@sriinnu/runic 1.0.0

package/Scripts/docs-list.mjs

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+import { readdirSync, readFileSync } from 'node:fs';
+import { dirname, join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DOCS_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'docs');
+const EXCLUDED_DIRS = new Set(['archive', 'research']);
+
+function walkMarkdownFiles(dir, base = dir) {
+  const entries = readdirSync(dir, { withFileTypes: true });
+  const files = [];
+
+  for (const entry of entries) {
+    if (entry.name.startsWith('.')) continue;
+    const fullPath = join(dir, entry.name);
+
+    if (entry.isDirectory()) {
+      if (EXCLUDED_DIRS.has(entry.name)) continue;
+      files.push(...walkMarkdownFiles(fullPath, base));
+    } else if (entry.isFile() && entry.name.endsWith('.md')) {
+      files.push(relative(base, fullPath));
+    }
+  }
+
+  return files.sort((a, b) => a.localeCompare(b));
+}
+
+function extractMetadata(fullPath) {
+  const content = readFileSync(fullPath, 'utf8');
+
+  if (!content.startsWith('---')) {
+    return { summary: null, readWhen: [], error: 'missing front matter' };
+  }
+
+  const endIndex = content.indexOf('\n---', 3);
+  if (endIndex === -1) {
+    return { summary: null, readWhen: [], error: 'unterminated front matter' };
+  }
+
+  const frontMatter = content.slice(3, endIndex).trim();
+  const lines = frontMatter.split('\n');
+
+  let summaryLine = null;
+  const readWhen = [];
+  let collectingReadWhen = false;
+
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+
+    if (line.startsWith('summary:')) {
+      summaryLine = line;
+      collectingReadWhen = false;
+      continue;
+    }
+
+    if (line.startsWith('read_when:')) {
+      collectingReadWhen = true;
+      const inline = line.slice('read_when:'.length).trim();
+      if (inline.startsWith('[') && inline.endsWith(']')) {
+        try {
+          const parsed = JSON.parse(inline.replace(/'/g, '"'));
+          if (Array.isArray(parsed)) {
+            parsed
+              .map((v) => String(v).trim())
+              .filter(Boolean)
+              .forEach((v) => readWhen.push(v));
+          }
+        } catch {
+          /* ignore malformed inline */
+        }
+      }
+      continue;
+    }
+
+    if (collectingReadWhen) {
+      if (line.startsWith('- ')) {
+        const hint = line.slice(2).trim();
+        if (hint) readWhen.push(hint);
+      } else if (line === '') {
+        // allow blank spacer lines inside list
+      } else {
+        collectingReadWhen = false;
+      }
+    }
+  }
+
+  if (!summaryLine) {
+    return { summary: null, readWhen, error: 'summary key missing' };
+  }
+
+  const summaryValue = summaryLine.slice('summary:'.length).trim();
+  const normalized = summaryValue.replace(/^['"]|['"]$/g, '').replace(/\s+/g, ' ').trim();
+
+  if (!normalized) {
+    return { summary: null, readWhen, error: 'summary is empty' };
+  }
+
+  return { summary: normalized, readWhen };
+}
+
+console.log('Listing all markdown files in docs folder:');
+
+const markdownFiles = walkMarkdownFiles(DOCS_DIR);
+
+for (const relativePath of markdownFiles) {
+  const fullPath = join(DOCS_DIR, relativePath);
+  const { summary, readWhen, error } = extractMetadata(fullPath);
+  if (summary) {
+    console.log(`${relativePath} - ${summary}`);
+    if (readWhen.length > 0) {
+      console.log(`  Read when: ${readWhen.join('; ')}`);
+    }
+  } else {
+    const reason = error ? ` - [${error}]` : '';
+    console.log(`${relativePath}${reason}`);
+  }
+}
+
+console.log('\nReminder: keep docs up to date as behavior changes. When your task matches any "Read when" hint above (React hooks, cache directives, database work, tests, etc.), read that doc before coding, and suggest new coverage when it is missing.');

package/Scripts/make_appcast.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+ZIP=${1:?
+"Usage: $0 Runic-<ver>.zip"}
+FEED_URL=${2:-"https://raw.githubusercontent.com/sriinnu/Runic/main/appcast.xml"}
+PRIVATE_KEY_FILE=${SPARKLE_PRIVATE_KEY_FILE:-}
+if [[ -z "$PRIVATE_KEY_FILE" ]]; then
+  echo "Set SPARKLE_PRIVATE_KEY_FILE to your ed25519 private key (Sparkle)." >&2
+  exit 1
+fi
+if [[ ! -f "$ZIP" ]]; then
+  echo "Zip not found: $ZIP" >&2
+  exit 1
+fi
+
+ZIP_DIR=$(cd "$(dirname "$ZIP")" && pwd)
+ZIP_NAME=$(basename "$ZIP")
+ZIP_BASE="${ZIP_NAME%.zip}"
+VERSION=${SPARKLE_RELEASE_VERSION:-}
+if [[ -z "$VERSION" ]]; then
+  if [[ "$ZIP_NAME" =~ ^Runic-([0-9]+(\.[0-9]+){1,2}([-.][^.]*)?)\.zip$ ]]; then
+    VERSION="${BASH_REMATCH[1]}"
+  else
+    echo "Could not infer version from $ZIP_NAME; set SPARKLE_RELEASE_VERSION." >&2
+    exit 1
+  fi
+fi
+
+NOTES_HTML="${ZIP_DIR}/${ZIP_BASE}.html"
+KEEP_NOTES=${KEEP_SPARKLE_NOTES:-0}
+if [[ -x "$ROOT/Scripts/changelog-to-html.sh" ]]; then
+  "$ROOT/Scripts/changelog-to-html.sh" "$VERSION" >"$NOTES_HTML"
+else
+  echo "Missing Scripts/changelog-to-html.sh; cannot generate HTML release notes." >&2
+  exit 1
+fi
+if [[ "$KEEP_NOTES" != "1" ]]; then
+  trap 'rm -f "$NOTES_HTML"' EXIT
+fi
+
+DOWNLOAD_URL_PREFIX=${SPARKLE_DOWNLOAD_URL_PREFIX:-"https://github.com/sriinnu/Runic/releases/download/v${VERSION}/"}
+
+# Sparkle provides generate_appcast; ensure it's on PATH (via SwiftPM build of Sparkle's bin) or Xcode dmg
+if ! command -v generate_appcast >/dev/null; then
+  echo "generate_appcast not found in PATH. Install Sparkle tools (see Sparkle docs)." >&2
+  exit 1
+fi
+
+generate_appcast \
+  --ed-key-file "$PRIVATE_KEY_FILE" \
+  --download-url-prefix "$DOWNLOAD_URL_PREFIX" \
+  --embed-release-notes \
+  --link "$FEED_URL" \
+  "$ZIP_DIR"
+
+echo "Appcast generated (appcast.xml). Upload alongside $ZIP at $FEED_URL"

package/Scripts/package_app.sh

@@ -0,0 +1,409 @@
+#!/usr/bin/env bash
+set -euo pipefail
+CONF=${1:-release}
+ALLOW_LLDB=${CODEXBAR_ALLOW_LLDB:-0}
+SIGNING_MODE=${RUNIC_SIGNING:-${CODEXBAR_SIGNING:-}}
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+cd "$ROOT"
+
+# Public-facing app name. (We keep SwiftPM target/module names as-is to avoid a massive refactor.)
+APP_NAME="Runic"
+
+# Local signing overrides (kept out of git).
+for LOCAL_ENV in "${HOME}/.config/runic/local.env" "${ROOT}/.runic.local.env"; do
+  if [[ -f "$LOCAL_ENV" ]]; then
+    # shellcheck disable=SC1090
+    source "$LOCAL_ENV"
+    break
+  fi
+done
+
+# Load version info
+source "$ROOT/version.env"
+
+BUILD_ROOT="${RUNIC_BUILD_ROOT:-$ROOT/builds/versions}"
+DEFAULT_BUILD_LABEL="athena-runic-${MARKETING_VERSION}-${BUILD_NUMBER}"
+BUILD_LABEL="${RUNIC_BUILD_LABEL:-$DEFAULT_BUILD_LABEL}"
+STABLE_BUILD_DIR="${RUNIC_STABLE_BUILD_DIR:-0}"
+BUILD_DIR="${BUILD_ROOT}/${BUILD_LABEL}"
+if [[ "$STABLE_BUILD_DIR" != "1" && -d "$BUILD_DIR" ]]; then
+  suffix=1
+  while [[ -d "${BUILD_DIR}-${suffix}" ]]; do
+    suffix=$((suffix + 1))
+  done
+  BUILD_DIR="${BUILD_DIR}-${suffix}"
+fi
+mkdir -p "$BUILD_DIR"
+
+# Clean build only when explicitly requested (slower).
+if [[ "${CODEXBAR_FORCE_CLEAN:-0}" == "1" ]]; then
+  if [[ -d "$ROOT/.build" ]]; then
+    if command -v trash >/dev/null 2>&1; then
+      if ! trash "$ROOT/.build"; then
+        echo "WARN: trash .build failed; continuing with swift package clean." >&2
+      fi
+    else
+      rm -rf "$ROOT/.build" || echo "WARN: rm -rf .build failed; continuing with swift package clean." >&2
+    fi
+  fi
+  swift package clean >/dev/null 2>&1 || true
+fi
+
+# Build for host architecture by default; allow overriding via ARCHES (e.g., "arm64 x86_64" for universal).
+ARCH_LIST=( ${ARCHES:-} )
+if [[ ${#ARCH_LIST[@]} -eq 0 ]]; then
+  HOST_ARCH=$(uname -m)
+  case "$HOST_ARCH" in
+    arm64) ARCH_LIST=(arm64) ;;
+    x86_64) ARCH_LIST=(x86_64) ;;
+    *) ARCH_LIST=("$HOST_ARCH") ;;
+  esac
+fi
+
+patch_keyboard_shortcuts() {
+  local util_path="$ROOT/.build/checkouts/KeyboardShortcuts/Sources/KeyboardShortcuts/Utilities.swift"
+  if [[ ! -f "$util_path" ]]; then
+    return 0
+  fi
+  if grep -q "keyboardShortcutsSafeBundle" "$util_path"; then
+    return 0
+  fi
+
+  chmod +w "$util_path" || true
+  python3 - "$util_path" <<'PY'
+import sys
+from pathlib import Path
+
+path = Path(sys.argv[1])
+text = path.read_text()
+if ".keyboardShortcutsSafeBundle" in text:
+    sys.exit(0)
+
+text = text.replace(
+    'NSLocalizedString(self, bundle: .module, comment: self)',
+    'NSLocalizedString(self, bundle: .keyboardShortcutsSafeBundle, comment: self)',
+)
+
+inject = """
+private extension Bundle {
+    /// Safe lookup that avoids the fatal trap in the autogenerated `Bundle.module`
+    /// when the resource bundle is not placed at the bundle root.
+    static let keyboardShortcutsSafeBundle: Bundle = {
+        #if os(macOS)
+        if let url = Bundle.main.url(forResource: "KeyboardShortcuts_KeyboardShortcuts", withExtension: "bundle"),
+           let bundle = Bundle(url: url) {
+            return bundle
+        }
+
+        let rootURL = Bundle.main.bundleURL.appendingPathComponent("KeyboardShortcuts_KeyboardShortcuts.bundle")
+        if let bundle = Bundle(url: rootURL) {
+            return bundle
+        }
+        #endif
+
+        let devURL = URL(fileURLWithPath: #file)
+            .deletingLastPathComponent()  // Utilities.swift
+            .deletingLastPathComponent()  // KeyboardShortcuts
+            .deletingLastPathComponent()  // Sources
+            .appendingPathComponent("KeyboardShortcuts_KeyboardShortcuts.bundle")
+        if let bundle = Bundle(url: devURL) {
+            return bundle
+        }
+
+        return Bundle.main
+    }()
+}
+"""
+
+marker = "}\n\n\nextension Data {"
+if marker not in text:
+    raise SystemExit("Marker not found in Utilities.swift; patch failed.")
+
+text = text.replace(marker, "}\n\n" + inject + "\n\nextension Data {")
+path.write_text(text)
+PY
+}
+
+KEYBOARD_SHORTCUTS_UTIL="$ROOT/.build/checkouts/KeyboardShortcuts/Sources/KeyboardShortcuts/Utilities.swift"
+if [[ ! -f "$KEYBOARD_SHORTCUTS_UTIL" ]]; then
+  swift build -c "$CONF" --arch "${ARCH_LIST[0]}"
+fi
+patch_keyboard_shortcuts
+
+for ARCH in "${ARCH_LIST[@]}"; do
+  swift build -c "$CONF" --arch "$ARCH"
+done
+
+APP="$BUILD_DIR/${APP_NAME}.app"
+rm -rf "$APP"
+mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources" "$APP/Contents/Frameworks"
+mkdir -p "$APP/Contents/Helpers" "$APP/Contents/PlugIns"
+
+# Convert new .icon bundle to .icns if present (macOS 14+/IconStudio export)
+ICON_SOURCE="$ROOT/Icon.icon"
+ICON_TARGET="$ROOT/Icon.icns"
+if [[ -f "$ICON_SOURCE" ]]; then
+  iconutil --convert icns --output "$ICON_TARGET" "$ICON_SOURCE"
+fi
+
+BUNDLE_ID="com.sriinnu.athena.runic"
+FEED_URL_DEFAULT="https://raw.githubusercontent.com/sriinnu/Runic/main/appcast.xml"
+FEED_URL="${RUNIC_SPARKLE_FEED_URL:-${FEED_URL_DEFAULT}}"
+AUTO_CHECKS=true
+LOWER_CONF=$(printf "%s" "$CONF" | tr '[:upper:]' '[:lower:]')
+if [[ "$LOWER_CONF" == "debug" ]]; then
+  BUNDLE_ID="com.sriinnu.athena.runic.debug"
+  FEED_URL=""
+  AUTO_CHECKS=false
+fi
+if [[ "$SIGNING_MODE" == "adhoc" ]]; then
+  FEED_URL=""
+  AUTO_CHECKS=false
+fi
+WIDGET_BUNDLE_ID="${BUNDLE_ID}.widget"
+APP_GROUP_ID="group.com.sriinnu.athena.runic"
+if [[ "$BUNDLE_ID" == *".debug"* ]]; then
+  APP_GROUP_ID="group.com.sriinnu.athena.runic.debug"
+fi
+ENTITLEMENTS_DIR="$ROOT/.build/entitlements"
+APP_ENTITLEMENTS="${ENTITLEMENTS_DIR}/${APP_NAME}.entitlements"
+WIDGET_ENTITLEMENTS="${ENTITLEMENTS_DIR}/${APP_NAME}Widget.entitlements"
+mkdir -p "$ENTITLEMENTS_DIR"
+if [[ "$ALLOW_LLDB" == "1" && "$LOWER_CONF" != "debug" ]]; then
+  echo "ERROR: CODEXBAR_ALLOW_LLDB requires debug configuration" >&2
+  exit 1
+fi
+cat > "$APP_ENTITLEMENTS" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.application-groups</key>
+    <array>
+        <string>${APP_GROUP_ID}</string>
+    </array>
+    $(if [[ "$ALLOW_LLDB" == "1" ]]; then echo "    <key>com.apple.security.get-task-allow</key><true/>"; fi)
+</dict>
+</plist>
+PLIST
+cat > "$WIDGET_ENTITLEMENTS" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.app-sandbox</key>
+    <true/>
+    <key>com.apple.security.application-groups</key>
+    <array>
+        <string>${APP_GROUP_ID}</string>
+    </array>
+</dict>
+</plist>
+PLIST
+BUILD_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown")
+
+cat > "$APP/Contents/Info.plist" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleName</key><string>${APP_NAME}</string>
+  <key>CFBundleDisplayName</key><string>${APP_NAME}</string>
+    <key>CFBundleIdentifier</key><string>${BUNDLE_ID}</string>
+  <key>CFBundleExecutable</key><string>${APP_NAME}</string>
+    <key>CFBundlePackageType</key><string>APPL</string>
+    <key>CFBundleShortVersionString</key><string>${MARKETING_VERSION}</string>
+    <key>CFBundleVersion</key><string>${BUILD_NUMBER}</string>
+    <key>LSMinimumSystemVersion</key><string>14.0</string>
+    <key>LSUIElement</key><true/>
+    <key>CFBundleIconFile</key><string>Icon</string>
+    <key>NSHumanReadableCopyright</key><string>© 2026 Srinivas Pendela (hello@srinivas.dev). MIT License.</string>
+    <key>SUFeedURL</key><string>${FEED_URL}</string>
+    <key>SUPublicEDKey</key><string>AGCY8w5vHirVfGGDGc8Szc5iuOqupZSh9pMj/Qs67XI=</string>
+    <key>SUEnableAutomaticChecks</key><${AUTO_CHECKS}/>
+    <key>CodexBuildTimestamp</key><string>${BUILD_TIMESTAMP}</string>
+    <key>CodexGitCommit</key><string>${GIT_COMMIT}</string>
+</dict>
+</plist>
+PLIST
+
+build_product_path() {
+  local name="$1"
+  local arch="$2"
+  case "$arch" in
+    arm64|x86_64) echo ".build/${arch}-apple-macosx/$CONF/$name" ;;
+    *) echo ".build/$CONF/$name" ;;
+  esac
+}
+
+verify_binary_arches() {
+  local binary="$1"; shift
+  local expected=("$@")
+  local actual
+  actual=$(lipo -archs "$binary")
+  local actual_count expected_count
+  actual_count=$(wc -w <<<"$actual" | tr -d ' ')
+  expected_count=${#expected[@]}
+  if [[ "$actual_count" -ne "$expected_count" ]]; then
+    echo "ERROR: $binary arch mismatch (expected: ${expected[*]}, actual: ${actual})" >&2
+    exit 1
+  fi
+  for arch in "${expected[@]}"; do
+    if [[ "$actual" != *"$arch"* ]]; then
+      echo "ERROR: $binary missing arch $arch (have: ${actual})" >&2
+      exit 1
+    fi
+  done
+}
+
+install_binary() {
+  local name="$1"
+  local dest="$2"
+  local binaries=()
+  for arch in "${ARCH_LIST[@]}"; do
+    local src
+    src=$(build_product_path "$name" "$arch")
+    if [[ ! -f "$src" ]]; then
+      echo "ERROR: Missing ${name} build for ${arch} at ${src}" >&2
+      exit 1
+    fi
+    binaries+=("$src")
+  done
+  if [[ ${#ARCH_LIST[@]} -gt 1 ]]; then
+    lipo -create "${binaries[@]}" -output "$dest"
+  else
+    cp "${binaries[0]}" "$dest"
+  fi
+  chmod +x "$dest"
+  verify_binary_arches "$dest" "${ARCH_LIST[@]}"
+}
+
+install_binary "Runic" "$APP/Contents/MacOS/${APP_NAME}"
+# Ship RunicCLI alongside the app for easy symlinking.
+if [[ -f "$(build_product_path "RunicCLI" "${ARCH_LIST[0]}")" ]]; then
+  install_binary "RunicCLI" "$APP/Contents/Helpers/RunicCLI"
+fi
+# Watchdog helper: ensures `claude` probes die when Runic crashes/gets killed.
+if [[ -f "$(build_product_path "RunicClaudeWatchdog" "${ARCH_LIST[0]}")" ]]; then
+  install_binary "RunicClaudeWatchdog" "$APP/Contents/Helpers/RunicClaudeWatchdog"
+fi
+if [[ -f "$(build_product_path "RunicWidget" "${ARCH_LIST[0]}")" ]]; then
+  WIDGET_APP="$APP/Contents/PlugIns/RunicWidget.appex"
+  mkdir -p "$WIDGET_APP/Contents/MacOS" "$WIDGET_APP/Contents/Resources"
+  cat > "$WIDGET_APP/Contents/Info.plist" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>CFBundleName</key><string>RunicWidget</string>
+    <key>CFBundleDisplayName</key><string>Runic</string>
+    <key>CFBundleIdentifier</key><string>${WIDGET_BUNDLE_ID}</string>
+    <key>CFBundleExecutable</key><string>RunicWidget</string>
+    <key>CFBundlePackageType</key><string>XPC!</string>
+    <key>CFBundleShortVersionString</key><string>${MARKETING_VERSION}</string>
+    <key>CFBundleVersion</key><string>${BUILD_NUMBER}</string>
+    <key>LSMinimumSystemVersion</key><string>14.0</string>
+    <key>NSExtension</key>
+    <dict>
+        <key>NSExtensionPointIdentifier</key><string>com.apple.widgetkit-extension</string>
+        <key>NSExtensionPrincipalClass</key><string>RunicWidget.RunicWidgetBundle</string>
+    </dict>
+</dict>
+</plist>
+PLIST
+  install_binary "RunicWidget" "$WIDGET_APP/Contents/MacOS/RunicWidget"
+fi
+# Embed Sparkle.framework
+if [[ -d ".build/$CONF/Sparkle.framework" ]]; then
+  cp -R ".build/$CONF/Sparkle.framework" "$APP/Contents/Frameworks/"
+  chmod -R a+rX "$APP/Contents/Frameworks/Sparkle.framework"
+  install_name_tool -add_rpath "@executable_path/../Frameworks" "$APP/Contents/MacOS/${APP_NAME}"
+  # Re-sign Sparkle and all nested components with Developer ID + timestamp
+  SPARKLE="$APP/Contents/Frameworks/Sparkle.framework"
+if [[ "$SIGNING_MODE" == "adhoc" ]]; then
+  CODESIGN_ID="-"
+  CODESIGN_ARGS=(--force --sign "$CODESIGN_ID")
+elif [[ "$ALLOW_LLDB" == "1" ]]; then
+  CODESIGN_ID="-"
+  CODESIGN_ARGS=(--force --sign "$CODESIGN_ID")
+else
+  CODESIGN_ID="${APP_IDENTITY:-Developer ID Application: YOUR_NAME (TEAMID)}"
+  CODESIGN_ARGS=(--force --timestamp --options runtime --sign "$CODESIGN_ID")
+fi
+function resign() { codesign "${CODESIGN_ARGS[@]}" "$1"; }
+  # Sign innermost binaries first, then the framework root to seal resources
+  resign "$SPARKLE"
+  resign "$SPARKLE/Versions/B/Sparkle"
+  resign "$SPARKLE/Versions/B/Autoupdate"
+  resign "$SPARKLE/Versions/B/Updater.app"
+  resign "$SPARKLE/Versions/B/Updater.app/Contents/MacOS/Updater"
+  resign "$SPARKLE/Versions/B/XPCServices/Downloader.xpc"
+  resign "$SPARKLE/Versions/B/XPCServices/Downloader.xpc/Contents/MacOS/Downloader"
+  resign "$SPARKLE/Versions/B/XPCServices/Installer.xpc"
+  resign "$SPARKLE/Versions/B/XPCServices/Installer.xpc/Contents/MacOS/Installer"
+  resign "$SPARKLE/Versions/B"
+  resign "$SPARKLE"
+fi
+
+if [[ -f "$ICON_TARGET" ]]; then
+  cp "$ICON_TARGET" "$APP/Contents/Resources/Icon.icns"
+fi
+
+# Bundle app resources (provider icons, etc.).
+APP_RESOURCES_DIR="$ROOT/Sources/Runic/Resources"
+if [[ -d "$APP_RESOURCES_DIR" ]]; then
+  cp -R "$APP_RESOURCES_DIR/." "$APP/Contents/Resources/"
+fi
+
+# SwiftPM resource bundles (e.g. KeyboardShortcuts) are emitted next to the built binary.
+PREFERRED_BUILD_DIR="$(dirname "$(build_product_path "Runic" "${ARCH_LIST[0]}")")"
+shopt -s nullglob
+SWIFTPM_BUNDLES=("${PREFERRED_BUILD_DIR}/"*.bundle)
+shopt -u nullglob
+if [[ ${#SWIFTPM_BUNDLES[@]} -gt 0 ]]; then
+  for bundle in "${SWIFTPM_BUNDLES[@]}"; do
+    bundle_name="$(basename "$bundle")"
+    cp -R "$bundle" "$APP/Contents/Resources/"
+  done
+fi
+if [[ ! -d "$APP/Contents/Resources/KeyboardShortcuts_KeyboardShortcuts.bundle" ]]; then
+  echo "ERROR: Missing KeyboardShortcuts SwiftPM resource bundle (Settings → Keyboard shortcut will crash)." >&2
+  echo "Expected: ${PREFERRED_BUILD_DIR}/KeyboardShortcuts_KeyboardShortcuts.bundle" >&2
+  exit 1
+fi
+
+# Ensure contents are writable before stripping attributes and signing.
+chmod -R u+w "$APP"
+
+# Strip extended attributes to prevent AppleDouble (._*) files that break code sealing
+xattr -cr "$APP"
+find "$APP" -name '._*' -delete
+
+# Sign helper binaries if present
+if [[ -f "${APP}/Contents/Helpers/RunicCLI" ]]; then
+  codesign "${CODESIGN_ARGS[@]}" "${APP}/Contents/Helpers/RunicCLI"
+fi
+if [[ -f "${APP}/Contents/Helpers/RunicClaudeWatchdog" ]]; then
+  codesign "${CODESIGN_ARGS[@]}" "${APP}/Contents/Helpers/RunicClaudeWatchdog"
+fi
+
+# Sign widget extension if present
+if [[ -d "${APP}/Contents/PlugIns/RunicWidget.appex" ]]; then
+  codesign "${CODESIGN_ARGS[@]}" \
+    --entitlements "$WIDGET_ENTITLEMENTS" \
+    "$APP/Contents/PlugIns/RunicWidget.appex/Contents/MacOS/RunicWidget"
+  codesign "${CODESIGN_ARGS[@]}" \
+    --entitlements "$WIDGET_ENTITLEMENTS" \
+    "$APP/Contents/PlugIns/RunicWidget.appex"
+fi
+
+# Finally sign the app bundle itself
+codesign "${CODESIGN_ARGS[@]}" \
+  --entitlements "$APP_ENTITLEMENTS" \
+  "$APP"
+
+LATEST_LINK="$ROOT/builds/latest"
+ln -sfn "$BUILD_DIR" "$LATEST_LINK"
+
+echo "Created $APP"