app-builder-lib 26.14.0 → 26.15.1

package/out/node-module-collector/nodeModulesCollector.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NodeModulesCollector = void 0;
+exports.buildPowerShellEncodedArgs = buildPowerShellEncodedArgs;
 const builder_util_1 = require("builder-util");
 const childProcess = require("child_process");
-const crypto_1 = require("crypto");
 const fs = require("fs-extra");
 const fs_extra_1 = require("fs-extra");
 const lazy_val_1 = require("lazy-val");
@@ -82,7 +82,7 @@ class NodeModulesCollector {
             interval: 2000,
             backoff: 2000,
             shouldRetry: async (error) => {
-                var _a;
+                var _a, _b;
                 const fields = { error: error.message, tempOutputFile, cwd: this.rootDir, packageManager: pm };
                 if (!(await (0, builder_util_1.exists)(tempOutputFile))) {
                     builder_util_1.log.debug(fields, "dependency tree output file missing, retrying");
@@ -104,7 +104,8 @@ class NodeModulesCollector {
                 else {
                     fields.content = fileContent;
                 }
-                if ((_a = error.message) === null || _a === void 0 ? void 0 : _a.includes("Unexpected end of JSON input")) {
+                // Both indicate truncated/polluted PM output (a transient that re-running the command clears).
+                if (((_a = error.message) === null || _a === void 0 ? void 0 : _a.includes("Unexpected end of JSON input")) || ((_b = error.message) === null || _b === void 0 ? void 0 : _b.includes("No JSON content found in output"))) {
                     builder_util_1.log.debug(fields, "JSON parse error in dependency tree, retrying");
                     return true;
                 }
@@ -297,8 +298,9 @@ class NodeModulesCollector {
      * Executes a command and streams its output to a file.
      *
      * Spawns a child process to execute the specified command with arguments, capturing stdout
-     * to a file. Handles Windows-specific quirks by wrapping .cmd files in a temporary .bat file
-     * when necessary. Enables corepack strict mode by default but allows process.env overrides.
+     * to a file. On Windows, wraps the invocation in `powershell.exe -EncodedCommand` (UTF-16LE
+     * base64) to avoid spawning `.cmd` shims directly and to eliminate shell-injection surface area.
+     * Enables corepack strict mode by default but allows process.env overrides.
      *
      * Special handling for `npm list` exit code 1, which is expected in certain scenarios.
      *
@@ -310,46 +312,63 @@ class NodeModulesCollector {
      * @throws {Error} If the child process spawn fails or exits with a non-zero code
      */
     async streamCollectorCommandToFile(command, args, cwd, tempOutputFile) {
-        // Capture execName from the original command before resolveWindowsCommand may rewrite it to
-        // cmd.exe — shouldIgnore must key off the original invocation (e.g. "npm", not "cmd").
+        // Derive execName from the original command so the npm-list shouldIgnore check below keys off the
+        // real invocation (e.g. "npm"), not the "powershell" wrapper we spawn on Windows.
         const execName = path.basename(command, path.extname(command));
-        if (process.platform === "win32") {
-            const resolved = await this.resolveWindowsCommand(command, args);
-            command = resolved.command;
-            args = resolved.args;
-        }
-        const isWindows = process.platform === "win32";
-        // shell: true is required on Windows — see https://github.com/electron-userland/electron-builder/issues/9488
-        // On non-Windows, shell:false means args are passed directly to the process with no shell
-        // interpretation, so the metacharacter guard is only necessary on Windows.
-        if (isWindows) {
-            // Guard against cmd.exe metacharacters. Parentheses are intentionally excluded because they
-            // appear in legitimate Windows paths (e.g. "C:\Program Files (x86)").
-            const SHELL_INJECTION_RE = /[;&|`${}[\]<>!%^]/;
-            for (const arg of args) {
-                if (SHELL_INJECTION_RE.test(arg)) {
-                    throw new Error(`Refusing to spawn "${command}": argument "${arg}" contains shell metacharacters. Possible injection attempt.`);
-                }
-            }
-        }
+        // On Windows the package-manager command is typically a `.cmd` shim (npm.cmd/pnpm.cmd/yarn.cmd),
+        // which Node can no longer spawn directly (CVE-2024-27980). Rather than spawn with `shell: true` —
+        // which emits the DEP0190 "args with shell" deprecation warning and forces manual metacharacter
+        // escaping — wrap the invocation in a single PowerShell `-EncodedCommand`. The base64 (UTF-16LE)
+        // payload sidesteps every shell-quoting layer, and `powershell.exe` is a real executable we spawn
+        // directly with no shell. See buildPowerShellEncodedArgs for the UTF-8 / exit-code handling.
+        const [spawnCommand, spawnArgs] = process.platform === "win32" ? ["powershell.exe", buildPowerShellEncodedArgs(command, args)] : [command, args];
         await new Promise((resolve, reject) => {
             const outStream = (0, fs_extra_1.createWriteStream)(tempOutputFile);
-            const child = childProcess.spawn(command, args, {
+            const child = childProcess.spawn(spawnCommand, spawnArgs, {
                 cwd,
                 // Package manager invocations do not need signing/publishing credentials.
                 env: { COREPACK_ENABLE_STRICT: "0", ...(0, builder_util_1.stripSensitiveEnvVars)(process.env) },
-                shell: isWindows, // shell: true is required on Windows — see https://github.com/electron-userland/electron-builder/issues/9488
             });
             let stderr = "";
+            // The process can close before all piped stdout has been flushed to disk. Resolving on the
+            // child's "close" alone races the write stream and lets the caller read a TRUNCATED file
+            // (manifesting as "No JSON content found in output"). Gate the settle on BOTH the child exit
+            // (for the code/stderr) and the write stream's "finish" (all bytes flushed).
+            let exitCode = null;
+            let childClosed = false;
+            let streamFinished = false;
+            let settled = false;
+            // `pipe` ends `outStream` when stdout EOFs, which triggers its "finish" once flushed.
             child.stdout.pipe(outStream);
             child.stderr.on("data", chunk => {
                 stderr += chunk.toString();
             });
-            child.on("error", err => {
-                reject(new Error(`Node module collector spawn (${command} ${JSON.stringify(args)}) failed: ${err.message}`));
-            });
-            child.on("close", code => {
-                outStream.close();
+            const fail = (err) => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                // Best-effort cleanup: stop the child and close the stream so we don't
+                // waste CPU writing to a broken fd after rejection.
+                try {
+                    child.kill();
+                }
+                catch {
+                    // ignore
+                }
+                try {
+                    outStream.destroy();
+                }
+                catch {
+                    // ignore
+                }
+                reject(err);
+            };
+            const settle = () => {
+                if (settled || !childClosed || !streamFinished) {
+                    return;
+                }
+                const code = exitCode;
                 // https://github.com/npm/npm/issues/17624
                 const shouldIgnore = code === 1 && "npm" === execName.toLowerCase() && args.includes("list");
                 if (shouldIgnore) {
@@ -365,38 +384,45 @@ class NodeModulesCollector {
                         this.cache.logSummary[moduleManager_1.LogMessageByKey.PKG_COLLECTOR_OUTPUT].push(stderr);
                     }
                 }
+                settled = true;
                 const shouldResolve = code === 0 || shouldIgnore;
                 return shouldResolve ? resolve() : reject(new Error(`Node module collector process exited with code ${code}:\n${stderr}`));
+            };
+            outStream.on("error", err => fail(new Error(`Node module collector failed writing output (${command}): ${err.message}`)));
+            outStream.on("finish", () => {
+                streamFinished = true;
+                settle();
+            });
+            child.on("error", err => {
+                fail(new Error(`Node module collector spawn (${command} ${JSON.stringify(args)}) failed: ${err.message}`));
+            });
+            child.on("close", code => {
+                exitCode = code;
+                childClosed = true;
+                settle();
             });
         });
     }
-    /**
-     * Windows-only. Wraps .cmd files and executables at paths containing spaces in a temporary .bat
-     * file so that cmd.exe spawns them correctly. Returns the original command/args unchanged when
-     * no wrapping is required. Must only be called on win32.
-     */
-    async resolveWindowsCommand(command, args) {
-        if (process.platform !== "win32") {
-            throw new Error("resolveWindowsCommand should only be called on Windows platforms");
-        }
-        const ext = path.extname(command).toLowerCase();
-        // Wrap .cmd files and any Windows executable path that contains spaces (e.g. extensionless
-        // shims from tools like Volta installed at "C:\Program Files\Volta\") to ensure the path is
-        // quoted correctly when passed to `spawn(..., { shell: true })`.
-        const needsWrap = ext === ".cmd" || command.includes(" ");
-        if (!needsWrap) {
-            return { command, args };
-        }
-        const execName = path.basename(command, ext);
-        const tempBatFile = await this.tempDirManager.getTempFile({
-            prefix: execName + "-" + (0, crypto_1.randomBytes)(8).toString("hex"),
-            suffix: ".bat",
-        });
-        const escapedCommand = command.replace(/"/g, `""`);
-        const batScript = `@echo off\r\n"${escapedCommand}" %*\r\n`; // <-- CRLF required for .bat
-        await fs.writeFile(tempBatFile, batScript, { encoding: "utf8", mode: 0o600 });
-        return { command: "cmd.exe", args: ["/c", `"${tempBatFile}"`, ...args] };
-    }
 }
 exports.NodeModulesCollector = NodeModulesCollector;
+/**
+ * Build the argv for invoking a Windows command through `powershell.exe -EncodedCommand`.
+ *
+ * Each token is wrapped in a PowerShell single-quoted string (with embedded single quotes doubled),
+ * so no character is interpreted by a shell. The script:
+ *   - pins `[Console]::OutputEncoding` to UTF-8 *without* a BOM so the JSON dependency tree is not
+ *     corrupted by the console's OEM code page (and no BOM is prepended to break `JSON.parse`),
+ *   - invokes the command via the call operator `&`,
+ *   - re-emits the command's own exit code via `exit $LASTEXITCODE` (e.g. `npm list` returns 1 in
+ *     expected scenarios, which the caller's shouldIgnore logic relies on).
+ *
+ * The whole script is base64-encoded as UTF-16LE per PowerShell's `-EncodedCommand` contract.
+ */
+function buildPowerShellEncodedArgs(command, args) {
+    const psQuote = (value) => `'${value.replace(/'/g, "''")}'`;
+    const invocation = ["&", psQuote(command), ...args.map(psQuote)].join(" ");
+    const script = `[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new($false); ${invocation}; exit $LASTEXITCODE`;
+    const encoded = Buffer.from(script, "utf16le").toString("base64");
+    return ["-NoProfile", "-NonInteractive", "-EncodedCommand", encoded];
+}
 //# sourceMappingURL=nodeModulesCollector.js.map

package/out/node-module-collector/nodeModulesCollector.js.map

@@ -1 +1 @@
-{"version":3,"file":"nodeModulesCollector.js","sourceRoot":"","sources":["../../src/node-module-collector/nodeModulesCollector.ts"],"names":[],"mappings":";;;AAAA,+CAAgF;AAChF,8CAA6C;AAC7C,mCAAoC;AACpC,+BAA8B;AAC9B,uCAA4C;AAC5C,uCAA+B;AAC/B,6BAA4B;AAC5B,mCAAqE;AACrE,mDAAgE;AAChE,qDAA+D;AAG/D,MAAsB,oBAAoB;IAsBxC,YACqB,OAAe,EACjB,cAAsB;QADpB,YAAO,GAAP,OAAO,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAQ;QAvBxB,gBAAW,GAAqB,EAAE,CAAA;QAChC,oBAAe,GAA6B,IAAI,GAAG,EAAE,CAAA;QACrD,oBAAe,GAAoB,EAAE,CAAA;QACrC,UAAK,GAAkB,IAAI,6BAAa,EAAE,CAAA;QAEnD,cAAS,GAAG,IAAI,eAAI,CAAU,KAAK,IAAI,EAAE;YACjD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,CAAA;YACvC,MAAM,OAAO,GAAG,IAAA,yCAAwB,EAAC,OAAO,CAAC,CAAA;YACjD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YACzE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,kBAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,sFAAsF,CAAC,CAAA;gBAC9G,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACpG,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,kBAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAA;gBAClD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAA;IAKC,CAAC;IAEJ;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,EAAE,WAAW,EAA2B;QAIlE,MAAM,IAAI,GAAgB,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QAErF,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAgB,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAC3E,MAAM,IAAI,CAAC,gCAAgC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QAElE,MAAM,aAAa,GAAkB,IAAA,aAAK,EAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE;YACzG,KAAK,EAAE,kBAAG,CAAC,cAAc;SAC1B,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QAExE,kBAAG,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAA;QAEjG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAA;IAC7E,CAAC;IAWD;;;;;;OAMG;IACO,KAAK,CAAC,mBAAmB,CAAC,EAAM;QACxC,MAAM,OAAO,GAAG,IAAA,yCAAwB,EAAC,EAAE,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QAE3B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;YAC3D,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,EAAE,aAAa;SACtB,CAAC,CAAA;QAEF,OAAO,IAAA,oBAAK,EACV,KAAK,IAAI,EAAE;YACT,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;YACpF,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAC3E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC7E,OAAO,MAAM,CAAA;QACf,CAAC,EACD;YACE,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,KAAK,EAAE,KAAU,EAAE,EAAE;;gBAChC,MAAM,MAAM,GAA2B,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,CAAA;gBAEtH,IAAI,CAAC,CAAC,MAAM,IAAA,qBAAM,EAAC,cAAc,CAAC,CAAC,EAAE,CAAC;oBACpC,kBAAG,CAAC,KAAK,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAA;oBAClE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;gBAC3E,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAA;gBAExD,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACpC,kBAAG,CAAC,KAAK,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAA;oBAChE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,uFAAuF;gBACvF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACrC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;gBACpD,IAAI,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAC9D,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC5D,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,OAAO,GAAG,WAAW,CAAA;gBAC9B,CAAC;gBAED,IAAI,MAAA,KAAK,CAAC,OAAO,0CAAE,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CAAC;oBAC5D,kBAAG,CAAC,KAAK,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAA;oBAClE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,kBAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAA;gBACpD,OAAO,KAAK,CAAA;YACd,CAAC;SACF,CACF,CAAA;IACH,CAAC;IAED;;;QAGI;IACM,qBAAqB,CAAC,WAAmB;QACjD,OAAO,IAAI,CAAC,6BAA6B,CAAc,WAAW,CAAC,CAAA;IACrE,CAAC;IAES,6BAA6B,CAAI,WAAmB;QAC5D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,CAAC;YACH,mHAAmH;YACnH,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,+HAA+H;QAE/H,+CAA+C;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3D,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA,CAAC,4CAA4C;QAEnG,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/C,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,mBAAmB;YACrB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,CAAC;IAES,QAAQ,CAAC,GAAmD;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QACjD,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,KAAK,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,GAAG,EAAE,CAAA;IACrD,CAAC;IAED,6EAA6E;IAC7E,iFAAiF;IACvE,uBAAuB,CAAC,GAAW,EAAE,GAAgB;QAC7D,OAAO,EAAE,EAAE,EAAE,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAA;IAC5E,CAAC;IAED;;;;;;;;;OASG;IACO,gBAAgB,CAAC,OAAe,EAAE,GAAgB;QAC1D,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,oBAAoB,EAAE,CAAA;QACrE,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;IAClC,CAAC;IAES,KAAK,CAAC,wBAAwB,CAAC,OAAuD;QAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC;YACnD,SAAS,EAAE,OAAO,CAAC,IAAI;YACvB,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,aAAa,EAAE,OAAO,CAAC,OAAO;SAC/B,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IACD;;;;;;OAMG;IACO,gBAAgB,CAAC,UAAkB;QAC3C,IAAI,EAAU,CAAA;QACd,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,uFAAuF;YACvF,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC1C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;YACjD,CAAC;YACD,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;QAC9C,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;QACD,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;QACjD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;IAC7E,CAAC;IAED;;;;;;;;;;OAUG;IACO,qBAAqB,CAAC,IAAiB,EAAE,WAAmB;QACpE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7D,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,sBAAsB,CAAC,GAAoB,EAAE,GAAW,EAAE,QAAkC,IAAI,GAAG,EAAE;QAC3G,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACzB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG;gBACL,IAAI;gBACJ,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,OAAO;gBAClB,YAAY,EAAE,IAAI,GAAG,EAAe;gBACpC,SAAS,EAAE,IAAI,GAAG,EAAU;aAC7B,CAAA;YAED,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAEpB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE,CAAA;YAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC1D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,YAAgC,EAAE,MAAwB;;QACtF,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,SAAS,EAAE,CAAA;YACpC,iFAAiF;YACjF,MAAM,OAAO,GAAG,MAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,0CAAE,IAAI,CAAA;YACnD,MAAM,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,+BAAe,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC9D,SAAQ;YACV,CAAC;YAED,qBAAqB;YACrB,yCAAyC;YACzC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;gBAC9B,SAAQ;YACV,CAAC;YAED,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,SAAS;gBAClB,GAAG,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;aAClC,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjB,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,GAAG,EAAE,CAAA;gBACtB,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACrD,CAAC;IAES,oBAAoB,CAAC,OAAe;QAC5C,MAAM,mBAAmB,GAAG,oGAAoG,CAAA;QAChI,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,+BAAe,CAAC,mCAAmC,CAAC,CAAC,CAAC,+BAAe,CAAC,eAAe,CAAA;QAC5I,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjD,CAAC;IAES,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,IAAc,EAAE,MAAc,IAAI,CAAC,OAAO;QACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACvF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YACjE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACtD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,kBAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAA;YAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;QACrD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACO,KAAK,CAAC,4BAA4B,CAAC,OAAe,EAAE,IAAc,EAAE,GAAW,EAAE,cAAsB;QAC/G,4FAA4F;QAC5F,uFAAuF;QACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;QAE9D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAChE,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;YAC1B,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QACtB,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;QAE9C,6GAA6G;QAC7G,0FAA0F;QAC1F,2EAA2E;QAC3E,IAAI,SAAS,EAAE,CAAC;YACd,4FAA4F;YAC5F,sEAAsE;YACtE,MAAM,kBAAkB,GAAG,mBAAmB,CAAA;YAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,gBAAgB,GAAG,8DAA8D,CAAC,CAAA;gBACjI,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAA,4BAAiB,EAAC,cAAc,CAAC,CAAA;YAEnD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;gBAC9C,GAAG;gBACH,0EAA0E;gBAC1E,GAAG,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE,GAAG,IAAA,oCAAqB,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE;gBAC3E,KAAK,EAAE,SAAS,EAAE,6GAA6G;aAChI,CAAC,CAAA;YAEF,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;gBAC9B,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;YAC5B,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YAC9G,CAAC,CAAC,CAAA;YAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;gBACvB,SAAS,CAAC,KAAK,EAAE,CAAA;gBACjB,0CAA0C;gBAC1C,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;gBAC5F,IAAI,YAAY,EAAE,CAAC;oBACjB,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,uIAAuI,CAAC,CAAA;gBAC1J,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,wDAAwD,CAAC,CAAA;oBAC/E,yFAAyF;oBACzF,qFAAqF;oBACrF,uFAAuF;oBACvF,yEAAyE;oBACzE,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,+BAAe,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAC1E,CAAC;gBACH,CAAC;gBACD,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,IAAI,YAAY,CAAA;gBAChD,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC,CAAA;YAC5H,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,IAAc;QACjE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;QAC/C,2FAA2F;QAC3F,4FAA4F;QAC5F,iEAAiE;QACjE,MAAM,SAAS,GAAG,GAAG,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QACzD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC1B,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;YACxD,MAAM,EAAE,QAAQ,GAAG,GAAG,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvD,MAAM,EAAE,MAAM;SACf,CAAC,CAAA;QACF,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAClD,MAAM,SAAS,GAAG,iBAAiB,cAAc,UAAU,CAAA,CAAC,6BAA6B;QACzF,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAA;IAC1E,CAAC;CACF;AA3bD,oDA2bC","sourcesContent":["import { exists, log, retry, stripSensitiveEnvVars, TmpDir } from \"builder-util\"\nimport * as childProcess from \"child_process\"\nimport { randomBytes } from \"crypto\"\nimport * as fs from \"fs-extra\"\nimport { createWriteStream } from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { hoist, type HoisterResult, type HoisterTree } from \"./hoist\"\nimport { LogMessageByKey, ModuleManager } from \"./moduleManager\"\nimport { getPackageManagerCommand, PM } from \"./packageManager\"\nimport type { Dependency, DependencyGraph, NodeModuleInfo, PackageJson } from \"./types\"\n\nexport abstract class NodeModulesCollector<ProdDepType extends Dependency<ProdDepType, OptionalDepType>, OptionalDepType> {\n  private readonly nodeModules: NodeModuleInfo[] = []\n  protected readonly allDependencies: Map<string, ProdDepType> = new Map()\n  protected readonly productionGraph: DependencyGraph = {}\n  protected readonly cache: ModuleManager = new ModuleManager()\n\n  protected isHoisted = new Lazy<boolean>(async () => {\n    const { manager } = this.installOptions\n    const command = getPackageManagerCommand(manager)\n    const config = (await this.asyncExec(command, [\"config\", \"list\"])).stdout\n    if (config == null) {\n      log.debug({ manager }, \"unable to determine node-linker setting; assuming non-hoisted (virtual store) layout\")\n      return false\n    }\n    const lines = Object.fromEntries(config.split(\"\\n\").map(line => line.split(\"=\").map(s => s.trim())))\n    if (lines[\"node-linker\"] === \"hoisted\") {\n      log.debug({ manager }, \"node_modules are hoisted\")\n      return true\n    }\n    return false\n  })\n\n  constructor(\n    protected readonly rootDir: string,\n    private readonly tempDirManager: TmpDir\n  ) {}\n\n  /**\n   * Retrieves and collects all Node.js modules for a given package.\n   *\n   * This method orchestrates the entire module collection process by:\n   * 1. Fetching the dependency tree from the package manager\n   * 2. Collecting all dependencies recursively\n   * 3. Extracting workspace references if applicable\n   * 4. Building a production dependency graph\n   * 5. Hoisting the dependencies to their final locations\n   * 6. Resolving and returning module information\n   */\n  public async getNodeModules({ packageName }: { packageName: string }): Promise<{\n    nodeModules: NodeModuleInfo[]\n    logSummary: ModuleManager[\"logSummary\"]\n  }> {\n    const tree: ProdDepType = await this.getDependenciesTree(this.installOptions.manager)\n\n    await this.collectAllDependencies(tree, packageName)\n    const realTree: ProdDepType = this.getTreeFromWorkspaces(tree, packageName)\n    await this.extractProductionDependencyGraph(realTree, packageName)\n\n    const hoisterResult: HoisterResult = hoist(this.transformToHoisterTree(this.productionGraph, packageName), {\n      check: log.isDebugEnabled,\n    })\n\n    await this._getNodeModules(hoisterResult.dependencies, this.nodeModules)\n\n    log.debug({ packageName, depCount: this.nodeModules.length }, \"node modules collection complete\")\n\n    return { nodeModules: this.nodeModules, logSummary: this.cache.logSummary }\n  }\n\n  public abstract readonly installOptions: {\n    manager: PM\n    lockfile: string\n  }\n\n  protected abstract getArgs(): string[]\n  protected abstract extractProductionDependencyGraph(tree: Dependency<ProdDepType, OptionalDepType>, dependencyId: string): Promise<void>\n  protected abstract collectAllDependencies(tree: Dependency<ProdDepType, OptionalDepType>, appPackageName: string): Promise<void>\n\n  /**\n   * Retrieves the dependency tree from the package manager.\n   *\n   * Executes the appropriate package manager command to fetch the dependency tree and writes\n   * the output to a temporary file. Includes retry logic to handle transient failures such as\n   * incomplete JSON output or missing files. Will retry up to 1 time with exponential backoff.\n   */\n  protected async getDependenciesTree(pm: PM): Promise<ProdDepType> {\n    const command = getPackageManagerCommand(pm)\n    const args = this.getArgs()\n\n    const tempOutputFile = await this.tempDirManager.getTempFile({\n      prefix: path.basename(command, path.extname(command)),\n      suffix: \"output.json\",\n    })\n\n    return retry(\n      async () => {\n        await this.streamCollectorCommandToFile(command, args, this.rootDir, tempOutputFile)\n        const shellOutput = await fs.readFile(tempOutputFile, { encoding: \"utf8\" })\n        const result = await Promise.resolve(this.parseDependenciesTree(shellOutput))\n        return result\n      },\n      {\n        retries: 1,\n        interval: 2000,\n        backoff: 2000,\n        shouldRetry: async (error: any) => {\n          const fields: Record<string, string> = { error: error.message, tempOutputFile, cwd: this.rootDir, packageManager: pm }\n\n          if (!(await exists(tempOutputFile))) {\n            log.debug(fields, \"dependency tree output file missing, retrying\")\n            return true\n          }\n\n          const fileContent = await fs.readFile(tempOutputFile, { encoding: \"utf8\" })\n          fields.fileContentLength = fileContent.length.toString()\n\n          if (fileContent.trim().length === 0) {\n            log.debug(fields, \"dependency tree output file empty, retrying\")\n            return true\n          }\n\n          // extract small start/end sample for debugging purposes (e.g. polluted console output)\n          const lines = fileContent.split(\"\\n\")\n          const lineSampleSize = Math.min(5, lines.length / 2)\n          if (2 * lineSampleSize > 5) {\n            fields.sampleStart = lines.slice(0, lineSampleSize).join(\"\\n\")\n            fields.sampleEnd = lines.slice(-lineSampleSize).join(\"\\n\")\n          } else {\n            fields.content = fileContent\n          }\n\n          if (error.message?.includes(\"Unexpected end of JSON input\")) {\n            log.debug(fields, \"JSON parse error in dependency tree, retrying\")\n            return true\n          }\n\n          log.error(fields, \"error parsing dependencies tree\")\n          return false\n        },\n      }\n    )\n  }\n\n  /**\n   * Parses the dependencies tree from shell command output.\n   *\n   **/\n  protected parseDependenciesTree(shellOutput: string): ProdDepType | Promise<ProdDepType> {\n    return this.extractJsonFromPollutedOutput<ProdDepType>(shellOutput)\n  }\n\n  protected extractJsonFromPollutedOutput<T>(shellOutput: string): T {\n    const consoleOutput = shellOutput.trim()\n    try {\n      // Please for the love of all that is holy, this should cover 99% of cases where npm/pnpm/yarn output is clean JSON\n      return JSON.parse(consoleOutput)\n    } catch {\n      // ignore\n    }\n\n    // DEDICATED FALLBACK FOR POLLUTED OUTPUT, non-trivial to implement correctly, not needed in most cases, and highly inefficient\n\n    // Find the first index that starts with { or [\n    const bracketOpen = Math.max(consoleOutput.indexOf(\"{\"), 0)\n    const bracketOpenSquare = Math.max(consoleOutput.indexOf(\"[\"), 0)\n    const start = Math.min(bracketOpen, bracketOpenSquare) // always non-negative due to Math.max above\n\n    for (let i = start; i < consoleOutput.length; i++) {\n      const slice = consoleOutput.slice(start, i + 1)\n      try {\n        return JSON.parse(slice)\n      } catch {\n        // ignore, try next\n      }\n    }\n    throw new Error(\"No JSON content found in output\")\n  }\n\n  protected cacheKey(pkg: Pick<ProdDepType, \"name\" | \"version\" | \"path\">): string {\n    const rel = path.relative(this.rootDir, pkg.path)\n    return `${pkg.name}::${pkg.version}::${rel ?? \".\"}`\n  }\n\n  // We use the key (alias name) instead of value.name for npm aliased packages\n  // e.g., { \"foo\": { name: \"@scope/bar\", ... } } should be stored as \"foo@version\"\n  protected normalizePackageVersion(key: string, pkg: ProdDepType) {\n    return { id: `${key}@${pkg.version}`, pkgOverride: { ...pkg, name: key } }\n  }\n\n  /**\n   * Determines if a given dependency is a production dependency of a package.\n   *\n   * Checks both the dependencies and optionalDependencies of a package to see if\n   * the specified dependency name is listed.\n   *\n   * @param depName - The name of the dependency to check\n   * @param pkg - The package to search for the dependency in\n   * @returns True if the dependency is found in either dependencies or optionalDependencies, false otherwise\n   */\n  protected isProdDependency(depName: string, pkg: ProdDepType): boolean {\n    const prodDeps = { ...pkg.dependencies, ...pkg.optionalDependencies }\n    return prodDeps[depName] != null\n  }\n\n  protected async locatePackageWithVersion(depTree: Pick<ProdDepType, \"name\" | \"version\" | \"path\">): Promise<{ packageDir: string; packageJson: PackageJson } | null> {\n    const result = await this.cache.locatePackageVersion({\n      parentDir: depTree.path,\n      pkgName: depTree.name,\n      requiredRange: depTree.version,\n    })\n    return result\n  }\n  /**\n   * Parses a dependency identifier string into name and version components.\n   *\n   * Handles both scoped packages (e.g., \"@scope/pkg@1.2.3\") and regular packages (e.g., \"pkg@1.2.3\").\n   * If the identifier is malformed or cannot be parsed, defaults to treating the entire string as\n   * the package name with an \"unknown\" version.\n   */\n  protected parseNameVersion(identifier: string): { name: string; version: string } {\n    let at: number\n    if (identifier.startsWith(\"@\")) {\n      // Scoped package: find the version separator after the scope (e.g. \"@scope/pkg@1.2.3\")\n      const slashIndex = identifier.indexOf(\"/\")\n      if (slashIndex === -1) {\n        return { name: identifier, version: \"unknown\" }\n      }\n      at = identifier.indexOf(\"@\", slashIndex + 1)\n    } else {\n      at = identifier.indexOf(\"@\")\n    }\n    if (at <= 0) {\n      return { name: identifier, version: \"unknown\" }\n    }\n    return { name: identifier.slice(0, at), version: identifier.slice(at + 1) }\n  }\n\n  /**\n   * Retrieves the dependency tree and handles workspace package self-references.\n   *\n   * If the project is a workspace project, this method removes the root package's self-reference\n   * from the dependency tree to avoid circular dependencies. It promotes the root package's\n   * direct dependencies to the top level of the tree.\n   *\n   * @param tree - The original dependency tree\n   * @param packageName - The name of the package to check for and remove from the tree\n   * @returns The extracted dependency subtree\n   */\n  protected getTreeFromWorkspaces(tree: ProdDepType, packageName: string): ProdDepType {\n    if (tree.workspaces && tree.dependencies) {\n      for (const [key, value] of Object.entries(tree.dependencies)) {\n        if (key === packageName) {\n          return value\n        }\n      }\n    }\n\n    return tree\n  }\n\n  private transformToHoisterTree(obj: DependencyGraph, key: string, nodes: Map<string, HoisterTree> = new Map()): HoisterTree {\n    let node = nodes.get(key)\n    const { name, version } = this.parseNameVersion(key)\n\n    if (!node) {\n      node = {\n        name,\n        identName: name,\n        reference: version,\n        dependencies: new Set<HoisterTree>(),\n        peerNames: new Set<string>(),\n      }\n\n      nodes.set(key, node)\n\n      const deps = (obj[key] || {}).dependencies || []\n      for (const dep of deps) {\n        const child = this.transformToHoisterTree(obj, dep, nodes)\n        node.dependencies.add(child)\n      }\n    }\n\n    return node\n  }\n\n  private async _getNodeModules(dependencies: Set<HoisterResult>, result: NodeModuleInfo[]) {\n    if (dependencies.size === 0) {\n      return\n    }\n\n    for (const d of dependencies.values()) {\n      const reference = [...d.references][0]\n      const key = `${d.name}@${reference}`\n      // Normalize the path to handle mixed separators from pnpm JSON output on Windows\n      const rawPath = this.allDependencies.get(key)?.path\n      const p = rawPath != null ? path.normalize(rawPath) : undefined\n      if (p === undefined) {\n        this.cache.logSummary[LogMessageByKey.PKG_NOT_FOUND].push(key)\n        continue\n      }\n\n      // fix npm list issue\n      // https://github.com/npm/cli/issues/8535\n      if (!(await this.cache.exists[p])) {\n        this.logMissingDependency(key)\n        continue\n      }\n\n      const node: NodeModuleInfo = {\n        name: d.name,\n        version: reference,\n        dir: await this.cache.realPath[p],\n      }\n      result.push(node)\n      if (d.dependencies.size > 0) {\n        node.dependencies = []\n        await this._getNodeModules(d.dependencies, node.dependencies)\n      }\n    }\n    result.sort((a, b) => a.name.localeCompare(b.name))\n  }\n\n  protected logMissingDependency(pkgName: string) {\n    const PLATFORM_PACKAGE_RE = /(linux|win32|darwin|freebsd|android)[-_](x64|arm64|ia32|arm|ppc64|s390x|loong64|riscv64|universal)/\n    const diskLogKey = PLATFORM_PACKAGE_RE.test(pkgName) ? LogMessageByKey.PKG_OPTIONAL_PLATFORM_NOT_INSTALLED : LogMessageByKey.PKG_NOT_ON_DISK\n    this.cache.logSummary[diskLogKey].push(pkgName)\n  }\n\n  protected async asyncExec(command: string, args: string[], cwd: string = this.rootDir): Promise<{ stdout: string | undefined; stderr: string | undefined }> {\n    const file = await this.tempDirManager.getTempFile({ prefix: \"exec-\", suffix: \".txt\" })\n    try {\n      await this.streamCollectorCommandToFile(command, args, cwd, file)\n      const result = await fs.readFile(file, { encoding: \"utf8\" })\n      return { stdout: result?.trim(), stderr: undefined }\n    } catch (error: any) {\n      log.debug({ error: error.message }, \"failed to execute command\")\n      return { stdout: undefined, stderr: error.message }\n    }\n  }\n\n  /**\n   * Executes a command and streams its output to a file.\n   *\n   * Spawns a child process to execute the specified command with arguments, capturing stdout\n   * to a file. Handles Windows-specific quirks by wrapping .cmd files in a temporary .bat file\n   * when necessary. Enables corepack strict mode by default but allows process.env overrides.\n   *\n   * Special handling for `npm list` exit code 1, which is expected in certain scenarios.\n   *\n   * @param command - The command to execute\n   * @param args - Array of command-line arguments\n   * @param cwd - The working directory to execute the command in\n   * @param tempOutputFile - The path to the temporary file where stdout will be written\n   * @returns Promise that resolves when the command completes successfully or rejects if it fails\n   * @throws {Error} If the child process spawn fails or exits with a non-zero code\n   */\n  protected async streamCollectorCommandToFile(command: string, args: string[], cwd: string, tempOutputFile: string) {\n    // Capture execName from the original command before resolveWindowsCommand may rewrite it to\n    // cmd.exe — shouldIgnore must key off the original invocation (e.g. \"npm\", not \"cmd\").\n    const execName = path.basename(command, path.extname(command))\n\n    if (process.platform === \"win32\") {\n      const resolved = await this.resolveWindowsCommand(command, args)\n      command = resolved.command\n      args = resolved.args\n    }\n    const isWindows = process.platform === \"win32\"\n\n    // shell: true is required on Windows — see https://github.com/electron-userland/electron-builder/issues/9488\n    // On non-Windows, shell:false means args are passed directly to the process with no shell\n    // interpretation, so the metacharacter guard is only necessary on Windows.\n    if (isWindows) {\n      // Guard against cmd.exe metacharacters. Parentheses are intentionally excluded because they\n      // appear in legitimate Windows paths (e.g. \"C:\\Program Files (x86)\").\n      const SHELL_INJECTION_RE = /[;&|`${}[\\]<>!%^]/\n      for (const arg of args) {\n        if (SHELL_INJECTION_RE.test(arg)) {\n          throw new Error(`Refusing to spawn \"${command}\": argument \"${arg}\" contains shell metacharacters. Possible injection attempt.`)\n        }\n      }\n    }\n\n    await new Promise<void>((resolve, reject) => {\n      const outStream = createWriteStream(tempOutputFile)\n\n      const child = childProcess.spawn(command, args, {\n        cwd,\n        // Package manager invocations do not need signing/publishing credentials.\n        env: { COREPACK_ENABLE_STRICT: \"0\", ...stripSensitiveEnvVars(process.env) },\n        shell: isWindows, // shell: true is required on Windows — see https://github.com/electron-userland/electron-builder/issues/9488\n      })\n\n      let stderr = \"\"\n      child.stdout.pipe(outStream)\n      child.stderr.on(\"data\", chunk => {\n        stderr += chunk.toString()\n      })\n      child.on(\"error\", err => {\n        reject(new Error(`Node module collector spawn (${command} ${JSON.stringify(args)}) failed: ${err.message}`))\n      })\n\n      child.on(\"close\", code => {\n        outStream.close()\n        // https://github.com/npm/npm/issues/17624\n        const shouldIgnore = code === 1 && \"npm\" === execName.toLowerCase() && args.includes(\"list\")\n        if (shouldIgnore) {\n          log.debug(null, \"`npm list` returned non-zero exit code, but it MIGHT be expected (https://github.com/npm/npm/issues/17624). Check stderr for details.\")\n        }\n        if (stderr.length > 0) {\n          log.debug({ stderr }, \"note: there was node module collector output on stderr\")\n          // Only surface stderr as a user-visible warning when the exit code itself is unexpected.\n          // When shouldIgnore is true (npm list exit code 1) the stderr is an anticipated side\n          // effect of package-manager features like yarn resolutions or npm overrides that cause\n          // npm to report ELSPROBLEMS for aliased packages it considers \"invalid\".\n          if (!shouldIgnore) {\n            this.cache.logSummary[LogMessageByKey.PKG_COLLECTOR_OUTPUT].push(stderr)\n          }\n        }\n        const shouldResolve = code === 0 || shouldIgnore\n        return shouldResolve ? resolve() : reject(new Error(`Node module collector process exited with code ${code}:\\n${stderr}`))\n      })\n    })\n  }\n\n  /**\n   * Windows-only. Wraps .cmd files and executables at paths containing spaces in a temporary .bat\n   * file so that cmd.exe spawns them correctly. Returns the original command/args unchanged when\n   * no wrapping is required. Must only be called on win32.\n   */\n  private async resolveWindowsCommand(command: string, args: string[]): Promise<{ command: string; args: string[] }> {\n    if (process.platform !== \"win32\") {\n      throw new Error(\"resolveWindowsCommand should only be called on Windows platforms\")\n    }\n\n    const ext = path.extname(command).toLowerCase()\n    // Wrap .cmd files and any Windows executable path that contains spaces (e.g. extensionless\n    // shims from tools like Volta installed at \"C:\\Program Files\\Volta\\\") to ensure the path is\n    // quoted correctly when passed to `spawn(..., { shell: true })`.\n    const needsWrap = ext === \".cmd\" || command.includes(\" \")\n    if (!needsWrap) {\n      return { command, args }\n    }\n\n    const execName = path.basename(command, ext)\n    const tempBatFile = await this.tempDirManager.getTempFile({\n      prefix: execName + \"-\" + randomBytes(8).toString(\"hex\"),\n      suffix: \".bat\",\n    })\n    const escapedCommand = command.replace(/\"/g, `\"\"`)\n    const batScript = `@echo off\\r\\n\"${escapedCommand}\" %*\\r\\n` // <-- CRLF required for .bat\n    await fs.writeFile(tempBatFile, batScript, { encoding: \"utf8\", mode: 0o600 })\n    return { command: \"cmd.exe\", args: [\"/c\", `\"${tempBatFile}\"`, ...args] }\n  }\n}\n"]}
+{"version":3,"file":"nodeModulesCollector.js","sourceRoot":"","sources":["../../src/node-module-collector/nodeModulesCollector.ts"],"names":[],"mappings":";;;AAwdA,gEAMC;AA9dD,+CAAgF;AAChF,8CAA6C;AAC7C,+BAA8B;AAC9B,uCAA4C;AAC5C,uCAA+B;AAC/B,6BAA4B;AAC5B,mCAAqE;AACrE,mDAAgE;AAChE,qDAA+D;AAG/D,MAAsB,oBAAoB;IAsBxC,YACqB,OAAe,EACjB,cAAsB;QADpB,YAAO,GAAP,OAAO,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAQ;QAvBxB,gBAAW,GAAqB,EAAE,CAAA;QAChC,oBAAe,GAA6B,IAAI,GAAG,EAAE,CAAA;QACrD,oBAAe,GAAoB,EAAE,CAAA;QACrC,UAAK,GAAkB,IAAI,6BAAa,EAAE,CAAA;QAEnD,cAAS,GAAG,IAAI,eAAI,CAAU,KAAK,IAAI,EAAE;YACjD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,CAAA;YACvC,MAAM,OAAO,GAAG,IAAA,yCAAwB,EAAC,OAAO,CAAC,CAAA;YACjD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YACzE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,kBAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,sFAAsF,CAAC,CAAA;gBAC9G,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACpG,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,kBAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAA;gBAClD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAA;IAKC,CAAC;IAEJ;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,EAAE,WAAW,EAA2B;QAIlE,MAAM,IAAI,GAAgB,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QAErF,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAgB,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAC3E,MAAM,IAAI,CAAC,gCAAgC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QAElE,MAAM,aAAa,GAAkB,IAAA,aAAK,EAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE;YACzG,KAAK,EAAE,kBAAG,CAAC,cAAc;SAC1B,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QAExE,kBAAG,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAA;QAEjG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAA;IAC7E,CAAC;IAWD;;;;;;OAMG;IACO,KAAK,CAAC,mBAAmB,CAAC,EAAM;QACxC,MAAM,OAAO,GAAG,IAAA,yCAAwB,EAAC,EAAE,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QAE3B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;YAC3D,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,EAAE,aAAa;SACtB,CAAC,CAAA;QAEF,OAAO,IAAA,oBAAK,EACV,KAAK,IAAI,EAAE;YACT,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;YACpF,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAC3E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC7E,OAAO,MAAM,CAAA;QACf,CAAC,EACD;YACE,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,KAAK,EAAE,KAAU,EAAE,EAAE;;gBAChC,MAAM,MAAM,GAA2B,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,CAAA;gBAEtH,IAAI,CAAC,CAAC,MAAM,IAAA,qBAAM,EAAC,cAAc,CAAC,CAAC,EAAE,CAAC;oBACpC,kBAAG,CAAC,KAAK,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAA;oBAClE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;gBAC3E,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAA;gBAExD,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACpC,kBAAG,CAAC,KAAK,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAA;oBAChE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,uFAAuF;gBACvF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACrC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;gBACpD,IAAI,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAC9D,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC5D,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,OAAO,GAAG,WAAW,CAAA;gBAC9B,CAAC;gBAED,+FAA+F;gBAC/F,IAAI,CAAA,MAAA,KAAK,CAAC,OAAO,0CAAE,QAAQ,CAAC,8BAA8B,CAAC,MAAI,MAAA,KAAK,CAAC,OAAO,0CAAE,QAAQ,CAAC,iCAAiC,CAAC,CAAA,EAAE,CAAC;oBAC1H,kBAAG,CAAC,KAAK,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAA;oBAClE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,kBAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAA;gBACpD,OAAO,KAAK,CAAA;YACd,CAAC;SACF,CACF,CAAA;IACH,CAAC;IAED;;;QAGI;IACM,qBAAqB,CAAC,WAAmB;QACjD,OAAO,IAAI,CAAC,6BAA6B,CAAc,WAAW,CAAC,CAAA;IACrE,CAAC;IAES,6BAA6B,CAAI,WAAmB;QAC5D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,CAAC;YACH,mHAAmH;YACnH,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,+HAA+H;QAE/H,+CAA+C;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3D,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA,CAAC,4CAA4C;QAEnG,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/C,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,mBAAmB;YACrB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,CAAC;IAES,QAAQ,CAAC,GAAmD;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QACjD,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,KAAK,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,GAAG,EAAE,CAAA;IACrD,CAAC;IAED,6EAA6E;IAC7E,iFAAiF;IACvE,uBAAuB,CAAC,GAAW,EAAE,GAAgB;QAC7D,OAAO,EAAE,EAAE,EAAE,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAA;IAC5E,CAAC;IAED;;;;;;;;;OASG;IACO,gBAAgB,CAAC,OAAe,EAAE,GAAgB;QAC1D,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,oBAAoB,EAAE,CAAA;QACrE,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;IAClC,CAAC;IAES,KAAK,CAAC,wBAAwB,CAAC,OAAuD;QAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC;YACnD,SAAS,EAAE,OAAO,CAAC,IAAI;YACvB,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,aAAa,EAAE,OAAO,CAAC,OAAO;SAC/B,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IACD;;;;;;OAMG;IACO,gBAAgB,CAAC,UAAkB;QAC3C,IAAI,EAAU,CAAA;QACd,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,uFAAuF;YACvF,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC1C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;YACjD,CAAC;YACD,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;QAC9C,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;QACD,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;QACjD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;IAC7E,CAAC;IAED;;;;;;;;;;OAUG;IACO,qBAAqB,CAAC,IAAiB,EAAE,WAAmB;QACpE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7D,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,sBAAsB,CAAC,GAAoB,EAAE,GAAW,EAAE,QAAkC,IAAI,GAAG,EAAE;QAC3G,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACzB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG;gBACL,IAAI;gBACJ,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,OAAO;gBAClB,YAAY,EAAE,IAAI,GAAG,EAAe;gBACpC,SAAS,EAAE,IAAI,GAAG,EAAU;aAC7B,CAAA;YAED,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAEpB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE,CAAA;YAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC1D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,YAAgC,EAAE,MAAwB;;QACtF,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,SAAS,EAAE,CAAA;YACpC,iFAAiF;YACjF,MAAM,OAAO,GAAG,MAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,0CAAE,IAAI,CAAA;YACnD,MAAM,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,+BAAe,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC9D,SAAQ;YACV,CAAC;YAED,qBAAqB;YACrB,yCAAyC;YACzC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;gBAC9B,SAAQ;YACV,CAAC;YAED,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,SAAS;gBAClB,GAAG,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;aAClC,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjB,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,GAAG,EAAE,CAAA;gBACtB,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACrD,CAAC;IAES,oBAAoB,CAAC,OAAe;QAC5C,MAAM,mBAAmB,GAAG,oGAAoG,CAAA;QAChI,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,+BAAe,CAAC,mCAAmC,CAAC,CAAC,CAAC,+BAAe,CAAC,eAAe,CAAA;QAC5I,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjD,CAAC;IAES,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,IAAc,EAAE,MAAc,IAAI,CAAC,OAAO;QACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACvF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YACjE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACtD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,kBAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAA;YAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;QACrD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACO,KAAK,CAAC,4BAA4B,CAAC,OAAe,EAAE,IAAc,EAAE,GAAW,EAAE,cAAsB;QAC/G,kGAAkG;QAClG,kFAAkF;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;QAE9D,iGAAiG;QACjG,mGAAmG;QACnG,gGAAgG;QAChG,iGAAiG;QACjG,kGAAkG;QAClG,6FAA6F;QAC7F,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAE,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAW,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,IAAI,CAAW,CAAA;QAEtK,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAA,4BAAiB,EAAC,cAAc,CAAC,CAAA;YAEnD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE;gBACxD,GAAG;gBACH,0EAA0E;gBAC1E,GAAG,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE,GAAG,IAAA,oCAAqB,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE;aAC5E,CAAC,CAAA;YAEF,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,2FAA2F;YAC3F,yFAAyF;YACzF,6FAA6F;YAC7F,6EAA6E;YAC7E,IAAI,QAAQ,GAAkB,IAAI,CAAA;YAClC,IAAI,WAAW,GAAG,KAAK,CAAA;YACvB,IAAI,cAAc,GAAG,KAAK,CAAA;YAC1B,IAAI,OAAO,GAAG,KAAK,CAAA;YAEnB,sFAAsF;YACtF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;gBAC9B,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;YAC5B,CAAC,CAAC,CAAA;YAEF,MAAM,IAAI,GAAG,CAAC,GAAU,EAAE,EAAE;gBAC1B,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAM;gBACR,CAAC;gBACD,OAAO,GAAG,IAAI,CAAA;gBACd,uEAAuE;gBACvE,oDAAoD;gBACpD,IAAI,CAAC;oBACH,KAAK,CAAC,IAAI,EAAE,CAAA;gBACd,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC;oBACH,SAAS,CAAC,OAAO,EAAE,CAAA;gBACrB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAA;YACb,CAAC,CAAA;YAED,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC;oBAC/C,OAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,QAAQ,CAAA;gBACrB,0CAA0C;gBAC1C,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;gBAC5F,IAAI,YAAY,EAAE,CAAC;oBACjB,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,uIAAuI,CAAC,CAAA;gBAC1J,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,wDAAwD,CAAC,CAAA;oBAC/E,yFAAyF;oBACzF,qFAAqF;oBACrF,uFAAuF;oBACvF,yEAAyE;oBACzE,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,+BAAe,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAC1E,CAAC;gBACH,CAAC;gBACD,OAAO,GAAG,IAAI,CAAA;gBACd,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,IAAI,YAAY,CAAA;gBAChD,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC,CAAA;YAC5H,CAAC,CAAA;YAED,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,gDAAgD,OAAO,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;YACzH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBAC1B,cAAc,GAAG,IAAI,CAAA;gBACrB,MAAM,EAAE,CAAA;YACV,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACtB,IAAI,CAAC,IAAI,KAAK,CAAC,gCAAgC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YAC5G,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;gBACvB,QAAQ,GAAG,IAAI,CAAA;gBACf,WAAW,GAAG,IAAI,CAAA;gBAClB,MAAM,EAAE,CAAA;YACV,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AA9bD,oDA8bC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,0BAA0B,CAAC,OAAe,EAAE,IAAc;IACxE,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,sEAAsE,UAAU,sBAAsB,CAAA;IACrH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACjE,OAAO,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;AACtE,CAAC","sourcesContent":["import { exists, log, retry, stripSensitiveEnvVars, TmpDir } from \"builder-util\"\nimport * as childProcess from \"child_process\"\nimport * as fs from \"fs-extra\"\nimport { createWriteStream } from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { hoist, type HoisterResult, type HoisterTree } from \"./hoist\"\nimport { LogMessageByKey, ModuleManager } from \"./moduleManager\"\nimport { getPackageManagerCommand, PM } from \"./packageManager\"\nimport type { Dependency, DependencyGraph, NodeModuleInfo, PackageJson } from \"./types\"\n\nexport abstract class NodeModulesCollector<ProdDepType extends Dependency<ProdDepType, OptionalDepType>, OptionalDepType> {\n  private readonly nodeModules: NodeModuleInfo[] = []\n  protected readonly allDependencies: Map<string, ProdDepType> = new Map()\n  protected readonly productionGraph: DependencyGraph = {}\n  protected readonly cache: ModuleManager = new ModuleManager()\n\n  protected isHoisted = new Lazy<boolean>(async () => {\n    const { manager } = this.installOptions\n    const command = getPackageManagerCommand(manager)\n    const config = (await this.asyncExec(command, [\"config\", \"list\"])).stdout\n    if (config == null) {\n      log.debug({ manager }, \"unable to determine node-linker setting; assuming non-hoisted (virtual store) layout\")\n      return false\n    }\n    const lines = Object.fromEntries(config.split(\"\\n\").map(line => line.split(\"=\").map(s => s.trim())))\n    if (lines[\"node-linker\"] === \"hoisted\") {\n      log.debug({ manager }, \"node_modules are hoisted\")\n      return true\n    }\n    return false\n  })\n\n  constructor(\n    protected readonly rootDir: string,\n    private readonly tempDirManager: TmpDir\n  ) {}\n\n  /**\n   * Retrieves and collects all Node.js modules for a given package.\n   *\n   * This method orchestrates the entire module collection process by:\n   * 1. Fetching the dependency tree from the package manager\n   * 2. Collecting all dependencies recursively\n   * 3. Extracting workspace references if applicable\n   * 4. Building a production dependency graph\n   * 5. Hoisting the dependencies to their final locations\n   * 6. Resolving and returning module information\n   */\n  public async getNodeModules({ packageName }: { packageName: string }): Promise<{\n    nodeModules: NodeModuleInfo[]\n    logSummary: ModuleManager[\"logSummary\"]\n  }> {\n    const tree: ProdDepType = await this.getDependenciesTree(this.installOptions.manager)\n\n    await this.collectAllDependencies(tree, packageName)\n    const realTree: ProdDepType = this.getTreeFromWorkspaces(tree, packageName)\n    await this.extractProductionDependencyGraph(realTree, packageName)\n\n    const hoisterResult: HoisterResult = hoist(this.transformToHoisterTree(this.productionGraph, packageName), {\n      check: log.isDebugEnabled,\n    })\n\n    await this._getNodeModules(hoisterResult.dependencies, this.nodeModules)\n\n    log.debug({ packageName, depCount: this.nodeModules.length }, \"node modules collection complete\")\n\n    return { nodeModules: this.nodeModules, logSummary: this.cache.logSummary }\n  }\n\n  public abstract readonly installOptions: {\n    manager: PM\n    lockfile: string\n  }\n\n  protected abstract getArgs(): string[]\n  protected abstract extractProductionDependencyGraph(tree: Dependency<ProdDepType, OptionalDepType>, dependencyId: string): Promise<void>\n  protected abstract collectAllDependencies(tree: Dependency<ProdDepType, OptionalDepType>, appPackageName: string): Promise<void>\n\n  /**\n   * Retrieves the dependency tree from the package manager.\n   *\n   * Executes the appropriate package manager command to fetch the dependency tree and writes\n   * the output to a temporary file. Includes retry logic to handle transient failures such as\n   * incomplete JSON output or missing files. Will retry up to 1 time with exponential backoff.\n   */\n  protected async getDependenciesTree(pm: PM): Promise<ProdDepType> {\n    const command = getPackageManagerCommand(pm)\n    const args = this.getArgs()\n\n    const tempOutputFile = await this.tempDirManager.getTempFile({\n      prefix: path.basename(command, path.extname(command)),\n      suffix: \"output.json\",\n    })\n\n    return retry(\n      async () => {\n        await this.streamCollectorCommandToFile(command, args, this.rootDir, tempOutputFile)\n        const shellOutput = await fs.readFile(tempOutputFile, { encoding: \"utf8\" })\n        const result = await Promise.resolve(this.parseDependenciesTree(shellOutput))\n        return result\n      },\n      {\n        retries: 1,\n        interval: 2000,\n        backoff: 2000,\n        shouldRetry: async (error: any) => {\n          const fields: Record<string, string> = { error: error.message, tempOutputFile, cwd: this.rootDir, packageManager: pm }\n\n          if (!(await exists(tempOutputFile))) {\n            log.debug(fields, \"dependency tree output file missing, retrying\")\n            return true\n          }\n\n          const fileContent = await fs.readFile(tempOutputFile, { encoding: \"utf8\" })\n          fields.fileContentLength = fileContent.length.toString()\n\n          if (fileContent.trim().length === 0) {\n            log.debug(fields, \"dependency tree output file empty, retrying\")\n            return true\n          }\n\n          // extract small start/end sample for debugging purposes (e.g. polluted console output)\n          const lines = fileContent.split(\"\\n\")\n          const lineSampleSize = Math.min(5, lines.length / 2)\n          if (2 * lineSampleSize > 5) {\n            fields.sampleStart = lines.slice(0, lineSampleSize).join(\"\\n\")\n            fields.sampleEnd = lines.slice(-lineSampleSize).join(\"\\n\")\n          } else {\n            fields.content = fileContent\n          }\n\n          // Both indicate truncated/polluted PM output (a transient that re-running the command clears).\n          if (error.message?.includes(\"Unexpected end of JSON input\") || error.message?.includes(\"No JSON content found in output\")) {\n            log.debug(fields, \"JSON parse error in dependency tree, retrying\")\n            return true\n          }\n\n          log.error(fields, \"error parsing dependencies tree\")\n          return false\n        },\n      }\n    )\n  }\n\n  /**\n   * Parses the dependencies tree from shell command output.\n   *\n   **/\n  protected parseDependenciesTree(shellOutput: string): ProdDepType | Promise<ProdDepType> {\n    return this.extractJsonFromPollutedOutput<ProdDepType>(shellOutput)\n  }\n\n  protected extractJsonFromPollutedOutput<T>(shellOutput: string): T {\n    const consoleOutput = shellOutput.trim()\n    try {\n      // Please for the love of all that is holy, this should cover 99% of cases where npm/pnpm/yarn output is clean JSON\n      return JSON.parse(consoleOutput)\n    } catch {\n      // ignore\n    }\n\n    // DEDICATED FALLBACK FOR POLLUTED OUTPUT, non-trivial to implement correctly, not needed in most cases, and highly inefficient\n\n    // Find the first index that starts with { or [\n    const bracketOpen = Math.max(consoleOutput.indexOf(\"{\"), 0)\n    const bracketOpenSquare = Math.max(consoleOutput.indexOf(\"[\"), 0)\n    const start = Math.min(bracketOpen, bracketOpenSquare) // always non-negative due to Math.max above\n\n    for (let i = start; i < consoleOutput.length; i++) {\n      const slice = consoleOutput.slice(start, i + 1)\n      try {\n        return JSON.parse(slice)\n      } catch {\n        // ignore, try next\n      }\n    }\n    throw new Error(\"No JSON content found in output\")\n  }\n\n  protected cacheKey(pkg: Pick<ProdDepType, \"name\" | \"version\" | \"path\">): string {\n    const rel = path.relative(this.rootDir, pkg.path)\n    return `${pkg.name}::${pkg.version}::${rel ?? \".\"}`\n  }\n\n  // We use the key (alias name) instead of value.name for npm aliased packages\n  // e.g., { \"foo\": { name: \"@scope/bar\", ... } } should be stored as \"foo@version\"\n  protected normalizePackageVersion(key: string, pkg: ProdDepType) {\n    return { id: `${key}@${pkg.version}`, pkgOverride: { ...pkg, name: key } }\n  }\n\n  /**\n   * Determines if a given dependency is a production dependency of a package.\n   *\n   * Checks both the dependencies and optionalDependencies of a package to see if\n   * the specified dependency name is listed.\n   *\n   * @param depName - The name of the dependency to check\n   * @param pkg - The package to search for the dependency in\n   * @returns True if the dependency is found in either dependencies or optionalDependencies, false otherwise\n   */\n  protected isProdDependency(depName: string, pkg: ProdDepType): boolean {\n    const prodDeps = { ...pkg.dependencies, ...pkg.optionalDependencies }\n    return prodDeps[depName] != null\n  }\n\n  protected async locatePackageWithVersion(depTree: Pick<ProdDepType, \"name\" | \"version\" | \"path\">): Promise<{ packageDir: string; packageJson: PackageJson } | null> {\n    const result = await this.cache.locatePackageVersion({\n      parentDir: depTree.path,\n      pkgName: depTree.name,\n      requiredRange: depTree.version,\n    })\n    return result\n  }\n  /**\n   * Parses a dependency identifier string into name and version components.\n   *\n   * Handles both scoped packages (e.g., \"@scope/pkg@1.2.3\") and regular packages (e.g., \"pkg@1.2.3\").\n   * If the identifier is malformed or cannot be parsed, defaults to treating the entire string as\n   * the package name with an \"unknown\" version.\n   */\n  protected parseNameVersion(identifier: string): { name: string; version: string } {\n    let at: number\n    if (identifier.startsWith(\"@\")) {\n      // Scoped package: find the version separator after the scope (e.g. \"@scope/pkg@1.2.3\")\n      const slashIndex = identifier.indexOf(\"/\")\n      if (slashIndex === -1) {\n        return { name: identifier, version: \"unknown\" }\n      }\n      at = identifier.indexOf(\"@\", slashIndex + 1)\n    } else {\n      at = identifier.indexOf(\"@\")\n    }\n    if (at <= 0) {\n      return { name: identifier, version: \"unknown\" }\n    }\n    return { name: identifier.slice(0, at), version: identifier.slice(at + 1) }\n  }\n\n  /**\n   * Retrieves the dependency tree and handles workspace package self-references.\n   *\n   * If the project is a workspace project, this method removes the root package's self-reference\n   * from the dependency tree to avoid circular dependencies. It promotes the root package's\n   * direct dependencies to the top level of the tree.\n   *\n   * @param tree - The original dependency tree\n   * @param packageName - The name of the package to check for and remove from the tree\n   * @returns The extracted dependency subtree\n   */\n  protected getTreeFromWorkspaces(tree: ProdDepType, packageName: string): ProdDepType {\n    if (tree.workspaces && tree.dependencies) {\n      for (const [key, value] of Object.entries(tree.dependencies)) {\n        if (key === packageName) {\n          return value\n        }\n      }\n    }\n\n    return tree\n  }\n\n  private transformToHoisterTree(obj: DependencyGraph, key: string, nodes: Map<string, HoisterTree> = new Map()): HoisterTree {\n    let node = nodes.get(key)\n    const { name, version } = this.parseNameVersion(key)\n\n    if (!node) {\n      node = {\n        name,\n        identName: name,\n        reference: version,\n        dependencies: new Set<HoisterTree>(),\n        peerNames: new Set<string>(),\n      }\n\n      nodes.set(key, node)\n\n      const deps = (obj[key] || {}).dependencies || []\n      for (const dep of deps) {\n        const child = this.transformToHoisterTree(obj, dep, nodes)\n        node.dependencies.add(child)\n      }\n    }\n\n    return node\n  }\n\n  private async _getNodeModules(dependencies: Set<HoisterResult>, result: NodeModuleInfo[]) {\n    if (dependencies.size === 0) {\n      return\n    }\n\n    for (const d of dependencies.values()) {\n      const reference = [...d.references][0]\n      const key = `${d.name}@${reference}`\n      // Normalize the path to handle mixed separators from pnpm JSON output on Windows\n      const rawPath = this.allDependencies.get(key)?.path\n      const p = rawPath != null ? path.normalize(rawPath) : undefined\n      if (p === undefined) {\n        this.cache.logSummary[LogMessageByKey.PKG_NOT_FOUND].push(key)\n        continue\n      }\n\n      // fix npm list issue\n      // https://github.com/npm/cli/issues/8535\n      if (!(await this.cache.exists[p])) {\n        this.logMissingDependency(key)\n        continue\n      }\n\n      const node: NodeModuleInfo = {\n        name: d.name,\n        version: reference,\n        dir: await this.cache.realPath[p],\n      }\n      result.push(node)\n      if (d.dependencies.size > 0) {\n        node.dependencies = []\n        await this._getNodeModules(d.dependencies, node.dependencies)\n      }\n    }\n    result.sort((a, b) => a.name.localeCompare(b.name))\n  }\n\n  protected logMissingDependency(pkgName: string) {\n    const PLATFORM_PACKAGE_RE = /(linux|win32|darwin|freebsd|android)[-_](x64|arm64|ia32|arm|ppc64|s390x|loong64|riscv64|universal)/\n    const diskLogKey = PLATFORM_PACKAGE_RE.test(pkgName) ? LogMessageByKey.PKG_OPTIONAL_PLATFORM_NOT_INSTALLED : LogMessageByKey.PKG_NOT_ON_DISK\n    this.cache.logSummary[diskLogKey].push(pkgName)\n  }\n\n  protected async asyncExec(command: string, args: string[], cwd: string = this.rootDir): Promise<{ stdout: string | undefined; stderr: string | undefined }> {\n    const file = await this.tempDirManager.getTempFile({ prefix: \"exec-\", suffix: \".txt\" })\n    try {\n      await this.streamCollectorCommandToFile(command, args, cwd, file)\n      const result = await fs.readFile(file, { encoding: \"utf8\" })\n      return { stdout: result?.trim(), stderr: undefined }\n    } catch (error: any) {\n      log.debug({ error: error.message }, \"failed to execute command\")\n      return { stdout: undefined, stderr: error.message }\n    }\n  }\n\n  /**\n   * Executes a command and streams its output to a file.\n   *\n   * Spawns a child process to execute the specified command with arguments, capturing stdout\n   * to a file. On Windows, wraps the invocation in `powershell.exe -EncodedCommand` (UTF-16LE\n   * base64) to avoid spawning `.cmd` shims directly and to eliminate shell-injection surface area.\n   * Enables corepack strict mode by default but allows process.env overrides.\n   *\n   * Special handling for `npm list` exit code 1, which is expected in certain scenarios.\n   *\n   * @param command - The command to execute\n   * @param args - Array of command-line arguments\n   * @param cwd - The working directory to execute the command in\n   * @param tempOutputFile - The path to the temporary file where stdout will be written\n   * @returns Promise that resolves when the command completes successfully or rejects if it fails\n   * @throws {Error} If the child process spawn fails or exits with a non-zero code\n   */\n  protected async streamCollectorCommandToFile(command: string, args: string[], cwd: string, tempOutputFile: string) {\n    // Derive execName from the original command so the npm-list shouldIgnore check below keys off the\n    // real invocation (e.g. \"npm\"), not the \"powershell\" wrapper we spawn on Windows.\n    const execName = path.basename(command, path.extname(command))\n\n    // On Windows the package-manager command is typically a `.cmd` shim (npm.cmd/pnpm.cmd/yarn.cmd),\n    // which Node can no longer spawn directly (CVE-2024-27980). Rather than spawn with `shell: true` —\n    // which emits the DEP0190 \"args with shell\" deprecation warning and forces manual metacharacter\n    // escaping — wrap the invocation in a single PowerShell `-EncodedCommand`. The base64 (UTF-16LE)\n    // payload sidesteps every shell-quoting layer, and `powershell.exe` is a real executable we spawn\n    // directly with no shell. See buildPowerShellEncodedArgs for the UTF-8 / exit-code handling.\n    const [spawnCommand, spawnArgs] = process.platform === \"win32\" ? ([\"powershell.exe\", buildPowerShellEncodedArgs(command, args)] as const) : ([command, args] as const)\n\n    await new Promise<void>((resolve, reject) => {\n      const outStream = createWriteStream(tempOutputFile)\n\n      const child = childProcess.spawn(spawnCommand, spawnArgs, {\n        cwd,\n        // Package manager invocations do not need signing/publishing credentials.\n        env: { COREPACK_ENABLE_STRICT: \"0\", ...stripSensitiveEnvVars(process.env) },\n      })\n\n      let stderr = \"\"\n      // The process can close before all piped stdout has been flushed to disk. Resolving on the\n      // child's \"close\" alone races the write stream and lets the caller read a TRUNCATED file\n      // (manifesting as \"No JSON content found in output\"). Gate the settle on BOTH the child exit\n      // (for the code/stderr) and the write stream's \"finish\" (all bytes flushed).\n      let exitCode: number | null = null\n      let childClosed = false\n      let streamFinished = false\n      let settled = false\n\n      // `pipe` ends `outStream` when stdout EOFs, which triggers its \"finish\" once flushed.\n      child.stdout.pipe(outStream)\n      child.stderr.on(\"data\", chunk => {\n        stderr += chunk.toString()\n      })\n\n      const fail = (err: Error) => {\n        if (settled) {\n          return\n        }\n        settled = true\n        // Best-effort cleanup: stop the child and close the stream so we don't\n        // waste CPU writing to a broken fd after rejection.\n        try {\n          child.kill()\n        } catch {\n          // ignore\n        }\n        try {\n          outStream.destroy()\n        } catch {\n          // ignore\n        }\n        reject(err)\n      }\n\n      const settle = () => {\n        if (settled || !childClosed || !streamFinished) {\n          return\n        }\n        const code = exitCode\n        // https://github.com/npm/npm/issues/17624\n        const shouldIgnore = code === 1 && \"npm\" === execName.toLowerCase() && args.includes(\"list\")\n        if (shouldIgnore) {\n          log.debug(null, \"`npm list` returned non-zero exit code, but it MIGHT be expected (https://github.com/npm/npm/issues/17624). Check stderr for details.\")\n        }\n        if (stderr.length > 0) {\n          log.debug({ stderr }, \"note: there was node module collector output on stderr\")\n          // Only surface stderr as a user-visible warning when the exit code itself is unexpected.\n          // When shouldIgnore is true (npm list exit code 1) the stderr is an anticipated side\n          // effect of package-manager features like yarn resolutions or npm overrides that cause\n          // npm to report ELSPROBLEMS for aliased packages it considers \"invalid\".\n          if (!shouldIgnore) {\n            this.cache.logSummary[LogMessageByKey.PKG_COLLECTOR_OUTPUT].push(stderr)\n          }\n        }\n        settled = true\n        const shouldResolve = code === 0 || shouldIgnore\n        return shouldResolve ? resolve() : reject(new Error(`Node module collector process exited with code ${code}:\\n${stderr}`))\n      }\n\n      outStream.on(\"error\", err => fail(new Error(`Node module collector failed writing output (${command}): ${err.message}`)))\n      outStream.on(\"finish\", () => {\n        streamFinished = true\n        settle()\n      })\n      child.on(\"error\", err => {\n        fail(new Error(`Node module collector spawn (${command} ${JSON.stringify(args)}) failed: ${err.message}`))\n      })\n      child.on(\"close\", code => {\n        exitCode = code\n        childClosed = true\n        settle()\n      })\n    })\n  }\n}\n\n/**\n * Build the argv for invoking a Windows command through `powershell.exe -EncodedCommand`.\n *\n * Each token is wrapped in a PowerShell single-quoted string (with embedded single quotes doubled),\n * so no character is interpreted by a shell. The script:\n *   - pins `[Console]::OutputEncoding` to UTF-8 *without* a BOM so the JSON dependency tree is not\n *     corrupted by the console's OEM code page (and no BOM is prepended to break `JSON.parse`),\n *   - invokes the command via the call operator `&`,\n *   - re-emits the command's own exit code via `exit $LASTEXITCODE` (e.g. `npm list` returns 1 in\n *     expected scenarios, which the caller's shouldIgnore logic relies on).\n *\n * The whole script is base64-encoded as UTF-16LE per PowerShell's `-EncodedCommand` contract.\n */\nexport function buildPowerShellEncodedArgs(command: string, args: string[]): string[] {\n  const psQuote = (value: string) => `'${value.replace(/'/g, \"''\")}'`\n  const invocation = [\"&\", psQuote(command), ...args.map(psQuote)].join(\" \")\n  const script = `[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new($false); ${invocation}; exit $LASTEXITCODE`\n  const encoded = Buffer.from(script, \"utf16le\").toString(\"base64\")\n  return [\"-NoProfile\", \"-NonInteractive\", \"-EncodedCommand\", encoded]\n}\n"]}

package/out/options/linuxOptions.d.ts

@@ -49,6 +49,16 @@ export interface LinuxConfiguration extends CommonLinuxOptions, PlatformSpecific
      * By default will be generated automatically based on the macOS icns file.
      */
     readonly icon?: string;
+    /**
+     * When `true`, the installed `.desktop` filename is derived from `desktopName` in `package.json`
+     * (minus the `.desktop` suffix) so that it matches `StartupWMClass` and Electron's `app_id`.
+     * Falls back to `executableName` when `desktopName` is absent.
+     *
+     * @default false
+     * @see https://github.com/electron-userland/electron-builder/issues/9103
+     * @remarks In v27 the default will change to `true`.
+     */
+    readonly syncDesktopName?: boolean;
 }
 /**
  * Desktop-entry and runtime fields shared by all Linux targets and all snap core strategies.

package/out/options/linuxOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"linuxOptions.js","sourceRoot":"","sources":["../../src/options/linuxOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { PlatformSpecificBuildOptions, TargetConfigType, TargetSpecificOptions } from \"../index\"\n\n/**\n * Example Spec: https://specifications.freedesktop.org/desktop-entry-spec/latest/example.html\n */\nexport interface LinuxDesktopFile {\n  /**\n   * `[Desktop Entry]` metadata entries (name to value). Overwrites default values calculated by electron-builder\n   */\n  entry?: {\n    [k: string]: string\n  } | null\n  /**\n   * `[Desktop Actions <ActionName>]` metadata entries (name to value).\n   *\n   * Config Example:\n   * ```js\n   * desktopActions: {\n   *    NewWindow: {\n   *       Name: 'New Window',\n   *       Exec: 'app --new-window',\n   *    }\n   * }\n   * ```\n   */\n  desktopActions?: {\n    [ActionName: string]: any\n  } | null\n}\n\nexport interface LinuxConfiguration extends CommonLinuxOptions, PlatformSpecificBuildOptions {\n  /**\n   * Target package type: list of `AppImage`, `flatpak`, `snap`, `deb`, `rpm`, `freebsd`, `pacman`, `p5p`, `apk`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   *\n   * electron-builder [docker image](https://www.electron.build/multi-platform-build#docker) can be used to build Linux targets on any platform.\n   *\n   * Please [do not put an AppImage into another archive](https://github.com/probonopd/AppImageKit/wiki/Creating-AppImages#common-mistake) like a .zip or .tar.gz.\n   * @default AppImage\n   */\n  readonly target?: TargetConfigType\n\n  /**\n   * The maintainer. Defaults to [author](https://www.electron.build/configuration#author).\n   */\n  readonly maintainer?: string | null\n\n  /**\n   * The vendor. Defaults to [author](https://www.electron.build/configuration#author).\n   */\n  readonly vendor?: string | null\n\n  /**\n   * The path to icon set directory or one png file, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory. The icon filename must contain the size (e.g. 32x32.png) of the icon.\n   * By default will be generated automatically based on the macOS icns file.\n   */\n  readonly icon?: string\n\n  /**\n   * @private\n   * @internal Allows specifying an FPM-only package category for all FPM targets in one place.\n   * For user-facing category configuration use the target-specific options (e.g. {@link DebOptions}).\n   */\n  readonly packageCategory?: string | null\n}\n\n/**\n * Desktop-entry and runtime fields shared by all Linux targets and all snap core strategies.\n *\n * Fields set under `linux.*` in your build config (i.e. on {@link LinuxConfiguration}) are\n * automatically cascaded into each snap core's options by `LinuxTargetHelper.getSnapCore()`.\n * You do not need to duplicate them under `snapcraft.core24.*`, `snapcraft.core22.*`, etc.\n * Per-core values always take precedence when both are set.\n */\nexport interface CommonLinuxOptions {\n  /**\n   * The [short description](https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Description).\n   */\n  readonly synopsis?: string | null\n\n  /**\n   * As [description](https://www.electron.build/configuration#description) from application package.json, but allows you to specify different for Linux.\n   */\n  readonly description?: string | null\n\n  /**\n   * The [application category](https://specifications.freedesktop.org/menu-spec/latest/apa.html#main-category-registry).\n   */\n  readonly category?: string | null\n\n  /**\n   * The mime types in addition to specified in the file associations. Use it if you don't want to register a new mime type, but reuse existing.\n   */\n  readonly mimeTypes?: Array<string> | null\n\n  /**\n   * The [Desktop file](https://developer.gnome.org/documentation/guidelines/maintainer/integrating.html#desktop-files)\n   */\n  readonly desktop?: LinuxDesktopFile | null\n\n  /**\n   * The executable parameters. Pass to executableName\n   */\n  readonly executableArgs?: Array<string> | null\n}\n\n// fpm-only specific options\nexport interface LinuxTargetSpecificOptions extends CommonLinuxOptions, TargetSpecificOptions {\n  /**\n   * Package dependencies.\n   * `rpm` defaults to `[\"gtk3\", \"libnotify\", \"nss\", \"libXScrnSaver\", \"(libXtst or libXtst6)\", \"xdg-utils\", \"at-spi2-core\", \"(libuuid or libuuid1)\"]`\n   * `pacman` defaults to `[\"c-ares\", \"ffmpeg\", \"gtk3\", \"http-parser\", \"libevent\", \"libvpx\", \"libxslt\", \"libxss\", \"minizip\", \"nss\", \"re2\", \"snappy\", \"libnotify\", \"libappindicator-gtk3\"]`\n   */\n  readonly depends?: Array<string> | null\n\n  /**\n   * The compression type passed to fpm. For `deb`, `rpm`, and `pacman` targets prefer the\n   * typed per-format interfaces (`DebOptions`, `RpmOptions`, `PacmanOptions`) which narrow\n   * this to only the values that fpm actually accepts for that format.\n   * @default xz\n   */\n  readonly compression?: \"gz\" | \"bzip2\" | \"xz\" | \"xzmt\" | \"gzip\" | \"zst\" | \"zstd\" | null\n\n  readonly icon?: string\n\n  /**\n   * The package category.\n   */\n  readonly packageCategory?: string | null\n\n  /**\n   * The name of the package.\n   */\n  readonly packageName?: string | null\n\n  readonly vendor?: string | null\n  readonly maintainer?: string | null\n\n  /**\n   * File path to script to be passed to FPM for `--after-install` arg.\n   */\n  readonly afterInstall?: string | null\n  /**\n   * File path to script to be passed to FPM for `--after-remove` arg.\n   */\n  readonly afterRemove?: string | null\n  /**\n   * File path to custom AppArmor profile (Ubuntu 24+)\n   */\n  readonly appArmorProfile?: string | null\n\n  /**\n   * *Advanced only* The [fpm](https://fpm.readthedocs.io/en/latest/cli-reference.html) options.\n   *\n   * Example: `[\"--before-install=build/deb-preinstall.sh\", \"--after-upgrade=build/deb-postinstall.sh\"]`\n   */\n  readonly fpm?: Array<string> | null\n}\nexport interface DebOptions extends LinuxTargetSpecificOptions {\n  /**\n   * Package dependencies.\n   * If need to support Debian, `libappindicator1` should be removed, it is [deprecated in Debian](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895037).\n   * If need to support KDE, `gconf2` and `gconf-service` should be removed as it's no longer used [by GNOME](https://packages.debian.org/bullseye/gconf2).\n   * @default [\"libgtk-3-0\", \"libnotify4\", \"libnss3\", \"libxss1\", \"libxtst6\", \"xdg-utils\", \"libatspi2.0-0\", \"libuuid1\", \"libsecret-1-0\"]\n   */\n  readonly depends?: Array<string> | null\n\n  /**\n   * The [recommended package dependencies](https://www.debian.org/doc/debian-policy/ch-relationships.html#s-binarydeps).\n   * @default [\"libappindicator3-1\"]\n   */\n  readonly recommends?: Array<string> | null\n\n  /**\n   * The [package category](https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Section).\n   */\n  readonly packageCategory?: string | null\n\n  /**\n   * The [Priority](https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Priority) attribute.\n   */\n  readonly priority?: string | null\n\n  /** @default xz */\n  readonly compression?: \"gz\" | \"bzip2\" | \"xz\" | \"zst\" | null\n}\n\nexport interface RpmOptions extends LinuxTargetSpecificOptions {\n  /**\n   * Passed to fpm via `--rpm-compression`. `\"xzmt\"` uses multi-threaded xz (fpm's RPM default).\n   * `\"xz\"` is automatically promoted to `\"xzmt\"`. `\"gzip\"` and `\"bzip2\"` pass through as-is.\n   * @default xzmt\n   */\n  readonly compression?: \"xz\" | \"xzmt\" | \"gzip\" | \"bzip2\" | null\n}\n\nexport interface PacmanOptions extends LinuxTargetSpecificOptions {\n  /** @default xz */\n  readonly compression?: \"gz\" | \"bzip2\" | \"xz\" | \"zstd\" | null\n}\n\nexport interface AppImageOptions extends CommonLinuxOptions, TargetSpecificOptions {\n  /**\n   * The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants). Only plain text is supported.\n   */\n  readonly license?: string | null\n  /**\n   * The compression algorithm passed to the AppImage build tool.\n   *\n   * **FUSE2 toolset (`\"0.0.0\"` or unset):** only `\"xz\"` and `\"gzip\"` are forwarded\n   * to mksquashfs (`-comp <value>`); `\"xz\"` additionally passes `-Xdict-size 100% -b 1048576`.\n   * `\"zstd\"`, `null`, and unset fall through to the root-level `compression` option:\n   * - `\"maximum\"` → `\"xz\"`\n   * - anything else → flag omitted (mksquashfs defaults to gzip)\n   *\n   * **Static-runtime toolsets (`>= 1.0.0`):** `\"gzip\"` and `\"zstd\"` are forwarded\n   * directly. `\"xz\"` is mapped to `\"zstd\"` (nearest supported equivalent). `null`\n   * or unset falls through to the root-level `compression` option:\n   * - `\"store\"` → `\"gzip\"`\n   * - `\"normal\"` / `\"maximum\"` / unset → `\"zstd\"`\n   */\n  readonly compression?: \"gzip\" | \"xz\" | \"zstd\" | null\n}\n\nexport interface FlatpakOptions extends CommonLinuxOptions, TargetSpecificOptions {\n  /**\n   * The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants). Only plain text is supported.\n   */\n  readonly license?: string | null\n\n  /**\n   * The name of the runtime that the application uses. Defaults to `org.freedesktop.Platform`.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly runtime?: string\n\n  /**\n   * The version of the runtime that the application uses. Defaults to `20.08`.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly runtimeVersion?: string\n\n  /**\n   * The name of the development runtime that the application builds with. Defaults to `org.freedesktop.Sdk`.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly sdk?: string\n\n  /**\n   * Start with the files from the specified application. This can be used to create applications that extend another application.\n   * Defaults to [org.electronjs.Electron2.BaseApp](https://github.com/flathub/org.electronjs.Electron2.BaseApp).\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly base?: string\n\n  /**\n   * Use this specific version of the application specified in base. Defaults to `20.08`.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly baseVersion?: string\n\n  /**\n   * The branch to use when exporting the application. Defaults to `master`.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly branch?: string\n\n  /**\n   * An array of arguments passed to the flatpak build-finish command. Defaults to:\n   * ```json\n   * [\n   *   // Wayland/X11 Rendering\n   *   \"--socket=wayland\",\n   *   \"--socket=x11\",\n   *   \"--share=ipc\",\n   *   // Open GL\n   *   \"--device=dri\",\n   *   // Audio output\n   *   \"--socket=pulseaudio\",\n   *   // Read/write home directory access\n   *   \"--filesystem=home\",\n   *   // Allow communication with network\n   *   \"--share=network\",\n   *   // System notifications with libnotify\n   *   \"--talk-name=org.freedesktop.Notifications\",\n   * ]\n   * ```\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly finishArgs?: string[]\n\n  /**\n   * An array of objects specifying the modules to be built in order.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly modules?: (string | any)[]\n\n  /**\n   * Files to copy directly into the app. Should be a list of [source, dest] tuples. Source should be a relative/absolute path to a file/directory to copy into the flatpak, and dest should be the path inside the app install prefix (e.g. /share/applications/).\n   *\n   * See [@malept/flatpak-bundler documentation](https://github.com/malept/flatpak-bundler#build-options).\n   */\n  readonly files?: [string, string][]\n\n  /**\n   * Symlinks to create in the app files. Should be a list of [target, location] symlink tuples. Target can be either a relative or absolute path inside the app install prefix, and location should be a absolute path inside the prefix to create the symlink at.\n   *\n   * See [@malept/flatpak-bundler documentation](https://github.com/malept/flatpak-bundler#build-options).\n   */\n  readonly symlinks?: [string, string][]\n\n  /**\n   * Whether to enable the Wayland specific flags (`--enable-features=UseOzonePlatform --ozone-platform=wayland`) in the wrapper script. These flags are only available starting with Electron version 12. Defaults to `false`.\n   */\n  readonly useWaylandFlags?: boolean\n}\n"]}
+{"version":3,"file":"linuxOptions.js","sourceRoot":"","sources":["../../src/options/linuxOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { PlatformSpecificBuildOptions, TargetConfigType, TargetSpecificOptions } from \"../index\"\n\n/**\n * Example Spec: https://specifications.freedesktop.org/desktop-entry-spec/latest/example.html\n */\nexport interface LinuxDesktopFile {\n  /**\n   * `[Desktop Entry]` metadata entries (name to value). Overwrites default values calculated by electron-builder\n   */\n  entry?: {\n    [k: string]: string\n  } | null\n  /**\n   * `[Desktop Actions <ActionName>]` metadata entries (name to value).\n   *\n   * Config Example:\n   * ```js\n   * desktopActions: {\n   *    NewWindow: {\n   *       Name: 'New Window',\n   *       Exec: 'app --new-window',\n   *    }\n   * }\n   * ```\n   */\n  desktopActions?: {\n    [ActionName: string]: any\n  } | null\n}\n\nexport interface LinuxConfiguration extends CommonLinuxOptions, PlatformSpecificBuildOptions {\n  /**\n   * Target package type: list of `AppImage`, `flatpak`, `snap`, `deb`, `rpm`, `freebsd`, `pacman`, `p5p`, `apk`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   *\n   * electron-builder [docker image](https://www.electron.build/multi-platform-build#docker) can be used to build Linux targets on any platform.\n   *\n   * Please [do not put an AppImage into another archive](https://github.com/probonopd/AppImageKit/wiki/Creating-AppImages#common-mistake) like a .zip or .tar.gz.\n   * @default AppImage\n   */\n  readonly target?: TargetConfigType\n\n  /**\n   * The maintainer. Defaults to [author](https://www.electron.build/configuration#author).\n   */\n  readonly maintainer?: string | null\n\n  /**\n   * The vendor. Defaults to [author](https://www.electron.build/configuration#author).\n   */\n  readonly vendor?: string | null\n\n  /**\n   * The path to icon set directory or one png file, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory. The icon filename must contain the size (e.g. 32x32.png) of the icon.\n   * By default will be generated automatically based on the macOS icns file.\n   */\n  readonly icon?: string\n\n  /**\n   * @private\n   * @internal Allows specifying an FPM-only package category for all FPM targets in one place.\n   * For user-facing category configuration use the target-specific options (e.g. {@link DebOptions}).\n   */\n  readonly packageCategory?: string | null\n\n  /**\n   * When `true`, the installed `.desktop` filename is derived from `desktopName` in `package.json`\n   * (minus the `.desktop` suffix) so that it matches `StartupWMClass` and Electron's `app_id`.\n   * Falls back to `executableName` when `desktopName` is absent.\n   *\n   * @default false\n   * @see https://github.com/electron-userland/electron-builder/issues/9103\n   * @remarks In v27 the default will change to `true`.\n   */\n  readonly syncDesktopName?: boolean\n}\n\n/**\n * Desktop-entry and runtime fields shared by all Linux targets and all snap core strategies.\n *\n * Fields set under `linux.*` in your build config (i.e. on {@link LinuxConfiguration}) are\n * automatically cascaded into each snap core's options by `LinuxTargetHelper.getSnapCore()`.\n * You do not need to duplicate them under `snapcraft.core24.*`, `snapcraft.core22.*`, etc.\n * Per-core values always take precedence when both are set.\n */\nexport interface CommonLinuxOptions {\n  /**\n   * The [short description](https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Description).\n   */\n  readonly synopsis?: string | null\n\n  /**\n   * As [description](https://www.electron.build/configuration#description) from application package.json, but allows you to specify different for Linux.\n   */\n  readonly description?: string | null\n\n  /**\n   * The [application category](https://specifications.freedesktop.org/menu-spec/latest/apa.html#main-category-registry).\n   */\n  readonly category?: string | null\n\n  /**\n   * The mime types in addition to specified in the file associations. Use it if you don't want to register a new mime type, but reuse existing.\n   */\n  readonly mimeTypes?: Array<string> | null\n\n  /**\n   * The [Desktop file](https://developer.gnome.org/documentation/guidelines/maintainer/integrating.html#desktop-files)\n   */\n  readonly desktop?: LinuxDesktopFile | null\n\n  /**\n   * The executable parameters. Pass to executableName\n   */\n  readonly executableArgs?: Array<string> | null\n}\n\n// fpm-only specific options\nexport interface LinuxTargetSpecificOptions extends CommonLinuxOptions, TargetSpecificOptions {\n  /**\n   * Package dependencies.\n   * `rpm` defaults to `[\"gtk3\", \"libnotify\", \"nss\", \"libXScrnSaver\", \"(libXtst or libXtst6)\", \"xdg-utils\", \"at-spi2-core\", \"(libuuid or libuuid1)\"]`\n   * `pacman` defaults to `[\"c-ares\", \"ffmpeg\", \"gtk3\", \"http-parser\", \"libevent\", \"libvpx\", \"libxslt\", \"libxss\", \"minizip\", \"nss\", \"re2\", \"snappy\", \"libnotify\", \"libappindicator-gtk3\"]`\n   */\n  readonly depends?: Array<string> | null\n\n  /**\n   * The compression type passed to fpm. For `deb`, `rpm`, and `pacman` targets prefer the\n   * typed per-format interfaces (`DebOptions`, `RpmOptions`, `PacmanOptions`) which narrow\n   * this to only the values that fpm actually accepts for that format.\n   * @default xz\n   */\n  readonly compression?: \"gz\" | \"bzip2\" | \"xz\" | \"xzmt\" | \"gzip\" | \"zst\" | \"zstd\" | null\n\n  readonly icon?: string\n\n  /**\n   * The package category.\n   */\n  readonly packageCategory?: string | null\n\n  /**\n   * The name of the package.\n   */\n  readonly packageName?: string | null\n\n  readonly vendor?: string | null\n  readonly maintainer?: string | null\n\n  /**\n   * File path to script to be passed to FPM for `--after-install` arg.\n   */\n  readonly afterInstall?: string | null\n  /**\n   * File path to script to be passed to FPM for `--after-remove` arg.\n   */\n  readonly afterRemove?: string | null\n  /**\n   * File path to custom AppArmor profile (Ubuntu 24+)\n   */\n  readonly appArmorProfile?: string | null\n\n  /**\n   * *Advanced only* The [fpm](https://fpm.readthedocs.io/en/latest/cli-reference.html) options.\n   *\n   * Example: `[\"--before-install=build/deb-preinstall.sh\", \"--after-upgrade=build/deb-postinstall.sh\"]`\n   */\n  readonly fpm?: Array<string> | null\n}\nexport interface DebOptions extends LinuxTargetSpecificOptions {\n  /**\n   * Package dependencies.\n   * If need to support Debian, `libappindicator1` should be removed, it is [deprecated in Debian](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895037).\n   * If need to support KDE, `gconf2` and `gconf-service` should be removed as it's no longer used [by GNOME](https://packages.debian.org/bullseye/gconf2).\n   * @default [\"libgtk-3-0\", \"libnotify4\", \"libnss3\", \"libxss1\", \"libxtst6\", \"xdg-utils\", \"libatspi2.0-0\", \"libuuid1\", \"libsecret-1-0\"]\n   */\n  readonly depends?: Array<string> | null\n\n  /**\n   * The [recommended package dependencies](https://www.debian.org/doc/debian-policy/ch-relationships.html#s-binarydeps).\n   * @default [\"libappindicator3-1\"]\n   */\n  readonly recommends?: Array<string> | null\n\n  /**\n   * The [package category](https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Section).\n   */\n  readonly packageCategory?: string | null\n\n  /**\n   * The [Priority](https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Priority) attribute.\n   */\n  readonly priority?: string | null\n\n  /** @default xz */\n  readonly compression?: \"gz\" | \"bzip2\" | \"xz\" | \"zst\" | null\n}\n\nexport interface RpmOptions extends LinuxTargetSpecificOptions {\n  /**\n   * Passed to fpm via `--rpm-compression`. `\"xzmt\"` uses multi-threaded xz (fpm's RPM default).\n   * `\"xz\"` is automatically promoted to `\"xzmt\"`. `\"gzip\"` and `\"bzip2\"` pass through as-is.\n   * @default xzmt\n   */\n  readonly compression?: \"xz\" | \"xzmt\" | \"gzip\" | \"bzip2\" | null\n}\n\nexport interface PacmanOptions extends LinuxTargetSpecificOptions {\n  /** @default xz */\n  readonly compression?: \"gz\" | \"bzip2\" | \"xz\" | \"zstd\" | null\n}\n\nexport interface AppImageOptions extends CommonLinuxOptions, TargetSpecificOptions {\n  /**\n   * The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants). Only plain text is supported.\n   */\n  readonly license?: string | null\n  /**\n   * The compression algorithm passed to the AppImage build tool.\n   *\n   * **FUSE2 toolset (`\"0.0.0\"` or unset):** only `\"xz\"` and `\"gzip\"` are forwarded\n   * to mksquashfs (`-comp <value>`); `\"xz\"` additionally passes `-Xdict-size 100% -b 1048576`.\n   * `\"zstd\"`, `null`, and unset fall through to the root-level `compression` option:\n   * - `\"maximum\"` → `\"xz\"`\n   * - anything else → flag omitted (mksquashfs defaults to gzip)\n   *\n   * **Static-runtime toolsets (`>= 1.0.0`):** `\"gzip\"` and `\"zstd\"` are forwarded\n   * directly. `\"xz\"` is mapped to `\"zstd\"` (nearest supported equivalent). `null`\n   * or unset falls through to the root-level `compression` option:\n   * - `\"store\"` → `\"gzip\"`\n   * - `\"normal\"` / `\"maximum\"` / unset → `\"zstd\"`\n   */\n  readonly compression?: \"gzip\" | \"xz\" | \"zstd\" | null\n}\n\nexport interface FlatpakOptions extends CommonLinuxOptions, TargetSpecificOptions {\n  /**\n   * The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants). Only plain text is supported.\n   */\n  readonly license?: string | null\n\n  /**\n   * The name of the runtime that the application uses. Defaults to `org.freedesktop.Platform`.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly runtime?: string\n\n  /**\n   * The version of the runtime that the application uses. Defaults to `20.08`.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly runtimeVersion?: string\n\n  /**\n   * The name of the development runtime that the application builds with. Defaults to `org.freedesktop.Sdk`.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly sdk?: string\n\n  /**\n   * Start with the files from the specified application. This can be used to create applications that extend another application.\n   * Defaults to [org.electronjs.Electron2.BaseApp](https://github.com/flathub/org.electronjs.Electron2.BaseApp).\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly base?: string\n\n  /**\n   * Use this specific version of the application specified in base. Defaults to `20.08`.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly baseVersion?: string\n\n  /**\n   * The branch to use when exporting the application. Defaults to `master`.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly branch?: string\n\n  /**\n   * An array of arguments passed to the flatpak build-finish command. Defaults to:\n   * ```json\n   * [\n   *   // Wayland/X11 Rendering\n   *   \"--socket=wayland\",\n   *   \"--socket=x11\",\n   *   \"--share=ipc\",\n   *   // Open GL\n   *   \"--device=dri\",\n   *   // Audio output\n   *   \"--socket=pulseaudio\",\n   *   // Read/write home directory access\n   *   \"--filesystem=home\",\n   *   // Allow communication with network\n   *   \"--share=network\",\n   *   // System notifications with libnotify\n   *   \"--talk-name=org.freedesktop.Notifications\",\n   * ]\n   * ```\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly finishArgs?: string[]\n\n  /**\n   * An array of objects specifying the modules to be built in order.\n   *\n   * See [flatpak manifest documentation](https://docs.flatpak.org/en/latest/flatpak-builder-command-reference.html#flatpak-manifest).\n   */\n  readonly modules?: (string | any)[]\n\n  /**\n   * Files to copy directly into the app. Should be a list of [source, dest] tuples. Source should be a relative/absolute path to a file/directory to copy into the flatpak, and dest should be the path inside the app install prefix (e.g. /share/applications/).\n   *\n   * See [@malept/flatpak-bundler documentation](https://github.com/malept/flatpak-bundler#build-options).\n   */\n  readonly files?: [string, string][]\n\n  /**\n   * Symlinks to create in the app files. Should be a list of [target, location] symlink tuples. Target can be either a relative or absolute path inside the app install prefix, and location should be a absolute path inside the prefix to create the symlink at.\n   *\n   * See [@malept/flatpak-bundler documentation](https://github.com/malept/flatpak-bundler#build-options).\n   */\n  readonly symlinks?: [string, string][]\n\n  /**\n   * Whether to enable the Wayland specific flags (`--enable-features=UseOzonePlatform --ozone-platform=wayland`) in the wrapper script. These flags are only available starting with Electron version 12. Defaults to `false`.\n   */\n  readonly useWaylandFlags?: boolean\n}\n"]}

package/out/options/macOptions.d.ts

@@ -17,10 +17,14 @@ export interface MacConfiguration extends PlatformSpecificBuildOptions {
      */
     readonly target?: Array<MacOsTargetName | TargetConfiguration> | MacOsTargetName | TargetConfiguration | null;
     /**
-     * The name of certificate to use when signing. Consider using environment variables [CSC_LINK or CSC_NAME](https://www.electron.build/code-signing) instead of specifying this option.
+     * The signing identity (certificate name) to use when signing. Consider using environment variables [CSC_LINK or CSC_NAME](https://www.electron.build/code-signing) instead of specifying this option.
      * MAS installer identity is specified in the [mas](https://www.electron.build/mas).
      *
-     * Set to `-` to use an ad-hoc identity for signing. Set to `null` to skip signing entirely.
+     * - **Not set** (default): electron-builder searches the keychain for a valid signing certificate. If none is found, signing is skipped for all architectures — there is no automatic ad-hoc fallback.
+     * - **`null`**: skip signing entirely.
+     * - **`"-"`**: opt in to ad-hoc signing explicitly. Note that `hardenedRuntime: true` (the default) combined with ad-hoc signing requires
+     *   the [`com.apple.security.cs.disable-library-validation`](https://developer.apple.com/documentation/BundleResources/Entitlements/com.apple.security.cs.disable-library-validation)
+     *   entitlement to prevent app launch failures; otherwise set `hardenedRuntime: false`.
      */
     readonly identity?: string | null;
     /**
@@ -129,6 +133,12 @@ export interface MacConfiguration extends PlatformSpecificBuildOptions {
     readonly extraDistFiles?: Array<string> | string | null;
     /**
      * Whether your app has to be signed with hardened runtime.
+     *
+     * When using ad-hoc signing (`identity: "-"`), hardened runtime enforces library validation which
+     * will reject pre-signed Electron frameworks that carry a different Team ID. To resolve this either
+     * set `hardenedRuntime: false` or add the
+     * [`com.apple.security.cs.disable-library-validation`](https://developer.apple.com/documentation/BundleResources/Entitlements/com.apple.security.cs.disable-library-validation)
+     * entitlement to your entitlements file.
      * @default true
      */
     readonly hardenedRuntime?: boolean;

package/out/options/macOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"macOptions.js","sourceRoot":"","sources":["../../src/options/macOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { PlatformSpecificBuildOptions, TargetConfiguration, TargetSpecificOptions } from \"../index\"\nimport { CustomMacSign } from \"../macPackager\"\n\nexport type MacOsTargetName = \"default\" | \"dmg\" | \"mas\" | \"mas-dev\" | \"pkg\" | \"7z\" | \"zip\" | \"tar.xz\" | \"tar.lz\" | \"tar.gz\" | \"tar.bz2\" | \"dir\"\n\nexport interface MacConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The application category type, as shown in the Finder via *View -> Arrange by Application Category* when viewing the Applications directory.\n   *\n   * For example, `\"category\": \"public.app-category.developer-tools\"` will set the application category to *Developer Tools*.\n   *\n   * Valid values are listed in [Apple's documentation](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/LaunchServicesKeys.html#//apple_ref/doc/uid/TP40009250-SW8).\n   */\n  readonly category?: string | null\n\n  /**\n   * The target package type: list of `default`, `dmg`, `mas`, `mas-dev`, `pkg`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * Note: Squirrel.Mac auto update mechanism requires both `dmg` and `zip` to be enabled, even when only `dmg` is used. Disabling `zip` will break auto update in `dmg` packages.\n   * @default default (dmg and zip for Squirrel.Mac)\n   */\n  readonly target?: Array<MacOsTargetName | TargetConfiguration> | MacOsTargetName | TargetConfiguration | null\n\n  /**\n   * The name of certificate to use when signing. Consider using environment variables [CSC_LINK or CSC_NAME](https://www.electron.build/code-signing) instead of specifying this option.\n   * MAS installer identity is specified in the [mas](https://www.electron.build/mas).\n   *\n   * Set to `-` to use an ad-hoc identity for signing. Set to `null` to skip signing entirely.\n   */\n  readonly identity?: string | null\n\n  /**\n   * The path to application icon.\n   * Accepts `.icns` (legacy) or `.icon` (Icon Composer asset).\n   * If a `.icon` asset is provided, it will be preferred and compiled to an asset catalog.\n   * @default build/icon.icns\n   */\n  readonly icon?: string | null\n\n  /**\n   * The path to entitlements file for signing the app. `build/entitlements.mac.plist` will be used if exists (it is a recommended way to set).\n   * MAS entitlements is specified in the [mas](https://www.electron.build/mas).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   * Be aware that your app may crash if the right entitlements are not set like `com.apple.security.cs.allow-jit` for example on arm64 builds with Electron 20+.\n   * See [Signing and Notarizing macOS Builds from the Electron documentation](https://www.electronjs.org/docs/latest/tutorial/code-signing#signing--notarizing-macos-builds) for more information.\n   */\n  readonly entitlements?: string | null\n\n  /**\n   * The path to child entitlements which inherit the security settings for signing frameworks and bundles of a distribution. `build/entitlements.mac.inherit.plist` will be used if exists (it is a recommended way to set).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   *\n   * This option only applies when signing with `entitlements` provided.\n   */\n  readonly entitlementsInherit?: string | null\n\n  /**\n   * Path to login helper entitlement file.\n   * When using App Sandbox, the the `com.apple.security.inherit` key that is normally in the inherited entitlements cannot be inherited since the login helper is a standalone executable.\n   * Defaults to the value provided for `entitlements`. This option only applies when signing with `entitlements` provided.\n   */\n  readonly entitlementsLoginHelper?: string | null\n\n  /**\n   * The path to the provisioning profile to use when signing, absolute or relative to the app root.\n   */\n  readonly provisioningProfile?: string | null\n\n  /**\n   * The `CFBundleVersion`. Do not use it unless [you need to](https://github.com/electron-userland/electron-builder/issues/565#issuecomment-230678643).\n   */\n  readonly bundleVersion?: string | null\n\n  /**\n   * The `CFBundleShortVersionString`. Do not use it unless you need to.\n   */\n  readonly bundleShortVersion?: string | null\n\n  /**\n   * Whether a dark mode is supported. If your app does have a dark mode, you can make your app follow the system-wide dark mode setting.\n   * @default false\n   */\n  readonly darkModeSupport?: boolean\n\n  /**\n   * The bundle identifier to use in the application helper's plist.\n   * @default ${appBundleIdentifier}.helper\n   */\n  readonly helperBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Renderer helper's plist.\n   * @default ${appBundleIdentifier}.helper.Renderer\n   */\n  readonly helperRendererBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Plugin helper's plist.\n   * @default ${appBundleIdentifier}.helper.Plugin\n   */\n  readonly helperPluginBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the GPU helper's plist.\n   * @default ${appBundleIdentifier}.helper.GPU\n   */\n  readonly helperGPUBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the EH helper's plist.\n   * @default ${appBundleIdentifier}.helper.EH\n   */\n  readonly helperEHBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the NP helper's plist.\n   * @default ${appBundleIdentifier}.helper.NP\n   */\n  readonly helperNPBundleId?: string | null\n\n  /**\n   * Whether to sign app for development or for distribution.\n   * @default distribution\n   */\n  readonly type?: \"distribution\" | \"development\" | null\n\n  /**\n   * The extra entries for `Info.plist`.\n   */\n  readonly extendInfo?: any\n\n  /**\n   * Paths of any extra binaries that need to be signed.\n   */\n  readonly binaries?: Array<string> | null\n\n  /**\n   * The minimum version of macOS required for the app to run. Corresponds to `LSMinimumSystemVersion`.\n   */\n  readonly minimumSystemVersion?: string | null\n\n  /**\n   * Path of [requirements file](https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/RequirementLang/RequirementLang.html) used in signing. Not applicable for MAS.\n   */\n  readonly requirements?: string | null\n\n  /** @private */\n  readonly cscInstallerLink?: string | null\n  /** @private */\n  readonly cscInstallerKeyPassword?: string | null\n\n  /**\n   * Extra files to put in archive. Not applicable for `tar.*`.\n   */\n  readonly extraDistFiles?: Array<string> | string | null\n\n  /**\n   * Whether your app has to be signed with hardened runtime.\n   * @default true\n   */\n  readonly hardenedRuntime?: boolean\n\n  /**\n   * Whether to let `@electron/osx-sign` validate the signing or not.\n   * @default false\n   */\n  readonly gatekeeperAssess?: boolean\n\n  /**\n   * Whether to let `@electron/osx-sign` verify the contents or not.\n   * @default true\n   */\n  readonly strictVerify?: boolean\n\n  /**\n   * Whether to enable entitlements automation from `@electron/osx-sign`.\n   * @default true\n   */\n  readonly preAutoEntitlements?: boolean\n\n  /**\n   * Regex or an array of regex's that signal skipping signing a file.\n   */\n  readonly signIgnore?: Array<string> | string | null\n\n  /**\n   * The custom function (or path to file or module id) to sign an app bundle.\n   */\n  readonly sign?: CustomMacSign | string | null\n\n  /**\n   * Specify the URL of the timestamp authority server\n   */\n  readonly timestamp?: string | null\n\n  /**\n   * Whether to merge ASAR files for different architectures or not.\n   *\n   * This option has no effect unless building for \"universal\" arch.\n   * @default true\n   */\n  readonly mergeASARs?: boolean\n\n  /**\n   * Minimatch pattern of paths that are allowed to be present in one of the\n   * ASAR files, but not in the other.\n   *\n   * This option has no effect unless building for \"universal\" arch and applies\n   * only if `mergeASARs` is `true`.\n   */\n  readonly singleArchFiles?: string | null\n\n  /**\n   * Minimatch pattern of paths that are allowed to be x64 binaries in both\n   * ASAR files\n   *\n   * This option has no effect unless building for \"universal\" arch and applies\n   * only if `mergeASARs` is `true`.\n   */\n  readonly x64ArchFiles?: string | null\n\n  /**\n   * Array of strings specifying additional arguments to pass to the `codesign` command used to sign a specific file.\n   *\n   * Some subresources that you may include in your Electron app may need to be signed with --deep, this is not typically safe to apply to the entire Electron app and therefore should be applied to just your file.\n   * Usage Example: `['--deep']`\n   */\n  readonly additionalArguments?: Array<string> | null\n\n  /**\n   * Whether to disable electron-builder's [@electron/notarize](https://github.com/electron/notarize) integration.\n   *\n   * Note: In order to activate the notarization step You MUST specify one of the following via environment variables:\n   *\n   * 1. `APPLE_API_KEY`, `APPLE_API_KEY_ID` and `APPLE_API_ISSUER`.\n   * 2. `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, and `APPLE_TEAM_ID`\n   * 3. `APPLE_KEYCHAIN` and `APPLE_KEYCHAIN_PROFILE`\n   *\n   * For security reasons it is recommended to use the first option (see https://github.com/electron-userland/electron-builder/issues/7859)\n   */\n  readonly notarize?: boolean\n}\n\nexport interface DmgOptions extends TargetSpecificOptions {\n  /**\n   * The path to background image (default: `build/background.tiff` or `build/background.png` if exists). The resolution of this file determines the resolution of the installer window.\n   * If background is not specified, use `window.size`. Default locations expected background size to be 540x380.\n   * @see [DMG with Retina background support](http://stackoverflow.com/a/11204769/1910191).\n   */\n  background?: string | null\n\n  /**\n   * The background color (accepts css colors). Used when no background image is set.\n   * @default #ffffff\n   */\n  backgroundColor?: string | null\n\n  /**\n   * The path to DMG icon (badge icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   */\n  badgeIcon?: string | null\n\n  /**\n   * The path to DMG icon (volume icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   * Defaults to the application icon (`build/icon.icns`).\n   */\n  icon?: string | null\n\n  /**\n   * The size of all the icons inside the DMG.\n   * @default 80\n   */\n  readonly iconSize?: number | null\n\n  /**\n   * The size of all the icon texts inside the DMG.\n   * @default 12\n   */\n  readonly iconTextSize?: number | null\n\n  /**\n   * The title of the produced DMG, which will be shown when mounted (volume name).\n   *\n   * Macro `${productName}`, `${version}` and `${name}` are supported.\n   * @default ${productName} ${version}\n   */\n  readonly title?: string | null\n\n  /**\n   * The content — to customize icon locations. The x and y coordinates refer to the position of the **center** of the icon (at 1x scale), and do not take the label into account.\n   */\n  contents?: Array<DmgContent>\n\n  /**\n   * The disk image format. `ULFO` (lzfse-compressed image (OS X 10.11+ only)).\n   * @default UDZO\n   */\n  format?: \"UDRW\" | \"UDRO\" | \"UDCO\" | \"UDZO\" | \"UDBZ\" | \"ULFO\"\n\n  /**\n   * The filesystem for the DMG volume (e.g. `\"APFS\"` or `\"HFS+\"`)\n   * This will be changed to APFS in the next major release, so it is recommended to set it explicitly to HFS+ if you want to keep using HFS+ (e.g. for better compatibility with older macOS versions).\n   * @default HFS+\n   */\n  readonly filesystem?: \"HFS+\" | \"APFS\" | null\n\n  /**\n   * The initial size of the DMG filesystem. Accepts the same syntax as the `-size` argument to `hdiutil`, e.g. `\"150m\"`, `\"4g\"`.\n   * If not specified, the size is calculated automatically.\n   * Set this explicitly for large apps or apps with sparse files to avoid \"No space left on device\" errors.\n   */\n  readonly size?: string | null\n\n  /**\n   * Whether to shrink the DMG filesystem to the minimum size after copying files.\n   * Set to `false` to preserve the explicit `size` you specified.\n   * @default true\n   */\n  readonly shrink?: boolean\n\n  /**\n   * The DMG window position and size. With y co-ordinates running from bottom to top.\n   *\n   * The Finder makes sure that the window will be on the user’s display, so if you want your window at the top left of the display you could use `\"x\": 0, \"y\": 100000` as the x, y co-ordinates.\n   * It is not to be possible to position the window relative to the [top left](https://github.com/electron-userland/electron-builder/issues/3990#issuecomment-512960957) or relative to the center of the user’s screen.\n   */\n  window?: DmgWindow\n\n  /**\n   * Whether to create internet-enabled disk image (when it is downloaded using a browser it will automatically decompress the image, put the application on the desktop, unmount and remove the disk image file).\n   * @default false\n   */\n  readonly internetEnabled?: boolean\n\n  /**\n   * Whether to sign the DMG or not. Signing is not required and will lead to unwanted errors in combination with notarization requirements.\n   * @default false\n   */\n  readonly sign?: boolean\n\n  /**\n   * License agreement to display when the DMG is mounted.\n   *\n   * Accepts a single file path (`.rtf`, `.txt`, or `.html`) used as the English/default license,\n   * or a language-code → file-path map for multi-language builds.\n   *\n   * When set, this takes precedence over the file-naming convention\n   * (`license_en.txt`, etc. in the build resources directory).\n   * Paths are resolved relative to the build resources directory or project root.\n   *\n   * @example Single language\n   * ```yaml\n   * dmg:\n   *   license: \"build/license.rtf\"\n   * ```\n   *\n   * @example Multi-language\n   * ```yaml\n   * dmg:\n   *   license:\n   *     en_US: \"build/license.rtf\"\n   *     de_DE: \"build/license_de.txt\"\n   *     ja_JP: \"build/license_ja.txt\"\n   * ```\n   *\n   * If not set, electron-builder scans the build resources directory for\n   * `license_LANG.{rtf,txt,html}` files automatically.\n   */\n  license?: string | Record<string, string> | null\n\n  /**\n   * @private\n   * @default true\n   */\n  writeUpdateInfo?: boolean\n}\n\nexport interface DmgWindow {\n  /**\n   * The X position relative to left of the screen.\n   * @default 400\n   */\n  x?: number\n\n  /**\n   * The Y position relative to bottom of the screen.\n   * @default 100\n   */\n  y?: number\n\n  /**\n   * The width. Defaults to background image width or 540.\n   */\n  width?: number\n\n  /**\n   * The height. Defaults to background image height or 380.\n   */\n  height?: number\n}\n\nexport interface DmgContent {\n  /**\n   * The device-independent pixel offset from the left of the window to the **center** of the icon.\n   */\n  x: number\n  /**\n   * The device-independent pixel offset from the top of the window to the **center** of the icon.\n   */\n  y: number\n  type?: \"link\" | \"file\" | \"dir\"\n\n  /**\n   * The name of the file within the DMG. Defaults to basename of `path`.\n   */\n  name?: string\n\n  /**\n   * The path of the file within the DMG.\n   */\n  path?: string\n}\n\nexport interface MasConfiguration extends MacConfiguration {\n  /**\n   * The path to entitlements file for signing the app. `build/entitlements.mas.plist` will be used if exists (it is a recommended way to set).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   * Be aware that your app may crash if the right entitlements are not set like `com.apple.security.cs.allow-jit` for example on arm64 builds with Electron 20+.\n   * See [Signing and Notarizing macOS Builds from the Electron documentation](https://www.electronjs.org/docs/latest/tutorial/code-signing#signing--notarizing-macos-builds) for more information.\n   */\n  readonly entitlements?: string | null\n\n  /**\n   * The path to child entitlements which inherit the security settings for signing frameworks and bundles of a distribution. `build/entitlements.mas.inherit.plist` will be used if exists (it is a recommended way to set).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   */\n  readonly entitlementsInherit?: string | null\n\n  /**\n   * Paths of any extra binaries that need to be signed.\n   */\n  readonly binaries?: Array<string> | null\n}\n"]}
+{"version":3,"file":"macOptions.js","sourceRoot":"","sources":["../../src/options/macOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { PlatformSpecificBuildOptions, TargetConfiguration, TargetSpecificOptions } from \"../index\"\nimport { CustomMacSign } from \"../macPackager\"\n\nexport type MacOsTargetName = \"default\" | \"dmg\" | \"mas\" | \"mas-dev\" | \"pkg\" | \"7z\" | \"zip\" | \"tar.xz\" | \"tar.lz\" | \"tar.gz\" | \"tar.bz2\" | \"dir\"\n\nexport interface MacConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The application category type, as shown in the Finder via *View -> Arrange by Application Category* when viewing the Applications directory.\n   *\n   * For example, `\"category\": \"public.app-category.developer-tools\"` will set the application category to *Developer Tools*.\n   *\n   * Valid values are listed in [Apple's documentation](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/LaunchServicesKeys.html#//apple_ref/doc/uid/TP40009250-SW8).\n   */\n  readonly category?: string | null\n\n  /**\n   * The target package type: list of `default`, `dmg`, `mas`, `mas-dev`, `pkg`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * Note: Squirrel.Mac auto update mechanism requires both `dmg` and `zip` to be enabled, even when only `dmg` is used. Disabling `zip` will break auto update in `dmg` packages.\n   * @default default (dmg and zip for Squirrel.Mac)\n   */\n  readonly target?: Array<MacOsTargetName | TargetConfiguration> | MacOsTargetName | TargetConfiguration | null\n\n  /**\n   * The signing identity (certificate name) to use when signing. Consider using environment variables [CSC_LINK or CSC_NAME](https://www.electron.build/code-signing) instead of specifying this option.\n   * MAS installer identity is specified in the [mas](https://www.electron.build/mas).\n   *\n   * - **Not set** (default): electron-builder searches the keychain for a valid signing certificate. If none is found, signing is skipped for all architectures — there is no automatic ad-hoc fallback.\n   * - **`null`**: skip signing entirely.\n   * - **`\"-\"`**: opt in to ad-hoc signing explicitly. Note that `hardenedRuntime: true` (the default) combined with ad-hoc signing requires\n   *   the [`com.apple.security.cs.disable-library-validation`](https://developer.apple.com/documentation/BundleResources/Entitlements/com.apple.security.cs.disable-library-validation)\n   *   entitlement to prevent app launch failures; otherwise set `hardenedRuntime: false`.\n   */\n  readonly identity?: string | null\n\n  /**\n   * The path to application icon.\n   * Accepts `.icns` (legacy) or `.icon` (Icon Composer asset).\n   * If a `.icon` asset is provided, it will be preferred and compiled to an asset catalog.\n   * @default build/icon.icns\n   */\n  readonly icon?: string | null\n\n  /**\n   * The path to entitlements file for signing the app. `build/entitlements.mac.plist` will be used if exists (it is a recommended way to set).\n   * MAS entitlements is specified in the [mas](https://www.electron.build/mas).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   * Be aware that your app may crash if the right entitlements are not set like `com.apple.security.cs.allow-jit` for example on arm64 builds with Electron 20+.\n   * See [Signing and Notarizing macOS Builds from the Electron documentation](https://www.electronjs.org/docs/latest/tutorial/code-signing#signing--notarizing-macos-builds) for more information.\n   */\n  readonly entitlements?: string | null\n\n  /**\n   * The path to child entitlements which inherit the security settings for signing frameworks and bundles of a distribution. `build/entitlements.mac.inherit.plist` will be used if exists (it is a recommended way to set).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   *\n   * This option only applies when signing with `entitlements` provided.\n   */\n  readonly entitlementsInherit?: string | null\n\n  /**\n   * Path to login helper entitlement file.\n   * When using App Sandbox, the the `com.apple.security.inherit` key that is normally in the inherited entitlements cannot be inherited since the login helper is a standalone executable.\n   * Defaults to the value provided for `entitlements`. This option only applies when signing with `entitlements` provided.\n   */\n  readonly entitlementsLoginHelper?: string | null\n\n  /**\n   * The path to the provisioning profile to use when signing, absolute or relative to the app root.\n   */\n  readonly provisioningProfile?: string | null\n\n  /**\n   * The `CFBundleVersion`. Do not use it unless [you need to](https://github.com/electron-userland/electron-builder/issues/565#issuecomment-230678643).\n   */\n  readonly bundleVersion?: string | null\n\n  /**\n   * The `CFBundleShortVersionString`. Do not use it unless you need to.\n   */\n  readonly bundleShortVersion?: string | null\n\n  /**\n   * Whether a dark mode is supported. If your app does have a dark mode, you can make your app follow the system-wide dark mode setting.\n   * @default false\n   */\n  readonly darkModeSupport?: boolean\n\n  /**\n   * The bundle identifier to use in the application helper's plist.\n   * @default ${appBundleIdentifier}.helper\n   */\n  readonly helperBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Renderer helper's plist.\n   * @default ${appBundleIdentifier}.helper.Renderer\n   */\n  readonly helperRendererBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Plugin helper's plist.\n   * @default ${appBundleIdentifier}.helper.Plugin\n   */\n  readonly helperPluginBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the GPU helper's plist.\n   * @default ${appBundleIdentifier}.helper.GPU\n   */\n  readonly helperGPUBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the EH helper's plist.\n   * @default ${appBundleIdentifier}.helper.EH\n   */\n  readonly helperEHBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the NP helper's plist.\n   * @default ${appBundleIdentifier}.helper.NP\n   */\n  readonly helperNPBundleId?: string | null\n\n  /**\n   * Whether to sign app for development or for distribution.\n   * @default distribution\n   */\n  readonly type?: \"distribution\" | \"development\" | null\n\n  /**\n   * The extra entries for `Info.plist`.\n   */\n  readonly extendInfo?: any\n\n  /**\n   * Paths of any extra binaries that need to be signed.\n   */\n  readonly binaries?: Array<string> | null\n\n  /**\n   * The minimum version of macOS required for the app to run. Corresponds to `LSMinimumSystemVersion`.\n   */\n  readonly minimumSystemVersion?: string | null\n\n  /**\n   * Path of [requirements file](https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/RequirementLang/RequirementLang.html) used in signing. Not applicable for MAS.\n   */\n  readonly requirements?: string | null\n\n  /** @private */\n  readonly cscInstallerLink?: string | null\n  /** @private */\n  readonly cscInstallerKeyPassword?: string | null\n\n  /**\n   * Extra files to put in archive. Not applicable for `tar.*`.\n   */\n  readonly extraDistFiles?: Array<string> | string | null\n\n  /**\n   * Whether your app has to be signed with hardened runtime.\n   *\n   * When using ad-hoc signing (`identity: \"-\"`), hardened runtime enforces library validation which\n   * will reject pre-signed Electron frameworks that carry a different Team ID. To resolve this either\n   * set `hardenedRuntime: false` or add the\n   * [`com.apple.security.cs.disable-library-validation`](https://developer.apple.com/documentation/BundleResources/Entitlements/com.apple.security.cs.disable-library-validation)\n   * entitlement to your entitlements file.\n   * @default true\n   */\n  readonly hardenedRuntime?: boolean\n\n  /**\n   * Whether to let `@electron/osx-sign` validate the signing or not.\n   * @default false\n   */\n  readonly gatekeeperAssess?: boolean\n\n  /**\n   * Whether to let `@electron/osx-sign` verify the contents or not.\n   * @default true\n   */\n  readonly strictVerify?: boolean\n\n  /**\n   * Whether to enable entitlements automation from `@electron/osx-sign`.\n   * @default true\n   */\n  readonly preAutoEntitlements?: boolean\n\n  /**\n   * Regex or an array of regex's that signal skipping signing a file.\n   */\n  readonly signIgnore?: Array<string> | string | null\n\n  /**\n   * The custom function (or path to file or module id) to sign an app bundle.\n   */\n  readonly sign?: CustomMacSign | string | null\n\n  /**\n   * Specify the URL of the timestamp authority server\n   */\n  readonly timestamp?: string | null\n\n  /**\n   * Whether to merge ASAR files for different architectures or not.\n   *\n   * This option has no effect unless building for \"universal\" arch.\n   * @default true\n   */\n  readonly mergeASARs?: boolean\n\n  /**\n   * Minimatch pattern of paths that are allowed to be present in one of the\n   * ASAR files, but not in the other.\n   *\n   * This option has no effect unless building for \"universal\" arch and applies\n   * only if `mergeASARs` is `true`.\n   */\n  readonly singleArchFiles?: string | null\n\n  /**\n   * Minimatch pattern of paths that are allowed to be x64 binaries in both\n   * ASAR files\n   *\n   * This option has no effect unless building for \"universal\" arch and applies\n   * only if `mergeASARs` is `true`.\n   */\n  readonly x64ArchFiles?: string | null\n\n  /**\n   * Array of strings specifying additional arguments to pass to the `codesign` command used to sign a specific file.\n   *\n   * Some subresources that you may include in your Electron app may need to be signed with --deep, this is not typically safe to apply to the entire Electron app and therefore should be applied to just your file.\n   * Usage Example: `['--deep']`\n   */\n  readonly additionalArguments?: Array<string> | null\n\n  /**\n   * Whether to disable electron-builder's [@electron/notarize](https://github.com/electron/notarize) integration.\n   *\n   * Note: In order to activate the notarization step You MUST specify one of the following via environment variables:\n   *\n   * 1. `APPLE_API_KEY`, `APPLE_API_KEY_ID` and `APPLE_API_ISSUER`.\n   * 2. `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, and `APPLE_TEAM_ID`\n   * 3. `APPLE_KEYCHAIN` and `APPLE_KEYCHAIN_PROFILE`\n   *\n   * For security reasons it is recommended to use the first option (see https://github.com/electron-userland/electron-builder/issues/7859)\n   */\n  readonly notarize?: boolean\n}\n\nexport interface DmgOptions extends TargetSpecificOptions {\n  /**\n   * The path to background image (default: `build/background.tiff` or `build/background.png` if exists). The resolution of this file determines the resolution of the installer window.\n   * If background is not specified, use `window.size`. Default locations expected background size to be 540x380.\n   * @see [DMG with Retina background support](http://stackoverflow.com/a/11204769/1910191).\n   */\n  background?: string | null\n\n  /**\n   * The background color (accepts css colors). Used when no background image is set.\n   * @default #ffffff\n   */\n  backgroundColor?: string | null\n\n  /**\n   * The path to DMG icon (badge icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   */\n  badgeIcon?: string | null\n\n  /**\n   * The path to DMG icon (volume icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   * Defaults to the application icon (`build/icon.icns`).\n   */\n  icon?: string | null\n\n  /**\n   * The size of all the icons inside the DMG.\n   * @default 80\n   */\n  readonly iconSize?: number | null\n\n  /**\n   * The size of all the icon texts inside the DMG.\n   * @default 12\n   */\n  readonly iconTextSize?: number | null\n\n  /**\n   * The title of the produced DMG, which will be shown when mounted (volume name).\n   *\n   * Macro `${productName}`, `${version}` and `${name}` are supported.\n   * @default ${productName} ${version}\n   */\n  readonly title?: string | null\n\n  /**\n   * The content — to customize icon locations. The x and y coordinates refer to the position of the **center** of the icon (at 1x scale), and do not take the label into account.\n   */\n  contents?: Array<DmgContent>\n\n  /**\n   * The disk image format. `ULFO` (lzfse-compressed image (OS X 10.11+ only)).\n   * @default UDZO\n   */\n  format?: \"UDRW\" | \"UDRO\" | \"UDCO\" | \"UDZO\" | \"UDBZ\" | \"ULFO\"\n\n  /**\n   * The filesystem for the DMG volume (e.g. `\"APFS\"` or `\"HFS+\"`)\n   * This will be changed to APFS in the next major release, so it is recommended to set it explicitly to HFS+ if you want to keep using HFS+ (e.g. for better compatibility with older macOS versions).\n   * @default HFS+\n   */\n  readonly filesystem?: \"HFS+\" | \"APFS\" | null\n\n  /**\n   * The initial size of the DMG filesystem. Accepts the same syntax as the `-size` argument to `hdiutil`, e.g. `\"150m\"`, `\"4g\"`.\n   * If not specified, the size is calculated automatically.\n   * Set this explicitly for large apps or apps with sparse files to avoid \"No space left on device\" errors.\n   */\n  readonly size?: string | null\n\n  /**\n   * Whether to shrink the DMG filesystem to the minimum size after copying files.\n   * Set to `false` to preserve the explicit `size` you specified.\n   * @default true\n   */\n  readonly shrink?: boolean\n\n  /**\n   * The DMG window position and size. With y co-ordinates running from bottom to top.\n   *\n   * The Finder makes sure that the window will be on the user’s display, so if you want your window at the top left of the display you could use `\"x\": 0, \"y\": 100000` as the x, y co-ordinates.\n   * It is not to be possible to position the window relative to the [top left](https://github.com/electron-userland/electron-builder/issues/3990#issuecomment-512960957) or relative to the center of the user’s screen.\n   */\n  window?: DmgWindow\n\n  /**\n   * Whether to create internet-enabled disk image (when it is downloaded using a browser it will automatically decompress the image, put the application on the desktop, unmount and remove the disk image file).\n   * @default false\n   */\n  readonly internetEnabled?: boolean\n\n  /**\n   * Whether to sign the DMG or not. Signing is not required and will lead to unwanted errors in combination with notarization requirements.\n   * @default false\n   */\n  readonly sign?: boolean\n\n  /**\n   * License agreement to display when the DMG is mounted.\n   *\n   * Accepts a single file path (`.rtf`, `.txt`, or `.html`) used as the English/default license,\n   * or a language-code → file-path map for multi-language builds.\n   *\n   * When set, this takes precedence over the file-naming convention\n   * (`license_en.txt`, etc. in the build resources directory).\n   * Paths are resolved relative to the build resources directory or project root.\n   *\n   * @example Single language\n   * ```yaml\n   * dmg:\n   *   license: \"build/license.rtf\"\n   * ```\n   *\n   * @example Multi-language\n   * ```yaml\n   * dmg:\n   *   license:\n   *     en_US: \"build/license.rtf\"\n   *     de_DE: \"build/license_de.txt\"\n   *     ja_JP: \"build/license_ja.txt\"\n   * ```\n   *\n   * If not set, electron-builder scans the build resources directory for\n   * `license_LANG.{rtf,txt,html}` files automatically.\n   */\n  license?: string | Record<string, string> | null\n\n  /**\n   * @private\n   * @default true\n   */\n  writeUpdateInfo?: boolean\n}\n\nexport interface DmgWindow {\n  /**\n   * The X position relative to left of the screen.\n   * @default 400\n   */\n  x?: number\n\n  /**\n   * The Y position relative to bottom of the screen.\n   * @default 100\n   */\n  y?: number\n\n  /**\n   * The width. Defaults to background image width or 540.\n   */\n  width?: number\n\n  /**\n   * The height. Defaults to background image height or 380.\n   */\n  height?: number\n}\n\nexport interface DmgContent {\n  /**\n   * The device-independent pixel offset from the left of the window to the **center** of the icon.\n   */\n  x: number\n  /**\n   * The device-independent pixel offset from the top of the window to the **center** of the icon.\n   */\n  y: number\n  type?: \"link\" | \"file\" | \"dir\"\n\n  /**\n   * The name of the file within the DMG. Defaults to basename of `path`.\n   */\n  name?: string\n\n  /**\n   * The path of the file within the DMG.\n   */\n  path?: string\n}\n\nexport interface MasConfiguration extends MacConfiguration {\n  /**\n   * The path to entitlements file for signing the app. `build/entitlements.mas.plist` will be used if exists (it is a recommended way to set).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   * Be aware that your app may crash if the right entitlements are not set like `com.apple.security.cs.allow-jit` for example on arm64 builds with Electron 20+.\n   * See [Signing and Notarizing macOS Builds from the Electron documentation](https://www.electronjs.org/docs/latest/tutorial/code-signing#signing--notarizing-macos-builds) for more information.\n   */\n  readonly entitlements?: string | null\n\n  /**\n   * The path to child entitlements which inherit the security settings for signing frameworks and bundles of a distribution. `build/entitlements.mas.inherit.plist` will be used if exists (it is a recommended way to set).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   */\n  readonly entitlementsInherit?: string | null\n\n  /**\n   * Paths of any extra binaries that need to be signed.\n   */\n  readonly binaries?: Array<string> | null\n}\n"]}