.
+    writeJson(pending, { ...plan, previous });
+    try {
+        await run(root, ["pwsh.exe", "-NoProfile", "-File", path.join(import.meta.dirname, "windows-associations.ps1"), "-PlanFile", pending], { capture: true });
+        writeJson(file, plan);
+    }
+    finally {
+        rmSync(pending, { force: true });
+    }
+}

package/vendor/node_modules/@legendapp/spark-cli/dist/windows-associations.ps1

@@ -0,0 +1,57 @@
+param([Parameter(Mandatory=$true)][string]$PlanFile, [switch]$Remove)
+$ErrorActionPreference = 'Stop'
+$plan = Get-Content -LiteralPath $PlanFile -Raw | ConvertFrom-Json
+$classes = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Software\Classes')
+try {
+  # Preflight every protocol before writing anything. Never replace another app.
+  foreach ($scheme in $plan.protocols) {
+    $key = $classes.OpenSubKey($scheme)
+    if ($key) {
+      try { if ($key.GetValue('SparkOwner') -ne $plan.appId) { throw "Protocol '$scheme' belongs to another app" } } finally { $key.Dispose() }
+    }
+  }
+  $command = '"' + $plan.executable + '" "%1"'
+  $progId = $plan.appId + '.Document'
+  if ($Remove) {
+    foreach ($scheme in $plan.protocols) { $classes.DeleteSubKeyTree($scheme, $false) }
+    foreach ($extension in $plan.extensions) {
+      $key = $classes.OpenSubKey('.' + $extension + '\OpenWithProgids', $true)
+      if ($key) { try { $key.DeleteValue($progId, $false) } finally { $key.Dispose() } }
+    }
+    $classes.DeleteSubKeyTree($progId, $false)
+  } else {
+    $key = $classes.CreateSubKey($progId)
+    try {
+      $key.SetValue('', [string]$plan.name); $key.SetValue('SparkOwner', [string]$plan.appId)
+      $open = $key.CreateSubKey('shell\open\command'); try { $open.SetValue('', $command) } finally { $open.Dispose() }
+    } finally { $key.Dispose() }
+    foreach ($extension in $plan.extensions) {
+      $key = $classes.CreateSubKey('.' + $extension + '\OpenWithProgids')
+      try { $key.SetValue($progId, [byte[]]@(), [Microsoft.Win32.RegistryValueKind]::None) } finally { $key.Dispose() }
+    }
+    foreach ($scheme in $plan.protocols) {
+      $key = $classes.CreateSubKey($scheme)
+      try {
+        $key.SetValue('', 'URL:' + $plan.name); $key.SetValue('URL Protocol', ''); $key.SetValue('SparkOwner', [string]$plan.appId)
+        $open = $key.CreateSubKey('shell\open\command'); try { $open.SetValue('', $command) } finally { $open.Dispose() }
+      } finally { $key.Dispose() }
+    }
+  }
+  # Remove only stale registrations still owned by this project's previous plan.
+  if ($plan.previous) {
+    foreach ($scheme in $plan.previous.protocols) {
+      if ($plan.protocols -contains $scheme) { continue }
+      $key = $classes.OpenSubKey($scheme)
+      $owned = $false
+      if ($key) { try { $owned = $key.GetValue('SparkOwner') -eq $plan.previous.appId } finally { $key.Dispose() } }
+      if ($owned) { $classes.DeleteSubKeyTree($scheme, $false) }
+    }
+    foreach ($extension in $plan.previous.extensions) {
+      if ($plan.extensions -contains $extension -and $plan.appId -eq $plan.previous.appId) { continue }
+      $key = $classes.OpenSubKey('.' + $extension + '\OpenWithProgids', $true)
+      if ($key) { try { $key.DeleteValue($plan.previous.appId + '.Document', $false) } finally { $key.Dispose() } }
+    }
+  }
+  Add-Type -TypeDefinition '[System.Runtime.InteropServices.DllImport("shell32.dll")] public static extern void SHChangeNotify(uint e, uint f, System.IntPtr a, System.IntPtr b);' -Name Shell -Namespace Spark
+  [Spark.Shell]::SHChangeNotify(0x08000000, 0, [IntPtr]::Zero, [IntPtr]::Zero)
+} finally { $classes.Dispose() }

package/vendor/node_modules/@legendapp/spark-cli/dist/windows-geometry.js

@@ -0,0 +1,33 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+const base = "::Microsoft::ReactNative::Composition::Experimental::IComponentViewInterop>";
+export function patchWindowsGeometry(source) {
+    if (source.includes("// SPARK GEOMETRY ABI"))
+        return source;
+    if (!source.includes(base) || !source.includes("  virtual RECT getClientRect() const noexcept;"))
+        throw new Error("The pinned RNW ComponentView changed; review the Spark geometry adapter before upgrading");
+    return source.replace('#include <ComponentView.Experimental.interop.h>', '#include <ComponentView.Experimental.interop.h>\n#include <SparkComponentGeometry.h>')
+        .replace(base, "::Microsoft::ReactNative::Composition::Experimental::IComponentViewInterop, ::ISparkComponentGeometry>")
+        .replace("  virtual RECT getClientRect() const noexcept;", `  virtual RECT getClientRect() const noexcept;
+  // SPARK GEOMETRY ABI
+  RECT __stdcall SparkClientRect() noexcept override { return getClientRect(); }
+  int64_t __stdcall SparkHitTest(float x, float y, float *localX, float *localY) noexcept override {
+    facebook::react::Point local;
+    const auto tag = hitTest({x, y}, local);
+    *localX = local.x; *localY = local.y; return tag;
+  }`);
+}
+export function prepareWindowsGeometry(root) {
+    const req = createRequire(path.join(root, "package.json"));
+    const manifest = req.resolve("react-native-windows/package.json");
+    if (JSON.parse(readFileSync(manifest, "utf8")).version !== "0.81.35")
+        throw new Error("spark's Windows geometry adapter requires react-native-windows 0.81.35");
+    const rnw = path.dirname(manifest), source = path.join(rnw, "Microsoft.ReactNative/Fabric/ComponentView.h");
+    const original = readFileSync(source, "utf8");
+    const patched = patchWindowsGeometry(original);
+    if (patched !== original)
+        writeFileSync(source, patched);
+    const header = readFileSync(createRequire(import.meta.url).resolve("@legendapp/spark-desktop-host/windows/SparkComponentGeometry.h"), "utf8");
+    writeFileSync(path.join(rnw, "Microsoft.ReactNative.Cxx/SparkComponentGeometry.h"), header);
+}