@stacksjs/desktop 0.70.160 → 0.70.162

package/README.md

@@ -1,10 +1,14 @@
 # Stacks Desktop
 
-## ☘️ Features
+## Features
 
-- ⚡️
+- Experimental native macOS, Linux, and Windows windows powered by Craft
+- Pretty development URLs through the Stacks rpx and tlsx integration
+- Hot reload and native developer tools
+- Multi-recipient invite delivery with application-owned token and mail callbacks
+- HTTPS update checks with Ed25519 manifest signatures, SHA-256 artifact verification, and atomic staging
 
-## 🤖 Usage
+## Usage
 
 ```bash
 bun install -d @stacksjs/desktop
@@ -13,12 +17,66 @@ bun install -d @stacksjs/desktop
 Now, you can use it in your project:
 
 ```js
-import desktop from '@stacksjs/desktop'
+import { openDevWindow } from '@stacksjs/desktop'
 
-// wip
+await openDevWindow(3000, {
+  title: 'My Stacks App',
+})
 ```
 
-## 🧪 Testing
+`APP_URL` is used by default, so a normal Stacks project opens its pretty HTTPS URL. Pass `url` only when embedding another development server.
+
+Craft is provisioned by Pantry from `config/deps.ts`. Run `pantry install` if the native binary is not available yet.
+
+## Support status
+
+There are currently **no stable desktop distribution targets**. Local Craft
+development and unpackaged bundles are experimental on macOS arm64/x64, Linux
+x64, and Windows x64. Linux arm64 and every unlisted target are unsupported.
+Exact OS versions remain unqualified until the native install/update matrix in
+[#2063](https://github.com/stacksjs/stacks/issues/2063) is retained. Platform
+signing and macOS notarization are tracked in
+[#2062](https://github.com/stacksjs/stacks/issues/2062).
+
+`buddy build:desktop` defaults to the experimental channel and emits
+`provenance.json` plus `checksums.sha256`. Setting
+`DESKTOP_RELEASE_CHANNEL=stable` fails until the checked support matrix contains
+a fully evidenced stable row.
+
+Invite delivery stays transport-neutral so applications can use their configured Stacks mail provider:
+
+```ts
+import { sendDesktopInvites } from '@stacksjs/desktop'
+
+await sendDesktopInvites(users, {
+  baseUrl: 'https://app.example.com',
+  createToken: user => inviteTokens.create(user),
+  send: invite => mail.send(invite.recipient.email, invite.url),
+})
+```
+
+The updater never stages an unsigned or untrusted release manifest. Configure an
+Ed25519 public key out of band, check the signed channel, then pass the same trust
+set when staging the checksum-verified artifact:
+
+```ts
+import { checkForDesktopUpdate, stageDesktopUpdate } from '@stacksjs/desktop'
+
+const update = await checkForDesktopUpdate({
+  currentVersion: '1.4.0',
+  manifestUrl: 'https://app.example.com/desktop/updates/stable.json',
+  trustedKeys: {
+    'release-2026': process.env.DESKTOP_UPDATE_PUBLIC_KEY,
+  },
+})
+
+if (update)
+  await stageDesktopUpdate(update, '/path/to/update.bin', fetch, {
+    'release-2026': process.env.DESKTOP_UPDATE_PUBLIC_KEY,
+  })
+```
+
+## Testing
 
 ```bash
 bun test

package/dist/index.js

@@ -1,2 +1,2 @@
 // @bun
-async function g(c,f){return!1}export{g as openDevWindow};
+import{existsSync as l}from"fs";import{homedir as R}from"os";import{join as a}from"path";function d(t,e,s={}){if(!e.trim())throw Error("Invite token is required");let r=new URL("/invite",/^https?:\/\//.test(t)?t:`https://${t}`);if(r.searchParams.set("token",e),s.email)r.searchParams.set("email",s.email);if(s.team)r.searchParams.set("team",s.team);if(s.role)r.searchParams.set("role",s.role);if(s.expiresAt){let i=s.expiresAt instanceof Date?s.expiresAt:new Date(s.expiresAt);if(Number.isNaN(i.valueOf()))throw Error("Invite expiration must be a valid date");r.searchParams.set("expires",i.toISOString())}return r.toString()}async function L(t,e){return Promise.all(t.map(async(s)=>{let r=typeof s==="string"?{email:s}:s;try{k(r.email);let i=await e.createToken(r),n=d(e.baseUrl,i,{email:r.email,team:r.team,role:r.role,expiresAt:e.expiresAt});return await e.send({recipient:r,url:n}),{recipient:r,url:n,delivered:!0}}catch(i){return{recipient:r,url:"",delivered:!1,error:i instanceof Error?i.message:String(i)}}}))}function k(t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t))throw Error(`Invalid invite email: ${t}`)}import{createHash as f,createPublicKey as h,verify as m}from"crypto";import{mkdir as b,rename as w,writeFile as v}from"fs/promises";import{dirname as y}from"path";async function q(t){g(t.manifestUrl);let e=await(t.fetcher||fetch)(t.manifestUrl,{headers:{Accept:"application/json"}});if(!e.ok)throw Error(`Desktop update check failed with HTTP ${e.status}`);let s=u(await e.json());return p(s,t.trustedKeys),D(s.version,t.currentVersion)>0?s:null}async function O(t,e,s=fetch,r){if(u(t),!r)throw Error("Desktop update staging requires trusted signing keys");p(t,r),g(t.url);let i=await s(t.url);if(!i.ok)throw Error(`Desktop update download failed with HTTP ${i.status}`);let n=new Uint8Array(await i.arrayBuffer());if(n.byteLength!==t.size)throw Error(`Desktop update size mismatch: expected ${t.size}, received ${n.byteLength}`);if(f("sha256").update(n).digest("hex")!==t.sha256.toLowerCase())throw Error("Desktop update checksum mismatch");await b(y(e),{recursive:!0});let c=`${e}.download-${crypto.randomUUID()}`;return await v(c,n,{mode:448}),await w(c,e),{manifest:t,path:e,bytes:n.byteLength}}function D(t,e){let s=o(t),r=o(e);for(let i=0;i<3;i++){let n=s[i]-r[i];if(n!==0)return Math.sign(n)}return 0}function u(t){if(!t||typeof t!=="object")throw Error("Desktop update manifest must be an object");let e=t;if(o(e.version||""),typeof e.url!=="string")throw Error("Desktop update manifest requires a URL");if(typeof e.sha256!=="string"||!/^[a-f0-9]{64}$/i.test(e.sha256))throw Error("Desktop update manifest requires a SHA-256 checksum");if(!Number.isInteger(e.size)||e.size<0)throw Error("Desktop update manifest requires a non-negative integer size");if(typeof e.sourceRevision!=="string"||!/^[0-9a-f]{40}$/.test(e.sourceRevision))throw Error("Desktop update manifest requires a full source revision");if(typeof e.platform!=="string"||!["darwin","linux","win32"].includes(e.platform))throw Error("Desktop update manifest requires a supported platform identifier");if(typeof e.architecture!=="string"||!/^[a-z0-9_-]+$/.test(e.architecture))throw Error("Desktop update manifest requires an architecture");if(typeof e.signingKeyId!=="string"||!/^[a-zA-Z0-9._-]+$/.test(e.signingKeyId))throw Error("Desktop update manifest requires a signing key ID");if(typeof e.signature!=="string"||!/^[A-Za-z0-9_-]+$/.test(e.signature))throw Error("Desktop update manifest requires an Ed25519 signature");return e}function E(t){return Buffer.from(JSON.stringify({version:t.version,url:t.url,sha256:t.sha256.toLowerCase(),size:t.size,sourceRevision:t.sourceRevision,platform:t.platform,architecture:t.architecture,signingKeyId:t.signingKeyId,publishedAt:t.publishedAt||null,notes:t.notes||null}),"utf8")}function p(t,e){let s=e[t.signingKeyId];if(!s)throw Error(`Desktop update signing key is not trusted: ${t.signingKeyId}`);let r="ed25519-public:";if(!s.startsWith(r))throw Error("Desktop update signing key has an invalid encoding");try{let i=h({key:Buffer.from(s.slice(r.length),"base64url"),format:"der",type:"spki"}),n=Buffer.from(t.signature,"base64url");if(i.asymmetricKeyType!=="ed25519"||n.length!==64||!m(null,E(t),i,n))throw Error("invalid")}catch{throw Error("Desktop update manifest signature verification failed")}}function o(t){let e=t.match(/^v?(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?$/);if(!e)throw Error(`Invalid semantic version: ${t}`);return[Number(e[1]),Number(e[2]),Number(e[3])]}function g(t){let e=new URL(t),s=["localhost","127.0.0.1","::1"].includes(e.hostname);if(e.protocol!=="https:"&&!(e.protocol==="http:"&&s))throw Error("Desktop updates require HTTPS outside loopback development")}var x=[{platform:"darwin",architecture:"arm64",status:"experimental",osVersions:["macOS 15 runner"],packageFormat:"DMG + PKG",signing:"pending",notarization:"pending",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["Lifecycle fixtures are unsigned while platform identities remain unprovisioned.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]},{platform:"darwin",architecture:"x64",status:"experimental",osVersions:["macOS 15 Intel runner"],packageFormat:"DMG + PKG",signing:"pending",notarization:"pending",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["Lifecycle fixtures are unsigned while platform identities remain unprovisioned.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]},{platform:"linux",architecture:"x64",status:"experimental",osVersions:["Ubuntu 24.04 runner"],packageFormat:"DEB",signing:"pending",notarization:"not-applicable",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["The lifecycle fixture is unsigned and no package repository support policy is published.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]},{platform:"win32",architecture:"x64",status:"experimental",osVersions:["Windows Server 2025 runner"],packageFormat:"MSI + ZIP",signing:"pending",notarization:"not-applicable",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["The lifecycle fixture is not Authenticode-signed.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]}];function I(t=process.platform,e=process.arch){return x.find((s)=>s.platform===t&&s.architecture===e)}function F(t,e=process.platform,s=process.arch){let r=I(e,s);if(!r)throw Error(`Desktop target ${e}/${s} is unsupported`);if(t==="stable"&&(r.status!=="stable"||r.signing!=="enforced"||r.platform==="darwin"&&r.notarization!=="enforced"||!r.installLaunchEvidence||!r.updateRollbackEvidence))throw Error(`Desktop target ${e}/${s} cannot be released as stable; complete stacksjs/stacks#2059, #2062, and #2063 first`);return r}function S(t=process.env.CRAFT_BIN){if(t){if(!l(t))throw Error(`Craft binary not found: ${t}`);return t}let e=a(R(),"Code/Tools/craft");return[a(e,"packages/zig/zig-out/bin/craft"),a(e,"craft"),a(e,"bin/craft")].find((r)=>l(r))||"craft"}function A(t,e={}){if(!Number.isInteger(t)||t<1||t>65535)throw RangeError(`Invalid desktop development port: ${t}`);let s=e.url||process.env.APP_URL;if(!s)return"https://stacks.test";let r=/^https?:\/\//.test(s)?s:`https://${s}`;return new URL(r).toString().replace(/\/$/,"")}function P(t,e={}){let s=[S(e.craftBin),A(t,e),"--title",e.title||"Stacks","--width",String(e.width||1400),"--height",String(e.height||900)];if(e.hotReload!==!1)s.push("--hot-reload");if(e.devTools===!1)s.push("--no-devtools");if(e.darkMode)s.push("--dark");if(e.systemTray)s.push("--system-tray");if(e.hideDockIcon)s.push("--hide-dock-icon");if(e.menubarOnly)s.push("--menubar-only");return s}function H(t,e="stable"){if(!/^[a-z0-9-]+$/i.test(e))throw Error("Update channel may only contain letters, numbers, and hyphens");return new URL(`/desktop/updates/${e}.json`,/^https?:\/\//.test(t)?t:`https://${t}`).toString()}async function U(t){Bun.spawn(t,{stdin:"inherit",stdout:"inherit",stderr:"inherit"}).unref()}async function G(t,e={},s=U){return await s(P(t,e)),!0}export{p as verifyUpdateManifestSignature,u as validateUpdateManifest,E as updateManifestPayload,O as stageDesktopUpdate,L as sendDesktopInvites,A as resolveDevWindowUrl,S as resolveCraftBinary,G as openDevWindow,x as desktopSupportMatrix,I as desktopSupport,H as createUpdateManifestUrl,d as createInviteLink,P as craftDevCommand,D as compareVersions,q as checkForDesktopUpdate,F as assertDesktopReleaseChannel};

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/desktop",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.160",
+  "version": "0.70.162",
   "description": "The Stacks Desktop engine.",
   "author": "Chris Breuer",
   "contributors": [
@@ -54,17 +54,16 @@
     "dist"
   ],
   "scripts": {
-    "dev": "bunx --bun vite ../../dashboard -c ../vite-config/src/desktop.ts",
-    "dev:app": "tauri dev",
+    "dev": "bun ../../actions/src/dev/desktop.ts",
+    "dev:app": "bun ../../actions/src/dev/desktop.ts",
     "build": "bun build.ts",
-    "build:app": "bunx --bun vite build ../../dashboard -c ../vite-config/src/desktop.ts",
-    "tauri:build": "tauri build",
+    "build:app": "bun ../../actions/src/build/desktop.ts",
     "typecheck": "bun tsc --noEmit",
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@stacksjs/build": "0.70.160",
+    "@stacksjs/build": "0.70.162",
     "better-dx": "^0.2.17",
-    "@stacksjs/server": "0.70.160"
+    "@stacksjs/server": "0.70.162"
   }
 }