@stacksjs/buddy 0.70.211 → 0.70.213

package/dist/commands/desktop-apple.d.ts

@@ -24,6 +24,14 @@ declare interface AppleDesktopOptions {
   skipBuild?: boolean
   validateOnly?: boolean
   packageOnly?: boolean
+  plan?: boolean
+  apply?: boolean
+  capabilities?: string
+  appCertificateCsr?: string
+  installerCertificateCsr?: string
+  profileName?: string
+  output?: string
+  commonName?: string
 }
 export declare interface AppleDesktopConfig {
   appName: string

package/dist/commands/desktop-apple.js

@@ -150,11 +150,20 @@ export function renderAppleWorkflowCaller() {
 on:
   workflow_dispatch:
     inputs:
+      release-tag:
+        description: Git tag used for the GitHub release
+        required: true
+        type: string
       validate-only:
         description: Validate the signed package without uploading it
         required: false
         default: true
         type: boolean
+      mirror-s3:
+        description: Mirror artifacts to the configured S3-compatible release registry
+        required: false
+        default: false
+        type: boolean
 
 jobs:
   publish:
@@ -164,9 +173,18 @@ jobs:
       bundle-id: \${{ vars.APPLE_BUNDLE_ID }}
       team-id: \${{ vars.APPLE_TEAM_ID }}
       desktop-url: \${{ vars.DESKTOP_URL }}
+      app-version: \${{ vars.APPLE_APP_VERSION }}
       app-signing-identity: \${{ vars.APPLE_APP_SIGNING_IDENTITY }}
       installer-signing-identity: \${{ vars.APPLE_INSTALLER_SIGNING_IDENTITY }}
+      release-tag: \${{ inputs.release-tag }}
       validate-only: \${{ inputs.validate-only }}
+      mirror-s3: \${{ inputs.mirror-s3 }}
+      s3-provider: \${{ vars.RELEASE_S3_PROVIDER || 'hetzner' }}
+      s3-bucket: \${{ vars.RELEASE_S3_BUCKET }}
+      s3-region: \${{ vars.RELEASE_S3_REGION }}
+      s3-endpoint: \${{ vars.RELEASE_S3_ENDPOINT }}
+      s3-prefix: \${{ vars.RELEASE_S3_PREFIX }}
+      s3-public-url: \${{ vars.RELEASE_S3_PUBLIC_URL }}
     secrets: inherit
 `;
 }
@@ -324,6 +342,102 @@ function fail(error) {
   process.exit(1);
 }
 export function desktopApple(buddy) {
+  buddy.command("desktop:apple:csr", "Generate local private keys and CSRs for Mac App Store distribution certificates").option("--common-name <name>", "Certificate request common name").option("--output <path>", "Directory for private keys and certificate requests").action(async (options) => {
+    try {
+      const metadata = packageMetadata(), outputDirectory = resolve(options.output || storagePath("framework/desktop-dist/apple/provisioning")), { generateMacCertificateRequests } = await import("ts-pantry");
+      generateMacCertificateRequests({
+        outputDirectory,
+        commonName: options.commonName || metadata.name
+      });
+      log.success(`Generated Apple certificate requests and private keys in ${outputDirectory}`);
+    } catch (error) {
+      fail(error);
+    }
+  });
+  buddy.command("desktop:apple:provision", "Plan or reconcile Apple Bundle ID, capabilities, certificates, and profile").option("--app-name <name>", "Mac App Store display name").option("--bundle-id <id>", "Reverse-DNS bundle identifier").option("--api-key-id <id>", "App Store Connect API key ID").option("--api-issuer-id <id>", "App Store Connect API issuer ID").option("--api-key-path <path>", "App Store Connect AuthKey .p8 file").option("--capabilities <types>", "Comma-separated Apple capability types").option("--app-certificate-csr <path>", "CSR for a missing Mac App Distribution certificate").option("--installer-certificate-csr <path>", "CSR for a missing Mac Installer Distribution certificate").option("--profile-name <name>", "Provisioning profile name").option("--output <path>", "Directory for the plan and downloaded Apple assets").option("--plan", "Report the idempotent Apple resource diff without mutating it").option("--apply", "Apply the Apple resource diff without revoking existing certificates").action(async (options) => {
+    try {
+      if (options.plan && options.apply)
+        throw Error("Choose either --plan or --apply");
+      const config = resolveAppleDesktopConfig(options);
+      if (!config.bundleId)
+        throw Error("APPLE_BUNDLE_ID or --bundle-id is required");
+      if (!config.apiKeyId || !config.apiIssuerId || !config.apiKeyPath || !existsSync(config.apiKeyPath))
+        throw Error("App Store Connect API key ID, issuer ID, and existing .p8 key path are required");
+      const readCsr = (file) => {
+        if (!file)
+          return;
+        const resolved = resolve(file);
+        if (!existsSync(resolved))
+          throw Error(`Apple certificate CSR does not exist: ${resolved}`);
+        return readFileSync(resolved, "utf8");
+      }, { exportAppleCertificateP12, provisionMacApp } = await import("ts-pantry"), result = await provisionMacApp({
+        identifier: config.bundleId,
+        name: config.appName,
+        capabilities: options.capabilities?.split(",").map((value) => value.trim()).filter(Boolean),
+        appCertificateCsr: readCsr(options.appCertificateCsr),
+        installerCertificateCsr: readCsr(options.installerCertificateCsr),
+        profileName: options.profileName,
+        keyId: config.apiKeyId,
+        issuerId: config.apiIssuerId,
+        keyPath: config.apiKeyPath,
+        checkOnly: !options.apply
+      }), outputDirectory = resolve(options.output || storagePath("framework/desktop-dist/apple/provisioning"));
+      mkdirSync(outputDirectory, { recursive: !0 });
+      for (const certificate of result.certificates) {
+        if (!certificate.certificateContent)
+          continue;
+        const fileName = certificate.type === "MAC_APP_DISTRIBUTION" ? "mac-app-distribution.cer" : "mac-installer-distribution.cer";
+        writeFileSync(join(outputDirectory, fileName), Buffer.from(certificate.certificateContent, "base64"), { mode: 384 });
+      }
+      if (result.profile.profileContent)
+        writeFileSync(join(outputDirectory, "mac-app-store.provisionprofile"), Buffer.from(result.profile.profileContent, "base64"), { mode: 384 });
+      const certificatePassword = env("APPLE_CERTIFICATE_PASSWORD"), certificateExports = [
+        {
+          type: "MAC_APP_DISTRIBUTION",
+          csr: options.appCertificateCsr,
+          certificate: "mac-app-distribution.cer",
+          output: "mac-app-distribution.p12",
+          name: `${config.appName} Mac App Distribution`
+        },
+        {
+          type: "MAC_INSTALLER_DISTRIBUTION",
+          csr: options.installerCertificateCsr,
+          certificate: "mac-installer-distribution.cer",
+          output: "mac-installer-distribution.p12",
+          name: `${config.appName} Mac Installer Distribution`
+        }
+      ];
+      for (const certificateExport of certificateExports) {
+        if (!result.certificates.find((item) => item.type === certificateExport.type)?.certificateContent || !certificateExport.csr || !certificatePassword)
+          continue;
+        exportAppleCertificateP12({
+          certificatePath: join(outputDirectory, certificateExport.certificate),
+          privateKeyPath: resolve(certificateExport.csr.replace(/\.csr$/i, ".key")),
+          outputPath: join(outputDirectory, certificateExport.output),
+          password: certificatePassword,
+          name: certificateExport.name
+        });
+      }
+      const certificates = result.certificates.map((item) => {
+        const certificate = { ...item };
+        delete certificate.certificateContent;
+        return certificate;
+      }), profile = { ...result.profile };
+      delete profile.profileContent;
+      const report = {
+        ...result,
+        certificates,
+        profile
+      }, reportPath = join(outputDirectory, "provisioning-plan.json");
+      writeFileSync(reportPath, `${JSON.stringify(report, null, 2)}
+`, { mode: 384 });
+      log.success(`${options.apply ? "Applied" : "Planned"} Apple provisioning: ${reportPath}`);
+      if (!result.appRecord.exists)
+        log.warn(result.appRecord.manualAction);
+    } catch (error) {
+      fail(error);
+    }
+  });
   buddy.command("desktop:apple:doctor", "Validate Mac App Store tooling, credentials, certificates, and project metadata").option("--app-name <name>", "Mac App Store display name").option("--bundle-id <id>", "Reverse-DNS bundle identifier").option("--team-id <id>", "Apple Developer team ID").option("--app-signing-identity <identity>", "Mac App Distribution signing identity").option("--installer-signing-identity <identity>", "Mac Installer Distribution signing identity").option("--provisioning-profile <path>", "Mac App Store provisioning profile").option("--api-key-id <id>", "App Store Connect API key ID").option("--api-issuer-id <id>", "App Store Connect API issuer ID").option("--api-key-path <path>", "App Store Connect AuthKey .p8 file").action((options) => {
     try {
       const config = resolveAppleDesktopConfig(options), errors = validateAppleDesktopConfig(config, !0);

package/dist/commands/protocol/desktop-workflow.test.js

@@ -27,7 +27,7 @@ describe("desktop lifecycle workflow", () => {
   it("retains artifacts through maintained Node 24 action runtimes", () => {
     expect(repositoryWorkflows).not.toMatch(/actions\/upload-artifact@v[1-6]\b/);
     expect(repositoryWorkflows).not.toMatch(/actions\/download-artifact@v[1-7]\b/);
-    expect(repositoryWorkflows.match(/actions\/upload-artifact@v7\b/g)).toHaveLength(3);
+    expect(repositoryWorkflows.match(/actions\/upload-artifact@v7\b/g)).toHaveLength(4);
     expect(repositoryWorkflows.match(/actions\/download-artifact@v8\b/g)).toHaveLength(1);
   });
 });

package/dist/lazy-commands.js

@@ -17,8 +17,10 @@ const commandRegistry = {
   deploy: { path: "./commands/deploy.js", exportName: "deploy" },
   dev: { path: "./commands/dev.js", exportName: "dev" },
   "desktop:apple:doctor": { path: "./commands/desktop-apple.js", exportName: "desktopApple" },
+  "desktop:apple:csr": { path: "./commands/desktop-apple.js", exportName: "desktopApple" },
   "desktop:apple:init": { path: "./commands/desktop-apple.js", exportName: "desktopApple" },
   "desktop:apple:package": { path: "./commands/desktop-apple.js", exportName: "desktopApple" },
+  "desktop:apple:provision": { path: "./commands/desktop-apple.js", exportName: "desktopApple" },
   "desktop:apple:publish": { path: "./commands/desktop-apple.js", exportName: "desktopApple" },
   dns: { path: "./commands/dns.js", exportName: "dns" },
   "dns:pull": { path: "./commands/dns.js", exportName: "dns" },

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/buddy",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.211",
+  "version": "0.70.213",
   "description": "Meet Buddy. The Stacks runtime.",
   "author": "Chris Breuer",
   "contributors": [
@@ -139,7 +139,8 @@
     "@stacksjs/validation": "^0.70.180",
     "@stacksjs/ts-cloud": "^0.7.86",
     "ajv": "^8.20.0",
-    "ajv-formats": "^3.0.1"
+    "ajv-formats": "^3.0.1",
+    "ts-pantry": "^0.11.0"
   },
   "devDependencies": {
     "better-dx": "^0.2.17"