@stacksjs/desktop-build 0.70.234

package/LICENSE.md

@@ -0,0 +1,21 @@
+# MIT License
+
+Copyright (c) 2023 Open Web Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,107 @@
+# Stacks Desktop
+
+## Features
+
+- Experimental native macOS, Linux, and Windows windows powered by Craft
+- Pretty development URLs through the Stacks rpx and tlsx integration
+- Hot reload and native developer tools
+- Multi-recipient invite delivery with application-owned token and mail callbacks
+- HTTPS update checks with Ed25519 manifest signatures, SHA-256 artifact verification, and atomic staging
+
+## Usage
+
+```bash
+bun install -d @stacksjs/desktop
+```
+
+Now, you can use it in your project:
+
+```js
+import { openDevWindow } from '@stacksjs/desktop'
+
+await openDevWindow(3000, {
+  title: 'My Stacks App',
+})
+```
+
+`APP_URL` is used by default, so a normal Stacks project opens its pretty HTTPS URL. Pass `url` only when embedding another development server.
+
+Craft is provisioned by Pantry from `config/deps.ts`. Run `pantry install` if the native binary is not available yet.
+
+## Support status
+
+There are currently **no stable desktop distribution targets**. Local Craft
+development and unpackaged bundles are experimental on macOS arm64/x64, Linux
+x64, and Windows x64. Linux arm64 and every unlisted target are unsupported.
+Exact OS versions remain unqualified until the native install/update matrix in
+[#2063](https://github.com/stacksjs/stacks/issues/2063) is retained. Platform
+signing and macOS notarization are tracked in
+[#2062](https://github.com/stacksjs/stacks/issues/2062).
+
+`buddy build:desktop` defaults to the experimental channel and emits
+`provenance.json` plus `checksums.sha256`. Setting
+`DESKTOP_RELEASE_CHANNEL=stable` fails until the checked support matrix contains
+a fully evidenced stable row.
+
+Invite delivery stays transport-neutral so applications can use their configured Stacks mail provider:
+
+```ts
+import { sendDesktopInvites } from '@stacksjs/desktop'
+
+await sendDesktopInvites(users, {
+  baseUrl: 'https://app.example.com',
+  createToken: user => inviteTokens.create(user),
+  send: invite => mail.send(invite.recipient.email, invite.url),
+})
+```
+
+The updater never stages an unsigned or untrusted release manifest. Configure an
+Ed25519 public key out of band, check the signed channel, then pass the same trust
+set when staging the checksum-verified artifact:
+
+```ts
+import { checkForDesktopUpdate, stageDesktopUpdate } from '@stacksjs/desktop'
+
+const update = await checkForDesktopUpdate({
+  currentVersion: '1.4.0',
+  manifestUrl: 'https://app.example.com/desktop/updates/stable.json',
+  trustedKeys: {
+    'release-2026': process.env.DESKTOP_UPDATE_PUBLIC_KEY,
+  },
+})
+
+if (update)
+  await stageDesktopUpdate(update, '/path/to/update.bin', fetch, {
+    'release-2026': process.env.DESKTOP_UPDATE_PUBLIC_KEY,
+  })
+```
+
+## Testing
+
+```bash
+bun test
+```
+
+## 📈 Changelog
+
+Please see our [releases](https://github.com/stacksjs/stacks/releases) page for more information on what has changed recently.
+
+## 🚜 Contributing
+
+Please review the [Contributing Guide](https://github.com/stacksjs/contributing) for details.
+
+## 🏝 Community
+
+For help, discussion about best practices, or any other conversation that would benefit from being searchable:
+
+[Discussions on GitHub](https://github.com/stacksjs/stacks/discussions)
+
+For casual chit-chat with others using this package:
+
+[Join the Stacks Discord Server](https://stacksjs.com/discord)
+
+## 📄 License
+
+The MIT License (MIT). Please see [LICENSE](https://github.com/stacksjs/stacks/tree/main/LICENSE.md) for more information.
+
+Made with 💙

package/dist/index.js

@@ -0,0 +1,2 @@
+// @bun
+import{existsSync as c}from"fs";import{homedir as R}from"os";import{dirname as S,join as a}from"path";import{fileURLToPath as A}from"url";function d(t,e,s={}){if(!e.trim())throw Error("Invite token is required");let r=new URL("/invite",/^https?:\/\//.test(t)?t:`https://${t}`);if(r.searchParams.set("token",e),s.email)r.searchParams.set("email",s.email);if(s.team)r.searchParams.set("team",s.team);if(s.role)r.searchParams.set("role",s.role);if(s.expiresAt){let i=s.expiresAt instanceof Date?s.expiresAt:new Date(s.expiresAt);if(Number.isNaN(i.valueOf()))throw Error("Invite expiration must be a valid date");r.searchParams.set("expires",i.toISOString())}return r.toString()}async function j(t,e){return Promise.all(t.map(async(s)=>{let r=typeof s==="string"?{email:s}:s;try{k(r.email);let i=await e.createToken(r),n=d(e.baseUrl,i,{email:r.email,team:r.team,role:r.role,expiresAt:e.expiresAt});return await e.send({recipient:r,url:n}),{recipient:r,url:n,delivered:!0}}catch(i){return{recipient:r,url:"",delivered:!1,error:i instanceof Error?i.message:String(i)}}}))}function k(t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t))throw Error(`Invalid invite email: ${t}`)}import{createHash as f,createPublicKey as h,verify as m}from"crypto";import{mkdir as w,rename as b,writeFile as v}from"fs/promises";import{dirname as y}from"path";async function F(t){l(t.manifestUrl);let e=await(t.fetcher||fetch)(t.manifestUrl,{headers:{Accept:"application/json"}});if(!e.ok)throw Error(`Desktop update check failed with HTTP ${e.status}`);let s=p(await e.json());return g(s,t.trustedKeys),D(s.version,t.currentVersion)>0?s:null}async function T(t,e,s=fetch,r){if(p(t),!r)throw Error("Desktop update staging requires trusted signing keys");g(t,r),l(t.url);let i=await s(t.url);if(!i.ok)throw Error(`Desktop update download failed with HTTP ${i.status}`);let n=new Uint8Array(await i.arrayBuffer());if(n.byteLength!==t.size)throw Error(`Desktop update size mismatch: expected ${t.size}, received ${n.byteLength}`);if(f("sha256").update(n).digest("hex")!==t.sha256.toLowerCase())throw Error("Desktop update checksum mismatch");await w(y(e),{recursive:!0});let u=`${e}.download-${crypto.randomUUID()}`;return await v(u,n,{mode:448}),await b(u,e),{manifest:t,path:e,bytes:n.byteLength}}function D(t,e){let s=o(t),r=o(e);for(let i=0;i<3;i++){let n=s[i]-r[i];if(n!==0)return Math.sign(n)}return 0}function p(t){if(!t||typeof t!=="object")throw Error("Desktop update manifest must be an object");let e=t;if(o(e.version||""),typeof e.url!=="string")throw Error("Desktop update manifest requires a URL");if(typeof e.sha256!=="string"||!/^[a-f0-9]{64}$/i.test(e.sha256))throw Error("Desktop update manifest requires a SHA-256 checksum");if(!Number.isInteger(e.size)||e.size<0)throw Error("Desktop update manifest requires a non-negative integer size");if(typeof e.sourceRevision!=="string"||!/^[0-9a-f]{40}$/.test(e.sourceRevision))throw Error("Desktop update manifest requires a full source revision");if(typeof e.platform!=="string"||!["darwin","linux","win32"].includes(e.platform))throw Error("Desktop update manifest requires a supported platform identifier");if(typeof e.architecture!=="string"||!/^[a-z0-9_-]+$/.test(e.architecture))throw Error("Desktop update manifest requires an architecture");if(typeof e.signingKeyId!=="string"||!/^[a-zA-Z0-9._-]+$/.test(e.signingKeyId))throw Error("Desktop update manifest requires a signing key ID");if(typeof e.signature!=="string"||!/^[A-Za-z0-9_-]+$/.test(e.signature))throw Error("Desktop update manifest requires an Ed25519 signature");return e}function E(t){return Buffer.from(JSON.stringify({version:t.version,url:t.url,sha256:t.sha256.toLowerCase(),size:t.size,sourceRevision:t.sourceRevision,platform:t.platform,architecture:t.architecture,signingKeyId:t.signingKeyId,publishedAt:t.publishedAt||null,notes:t.notes||null}),"utf8")}function g(t,e){let s=e[t.signingKeyId];if(!s)throw Error(`Desktop update signing key is not trusted: ${t.signingKeyId}`);let r="ed25519-public:";if(!s.startsWith(r))throw Error("Desktop update signing key has an invalid encoding");try{let i=h({key:Buffer.from(s.slice(r.length),"base64url"),format:"der",type:"spki"}),n=Buffer.from(t.signature,"base64url");if(i.asymmetricKeyType!=="ed25519"||n.length!==64||!m(null,E(t),i,n))throw Error("invalid")}catch{throw Error("Desktop update manifest signature verification failed")}}function o(t){let e=t.match(/^v?(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?$/);if(!e)throw Error(`Invalid semantic version: ${t}`);return[Number(e[1]),Number(e[2]),Number(e[3])]}function l(t){let e=new URL(t),s=["localhost","127.0.0.1","::1"].includes(e.hostname);if(e.protocol!=="https:"&&!(e.protocol==="http:"&&s))throw Error("Desktop updates require HTTPS outside loopback development")}var x=[{platform:"darwin",architecture:"arm64",status:"experimental",osVersions:["macOS 15 runner"],packageFormat:"DMG + PKG",signing:"pending",notarization:"pending",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/.github/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["Lifecycle fixtures are unsigned while platform identities remain unprovisioned.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]},{platform:"darwin",architecture:"x64",status:"experimental",osVersions:["macOS 15 Intel runner"],packageFormat:"DMG + PKG",signing:"pending",notarization:"pending",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/.github/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["Lifecycle fixtures are unsigned while platform identities remain unprovisioned.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]},{platform:"linux",architecture:"x64",status:"experimental",osVersions:["Ubuntu 24.04 runner"],packageFormat:"DEB",signing:"pending",notarization:"not-applicable",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/.github/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["The lifecycle fixture is unsigned and no package repository support policy is published.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]},{platform:"win32",architecture:"x64",status:"experimental",osVersions:["Windows Server 2025 runner"],packageFormat:"MSI + ZIP",signing:"pending",notarization:"not-applicable",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/.github/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["The lifecycle fixture is not Authenticode-signed.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]}];function I(t=process.platform,e=process.arch){return x.find((s)=>s.platform===t&&s.architecture===e)}function N(t,e=process.platform,s=process.arch){let r=I(e,s);if(!r)throw Error(`Desktop target ${e}/${s} is unsupported`);if(t==="stable"&&(r.status!=="stable"||r.signing!=="enforced"||r.platform==="darwin"&&r.notarization!=="enforced"||!r.installLaunchEvidence||!r.updateRollbackEvidence))throw Error(`Desktop target ${e}/${s} cannot be released as stable; complete stacksjs/stacks#2059, #2062, and #2063 first`);return r}function P(t=process.env.CRAFT_BIN){if(t){if(!c(t))throw Error(`Craft binary not found: ${t}`);return t}let e=a(R(),"Code/Tools/craft");return[a(e,"packages/zig/zig-out/bin/craft"),a(e,"craft"),a(e,"bin/craft")].find((r)=>c(r))||"craft"}function _(){let t=S(A(import.meta.url)),s=[a(t,"launcher.ts"),a(t,"launcher.js")].find((r)=>c(r));if(!s)throw Error("Desktop launcher entrypoint not found. Reinstall @stacksjs/desktop \u2014 the package must ship dist/launcher.js.");return s}function U(t,e={}){if(!Number.isInteger(t)||t<1||t>65535)throw RangeError(`Invalid desktop development port: ${t}`);let s=e.url||process.env.APP_URL;if(!s)return"https://stacks.test";let r=/^https?:\/\//.test(s)?s:`https://${s}`;return new URL(r).toString().replace(/\/$/,"")}function $(t,e={}){let s=[P(e.craftBin),U(t,e),"--title",e.title||"Stacks","--width",String(e.width||1400),"--height",String(e.height||900)];if(e.hotReload!==!1)s.push("--hot-reload");if(e.devTools===!1)s.push("--no-devtools");if(e.darkMode)s.push("--dark");if(e.systemTray)s.push("--system-tray");if(e.hideDockIcon)s.push("--hide-dock-icon");if(e.menubarOnly)s.push("--menubar-only");return s}function J(t,e="stable"){if(!/^[a-z0-9-]+$/i.test(e))throw Error("Update channel may only contain letters, numbers, and hyphens");return new URL(`/desktop/updates/${e}.json`,/^https?:\/\//.test(t)?t:`https://${t}`).toString()}async function L(t){Bun.spawn(t,{stdin:"inherit",stdout:"inherit",stderr:"inherit"}).unref()}async function W(t,e={},s=L){return await s($(t,e)),!0}export{g as verifyUpdateManifestSignature,p as validateUpdateManifest,E as updateManifestPayload,T as stageDesktopUpdate,j as sendDesktopInvites,U as resolveDevWindowUrl,_ as resolveDesktopLauncher,P as resolveCraftBinary,W as openDevWindow,x as desktopSupportMatrix,I as desktopSupport,J as createUpdateManifestUrl,d as createInviteLink,$ as craftDevCommand,D as compareVersions,F as checkForDesktopUpdate,N as assertDesktopReleaseChannel};

package/dist/launcher.js

@@ -0,0 +1,2 @@
+// @bun
+import{existsSync as o,readFileSync as a}from"fs";import{dirname as d,join as r}from"path";var s=d(process.execPath),i=r(s,"desktop.json"),n=r(s,process.platform==="win32"?"craft-runtime.exe":"craft-runtime");if(!o(i))throw Error(`Desktop manifest not found: ${i}`);if(!o(n))throw Error(`Craft runtime not found: ${n}`);var t=JSON.parse(a(i,"utf8")),e=[n,t.url,"--title",t.title,"--width",String(t.width),"--height",String(t.height),"--no-devtools"];if(t.darkMode)e.push("--dark");if(t.systemTray)e.push("--system-tray");if(t.hideDockIcon)e.push("--hide-dock-icon");var c=Bun.spawn(e,{stdin:"inherit",stdout:"inherit",stderr:"inherit"});process.exit(await c.exited);

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@stacksjs/desktop-build",
+  "type": "module",
+  "sideEffects": false,
+  "version": "0.70.234",
+  "description": "Build and launch Craft desktop applications for Stacks",
+  "author": "Chris Breuer",
+  "contributors": [
+    "Chris Breuer <chris@stacksjs.com>"
+  ],
+  "license": "MIT",
+  "funding": "https://github.com/sponsors/chrisbbreuer",
+  "homepage": "https://github.com/stacksjs/stacks/tree/main/storage/framework/core/desktop#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/stacksjs/stacks.git",
+    "directory": "./storage/framework/core/desktop"
+  },
+  "bugs": {
+    "url": "https://github.com/stacksjs/stacks/issues"
+  },
+  "keywords": [
+    "desktop",
+    "nexmo",
+    "twilio",
+    "aws",
+    "sms",
+    "email",
+    "database",
+    "slack",
+    "discord",
+    "webhooks",
+    "stacks"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "bun": "./dist/index.js",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./*": {
+      "bun": "./dist/*",
+      "import": "./dist/*",
+      "default": "./dist/*"
+    }
+  },
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "README.md",
+    "dist"
+  ],
+  "scripts": {
+    "dev": "bun ../../actions/src/dev/desktop.ts",
+    "dev:app": "bun ../../actions/src/dev/desktop.ts",
+    "build": "bun build.ts",
+    "build:app": "bun ../../actions/src/build/desktop.ts",
+    "typecheck": "bun tsc --noEmit",
+    "prepublishOnly": "bun run build"
+  },
+  "devDependencies": {
+    "@stacksjs/build": "0.70.234",
+    "better-dx": "^0.2.17",
+    "@stacksjs/server": "0.70.234"
+  }
+}