@stacksjs/buddy 0.70.258 → 0.70.260

package/dist/commands/desktop-apple.js

@@ -1,90 +1,6 @@
-import { createHash } from "node:crypto";
-import {
-  chmodSync,
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync
-} from "node:fs";
-import { basename, join, resolve } from "node:path";
-import process from "node:process";
-import { log } from "@stacksjs/cli";
-import { projectPath, storagePath } from "@stacksjs/path";
-const REQUIRED_TOOLS = ["codesign", "security", "productbuild", "pkgutil", "xcrun"];
-function env(name) {
-  return process.env[name]?.trim() || "";
-}
-function xml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-}
-function packageMetadata() {
-  const packageJson = JSON.parse(readFileSync(projectPath("package.json"), "utf8"));
-  return {
-    name: packageJson.name || "Stacks",
-    version: packageJson.version || "0.1.0"
-  };
-}
-export function resolveAppleDesktopConfig(options = {}) {
-  const metadata = packageMetadata(), provisioningProfile = options.provisioningProfile || env("APPLE_PROVISIONING_PROFILE"), apiKeyPath = options.apiKeyPath || env("APP_STORE_CONNECT_API_KEY_PATH");
-  return {
-    appName: options.appName || env("APPLE_APP_NAME") || env("APP_NAME") || metadata.name,
-    bundleId: options.bundleId || env("APPLE_BUNDLE_ID"),
-    teamId: options.teamId || env("APPLE_TEAM_ID"),
-    version: options.appVersion || env("APPLE_APP_VERSION") || metadata.version,
-    buildNumber: options.buildNumber || env("APPLE_BUILD_NUMBER") || env("GITHUB_RUN_NUMBER") || String(Math.floor(Date.now() / 1000)),
-    minimumMacos: options.minimumMacos || env("APPLE_MINIMUM_MACOS") || "13.0",
-    category: options.category || env("APPLE_APP_CATEGORY") || "public.app-category.productivity",
-    appSigningIdentity: options.appSigningIdentity || env("APPLE_APP_SIGNING_IDENTITY"),
-    installerSigningIdentity: options.installerSigningIdentity || env("APPLE_INSTALLER_SIGNING_IDENTITY"),
-    provisioningProfile: provisioningProfile ? resolve(provisioningProfile) : "",
-    apiKeyId: options.apiKeyId || env("APP_STORE_CONNECT_API_KEY_ID"),
-    apiIssuerId: options.apiIssuerId || env("APP_STORE_CONNECT_API_ISSUER_ID"),
-    apiKeyPath: apiKeyPath ? resolve(apiKeyPath) : "",
-    icon: options.icon || env("APPLE_APP_ICON") || void 0
-  };
-}
-export function validateAppleDesktopConfig(config, includeApi = !0) {
-  const errors = [];
-  if (process.platform !== "darwin")
-    errors.push("Mac App Store packaging must run on macOS");
-  if (!config.appName)
-    errors.push("APPLE_APP_NAME or --app-name is required");
-  if (!/^[A-Za-z0-9][A-Za-z0-9.-]+$/.test(config.bundleId))
-    errors.push("APPLE_BUNDLE_ID must be a reverse-DNS bundle identifier");
-  if (!/^[A-Z0-9]{10}$/.test(config.teamId))
-    errors.push("APPLE_TEAM_ID must be the 10-character Apple Developer team ID");
-  if (!/^\d+(?:\.\d+){0,2}$/.test(config.version))
-    errors.push("The marketing version must contain one to three numeric components");
-  if (!/^[A-Za-z0-9.-]+$/.test(config.buildNumber))
-    errors.push("The build number must contain only letters, numbers, periods, and hyphens");
-  if (!config.appSigningIdentity)
-    errors.push("APPLE_APP_SIGNING_IDENTITY is required");
-  if (!config.installerSigningIdentity)
-    errors.push("APPLE_INSTALLER_SIGNING_IDENTITY is required");
-  if (!config.provisioningProfile || !existsSync(config.provisioningProfile))
-    errors.push("APPLE_PROVISIONING_PROFILE must point to an existing .provisionprofile file");
-  if (config.icon && !existsSync(resolve(config.icon)))
-    errors.push(`Apple app icon does not exist: ${config.icon}`);
-  if (includeApi) {
-    if (!config.apiKeyId)
-      errors.push("APP_STORE_CONNECT_API_KEY_ID is required");
-    if (!config.apiIssuerId)
-      errors.push("APP_STORE_CONNECT_API_ISSUER_ID is required");
-    if (!config.apiKeyPath || !existsSync(config.apiKeyPath))
-      errors.push("APP_STORE_CONNECT_API_KEY_PATH must point to an existing .p8 file");
-  }
-  for (const tool of REQUIRED_TOOLS)
-    if (!Bun.which(tool))
-      errors.push(`Required Apple command is unavailable: ${tool}`);
-  return errors;
-}
-export function renderInfoPlist(config, executable = "stacks-desktop") {
-  const iconEntry = config.icon ? `
+import{createHash}from"node:crypto";import{chmodSync,copyFileSync,existsSync,mkdirSync,readFileSync,rmSync,writeFileSync}from"node:fs";import{basename,join,resolve}from"node:path";import process from"node:process";import{log}from"@stacksjs/cli";import{projectPath,storagePath}from"@stacksjs/path";const REQUIRED_TOOLS=["codesign","security","productbuild","pkgutil","xcrun"];function env(name){return process.env[name]?.trim()||""}function xml(value){return value.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function packageMetadata(){const packageJson=JSON.parse(readFileSync(projectPath("package.json"),"utf8"));return{name:packageJson.name||"Stacks",version:packageJson.version||"0.1.0"}}export function resolveAppleDesktopConfig(options={}){const metadata=packageMetadata(),provisioningProfile=options.provisioningProfile||env("APPLE_PROVISIONING_PROFILE"),apiKeyPath=options.apiKeyPath||env("APP_STORE_CONNECT_API_KEY_PATH");return{appName:options.appName||env("APPLE_APP_NAME")||env("APP_NAME")||metadata.name,bundleId:options.bundleId||env("APPLE_BUNDLE_ID"),teamId:options.teamId||env("APPLE_TEAM_ID"),version:options.appVersion||env("APPLE_APP_VERSION")||metadata.version,buildNumber:options.buildNumber||env("APPLE_BUILD_NUMBER")||env("GITHUB_RUN_NUMBER")||String(Math.floor(Date.now()/1000)),minimumMacos:options.minimumMacos||env("APPLE_MINIMUM_MACOS")||"13.0",category:options.category||env("APPLE_APP_CATEGORY")||"public.app-category.productivity",appSigningIdentity:options.appSigningIdentity||env("APPLE_APP_SIGNING_IDENTITY"),installerSigningIdentity:options.installerSigningIdentity||env("APPLE_INSTALLER_SIGNING_IDENTITY"),provisioningProfile:provisioningProfile?resolve(provisioningProfile):"",apiKeyId:options.apiKeyId||env("APP_STORE_CONNECT_API_KEY_ID"),apiIssuerId:options.apiIssuerId||env("APP_STORE_CONNECT_API_ISSUER_ID"),apiKeyPath:apiKeyPath?resolve(apiKeyPath):"",icon:options.icon||env("APPLE_APP_ICON")||void 0}}export function validateAppleDesktopConfig(config,includeApi=!0){const errors=[];if(process.platform!=="darwin")errors.push("Mac App Store packaging must run on macOS");if(!config.appName)errors.push("APPLE_APP_NAME or --app-name is required");if(!/^[A-Za-z0-9][A-Za-z0-9.-]+$/.test(config.bundleId))errors.push("APPLE_BUNDLE_ID must be a reverse-DNS bundle identifier");if(!/^[A-Z0-9]{10}$/.test(config.teamId))errors.push("APPLE_TEAM_ID must be the 10-character Apple Developer team ID");if(!/^\d+(?:\.\d+){0,2}$/.test(config.version))errors.push("The marketing version must contain one to three numeric components");if(!/^[A-Za-z0-9.-]+$/.test(config.buildNumber))errors.push("The build number must contain only letters, numbers, periods, and hyphens");if(!config.appSigningIdentity)errors.push("APPLE_APP_SIGNING_IDENTITY is required");if(!config.installerSigningIdentity)errors.push("APPLE_INSTALLER_SIGNING_IDENTITY is required");if(!config.provisioningProfile||!existsSync(config.provisioningProfile))errors.push("APPLE_PROVISIONING_PROFILE must point to an existing .provisionprofile file");if(config.icon&&!existsSync(resolve(config.icon)))errors.push(`Apple app icon does not exist: ${config.icon}`);if(includeApi){if(!config.apiKeyId)errors.push("APP_STORE_CONNECT_API_KEY_ID is required");if(!config.apiIssuerId)errors.push("APP_STORE_CONNECT_API_ISSUER_ID is required");if(!config.apiKeyPath||!existsSync(config.apiKeyPath))errors.push("APP_STORE_CONNECT_API_KEY_PATH must point to an existing .p8 file")}for(const tool of REQUIRED_TOOLS)if(!Bun.which(tool))errors.push(`Required Apple command is unavailable: ${tool}`);return errors}export function renderInfoPlist(config,executable="stacks-desktop"){const iconEntry=config.icon?`
   <key>CFBundleIconFile</key>
-  <string>AppIcon</string>` : "";
-  return `<?xml version="1.0" encoding="UTF-8"?>
+  <string>AppIcon</string>`:"";return`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
@@ -112,10 +28,7 @@ export function renderInfoPlist(config, executable = "stacks-desktop") {
   <true/>
 </dict>
 </plist>
-`;
-}
-export function renderAppEntitlements(config) {
-  return `<?xml version="1.0" encoding="UTF-8"?>
+`}export function renderAppEntitlements(config){return`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
@@ -129,10 +42,7 @@ export function renderAppEntitlements(config) {
   <true/>
 </dict>
 </plist>
-`;
-}
-export function renderHelperEntitlements() {
-  return `<?xml version="1.0" encoding="UTF-8"?>
+`}export function renderHelperEntitlements(){return`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
@@ -142,10 +52,7 @@ export function renderHelperEntitlements() {
   <true/>
 </dict>
 </plist>
-`;
-}
-export function renderAppleWorkflowCaller() {
-  return `name: Publish Mac App Store
+`}export function renderAppleWorkflowCaller(){return`name: Publish Mac App Store
 
 on:
   workflow_dispatch:
@@ -186,304 +93,10 @@ jobs:
       s3-prefix: \${{ vars.RELEASE_S3_PREFIX }}
       s3-public-url: \${{ vars.RELEASE_S3_PUBLIC_URL }}
     secrets: inherit
-`;
-}
-function command(args, cwd = projectPath()) {
-  const result = Bun.spawnSync(args, {
-    cwd,
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit"
-  });
-  if (result.exitCode !== 0)
-    throw Error(`${args[0]} ${args.slice(1).join(" ")} exited with code ${result.exitCode}`);
-}
-function signingIdentityExists(identity) {
-  if (!identity)
-    return !1;
-  const result = Bun.spawnSync(["security", "find-identity", "-v"], {
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  return result.exitCode === 0 && result.stdout.toString().includes(identity);
-}
-function provisioningProfileMatches(config) {
-  if (!config.provisioningProfile || !existsSync(config.provisioningProfile))
-    return !1;
-  const result = Bun.spawnSync(["security", "cms", "-D", "-i", config.provisioningProfile], {
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  if (result.exitCode !== 0)
-    return !1;
-  const profile = result.stdout.toString();
-  return profile.includes(config.bundleId) && profile.includes(config.teamId);
-}
-async function buildDesktop() {
-  const { runAction } = await import("@stacksjs/actions"), { Action } = await import("@stacksjs/enums"), result = await runAction(Action.BuildDesktop);
-  if (result.isErr)
-    throw result.error;
-}
-function sha256(path) {
-  return createHash("sha256").update(readFileSync(path)).digest("hex");
-}
-async function packageAppleDesktop(config, skipBuild = !1) {
-  const errors = validateAppleDesktopConfig(config, !1);
-  if (!signingIdentityExists(config.appSigningIdentity))
-    errors.push(`App signing identity is not installed: ${config.appSigningIdentity}`);
-  if (!signingIdentityExists(config.installerSigningIdentity))
-    errors.push(`Installer signing identity is not installed: ${config.installerSigningIdentity}`);
-  if (!provisioningProfileMatches(config))
-    errors.push(`Provisioning profile does not match ${config.teamId}.${config.bundleId}`);
-  if (errors.length)
-    throw Error(errors.join(`
-`));
-  if (!skipBuild)
-    await buildDesktop();
-  const desktopDist = storagePath("framework/desktop-dist"), launcher = join(desktopDist, "stacks-desktop"), runtime = join(desktopDist, "craft-runtime"), manifest = join(desktopDist, "desktop.json");
-  for (const path of [launcher, runtime, manifest])
-    if (!existsSync(path))
-      throw Error(`Desktop build artifact is missing: ${path}`);
-  const appleDir = join(desktopDist, "apple"), appPath = join(appleDir, `${config.appName}.app`), contents = join(appPath, "Contents"), macosDir = join(contents, "MacOS"), resourcesDir = join(contents, "Resources");
-  if (existsSync(appleDir))
-    rmSync(appleDir, { recursive: !0 });
-  mkdirSync(macosDir, { recursive: !0 });
-  mkdirSync(resourcesDir, { recursive: !0 });
-  copyFileSync(launcher, join(macosDir, "stacks-desktop"));
-  copyFileSync(runtime, join(macosDir, "craft-runtime"));
-  copyFileSync(manifest, join(macosDir, "desktop.json"));
-  copyFileSync(config.provisioningProfile, join(contents, "embedded.provisionprofile"));
-  chmodSync(join(macosDir, "stacks-desktop"), 493);
-  chmodSync(join(macosDir, "craft-runtime"), 493);
-  if (config.icon)
-    copyFileSync(resolve(config.icon), join(resourcesDir, "AppIcon.icns"));
-  const infoPlist = join(contents, "Info.plist"), appEntitlements = join(appleDir, "app.entitlements"), helperEntitlements = join(appleDir, "helper.entitlements");
-  writeFileSync(infoPlist, renderInfoPlist(config));
-  writeFileSync(appEntitlements, renderAppEntitlements(config));
-  writeFileSync(helperEntitlements, renderHelperEntitlements());
-  command(["plutil", "-lint", infoPlist, appEntitlements, helperEntitlements]);
-  command([
-    "codesign",
-    "--force",
-    "--timestamp",
-    "--options",
-    "runtime",
-    "--entitlements",
-    helperEntitlements,
-    "--sign",
-    config.appSigningIdentity,
-    join(macosDir, "craft-runtime")
-  ]);
-  command([
-    "codesign",
-    "--force",
-    "--timestamp",
-    "--options",
-    "runtime",
-    "--entitlements",
-    appEntitlements,
-    "--sign",
-    config.appSigningIdentity,
-    appPath
-  ]);
-  command(["codesign", "--verify", "--deep", "--strict", "--verbose=2", appPath]);
-  command(["codesign", "-d", "--entitlements", ":-", appPath]);
-  const packagePath = join(appleDir, `${config.appName}-${config.version}-${config.buildNumber}.pkg`);
-  command([
-    "productbuild",
-    "--component",
-    appPath,
-    "/Applications",
-    "--sign",
-    config.installerSigningIdentity,
-    packagePath
-  ]);
-  command(["pkgutil", "--check-signature", packagePath]);
-  const packageHash = sha256(packagePath);
-  writeFileSync(join(appleDir, "checksums.sha256"), `${packageHash}  ${basename(packagePath)}
-`);
-  writeFileSync(join(appleDir, "apple-provenance.json"), `${JSON.stringify({
-    schemaVersion: "1.0.0",
-    appName: config.appName,
-    bundleId: config.bundleId,
-    teamId: config.teamId,
-    version: config.version,
-    buildNumber: config.buildNumber,
-    minimumMacos: config.minimumMacos,
-    package: { name: basename(packagePath), sha256: packageHash },
-    sourceRevision: Bun.spawnSync(["git", "rev-parse", "HEAD"], { cwd: projectPath() }).stdout.toString().trim(),
-    craft: { sha256: sha256(join(macosDir, "craft-runtime")) }
-  }, null, 2)}
-`);
-  return packagePath;
-}
-function validateOrUpload(packagePath, config, validateOnly) {
-  const errors = validateAppleDesktopConfig(config, !0);
-  if (errors.length)
-    throw Error(errors.join(`
-`));
-  const common = [
-    "--type",
-    "macos",
-    "--file",
-    packagePath,
-    "--apiKey",
-    config.apiKeyId,
-    "--apiIssuer",
-    config.apiIssuerId
-  ];
-  process.env.API_PRIVATE_KEYS_DIR = resolve(config.apiKeyPath, "..");
-  command(["xcrun", "altool", "--validate-app", ...common]);
-  if (!validateOnly)
-    command(["xcrun", "altool", "--upload-app", ...common]);
-}
-function fail(error) {
-  log.error(error instanceof Error ? error.message : String(error));
-  process.exit(1);
-}
-export function desktopApple(buddy) {
-  buddy.command("desktop:apple:csr", "Generate local private keys and CSRs for Mac App Store distribution certificates").option("--common-name <name>", "Certificate request common name").option("--output <path>", "Directory for private keys and certificate requests").action(async (options) => {
-    try {
-      const metadata = packageMetadata(), outputDirectory = resolve(options.output || storagePath("framework/desktop-dist/apple/provisioning")), { generateMacCertificateRequests } = await import("ts-pantry");
-      generateMacCertificateRequests({
-        outputDirectory,
-        commonName: options.commonName || metadata.name
-      });
-      log.success(`Generated Apple certificate requests and private keys in ${outputDirectory}`);
-    } catch (error) {
-      fail(error);
-    }
-  });
-  buddy.command("desktop:apple:provision", "Plan or reconcile Apple Bundle ID, capabilities, certificates, and profile").option("--app-name <name>", "Mac App Store display name").option("--bundle-id <id>", "Reverse-DNS bundle identifier").option("--api-key-id <id>", "App Store Connect API key ID").option("--api-issuer-id <id>", "App Store Connect API issuer ID").option("--api-key-path <path>", "App Store Connect AuthKey .p8 file").option("--capabilities <types>", "Comma-separated Apple capability types").option("--app-certificate-csr <path>", "CSR for a missing Mac App Distribution certificate").option("--installer-certificate-csr <path>", "CSR for a missing Mac Installer Distribution certificate").option("--profile-name <name>", "Provisioning profile name").option("--output <path>", "Directory for the plan and downloaded Apple assets").option("--plan", "Report the idempotent Apple resource diff without mutating it").option("--apply", "Apply the Apple resource diff without revoking existing certificates").action(async (options) => {
-    try {
-      if (options.plan && options.apply)
-        throw Error("Choose either --plan or --apply");
-      const config = resolveAppleDesktopConfig(options);
-      if (!config.bundleId)
-        throw Error("APPLE_BUNDLE_ID or --bundle-id is required");
-      if (!config.apiKeyId || !config.apiIssuerId || !config.apiKeyPath || !existsSync(config.apiKeyPath))
-        throw Error("App Store Connect API key ID, issuer ID, and existing .p8 key path are required");
-      const readCsr = (file) => {
-        if (!file)
-          return;
-        const resolved = resolve(file);
-        if (!existsSync(resolved))
-          throw Error(`Apple certificate CSR does not exist: ${resolved}`);
-        return readFileSync(resolved, "utf8");
-      }, { exportAppleCertificateP12, provisionMacApp } = await import("ts-pantry"), result = await provisionMacApp({
-        identifier: config.bundleId,
-        name: config.appName,
-        capabilities: options.capabilities?.split(",").map((value) => value.trim()).filter(Boolean),
-        appCertificateCsr: readCsr(options.appCertificateCsr),
-        installerCertificateCsr: readCsr(options.installerCertificateCsr),
-        profileName: options.profileName,
-        keyId: config.apiKeyId,
-        issuerId: config.apiIssuerId,
-        keyPath: config.apiKeyPath,
-        checkOnly: !options.apply
-      }), outputDirectory = resolve(options.output || storagePath("framework/desktop-dist/apple/provisioning"));
-      mkdirSync(outputDirectory, { recursive: !0 });
-      for (const certificate of result.certificates) {
-        if (!certificate.certificateContent)
-          continue;
-        const fileName = certificate.type === "MAC_APP_DISTRIBUTION" ? "mac-app-distribution.cer" : "mac-installer-distribution.cer";
-        writeFileSync(join(outputDirectory, fileName), Buffer.from(certificate.certificateContent, "base64"), { mode: 384 });
-      }
-      if (result.profile.profileContent)
-        writeFileSync(join(outputDirectory, "mac-app-store.provisionprofile"), Buffer.from(result.profile.profileContent, "base64"), { mode: 384 });
-      const certificatePassword = env("APPLE_CERTIFICATE_PASSWORD"), certificateExports = [
-        {
-          type: "MAC_APP_DISTRIBUTION",
-          csr: options.appCertificateCsr,
-          certificate: "mac-app-distribution.cer",
-          output: "mac-app-distribution.p12",
-          name: `${config.appName} Mac App Distribution`
-        },
-        {
-          type: "MAC_INSTALLER_DISTRIBUTION",
-          csr: options.installerCertificateCsr,
-          certificate: "mac-installer-distribution.cer",
-          output: "mac-installer-distribution.p12",
-          name: `${config.appName} Mac Installer Distribution`
-        }
-      ];
-      for (const certificateExport of certificateExports) {
-        if (!result.certificates.find((item) => item.type === certificateExport.type)?.certificateContent || !certificateExport.csr || !certificatePassword)
-          continue;
-        exportAppleCertificateP12({
-          certificatePath: join(outputDirectory, certificateExport.certificate),
-          privateKeyPath: resolve(certificateExport.csr.replace(/\.csr$/i, ".key")),
-          outputPath: join(outputDirectory, certificateExport.output),
-          password: certificatePassword,
-          name: certificateExport.name
-        });
-      }
-      const certificates = result.certificates.map((item) => {
-        const certificate = { ...item };
-        delete certificate.certificateContent;
-        return certificate;
-      }), profile = { ...result.profile };
-      delete profile.profileContent;
-      const report = {
-        ...result,
-        certificates,
-        profile
-      }, reportPath = join(outputDirectory, "provisioning-plan.json");
-      writeFileSync(reportPath, `${JSON.stringify(report, null, 2)}
-`, { mode: 384 });
-      log.success(`${options.apply ? "Applied" : "Planned"} Apple provisioning: ${reportPath}`);
-      if (!result.appRecord.exists && result.appRecord.manualAction)
-        log.warn(result.appRecord.manualAction);
-    } catch (error) {
-      fail(error);
-    }
-  });
-  buddy.command("desktop:apple:doctor", "Validate Mac App Store tooling, credentials, certificates, and project metadata").option("--app-name <name>", "Mac App Store display name").option("--bundle-id <id>", "Reverse-DNS bundle identifier").option("--team-id <id>", "Apple Developer team ID").option("--app-signing-identity <identity>", "Mac App Distribution signing identity").option("--installer-signing-identity <identity>", "Mac Installer Distribution signing identity").option("--provisioning-profile <path>", "Mac App Store provisioning profile").option("--api-key-id <id>", "App Store Connect API key ID").option("--api-issuer-id <id>", "App Store Connect API issuer ID").option("--api-key-path <path>", "App Store Connect AuthKey .p8 file").action((options) => {
-    try {
-      const config = resolveAppleDesktopConfig(options), errors = validateAppleDesktopConfig(config, !0);
-      if (!signingIdentityExists(config.appSigningIdentity))
-        errors.push(`App signing identity is not installed: ${config.appSigningIdentity}`);
-      if (!signingIdentityExists(config.installerSigningIdentity))
-        errors.push(`Installer signing identity is not installed: ${config.installerSigningIdentity}`);
-      if (!provisioningProfileMatches(config))
-        errors.push(`Provisioning profile does not match ${config.teamId}.${config.bundleId}`);
-      if (errors.length)
-        throw Error(errors.join(`
-`));
-      log.success(`Mac App Store prerequisites are ready for ${config.bundleId}`);
-    } catch (error) {
-      fail(error);
-    }
-  });
-  buddy.command("desktop:apple:init", "Create a GitHub Actions caller for the reusable Stacks Mac App Store workflow").option("--force", "Replace an existing workflow").action((options) => {
-    try {
-      const workflowPath = projectPath(".github/workflows/apple-app-store.yml");
-      if (existsSync(workflowPath) && !options.force)
-        throw Error(`${workflowPath} already exists. Use --force to replace it.`);
-      mkdirSync(resolve(workflowPath, ".."), { recursive: !0 });
-      writeFileSync(workflowPath, renderAppleWorkflowCaller());
-      log.success(`Created ${workflowPath}`);
-    } catch (error) {
-      fail(error);
-    }
-  });
-  const addSharedOptions = (commandBuilder) => commandBuilder.option("--app-name <name>", "Mac App Store display name").option("--bundle-id <id>", "Reverse-DNS bundle identifier").option("--team-id <id>", "Apple Developer team ID").option("--app-version <version>", "Marketing version").option("--build-number <number>", "Unique App Store build number").option("--minimum-macos <version>", "Minimum supported macOS version").option("--category <category>", "LSApplicationCategoryType value").option("--app-signing-identity <identity>", "Mac App Distribution signing identity").option("--installer-signing-identity <identity>", "Mac Installer Distribution signing identity").option("--provisioning-profile <path>", "Mac App Store provisioning profile").option("--icon <path>", "Optional .icns app icon").option("--skip-build", "Package existing storage/framework/desktop-dist artifacts");
-  addSharedOptions(buddy.command("desktop:apple:package", "Build, sandbox, sign, and package a Mac App Store desktop app")).action(async (options) => {
-    try {
-      const packagePath = await packageAppleDesktop(resolveAppleDesktopConfig(options), Boolean(options.skipBuild));
-      log.success(`Created signed Mac App Store package ${packagePath}`);
-    } catch (error) {
-      fail(error);
-    }
-  });
-  addSharedOptions(buddy.command("desktop:apple:publish", "Build and validate or upload a signed Mac App Store package")).option("--api-key-id <id>", "App Store Connect API key ID").option("--api-issuer-id <id>", "App Store Connect API issuer ID").option("--api-key-path <path>", "App Store Connect AuthKey .p8 file").option("--validate-only", "Validate with App Store Connect without uploading").option("--package-only", "Create the signed package without contacting App Store Connect").action(async (options) => {
-    try {
-      const config = resolveAppleDesktopConfig(options), packagePath = await packageAppleDesktop(config, Boolean(options.skipBuild));
-      if (!options.packageOnly)
-        validateOrUpload(packagePath, config, Boolean(options.validateOnly));
-      log.success(options.packageOnly ? `Created signed Mac App Store package ${packagePath}` : options.validateOnly ? `Validated ${packagePath} with App Store Connect` : `Uploaded ${packagePath} to App Store Connect`);
-    } catch (error) {
-      fail(error);
-    }
-  });
-}
+`}function command(args,cwd=projectPath()){const result=Bun.spawnSync(args,{cwd,stdin:"inherit",stdout:"inherit",stderr:"inherit"});if(result.exitCode!==0)throw Error(`${args[0]} ${args.slice(1).join(" ")} exited with code ${result.exitCode}`)}function signingIdentityExists(identity){if(!identity)return!1;const result=Bun.spawnSync(["security","find-identity","-v"],{stdout:"pipe",stderr:"pipe"});return result.exitCode===0&&result.stdout.toString().includes(identity)}function provisioningProfileMatches(config){if(!config.provisioningProfile||!existsSync(config.provisioningProfile))return!1;const result=Bun.spawnSync(["security","cms","-D","-i",config.provisioningProfile],{stdout:"pipe",stderr:"pipe"});if(result.exitCode!==0)return!1;const profile=result.stdout.toString();return profile.includes(config.bundleId)&&profile.includes(config.teamId)}async function buildDesktop(){const{runAction}=await import("@stacksjs/actions"),{Action}=await import("@stacksjs/enums"),result=await runAction(Action.BuildDesktop);if(result.isErr)throw result.error}function sha256(path){return createHash("sha256").update(readFileSync(path)).digest("hex")}async function packageAppleDesktop(config,skipBuild=!1){const errors=validateAppleDesktopConfig(config,!1);if(!signingIdentityExists(config.appSigningIdentity))errors.push(`App signing identity is not installed: ${config.appSigningIdentity}`);if(!signingIdentityExists(config.installerSigningIdentity))errors.push(`Installer signing identity is not installed: ${config.installerSigningIdentity}`);if(!provisioningProfileMatches(config))errors.push(`Provisioning profile does not match ${config.teamId}.${config.bundleId}`);if(errors.length)throw Error(errors.join(`
+`));if(!skipBuild)await buildDesktop();const desktopDist=storagePath("framework/desktop-dist"),launcher=join(desktopDist,"stacks-desktop"),runtime=join(desktopDist,"craft-runtime"),manifest=join(desktopDist,"desktop.json");for(const path of[launcher,runtime,manifest])if(!existsSync(path))throw Error(`Desktop build artifact is missing: ${path}`);const appleDir=join(desktopDist,"apple"),appPath=join(appleDir,`${config.appName}.app`),contents=join(appPath,"Contents"),macosDir=join(contents,"MacOS"),resourcesDir=join(contents,"Resources");if(existsSync(appleDir))rmSync(appleDir,{recursive:!0});mkdirSync(macosDir,{recursive:!0});mkdirSync(resourcesDir,{recursive:!0});copyFileSync(launcher,join(macosDir,"stacks-desktop"));copyFileSync(runtime,join(macosDir,"craft-runtime"));copyFileSync(manifest,join(macosDir,"desktop.json"));copyFileSync(config.provisioningProfile,join(contents,"embedded.provisionprofile"));chmodSync(join(macosDir,"stacks-desktop"),493);chmodSync(join(macosDir,"craft-runtime"),493);if(config.icon)copyFileSync(resolve(config.icon),join(resourcesDir,"AppIcon.icns"));const infoPlist=join(contents,"Info.plist"),appEntitlements=join(appleDir,"app.entitlements"),helperEntitlements=join(appleDir,"helper.entitlements");writeFileSync(infoPlist,renderInfoPlist(config));writeFileSync(appEntitlements,renderAppEntitlements(config));writeFileSync(helperEntitlements,renderHelperEntitlements());command(["plutil","-lint",infoPlist,appEntitlements,helperEntitlements]);command(["codesign","--force","--timestamp","--options","runtime","--entitlements",helperEntitlements,"--sign",config.appSigningIdentity,join(macosDir,"craft-runtime")]);command(["codesign","--force","--timestamp","--options","runtime","--entitlements",appEntitlements,"--sign",config.appSigningIdentity,appPath]);command(["codesign","--verify","--deep","--strict","--verbose=2",appPath]);command(["codesign","-d","--entitlements",":-",appPath]);const packagePath=join(appleDir,`${config.appName}-${config.version}-${config.buildNumber}.pkg`);command(["productbuild","--component",appPath,"/Applications","--sign",config.installerSigningIdentity,packagePath]);command(["pkgutil","--check-signature",packagePath]);const packageHash=sha256(packagePath);writeFileSync(join(appleDir,"checksums.sha256"),`${packageHash}  ${basename(packagePath)}
+`);writeFileSync(join(appleDir,"apple-provenance.json"),`${JSON.stringify({schemaVersion:"1.0.0",appName:config.appName,bundleId:config.bundleId,teamId:config.teamId,version:config.version,buildNumber:config.buildNumber,minimumMacos:config.minimumMacos,package:{name:basename(packagePath),sha256:packageHash},sourceRevision:Bun.spawnSync(["git","rev-parse","HEAD"],{cwd:projectPath()}).stdout.toString().trim(),craft:{sha256:sha256(join(macosDir,"craft-runtime"))}},null,2)}
+`);return packagePath}function validateOrUpload(packagePath,config,validateOnly){const errors=validateAppleDesktopConfig(config,!0);if(errors.length)throw Error(errors.join(`
+`));const common=["--type","macos","--file",packagePath,"--apiKey",config.apiKeyId,"--apiIssuer",config.apiIssuerId];process.env.API_PRIVATE_KEYS_DIR=resolve(config.apiKeyPath,"..");command(["xcrun","altool","--validate-app",...common]);if(!validateOnly)command(["xcrun","altool","--upload-app",...common])}function fail(error){log.error(error instanceof Error?error.message:String(error));process.exit(1)}export function desktopApple(buddy){buddy.command("desktop:apple:csr","Generate local private keys and CSRs for Mac App Store distribution certificates").option("--common-name <name>","Certificate request common name").option("--output <path>","Directory for private keys and certificate requests").action(async(options)=>{try{const metadata=packageMetadata(),outputDirectory=resolve(options.output||storagePath("framework/desktop-dist/apple/provisioning")),{generateMacCertificateRequests}=await import("ts-pantry");generateMacCertificateRequests({outputDirectory,commonName:options.commonName||metadata.name});log.success(`Generated Apple certificate requests and private keys in ${outputDirectory}`)}catch(error){fail(error)}});buddy.command("desktop:apple:provision","Plan or reconcile Apple Bundle ID, capabilities, certificates, and profile").option("--app-name <name>","Mac App Store display name").option("--bundle-id <id>","Reverse-DNS bundle identifier").option("--api-key-id <id>","App Store Connect API key ID").option("--api-issuer-id <id>","App Store Connect API issuer ID").option("--api-key-path <path>","App Store Connect AuthKey .p8 file").option("--capabilities <types>","Comma-separated Apple capability types").option("--app-certificate-csr <path>","CSR for a missing Mac App Distribution certificate").option("--installer-certificate-csr <path>","CSR for a missing Mac Installer Distribution certificate").option("--profile-name <name>","Provisioning profile name").option("--output <path>","Directory for the plan and downloaded Apple assets").option("--plan","Report the idempotent Apple resource diff without mutating it").option("--apply","Apply the Apple resource diff without revoking existing certificates").action(async(options)=>{try{if(options.plan&&options.apply)throw Error("Choose either --plan or --apply");const config=resolveAppleDesktopConfig(options);if(!config.bundleId)throw Error("APPLE_BUNDLE_ID or --bundle-id is required");if(!config.apiKeyId||!config.apiIssuerId||!config.apiKeyPath||!existsSync(config.apiKeyPath))throw Error("App Store Connect API key ID, issuer ID, and existing .p8 key path are required");const readCsr=(file)=>{if(!file)return;const resolved=resolve(file);if(!existsSync(resolved))throw Error(`Apple certificate CSR does not exist: ${resolved}`);return readFileSync(resolved,"utf8")},{exportAppleCertificateP12,provisionMacApp}=await import("ts-pantry"),result=await provisionMacApp({identifier:config.bundleId,name:config.appName,capabilities:options.capabilities?.split(",").map((value)=>value.trim()).filter(Boolean),appCertificateCsr:readCsr(options.appCertificateCsr),installerCertificateCsr:readCsr(options.installerCertificateCsr),profileName:options.profileName,keyId:config.apiKeyId,issuerId:config.apiIssuerId,keyPath:config.apiKeyPath,checkOnly:!options.apply}),outputDirectory=resolve(options.output||storagePath("framework/desktop-dist/apple/provisioning"));mkdirSync(outputDirectory,{recursive:!0});for(const certificate of result.certificates){if(!certificate.certificateContent)continue;const fileName=certificate.type==="MAC_APP_DISTRIBUTION"?"mac-app-distribution.cer":"mac-installer-distribution.cer";writeFileSync(join(outputDirectory,fileName),Buffer.from(certificate.certificateContent,"base64"),{mode:384})}if(result.profile.profileContent)writeFileSync(join(outputDirectory,"mac-app-store.provisionprofile"),Buffer.from(result.profile.profileContent,"base64"),{mode:384});const certificatePassword=env("APPLE_CERTIFICATE_PASSWORD"),certificateExports=[{type:"MAC_APP_DISTRIBUTION",csr:options.appCertificateCsr,certificate:"mac-app-distribution.cer",output:"mac-app-distribution.p12",name:`${config.appName} Mac App Distribution`},{type:"MAC_INSTALLER_DISTRIBUTION",csr:options.installerCertificateCsr,certificate:"mac-installer-distribution.cer",output:"mac-installer-distribution.p12",name:`${config.appName} Mac Installer Distribution`}];for(const certificateExport of certificateExports){if(!result.certificates.find((item)=>item.type===certificateExport.type)?.certificateContent||!certificateExport.csr||!certificatePassword)continue;exportAppleCertificateP12({certificatePath:join(outputDirectory,certificateExport.certificate),privateKeyPath:resolve(certificateExport.csr.replace(/\.csr$/i,".key")),outputPath:join(outputDirectory,certificateExport.output),password:certificatePassword,name:certificateExport.name})}const certificates=result.certificates.map((item)=>{const certificate={...item};delete certificate.certificateContent;return certificate}),profile={...result.profile};delete profile.profileContent;const report={...result,certificates,profile},reportPath=join(outputDirectory,"provisioning-plan.json");writeFileSync(reportPath,`${JSON.stringify(report,null,2)}
+`,{mode:384});log.success(`${options.apply?"Applied":"Planned"} Apple provisioning: ${reportPath}`);if(!result.appRecord.exists&&result.appRecord.manualAction)log.warn(result.appRecord.manualAction)}catch(error){fail(error)}});buddy.command("desktop:apple:doctor","Validate Mac App Store tooling, credentials, certificates, and project metadata").option("--app-name <name>","Mac App Store display name").option("--bundle-id <id>","Reverse-DNS bundle identifier").option("--team-id <id>","Apple Developer team ID").option("--app-signing-identity <identity>","Mac App Distribution signing identity").option("--installer-signing-identity <identity>","Mac Installer Distribution signing identity").option("--provisioning-profile <path>","Mac App Store provisioning profile").option("--api-key-id <id>","App Store Connect API key ID").option("--api-issuer-id <id>","App Store Connect API issuer ID").option("--api-key-path <path>","App Store Connect AuthKey .p8 file").action((options)=>{try{const config=resolveAppleDesktopConfig(options),errors=validateAppleDesktopConfig(config,!0);if(!signingIdentityExists(config.appSigningIdentity))errors.push(`App signing identity is not installed: ${config.appSigningIdentity}`);if(!signingIdentityExists(config.installerSigningIdentity))errors.push(`Installer signing identity is not installed: ${config.installerSigningIdentity}`);if(!provisioningProfileMatches(config))errors.push(`Provisioning profile does not match ${config.teamId}.${config.bundleId}`);if(errors.length)throw Error(errors.join(`
+`));log.success(`Mac App Store prerequisites are ready for ${config.bundleId}`)}catch(error){fail(error)}});buddy.command("desktop:apple:init","Create a GitHub Actions caller for the reusable Stacks Mac App Store workflow").option("--force","Replace an existing workflow").action((options)=>{try{const workflowPath=projectPath(".github/workflows/apple-app-store.yml");if(existsSync(workflowPath)&&!options.force)throw Error(`${workflowPath} already exists. Use --force to replace it.`);mkdirSync(resolve(workflowPath,".."),{recursive:!0});writeFileSync(workflowPath,renderAppleWorkflowCaller());log.success(`Created ${workflowPath}`)}catch(error){fail(error)}});const addSharedOptions=(commandBuilder)=>commandBuilder.option("--app-name <name>","Mac App Store display name").option("--bundle-id <id>","Reverse-DNS bundle identifier").option("--team-id <id>","Apple Developer team ID").option("--app-version <version>","Marketing version").option("--build-number <number>","Unique App Store build number").option("--minimum-macos <version>","Minimum supported macOS version").option("--category <category>","LSApplicationCategoryType value").option("--app-signing-identity <identity>","Mac App Distribution signing identity").option("--installer-signing-identity <identity>","Mac Installer Distribution signing identity").option("--provisioning-profile <path>","Mac App Store provisioning profile").option("--icon <path>","Optional .icns app icon").option("--skip-build","Package existing storage/framework/desktop-dist artifacts");addSharedOptions(buddy.command("desktop:apple:package","Build, sandbox, sign, and package a Mac App Store desktop app")).action(async(options)=>{try{const packagePath=await packageAppleDesktop(resolveAppleDesktopConfig(options),Boolean(options.skipBuild));log.success(`Created signed Mac App Store package ${packagePath}`)}catch(error){fail(error)}});addSharedOptions(buddy.command("desktop:apple:publish","Build and validate or upload a signed Mac App Store package")).option("--api-key-id <id>","App Store Connect API key ID").option("--api-issuer-id <id>","App Store Connect API issuer ID").option("--api-key-path <path>","App Store Connect AuthKey .p8 file").option("--validate-only","Validate with App Store Connect without uploading").option("--package-only","Create the signed package without contacting App Store Connect").action(async(options)=>{try{const config=resolveAppleDesktopConfig(options),packagePath=await packageAppleDesktop(config,Boolean(options.skipBuild));if(!options.packageOnly)validateOrUpload(packagePath,config,Boolean(options.validateOnly));log.success(options.packageOnly?`Created signed Mac App Store package ${packagePath}`:options.validateOnly?`Validated ${packagePath} with App Store Connect`:`Uploaded ${packagePath} to App Store Connect`)}catch(error){fail(error)}})}