@livx.cc/appwrap 0.55.0 → 0.56.0

package/src/cli.ts

@@ -10,10 +10,10 @@
  */
 import { execFileSync, spawn, spawnSync } from 'child_process';
 import { createHash } from 'crypto';
-import { copyFileSync, cpSync, existsSync, mkdirSync, openSync, closeSync, readdirSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from 'fs';
+import { cpSync, existsSync, mkdirSync, openSync, closeSync, readdirSync, readFileSync, readSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from 'fs';
 import { builtinModules } from 'module';
 import { networkInterfaces, tmpdir } from 'os';
-import { basename, delimiter as pathDelimiter, dirname, extname, join, resolve } from 'path';
+import { basename, dirname, extname, join, resolve } from 'path';
 import { pathToFileURL } from 'url';
 // PURE-DATA capability manifest (no NativeScript globals) — type-only import (erased at runtime);
 // the VALUES are loaded dynamically below from the resolved runtime so the CLI works both in the
@@ -25,9 +25,9 @@ import type { AppwrapConfig } from './config';
 import { unknownConfigKeys } from './config';
 import { resolveModulePacks, type ResolvedModule, type SyncContext } from './packs';
 import { createHash } from 'crypto';
-import { buildInfoPlist, buildMacEntitlements, deriveDesktopConfig, parseMacProfile, resolveCargoPath, stampTauriConf } from './desktop';
-import type { DesktopShellConfig } from './desktop';
-import { APPLE_ICON_GRID_SCALE, makeDockRuntimeIcon } from './icon';
+// Icon helpers re-exported so the EE desktop lane (which owns the Tauri chassis) can reuse them via
+// `@livx.cc/appwrap/cli` — the CE/EE split (Phase D) moved the desktop lane out but keeps these shared.
+export { APPLE_ICON_GRID_SCALE, makeDockRuntimeIcon } from './icon';
 import {
   androidScreenOrientation,
   applyBuildNumberFlag,
@@ -98,27 +98,38 @@ const ANDROID_PERMISSION_KEYS: Record<string, string[]> = {
 };
 
 /** Resolve a bundled asset dir. A published tarball ships runtime/ + templates/ at the package root
- * (one level above src/); the monorepo resolves them at the repo root (three levels up). */
+ * (one level above src/); the monorepo resolves them at the repo root (three levels up). Returns the
+ * REAL path — a dev checkout may stage the package-root dir as a symlink to the repo-root source (what
+ * prepack does with a copy), and Bun's cpSync refuses a symlink as a copy-source root. */
 function resolveAssetRoot(rel: string): string {
   const local = resolve(import.meta.dir, '..', rel);
-  return existsSync(local) ? local : resolve(import.meta.dir, '../../..', rel);
+  const dir = existsSync(local) ? local : resolve(import.meta.dir, '../../..', rel);
+  try { return realpathSync(dir); } catch { return dir; }
 }
 const TEMPLATE_DIR = resolveAssetRoot('runtime');
 /** Ordered runtime-template roots copied into native/ (later roots overlay earlier — file-level
  * last-wins), defaulting to the single built-in template. runCli (A5) can extend this so a consumer
- * like appwrap-ee layers extra shell files on top of CE without forking the template. A single root
+ * (a host) layers extra shell files on top of CE without forking the template. A single root
  * is byte-identical to the pre-overlay behavior. */
 let TEMPLATE_ROOTS: string[] = [TEMPLATE_DIR];
 const CI_TEMPLATE_DIR = resolveAssetRoot('templates/ci');
 /** Scaffold for `appwrap create-module` — a starter module pack (see packs.ts / @livx.cc/appwrap/testing). */
 const MODULE_PACK_TEMPLATE_DIR = resolveAssetRoot('templates/module-pack');
-/** Desktop (Tauri chassis) template — phase-0, macOS-only. Its own generated wrapper (`native-desktop/`)
- * is disposable, like `native/`; the template stays canonical (edit here, regenerate propagates).
- * A `let` so runCli (A5) can point it at a host-provided template (e.g. appwrap-ee owns the desktop lane). */
-let DESKTOP_TEMPLATE_DIR = resolveAssetRoot('runtime-desktop');
+/** Desktop (Tauri chassis) template dir. CE ships no bundled desktop template — the desktop lane is
+ * host-owned: a consumer points this at its own template via `runCli({ desktopTemplateDir })` (A5).
+ * A `let` so runCli can override it; empty by default so the mobile lanes are unaffected. The desktop
+ * lane itself lives in the EE package (Phase D split) and reads this value via `getDesktopTemplateDir()`
+ * — CE keeps the seam (set by `runCli({ desktopTemplateDir })`) but ships no desktop code. */
+let DESKTOP_TEMPLATE_DIR = '';
+
+/** The desktop (Tauri) template dir set via `runCli({ desktopTemplateDir })`. Read by the EE desktop
+ * lane (hosted on top of CE through the `platforms` seam) so the seam stays authoritative in one place. */
+export function getDesktopTemplateDir(): string {
+  return DESKTOP_TEMPLATE_DIR;
+}
 
 /**
- * Composition seam for a HOST that wraps this CLI (appwrap-ee, or any consumer). Every field is
+ * Composition seam for a HOST that wraps this CLI (any consumer). Every field is
  * optional and no-op by default, so the bare `appwrap` bin behaves exactly as before. A host calls
  * `runCli({...})` to extend the CLI without forking it.
  */
@@ -127,8 +138,10 @@ export interface CliOptions {
    * switch, so a host can add a command or replace a built-in one. */
   commands?: Record<string, (cwd: string, flags: Record<string, string>, positionals: string[]) => Promise<void> | void>;
   /** Pluggable platform handlers for `dev`/`build` (keyed by the platform arg, e.g. 'desktop') —
-   * consulted BEFORE the built-in platform routing, so a host can add/replace a platform lane. */
-  platforms?: Record<string, (cwd: string, flags: Record<string, string>, positionals: string[]) => Promise<void> | void>;
+   * consulted BEFORE the built-in platform routing, so a host can add/replace a platform lane. The
+   * 4th arg is the driving command ('dev' | 'build') so a single handler (e.g. the EE desktop lane)
+   * can branch dev-vs-build — `dev desktop` and `build desktop` route to the SAME handler key. */
+  platforms?: Record<string, (cwd: string, flags: Record<string, string>, positionals: string[], command: 'dev' | 'build') => Promise<void> | void>;
   /** Module packs injected by the host, applied BEFORE the app config's own `modulePacks` (so the app
    * can still override them, last-wins). */
   modulePacks?: string[];
@@ -175,7 +188,7 @@ function packInfo(name: string): { source: string; packDir: string } | undefined
  * built-ins untouched → byte-identical) when the config declares no packs. Async because pack manifests
  * are dynamically imported; callers await it before the sync/regenerate pipeline. */
 async function applyModulePacks(cwd: string, cfg: AppwrapConfig): Promise<void> {
-  // Host-injected packs first (appwrap-ee's), then the app config's — so the app can override, last-wins.
+  // Host-injected packs first (the host's), then the app config's — so the app can override, last-wins.
   const refs = [...(cliOptions.modulePacks ?? []), ...(cfg.modulePacks ?? [])];
   if (refs.length === 0) {
     RESOLVED_MODULES = null;
@@ -324,7 +337,7 @@ const OPTIONAL_GROUP_HANDLERS: Record<string, { file: string; fn: string }> = {
   tracking: { file: './handlers-tracking', fn: 'registerTrackingHandlers' },
   appleSignIn: { file: './handlers-apple-signin', fn: 'registerAppleSignInHandlers' },
   backgroundTask: { file: './handlers-background', fn: 'registerBackgroundTaskHandlers' },
-  // billing/health/widget moved to appwrap-ee packs — their handlers stage from packages/ee/packs/*.
+  // billing/health/widget live in host-provided module packs (not part of CE) — a consumer opts in via modulePacks.
 };
 
 /** The bare specifier a pack handler uses to import a built-in shell API — rewritten to a relative
@@ -783,7 +796,7 @@ function resolveConfigPath(cwd: string, flags: Record<string, string>): string {
     : (CONFIG_CANDIDATES.map((f) => resolve(cwd, f)).find(existsSync) ?? resolve(cwd, CONFIG_CANDIDATES[0]));
 }
 
-async function loadConfig(cwd: string, flags: Record<string, string>): Promise<AppwrapConfig> {
+export async function loadConfig(cwd: string, flags: Record<string, string>): Promise<AppwrapConfig> {
   const configPath = resolveConfigPath(cwd, flags);
   if (!existsSync(configPath)) {
     console.error(`✖ Config not found — looked for ${CONFIG_CANDIDATES.join(' / ')} in ${cwd}`);
@@ -1620,7 +1633,7 @@ function stampAndroidVersion(outDir: string, cfg: AppwrapConfig): void {
 }
 
 /** Locate the icon source: explicit cfg.icon, else the largest icon in the PWA manifest. */
-function findIconSource(cwd: string, cfg: AppwrapConfig): string | null {
+export function findIconSource(cwd: string, cfg: AppwrapConfig): string | null {
   if (cfg.icon) {
     const p = resolve(cwd, cfg.icon);
     if (existsSync(p)) return p;
@@ -2265,12 +2278,11 @@ function openInspector(cfg: AppwrapConfig, flags: Record<string, string>, platfo
  */
 async function dev(cwd: string, flags: Record<string, string>, positionals: string[]): Promise<void> {
   const platform = positionals[0];
-  if (platform && cliOptions.platforms?.[platform]) return void await cliOptions.platforms[platform](cwd, flags, positionals);
-  if (platform === 'desktop') return devDesktop(cwd, flags);
+  if (platform && cliOptions.platforms?.[platform]) return void await cliOptions.platforms[platform](cwd, flags, positionals, 'dev');
   const sim = 'sim' in flags || positionals[1] === 'sim';
   const wantDebug = 'debug' in flags;
   if (platform !== 'ios' && platform !== 'android') {
-    console.error('Usage: appwrap dev <ios|android|desktop> [--sim] [--detached] [--debug] [--wifi] [--device <id|ip[:port]>] [--url <devserver>|--port <p>]');
+    console.error('Usage: appwrap dev <ios|android> [--sim] [--detached] [--debug] [--wifi] [--device <id|ip[:port]>] [--url <devserver>|--port <p>]');
     process.exit(1);
   }
   const cfg = await loadConfig(cwd, flags);
@@ -2643,553 +2655,12 @@ async function watchAndSync(cwd: string, flags: Record<string, string>, outDir:
  * Android signing comes from env (APPWRAP_ANDROID_KEYSTORE[_PASSWORD|_ALIAS|_ALIAS_PASSWORD]) — secrets
  * never live in the appwrap config. iOS distribution signing/upload is the fastlane release lane's job (the
  * cicd templates); `--release` here just builds the Release config for the device. */
-// ─────────────────────────────── desktop (Tauri chassis) lane ────────────────────────────────
-// Phase-0, macOS-only. Mirrors the managed-CNG model of the mobile lanes but far leaner: copy the
-// `runtime-desktop/` template into the app's disposable `native-desktop/`, stamp the app's identity +
-// window shape (shell_config.json, embedded into the Rust binary) and Tauri config (tauri.conf.json),
-// stage the built web dist, then `cargo run`/`build`. The template is canonical; `native-desktop/` is
-// gitignored + regenerated each run (framework edits propagate — same contract as `native/`).
-
-/** Fail clearly on non-macOS — the desktop chassis is macOS-only for phase-0 (osascript dialogs/
- * notifications, `open`, the app-data path are all macOS). */
-function ensureDesktopMacOS(): void {
-  if (process.platform !== 'darwin') {
-    console.error(`✖ appwrap desktop is macOS-only for now (phase-0). Detected platform: ${process.platform}.`);
-    process.exit(1);
-  }
-}
-
-/** Skip the heavy/generated dirs when copying the desktop template (Rust build output + Tauri codegen +
- * deps): they regenerate, and `target/` alone is GBs. Matches RELATIVE to the template root. */
-function desktopCopyFilter(src: string): boolean {
-  const rel = src.slice(DESKTOP_TEMPLATE_DIR.length);
-  return !/(^|\/)(target|gen|node_modules)(\/|$)/.test(rel);
-}
-
-/** Resolve a `desktop.server.command` to an absolute path: an absolute/relative path is resolved
- * against the app root; a bare name is looked up on `path` (build-time PATH). Falls back to the bare
- * name (the Rust shell will surface the spawn ENOENT) when it's nowhere. */
-function resolveServerCommand(command: string, cwd: string, path: string): string {
-  if (command.includes('/')) return resolve(cwd, command);
-  for (const dir of path.split(pathDelimiter).filter(Boolean)) {
-    const abs = join(dir, command);
-    if (existsSync(abs)) return abs;
-  }
-  return command;
-}
-
-/** The bundled splash shown while a local-server app boots (before the shell navigates to the live
- * server). A dependency-free, theme-neutral holding page. */
-function desktopSplashHtml(name: string): string {
-  const safe = name.replace(/</g, '&lt;').replace(/&/g, '&amp;');
-  return `<!doctype html><html><head><meta charset="utf-8"><title>${safe}</title>
-<style>html,body{height:100%;margin:0}body{display:flex;align-items:center;justify-content:center;
-flex-direction:column;gap:20px;background:#0b0b0f;color:#e5e5e5;font:14px -apple-system,system-ui,sans-serif}
-.s{width:34px;height:34px;border:3px solid #333;border-top-color:#888;border-radius:50%;animation:r .8s linear infinite}
-@keyframes r{to{transform:rotate(360deg)}}#e{color:#f87171;max-width:70%;text-align:center;line-height:1.5}</style>
-</head><body><div class="s" id="spin"></div><div id="m">Starting ${safe}…</div><div id="e"></div></body></html>`;
-}
-
-/** Copy the desktop template into `native-desktop/` and stamp it from the config: the Rust-read
- * `shell_config.json` (identity + window), `tauri.conf.json` (productName/version/identifier +
- * frontendDist), and the staged web dist (`native-desktop/dist`, referenced as `../dist`). */
-/**
- * Make `cfg.plugins` LIVE (A.1 loader): resolve each entry (path OR npm package), bun-build its
- * entrypoint to a single embedded file under `native-desktop/plugins/`, bun-build the multiplexed
- * plugin-host once, and stamp `{ pluginHost, plugins:[{bundleId, attachTo, bundlePath}] }` into the
- * shell config. The Rust shell (plugin_host.rs) spawns the host with the stamped plugins at boot.
- *
- * A.1 scope: manifest/perms/native-deps merge is STUBBED (noted) — full `capabilities.manifest.ts`
- * reuse (perms/entitlements union) lands later. `bundleId` here is the file/package basename (a
- * pre-load build id for the bundle filename only); the authoritative routing/diagnostic identifier is
- * the plugin def's `name`, which the host reads from the bundle after `import()`.
- */
-export function regeneratePlugins(cwd: string, cfg: AppwrapConfig, outDir: string, shell: DesktopShellConfig): void {
-  const entries = cfg.plugins ?? [];
-  if (entries.length === 0) return;
-  const outPlugins = join(outDir, 'plugins');
-  mkdirSync(outPlugins, { recursive: true });
-  const bun = process.execPath; // the CLI runs under bun → the exact runtime to build/spawn with
-
-  const bunBuild = (entrypoint: string, outfile: string): boolean => {
-    try {
-      execFileSync(bun, ['build', entrypoint, '--target=bun', '--outfile', outfile], { stdio: 'pipe' });
-      return true;
-    } catch (e: unknown) {
-      console.warn(`⚠ plugin bun-build failed (${entrypoint}): ${e instanceof Error ? e.message : String(e)}`);
-      return false;
-    }
-  };
-
-  // Build the host bundle once (from THIS package's src/plugin/host.ts).
-  const hostSrc = resolve(import.meta.dir, 'plugin', 'host.ts');
-  const hostOut = join(outPlugins, 'host.js');
-  if (!bunBuild(hostSrc, hostOut)) {
-    console.warn('⚠ plugin host failed to build — plugins disabled for this build.');
-    return;
-  }
-
-  const stamped: DesktopShellConfig['plugins'] = [];
-  for (const raw of entries) {
-    const name = typeof raw === 'string' ? raw : raw.name;
-    const attachTo = typeof raw === 'string' ? undefined : raw.attachTo;
-    // Resolve: an existing path (relative to the app root) wins; else treat as an npm package name.
-    let entrypoint = resolve(cwd, name);
-    if (!existsSync(entrypoint)) {
-      try {
-        entrypoint = (Bun as unknown as { resolveSync(id: string, parent: string): string }).resolveSync(name, cwd);
-      } catch {
-        console.warn(`⚠ plugin "${name}" not found (no such path, not resolvable as an npm package) — skipping.`);
-        continue;
-      }
-    }
-    const bundleId = name.replace(/[^a-zA-Z0-9_-]/g, '_');
-    const bundlePath = join(outPlugins, `${bundleId}.js`);
-    if (!bunBuild(entrypoint, bundlePath)) continue;
-    stamped.push({ bundleId, attachTo, bundlePath });
-    console.log(`  plugin ← ${name}  (attachTo: ${attachTo ?? 'def-declared'})`);
-  }
-
-  if (stamped.length > 0) {
-    shell.pluginHost = hostOut;
-    shell.plugins = stamped;
-    // TODO(A.x): read each plugin's `manifest` and merge perms/entitlements/native-deps via
-    // generateModuleArtifacts + capabilities.manifest.ts (plugins are manifest-compatible with modules).
-  }
-}
-
-function regenerateDesktop(cwd: string, cfg: AppwrapConfig, outDir: string, pushSigned = false): void {
-  if (!existsSync(DESKTOP_TEMPLATE_DIR)) {
-    console.error(`✖ Desktop template not found at ${DESKTOP_TEMPLATE_DIR}`);
-    process.exit(1);
-  }
-  const srcTauri = join(outDir, 'src-tauri');
-  mkdirSync(outDir, { recursive: true });
-  cpSync(DESKTOP_TEMPLATE_DIR, outDir, { recursive: true, force: true, filter: desktopCopyFilter });
-  // `native-desktop/` is generated + disposable (regenerated from the template on every build) — mark
-  // the whole tree git-invisible so a consuming repo never commits generated native code (incl. the
-  // copied `crates/` + `src-tauri/`). A self-ignoring `*` .gitignore works regardless of the app's root
-  // .gitignore; mirrors the mobile lane's disposable-`native/` convention. Written AFTER cpSync so it wins.
-  writeFileSync(join(outDir, '.gitignore'), '*\n');
-
-  const shell = deriveDesktopConfig(cfg);
-  shell.pushSigned = pushSigned;
-
-  // Stage the frontendDist INTO the wrapper (mirrors mobile copyPwa) so it's a stable relative path
-  // independent of where the app project sits. Local-server apps (`desktop.server`) have no meaningful
-  // web dist — the window loads the live server — so we stage a tiny bundled SPLASH instead (shown
-  // while the server boots, then the shell navigates away from it).
-  const stagedDist = join(outDir, 'dist');
-  rmSync(stagedDist, { recursive: true, force: true });
-  if (shell.server) {
-    mkdirSync(stagedDist, { recursive: true });
-    writeFileSync(join(stagedDist, 'index.html'), desktopSplashHtml(shell.name));
-  } else {
-    const dist = resolve(cwd, cfg.pwaDist);
-    if (!existsSync(dist)) {
-      console.error(`✖ Web dist not found at ${dist} — build the PWA first (or check pwaDist).`);
-      process.exit(1);
-    }
-    cpSync(dist, stagedDist, { recursive: true, force: true });
-  }
-
-  // Stage the app-owned browser sub-window chrome (‹ › ⟳ + address bar + profile▾) INTO the dist so
-  // `WebviewUrl::App("appwrap-browser-chrome.html")` resolves it (browser_tab::browser_subwindow_open).
-  const chromeSrc = join(DESKTOP_TEMPLATE_DIR, 'chrome', 'appwrap-browser-chrome.html');
-  if (existsSync(chromeSrc)) {
-    copyFileSync(chromeSrc, join(stagedDist, 'appwrap-browser-chrome.html'));
-  } else {
-    console.warn(`⚠ browser chrome not found at ${chromeSrc} — sub-window chrome will 404.`);
-  }
-
-  // Local-server mode: resolve `command` (bare name → PATH lookup) and `cwd` to ABSOLUTE, and stamp
-  // the build-time PATH — a GUI-launched .app inherits the minimal launchd PATH (no ~/.bun/bin), so
-  // a bare-name spawn (or a child that itself shells out to `bun`/`node`) would fail there.
-  if (shell.server) {
-    const s = shell.server;
-    s.cwd = s.cwd ? resolve(cwd, s.cwd) : cwd;
-    s.command = resolveServerCommand(s.command, cwd, process.env.PATH ?? '');
-    s.path = process.env.PATH ?? '';
-    if (!existsSync(s.command)) {
-      console.warn(`⚠ desktop.server.command not found (${s.command}) — the server will fail to spawn at launch.`);
-    }
-  }
-  // Resolve the handlers path to ABSOLUTE (against the app root): the shell binary runs from a
-  // different cwd, and for `build desktop` the .app runs from wherever it's installed — an absolute
-  // path is the only one that stays valid. The handler file is NOT copied into the wrapper/.app; the
-  // app dir (with its node_modules) must remain present at runtime (documented in the config type).
-  if (shell.handlers) {
-    const abs = resolve(cwd, shell.handlers);
-    if (!existsSync(abs)) {
-      console.warn(`⚠ desktop.handlers points to a missing file (${abs}) — the sidecar will not spawn.`);
-    }
-    shell.handlers = abs;
-    // Stamp the ABSOLUTE Bun binary the sidecar must be spawned with: the CLI itself runs under bun,
-    // so process.execPath IS the exact runtime the app was built with. A GUI-launched .app inherits
-    // the launchd PATH (no ~/.bun/bin), so the Rust shell can't rely on a bare `bun` lookup.
-    shell.handlersRuntime = process.execPath;
-  }
-  // Resolve + bun-build the configured plugins (make `cfg.plugins` LIVE). Runs BEFORE writing
-  // shell_config (and before applyOverrides, which happens after regenerateDesktop returns) so the
-  // stamped plugin bundles + host are embedded and the .app is self-contained.
-  regeneratePlugins(cwd, cfg, outDir, shell);
-  writeFileSync(join(srcTauri, 'shell_config.json'), JSON.stringify(shell, null, 2) + '\n');
-
-  const tauriConfPath = join(srcTauri, 'tauri.conf.json');
-  const template = JSON.parse(readFileSync(tauriConfPath, 'utf8')) as Record<string, unknown>;
-  const stamped = stampTauriConf(template, shell, '../dist'); // relative to src-tauri/
-  writeFileSync(tauriConfPath, JSON.stringify(stamped, null, 2) + '\n');
-
-  stampDesktopRuntimeIcon(cwd, cfg, join(srcTauri, 'icons', 'icon.png'));
-}
-
-/** Stamp the Tauri RUNTIME icon (`src-tauri/icons/icon.png`, embedded via `generate_context!`) from
- * the app's real icon — else it OVERRIDES the bundle icns/Assets.car in cmd+tab/Dock with the template
- * placeholder square. Downscale to 512 via sips → round the macOS app-icon corners + ensure RGBA (our
- * dependency-free codec) → write. On any failure, keep the template placeholder (Tauri needs *some*
- * RGBA icon.png to compile) and warn — never fail the build over an icon. */
-function stampDesktopRuntimeIcon(cwd: string, cfg: AppwrapConfig, destPng: string): void {
-  const source = findIconSource(cwd, cfg);
-  if (!source) return; // no cfg.icon / manifest icon → keep template placeholder
-  const tmpPng = join(tmpdir(), `appwrap-desktop-icon-${Date.now()}.png`);
-  try {
-    // Artwork at Apple's icon-grid fraction of the canvas, then pad — full-bleed runtime icons
-    // render visibly larger than bundle-masked Dock neighbors (no OS-applied margin/mask).
-    const art = Math.round(512 * APPLE_ICON_GRID_SCALE);
-    execFileSync('sips', ['-s', 'format', 'png', '-z', String(art), String(art), source, '--out', tmpPng], { stdio: 'ignore' });
-    writeFileSync(destPng, makeDockRuntimeIcon(readFileSync(tmpPng), 512));
-    console.log(`  desktop runtime icon ← ${source} (${art}² rounded on 512² canvas)`);
-  } catch (e: unknown) {
-    console.warn(`⚠ desktop runtime icon stamp failed (${e instanceof Error ? e.message : String(e)}) — keeping placeholder`);
-  } finally {
-    rmSync(tmpPng, { force: true });
-  }
-}
-
-/** Shared target dir for the desktop crate — reuse the template's warm `target/` so a stamped copy
- * builds incrementally (~seconds) instead of a ~4-min cold compile of the Tauri dep tree. */
-/** Resolve a spawnable `cargo` (bin + PATH-augmented env) for the desktop lane. rustup installs into
- * `~/.cargo/bin`, which a GUI/login shell often lacks on PATH → a bare spawn throws a raw ENOENT. We
- * append it when the binary lives there, else fail with an actionable install/source message. */
-function desktopCargo(): { bin: string; env: NodeJS.ProcessEnv } {
-  const home = process.env.HOME ?? '';
-  const res = resolveCargoPath({
-    path: process.env.PATH ?? '',
-    home,
-    delimiter: pathDelimiter,
-    hasCargo: (dir) => existsSync(join(dir, 'cargo')),
-  });
-  if (!res.found) {
-    console.error(
-      `✖ cargo not found on PATH${home ? ` (and no ${home}/.cargo/bin/cargo)` : ''}.\n` +
-        `  Install the Rust toolchain via rustup:  https://rustup.rs\n` +
-        `  If it's already installed, add it to this shell:  source "$HOME/.cargo/env"`
-    );
-    process.exit(1);
-  }
-  if (res.augmented) console.log(`  cargo ← ${home}/.cargo/bin (appended to PATH; not in your shell's PATH)`);
-  return {
-    bin: res.bin,
-    env: { ...process.env, PATH: res.path, CARGO_TARGET_DIR: join(DESKTOP_TEMPLATE_DIR, 'src-tauri/target') },
-  };
-}
-
-/** `appwrap dev desktop` — stamp the wrapper + `cargo run` (launches the window; blocks until closed). */
-async function devDesktop(cwd: string, flags: Record<string, string>): Promise<void> {
-  ensureDesktopMacOS();
-  const cfg = await loadConfig(cwd, flags);
-  const outDir = resolve(cwd, flags.out ?? 'native-desktop');
-  buildWebIfBundled(cwd, cfg, flags);
-  regenerateDesktop(cwd, cfg, outDir);
-  const { bin, env } = desktopCargo();
-  console.log(`▶ cargo run  (appwrap desktop shell — ${cfg.name})`);
-  execFileSync(bin, ['run'], { cwd: join(outDir, 'src-tauri'), stdio: 'inherit', env });
-}
-
-/** Generate `AppIcon.icns` from the app's icon PNG via `sips` + `iconutil` (macOS-only, like the whole
- * desktop lane). Returns the icns basename, or null when no icon source / tooling — skip gracefully. */
-function generateMacIcns(cwd: string, cfg: AppwrapConfig, resourcesDir: string): string | null {
-  const source = findIconSource(cwd, cfg);
-  if (!source) return null;
-  const iconset = join(tmpdir(), `appwrap-icns-${Date.now()}.iconset`);
-  mkdirSync(iconset, { recursive: true });
-  try {
-    for (const px of [16, 32, 128, 256, 512]) {
-      execFileSync('sips', ['-z', String(px), String(px), source, '--out', join(iconset, `icon_${px}x${px}.png`)], { stdio: 'ignore' });
-      execFileSync('sips', ['-z', String(px * 2), String(px * 2), source, '--out', join(iconset, `icon_${px}x${px}@2x.png`)], { stdio: 'ignore' });
-    }
-    execFileSync('iconutil', ['-c', 'icns', iconset, '-o', join(resourcesDir, 'AppIcon.icns')], { stdio: 'ignore' });
-    return 'AppIcon.icns';
-  } catch (e: unknown) {
-    console.warn(`⚠ icns generation failed (${e instanceof Error ? e.message : String(e)}) — .app ships without an icon`);
-    return null;
-  } finally {
-    rmSync(iconset, { recursive: true, force: true });
-  }
-}
-
-/** Compile a Tahoe-native `Assets.car` (+ its own `AppIcon.icns`) from the app's icon via `actool`,
- * into `resourcesDir`. macOS 26 (Tahoe) resolves a bundle's Finder/Dock icon through
- * `CFBundleIconName` + `Assets.car`, NOT the legacy top-level `.icns`. Returns the asset icon name
- * (`AppIcon`) on success, or null when there's no icon / `xcrun`/`actool` is unavailable or fails —
- * caller then keeps the iconutil `.icns` path (fine pre-26; Tahoe Finder icon may look generic). */
-function compileMacAssetsCar(cwd: string, cfg: AppwrapConfig, resourcesDir: string): string | null {
-  const source = findIconSource(cwd, cfg);
-  if (!source) return null;
-  const work = join(tmpdir(), `appwrap-actool-${Date.now()}`);
-  const xcassets = join(work, 'Assets.xcassets');
-  const iconset = join(xcassets, 'AppIcon.appiconset');
-  try {
-    mkdirSync(iconset, { recursive: true });
-    // 10 macOS reps: 16/32/128/256/512 pt at @1x and @2x.
-    const reps = [16, 32, 128, 256, 512].flatMap((pt) => [
-      { pt, scale: 1, px: pt },
-      { pt, scale: 2, px: pt * 2 },
-    ]);
-    const images = reps.map(({ pt, scale, px }) => {
-      const filename = `icon_${pt}x${pt}@${scale}x.png`;
-      execFileSync('sips', ['-s', 'format', 'png', '-z', String(px), String(px), source, '--out', join(iconset, filename)], { stdio: 'ignore' });
-      return { idiom: 'mac', size: `${pt}x${pt}`, scale: `${scale}x`, filename };
-    });
-    writeFileSync(join(iconset, 'Contents.json'), JSON.stringify({ images, info: { version: 1, author: 'appwrap' } }, null, 2));
-    writeFileSync(join(xcassets, 'Contents.json'), JSON.stringify({ info: { version: 1, author: 'appwrap' } }, null, 2));
-
-    const partialPlist = join(work, 'partial.plist');
-    execFileSync('xcrun', ['actool', xcassets,
-      '--compile', resourcesDir,
-      '--platform', 'macosx',
-      '--target-device', 'mac',
-      '--minimum-deployment-target', '11.0',
-      '--app-icon', 'AppIcon',
-      '--output-partial-info-plist', partialPlist,
-    ], { stdio: 'ignore' });
-
-    if (!existsSync(join(resourcesDir, 'Assets.car'))) throw new Error('actool produced no Assets.car');
-    return 'AppIcon';
-  } catch (e: unknown) {
-    console.warn(`⚠ actool Assets.car compile skipped (${e instanceof Error ? e.message : String(e)}) — Tahoe Finder icon may look generic; legacy .icns kept`);
-    return null;
-  } finally {
-    rmSync(work, { recursive: true, force: true });
-  }
-}
-
-/** Resolved macOS signing lane. `identity` is the cert SHA-1 hash (fed to codesign — unambiguous,
- * unlike a CN which can collide); `cn` is kept for logging; `kind` records the cert class. The
- * aps-environment is NOT derived from `kind` — it comes from the provisioning profile itself. */
-interface MacSigning { identity: string; cn: string; kind: 'developer-id' | 'development'; teamId: string }
-
-/** A matched macOS profile + its own aps-environment entitlement. */
-interface MacProfileMatch { path: string; apsEnvironment?: string }
-
-/** Resolve a real code-signing identity for the desktop lane. Team precedence mirrors stampTeamId:
- * non-placeholder cfg.teamId → $APPWRAP_TEAM_ID → none (adhoc). Identity preference within the team:
- * "Developer ID Application" (direct distribution) → "Apple Development" (local/dev). The CN of a
- * dev cert does NOT carry the team id — match via the certificate's OU field. Returns null (→ adhoc
- * fallback) when no team is set or no identity of either class belongs to it. */
-function resolveMacSigning(cfg: AppwrapConfig): MacSigning | null {
-  const teamId = (!cfg.teamId || /YOUR_APPLE_TEAM_ID|^$/.test(cfg.teamId))
-    ? process.env.APPWRAP_TEAM_ID?.trim() || null
-    : cfg.teamId;
-  if (!teamId) return null;
-  let listing = '';
-  try {
-    listing = execFileSync('security', ['find-identity', '-v', '-p', 'codesigning'], { encoding: 'utf8' });
-  } catch { return null; }
-  // find-identity -v lines: `  1) <40-hex-SHA1> "<CN>"`. Capture BOTH — codesign is fed the hash.
-  const entries = [...listing.matchAll(/\b([0-9A-F]{40})\s+"([^"]+)"/g)].map((m) => ({ hash: m[1], cn: m[2] }));
-  const teamOf = (cn: string): string | null => {
-    try {
-      const pem = execFileSync('security', ['find-certificate', '-c', cn, '-p'], { encoding: 'utf8' });
-      const subject = execFileSync('openssl', ['x509', '-noout', '-subject'], { input: pem, encoding: 'utf8' });
-      return subject.match(/OU\s*=\s*([A-Z0-9]{10})/)?.[1] ?? null;
-    } catch { return null; }
-  };
-  for (const prefix of ['Developer ID Application', 'Apple Development'] as const) {
-    const match = entries.find((e) => e.cn.startsWith(prefix) && teamOf(e.cn) === teamId);
-    if (match) return { identity: match.hash, cn: match.cn, kind: prefix === 'Developer ID Application' ? 'developer-id' : 'development', teamId };
-  }
-  return null;
-}
-
-/** Find an installed, unexpired macOS provisioning profile for `<teamId>.<bundleId>`. macOS profiles
- * are `.provisionprofile` (same CMS envelope as iOS `.mobileprovision`; findProvisioningProfiles only
- * scans the latter, so this is the mac twin). Returns the file path, or null (→ sign without the
- * restricted push entitlement — a restricted entitlement with no embedded profile kills the app at
- * launch, which is strictly worse than a signed app without push). */
-function findMacProvisionProfile(teamId: string, bundleId: string, signingCertHash?: string): MacProfileMatch | null {
-  const dirs = [
-    join(process.env.HOME ?? '', 'Library/MobileDevice/Provisioning Profiles'),
-    join(process.env.HOME ?? '', 'Library/Developer/Xcode/UserData/Provisioning Profiles'),
-  ];
-  const wanted = signingCertHash?.toUpperCase();
-  for (const dir of dirs) {
-    if (!existsSync(dir)) continue;
-    let files: string[] = [];
-    try { files = readdirSync(dir).filter((f) => f.endsWith('.provisionprofile')); } catch { continue; }
-    for (const f of files) {
-      try {
-        const raw = execFileSync('security', ['cms', '-D', '-i', join(dir, f)],
-          { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
-        const info = parseMacProfile(raw);
-        const { teamId: team, appId, expiration } = info;
-        if (team !== teamId || !appId) continue;
-        if (expiration && Date.parse(expiration) < Date.now()) continue;
-        const profBundle = appId.startsWith(team + '.') ? appId.slice(team.length + 1) : appId;
-        if (profBundle !== bundleId && profBundle !== '*') continue;
-        // The chosen signing cert MUST be one the profile authorizes (DER SHA-1 == find-identity hash),
-        // else codesign succeeds but the app launch is rejected. Mismatch → warn + keep scanning.
-        if (wanted) {
-          const authorized = info.certificates.some(
-            (b64) => createHash('sha1').update(Buffer.from(b64, 'base64')).digest('hex').toUpperCase() === wanted,
-          );
-          if (!authorized) {
-            console.log(`  ⚠ profile ${f} does not authorize the chosen signing certificate — skipping`);
-            continue;
-          }
-        }
-        return { path: join(dir, f), apsEnvironment: info.apsEnvironment };
-      } catch { /* skip unreadable profile */ }
-    }
-  }
-  return null;
-}
-
-/** Assemble a double-clickable `<Name>.app` around the built shell binary. The Info.plist's
- * CFBundleURLTypes is what registers `urlScheme` with LaunchServices — a bare binary can't receive
- * `<scheme>://…` opens (tauri-plugin-deep-link needs the bundle). Signed with a real identity +
- * entitlements + embedded profile when teamId resolves (resolveMacSigning); ad-hoc otherwise. */
-function assembleMacApp(cwd: string, cfg: AppwrapConfig, shell: DesktopShellConfig, outDir: string, binary: string,
-  lane?: { signing: MacSigning | null; profile: MacProfileMatch | null }): string {
-  const appDir = join(outDir, 'dist-app', `${shell.name}.app`);
-  const macosDir = join(appDir, 'Contents/MacOS');
-  const resourcesDir = join(appDir, 'Contents/Resources');
-  rmSync(appDir, { recursive: true, force: true });
-  mkdirSync(macosDir, { recursive: true });
-  mkdirSync(resourcesDir, { recursive: true });
-  cpSync(binary, join(macosDir, shell.name));
-  const iconFile = generateMacIcns(cwd, cfg, resourcesDir) ?? undefined;
-  // Also compile a Tahoe-native Assets.car (macOS 26 reads CFBundleIconName/Assets.car, not the .icns).
-  // actool emits its own AppIcon.icns alongside — let it replace the iconutil one when present.
-  const iconName = compileMacAssetsCar(cwd, cfg, resourcesDir) ?? undefined;
-  writeFileSync(join(appDir, 'Contents/Info.plist'), buildInfoPlist(shell, shell.name, iconFile, iconName));
-  const signing = lane ? lane.signing : resolveMacSigning(cfg);
-  if (signing) {
-    // Signed lane: real identity; when an installed macOS profile matches, embed it and claim the
-    // push entitlement (restricted → only launches profile-backed). Developer ID gets the hardened
-    // runtime (notarization prerequisite; harmless otherwise).
-    const profile = lane ? lane.profile : findMacProvisionProfile(signing.teamId, shell.identifier, signing.identity);
-    if (profile) cpSync(profile.path, join(appDir, 'Contents/embedded.provisionprofile'));
-    else console.log(`  ⓘ no macOS provisioning profile installed for ${signing.teamId}.${shell.identifier} — signing without entitlements (cert only)`);
-    // aps-environment comes from the PROFILE's own entitlement, not the cert kind — a Developer ID cert
-    // paired with a development profile must claim `development`, or the app is killed at launch.
-    const aps = profile?.apsEnvironment;
-    if (profile && aps !== 'development' && aps !== 'production') {
-      console.log(`  ⓘ profile has no aps-environment entitlement — signing without push`);
-    }
-    const args = ['--force', '--deep', '-s', signing.identity];
-    // Entitlements ONLY when a profile backs them: application-identifier/team-identifier are
-    // RESTRICTED — claiming them without an embedded profile makes macOS refuse to launch the app
-    // ("can't be opened"). No profile → plain cert signature (launches fine, no push).
-    if (profile) {
-      const entitlements = buildMacEntitlements({
-        teamId: signing.teamId,
-        bundleId: shell.identifier,
-        apsEnvironment: aps === 'development' || aps === 'production' ? aps : undefined,
-      });
-      const entFile = join(outDir, 'dist-app', `${shell.name}.entitlements`);
-      writeFileSync(entFile, entitlements);
-      args.push('--entitlements', entFile);
-    }
-    if (signing.kind === 'developer-id') args.push('--options', 'runtime', '--timestamp');
-    console.log(`▶ codesign (${signing.cn} [${signing.identity}]${profile ? ', profile embedded' : ''})`);
-    execFileSync('codesign', [...args, appDir], { stdio: 'inherit' });
-  } else {
-    // Ad-hoc sign so Gatekeeper/LaunchServices treat the bundle as intact on this machine.
-    // Only flag a skip when a REAL team was requested (placeholder teamId = signing never asked for).
-    const requested = process.env.APPWRAP_TEAM_ID?.trim() || (cfg.teamId && !/YOUR_APPLE_TEAM_ID|^$/.test(cfg.teamId) ? cfg.teamId : '');
-    if (requested) console.log(`  ⓘ signed lane skipped — no Developer ID / Apple Development identity for team ${requested}; ad-hoc signing`);
-    execFileSync('codesign', ['--force', '--deep', '-s', '-', appDir], { stdio: 'inherit' });
-  }
-  return appDir;
-}
-
-/** Opt-in notarization (env `APPWRAP_NOTARIZE=1`, off by default). Requires the Developer ID signed
- * lane — assembleMacApp already signs it with `--options runtime --timestamp` (hardened runtime +
- * secure timestamp, both notarization prerequisites; no get-task-allow is ever claimed). Credentials:
- * `APPWRAP_NOTARY_KEYCHAIN_PROFILE` (a `notarytool store-credentials` profile) or an ASC API key —
- * `APPWRAP_NOTARY_KEY_ID` + `APPWRAP_NOTARY_ISSUER` (+ optional `APPWRAP_NOTARY_KEY` p8 path,
- * default ~/.appstoreconnect/private_keys/AuthKey_<id>.p8). */
-function notarizeMacApp(appDir: string, signing: MacSigning | null): void {
-  if (process.env.APPWRAP_NOTARIZE !== '1') return;
-  if (!signing || signing.kind !== 'developer-id') {
-    console.error(`✖ APPWRAP_NOTARIZE=1 needs a Developer ID signed .app (current lane: ${signing ? signing.kind : 'ad-hoc'}) — install a "Developer ID Application" identity for the team and rebuild`);
-    process.exit(1);
-  }
-  const kcProfile = process.env.APPWRAP_NOTARY_KEYCHAIN_PROFILE?.trim();
-  const keyId = process.env.APPWRAP_NOTARY_KEY_ID?.trim();
-  const issuer = process.env.APPWRAP_NOTARY_ISSUER?.trim();
-  const keyPath = process.env.APPWRAP_NOTARY_KEY?.trim()
-    || (keyId ? join(process.env.HOME ?? '', `.appstoreconnect/private_keys/AuthKey_${keyId}.p8`) : '');
-  let auth: string[];
-  if (kcProfile) auth = ['--keychain-profile', kcProfile];
-  else if (keyId && issuer) {
-    if (!existsSync(keyPath)) {
-      console.error(`✖ notarization: ASC API key file not found at ${keyPath} (set APPWRAP_NOTARY_KEY to the .p8 path)`);
-      process.exit(1);
-    }
-    auth = ['--key', keyPath, '--key-id', keyId, '--issuer', issuer];
-  } else {
-    console.error('✖ APPWRAP_NOTARIZE=1 but no credentials — set APPWRAP_NOTARY_KEY_ID + APPWRAP_NOTARY_ISSUER (ASC API key) or APPWRAP_NOTARY_KEYCHAIN_PROFILE (notarytool store-credentials)');
-    process.exit(1);
-  }
-  const zip = `${appDir}.notarize.zip`;
-  rmSync(zip, { force: true });
-  execFileSync('ditto', ['-c', '-k', '--keepParent', appDir, zip], { stdio: 'inherit' });
-  console.log('▶ notarytool submit --wait  (Apple-side processing — can take several minutes)');
-  try {
-    execFileSync('xcrun', ['notarytool', 'submit', zip, ...auth, '--wait'], { stdio: 'inherit' });
-    execFileSync('xcrun', ['stapler', 'staple', appDir], { stdio: 'inherit' });
-  } finally {
-    rmSync(zip, { force: true });
-  }
-  console.log(`✓ Notarized + stapled: ${appDir}`);
-}
-
-/** `appwrap build desktop` — stamp the wrapper, `cargo build --release`, then assemble the `.app`. */
-async function buildDesktop(cwd: string, flags: Record<string, string>): Promise<void> {
-  ensureDesktopMacOS();
-  const cfg = await loadConfig(cwd, flags);
-  const outDir = resolve(cwd, flags.out ?? 'native-desktop');
-  // Local-server apps load the live server, not a bundled web build — skip it (regenerateDesktop
-  // stages a boot splash for them). Otherwise build/stage the PWA as usual.
-  if (!cfg.desktop?.server) buildWebIfBundled(cwd, cfg, flags);
-  // Resolve the signing lane BEFORE regeneration: shell_config.json is embedded at compile time,
-  // and the Rust shell's push capability must only claim 'native' when the .app really ships the
-  // profile-backed aps-environment entitlement (signed lane + installed macOS profile).
-  const signing = resolveMacSigning(cfg);
-  const shellCfg = deriveDesktopConfig(cfg);
-  const profile = signing ? findMacProvisionProfile(signing.teamId, shellCfg.identifier, signing.identity) : null;
-  // Only let the Rust shell claim NATIVE push when the app will actually ship a profile-backed
-  // aps-environment entitlement (profile matched AND it carries the entitlement).
-  const nativePush = !!(signing && profile && (profile.apsEnvironment === 'development' || profile.apsEnvironment === 'production'));
-  regenerateDesktop(cwd, cfg, outDir, nativePush);
-  const { bin, env } = desktopCargo();
-  console.log(`▶ cargo build --release  (appwrap desktop shell — ${cfg.name})`);
-  execFileSync(bin, ['build', '--release'], { cwd: join(outDir, 'src-tauri'), stdio: 'inherit', env });
-  const binary = join(DESKTOP_TEMPLATE_DIR, 'src-tauri/target/release/appwrap-desktop-shell');
-  console.log(`✓ Desktop binary: ${binary}`);
-  const appDir = assembleMacApp(cwd, cfg, shellCfg, outDir, binary, { signing, profile });
-  console.log(`✓ App bundle: ${appDir}`);
-  notarizeMacApp(appDir, signing);
-}
 
 async function build(cwd: string, flags: Record<string, string>, positionals: string[]): Promise<void> {
   const platform = positionals[0];
-  if (platform && cliOptions.platforms?.[platform]) return void await cliOptions.platforms[platform](cwd, flags, positionals);
-  if (platform === 'desktop') return buildDesktop(cwd, flags);
+  if (platform && cliOptions.platforms?.[platform]) return void await cliOptions.platforms[platform](cwd, flags, positionals, 'build');
   if (platform !== 'ios' && platform !== 'android') {
-    console.error('Usage: appwrap build <ios|android|desktop> [--release] [--aab] [--config <path>] [--out native]');
+    console.error('Usage: appwrap build <ios|android> [--release] [--aab] [--config <path>] [--out native]');
     process.exit(1);
   }
   const outDir = resolve(cwd, flags.out ?? 'native');
@@ -3584,7 +3055,7 @@ function buildInputStats(cwd: string, cfg: { pwaDist?: string; overrides?: strin
   const overridesDir = resolve(cwd, cfg.overrides ?? 'appwrap.overrides');
   const stats = [mtimeStats(distDir), mtimeStats(overridesDir), mtimeStats(resolveConfigPath(cwd, flags))];
   // The appwrap runtime template(s) — bundled into bundle.js, so a first-class build input. Every
-  // overlay root counts, so editing a host-provided (e.g. appwrap-ee) template file busts the cache.
+  // overlay root counts, so editing a host-provided template file busts the cache.
   let runtime = 0, runtimeNewest = 0;
   for (const root of TEMPLATE_ROOTS) {
    if (!existsSync(root)) continue;
@@ -3810,7 +3281,7 @@ function detectWebBuildCmd(cwd: string, cfg: AppwrapConfig): string[] | null {
  * app loads the live serverUrl, so its dist is unused (building it would be wasteful + misleading).
  * Prints exactly what it's doing either way. `--no-web-build` skips it (ship the current dist as-is,
  * e.g. to hit the native build-skip fast-path when only the wrapper changed). */
-function buildWebIfBundled(cwd: string, cfg: AppwrapConfig, flags: Record<string, string>): void {
+export function buildWebIfBundled(cwd: string, cfg: AppwrapConfig, flags: Record<string, string>): void {
   if ((cfg.loader ?? 'app') === 'server') {
     console.log('ℹ loader:server — NOT building the web (the app loads serverUrl live; the bundle is unused).');
     return;
@@ -4558,7 +4029,7 @@ async function createModule(cwd: string, flags: Record<string, string>, position
 
 /**
  * The CLI entry point — the bare `appwrap` bin calls `runCli()` with no options (identical to the
- * historical `main`). A host (appwrap-ee) calls `runCli({ commands, platforms, modulePacks,
+ * historical `main`). A host calls `runCli({ commands, platforms, modulePacks,
  * templateRoots, desktopTemplateDir })` to compose extra capability on top of CE without forking it.
  */
 export async function runCli(options: CliOptions = {}): Promise<void> {
@@ -4620,11 +4091,10 @@ export async function runCli(options: CliOptions = {}): Promise<void> {
         '  Android wireless: --wifi flips a USB device to wireless adb (unplug + keep going); thereafter the\n' +
         '       device is auto-discovered via mDNS — plain `dev android` finds it with NO flag (iOS parity).\n' +
         '       --device <ip[:port]> `adb connect`s an already-paired one.\n\n' +
-        '  dev <ios|android|desktop> [--sim] [--detached] [--debug] [--wifi] [--url <devserver>|--port <p>]\n' +
+        '  dev <ios|android> [--sim] [--detached] [--debug] [--wifi] [--url <devserver>|--port <p>]\n' +
         '       live-dev: ANDROID device → ns run livesync (true on-device HMR) + re-stage on save;\n' +
         '       iOS device → deploy + rebuild/reinstall on save. --sim = ns run/HMR on emulator;\n' +
         '       --url/--port = web HMR from a dev server inside the WebView; --detached = install & exit.\n' +
-        '       desktop → macOS Tauri shell (cargo run) speaking appwrap protocol v1 (phase-0, macOS-only).\n' +
         '  deploy <ios|android> [--no-launch] [--no-web-build] [-f]   (clean ship-once: build → install → launch → exit)\n' +
         '  publish <ios|android> [prod]              (beta: TestFlight / Play internal. prod: App Store / Play production)\n' +
         '  build <ios|android> [--release] [--aab]   (store artifact only — no install/upload)\n' +