@stacksjs/desktop 0.70.161 → 0.70.163

package/README.md

@@ -2,11 +2,11 @@
 
 ## Features
 
-- Native macOS, Linux, and Windows windows powered by Craft
+- Experimental native macOS, Linux, and Windows windows powered by Craft
 - Pretty development URLs through the Stacks rpx and tlsx integration
 - Hot reload and native developer tools
 - Multi-recipient invite delivery with application-owned token and mail callbacks
-- HTTPS update checks with SHA-256 verification and atomic staging
+- HTTPS update checks with Ed25519 manifest signatures, SHA-256 artifact verification, and atomic staging
 
 ## Usage
 
@@ -28,6 +28,21 @@ await openDevWindow(3000, {
 
 Craft is provisioned by Pantry from `config/deps.ts`. Run `pantry install` if the native binary is not available yet.
 
+## Support status
+
+There are currently **no stable desktop distribution targets**. Local Craft
+development and unpackaged bundles are experimental on macOS arm64/x64, Linux
+x64, and Windows x64. Linux arm64 and every unlisted target are unsupported.
+Exact OS versions remain unqualified until the native install/update matrix in
+[#2063](https://github.com/stacksjs/stacks/issues/2063) is retained. Platform
+signing and macOS notarization are tracked in
+[#2062](https://github.com/stacksjs/stacks/issues/2062).
+
+`buddy build:desktop` defaults to the experimental channel and emits
+`provenance.json` plus `checksums.sha256`. Setting
+`DESKTOP_RELEASE_CHANNEL=stable` fails until the checked support matrix contains
+a fully evidenced stable row.
+
 Invite delivery stays transport-neutral so applications can use their configured Stacks mail provider:
 
 ```ts
@@ -40,7 +55,9 @@ await sendDesktopInvites(users, {
 })
 ```
 
-The updater never executes unverified downloads. Check the signed release channel, then stage the checksum-verified artifact for the platform installer:
+The updater never stages an unsigned or untrusted release manifest. Configure an
+Ed25519 public key out of band, check the signed channel, then pass the same trust
+set when staging the checksum-verified artifact:
 
 ```ts
 import { checkForDesktopUpdate, stageDesktopUpdate } from '@stacksjs/desktop'
@@ -48,10 +65,15 @@ import { checkForDesktopUpdate, stageDesktopUpdate } from '@stacksjs/desktop'
 const update = await checkForDesktopUpdate({
   currentVersion: '1.4.0',
   manifestUrl: 'https://app.example.com/desktop/updates/stable.json',
+  trustedKeys: {
+    'release-2026': process.env.DESKTOP_UPDATE_PUBLIC_KEY,
+  },
 })
 
 if (update)
-  await stageDesktopUpdate(update, '/path/to/update.bin')
+  await stageDesktopUpdate(update, '/path/to/update.bin', fetch, {
+    'release-2026': process.env.DESKTOP_UPDATE_PUBLIC_KEY,
+  })
 ```
 
 ## Testing

package/dist/index.js

@@ -1,2 +1,2 @@
 // @bun
-import{existsSync as p}from"fs";import{homedir as v}from"os";import{join as n}from"path";function m(t,e,r={}){if(!e.trim())throw Error("Invite token is required");let s=new URL("/invite",/^https?:\/\//.test(t)?t:`https://${t}`);if(s.searchParams.set("token",e),r.email)s.searchParams.set("email",r.email);if(r.team)s.searchParams.set("team",r.team);if(r.role)s.searchParams.set("role",r.role);if(r.expiresAt){let i=r.expiresAt instanceof Date?r.expiresAt:new Date(r.expiresAt);if(Number.isNaN(i.valueOf()))throw Error("Invite expiration must be a valid date");s.searchParams.set("expires",i.toISOString())}return s.toString()}async function U(t,e){return Promise.all(t.map(async(r)=>{let s=typeof r==="string"?{email:r}:r;try{h(s.email);let i=await e.createToken(s),a=m(e.baseUrl,i,{email:s.email,team:s.team,role:s.role,expiresAt:e.expiresAt});return await e.send({recipient:s,url:a}),{recipient:s,url:a,delivered:!0}}catch(i){return{recipient:s,url:"",delivered:!1,error:i instanceof Error?i.message:String(i)}}}))}function h(t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t))throw Error(`Invalid invite email: ${t}`)}import{createHash as k}from"crypto";import{mkdir as g,rename as d,writeFile as l}from"fs/promises";import{dirname as D}from"path";async function L(t){o(t.manifestUrl);let e=await(t.fetcher||fetch)(t.manifestUrl,{headers:{Accept:"application/json"}});if(!e.ok)throw Error(`Desktop update check failed with HTTP ${e.status}`);let r=u(await e.json());return w(r.version,t.currentVersion)>0?r:null}async function z(t,e,r=fetch){u(t),o(t.url);let s=await r(t.url);if(!s.ok)throw Error(`Desktop update download failed with HTTP ${s.status}`);let i=new Uint8Array(await s.arrayBuffer());if(t.size!==void 0&&i.byteLength!==t.size)throw Error(`Desktop update size mismatch: expected ${t.size}, received ${i.byteLength}`);if(k("sha256").update(i).digest("hex")!==t.sha256.toLowerCase())throw Error("Desktop update checksum mismatch");await g(D(e),{recursive:!0});let f=`${e}.download-${crypto.randomUUID()}`;return await l(f,i,{mode:448}),await d(f,e),{manifest:t,path:e,bytes:i.byteLength}}function w(t,e){let r=c(t),s=c(e);for(let i=0;i<3;i++){let a=r[i]-s[i];if(a!==0)return Math.sign(a)}return 0}function u(t){if(!t||typeof t!=="object")throw Error("Desktop update manifest must be an object");let e=t;if(c(e.version||""),typeof e.url!=="string")throw Error("Desktop update manifest requires a URL");if(typeof e.sha256!=="string"||!/^[a-f0-9]{64}$/i.test(e.sha256))throw Error("Desktop update manifest requires a SHA-256 checksum");if(e.size!==void 0&&(!Number.isInteger(e.size)||e.size<0))throw Error("Desktop update manifest size must be a non-negative integer");return e}function c(t){let e=t.match(/^v?(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?$/);if(!e)throw Error(`Invalid semantic version: ${t}`);return[Number(e[1]),Number(e[2]),Number(e[3])]}function o(t){let e=new URL(t),r=["localhost","127.0.0.1","::1"].includes(e.hostname);if(e.protocol!=="https:"&&!(e.protocol==="http:"&&r))throw Error("Desktop updates require HTTPS outside loopback development")}function y(t=process.env.CRAFT_BIN){if(t){if(!p(t))throw Error(`Craft binary not found: ${t}`);return t}let e=n(v(),"Code/Tools/craft");return[n(e,"packages/zig/zig-out/bin/craft"),n(e,"craft"),n(e,"bin/craft")].find((s)=>p(s))||"craft"}function I(t,e={}){if(!Number.isInteger(t)||t<1||t>65535)throw RangeError(`Invalid desktop development port: ${t}`);let r=e.url||process.env.APP_URL;if(!r)return"https://stacks.test";let s=/^https?:\/\//.test(r)?r:`https://${r}`;return new URL(s).toString().replace(/\/$/,"")}function b(t,e={}){let r=[y(e.craftBin),I(t,e),"--title",e.title||"Stacks","--width",String(e.width||1400),"--height",String(e.height||900)];if(e.hotReload!==!1)r.push("--hot-reload");if(e.devTools===!1)r.push("--no-devtools");if(e.darkMode)r.push("--dark");if(e.systemTray)r.push("--system-tray");if(e.hideDockIcon)r.push("--hide-dock-icon");if(e.menubarOnly)r.push("--menubar-only");return r}function N(t,e="stable"){if(!/^[a-z0-9-]+$/i.test(e))throw Error("Update channel may only contain letters, numbers, and hyphens");return new URL(`/desktop/updates/${e}.json`,/^https?:\/\//.test(t)?t:`https://${t}`).toString()}async function P(t){Bun.spawn(t,{stdin:"inherit",stdout:"inherit",stderr:"inherit"}).unref()}async function H(t,e={},r=P){return await r(b(t,e)),!0}export{u as validateUpdateManifest,z as stageDesktopUpdate,U as sendDesktopInvites,I as resolveDevWindowUrl,y as resolveCraftBinary,H as openDevWindow,N as createUpdateManifestUrl,m as createInviteLink,b as craftDevCommand,w as compareVersions,L as checkForDesktopUpdate};
+import{existsSync as l}from"fs";import{homedir as R}from"os";import{join as a}from"path";function d(t,e,s={}){if(!e.trim())throw Error("Invite token is required");let r=new URL("/invite",/^https?:\/\//.test(t)?t:`https://${t}`);if(r.searchParams.set("token",e),s.email)r.searchParams.set("email",s.email);if(s.team)r.searchParams.set("team",s.team);if(s.role)r.searchParams.set("role",s.role);if(s.expiresAt){let i=s.expiresAt instanceof Date?s.expiresAt:new Date(s.expiresAt);if(Number.isNaN(i.valueOf()))throw Error("Invite expiration must be a valid date");r.searchParams.set("expires",i.toISOString())}return r.toString()}async function L(t,e){return Promise.all(t.map(async(s)=>{let r=typeof s==="string"?{email:s}:s;try{k(r.email);let i=await e.createToken(r),n=d(e.baseUrl,i,{email:r.email,team:r.team,role:r.role,expiresAt:e.expiresAt});return await e.send({recipient:r,url:n}),{recipient:r,url:n,delivered:!0}}catch(i){return{recipient:r,url:"",delivered:!1,error:i instanceof Error?i.message:String(i)}}}))}function k(t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t))throw Error(`Invalid invite email: ${t}`)}import{createHash as f,createPublicKey as h,verify as m}from"crypto";import{mkdir as b,rename as w,writeFile as v}from"fs/promises";import{dirname as y}from"path";async function q(t){g(t.manifestUrl);let e=await(t.fetcher||fetch)(t.manifestUrl,{headers:{Accept:"application/json"}});if(!e.ok)throw Error(`Desktop update check failed with HTTP ${e.status}`);let s=u(await e.json());return p(s,t.trustedKeys),D(s.version,t.currentVersion)>0?s:null}async function O(t,e,s=fetch,r){if(u(t),!r)throw Error("Desktop update staging requires trusted signing keys");p(t,r),g(t.url);let i=await s(t.url);if(!i.ok)throw Error(`Desktop update download failed with HTTP ${i.status}`);let n=new Uint8Array(await i.arrayBuffer());if(n.byteLength!==t.size)throw Error(`Desktop update size mismatch: expected ${t.size}, received ${n.byteLength}`);if(f("sha256").update(n).digest("hex")!==t.sha256.toLowerCase())throw Error("Desktop update checksum mismatch");await b(y(e),{recursive:!0});let c=`${e}.download-${crypto.randomUUID()}`;return await v(c,n,{mode:448}),await w(c,e),{manifest:t,path:e,bytes:n.byteLength}}function D(t,e){let s=o(t),r=o(e);for(let i=0;i<3;i++){let n=s[i]-r[i];if(n!==0)return Math.sign(n)}return 0}function u(t){if(!t||typeof t!=="object")throw Error("Desktop update manifest must be an object");let e=t;if(o(e.version||""),typeof e.url!=="string")throw Error("Desktop update manifest requires a URL");if(typeof e.sha256!=="string"||!/^[a-f0-9]{64}$/i.test(e.sha256))throw Error("Desktop update manifest requires a SHA-256 checksum");if(!Number.isInteger(e.size)||e.size<0)throw Error("Desktop update manifest requires a non-negative integer size");if(typeof e.sourceRevision!=="string"||!/^[0-9a-f]{40}$/.test(e.sourceRevision))throw Error("Desktop update manifest requires a full source revision");if(typeof e.platform!=="string"||!["darwin","linux","win32"].includes(e.platform))throw Error("Desktop update manifest requires a supported platform identifier");if(typeof e.architecture!=="string"||!/^[a-z0-9_-]+$/.test(e.architecture))throw Error("Desktop update manifest requires an architecture");if(typeof e.signingKeyId!=="string"||!/^[a-zA-Z0-9._-]+$/.test(e.signingKeyId))throw Error("Desktop update manifest requires a signing key ID");if(typeof e.signature!=="string"||!/^[A-Za-z0-9_-]+$/.test(e.signature))throw Error("Desktop update manifest requires an Ed25519 signature");return e}function E(t){return Buffer.from(JSON.stringify({version:t.version,url:t.url,sha256:t.sha256.toLowerCase(),size:t.size,sourceRevision:t.sourceRevision,platform:t.platform,architecture:t.architecture,signingKeyId:t.signingKeyId,publishedAt:t.publishedAt||null,notes:t.notes||null}),"utf8")}function p(t,e){let s=e[t.signingKeyId];if(!s)throw Error(`Desktop update signing key is not trusted: ${t.signingKeyId}`);let r="ed25519-public:";if(!s.startsWith(r))throw Error("Desktop update signing key has an invalid encoding");try{let i=h({key:Buffer.from(s.slice(r.length),"base64url"),format:"der",type:"spki"}),n=Buffer.from(t.signature,"base64url");if(i.asymmetricKeyType!=="ed25519"||n.length!==64||!m(null,E(t),i,n))throw Error("invalid")}catch{throw Error("Desktop update manifest signature verification failed")}}function o(t){let e=t.match(/^v?(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?$/);if(!e)throw Error(`Invalid semantic version: ${t}`);return[Number(e[1]),Number(e[2]),Number(e[3])]}function g(t){let e=new URL(t),s=["localhost","127.0.0.1","::1"].includes(e.hostname);if(e.protocol!=="https:"&&!(e.protocol==="http:"&&s))throw Error("Desktop updates require HTTPS outside loopback development")}var x=[{platform:"darwin",architecture:"arm64",status:"experimental",osVersions:["macOS 15 runner"],packageFormat:"DMG + PKG",signing:"pending",notarization:"pending",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["Lifecycle fixtures are unsigned while platform identities remain unprovisioned.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]},{platform:"darwin",architecture:"x64",status:"experimental",osVersions:["macOS 15 Intel runner"],packageFormat:"DMG + PKG",signing:"pending",notarization:"pending",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["Lifecycle fixtures are unsigned while platform identities remain unprovisioned.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]},{platform:"linux",architecture:"x64",status:"experimental",osVersions:["Ubuntu 24.04 runner"],packageFormat:"DEB",signing:"pending",notarization:"not-applicable",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["The lifecycle fixture is unsigned and no package repository support policy is published.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]},{platform:"win32",architecture:"x64",status:"experimental",osVersions:["Windows Server 2025 runner"],packageFormat:"MSI + ZIP",signing:"pending",notarization:"not-applicable",installLaunchEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",updateRollbackEvidence:"https://github.com/stacksjs/stacks/actions/runs/29890804159",packagingEvidence:"https://github.com/stacksjs/stacks/blob/main/protocol/evidence/craft.json",blockingIssues:["https://github.com/stacksjs/stacks/issues/2062","https://github.com/home-lang/craft/issues/11"],limitations:["The lifecycle fixture is not Authenticode-signed.","Craft v0.0.48 is source-tagged, but its upstream release workflow is blocked by repository Actions policy."]}];function I(t=process.platform,e=process.arch){return x.find((s)=>s.platform===t&&s.architecture===e)}function F(t,e=process.platform,s=process.arch){let r=I(e,s);if(!r)throw Error(`Desktop target ${e}/${s} is unsupported`);if(t==="stable"&&(r.status!=="stable"||r.signing!=="enforced"||r.platform==="darwin"&&r.notarization!=="enforced"||!r.installLaunchEvidence||!r.updateRollbackEvidence))throw Error(`Desktop target ${e}/${s} cannot be released as stable; complete stacksjs/stacks#2059, #2062, and #2063 first`);return r}function S(t=process.env.CRAFT_BIN){if(t){if(!l(t))throw Error(`Craft binary not found: ${t}`);return t}let e=a(R(),"Code/Tools/craft");return[a(e,"packages/zig/zig-out/bin/craft"),a(e,"craft"),a(e,"bin/craft")].find((r)=>l(r))||"craft"}function A(t,e={}){if(!Number.isInteger(t)||t<1||t>65535)throw RangeError(`Invalid desktop development port: ${t}`);let s=e.url||process.env.APP_URL;if(!s)return"https://stacks.test";let r=/^https?:\/\//.test(s)?s:`https://${s}`;return new URL(r).toString().replace(/\/$/,"")}function P(t,e={}){let s=[S(e.craftBin),A(t,e),"--title",e.title||"Stacks","--width",String(e.width||1400),"--height",String(e.height||900)];if(e.hotReload!==!1)s.push("--hot-reload");if(e.devTools===!1)s.push("--no-devtools");if(e.darkMode)s.push("--dark");if(e.systemTray)s.push("--system-tray");if(e.hideDockIcon)s.push("--hide-dock-icon");if(e.menubarOnly)s.push("--menubar-only");return s}function H(t,e="stable"){if(!/^[a-z0-9-]+$/i.test(e))throw Error("Update channel may only contain letters, numbers, and hyphens");return new URL(`/desktop/updates/${e}.json`,/^https?:\/\//.test(t)?t:`https://${t}`).toString()}async function U(t){Bun.spawn(t,{stdin:"inherit",stdout:"inherit",stderr:"inherit"}).unref()}async function G(t,e={},s=U){return await s(P(t,e)),!0}export{p as verifyUpdateManifestSignature,u as validateUpdateManifest,E as updateManifestPayload,O as stageDesktopUpdate,L as sendDesktopInvites,A as resolveDevWindowUrl,S as resolveCraftBinary,G as openDevWindow,x as desktopSupportMatrix,I as desktopSupport,H as createUpdateManifestUrl,d as createInviteLink,P as craftDevCommand,D as compareVersions,q as checkForDesktopUpdate,F as assertDesktopReleaseChannel};

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/desktop",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.161",
+  "version": "0.70.163",
   "description": "The Stacks Desktop engine.",
   "author": "Chris Breuer",
   "contributors": [
@@ -62,8 +62,8 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@stacksjs/build": "0.70.161",
+    "@stacksjs/build": "0.70.163",
     "better-dx": "^0.2.17",
-    "@stacksjs/server": "0.70.161"
+    "@stacksjs/server": "0.70.163"
   }
 }