amalgm 0.1.124 → 0.1.125

package/runtime/scripts/amalgm-mcp/events/desktop-release-runner.js

@@ -0,0 +1,1379 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const yaml = require('js-yaml');
+
+const ENGINE_REPO_FULL_NAME = 'amalgm-inc/amalgm-engine';
+const UI_REPO_FULL_NAME = 'amalgm-inc/amalgm-ui';
+const DEFAULT_DESKTOP_RELEASE_REPO_FULL_NAME = 'amalgm-inc/amalgm-desktop-releases';
+const DEFAULT_DESKTOP_LEGACY_BRIDGE_REPO_FULL_NAME = ENGINE_REPO_FULL_NAME;
+const DEFAULT_ENGINE_REPO_URL = 'https://github.com/amalgm-inc/amalgm-engine.git';
+const DEFAULT_UI_REPO_URL = 'https://github.com/amalgm-inc/amalgm-ui.git';
+const DEFAULT_CHECKOUT_ROOT = path.join(os.homedir(), '.amalgm', 'workflow-checkouts', 'amalgm-desktop-release');
+const DEFAULT_ENV_FILE = path.join(os.homedir(), '.amalgm', 'desktop-release.env');
+const DEFAULT_CSC_NAME = 'amalgm, Inc. (C5S6UATV3L)';
+const DEFAULT_DESKTOP_UPDATE_BASE_URL = 'https://amalgm-desktop-releases.fly.dev';
+const DEFAULT_DESKTOP_RELEASE_FLY_APP = 'amalgm-desktop-releases';
+const DEFAULT_DESKTOP_RELEASE_FLY_ROOT = '/data';
+const DEFAULT_DESKTOP_RELEASE_UPLOAD_CHUNK_BYTES = 2 * 1024 * 1024;
+
+function cleanString(value) {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+function parseRepoFullName(value) {
+  const raw = cleanString(value);
+  const match = /^([^/\s]+)\/([^/\s]+)$/.exec(raw);
+  if (!match) throw new Error(`Invalid GitHub repository full name: ${raw || '(missing)'}`);
+  return { owner: match[1], repo: match[2], fullName: `${match[1]}/${match[2]}` };
+}
+
+function normalizeReleaseProvider(value) {
+  const raw = cleanString(value).toLowerCase();
+  if (!raw || raw === 'fly' || raw === 'generic') return 'fly';
+  if (raw === 'github' || raw === 'gh') return 'github';
+  throw new Error(`Unsupported desktop release provider: ${value}`);
+}
+
+function normalizeUpdateProviderForRelease(provider) {
+  return provider === 'github' ? 'github' : 'generic';
+}
+
+function normalizeUploadMethod(value) {
+  const raw = cleanString(value).toLowerCase();
+  if (!raw || raw === 'http' || raw === 'https' || raw === 'chunked' || raw === 'http-chunked') return 'http';
+  if (raw === 'sftp' || raw === 'fly-sftp') return 'sftp';
+  throw new Error(`Unsupported desktop release upload method: ${value}`);
+}
+
+function normalizeHttpBaseUrl(value, label) {
+  const raw = cleanString(value);
+  if (!raw) return '';
+  const url = new URL(raw);
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new Error(`${label} must be http(s), received: ${raw}`);
+  }
+  url.search = '';
+  url.hash = '';
+  if (!url.pathname.endsWith('/')) url.pathname += '/';
+  return url.toString();
+}
+
+function desktopReleaseProvider(env = process.env) {
+  return normalizeReleaseProvider(
+    env.AMALGM_DESKTOP_RELEASE_PROVIDER
+    || env.AMALGM_DESKTOP_UPDATE_PROVIDER
+    || 'fly',
+  );
+}
+
+function desktopUpdateBaseUrl(env = process.env) {
+  return normalizeHttpBaseUrl(
+    env.AMALGM_DESKTOP_UPDATE_BASE_URL || DEFAULT_DESKTOP_UPDATE_BASE_URL,
+    'Desktop update base URL',
+  );
+}
+
+function desktopUpdateUrlForLane(lane, env = process.env) {
+  const explicitUrl = normalizeHttpBaseUrl(env.AMALGM_DESKTOP_UPDATE_URL || '', 'Desktop update URL');
+  if (explicitUrl) return explicitUrl;
+  return new URL(`${lane}/`, desktopUpdateBaseUrl(env)).toString();
+}
+
+function desktopReleaseUploadBaseUrl(env = process.env) {
+  return normalizeHttpBaseUrl(
+    env.AMALGM_DESKTOP_RELEASE_UPLOAD_URL
+    || env.AMALGM_DESKTOP_UPDATE_BASE_URL
+    || DEFAULT_DESKTOP_UPDATE_BASE_URL,
+    'Desktop release upload URL',
+  );
+}
+
+function safeRemotePathSegment(value, label) {
+  const raw = cleanString(value);
+  if (!/^[A-Za-z0-9._-]+$/.test(raw)) {
+    throw new Error(`Invalid ${label}: ${raw || '(missing)'}`);
+  }
+  return raw;
+}
+
+function normalizeRemoteRoot(value) {
+  const raw = cleanString(value) || DEFAULT_DESKTOP_RELEASE_FLY_ROOT;
+  if (!raw.startsWith('/')) throw new Error(`Fly release root must be absolute: ${raw}`);
+  return raw.replace(/\/+$/, '') || '/';
+}
+
+function joinRemotePath(root, ...segments) {
+  const cleanRoot = normalizeRemoteRoot(root);
+  const prefix = cleanRoot === '/' ? '' : cleanRoot;
+  return [prefix, ...segments.map((segment) => safeRemotePathSegment(segment, 'remote path segment'))]
+    .join('/')
+    .replace(/\/+/g, '/');
+}
+
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
+function desktopReleasePublishTarget(env = process.env, lane = 'main') {
+  const provider = desktopReleaseProvider(env);
+  if (provider === 'github') {
+    const releaseRepository = desktopReleaseRepository(env);
+    return {
+      provider,
+      updateProvider: 'github',
+      releaseRepository,
+      releaseUrlBase: `https://github.com/${releaseRepository.fullName}/releases/tag/`,
+    };
+  }
+
+  const flyApp = cleanString(env.AMALGM_DESKTOP_RELEASE_FLY_APP) || DEFAULT_DESKTOP_RELEASE_FLY_APP;
+  const flyRoot = normalizeRemoteRoot(env.AMALGM_DESKTOP_RELEASE_FLY_ROOT);
+  const remoteDir = joinRemotePath(flyRoot, lane);
+  const updateUrl = desktopUpdateUrlForLane(lane, env);
+  const channelFile = desktopReleaseChannelFile(lane);
+  const uploadMethod = normalizeUploadMethod(env.AMALGM_DESKTOP_RELEASE_UPLOAD_METHOD || '');
+  return {
+    provider,
+    updateProvider: 'generic',
+    updateUrl,
+    channelFile,
+    channelUrl: new URL(channelFile, updateUrl).toString(),
+    uploadMethod,
+    uploadBaseUrl: desktopReleaseUploadBaseUrl(env),
+    flyApp,
+    flyRoot,
+    remoteDir,
+    lane,
+  };
+}
+
+function desktopReleaseRepository(env = process.env) {
+  const fullName = cleanString(env.AMALGM_DESKTOP_RELEASE_REPOSITORY)
+    || cleanString(env.AMALGM_DESKTOP_RELEASE_REPO_FULL_NAME);
+  if (fullName) return parseRepoFullName(fullName);
+
+  const owner = cleanString(env.AMALGM_DESKTOP_UPDATE_OWNER)
+    || cleanString(env.AMALGM_DESKTOP_RELEASE_OWNER);
+  const repo = cleanString(env.AMALGM_DESKTOP_UPDATE_REPO)
+    || cleanString(env.AMALGM_DESKTOP_RELEASE_REPO);
+  if (owner || repo) return parseRepoFullName(`${owner || 'amalgm-inc'}/${repo || 'amalgm-desktop-releases'}`);
+
+  return parseRepoFullName(DEFAULT_DESKTOP_RELEASE_REPO_FULL_NAME);
+}
+
+function desktopLegacyBridgeEnabled(env = process.env) {
+  const raw = cleanString(env.AMALGM_DESKTOP_LEGACY_BRIDGE_ENABLED).toLowerCase();
+  if (!raw) return true;
+  return !['0', 'false', 'no', 'off'].includes(raw);
+}
+
+function desktopLegacyBridgeRepository(env = process.env) {
+  const fullName = cleanString(env.AMALGM_DESKTOP_LEGACY_BRIDGE_REPOSITORY)
+    || cleanString(env.AMALGM_DESKTOP_LEGACY_BRIDGE_REPO_FULL_NAME);
+  if (fullName) return parseRepoFullName(fullName);
+
+  const owner = cleanString(env.AMALGM_DESKTOP_LEGACY_BRIDGE_OWNER);
+  const repo = cleanString(env.AMALGM_DESKTOP_LEGACY_BRIDGE_REPO);
+  if (owner || repo) return parseRepoFullName(`${owner || 'amalgm-inc'}/${repo || 'amalgm-engine'}`);
+
+  return parseRepoFullName(DEFAULT_DESKTOP_LEGACY_BRIDGE_REPO_FULL_NAME);
+}
+
+function parseEnvFile(text) {
+  const env = {};
+  for (const line of String(text || '').split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const match = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(trimmed);
+    if (!match) continue;
+    let value = match[2] || '';
+    const quote = value[0];
+    if ((quote === '"' || quote === "'") && value.endsWith(quote)) {
+      value = value.slice(1, -1);
+    }
+    env[match[1]] = value;
+  }
+  return env;
+}
+
+function applyDesktopReleaseEnv(env = process.env) {
+  const candidates = [
+    cleanString(env.AMALGM_DESKTOP_RELEASE_ENV_FILE),
+    DEFAULT_ENV_FILE,
+  ].filter(Boolean);
+
+  for (const filePath of candidates) {
+    if (!fs.existsSync(filePath)) continue;
+    const values = parseEnvFile(fs.readFileSync(filePath, 'utf8'));
+    for (const [key, value] of Object.entries(values)) {
+      if (!cleanString(env[key])) env[key] = value;
+    }
+  }
+
+  return env;
+}
+
+function prependPath(env, dir) {
+  const cleanDir = cleanString(dir);
+  if (!cleanDir) return env.PATH || '';
+  const parts = String(env.PATH || '').split(path.delimiter).filter(Boolean);
+  return [cleanDir, ...parts.filter((part) => part !== cleanDir)].join(path.delimiter);
+}
+
+function desktopReleaseToolEnv(baseEnv = process.env) {
+  const env = { ...baseEnv };
+  applyDesktopReleaseEnv(env);
+  const nodeBin = cleanString(env.AMALGM_DESKTOP_RELEASE_NODE_BIN);
+  if (nodeBin && fs.existsSync(nodeBin)) {
+    env.PATH = prependPath(env, path.dirname(nodeBin));
+  }
+  const pathPrefix = cleanString(env.AMALGM_DESKTOP_RELEASE_PATH_PREFIX);
+  if (pathPrefix) env.PATH = prependPath(env, pathPrefix);
+  env.npm_config_python = cleanString(env.AMALGM_DESKTOP_RELEASE_PYTHON)
+    || cleanString(env.npm_config_python)
+    || '/usr/bin/python3';
+  return env;
+}
+
+function isFullSha(value) {
+  return /^[a-f0-9]{40}$/i.test(cleanString(value));
+}
+
+function laneForBranch(branch) {
+  if (branch === 'preview') return 'preview';
+  if (branch === 'main') return 'main';
+  return null;
+}
+
+function readJsonFile(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+
+function parsePayloadFromEnv(env = process.env) {
+  const payloadFile = cleanString(env.AMALGM_DESKTOP_RELEASE_PAYLOAD_FILE);
+  const payloadJson = payloadFile ? fs.readFileSync(payloadFile, 'utf8') : cleanString(env.AMALGM_DESKTOP_RELEASE_PAYLOAD_JSON);
+  if (!payloadJson) return null;
+  return JSON.parse(payloadJson);
+}
+
+function requestFromEnv(env = process.env) {
+  const payload = parsePayloadFromEnv(env);
+  const repository = cleanString(
+    env.AMALGM_DESKTOP_RELEASE_SOURCE_REPO
+    || payload?.repository?.full_name,
+  );
+  const ref = cleanString(env.AMALGM_DESKTOP_RELEASE_REF || payload?.ref);
+  const branch = cleanString(
+    env.AMALGM_DESKTOP_RELEASE_BRANCH
+    || (ref.startsWith('refs/heads/') ? ref.slice('refs/heads/'.length) : ref),
+  );
+  const after = cleanString(env.AMALGM_DESKTOP_RELEASE_AFTER || payload?.after);
+  const lane = laneForBranch(branch);
+
+  return {
+    payload,
+    repository,
+    ref: ref || (branch ? `refs/heads/${branch}` : ''),
+    branch,
+    after,
+    lane,
+    delivery: cleanString(env.AMALGM_DESKTOP_RELEASE_DELIVERY),
+    dryRun: ['1', 'true', 'yes', 'on'].includes(cleanString(env.AMALGM_DESKTOP_RELEASE_DRY_RUN).toLowerCase()),
+  };
+}
+
+function shouldHandleRequest(request) {
+  if (!request.lane) return { ok: false, reason: `Ignored branch "${request.branch || '(missing)'}".` };
+  if (![ENGINE_REPO_FULL_NAME, UI_REPO_FULL_NAME].includes(request.repository)) {
+    return { ok: false, reason: `Ignored repository "${request.repository || '(missing)'}".` };
+  }
+  if (!isFullSha(request.after)) return { ok: false, reason: `Ignored push without a full after SHA.` };
+  if (/^0{40}$/.test(request.after)) return { ok: false, reason: 'Ignored branch deletion push.' };
+  return { ok: true };
+}
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function scrubLogText(value, env = process.env) {
+  let text = String(value || '');
+  for (const secret of [
+    env.GH_TOKEN,
+    env.GITHUB_TOKEN,
+    env.FLY_ACCESS_TOKEN,
+    env.AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN,
+    env.APPLE_API_KEY,
+    env.APPLE_API_KEY_ID,
+    env.APPLE_API_ISSUER,
+    env.APPLE_ID,
+    env.APPLE_APP_SPECIFIC_PASSWORD,
+    env.APPLE_TEAM_ID,
+    env.APPLE_KEYCHAIN,
+    env.APPLE_KEYCHAIN_PROFILE,
+    process.env.GH_TOKEN,
+    process.env.GITHUB_TOKEN,
+    process.env.FLY_ACCESS_TOKEN,
+    process.env.AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN,
+    process.env.APPLE_API_KEY,
+    process.env.APPLE_API_KEY_ID,
+    process.env.APPLE_API_ISSUER,
+    process.env.APPLE_ID,
+    process.env.APPLE_APP_SPECIFIC_PASSWORD,
+    process.env.APPLE_TEAM_ID,
+    process.env.APPLE_KEYCHAIN,
+    process.env.APPLE_KEYCHAIN_PROFILE,
+  ]) {
+    const cleanSecret = cleanString(secret);
+    if (cleanSecret.length < 8) continue;
+    text = text.replace(new RegExp(escapeRegExp(cleanSecret), 'g'), '[redacted]');
+  }
+  return text;
+}
+
+function releaseLogFile(options = {}) {
+  return cleanString(options.logFile)
+    || cleanString(options.env?.AMALGM_DESKTOP_RELEASE_LOG_FILE)
+    || cleanString(process.env.AMALGM_DESKTOP_RELEASE_LOG_FILE);
+}
+
+function appendReleaseLog(filePath, text) {
+  const logFile = cleanString(filePath);
+  if (!logFile) return;
+  fs.mkdirSync(path.dirname(logFile), { recursive: true });
+  fs.appendFileSync(logFile, text);
+}
+
+function run(command, args, options = {}) {
+  const printable = [command, ...args].join(' ');
+  const logFile = releaseLogFile(options);
+  appendReleaseLog(logFile, [
+    '',
+    `[${new Date().toISOString()}] $ ${scrubLogText(printable, options.env)}`,
+    options.cwd ? `cwd: ${options.cwd}` : null,
+  ].filter(Boolean).join('\n') + '\n');
+  console.log(`$ ${printable}`);
+  const result = spawnSync(command, args, {
+    cwd: options.cwd,
+    env: options.env || process.env,
+    encoding: 'utf8',
+    maxBuffer: Number(options.maxBuffer) || 100 * 1024 * 1024,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  appendReleaseLog(logFile, [
+    `status: ${result.error ? `error: ${result.error.message}` : (result.status ?? result.signal ?? 'unknown')}`,
+    result.stdout ? `stdout:\n${scrubLogText(result.stdout, options.env)}` : null,
+    result.stderr ? `stderr:\n${scrubLogText(result.stderr, options.env)}` : null,
+  ].filter(Boolean).join('\n') + '\n');
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(`${printable} failed with exit code ${result.status ?? result.signal ?? 'unknown'}`);
+  }
+  return result.stdout || '';
+}
+
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function runWithRetry(command, args, options = {}, attempts = 3) {
+  let lastError = null;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return run(command, args, options);
+    } catch (error) {
+      lastError = error;
+      if (attempt >= attempts) break;
+      const delayMs = Math.min(15_000, attempt * 5_000);
+      console.warn(`${command} ${args[0] || ''} failed on attempt ${attempt}; retrying in ${delayMs}ms.`);
+      sleepSync(delayMs);
+    }
+  }
+  throw lastError;
+}
+
+function curlConfigValue(value) {
+  return `"${String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+
+function ghToken(env = process.env) {
+  if (cleanString(env.GH_TOKEN)) return cleanString(env.GH_TOKEN);
+  if (cleanString(env.GITHUB_TOKEN)) return cleanString(env.GITHUB_TOKEN);
+  try {
+    const result = spawnSync('gh', ['auth', 'token'], {
+      env,
+      encoding: 'utf8',
+      maxBuffer: 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (result.error || result.status !== 0) return '';
+    return cleanString(result.stdout);
+  } catch {
+    return '';
+  }
+}
+
+function githubAssetContentType(filePath) {
+  const name = path.basename(filePath);
+  if (name.endsWith('.zip')) return 'application/zip';
+  if (name.endsWith('.dmg')) return 'application/x-apple-diskimage';
+  if (name.endsWith('.yml') || name.endsWith('.yaml')) return 'text/yaml';
+  return 'application/octet-stream';
+}
+
+function githubReleaseAssetIdsByName(releaseId, assetName, cwd, env, releaseRepository) {
+  const jq = `.[] | select(.name == ${JSON.stringify(assetName)}) | .id`;
+  const stdout = run('gh', [
+    'api',
+    `repos/${releaseRepository.fullName}/releases/${releaseId}/assets`,
+    '--paginate',
+    '--jq',
+    jq,
+  ], { cwd, env });
+  return stdout.split(/\r?\n/)
+    .map((line) => cleanString(line))
+    .filter(Boolean);
+}
+
+function deleteGithubReleaseAssetsByName(releaseId, assetName, cwd, env, releaseRepository) {
+  for (const assetId of githubReleaseAssetIdsByName(releaseId, assetName, cwd, env, releaseRepository)) {
+    run('gh', [
+      'api',
+      '-X',
+      'DELETE',
+      `repos/${releaseRepository.fullName}/releases/assets/${assetId}`,
+    ], { cwd, env });
+  }
+}
+
+function githubUploadLimitRate(env = process.env) {
+  return cleanString(env.AMALGM_DESKTOP_RELEASE_UPLOAD_LIMIT_RATE) || '1m';
+}
+
+function uploadGithubReleaseAssetWithCurl(releaseId, filePath, cwd, env, releaseRepository) {
+  const token = ghToken(env);
+  if (!token) throw new Error('Missing GitHub token. Set GH_TOKEN/GITHUB_TOKEN or run gh auth login before uploading desktop release assets.');
+
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-release-upload-'));
+  const configPath = path.join(tempRoot, 'curl.conf');
+  const responsePath = path.join(tempRoot, 'response.json');
+  const assetName = path.basename(filePath);
+  const uploadUrl = `https://uploads.github.com/repos/${releaseRepository.fullName}/releases/${releaseId}/assets?name=${encodeURIComponent(assetName)}`;
+  const limitRate = githubUploadLimitRate(env);
+  const configLines = [
+    'http1.1',
+    'silent',
+    'show-error',
+    'fail',
+    'location',
+    'request = "POST"',
+    'connect-timeout = "30"',
+    limitRate ? `limit-rate = ${curlConfigValue(limitRate)}` : '',
+    `header = ${curlConfigValue(`Authorization: Bearer ${token}`)}`,
+    'header = "Accept: application/vnd.github+json"',
+    `header = ${curlConfigValue(`Content-Type: ${githubAssetContentType(filePath)}`)}`,
+    `data-binary = ${curlConfigValue(`@${filePath}`)}`,
+    `output = ${curlConfigValue(responsePath)}`,
+    'write-out = "%{http_code}\\n"',
+    `url = ${curlConfigValue(uploadUrl)}`,
+    '',
+  ].filter(Boolean);
+
+  try {
+    fs.writeFileSync(configPath, configLines.join('\n'), { mode: 0o600 });
+    const stdout = run('curl', ['--config', configPath], {
+      cwd,
+      env,
+      maxBuffer: 1024 * 1024,
+    });
+    const statusCode = cleanString(stdout).split(/\s+/).filter(Boolean).pop();
+    if (statusCode !== '201') {
+      const response = fs.existsSync(responsePath) ? fs.readFileSync(responsePath, 'utf8') : '';
+      throw new Error(`GitHub asset upload returned HTTP ${statusCode || '(missing)'} for ${assetName}: ${response}`);
+    }
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+function ensureCheckout({ dir, repoUrl, branch, ref }) {
+  fs.mkdirSync(path.dirname(dir), { recursive: true });
+  if (!fs.existsSync(path.join(dir, '.git'))) {
+    if (fs.existsSync(dir)) fs.rmSync(dir, { recursive: true, force: true });
+    run('git', ['clone', repoUrl, dir]);
+  }
+
+  run('git', ['remote', 'set-url', 'origin', repoUrl], { cwd: dir });
+  run('git', ['fetch', '--tags', 'origin', branch], { cwd: dir });
+  if (isFullSha(ref)) {
+    run('git', ['checkout', '--detach', ref], { cwd: dir });
+  } else {
+    run('git', ['checkout', '-B', branch, `origin/${branch}`], { cwd: dir });
+  }
+  run('git', ['reset', '--hard'], { cwd: dir });
+  run('git', ['clean', '-ffd', '-e', 'node_modules/'], { cwd: dir });
+}
+
+function resolveBuildRefs(request) {
+  const branch = request.branch;
+  return {
+    engineRef: request.repository === ENGINE_REPO_FULL_NAME ? request.after : branch,
+    uiRef: request.repository === UI_REPO_FULL_NAME ? request.after : branch,
+  };
+}
+
+function desktopVersion(packageVersion, lane, buildNumber) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-.+)?$/.exec(String(packageVersion || ''));
+  if (!match) throw new Error(`Unsupported package version for desktop build: ${packageVersion}`);
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  const patch = Number(match[3]);
+  const runNumber = Number(buildNumber);
+  if (![major, minor, patch, runNumber].every(Number.isSafeInteger)) {
+    throw new Error(`Invalid desktop version inputs: ${packageVersion}, build ${buildNumber}`);
+  }
+  const desktopPatch = (patch * 1_000_000) + runNumber;
+  const base = `${major}.${minor}.${desktopPatch}`;
+  return lane === 'preview' ? `${base}-preview.1` : base;
+}
+
+function buildNumberFromNow(date = new Date()) {
+  const epoch = Date.UTC(2026, 0, 1, 0, 0, 0);
+  return Math.max(1, Math.floor((date.getTime() - epoch) / 1000));
+}
+
+function copyUiIntoEngine(uiDir, engineDir) {
+  const webDir = path.join(engineDir, 'web');
+  fs.rmSync(webDir, { recursive: true, force: true });
+  fs.mkdirSync(webDir, { recursive: true });
+  run('rsync', [
+    '-a',
+    '--delete',
+    '--exclude', '.git',
+    '--exclude', 'node_modules',
+    '--exclude', '.next',
+    `${uiDir}/`,
+    `${webDir}/`,
+  ]);
+}
+
+function envForBuild(
+  baseEnv,
+  request,
+  sourcePackageVersion,
+  version,
+  refs,
+  shas,
+  appOrigin,
+  releaseRepository = desktopReleaseRepository(baseEnv),
+  publishTarget = desktopReleasePublishTarget(baseEnv, request.lane),
+) {
+  const token = ghToken(baseEnv);
+  if (publishTarget.provider === 'github' && !token) {
+    throw new Error('Missing GitHub token. Set GH_TOKEN/GITHUB_TOKEN or run gh auth login on the builder Mac.');
+  }
+  const env = {
+    ...baseEnv,
+    DESKTOP_RELEASE_LANE: request.lane,
+    DESKTOP_RELEASE_CHANNEL: request.lane === 'preview' ? 'preview' : 'latest',
+    AMALGM_RUNTIME_LABEL: request.lane === 'preview' ? 'preview' : 'main',
+    AMALGM_BRANCH: request.lane,
+    ELECTRON_VERSION: version,
+    AMALGM_DESKTOP_SOURCE_PACKAGE_VERSION: sourcePackageVersion,
+    AMALGM_DESKTOP_ENGINE_REF: refs.engineRef,
+    AMALGM_DESKTOP_UI_REF: refs.uiRef,
+    AMALGM_DESKTOP_ENGINE_SHA: shas.engineSha,
+    AMALGM_DESKTOP_UI_SHA: shas.uiSha,
+    AMALGM_DESKTOP_SOURCE_RUN_ID: request.delivery || `amalgm-automation-${Date.now()}`,
+    AMALGM_DESKTOP_APP_ORIGIN: appOrigin,
+    AMALGM_DESKTOP_RELEASE_PROVIDER: publishTarget.provider,
+    AMALGM_DESKTOP_UPDATE_PROVIDER: publishTarget.updateProvider || normalizeUpdateProviderForRelease(publishTarget.provider),
+    CSC_NAME: baseEnv.CSC_NAME || DEFAULT_CSC_NAME,
+  };
+  if (token) {
+    env.GH_TOKEN = token;
+    env.GITHUB_TOKEN = token;
+  }
+  if (publishTarget.provider === 'github') {
+    env.AMALGM_DESKTOP_UPDATE_OWNER = releaseRepository.owner;
+    env.AMALGM_DESKTOP_UPDATE_REPO = releaseRepository.repo;
+    env.AMALGM_DESKTOP_RELEASE_REPOSITORY = releaseRepository.fullName;
+  } else {
+    env.AMALGM_DESKTOP_UPDATE_BASE_URL = desktopUpdateBaseUrl(baseEnv);
+    env.AMALGM_DESKTOP_UPDATE_URL = publishTarget.updateUrl || desktopUpdateUrlForLane(request.lane, baseEnv);
+    env.AMALGM_DESKTOP_RELEASE_UPLOAD_METHOD = publishTarget.uploadMethod || normalizeUploadMethod(baseEnv.AMALGM_DESKTOP_RELEASE_UPLOAD_METHOD || '');
+    env.AMALGM_DESKTOP_RELEASE_UPLOAD_URL = publishTarget.uploadBaseUrl || desktopReleaseUploadBaseUrl(baseEnv);
+    if (cleanString(baseEnv.AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN)) {
+      env.AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN = cleanString(baseEnv.AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN);
+    }
+    if (cleanString(baseEnv.AMALGM_DESKTOP_RELEASE_UPLOAD_CHUNK_BYTES)) {
+      env.AMALGM_DESKTOP_RELEASE_UPLOAD_CHUNK_BYTES = cleanString(baseEnv.AMALGM_DESKTOP_RELEASE_UPLOAD_CHUNK_BYTES);
+    }
+    env.AMALGM_DESKTOP_RELEASE_FLY_APP = publishTarget.flyApp || DEFAULT_DESKTOP_RELEASE_FLY_APP;
+    env.AMALGM_DESKTOP_RELEASE_FLY_ROOT = publishTarget.flyRoot || DEFAULT_DESKTOP_RELEASE_FLY_ROOT;
+  }
+  for (const key of ['CSC_LINK', 'CSC_KEY_PASSWORD']) {
+    if (!cleanString(env[key])) delete env[key];
+  }
+  return env;
+}
+
+function appOriginForLane(lane, env = process.env) {
+  if (lane === 'preview') {
+    return cleanString(env.AMALGM_DESKTOP_PREVIEW_APP_ORIGIN)
+      || cleanString(env.NEXT_PUBLIC_PREVIEW_SITE_URL)
+      || 'https://preview.amalgm.ai';
+  }
+  return cleanString(env.AMALGM_DESKTOP_MAIN_APP_ORIGIN)
+    || cleanString(env.NEXT_PUBLIC_SITE_URL)
+    || 'https://amalgm.ai';
+}
+
+function writeBundledWebEnv(engineDir, lane, env = process.env) {
+  const supabaseUrl = cleanString(env.NEXT_PUBLIC_SUPABASE_URL);
+  const supabaseAnonKey = cleanString(env.NEXT_PUBLIC_SUPABASE_ANON_KEY);
+  if (!supabaseUrl) throw new Error('Missing NEXT_PUBLIC_SUPABASE_URL for bundled desktop web app.');
+  if (!supabaseAnonKey) throw new Error('Missing NEXT_PUBLIC_SUPABASE_ANON_KEY for bundled desktop web app.');
+  const appOrigin = appOriginForLane(lane, env);
+  fs.writeFileSync(path.join(engineDir, 'web', '.env'), [
+    `NEXT_PUBLIC_SUPABASE_URL=${supabaseUrl}`,
+    `NEXT_PUBLIC_SUPABASE_ANON_KEY=${supabaseAnonKey}`,
+    `NEXT_PUBLIC_SITE_URL=${appOrigin}`,
+    `NEXT_PUBLIC_APP_URL=${appOrigin}`,
+    `NEXT_PUBLIC_AMALGM_RUNTIME_LABEL=${lane === 'preview' ? 'preview' : 'main'}`,
+    '',
+  ].join('\n'));
+  return appOrigin;
+}
+
+function latestReleaseBody(request, version, refs, shas, sourcePackageVersion) {
+  return [
+    `amalgm-desktop-lane: ${request.lane}`,
+    `amalgm-desktop-channel: ${request.lane === 'preview' ? 'preview' : 'latest'}`,
+    `amalgm-desktop-engine-ref: ${refs.engineRef}`,
+    `amalgm-desktop-engine-sha: ${shas.engineSha}`,
+    `amalgm-desktop-ui-ref: ${refs.uiRef}`,
+    `amalgm-desktop-ui-sha: ${shas.uiSha}`,
+    `amalgm-desktop-source-package-version: ${sourcePackageVersion}`,
+    `amalgm-desktop-source-run-id: ${request.delivery || `amalgm-automation-${version}`}`,
+  ].join('\n');
+}
+
+function desktopReleaseChannelFile(lane) {
+  return `${lane === 'preview' ? 'preview' : 'latest'}-mac.yml`;
+}
+
+function desktopReleaseArtifactPaths(buildDir, lane, version) {
+  const names = fs.readdirSync(buildDir);
+  const versionedArtifacts = names
+    .filter((name) => name.includes(version))
+    .filter((name) => (
+      name.endsWith('.dmg')
+      || name.endsWith('.dmg.blockmap')
+      || name.endsWith('.zip')
+      || name.endsWith('.zip.blockmap')
+    ))
+    .sort();
+  const channelFile = desktopReleaseChannelFile(lane);
+  const required = [
+    { label: 'DMG', ok: versionedArtifacts.some((name) => name.endsWith('.dmg')) },
+    { label: 'DMG blockmap', ok: versionedArtifacts.some((name) => name.endsWith('.dmg.blockmap')) },
+    { label: 'zip', ok: versionedArtifacts.some((name) => name.endsWith('.zip')) },
+    { label: 'zip blockmap', ok: versionedArtifacts.some((name) => name.endsWith('.zip.blockmap')) },
+    { label: channelFile, ok: fs.existsSync(path.join(buildDir, channelFile)) },
+  ];
+  const missing = required.filter((item) => !item.ok).map((item) => item.label);
+  if (missing.length > 0) {
+    throw new Error(`Missing desktop release artifact(s): ${missing.join(', ')}`);
+  }
+
+  return [
+    ...versionedArtifacts.map((name) => path.join(buildDir, name)),
+    path.join(buildDir, channelFile),
+  ];
+}
+
+function githubReleaseId(tag, cwd, env, releaseRepository = desktopReleaseRepository(env)) {
+  try {
+    const publishedReleaseId = cleanString(run('gh', [
+      'api',
+      `repos/${releaseRepository.fullName}/releases/tags/${tag}`,
+      '--jq',
+      '.id',
+    ], { cwd, env }));
+    if (publishedReleaseId) return publishedReleaseId;
+  } catch {
+    // Draft releases are not returned by the releases/tags endpoint.
+  }
+
+  try {
+    return cleanString(run('gh', [
+      'api',
+      `repos/${releaseRepository.fullName}/releases`,
+      '--paginate',
+      '--jq',
+      `.[] | select(.tag_name == ${JSON.stringify(tag)}) | .id`,
+    ], { cwd, env })).split(/\r?\n/).find(Boolean) || '';
+  } catch {
+    return '';
+  }
+}
+
+function waitForGithubReleaseId(tag, cwd, env, releaseRepository = desktopReleaseRepository(env)) {
+  let releaseId = '';
+  for (let attempt = 1; attempt <= 6; attempt += 1) {
+    releaseId = githubReleaseId(tag, cwd, env, releaseRepository);
+    if (releaseId) return releaseId;
+    sleepSync(Math.min(10_000, attempt * 2_000));
+  }
+  return releaseId;
+}
+
+function githubReleaseTargetCommitish(refs, releaseRepository) {
+  if (releaseRepository.fullName === ENGINE_REPO_FULL_NAME) return refs.engineRef;
+  return 'main';
+}
+
+function createGithubRelease({ tag, version, body, request, refs, cwd, env, releaseRepository }) {
+  const releaseId = cleanString(runWithRetry('gh', [
+    'api',
+    '-X',
+    'POST',
+    `repos/${releaseRepository.fullName}/releases`,
+    '-f',
+    `tag_name=${tag}`,
+    '-f',
+    `target_commitish=${githubReleaseTargetCommitish(refs, releaseRepository)}`,
+    '-f',
+    `name=${version}`,
+    '-f',
+    `body=${body}`,
+    '-F',
+    'draft=true',
+    '-F',
+    `prerelease=${request.lane === 'preview' ? 'true' : 'false'}`,
+    '-f',
+    'make_latest=false',
+    '--jq',
+    '.id',
+  ], { cwd, env }));
+  if (releaseId) return releaseId;
+  return waitForGithubReleaseId(tag, cwd, env, releaseRepository);
+}
+
+function ensureGithubRelease({ tag, version, request, refs, shas, sourcePackageVersion, cwd, env, releaseRepository = desktopReleaseRepository(env), body: bodyOverride = '' }) {
+  const body = cleanString(bodyOverride) || latestReleaseBody(request, version, refs, shas, sourcePackageVersion);
+  let releaseId = githubReleaseId(tag, cwd, env, releaseRepository);
+  if (!releaseId) {
+    releaseId = createGithubRelease({ tag, version, body, request, refs, cwd, env, releaseRepository });
+  }
+  if (!releaseId) throw new Error(`Failed to resolve GitHub release id for ${tag}`);
+
+  const patchArgs = [
+    'api',
+    '-X',
+    'PATCH',
+    `repos/${releaseRepository.fullName}/releases/${releaseId}`,
+    '-f',
+    `tag_name=${tag}`,
+    '-f',
+    `target_commitish=${githubReleaseTargetCommitish(refs, releaseRepository)}`,
+    '-f',
+    `name=${version}`,
+    '-f',
+    `body=${body}`,
+    '-F',
+    `prerelease=${request.lane === 'preview' ? 'true' : 'false'}`,
+    '-F',
+    'draft=true',
+  ];
+  run('gh', patchArgs, { cwd, env });
+
+  return releaseId;
+}
+
+function publishGithubRelease({ tag, request, cwd, env, releaseRepository = desktopReleaseRepository(env), releaseId: releaseIdOverride = '' }) {
+  const releaseId = cleanString(releaseIdOverride) || githubReleaseId(tag, cwd, env, releaseRepository);
+  if (!releaseId) throw new Error(`Failed to resolve GitHub release id for ${tag}`);
+  run('gh', [
+    'api',
+    '-X',
+    'PATCH',
+    `repos/${releaseRepository.fullName}/releases/${releaseId}`,
+    '-f',
+    `tag_name=${tag}`,
+    '-F',
+    'draft=false',
+    '-F',
+    `prerelease=${request.lane === 'preview' ? 'true' : 'false'}`,
+    '-f',
+    `make_latest=${request.lane === 'main' ? 'true' : 'false'}`,
+  ], { cwd, env });
+}
+
+function uploadGithubReleaseAssets(tag, artifactPaths, cwd, env, releaseRepository = desktopReleaseRepository(env), releaseIdOverride = '') {
+  const releaseId = cleanString(releaseIdOverride) || githubReleaseId(tag, cwd, env, releaseRepository);
+  if (!releaseId) throw new Error(`Failed to resolve GitHub release id for ${tag}`);
+  const channelPath = artifactPaths.find((filePath) => filePath.endsWith('-mac.yml'));
+  const uploadPaths = [
+    ...artifactPaths.filter((filePath) => filePath !== channelPath),
+    channelPath,
+  ].filter(Boolean);
+
+  for (const filePath of uploadPaths) {
+    const assetName = path.basename(filePath);
+    let lastError = null;
+    const attempts = Number(env.AMALGM_DESKTOP_RELEASE_UPLOAD_ATTEMPTS) || 4;
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+      try {
+        deleteGithubReleaseAssetsByName(releaseId, assetName, cwd, env, releaseRepository);
+        uploadGithubReleaseAssetWithCurl(releaseId, filePath, cwd, env, releaseRepository);
+        lastError = null;
+        break;
+      } catch (error) {
+        lastError = error;
+        if (attempt >= attempts) break;
+        const delayMs = Math.min(30_000, attempt * 10_000);
+        console.warn(`asset upload failed for ${assetName} on attempt ${attempt}; retrying in ${delayMs}ms.`);
+        sleepSync(delayMs);
+      }
+    }
+    if (lastError) throw lastError;
+  }
+}
+
+function absoluteAssetUrl(updateBaseUrl, assetUrl) {
+  const raw = cleanString(assetUrl);
+  if (!raw) return raw;
+  const url = new URL(raw, normalizeHttpBaseUrl(updateBaseUrl, 'Desktop update URL'));
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new Error(`Desktop release asset URL must be http(s), received: ${raw}`);
+  }
+  return url.toString();
+}
+
+function rewritePackageAssetReferences(packages, updateBaseUrl) {
+  if (!packages || typeof packages !== 'object' || Array.isArray(packages)) return;
+  for (const packageInfo of Object.values(packages)) {
+    if (!packageInfo || typeof packageInfo !== 'object' || Array.isArray(packageInfo)) continue;
+    for (const key of ['path', 'file', 'url']) {
+      if (typeof packageInfo[key] === 'string') {
+        packageInfo[key] = absoluteAssetUrl(updateBaseUrl, packageInfo[key]);
+      }
+    }
+  }
+}
+
+function bridgeChannelInfoForBase(channelText, updateBaseUrl) {
+  const channelInfo = yaml.load(String(channelText || ''));
+  if (!channelInfo || typeof channelInfo !== 'object' || Array.isArray(channelInfo)) {
+    throw new Error('Desktop release channel file is not a YAML object.');
+  }
+
+  if (Array.isArray(channelInfo.files)) {
+    for (const file of channelInfo.files) {
+      if (!file || typeof file !== 'object' || Array.isArray(file)) continue;
+      if (typeof file.url === 'string') file.url = absoluteAssetUrl(updateBaseUrl, file.url);
+    }
+  }
+  if (typeof channelInfo.path === 'string') {
+    channelInfo.path = absoluteAssetUrl(updateBaseUrl, channelInfo.path);
+  }
+  rewritePackageAssetReferences(channelInfo.packages, updateBaseUrl);
+
+  return yaml.dump(channelInfo, {
+    lineWidth: -1,
+    noRefs: true,
+    sortKeys: false,
+  });
+}
+
+function legacyGithubBridgeReleaseBody(request, version, refs, shas, sourcePackageVersion, publishTarget) {
+  return [
+    'amalgm-desktop-legacy-bridge: true',
+    `amalgm-desktop-lane: ${request.lane}`,
+    `amalgm-desktop-channel: ${request.lane === 'preview' ? 'preview' : 'latest'}`,
+    `amalgm-desktop-engine-ref: ${refs.engineRef}`,
+    `amalgm-desktop-engine-sha: ${shas.engineSha}`,
+    `amalgm-desktop-ui-ref: ${refs.uiRef}`,
+    `amalgm-desktop-ui-sha: ${shas.uiSha}`,
+    `amalgm-desktop-source-package-version: ${sourcePackageVersion}`,
+    `amalgm-desktop-source-run-id: ${request.delivery || `amalgm-automation-${version}`}`,
+    `amalgm-desktop-update-url: ${publishTarget.updateUrl || ''}`,
+    '',
+    'This release exists only for old macOS clients whose embedded updater still checks GitHub.',
+    'The channel YAML points those clients at the Fly-hosted desktop update feed.',
+  ].join('\n');
+}
+
+function desktopLegacyBridgePlan(env, publishTarget) {
+  if (!publishTarget || publishTarget.provider === 'github') {
+    return { enabled: false, skipped: true, reason: 'Desktop release provider is GitHub.' };
+  }
+  if (!desktopLegacyBridgeEnabled(env)) {
+    return { enabled: false, skipped: true, reason: 'Legacy GitHub updater bridge disabled.' };
+  }
+  return {
+    enabled: true,
+    repository: desktopLegacyBridgeRepository(env).fullName,
+    channelFile: publishTarget.channelFile || '',
+    updateUrl: publishTarget.updateUrl || '',
+  };
+}
+
+function publishLegacyGithubBridgeRelease({
+  tag,
+  version,
+  request,
+  refs,
+  shas,
+  sourcePackageVersion,
+  cwd,
+  env,
+  publishTarget,
+  channelPath,
+}) {
+  const plan = desktopLegacyBridgePlan(env, publishTarget);
+  if (!plan.enabled) return plan;
+  if (!channelPath) throw new Error('Missing desktop release channel file for legacy GitHub updater bridge.');
+
+  const bridgeRepository = desktopLegacyBridgeRepository(env);
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-desktop-legacy-bridge-'));
+  const bridgeChannelPath = path.join(tempRoot, path.basename(channelPath));
+  try {
+    fs.writeFileSync(
+      bridgeChannelPath,
+      bridgeChannelInfoForBase(fs.readFileSync(channelPath, 'utf8'), publishTarget.updateUrl),
+    );
+    const body = legacyGithubBridgeReleaseBody(request, version, refs, shas, sourcePackageVersion, publishTarget);
+    const releaseId = ensureGithubRelease({
+      tag,
+      version,
+      request,
+      refs,
+      shas,
+      sourcePackageVersion,
+      cwd,
+      env,
+      releaseRepository: bridgeRepository,
+      body,
+    });
+    uploadGithubReleaseAssets(tag, [bridgeChannelPath], cwd, env, bridgeRepository, releaseId);
+    publishGithubRelease({ tag, request, cwd, env, releaseRepository: bridgeRepository, releaseId });
+    return {
+      enabled: true,
+      skipped: false,
+      repository: bridgeRepository.fullName,
+      releaseUrl: `https://github.com/${bridgeRepository.fullName}/releases/tag/${tag}`,
+      channelFile: path.basename(channelPath),
+      updateUrl: publishTarget.updateUrl || '',
+    };
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+function desktopReleaseMetadata({ tag, version, request, refs, shas, sourcePackageVersion, publishTarget, artifacts }) {
+  return {
+    provider: publishTarget.provider,
+    updateProvider: publishTarget.updateProvider,
+    updateUrl: publishTarget.updateUrl || '',
+    channelFile: desktopReleaseChannelFile(request.lane),
+    releaseUrl: publishTarget.channelUrl || '',
+    tag,
+    version,
+    lane: request.lane,
+    branch: request.branch,
+    repository: request.repository,
+    refs,
+    shas,
+    sourcePackageVersion,
+    sourceRunId: request.delivery || `amalgm-automation-${version}`,
+    artifacts: artifacts.map((filePath) => path.basename(filePath)),
+    publishedAt: new Date().toISOString(),
+  };
+}
+
+function desktopReleaseUploadChunkBytes(env = process.env) {
+  const value = Number(env.AMALGM_DESKTOP_RELEASE_UPLOAD_CHUNK_BYTES) || DEFAULT_DESKTOP_RELEASE_UPLOAD_CHUNK_BYTES;
+  return Math.max(64 * 1024, Math.min(value, 8 * 1024 * 1024));
+}
+
+function orderedReleaseUploadPaths(artifactPaths) {
+  const channelPath = artifactPaths.find((filePath) => filePath.endsWith('-mac.yml'));
+  return [
+    ...artifactPaths.filter((filePath) => filePath !== channelPath),
+    channelPath,
+  ].filter(Boolean);
+}
+
+function uploadRequestWithCurl({ method, url, token, cwd, env, dataFile = '', dataText = '', expectedStatuses = [200] }) {
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-release-http-upload-'));
+  const configPath = path.join(tempRoot, 'curl.conf');
+  const responsePath = path.join(tempRoot, 'response.json');
+  const bodyPath = dataText ? path.join(tempRoot, 'body.json') : dataFile;
+  const configLines = [
+    'silent',
+    'show-error',
+    'location',
+    `request = ${curlConfigValue(method)}`,
+    'connect-timeout = "30"',
+    `header = ${curlConfigValue(`x-upload-token: ${token}`)}`,
+    dataText ? 'header = "content-type: application/json"' : '',
+    dataFile ? 'header = "content-type: application/octet-stream"' : '',
+    bodyPath ? `data-binary = ${curlConfigValue(`@${bodyPath}`)}` : '',
+    `output = ${curlConfigValue(responsePath)}`,
+    'write-out = "%{http_code}\\n"',
+    `url = ${curlConfigValue(url)}`,
+    '',
+  ].filter(Boolean);
+
+  try {
+    if (dataText) fs.writeFileSync(bodyPath, dataText);
+    fs.writeFileSync(configPath, configLines.join('\n'), { mode: 0o600 });
+    const stdout = run('curl', ['--config', configPath], {
+      cwd,
+      env,
+      maxBuffer: 1024 * 1024,
+    });
+    const statusCode = cleanString(stdout).split(/\s+/).filter(Boolean).pop();
+    if (!expectedStatuses.map(String).includes(statusCode)) {
+      const response = fs.existsSync(responsePath) ? fs.readFileSync(responsePath, 'utf8') : '';
+      throw new Error(`Desktop release upload ${method} returned HTTP ${statusCode || '(missing)'} for ${url}: ${response.slice(0, 1000)}`);
+    }
+    return fs.existsSync(responsePath) ? fs.readFileSync(responsePath, 'utf8') : '';
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+function uploadRequestWithRetry(params, attempts = Number(params.env?.AMALGM_DESKTOP_RELEASE_UPLOAD_ATTEMPTS) || 4) {
+  let lastError = null;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return uploadRequestWithCurl(params);
+    } catch (error) {
+      lastError = error;
+      if (attempt >= attempts) break;
+      const delayMs = Math.min(15_000, attempt * 3_000);
+      console.warn(`desktop release upload ${params.method} failed on attempt ${attempt}; retrying in ${delayMs}ms.`);
+      sleepSync(delayMs);
+    }
+  }
+  throw lastError;
+}
+
+function uploadHttpReleaseFile({ filePath, cwd, env, publishTarget }) {
+  const token = cleanString(env.AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN);
+  if (!token) throw new Error('Missing AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN for desktop release HTTP upload.');
+  const lane = publishTarget.lane || 'main';
+  const baseUrl = publishTarget.uploadBaseUrl || desktopReleaseUploadBaseUrl(env);
+  const assetName = path.basename(filePath);
+  const uploadUrl = new URL(`/__upload/${lane}/${encodeURIComponent(assetName)}`, baseUrl).toString();
+  const finishUrl = new URL(`/__upload/${lane}/${encodeURIComponent(assetName)}/finish`, baseUrl).toString();
+  const size = fs.statSync(filePath).size;
+  const chunkBytes = desktopReleaseUploadChunkBytes(env);
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-release-chunk-'));
+  const chunkPath = path.join(tempRoot, 'chunk.bin');
+  const fd = fs.openSync(filePath, 'r');
+
+  try {
+    uploadRequestWithRetry({
+      method: 'DELETE',
+      url: uploadUrl,
+      token,
+      cwd,
+      env,
+      expectedStatuses: [200, 404],
+    });
+
+    let offset = 0;
+    while (offset < size) {
+      const length = Math.min(chunkBytes, size - offset);
+      const buffer = Buffer.allocUnsafe(length);
+      const bytesRead = fs.readSync(fd, buffer, 0, length, offset);
+      if (bytesRead <= 0) throw new Error(`Failed to read upload chunk for ${assetName} at offset ${offset}`);
+      fs.writeFileSync(chunkPath, buffer.subarray(0, bytesRead));
+      const chunkUrl = new URL(uploadUrl);
+      chunkUrl.searchParams.set('offset', String(offset));
+      uploadRequestWithRetry({
+        method: 'PUT',
+        url: chunkUrl.toString(),
+        token,
+        cwd,
+        env,
+        dataFile: chunkPath,
+      });
+      offset += bytesRead;
+    }
+
+    uploadRequestWithRetry({
+      method: 'POST',
+      url: finishUrl,
+      token,
+      cwd,
+      env,
+      dataText: `${JSON.stringify({ size })}\n`,
+    });
+  } finally {
+    fs.closeSync(fd);
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+function uploadHttpReleaseAssets({ artifactPaths, cwd, env, publishTarget, metadata }) {
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-desktop-release-metadata-'));
+  const metadataPath = path.join(tempRoot, 'desktop-release.json');
+  try {
+    fs.writeFileSync(metadataPath, `${JSON.stringify(metadata, null, 2)}\n`);
+    const ordered = orderedReleaseUploadPaths(artifactPaths);
+    const uploadPaths = [
+      ...ordered.filter((filePath) => !filePath.endsWith('-mac.yml')),
+      metadataPath,
+      ...ordered.filter((filePath) => filePath.endsWith('-mac.yml')),
+    ];
+    for (const filePath of uploadPaths) {
+      uploadHttpReleaseFile({ filePath, cwd, env, publishTarget });
+    }
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+function uploadFlySftpReleaseAssets({ artifactPaths, cwd, env, publishTarget, metadata }) {
+  if (!publishTarget.flyApp) throw new Error('Missing Fly app for desktop release upload.');
+  if (!publishTarget.remoteDir) throw new Error('Missing Fly release remote directory.');
+  const attempts = Number(env.AMALGM_DESKTOP_RELEASE_UPLOAD_ATTEMPTS) || 4;
+  runWithRetry('fly', [
+    'ssh',
+    'console',
+    '-a',
+    publishTarget.flyApp,
+    '-C',
+    `mkdir -p ${shellQuote(publishTarget.remoteDir)}`,
+  ], { cwd, env }, attempts);
+
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-desktop-release-metadata-'));
+  const metadataPath = path.join(tempRoot, 'desktop-release.json');
+  const ordered = orderedReleaseUploadPaths(artifactPaths);
+  const uploadPaths = [
+    ...ordered.filter((filePath) => !filePath.endsWith('-mac.yml')),
+    metadataPath,
+    ...ordered.filter((filePath) => filePath.endsWith('-mac.yml')),
+  ];
+
+  try {
+    fs.writeFileSync(metadataPath, `${JSON.stringify(metadata, null, 2)}\n`);
+    for (const filePath of uploadPaths) {
+      const remotePath = joinRemotePath(publishTarget.remoteDir, path.basename(filePath));
+      runWithRetry('fly', [
+        'sftp',
+        'put',
+        '-a',
+        publishTarget.flyApp,
+        filePath,
+        remotePath,
+      ], { cwd, env }, attempts);
+    }
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+function uploadFlyReleaseAssets({ artifactPaths, cwd, env, publishTarget, metadata }) {
+  if ((publishTarget.uploadMethod || 'http') === 'sftp') {
+    return uploadFlySftpReleaseAssets({ artifactPaths, cwd, env, publishTarget, metadata });
+  }
+  return uploadHttpReleaseAssets({ artifactPaths, cwd, env, publishTarget, metadata });
+}
+
+function publishDesktopRelease(request, options = {}) {
+  applyDesktopReleaseEnv(process.env);
+  const releaseEnv = desktopReleaseToolEnv(process.env);
+  const decision = shouldHandleRequest(request);
+  if (!decision.ok) {
+    console.log(decision.reason);
+    return { ok: true, skipped: true, reason: decision.reason };
+  }
+
+  const checkoutRoot = cleanString(options.checkoutRoot || process.env.AMALGM_DESKTOP_RELEASE_CHECKOUT_ROOT)
+    || DEFAULT_CHECKOUT_ROOT;
+  const laneRoot = path.join(checkoutRoot, request.lane);
+  const engineDir = cleanString(process.env.AMALGM_DESKTOP_RELEASE_ENGINE_REPO_PATH)
+    || path.join(laneRoot, 'amalgm-engine');
+  const uiDir = cleanString(process.env.AMALGM_DESKTOP_RELEASE_UI_REPO_PATH)
+    || path.join(laneRoot, 'amalgm-ui');
+  const engineRepoUrl = cleanString(process.env.AMALGM_ENGINE_REPO_URL) || DEFAULT_ENGINE_REPO_URL;
+  const uiRepoUrl = cleanString(process.env.AMALGM_UI_REPO_URL) || DEFAULT_UI_REPO_URL;
+  const refs = resolveBuildRefs(request);
+  const releaseRepository = desktopReleaseRepository(releaseEnv);
+  const publishTarget = desktopReleasePublishTarget(releaseEnv, request.lane);
+
+  if (request.dryRun) {
+    return {
+      ok: true,
+      dryRun: true,
+      lane: request.lane,
+      branch: request.branch,
+      repository: request.repository,
+      refs,
+      engineDir,
+      uiDir,
+      releaseProvider: publishTarget.provider,
+      updateProvider: publishTarget.updateProvider,
+      updateUrl: publishTarget.updateUrl || '',
+      releaseUrl: publishTarget.channelUrl || '',
+      flyApp: publishTarget.flyApp || '',
+      flyRemoteDir: publishTarget.remoteDir || '',
+      releaseRepository: releaseRepository.fullName,
+      legacyBridge: desktopLegacyBridgePlan(releaseEnv, publishTarget),
+    };
+  }
+
+  ensureCheckout({ dir: engineDir, repoUrl: engineRepoUrl, branch: request.branch, ref: refs.engineRef });
+  ensureCheckout({ dir: uiDir, repoUrl: uiRepoUrl, branch: request.branch, ref: refs.uiRef });
+  releaseEnv.AMALGM_DESKTOP_RELEASE_LOG_FILE = cleanString(releaseEnv.AMALGM_DESKTOP_RELEASE_LOG_FILE)
+    || path.join(engineDir, '.desktop-build', 'desktop-release-run.log');
+  fs.mkdirSync(path.dirname(releaseEnv.AMALGM_DESKTOP_RELEASE_LOG_FILE), { recursive: true });
+  fs.writeFileSync(releaseEnv.AMALGM_DESKTOP_RELEASE_LOG_FILE, [
+    `amalgm desktop release log`,
+    `startedAt=${new Date().toISOString()}`,
+    `lane=${request.lane}`,
+    `repository=${request.repository}`,
+    `branch=${request.branch}`,
+    `delivery=${request.delivery || ''}`,
+    '',
+  ].join('\n'), { mode: 0o600 });
+
+  const sourcePackageVersion = readJsonFile(path.join(engineDir, 'package.json')).version;
+  if (request.lane === 'preview' && !sourcePackageVersion.includes('-')) {
+    throw new Error(`Preview desktop builds must come from a prerelease package version, received: ${sourcePackageVersion}`);
+  }
+  if (request.lane === 'main' && sourcePackageVersion.includes('-')) {
+    throw new Error(`Main desktop builds must come from a stable package version, received: ${sourcePackageVersion}`);
+  }
+
+  const buildNumber = Number(process.env.AMALGM_DESKTOP_BUILD_NUMBER) || buildNumberFromNow();
+  const version = desktopVersion(sourcePackageVersion, request.lane, buildNumber);
+  const engineSha = cleanString(run('git', ['rev-parse', 'HEAD'], { cwd: engineDir }));
+  const uiSha = cleanString(run('git', ['rev-parse', 'HEAD'], { cwd: uiDir }));
+  const shas = { engineSha, uiSha };
+
+  run('npm', ['ci'], { cwd: engineDir, env: releaseEnv });
+  run('git', ['tag', '-f', `v${version}`, engineSha], { cwd: engineDir });
+  run('git', ['push', 'origin', `refs/tags/v${version}`, '--force'], { cwd: engineDir });
+  run('npm', ['version', '--no-git-tag-version', '--allow-same-version', version], { cwd: engineDir, env: releaseEnv });
+  run('npm', ['run', 'compile'], { cwd: engineDir, env: releaseEnv });
+  run('npm', ['run', 'npm:sync'], { cwd: engineDir, env: releaseEnv });
+  copyUiIntoEngine(uiDir, engineDir);
+  const appOrigin = writeBundledWebEnv(engineDir, request.lane, releaseEnv);
+  run('npm', ['run', 'build:next'], { cwd: engineDir, env: releaseEnv });
+  if (request.lane === 'preview') run('npm', ['run', 'assets:preview-icon'], { cwd: engineDir, env: releaseEnv });
+
+  const buildEnv = envForBuild(releaseEnv, request, sourcePackageVersion, version, refs, shas, appOrigin, releaseRepository, publishTarget);
+  run('npm', ['run', 'electron-builder:config', '--', request.lane], { cwd: engineDir, env: buildEnv });
+  fs.rmSync(path.join(engineDir, 'build'), { recursive: true, force: true });
+  run(path.join(engineDir, 'node_modules', '.bin', 'electron-builder'), [
+    '--mac',
+    '--config',
+    `.desktop-build/electron-builder.${request.lane}.json`,
+    '--publish',
+    'never',
+  ], { cwd: engineDir, env: buildEnv });
+
+  const tag = `v${version}`;
+  const artifacts = desktopReleaseArtifactPaths(path.join(engineDir, 'build'), request.lane, version);
+  const channelPath = artifacts.find((filePath) => filePath.endsWith('-mac.yml'));
+  let releaseUrl = '';
+  let legacyBridge = null;
+  if (publishTarget.provider === 'github') {
+    const releaseId = ensureGithubRelease({ tag, version, request, refs, shas, sourcePackageVersion, cwd: engineDir, env: buildEnv, releaseRepository });
+    uploadGithubReleaseAssets(tag, artifacts, engineDir, buildEnv, releaseRepository, releaseId);
+    publishGithubRelease({ tag, request, cwd: engineDir, env: buildEnv, releaseRepository, releaseId });
+    releaseUrl = `https://github.com/${releaseRepository.fullName}/releases/tag/${tag}`;
+    legacyBridge = desktopLegacyBridgePlan(buildEnv, publishTarget);
+  } else {
+    const metadata = desktopReleaseMetadata({ tag, version, request, refs, shas, sourcePackageVersion, publishTarget, artifacts });
+    uploadFlyReleaseAssets({ artifactPaths: artifacts, cwd: engineDir, env: buildEnv, publishTarget, metadata });
+    legacyBridge = publishLegacyGithubBridgeRelease({
+      tag,
+      version,
+      request,
+      refs,
+      shas,
+      sourcePackageVersion,
+      cwd: engineDir,
+      env: buildEnv,
+      publishTarget,
+      channelPath,
+    });
+    releaseUrl = publishTarget.channelUrl;
+  }
+
+  return {
+    ok: true,
+    skipped: false,
+    lane: request.lane,
+    version,
+    tag,
+    releaseUrl,
+    releaseProvider: publishTarget.provider,
+    updateProvider: publishTarget.updateProvider,
+    updateUrl: publishTarget.updateUrl || '',
+    flyApp: publishTarget.flyApp || '',
+    flyRemoteDir: publishTarget.remoteDir || '',
+    releaseRepository: releaseRepository.fullName,
+    legacyBridge,
+    artifacts: artifacts.map((filePath) => path.basename(filePath)),
+    repository: request.repository,
+    branch: request.branch,
+    refs,
+    shas,
+    sourcePackageVersion,
+  };
+}
+
+function main() {
+  applyDesktopReleaseEnv(process.env);
+  const request = requestFromEnv(process.env);
+  const result = publishDesktopRelease(request);
+  console.log(JSON.stringify(result, null, 2));
+}
+
+if (require.main === module) {
+  try {
+    main();
+  } catch (error) {
+    console.error(error?.stack || error?.message || String(error));
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  absoluteAssetUrl,
+  applyDesktopReleaseEnv,
+  bridgeChannelInfoForBase,
+  buildNumberFromNow,
+  desktopLegacyBridgeEnabled,
+  desktopLegacyBridgePlan,
+  desktopLegacyBridgeRepository,
+  desktopReleaseRepository,
+  desktopReleaseProvider,
+  desktopReleasePublishTarget,
+  desktopReleaseToolEnv,
+  desktopUpdateUrlForLane,
+  desktopVersion,
+  desktopReleaseArtifactPaths,
+  envForBuild,
+  parseEnvFile,
+  publishLegacyGithubBridgeRelease,
+  publishDesktopRelease,
+  requestFromEnv,
+  shouldHandleRequest,
+};