app-builder-lib 26.15.7 → 26.16.1

package/out/codeSign/macCodeSign.js

@@ -156,16 +156,18 @@ async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIK
     if (cscIKeyPassword != null) {
         cscPasswords.push(cscIKeyPassword);
     }
-    return await importCerts(keychainFile, certPaths, cscPasswords);
+    return await importCerts(keychainFile, certPaths, cscPasswords, keychainPassword);
 }
-async function importCerts(keychainFile, paths, keyPasswords) {
+async function importCerts(keychainFile, paths, keyPasswords, keychainPassword) {
     var _a;
     for (let i = 0; i < paths.length; i++) {
         const password = (_a = keyPasswords[i]) !== null && _a !== void 0 ? _a : "";
         await (0, builder_util_1.exec)("/usr/bin/security", ["import", paths[i], "-k", keychainFile, "-T", "/usr/bin/codesign", "-T", "/usr/bin/productbuild", "-P", password]);
         // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p
         // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996
-        await (0, builder_util_1.exec)("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]);
+        // `-k` expects the keychain's own unlock password (as used by create-keychain/unlock-keychain above),
+        // not the imported item's password used by `security import -P`.
+        await (0, builder_util_1.exec)("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", keychainPassword, keychainFile]);
     }
     return {
         keychainFile,

package/out/codeSign/macCodeSign.js.map

@@ -1 +1 @@
-{"version":3,"file":"macCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/macCodeSign.ts"],"names":[],"mappings":";;;AA4BA,sCA6BC;AAED,kCAqCC;AA+CD,wCAOC;AAED,wCA8CC;AAiBD,oBAOC;AAuGD,oCAeC;AAnVD,+CAAuK;AACvK,yDAAqD;AAErD,mCAAgD;AAChD,0CAAoC;AACpC,uCAA+B;AAC/B,2BAAoC;AACpC,6BAA4B;AAC5B,yCAAuC;AACvC,yCAA+D;AAC/D,yCAA8C;AAEjC,QAAA,wBAAwB,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,sCAAsC,EAAE,oCAAoC,CAAC,CAAA;AAe9K,SAAgB,aAAa,CAAC,WAAW,GAAG,IAAI;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAA,4BAAa,GAAE,EAAE,CAAC;QACpB,MAAM,iBAAiB,GACrB,kKAAkK;YAClK,6LAA6L,CAAA;QAE/L,IAAI,IAAA,wBAAS,EAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,IAAI,WAAW,EAAE,CAAC;gBAChB,kBAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,kBAAG,CAAC,IAAI,CACN,wEAAwE,GAAG,+DAA+D,GAAG,KAAK,iBAAiB,EAAE,CACtK,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,KAAc,EAAE,gBAA4B,EAAE,SAA2B,EAAE,YAA8B,EAAE,kBAA2B;IACtK,MAAM,SAAS,GAAW,EAAE,CAAA;IAC5B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE,CAAA;QACrB,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,IAAI,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,aACnE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sIACf,EAAE,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,IAAI,2CAA2C,CAAA;QAC/D,IAAI,CAAC,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACvC,SAAS,CAAC,2BAA2B,GAAG,KAAK,CAAA;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,GAAG,kFAAkF,CAAA;QACrG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;QAC3D,SAAS,CAAC,aAAa,GAAG,CAAC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;aAC9D,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,MAAM,WAAW,GAAG,wCAAwC,CAAA;IAC5D,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAM,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,kBAAG,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAED,sJAAsJ;AACtJ,+LAA+L;AAC/L,wDAAwD;AACxD,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,eAAI,CAAO,KAAK,IAAI,EAAE;IACzD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAA,uBAAW,EAAC,6BAA6B,CAAC,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAM;QACrC,iBAAiB,EAAE;QACnB,IAAA,uBAAQ,EAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,iBAAM,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KAC9I,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,OAAO,IAAA,8BAAe,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,YAAO,GAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,EAAE;SACC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,EAAE,CAAC,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC;SACD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAA;AACH,CAAC;AAWD,SAAgB,cAAc,CAAC,YAAoB,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,IAAA,6BAAc,EAAC,YAAY,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAyB;IACpI,sCAAsC;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,wBAAwB,CAAC,KAAK,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAA,WAAM,GAAE,EAAE,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACtK,oCAAoC;IAEpC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,gBAAgB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG;QACvB,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,uBAAuB,EAAE,YAAY,CAAC;KACxC,CAAA;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,2LAA2L;QAC3L,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,4BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1G,8BAA8B;QAC9B,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;KACrI,CAAC,CAAA;IACF,MAAM,YAAY,GAAkB,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAoB,EAAE,YAA2B;;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAA,YAAY,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAA;QACtC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEnJ,6HAA6H;QAC7H,2FAA2F;QAC3F,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAC7H,CAAC;IAED,OAAO;QACL,YAAY;KACb,CAAA;AACH,CAAC;AAEM,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,6BAAa,EAAsC,oBAAoB,CAAC,CAAA;IACpG,OAAO,IAAA,oBAAK,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAEU,QAAA,qBAAqB,GAAkC,IAAI,CAAA;AAEtE,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IACxD,SAAS,WAAW,CAAC,IAAmB;QACtC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,GAAG,6BAAqB,CAAA;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAgB;YAClC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACxE,EAAE;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,EAAE,CAAC,EAAE;gBACX,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CACL;YACD,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACvH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACX,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;iBAChB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBACb,MAAM,CACL,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CACvK;gBACD,YAAY;iBACX,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,6BAAqB,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAyB,EAAE,QAAwB;IAC9F,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,6BAA6B;QAC7B,mEAAmE;QACnE,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,SAAQ;YACV,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,SAAS,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AASD,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACnD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,IAAA,6BAAa,EAA8D,6CAA6C,CAAC,CAAA;IACnK,OAAO,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACtC,CAAC;AAED,SAAgB,YAAY,CAAC,QAAkB,EAAE,SAAyB,EAAE,QAAwB;IAClG,IAAI,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAChD,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,wCAAyB,CAAC,yBAAyB,MAAM,kFAAkF,CAAC,CAAA;IACxJ,CAAC;AACH,CAAC","sourcesContent":["import type { SignOptions } from \"@electron/osx-sign/dist/cjs/types\"\nimport { copyFile, exec, Fields, InvalidConfigurationError, isEmptyOrSpaces, isEnvTrue, isPullRequest, log, Logger, retry, TmpDir, unlinkIfExists } from \"builder-util\"\nimport { dynamicImport } from \"../util/dynamicImport\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { createHash, randomBytes } from \"crypto\"\nimport { rename } from \"fs/promises\"\nimport { Lazy } from \"lazy-val\"\nimport { homedir, tmpdir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { isAutoDiscoveryCodeSignIdentity } from \"../util/flags\"\nimport { importCertificate } from \"./codesign\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType =\n  | \"Developer ID Application\"\n  | \"Developer ID Installer\"\n  | \"3rd Party Mac Developer Application\"\n  | \"3rd Party Mac Developer Installer\"\n  | \"Mac Developer\"\n  | \"Apple Development\"\n  | \"Apple Distribution\"\n\nexport interface CodeSigningInfo {\n  keychainFile?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n  if (process.platform !== \"darwin\") {\n    if (isPrintWarn) {\n      log.warn({ reason: \"supported only on macOS\" }, \"skipped macOS application code signing\")\n    }\n    return false\n  }\n\n  if (isPullRequest()) {\n    const buildForPrWarning =\n      \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n      \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n    if (isEnvTrue(process.env.CSC_FOR_PULL_REQUEST)) {\n      if (isPrintWarn) {\n        log.warn(buildForPrWarning)\n      }\n    } else {\n      if (isPrintWarn) {\n        // https://github.com/electron-userland/electron-builder/issues/1524\n        log.warn(\n          \"Current build is a part of pull request, code signing will be skipped.\" + \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" + `\\n${buildForPrWarning}`\n        )\n      }\n      return false\n    }\n  }\n\n  return true\n}\n\nexport async function reportError(isMas: boolean, certificateTypes: CertType[], qualifier: string | Nullish, keychainFile: string | Nullish, isForceCodeSigning: boolean) {\n  const logFields: Fields = {}\n  if (qualifier == null) {\n    logFields.reason = \"\"\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      logFields.reason += `cannot find valid \"${certificateTypes.join(\", \")}\" identity${\n        isMas ? \"\" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`\n      }`\n    }\n    logFields.reason += \", see https://electron.build/code-signing\"\n    if (!isAutoDiscoveryCodeSignIdentity()) {\n      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n    }\n  } else {\n    logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n    logFields.identity = qualifier\n  }\n\n  const args = [\"find-identity\"]\n  if (keychainFile != null) {\n    args.push(keychainFile)\n  }\n\n  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n    logFields.allIdentities = (await exec(\"/usr/bin/security\", args))\n      .trim()\n      .split(\"\\n\")\n      .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n      .join(\"\\n\")\n  }\n\n  const skipMessage = \"skipped macOS application code signing\"\n  if (isMas || isForceCodeSigning) {\n    throw new Error(Logger.createMessage(skipMessage, logFields, \"error\", it => it))\n  } else {\n    log.warn(logFields, skipMessage)\n  }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n  // copy to temp and then atomic rename to final path\n  const cacheDir = getCacheDirectory()\n  const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n  const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n  const results = await Promise.all<any>([\n    listUserKeychains(),\n    copyFile(path.join(__dirname, \"..\", \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),\n  ])\n  const list = results[0]\n  if (!list.includes(keychainPath)) {\n    await exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n  }\n})\n\nfunction getCacheDirectory(): string {\n  const env = process.env.ELECTRON_BUILDER_CACHE\n  return isEmptyOrSpaces(env) ? path.join(homedir(), \"Library\", \"Caches\", \"electron-builder\") : path.resolve(env)\n}\n\nfunction listUserKeychains(): Promise<Array<string>> {\n  return exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\"]).then(it =>\n    it\n      .split(\"\\n\")\n      .map(it => {\n        const r = it.trim()\n        return r.substring(1, r.length - 1)\n      })\n      .filter(it => it.length > 0)\n  )\n}\n\nexport interface CreateKeychainOptions {\n  tmpDir: TmpDir\n  cscLink: string\n  cscKeyPassword: string\n  cscILink?: string | null\n  cscIKeyPassword?: string | null\n  currentDir: string\n}\n\nexport function removeKeychain(keychainFile: string, printWarn = true): Promise<any> {\n  return exec(\"/usr/bin/security\", [\"delete-keychain\", keychainFile]).catch((e: any) => {\n    if (printWarn) {\n      log.warn({ file: keychainFile, error: e.stack || e }, \"cannot delete keychain\")\n    }\n    return unlinkIfExists(keychainFile)\n  })\n}\n\nexport async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }: CreateKeychainOptions): Promise<CodeSigningInfo> {\n  // travis has correct AppleWWDRCA cert\n  if (process.env.TRAVIS !== \"true\") {\n    await bundledCertKeychainAdded.value\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/3685\n  // use constant file\n  const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash(\"sha256\").update(currentDir).update(\"app-builder\").digest(\"hex\")}.keychain`)\n  // noinspection JSUnusedLocalSymbols\n\n  await removeKeychain(keychainFile, false).catch(_ => {\n    /* ignore*/\n  })\n\n  const certLinks = [cscLink]\n  if (cscILink != null) {\n    certLinks.push(cscILink)\n  }\n\n  const certPaths = new Array(certLinks.length)\n  const keychainPassword = randomBytes(32).toString(\"base64\")\n  const securityCommands = [\n    [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"set-keychain-settings\", keychainFile],\n  ]\n\n  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n  // https://github.com/electron-userland/electron-builder/issues/1457\n  const list = await listUserKeychains()\n  if (!list.includes(keychainFile)) {\n    securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n  }\n\n  await Promise.all([\n    // we do not clear downloaded files - will be removed on tmpDir cleanup automatically. not a security issue since in any case data is available as env variables and protected by password.\n    ...certLinks.map((link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))),\n    // queue each security command\n    securityCommands.reduce((promise, cmd) => promise.then(() => exec(\"/usr/bin/security\", cmd)), new Promise(resolve => resolve(null))),\n  ])\n  const cscPasswords: Array<string> = [cscKeyPassword]\n  if (cscIKeyPassword != null) {\n    cscPasswords.push(cscIKeyPassword)\n  }\n  return await importCerts(keychainFile, certPaths, cscPasswords)\n}\n\nasync function importCerts(keychainFile: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {\n  for (let i = 0; i < paths.length; i++) {\n    const password = keyPasswords[i] ?? \"\"\n    await exec(\"/usr/bin/security\", [\"import\", paths[i], \"-k\", keychainFile, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n    await exec(\"/usr/bin/security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", password, keychainFile])\n  }\n\n  return {\n    keychainFile,\n  }\n}\n\nexport async function sign(opts: SignOptions): Promise<void> {\n  const { signAsync } = await dynamicImport<typeof import(\"@electron/osx-sign\")>(\"@electron/osx-sign\")\n  return retry(() => signAsync(opts), {\n    retries: 3,\n    interval: 5000,\n    backoff: 5000,\n  })\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n  function addKeychain(args: Array<string>) {\n    if (keychain != null) {\n      args.push(keychain)\n    }\n    return args\n  }\n\n  let result = findIdentityRawResult\n  if (result == null || keychain != null) {\n    // https://github.com/electron-userland/electron-builder/issues/481\n    // https://github.com/electron-userland/electron-builder/issues/535\n    result = Promise.all<Array<string>>([\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\"])).then(it =>\n        it\n          .trim()\n          .split(\"\\n\")\n          .filter(it => {\n            for (const prefix of appleCertificatePrefixes) {\n              if (it.includes(prefix)) {\n                return true\n              }\n            }\n            return false\n          })\n      ),\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"])).then(it => it.trim().split(\"\\n\")),\n    ]).then(it => {\n      const array = it[0]\n        .concat(it[1])\n        .filter(\n          it => !it.includes(\"(Missing required extension)\") && !it.includes(\"valid identities found\") && !it.includes(\"iPhone \") && !it.includes(\"com.apple.idms.appleid.prd.\")\n        )\n        // remove 1)\n        .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n      return Array.from(new Set(array))\n    })\n\n    if (keychain == null) {\n      findIdentityRawResult = result\n    }\n  }\n  return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  // https://github.com/electron-userland/electron-builder/issues/484\n  //noinspection SpellCheckingInspection\n  const lines = await getValidIdentities(keychain)\n  const namePrefix = `${type}:`\n  for (const line of lines) {\n    if (qualifier != null && !line.includes(qualifier)) {\n      continue\n    }\n\n    if (line.includes(namePrefix)) {\n      return await parseIdentity(line)\n    }\n  }\n\n  if (type === \"Developer ID Application\") {\n    // find non-Apple certificate\n    // https://github.com/electron-userland/electron-builder/issues/458\n    l: for (const line of lines) {\n      if (qualifier != null && !line.includes(qualifier)) {\n        continue\n      }\n\n      if (line.includes(\"Mac Developer:\")) {\n        continue\n      }\n\n      for (const prefix of appleCertificatePrefixes) {\n        if (line.includes(prefix)) {\n          continue l\n        }\n      }\n\n      return await parseIdentity(line)\n    }\n  }\n  return null\n}\n\nexport declare class Identity {\n  readonly name: string\n  readonly hash?: string\n\n  constructor(name: string, hash?: string)\n}\n\nasync function parseIdentity(line: string): Promise<Identity> {\n  const firstQuoteIndex = line.indexOf('\"')\n  const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n  const hash = line.substring(0, firstQuoteIndex - 1)\n  const { Identity: IdentityClass } = await dynamicImport<{ Identity: new (name: string, hash?: string) => Identity }>(\"@electron/osx-sign/dist/cjs/util-identities\")\n  return new IdentityClass(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  let identity = qualifier || process.env.CSC_NAME\n  if (isEmptyOrSpaces(identity)) {\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      return _findIdentity(certType, null, keychain)\n    } else {\n      return Promise.resolve(null)\n    }\n  } else {\n    identity = identity.trim()\n    for (const prefix of appleCertificatePrefixes) {\n      checkPrefix(identity, prefix)\n    }\n    return _findIdentity(certType, identity, keychain)\n  }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n  if (name.startsWith(prefix)) {\n    throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n  }\n}\n"]}
+{"version":3,"file":"macCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/macCodeSign.ts"],"names":[],"mappings":";;;AA4BA,sCA6BC;AAED,kCAqCC;AA+CD,wCAOC;AAED,wCA8CC;AAmBD,oBAOC;AAuGD,oCAeC;AArVD,+CAAuK;AACvK,yDAAqD;AAErD,mCAAgD;AAChD,0CAAoC;AACpC,uCAA+B;AAC/B,2BAAoC;AACpC,6BAA4B;AAC5B,yCAAuC;AACvC,yCAA+D;AAC/D,yCAA8C;AAEjC,QAAA,wBAAwB,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,sCAAsC,EAAE,oCAAoC,CAAC,CAAA;AAe9K,SAAgB,aAAa,CAAC,WAAW,GAAG,IAAI;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAA,4BAAa,GAAE,EAAE,CAAC;QACpB,MAAM,iBAAiB,GACrB,kKAAkK;YAClK,6LAA6L,CAAA;QAE/L,IAAI,IAAA,wBAAS,EAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,IAAI,WAAW,EAAE,CAAC;gBAChB,kBAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,kBAAG,CAAC,IAAI,CACN,wEAAwE,GAAG,+DAA+D,GAAG,KAAK,iBAAiB,EAAE,CACtK,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,KAAc,EAAE,gBAA4B,EAAE,SAA2B,EAAE,YAA8B,EAAE,kBAA2B;IACtK,MAAM,SAAS,GAAW,EAAE,CAAA;IAC5B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE,CAAA;QACrB,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,IAAI,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,aACnE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sIACf,EAAE,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,IAAI,2CAA2C,CAAA;QAC/D,IAAI,CAAC,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACvC,SAAS,CAAC,2BAA2B,GAAG,KAAK,CAAA;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,GAAG,kFAAkF,CAAA;QACrG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;QAC3D,SAAS,CAAC,aAAa,GAAG,CAAC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;aAC9D,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,MAAM,WAAW,GAAG,wCAAwC,CAAA;IAC5D,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAM,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,kBAAG,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAED,sJAAsJ;AACtJ,+LAA+L;AAC/L,wDAAwD;AACxD,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,eAAI,CAAO,KAAK,IAAI,EAAE;IACzD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAA,uBAAW,EAAC,6BAA6B,CAAC,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAM;QACrC,iBAAiB,EAAE;QACnB,IAAA,uBAAQ,EAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,iBAAM,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KAC9I,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,OAAO,IAAA,8BAAe,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,YAAO,GAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,EAAE;SACC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,EAAE,CAAC,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC;SACD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAA;AACH,CAAC;AAWD,SAAgB,cAAc,CAAC,YAAoB,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,IAAA,6BAAc,EAAC,YAAY,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAyB;IACpI,sCAAsC;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,wBAAwB,CAAC,KAAK,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAA,WAAM,GAAE,EAAE,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACtK,oCAAoC;IAEpC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,gBAAgB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG;QACvB,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,uBAAuB,EAAE,YAAY,CAAC;KACxC,CAAA;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,2LAA2L;QAC3L,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,4BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1G,8BAA8B;QAC9B,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;KACrI,CAAC,CAAA;IACF,MAAM,YAAY,GAAkB,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAA;AACnF,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAoB,EAAE,YAA2B,EAAE,gBAAwB;;IAC1H,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAA,YAAY,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAA;QACtC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEnJ,6HAA6H;QAC7H,2FAA2F;QAC3F,sGAAsG;QACtG,iEAAiE;QACjE,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAA;IACrI,CAAC;IAED,OAAO;QACL,YAAY;KACb,CAAA;AACH,CAAC;AAEM,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,6BAAa,EAAsC,oBAAoB,CAAC,CAAA;IACpG,OAAO,IAAA,oBAAK,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAEU,QAAA,qBAAqB,GAAkC,IAAI,CAAA;AAEtE,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IACxD,SAAS,WAAW,CAAC,IAAmB;QACtC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,GAAG,6BAAqB,CAAA;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAgB;YAClC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACxE,EAAE;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,EAAE,CAAC,EAAE;gBACX,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CACL;YACD,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACvH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACX,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;iBAChB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBACb,MAAM,CACL,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CACvK;gBACD,YAAY;iBACX,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,6BAAqB,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAyB,EAAE,QAAwB;IAC9F,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,6BAA6B;QAC7B,mEAAmE;QACnE,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,SAAQ;YACV,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,SAAS,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AASD,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACnD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,IAAA,6BAAa,EAA8D,6CAA6C,CAAC,CAAA;IACnK,OAAO,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACtC,CAAC;AAED,SAAgB,YAAY,CAAC,QAAkB,EAAE,SAAyB,EAAE,QAAwB;IAClG,IAAI,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAChD,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,wCAAyB,CAAC,yBAAyB,MAAM,kFAAkF,CAAC,CAAA;IACxJ,CAAC;AACH,CAAC","sourcesContent":["import type { SignOptions } from \"@electron/osx-sign/dist/cjs/types\"\nimport { copyFile, exec, Fields, InvalidConfigurationError, isEmptyOrSpaces, isEnvTrue, isPullRequest, log, Logger, retry, TmpDir, unlinkIfExists } from \"builder-util\"\nimport { dynamicImport } from \"../util/dynamicImport\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { createHash, randomBytes } from \"crypto\"\nimport { rename } from \"fs/promises\"\nimport { Lazy } from \"lazy-val\"\nimport { homedir, tmpdir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { isAutoDiscoveryCodeSignIdentity } from \"../util/flags\"\nimport { importCertificate } from \"./codesign\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType =\n  | \"Developer ID Application\"\n  | \"Developer ID Installer\"\n  | \"3rd Party Mac Developer Application\"\n  | \"3rd Party Mac Developer Installer\"\n  | \"Mac Developer\"\n  | \"Apple Development\"\n  | \"Apple Distribution\"\n\nexport interface CodeSigningInfo {\n  keychainFile?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n  if (process.platform !== \"darwin\") {\n    if (isPrintWarn) {\n      log.warn({ reason: \"supported only on macOS\" }, \"skipped macOS application code signing\")\n    }\n    return false\n  }\n\n  if (isPullRequest()) {\n    const buildForPrWarning =\n      \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n      \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n    if (isEnvTrue(process.env.CSC_FOR_PULL_REQUEST)) {\n      if (isPrintWarn) {\n        log.warn(buildForPrWarning)\n      }\n    } else {\n      if (isPrintWarn) {\n        // https://github.com/electron-userland/electron-builder/issues/1524\n        log.warn(\n          \"Current build is a part of pull request, code signing will be skipped.\" + \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" + `\\n${buildForPrWarning}`\n        )\n      }\n      return false\n    }\n  }\n\n  return true\n}\n\nexport async function reportError(isMas: boolean, certificateTypes: CertType[], qualifier: string | Nullish, keychainFile: string | Nullish, isForceCodeSigning: boolean) {\n  const logFields: Fields = {}\n  if (qualifier == null) {\n    logFields.reason = \"\"\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      logFields.reason += `cannot find valid \"${certificateTypes.join(\", \")}\" identity${\n        isMas ? \"\" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`\n      }`\n    }\n    logFields.reason += \", see https://electron.build/code-signing\"\n    if (!isAutoDiscoveryCodeSignIdentity()) {\n      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n    }\n  } else {\n    logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n    logFields.identity = qualifier\n  }\n\n  const args = [\"find-identity\"]\n  if (keychainFile != null) {\n    args.push(keychainFile)\n  }\n\n  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n    logFields.allIdentities = (await exec(\"/usr/bin/security\", args))\n      .trim()\n      .split(\"\\n\")\n      .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n      .join(\"\\n\")\n  }\n\n  const skipMessage = \"skipped macOS application code signing\"\n  if (isMas || isForceCodeSigning) {\n    throw new Error(Logger.createMessage(skipMessage, logFields, \"error\", it => it))\n  } else {\n    log.warn(logFields, skipMessage)\n  }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n  // copy to temp and then atomic rename to final path\n  const cacheDir = getCacheDirectory()\n  const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n  const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n  const results = await Promise.all<any>([\n    listUserKeychains(),\n    copyFile(path.join(__dirname, \"..\", \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),\n  ])\n  const list = results[0]\n  if (!list.includes(keychainPath)) {\n    await exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n  }\n})\n\nfunction getCacheDirectory(): string {\n  const env = process.env.ELECTRON_BUILDER_CACHE\n  return isEmptyOrSpaces(env) ? path.join(homedir(), \"Library\", \"Caches\", \"electron-builder\") : path.resolve(env)\n}\n\nfunction listUserKeychains(): Promise<Array<string>> {\n  return exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\"]).then(it =>\n    it\n      .split(\"\\n\")\n      .map(it => {\n        const r = it.trim()\n        return r.substring(1, r.length - 1)\n      })\n      .filter(it => it.length > 0)\n  )\n}\n\nexport interface CreateKeychainOptions {\n  tmpDir: TmpDir\n  cscLink: string\n  cscKeyPassword: string\n  cscILink?: string | null\n  cscIKeyPassword?: string | null\n  currentDir: string\n}\n\nexport function removeKeychain(keychainFile: string, printWarn = true): Promise<any> {\n  return exec(\"/usr/bin/security\", [\"delete-keychain\", keychainFile]).catch((e: any) => {\n    if (printWarn) {\n      log.warn({ file: keychainFile, error: e.stack || e }, \"cannot delete keychain\")\n    }\n    return unlinkIfExists(keychainFile)\n  })\n}\n\nexport async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }: CreateKeychainOptions): Promise<CodeSigningInfo> {\n  // travis has correct AppleWWDRCA cert\n  if (process.env.TRAVIS !== \"true\") {\n    await bundledCertKeychainAdded.value\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/3685\n  // use constant file\n  const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash(\"sha256\").update(currentDir).update(\"app-builder\").digest(\"hex\")}.keychain`)\n  // noinspection JSUnusedLocalSymbols\n\n  await removeKeychain(keychainFile, false).catch(_ => {\n    /* ignore*/\n  })\n\n  const certLinks = [cscLink]\n  if (cscILink != null) {\n    certLinks.push(cscILink)\n  }\n\n  const certPaths = new Array(certLinks.length)\n  const keychainPassword = randomBytes(32).toString(\"base64\")\n  const securityCommands = [\n    [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"set-keychain-settings\", keychainFile],\n  ]\n\n  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n  // https://github.com/electron-userland/electron-builder/issues/1457\n  const list = await listUserKeychains()\n  if (!list.includes(keychainFile)) {\n    securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n  }\n\n  await Promise.all([\n    // we do not clear downloaded files - will be removed on tmpDir cleanup automatically. not a security issue since in any case data is available as env variables and protected by password.\n    ...certLinks.map((link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))),\n    // queue each security command\n    securityCommands.reduce((promise, cmd) => promise.then(() => exec(\"/usr/bin/security\", cmd)), new Promise(resolve => resolve(null))),\n  ])\n  const cscPasswords: Array<string> = [cscKeyPassword]\n  if (cscIKeyPassword != null) {\n    cscPasswords.push(cscIKeyPassword)\n  }\n  return await importCerts(keychainFile, certPaths, cscPasswords, keychainPassword)\n}\n\nasync function importCerts(keychainFile: string, paths: Array<string>, keyPasswords: Array<string>, keychainPassword: string): Promise<CodeSigningInfo> {\n  for (let i = 0; i < paths.length; i++) {\n    const password = keyPasswords[i] ?? \"\"\n    await exec(\"/usr/bin/security\", [\"import\", paths[i], \"-k\", keychainFile, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n    // `-k` expects the keychain's own unlock password (as used by create-keychain/unlock-keychain above),\n    // not the imported item's password used by `security import -P`.\n    await exec(\"/usr/bin/security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", keychainPassword, keychainFile])\n  }\n\n  return {\n    keychainFile,\n  }\n}\n\nexport async function sign(opts: SignOptions): Promise<void> {\n  const { signAsync } = await dynamicImport<typeof import(\"@electron/osx-sign\")>(\"@electron/osx-sign\")\n  return retry(() => signAsync(opts), {\n    retries: 3,\n    interval: 5000,\n    backoff: 5000,\n  })\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n  function addKeychain(args: Array<string>) {\n    if (keychain != null) {\n      args.push(keychain)\n    }\n    return args\n  }\n\n  let result = findIdentityRawResult\n  if (result == null || keychain != null) {\n    // https://github.com/electron-userland/electron-builder/issues/481\n    // https://github.com/electron-userland/electron-builder/issues/535\n    result = Promise.all<Array<string>>([\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\"])).then(it =>\n        it\n          .trim()\n          .split(\"\\n\")\n          .filter(it => {\n            for (const prefix of appleCertificatePrefixes) {\n              if (it.includes(prefix)) {\n                return true\n              }\n            }\n            return false\n          })\n      ),\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"])).then(it => it.trim().split(\"\\n\")),\n    ]).then(it => {\n      const array = it[0]\n        .concat(it[1])\n        .filter(\n          it => !it.includes(\"(Missing required extension)\") && !it.includes(\"valid identities found\") && !it.includes(\"iPhone \") && !it.includes(\"com.apple.idms.appleid.prd.\")\n        )\n        // remove 1)\n        .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n      return Array.from(new Set(array))\n    })\n\n    if (keychain == null) {\n      findIdentityRawResult = result\n    }\n  }\n  return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  // https://github.com/electron-userland/electron-builder/issues/484\n  //noinspection SpellCheckingInspection\n  const lines = await getValidIdentities(keychain)\n  const namePrefix = `${type}:`\n  for (const line of lines) {\n    if (qualifier != null && !line.includes(qualifier)) {\n      continue\n    }\n\n    if (line.includes(namePrefix)) {\n      return await parseIdentity(line)\n    }\n  }\n\n  if (type === \"Developer ID Application\") {\n    // find non-Apple certificate\n    // https://github.com/electron-userland/electron-builder/issues/458\n    l: for (const line of lines) {\n      if (qualifier != null && !line.includes(qualifier)) {\n        continue\n      }\n\n      if (line.includes(\"Mac Developer:\")) {\n        continue\n      }\n\n      for (const prefix of appleCertificatePrefixes) {\n        if (line.includes(prefix)) {\n          continue l\n        }\n      }\n\n      return await parseIdentity(line)\n    }\n  }\n  return null\n}\n\nexport declare class Identity {\n  readonly name: string\n  readonly hash?: string\n\n  constructor(name: string, hash?: string)\n}\n\nasync function parseIdentity(line: string): Promise<Identity> {\n  const firstQuoteIndex = line.indexOf('\"')\n  const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n  const hash = line.substring(0, firstQuoteIndex - 1)\n  const { Identity: IdentityClass } = await dynamicImport<{ Identity: new (name: string, hash?: string) => Identity }>(\"@electron/osx-sign/dist/cjs/util-identities\")\n  return new IdentityClass(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  let identity = qualifier || process.env.CSC_NAME\n  if (isEmptyOrSpaces(identity)) {\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      return _findIdentity(certType, null, keychain)\n    } else {\n      return Promise.resolve(null)\n    }\n  } else {\n    identity = identity.trim()\n    for (const prefix of appleCertificatePrefixes) {\n      checkPrefix(identity, prefix)\n    }\n    return _findIdentity(certType, identity, keychain)\n  }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n  if (name.startsWith(prefix)) {\n    throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n  }\n}\n"]}

package/out/codeSign/windowsCodeSign.js

@@ -9,9 +9,6 @@ async function signWindows(options, packager) {
         }
         builder_util_1.log.info({ path: builder_util_1.log.filePath(options.path) }, "signing with Azure Trusted Signing");
     }
-    else {
-        builder_util_1.log.info({ path: builder_util_1.log.filePath(options.path) }, "signing with signtool.exe");
-    }
     const packageManager = await packager.signingManager.value;
     return signWithRetry(async () => packageManager.signFile(options));
 }

package/out/codeSign/windowsCodeSign.js.map

@@ -1 +1 @@
-{"version":3,"file":"windowsCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/windowsCodeSign.ts"],"names":[],"mappings":";;AASA,kCAWC;AApBD,+CAAyC;AASlC,KAAK,UAAU,WAAW,CAAC,OAA2B,EAAE,QAAqB;IAClF,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACpC,kBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,mFAAmF,CAAC,CAAA;QACrG,CAAC;QACD,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;IACtF,CAAC;SAAM,CAAC;QACN,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAA;IAC1D,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,MAA8B;IACnD,OAAO,IAAA,oBAAK,EAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;YACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;YACzB;YACE,oEAAoE;YACpE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAC,4BAA4B,CAAC;;gBAC/C,oEAAoE;gBACpE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAC,gCAAgC,CAAC,CAAA,EACnD,CAAC;gBACD,kBAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,sDAAsD,CAAC,CAAA;gBACpF,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { log, retry } from \"builder-util\"\nimport { WindowsConfiguration } from \"../options/winOptions\"\nimport { WinPackager } from \"../winPackager\"\n\nexport interface WindowsSignOptions {\n  readonly path: string\n  readonly options: WindowsConfiguration\n}\n\nexport async function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<boolean> {\n  if (options.options.azureSignOptions) {\n    if (options.options.signtoolOptions) {\n      log.warn(null, \"ignoring signtool options, using Azure Trusted Signing; please only configure one\")\n    }\n    log.info({ path: log.filePath(options.path) }, \"signing with Azure Trusted Signing\")\n  } else {\n    log.info({ path: log.filePath(options.path) }, \"signing with signtool.exe\")\n  }\n  const packageManager = await packager.signingManager.value\n  return signWithRetry(async () => packageManager.signFile(options))\n}\n\nfunction signWithRetry(signer: () => Promise<boolean>): Promise<boolean> {\n  return retry(signer, {\n    retries: 3,\n    interval: 1000,\n    backoff: 1000,\n    shouldRetry: (e: any) => {\n      const message = e.message\n      if (\n        // https://github.com/electron-userland/electron-builder/issues/1414\n        message?.includes(\"Couldn't resolve host name\") ||\n        // https://github.com/electron-userland/electron-builder/issues/8615\n        message?.includes(\"being used by another process.\")\n      ) {\n        log.warn({ error: message }, \"attempt to sign failed, another attempt will be made\")\n        return true\n      }\n      return false\n    },\n  })\n}\n"]}
+{"version":3,"file":"windowsCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/windowsCodeSign.ts"],"names":[],"mappings":";;AASA,kCASC;AAlBD,+CAAyC;AASlC,KAAK,UAAU,WAAW,CAAC,OAA2B,EAAE,QAAqB;IAClF,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACpC,kBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,mFAAmF,CAAC,CAAA;QACrG,CAAC;QACD,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;IACtF,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAA;IAC1D,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,MAA8B;IACnD,OAAO,IAAA,oBAAK,EAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;YACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;YACzB;YACE,oEAAoE;YACpE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAC,4BAA4B,CAAC;;gBAC/C,oEAAoE;gBACpE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAC,gCAAgC,CAAC,CAAA,EACnD,CAAC;gBACD,kBAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,sDAAsD,CAAC,CAAA;gBACpF,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { log, retry } from \"builder-util\"\nimport { WindowsConfiguration } from \"../options/winOptions\"\nimport { WinPackager } from \"../winPackager\"\n\nexport interface WindowsSignOptions {\n  readonly path: string\n  readonly options: WindowsConfiguration\n}\n\nexport async function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<boolean> {\n  if (options.options.azureSignOptions) {\n    if (options.options.signtoolOptions) {\n      log.warn(null, \"ignoring signtool options, using Azure Trusted Signing; please only configure one\")\n    }\n    log.info({ path: log.filePath(options.path) }, \"signing with Azure Trusted Signing\")\n  }\n  const packageManager = await packager.signingManager.value\n  return signWithRetry(async () => packageManager.signFile(options))\n}\n\nfunction signWithRetry(signer: () => Promise<boolean>): Promise<boolean> {\n  return retry(signer, {\n    retries: 3,\n    interval: 1000,\n    backoff: 1000,\n    shouldRetry: (e: any) => {\n      const message = e.message\n      if (\n        // https://github.com/electron-userland/electron-builder/issues/1414\n        message?.includes(\"Couldn't resolve host name\") ||\n        // https://github.com/electron-userland/electron-builder/issues/8615\n        message?.includes(\"being used by another process.\")\n      ) {\n        log.warn({ error: message }, \"attempt to sign failed, another attempt will be made\")\n        return true\n      }\n      return false\n    },\n  })\n}\n"]}

package/out/codeSign/windowsSignToolManager.js

@@ -132,6 +132,9 @@ class WindowsSignToolManager {
         const customSign = await (0, resolve_1.resolveFunction)(this.packager.appInfo.type, (_b = options.options.signtoolOptions) === null || _b === void 0 ? void 0 : _b.sign, "sign", await this.packager.info.getWorkspaceRoot());
         const cscInfo = await this.cscInfo.value;
         if (cscInfo) {
+            if (!customSign) {
+                builder_util_1.log.info({ path: builder_util_1.log.filePath(options.path) }, "signing with signtool.exe");
+            }
             let logInfo = {
                 file: builder_util_1.log.filePath(options.path),
             };
@@ -153,7 +156,7 @@ class WindowsSignToolManager {
             builder_util_1.log.info(logInfo, "signing");
         }
         else if (!customSign) {
-            builder_util_1.log.debug({ signHook: !!customSign, cscInfo }, "no signing info identified, signing is skipped");
+            builder_util_1.log.info({ path: builder_util_1.log.filePath(options.path) }, "no code signing certificate configured, signing is skipped");
             return false;
         }
         const executor = customSign || ((config, packager) => this.doSign(config, packager));

package/out/codeSign/windowsSignToolManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"windowsSignToolManager.js","sourceRoot":"","sources":["../../src/codeSign/windowsSignToolManager.ts"],"names":[],"mappings":";;;AAAA,+CAA6E;AAC7E,+DAAwD;AACxD,uCAAiC;AACjC,uCAA+B;AAC/B,6BAA4B;AAG5B,sDAA8C;AAC9C,iDAAqD;AAErD,6CAAiD;AACjD,yCAAyC;AACzC,iCAAoC;AAEpC,yCAA8C;AAgD9C,MAAa,sBAAsB;IAGjC,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAIzC,0BAAqB,GAAG,IAAI,eAAI,CAAuB,KAAK,IAAI,EAAE;;YACzE,MAAM,aAAa,GAAG,MAAA,IAAI,CAAC,4BAA4B,CAAC,eAAe,0CAAE,aAAa,CAAA;YACtF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAA;YACb,CAAC;iBAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACjC,OAAO,IAAA,sBAAO,EAAC,aAAa,CAAC,CAAA;YAC/B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;YAC9C,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEO,iBAAY,GAAG,IAAI,+BAAQ,CAClC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAClB,KAAK,EAAC,GAAG,EAAC,EAAE;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAA;gBAChD,OAAO;oBACL,UAAU,EAAE,IAAA,8BAAO,EAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAE;oBACxD,wBAAwB;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAA;YAC5B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;QAChE,CAAC,CACF,CAAA;QAEQ,YAAO,GAAG,IAAI,+BAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,4BAA4B,EACvC,4BAA4B,CAAC,EAAE;;YAC7B,MAAM,WAAW,GAAG,MAAA,4BAA4B,CAAC,eAAe,0CAAE,sBAAsB,CAAA;YACxF,MAAM,OAAO,GAAG,MAAA,4BAA4B,CAAC,eAAe,0CAAE,eAAe,CAAA;YAC7E,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK;qBAC1B,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;qBAC9E,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;;oBAChB,kEAAkE;oBAClE,IAAI,CAAA,MAAA,4BAA4B,CAAC,eAAe,0CAAE,IAAI,KAAI,IAAI,EAAE,CAAC;wBAC/D,MAAM,CAAC,CAAA;oBACT,CAAC;yBAAM,CAAC;wBACN,kBAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAA;wBAC5D,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC,CAAC,CAAA;YACN,CAAC;YAED,MAAM,eAAe,GAAG,MAAA,4BAA4B,CAAC,eAAe,0CAAE,eAAe,CAAA;YACrF,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;gBAC5B,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAA;gBAC1D,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE;iBAC1E,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;YACxD,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACtC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC9B,CAAC;YAED,OAAO,CACL,IAAA,4BAAiB,EAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;gBACrF,cAAc;iBACb,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;gBAChB,IAAI,CAAC,YAAY,wCAAyB,EAAE,CAAC;oBAC3C,MAAM,IAAI,wCAAyB,CAAC,oDAAoD,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;gBACtG,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,CAAA;gBACT,CAAC;YACH,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,EAAE;gBACX,OAAO;oBACL,IAAI,EAAE,IAAI;oBACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;iBACzC,CAAA;YACH,CAAC,CAAC,CACL,CAAA;QACH,CAAC,CACF,CAAA;QA1FC,IAAI,CAAC,4BAA4B,GAAG,QAAQ,CAAC,4BAA4B,CAAA;IAC3E,CAAC;IA2FD,UAAU;QACR,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,aAAqB;QAC9D,IAAI,MAAM,YAAY,oBAAU,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACvE,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,oBAAoB,CAAC,CAAA;YACtE,OAAO,aAAa,IAAI,OAAO,CAAA;QACjC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;QAC9C,MAAM,SAAS,GAAG,aAAa,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAA;QAChG,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA2B;;QACxC,IAAI,MAAM,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,qBAAqB,CAAA;QACnE,oCAAoC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC3E,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAA;QAE5D,MAAM,UAAU,GAAG,MAAM,IAAA,yBAAe,EAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAEhK,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QACxC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,GAAQ;gBACjB,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,CAAA;YACD,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACtB,OAAO,GAAG;oBACR,GAAG,OAAO;oBACV,eAAe,EAAE,OAAO,CAAC,IAAI;iBAC9B,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,GAAG,OAAO;oBACV,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,IAAI,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;iBACrE,CAAA;YACH,CAAC;YACD,kBAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC9B,CAAC;aAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACvB,kBAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,gDAAgD,CAAC,CAAA;YAChG,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,CAAC,MAA0C,EAAE,QAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrI,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,iBAAiB,GAAiC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzG,MAAM,OAAO,CAAC,OAAO,CACnB,QAAQ,CACN;gBACE,GAAG,iBAAiB;gBACpB,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC;aACjF,EACD,IAAI,CAAC,QAAQ,CACd,CACF,CAAA;YACD,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,iBAAiB,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC;gBAC/C,MAAM,IAAA,iBAAM,EAAC,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,QAAgB;QAC9C,MAAM,kBAAkB,GAAG,4GAA4G,CAAA;QACvI,IAAI,CAAC;YACH,OAAO,MAAM,IAAA,uBAAY,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,wCAAyB,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mBAAmB,CAAC,OAAqC,EAAE,KAAc,EAAE,KAAgB,IAAI,cAAS,EAAE;QACxG,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACrG,CAAC;IAEO,sBAAsB,CAAC,OAAqC,EAAE,EAAa;;QACjF,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAErB,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAEnC,MAAM,YAAY,GAAG,SAAS;gBAC5B,CAAC,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,sBAAsB,KAAI,+BAA+B;gBAC5F,CAAC,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,eAAe,KAAI,+BAA+B,CAAA;YACvF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACzB,CAAC;QAED,cAAc;QACd,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAEhD,iBAAiB;QACjB,MAAM,eAAe,GAAG,CAAA,MAAA,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,0CAAE,WAAW,MAAK,OAAO,IAAI,CAAA,MAAA,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,0CAAE,WAAW,KAAI,IAAI,CAAA;QACpI,IAAI,eAAe,EAAE,CAAC;YACpB,kEAAkE;YAClE,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;oBACpD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAC5C,6DAA6D;YAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACrG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAElD,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC,eAAe;QAEpC,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,uBAAuB,CAAC,OAAqC,EAAE,EAAa;;QAClF,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAA;QAErC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QAE3D,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,YAAY,GAAG,CAAA,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,eAAe,KAAI,+BAA+B,CAAA;YACxG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QAC/B,CAAC;QAED,cAAc;QACd,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEjD,iBAAiB;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAE3C,sBAAsB;QACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEnD,gBAAgB;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;QAC1C,IAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC7B,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,kBAAkB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc;QAClH,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAA;QACjI,CAAC;QACD,MAAM,eAAe,GAAI,OAAO,CAAC,OAA+B,CAAC,IAAI,CAAA;QAErE,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,wCAAwC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;YACrF,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAmC,CAAA;YAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,mBAAmB;YACnB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;YACnD,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;YACnE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,2CAA2C,eAAe,iBAAiB,CAAC,CAAA;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc;;QACpH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAC,OAAO,CAAC,OAA+B,0CAAE,QAAQ,CAAA;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC7C,CAAC;QAED,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,yBAAyB,CAAA;QACjF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAAY;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,GAAG,SAAS,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,OAA6B,EAAE,EAAa;;QAC5E,MAAM,sBAAsB,GAAG,MAAA,OAAO,CAAC,eAAe,0CAAE,sBAAsB,CAAA;QAC9E,MAAM,eAAe,GAAG,MAAA,MAAA,OAAO,CAAC,eAAe,0CAAE,eAAe,0CAAE,WAAW,EAAE,CAAA;QAE/E,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;YAClC,YAAY;YACZ,iBAAiB;YACjB,UAAU;YACV,oIAAoI;SACrI,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,sBAAO,EAAW,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACvF,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAChC,IACE,CAAC,sBAAsB,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;gBACtF,CAAC,eAAe,IAAI,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAClF,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAA;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACpE,kBAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAC/E,oEAAoE;YACpE,MAAM,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;YAC5E,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAA;YAC1D,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK;gBACL,mBAAmB;aACpB,CAAA;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,sBAAsB,IAAI,eAAe,gBAAgB,SAAS,EAAE,CAAC,CAAA;IAClH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;;QACpD,OAAO,IAAA,yBAAe,EAAC,MAAA,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,0CAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IAC3E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAiD,EAAE,QAAqB;;QACnF,kEAAkE;QAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAuB,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACnF,mCAAmC;QACnC,IAAI,IAAmB,CAAA;QACvB,IAAI,EAAa,CAAA;QACjB,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,OAAQ,CAAC,CAAA,CAAC,mDAAmD;QACvJ,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAA,yBAAe,EAAC,MAAA,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,0CAAE,WAAW,EAAE,KAAK,CAAC,CAAA;QACzF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;YAC5B,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAC3D,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,IAAI,cAAS,EAAE,CAAA;YACpB,IAAI,GAAG,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;QAED,MAAM,IAAA,oBAAK,EAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE;YACpG,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;gBACtB,IACE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2CAA2C,CAAC;oBAC/D,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,4DAA4D,CAAC;oBAChF,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,6DAA6D,CAAC,EACjF,CAAC;oBACD,kBAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACjG,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;CACF;AAtZD,wDAsZC","sourcesContent":["import { asArray, InvalidConfigurationError, log, retry } from \"builder-util\"\nimport { MemoLazy, parseDn } from \"builder-util-runtime\"\nimport { rename } from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../core\"\nimport { WindowsConfiguration } from \"../options/winOptions\"\nimport AppXTarget from \"../targets/AppxTarget\"\nimport { getSignToolPath } from \"../toolsets/windows\"\nimport { ToolInfo } from \"../util/bundledTool\"\nimport { resolveFunction } from \"../util/resolve\"\nimport { readCertInfo } from \"./certInfo\"\nimport { VmManager } from \"../vm/vm\"\nimport { WinPackager } from \"../winPackager\"\nimport { importCertificate } from \"./codesign\"\nimport { SignManager } from \"./signManager\"\nimport { WindowsSignOptions } from \"./windowsCodeSign\"\n\nexport type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>\n\nexport interface WindowsSignToolOptions extends WindowsSignOptions {\n  readonly name: string\n  readonly site: string | null\n}\n\nexport interface FileCodeSigningInfo {\n  readonly file: string\n  readonly password: string | null\n}\n\nexport interface WindowsSignTaskConfiguration extends WindowsSignToolOptions {\n  readonly cscInfo: FileCodeSigningInfo | CertificateFromStoreInfo | null\n\n  // set if output path differs from input (e.g. osslsigncode cannot sign file in-place)\n  resultOutputPath?: string\n\n  hash: string\n  isNest: boolean\n}\n\nexport interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {\n  computeSignToolArgs(isWin: boolean): Array<string>\n}\n\nexport interface CertificateInfo {\n  readonly commonName: string\n  readonly bloodyMicrosoftSubjectDn: string\n}\n\nexport interface CertificateFromStoreInfo {\n  thumbprint: string\n  subject: string\n  store: string\n  isLocalMachineStore: boolean\n}\n\ninterface CertInfo {\n  Subject: string\n  Thumbprint: string\n  PSParentPath: string\n}\n\nexport class WindowsSignToolManager implements SignManager {\n  private readonly platformSpecificBuildOptions: WindowsConfiguration\n\n  constructor(private readonly packager: WinPackager) {\n    this.platformSpecificBuildOptions = packager.platformSpecificBuildOptions\n  }\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(async () => {\n    const publisherName = this.platformSpecificBuildOptions.signtoolOptions?.publisherName\n    if (publisherName === null) {\n      return null\n    } else if (publisherName != null) {\n      return asArray(publisherName)\n    }\n\n    const certInfo = await this.lazyCertInfo.value\n    return certInfo == null ? null : [certInfo.commonName]\n  })\n\n  readonly lazyCertInfo = new MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>(\n    () => this.cscInfo,\n    async csc => {\n      const cscInfo = await csc.value\n      if (cscInfo == null) {\n        return null\n      }\n\n      if (\"subject\" in cscInfo) {\n        const bloodyMicrosoftSubjectDn = cscInfo.subject\n        return {\n          commonName: parseDn(bloodyMicrosoftSubjectDn).get(\"CN\")!,\n          bloodyMicrosoftSubjectDn,\n        }\n      }\n\n      const cscFile = cscInfo.file\n      if (cscFile == null) {\n        return null\n      }\n      return await this.getCertInfo(cscFile, cscInfo.password || \"\")\n    }\n  )\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.platformSpecificBuildOptions,\n    platformSpecificBuildOptions => {\n      const subjectName = platformSpecificBuildOptions.signtoolOptions?.certificateSubjectName\n      const shaType = platformSpecificBuildOptions.signtoolOptions?.certificateSha1\n      if (subjectName != null || shaType != null) {\n        return this.packager.vm.value\n          .then(vm => this.getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))\n          .catch((e: any) => {\n            // https://github.com/electron-userland/electron-builder/pull/2397\n            if (platformSpecificBuildOptions.signtoolOptions?.sign == null) {\n              throw e\n            } else {\n              log.debug({ error: e }, \"getCertificateFromStoreInfo error\")\n              return null\n            }\n          })\n      }\n\n      const certificateFile = platformSpecificBuildOptions.signtoolOptions?.certificateFile\n      if (certificateFile != null) {\n        const certificatePassword = this.packager.getCscPassword()\n        return Promise.resolve({\n          file: certificateFile,\n          password: certificatePassword == null ? null : certificatePassword.trim(),\n        })\n      }\n\n      const cscLink = this.packager.getCscLink(\"WIN_CSC_LINK\")\n      if (cscLink == null || cscLink === \"\") {\n        return Promise.resolve(null)\n      }\n\n      return (\n        importCertificate(cscLink, this.packager.info.tempDirManager, this.packager.projectDir)\n          // before then\n          .catch((e: any) => {\n            if (e instanceof InvalidConfigurationError) {\n              throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)\n            } else {\n              throw e\n            }\n          })\n          .then(path => {\n            return {\n              file: path,\n              password: this.packager.getCscPassword(),\n            }\n          })\n      )\n    }\n  )\n\n  initialize(): Promise<void> {\n    return Promise.resolve()\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/2108#issuecomment-333200711\n  async computePublisherName(target: Target, publisherName: string) {\n    if (target instanceof AppXTarget && (await this.cscInfo.value) == null) {\n      log.info({ reason: \"Windows Store only build\" }, \"AppX is not signed\")\n      return publisherName || \"CN=ms\"\n    }\n\n    const certInfo = await this.lazyCertInfo.value\n    const publisher = publisherName || (certInfo == null ? null : certInfo.bloodyMicrosoftSubjectDn)\n    if (publisher == null) {\n      throw new Error(\"Internal error: cannot compute subject using certificate info\")\n    }\n    return publisher\n  }\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    let hashes = options.options.signtoolOptions?.signingHashAlgorithms\n    // msi does not support dual-signing\n    if (options.path.endsWith(\".msi\")) {\n      hashes = [hashes != null && !hashes.includes(\"sha1\") ? \"sha256\" : \"sha1\"]\n    } else if (options.path.endsWith(\".appx\")) {\n      hashes = [\"sha256\"]\n    } else if (hashes == null) {\n      hashes = [\"sha1\", \"sha256\"]\n    } else {\n      hashes = Array.isArray(hashes) ? hashes : [hashes]\n    }\n\n    const name = this.packager.appInfo.productName\n    const site = await this.packager.appInfo.computePackageUrl()\n\n    const customSign = await resolveFunction(this.packager.appInfo.type, options.options.signtoolOptions?.sign, \"sign\", await this.packager.info.getWorkspaceRoot())\n\n    const cscInfo = await this.cscInfo.value\n    if (cscInfo) {\n      let logInfo: any = {\n        file: log.filePath(options.path),\n      }\n      if (\"file\" in cscInfo) {\n        logInfo = {\n          ...logInfo,\n          certificateFile: cscInfo.file,\n        }\n      } else {\n        logInfo = {\n          ...logInfo,\n          subject: cscInfo.subject,\n          thumbprint: cscInfo.thumbprint,\n          store: cscInfo.store,\n          user: cscInfo.isLocalMachineStore ? \"local machine\" : \"current user\",\n        }\n      }\n      log.info(logInfo, \"signing\")\n    } else if (!customSign) {\n      log.debug({ signHook: !!customSign, cscInfo }, \"no signing info identified, signing is skipped\")\n      return false\n    }\n\n    const executor = customSign || ((config: CustomWindowsSignTaskConfiguration, packager: WinPackager) => this.doSign(config, packager))\n    let isNest = false\n    for (const hash of hashes) {\n      const taskConfiguration: WindowsSignTaskConfiguration = { ...options, name, site, cscInfo, hash, isNest }\n      await Promise.resolve(\n        executor(\n          {\n            ...taskConfiguration,\n            computeSignToolArgs: isWin => this.computeSignToolArgs(taskConfiguration, isWin),\n          },\n          this.packager\n        )\n      )\n      isNest = true\n      if (taskConfiguration.resultOutputPath != null) {\n        await rename(taskConfiguration.resultOutputPath, options.path)\n      }\n    }\n\n    return true\n  }\n\n  async getCertInfo(file: string, password: string): Promise<CertificateInfo> {\n    const errorMessagePrefix = \"Cannot extract publisher name from code signing certificate. As workaround, set win.publisherName. Error: \"\n    try {\n      return await readCertInfo(file, password)\n    } catch (e: any) {\n      throw new InvalidConfigurationError(`${errorMessagePrefix}${e.message || e}`)\n    }\n  }\n\n  // on windows be aware of http://stackoverflow.com/a/32640183/1910191\n  computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm: VmManager = new VmManager()): Array<string> {\n    return isWin ? this.computeWindowsSignArgs(options, vm) : this.computeOsslsigncodeArgs(options, vm)\n  }\n\n  private computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const inputFile = vm.toVmFile(options.path)\n    const args = [\"sign\"]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const isRfc3161 = options.isNest || options.hash === \"sha256\"\n      args.push(isRfc3161 ? \"/tr\" : \"/t\")\n\n      const timestampUrl = isRfc3161\n        ? options.options.signtoolOptions?.rfc3161TimeStampServer || \"http://timestamp.digicert.com\"\n        : options.options.signtoolOptions?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(timestampUrl)\n    }\n\n    // Certificate\n    this.addCertificateArgs(args, options, vm, true)\n\n    // Hash algorithm\n    const isLegacyToolset = this.packager.config.toolsets?.winCodeSign === \"0.0.0\" || this.packager.config.toolsets?.winCodeSign == null\n    if (isLegacyToolset) {\n      // Legacy || v0.0.0: Only add /fd for non-SHA1 (original behavior)\n      if (options.hash !== \"sha1\") {\n        args.push(\"/fd\", options.hash)\n        if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n          args.push(\"/td\", \"sha256\")\n        }\n      }\n    } else {\n      // Modern: Always add /fd (required by new Windows Kits)\n      args.push(\"/fd\", options.hash.toLowerCase())\n      // Only add /td for RFC3161 timestamps (incompatible with /t)\n      if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\" && (options.isNest || options.hash === \"sha256\")) {\n        args.push(\"/td\", \"sha256\")\n      }\n    }\n\n    // Optional parameters\n    this.addCommonSigningArgs(args, options, vm, true)\n\n    // Windows-specific\n    args.push(\"/debug\")\n    args.push(inputFile) // Must be last\n\n    return args\n  }\n\n  private computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const inputFile = vm.toVmFile(options.path)\n    const outputPath = this.getOutputPath(inputFile, options.hash)\n    options.resultOutputPath = outputPath\n\n    const args = [\"sign\", \"-in\", inputFile, \"-out\", outputPath]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const timestampUrl = options.options.signtoolOptions?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(\"-t\", timestampUrl)\n    }\n\n    // Certificate\n    this.addCertificateArgs(args, options, vm, false)\n\n    // Hash algorithm\n    args.push(\"-h\", options.hash.toLowerCase())\n\n    // Optional parameters\n    this.addCommonSigningArgs(args, options, vm, false)\n\n    // Proxy support\n    const httpsProxy = process.env.HTTPS_PROXY\n    if (httpsProxy?.length) {\n      args.push(\"-p\", httpsProxy)\n    }\n\n    return args\n  }\n\n  private addCertificateArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean): void {\n    if (options.cscInfo == null) {\n      throw new Error(\"No code signing certificate configured. Provide certificateFile, certificateSha1, or certificateSubjectName.\")\n    }\n    const certificateFile = (options.cscInfo as FileCodeSigningInfo).file\n\n    if (certificateFile == null) {\n      // Certificate from store (Windows only)\n      if (!isWin) {\n        throw new Error(\"certificateSha1/certificateSubjectName supported only on Windows\")\n      }\n\n      const cscInfo = options.cscInfo as CertificateFromStoreInfo\n      args.push(\"/sha1\", cscInfo.thumbprint)\n      args.push(\"/s\", cscInfo.store)\n      if (cscInfo.isLocalMachineStore) {\n        args.push(\"/sm\")\n      }\n    } else {\n      // Certificate file\n      const certExtension = path.extname(certificateFile)\n      if (certExtension === \".p12\" || certExtension === \".pfx\") {\n        args.push(isWin ? \"/f\" : \"-pkcs12\", vm.toVmFile(certificateFile))\n      } else {\n        throw new Error(`Please specify pkcs12 (.p12/.pfx) file, ${certificateFile} is not correct`)\n      }\n    }\n  }\n\n  private addCommonSigningArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean): void {\n    if (options.name) {\n      args.push(isWin ? \"/d\" : \"-n\", options.name)\n    }\n\n    if (options.site) {\n      args.push(isWin ? \"/du\" : \"-i\", options.site)\n    }\n\n    if (options.isNest) {\n      args.push(isWin ? \"/as\" : \"-nest\")\n    }\n\n    const password = (options.cscInfo as FileCodeSigningInfo)?.password\n    if (password) {\n      args.push(isWin ? \"/p\" : \"-pass\", password)\n    }\n\n    const additionalCert = options.options.signtoolOptions?.additionalCertificateFile\n    if (additionalCert) {\n      args.push(isWin ? \"/ac\" : \"-ac\", vm.toVmFile(additionalCert))\n    }\n  }\n\n  getOutputPath(inputPath: string, hash: string) {\n    const extension = path.extname(inputPath)\n    return path.join(path.dirname(inputPath), `${path.basename(inputPath, extension)}-signed-${hash}${extension}`)\n  }\n\n  async getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo> {\n    const certificateSubjectName = options.signtoolOptions?.certificateSubjectName\n    const certificateSha1 = options.signtoolOptions?.certificateSha1?.toUpperCase()\n\n    const ps = await vm.powershellCommand.value\n    const rawResult = await vm.exec(ps, [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-Command\",\n      \"Get-ChildItem -Recurse Cert: -CodeSigningCert | Select-Object -Property Subject,PSParentPath,Thumbprint | ConvertTo-Json -Compress\",\n    ])\n    const certList = rawResult.length === 0 ? [] : asArray<CertInfo>(JSON.parse(rawResult))\n    for (const certInfo of certList) {\n      if (\n        (certificateSubjectName != null && !certInfo.Subject.includes(certificateSubjectName)) ||\n        (certificateSha1 != null && certInfo.Thumbprint.toUpperCase() !== certificateSha1)\n      ) {\n        continue\n      }\n\n      const parentPath = certInfo.PSParentPath\n      const store = parentPath.substring(parentPath.lastIndexOf(\"\\\\\") + 1)\n      log.debug({ store, PSParentPath: parentPath }, \"auto-detect certificate store\")\n      // https://github.com/electron-userland/electron-builder/issues/1717\n      const isLocalMachineStore = parentPath.includes(\"Certificate::LocalMachine\")\n      log.debug(null, \"auto-detect using of LocalMachine store\")\n      return {\n        thumbprint: certInfo.Thumbprint,\n        subject: certInfo.Subject,\n        store,\n        isLocalMachineStore,\n      }\n    }\n\n    throw new Error(`Cannot find certificate ${certificateSubjectName || certificateSha1}, all certs: ${rawResult}`)\n  }\n\n  async getToolPath(isWin = process.platform === \"win32\"): Promise<ToolInfo> {\n    return getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin)\n  }\n\n  async doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager) {\n    // https://github.com/electron-userland/electron-builder/pull/1944\n    const timeout = parseInt(process.env.SIGNTOOL_TIMEOUT as any, 10) || 10 * 60 * 1000\n    // decide runtime argument by cases\n    let args: Array<string>\n    let vm: VmManager\n    const useVmIfNotOnWin = configuration.path.endsWith(\".appx\") || !(\"file\" in configuration.cscInfo!) /* certificateSubjectName and other such options */\n    const isWin = process.platform === \"win32\" || useVmIfNotOnWin\n    const toolInfo = await getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin)\n    const tool = toolInfo.path\n    if (useVmIfNotOnWin) {\n      vm = await packager.vm.value\n      args = this.computeSignToolArgs(configuration, isWin, vm)\n    } else {\n      vm = new VmManager()\n      args = configuration.computeSignToolArgs(isWin)\n    }\n\n    await retry(() => vm.exec(tool, args, { timeout, env: { ...process.env, ...(toolInfo.env || {}) } }), {\n      retries: 2,\n      interval: 15000,\n      backoff: 10000,\n      shouldRetry: (e: any) => {\n        if (\n          e.message.includes(\"The file is being used by another process\") ||\n          e.message.includes(\"The specified timestamp server either could not be reached\") ||\n          e.message.includes(\"No certificates were found that met all the given criteria.\")\n        ) {\n          log.warn(`Attempt to code sign failed, another attempt will be made in 15 seconds: ${e.message}`)\n          return true\n        }\n        return false\n      },\n    })\n  }\n}\n"]}
+{"version":3,"file":"windowsSignToolManager.js","sourceRoot":"","sources":["../../src/codeSign/windowsSignToolManager.ts"],"names":[],"mappings":";;;AAAA,+CAA6E;AAC7E,+DAAwD;AACxD,uCAAiC;AACjC,uCAA+B;AAC/B,6BAA4B;AAG5B,sDAA8C;AAC9C,iDAAqD;AAErD,6CAAiD;AACjD,yCAAyC;AACzC,iCAAoC;AAEpC,yCAA8C;AAgD9C,MAAa,sBAAsB;IAGjC,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAIzC,0BAAqB,GAAG,IAAI,eAAI,CAAuB,KAAK,IAAI,EAAE;;YACzE,MAAM,aAAa,GAAG,MAAA,IAAI,CAAC,4BAA4B,CAAC,eAAe,0CAAE,aAAa,CAAA;YACtF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAA;YACb,CAAC;iBAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACjC,OAAO,IAAA,sBAAO,EAAC,aAAa,CAAC,CAAA;YAC/B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;YAC9C,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEO,iBAAY,GAAG,IAAI,+BAAQ,CAClC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAClB,KAAK,EAAC,GAAG,EAAC,EAAE;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAA;gBAChD,OAAO;oBACL,UAAU,EAAE,IAAA,8BAAO,EAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAE;oBACxD,wBAAwB;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAA;YAC5B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;QAChE,CAAC,CACF,CAAA;QAEQ,YAAO,GAAG,IAAI,+BAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,4BAA4B,EACvC,4BAA4B,CAAC,EAAE;;YAC7B,MAAM,WAAW,GAAG,MAAA,4BAA4B,CAAC,eAAe,0CAAE,sBAAsB,CAAA;YACxF,MAAM,OAAO,GAAG,MAAA,4BAA4B,CAAC,eAAe,0CAAE,eAAe,CAAA;YAC7E,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK;qBAC1B,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;qBAC9E,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;;oBAChB,kEAAkE;oBAClE,IAAI,CAAA,MAAA,4BAA4B,CAAC,eAAe,0CAAE,IAAI,KAAI,IAAI,EAAE,CAAC;wBAC/D,MAAM,CAAC,CAAA;oBACT,CAAC;yBAAM,CAAC;wBACN,kBAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAA;wBAC5D,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC,CAAC,CAAA;YACN,CAAC;YAED,MAAM,eAAe,GAAG,MAAA,4BAA4B,CAAC,eAAe,0CAAE,eAAe,CAAA;YACrF,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;gBAC5B,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAA;gBAC1D,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE;iBAC1E,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;YACxD,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACtC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC9B,CAAC;YAED,OAAO,CACL,IAAA,4BAAiB,EAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;gBACrF,cAAc;iBACb,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;gBAChB,IAAI,CAAC,YAAY,wCAAyB,EAAE,CAAC;oBAC3C,MAAM,IAAI,wCAAyB,CAAC,oDAAoD,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;gBACtG,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,CAAA;gBACT,CAAC;YACH,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,EAAE;gBACX,OAAO;oBACL,IAAI,EAAE,IAAI;oBACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;iBACzC,CAAA;YACH,CAAC,CAAC,CACL,CAAA;QACH,CAAC,CACF,CAAA;QA1FC,IAAI,CAAC,4BAA4B,GAAG,QAAQ,CAAC,4BAA4B,CAAA;IAC3E,CAAC;IA2FD,UAAU;QACR,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,aAAqB;QAC9D,IAAI,MAAM,YAAY,oBAAU,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACvE,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,oBAAoB,CAAC,CAAA;YACtE,OAAO,aAAa,IAAI,OAAO,CAAA;QACjC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;QAC9C,MAAM,SAAS,GAAG,aAAa,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAA;QAChG,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA2B;;QACxC,IAAI,MAAM,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,qBAAqB,CAAA;QACnE,oCAAoC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC3E,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAA;QAE5D,MAAM,UAAU,GAAG,MAAM,IAAA,yBAAe,EAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAEhK,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QACxC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;YAC7E,CAAC;YACD,IAAI,OAAO,GAAQ;gBACjB,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,CAAA;YACD,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACtB,OAAO,GAAG;oBACR,GAAG,OAAO;oBACV,eAAe,EAAE,OAAO,CAAC,IAAI;iBAC9B,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,GAAG,OAAO;oBACV,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,IAAI,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;iBACrE,CAAA;YACH,CAAC;YACD,kBAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC9B,CAAC;aAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACvB,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,4DAA4D,CAAC,CAAA;YAC5G,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,CAAC,MAA0C,EAAE,QAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrI,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,iBAAiB,GAAiC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzG,MAAM,OAAO,CAAC,OAAO,CACnB,QAAQ,CACN;gBACE,GAAG,iBAAiB;gBACpB,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC;aACjF,EACD,IAAI,CAAC,QAAQ,CACd,CACF,CAAA;YACD,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,iBAAiB,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC;gBAC/C,MAAM,IAAA,iBAAM,EAAC,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,QAAgB;QAC9C,MAAM,kBAAkB,GAAG,4GAA4G,CAAA;QACvI,IAAI,CAAC;YACH,OAAO,MAAM,IAAA,uBAAY,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,wCAAyB,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mBAAmB,CAAC,OAAqC,EAAE,KAAc,EAAE,KAAgB,IAAI,cAAS,EAAE;QACxG,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACrG,CAAC;IAEO,sBAAsB,CAAC,OAAqC,EAAE,EAAa;;QACjF,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAErB,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAEnC,MAAM,YAAY,GAAG,SAAS;gBAC5B,CAAC,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,sBAAsB,KAAI,+BAA+B;gBAC5F,CAAC,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,eAAe,KAAI,+BAA+B,CAAA;YACvF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACzB,CAAC;QAED,cAAc;QACd,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAEhD,iBAAiB;QACjB,MAAM,eAAe,GAAG,CAAA,MAAA,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,0CAAE,WAAW,MAAK,OAAO,IAAI,CAAA,MAAA,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,0CAAE,WAAW,KAAI,IAAI,CAAA;QACpI,IAAI,eAAe,EAAE,CAAC;YACpB,kEAAkE;YAClE,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;oBACpD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAC5C,6DAA6D;YAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACrG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAElD,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC,eAAe;QAEpC,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,uBAAuB,CAAC,OAAqC,EAAE,EAAa;;QAClF,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAA;QAErC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QAE3D,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,YAAY,GAAG,CAAA,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,eAAe,KAAI,+BAA+B,CAAA;YACxG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QAC/B,CAAC;QAED,cAAc;QACd,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEjD,iBAAiB;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAE3C,sBAAsB;QACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEnD,gBAAgB;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;QAC1C,IAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC7B,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,kBAAkB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc;QAClH,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAA;QACjI,CAAC;QACD,MAAM,eAAe,GAAI,OAAO,CAAC,OAA+B,CAAC,IAAI,CAAA;QAErE,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,wCAAwC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;YACrF,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAmC,CAAA;YAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,mBAAmB;YACnB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;YACnD,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;YACnE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,2CAA2C,eAAe,iBAAiB,CAAC,CAAA;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc;;QACpH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAC,OAAO,CAAC,OAA+B,0CAAE,QAAQ,CAAA;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC7C,CAAC;QAED,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,eAAe,0CAAE,yBAAyB,CAAA;QACjF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAAY;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,GAAG,SAAS,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,OAA6B,EAAE,EAAa;;QAC5E,MAAM,sBAAsB,GAAG,MAAA,OAAO,CAAC,eAAe,0CAAE,sBAAsB,CAAA;QAC9E,MAAM,eAAe,GAAG,MAAA,MAAA,OAAO,CAAC,eAAe,0CAAE,eAAe,0CAAE,WAAW,EAAE,CAAA;QAE/E,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;YAClC,YAAY;YACZ,iBAAiB;YACjB,UAAU;YACV,oIAAoI;SACrI,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,sBAAO,EAAW,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACvF,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAChC,IACE,CAAC,sBAAsB,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;gBACtF,CAAC,eAAe,IAAI,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAClF,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAA;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACpE,kBAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAC/E,oEAAoE;YACpE,MAAM,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;YAC5E,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAA;YAC1D,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK;gBACL,mBAAmB;aACpB,CAAA;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,sBAAsB,IAAI,eAAe,gBAAgB,SAAS,EAAE,CAAC,CAAA;IAClH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;;QACpD,OAAO,IAAA,yBAAe,EAAC,MAAA,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,0CAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IAC3E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAiD,EAAE,QAAqB;;QACnF,kEAAkE;QAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAuB,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACnF,mCAAmC;QACnC,IAAI,IAAmB,CAAA;QACvB,IAAI,EAAa,CAAA;QACjB,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,OAAQ,CAAC,CAAA,CAAC,mDAAmD;QACvJ,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAA,yBAAe,EAAC,MAAA,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,0CAAE,WAAW,EAAE,KAAK,CAAC,CAAA;QACzF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;YAC5B,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAC3D,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,IAAI,cAAS,EAAE,CAAA;YACpB,IAAI,GAAG,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;QAED,MAAM,IAAA,oBAAK,EAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE;YACpG,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;gBACtB,IACE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2CAA2C,CAAC;oBAC/D,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,4DAA4D,CAAC;oBAChF,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,6DAA6D,CAAC,EACjF,CAAC;oBACD,kBAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACjG,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;CACF;AAzZD,wDAyZC","sourcesContent":["import { asArray, InvalidConfigurationError, log, retry } from \"builder-util\"\nimport { MemoLazy, parseDn } from \"builder-util-runtime\"\nimport { rename } from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../core\"\nimport { WindowsConfiguration } from \"../options/winOptions\"\nimport AppXTarget from \"../targets/AppxTarget\"\nimport { getSignToolPath } from \"../toolsets/windows\"\nimport { ToolInfo } from \"../util/bundledTool\"\nimport { resolveFunction } from \"../util/resolve\"\nimport { readCertInfo } from \"./certInfo\"\nimport { VmManager } from \"../vm/vm\"\nimport { WinPackager } from \"../winPackager\"\nimport { importCertificate } from \"./codesign\"\nimport { SignManager } from \"./signManager\"\nimport { WindowsSignOptions } from \"./windowsCodeSign\"\n\nexport type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>\n\nexport interface WindowsSignToolOptions extends WindowsSignOptions {\n  readonly name: string\n  readonly site: string | null\n}\n\nexport interface FileCodeSigningInfo {\n  readonly file: string\n  readonly password: string | null\n}\n\nexport interface WindowsSignTaskConfiguration extends WindowsSignToolOptions {\n  readonly cscInfo: FileCodeSigningInfo | CertificateFromStoreInfo | null\n\n  // set if output path differs from input (e.g. osslsigncode cannot sign file in-place)\n  resultOutputPath?: string\n\n  hash: string\n  isNest: boolean\n}\n\nexport interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {\n  computeSignToolArgs(isWin: boolean): Array<string>\n}\n\nexport interface CertificateInfo {\n  readonly commonName: string\n  readonly bloodyMicrosoftSubjectDn: string\n}\n\nexport interface CertificateFromStoreInfo {\n  thumbprint: string\n  subject: string\n  store: string\n  isLocalMachineStore: boolean\n}\n\ninterface CertInfo {\n  Subject: string\n  Thumbprint: string\n  PSParentPath: string\n}\n\nexport class WindowsSignToolManager implements SignManager {\n  private readonly platformSpecificBuildOptions: WindowsConfiguration\n\n  constructor(private readonly packager: WinPackager) {\n    this.platformSpecificBuildOptions = packager.platformSpecificBuildOptions\n  }\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(async () => {\n    const publisherName = this.platformSpecificBuildOptions.signtoolOptions?.publisherName\n    if (publisherName === null) {\n      return null\n    } else if (publisherName != null) {\n      return asArray(publisherName)\n    }\n\n    const certInfo = await this.lazyCertInfo.value\n    return certInfo == null ? null : [certInfo.commonName]\n  })\n\n  readonly lazyCertInfo = new MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>(\n    () => this.cscInfo,\n    async csc => {\n      const cscInfo = await csc.value\n      if (cscInfo == null) {\n        return null\n      }\n\n      if (\"subject\" in cscInfo) {\n        const bloodyMicrosoftSubjectDn = cscInfo.subject\n        return {\n          commonName: parseDn(bloodyMicrosoftSubjectDn).get(\"CN\")!,\n          bloodyMicrosoftSubjectDn,\n        }\n      }\n\n      const cscFile = cscInfo.file\n      if (cscFile == null) {\n        return null\n      }\n      return await this.getCertInfo(cscFile, cscInfo.password || \"\")\n    }\n  )\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.platformSpecificBuildOptions,\n    platformSpecificBuildOptions => {\n      const subjectName = platformSpecificBuildOptions.signtoolOptions?.certificateSubjectName\n      const shaType = platformSpecificBuildOptions.signtoolOptions?.certificateSha1\n      if (subjectName != null || shaType != null) {\n        return this.packager.vm.value\n          .then(vm => this.getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))\n          .catch((e: any) => {\n            // https://github.com/electron-userland/electron-builder/pull/2397\n            if (platformSpecificBuildOptions.signtoolOptions?.sign == null) {\n              throw e\n            } else {\n              log.debug({ error: e }, \"getCertificateFromStoreInfo error\")\n              return null\n            }\n          })\n      }\n\n      const certificateFile = platformSpecificBuildOptions.signtoolOptions?.certificateFile\n      if (certificateFile != null) {\n        const certificatePassword = this.packager.getCscPassword()\n        return Promise.resolve({\n          file: certificateFile,\n          password: certificatePassword == null ? null : certificatePassword.trim(),\n        })\n      }\n\n      const cscLink = this.packager.getCscLink(\"WIN_CSC_LINK\")\n      if (cscLink == null || cscLink === \"\") {\n        return Promise.resolve(null)\n      }\n\n      return (\n        importCertificate(cscLink, this.packager.info.tempDirManager, this.packager.projectDir)\n          // before then\n          .catch((e: any) => {\n            if (e instanceof InvalidConfigurationError) {\n              throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)\n            } else {\n              throw e\n            }\n          })\n          .then(path => {\n            return {\n              file: path,\n              password: this.packager.getCscPassword(),\n            }\n          })\n      )\n    }\n  )\n\n  initialize(): Promise<void> {\n    return Promise.resolve()\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/2108#issuecomment-333200711\n  async computePublisherName(target: Target, publisherName: string) {\n    if (target instanceof AppXTarget && (await this.cscInfo.value) == null) {\n      log.info({ reason: \"Windows Store only build\" }, \"AppX is not signed\")\n      return publisherName || \"CN=ms\"\n    }\n\n    const certInfo = await this.lazyCertInfo.value\n    const publisher = publisherName || (certInfo == null ? null : certInfo.bloodyMicrosoftSubjectDn)\n    if (publisher == null) {\n      throw new Error(\"Internal error: cannot compute subject using certificate info\")\n    }\n    return publisher\n  }\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    let hashes = options.options.signtoolOptions?.signingHashAlgorithms\n    // msi does not support dual-signing\n    if (options.path.endsWith(\".msi\")) {\n      hashes = [hashes != null && !hashes.includes(\"sha1\") ? \"sha256\" : \"sha1\"]\n    } else if (options.path.endsWith(\".appx\")) {\n      hashes = [\"sha256\"]\n    } else if (hashes == null) {\n      hashes = [\"sha1\", \"sha256\"]\n    } else {\n      hashes = Array.isArray(hashes) ? hashes : [hashes]\n    }\n\n    const name = this.packager.appInfo.productName\n    const site = await this.packager.appInfo.computePackageUrl()\n\n    const customSign = await resolveFunction(this.packager.appInfo.type, options.options.signtoolOptions?.sign, \"sign\", await this.packager.info.getWorkspaceRoot())\n\n    const cscInfo = await this.cscInfo.value\n    if (cscInfo) {\n      if (!customSign) {\n        log.info({ path: log.filePath(options.path) }, \"signing with signtool.exe\")\n      }\n      let logInfo: any = {\n        file: log.filePath(options.path),\n      }\n      if (\"file\" in cscInfo) {\n        logInfo = {\n          ...logInfo,\n          certificateFile: cscInfo.file,\n        }\n      } else {\n        logInfo = {\n          ...logInfo,\n          subject: cscInfo.subject,\n          thumbprint: cscInfo.thumbprint,\n          store: cscInfo.store,\n          user: cscInfo.isLocalMachineStore ? \"local machine\" : \"current user\",\n        }\n      }\n      log.info(logInfo, \"signing\")\n    } else if (!customSign) {\n      log.info({ path: log.filePath(options.path) }, \"no code signing certificate configured, signing is skipped\")\n      return false\n    }\n\n    const executor = customSign || ((config: CustomWindowsSignTaskConfiguration, packager: WinPackager) => this.doSign(config, packager))\n    let isNest = false\n    for (const hash of hashes) {\n      const taskConfiguration: WindowsSignTaskConfiguration = { ...options, name, site, cscInfo, hash, isNest }\n      await Promise.resolve(\n        executor(\n          {\n            ...taskConfiguration,\n            computeSignToolArgs: isWin => this.computeSignToolArgs(taskConfiguration, isWin),\n          },\n          this.packager\n        )\n      )\n      isNest = true\n      if (taskConfiguration.resultOutputPath != null) {\n        await rename(taskConfiguration.resultOutputPath, options.path)\n      }\n    }\n\n    return true\n  }\n\n  async getCertInfo(file: string, password: string): Promise<CertificateInfo> {\n    const errorMessagePrefix = \"Cannot extract publisher name from code signing certificate. As workaround, set win.publisherName. Error: \"\n    try {\n      return await readCertInfo(file, password)\n    } catch (e: any) {\n      throw new InvalidConfigurationError(`${errorMessagePrefix}${e.message || e}`)\n    }\n  }\n\n  // on windows be aware of http://stackoverflow.com/a/32640183/1910191\n  computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm: VmManager = new VmManager()): Array<string> {\n    return isWin ? this.computeWindowsSignArgs(options, vm) : this.computeOsslsigncodeArgs(options, vm)\n  }\n\n  private computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const inputFile = vm.toVmFile(options.path)\n    const args = [\"sign\"]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const isRfc3161 = options.isNest || options.hash === \"sha256\"\n      args.push(isRfc3161 ? \"/tr\" : \"/t\")\n\n      const timestampUrl = isRfc3161\n        ? options.options.signtoolOptions?.rfc3161TimeStampServer || \"http://timestamp.digicert.com\"\n        : options.options.signtoolOptions?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(timestampUrl)\n    }\n\n    // Certificate\n    this.addCertificateArgs(args, options, vm, true)\n\n    // Hash algorithm\n    const isLegacyToolset = this.packager.config.toolsets?.winCodeSign === \"0.0.0\" || this.packager.config.toolsets?.winCodeSign == null\n    if (isLegacyToolset) {\n      // Legacy || v0.0.0: Only add /fd for non-SHA1 (original behavior)\n      if (options.hash !== \"sha1\") {\n        args.push(\"/fd\", options.hash)\n        if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n          args.push(\"/td\", \"sha256\")\n        }\n      }\n    } else {\n      // Modern: Always add /fd (required by new Windows Kits)\n      args.push(\"/fd\", options.hash.toLowerCase())\n      // Only add /td for RFC3161 timestamps (incompatible with /t)\n      if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\" && (options.isNest || options.hash === \"sha256\")) {\n        args.push(\"/td\", \"sha256\")\n      }\n    }\n\n    // Optional parameters\n    this.addCommonSigningArgs(args, options, vm, true)\n\n    // Windows-specific\n    args.push(\"/debug\")\n    args.push(inputFile) // Must be last\n\n    return args\n  }\n\n  private computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const inputFile = vm.toVmFile(options.path)\n    const outputPath = this.getOutputPath(inputFile, options.hash)\n    options.resultOutputPath = outputPath\n\n    const args = [\"sign\", \"-in\", inputFile, \"-out\", outputPath]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const timestampUrl = options.options.signtoolOptions?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(\"-t\", timestampUrl)\n    }\n\n    // Certificate\n    this.addCertificateArgs(args, options, vm, false)\n\n    // Hash algorithm\n    args.push(\"-h\", options.hash.toLowerCase())\n\n    // Optional parameters\n    this.addCommonSigningArgs(args, options, vm, false)\n\n    // Proxy support\n    const httpsProxy = process.env.HTTPS_PROXY\n    if (httpsProxy?.length) {\n      args.push(\"-p\", httpsProxy)\n    }\n\n    return args\n  }\n\n  private addCertificateArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean): void {\n    if (options.cscInfo == null) {\n      throw new Error(\"No code signing certificate configured. Provide certificateFile, certificateSha1, or certificateSubjectName.\")\n    }\n    const certificateFile = (options.cscInfo as FileCodeSigningInfo).file\n\n    if (certificateFile == null) {\n      // Certificate from store (Windows only)\n      if (!isWin) {\n        throw new Error(\"certificateSha1/certificateSubjectName supported only on Windows\")\n      }\n\n      const cscInfo = options.cscInfo as CertificateFromStoreInfo\n      args.push(\"/sha1\", cscInfo.thumbprint)\n      args.push(\"/s\", cscInfo.store)\n      if (cscInfo.isLocalMachineStore) {\n        args.push(\"/sm\")\n      }\n    } else {\n      // Certificate file\n      const certExtension = path.extname(certificateFile)\n      if (certExtension === \".p12\" || certExtension === \".pfx\") {\n        args.push(isWin ? \"/f\" : \"-pkcs12\", vm.toVmFile(certificateFile))\n      } else {\n        throw new Error(`Please specify pkcs12 (.p12/.pfx) file, ${certificateFile} is not correct`)\n      }\n    }\n  }\n\n  private addCommonSigningArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean): void {\n    if (options.name) {\n      args.push(isWin ? \"/d\" : \"-n\", options.name)\n    }\n\n    if (options.site) {\n      args.push(isWin ? \"/du\" : \"-i\", options.site)\n    }\n\n    if (options.isNest) {\n      args.push(isWin ? \"/as\" : \"-nest\")\n    }\n\n    const password = (options.cscInfo as FileCodeSigningInfo)?.password\n    if (password) {\n      args.push(isWin ? \"/p\" : \"-pass\", password)\n    }\n\n    const additionalCert = options.options.signtoolOptions?.additionalCertificateFile\n    if (additionalCert) {\n      args.push(isWin ? \"/ac\" : \"-ac\", vm.toVmFile(additionalCert))\n    }\n  }\n\n  getOutputPath(inputPath: string, hash: string) {\n    const extension = path.extname(inputPath)\n    return path.join(path.dirname(inputPath), `${path.basename(inputPath, extension)}-signed-${hash}${extension}`)\n  }\n\n  async getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo> {\n    const certificateSubjectName = options.signtoolOptions?.certificateSubjectName\n    const certificateSha1 = options.signtoolOptions?.certificateSha1?.toUpperCase()\n\n    const ps = await vm.powershellCommand.value\n    const rawResult = await vm.exec(ps, [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-Command\",\n      \"Get-ChildItem -Recurse Cert: -CodeSigningCert | Select-Object -Property Subject,PSParentPath,Thumbprint | ConvertTo-Json -Compress\",\n    ])\n    const certList = rawResult.length === 0 ? [] : asArray<CertInfo>(JSON.parse(rawResult))\n    for (const certInfo of certList) {\n      if (\n        (certificateSubjectName != null && !certInfo.Subject.includes(certificateSubjectName)) ||\n        (certificateSha1 != null && certInfo.Thumbprint.toUpperCase() !== certificateSha1)\n      ) {\n        continue\n      }\n\n      const parentPath = certInfo.PSParentPath\n      const store = parentPath.substring(parentPath.lastIndexOf(\"\\\\\") + 1)\n      log.debug({ store, PSParentPath: parentPath }, \"auto-detect certificate store\")\n      // https://github.com/electron-userland/electron-builder/issues/1717\n      const isLocalMachineStore = parentPath.includes(\"Certificate::LocalMachine\")\n      log.debug(null, \"auto-detect using of LocalMachine store\")\n      return {\n        thumbprint: certInfo.Thumbprint,\n        subject: certInfo.Subject,\n        store,\n        isLocalMachineStore,\n      }\n    }\n\n    throw new Error(`Cannot find certificate ${certificateSubjectName || certificateSha1}, all certs: ${rawResult}`)\n  }\n\n  async getToolPath(isWin = process.platform === \"win32\"): Promise<ToolInfo> {\n    return getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin)\n  }\n\n  async doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager) {\n    // https://github.com/electron-userland/electron-builder/pull/1944\n    const timeout = parseInt(process.env.SIGNTOOL_TIMEOUT as any, 10) || 10 * 60 * 1000\n    // decide runtime argument by cases\n    let args: Array<string>\n    let vm: VmManager\n    const useVmIfNotOnWin = configuration.path.endsWith(\".appx\") || !(\"file\" in configuration.cscInfo!) /* certificateSubjectName and other such options */\n    const isWin = process.platform === \"win32\" || useVmIfNotOnWin\n    const toolInfo = await getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin)\n    const tool = toolInfo.path\n    if (useVmIfNotOnWin) {\n      vm = await packager.vm.value\n      args = this.computeSignToolArgs(configuration, isWin, vm)\n    } else {\n      vm = new VmManager()\n      args = configuration.computeSignToolArgs(isWin)\n    }\n\n    await retry(() => vm.exec(tool, args, { timeout, env: { ...process.env, ...(toolInfo.env || {}) } }), {\n      retries: 2,\n      interval: 15000,\n      backoff: 10000,\n      shouldRetry: (e: any) => {\n        if (\n          e.message.includes(\"The file is being used by another process\") ||\n          e.message.includes(\"The specified timestamp server either could not be reached\") ||\n          e.message.includes(\"No certificates were found that met all the given criteria.\")\n        ) {\n          log.warn(`Attempt to code sign failed, another attempt will be made in 15 seconds: ${e.message}`)\n          return true\n        }\n        return false\n      },\n    })\n  }\n}\n"]}

package/out/configuration.d.ts

@@ -188,6 +188,31 @@ export interface CommonConfiguration {
      * @default sequential
      */
     readonly nativeRebuilder?: "legacy" | "sequential" | "parallel" | null;
+    /**
+     * Whether production dependencies that cannot be resolved during node-module collection are
+     * allowed — i.e. whether the build should continue with a warning instead of failing.
+     *
+     * During collection every production dependency must resolve to an installed package on disk. A
+     * dependency that does not resolve (`cannot find path for dependency` / `dependency not found on
+     * disk`) is not bundled, which typically breaks the packaged app at runtime with
+     * `MODULE_NOT_FOUND`.
+     *
+     * - `true` (or omitted — the v26 default): missing production dependencies are only logged as
+     *   warnings, keeping the historical behavior of the stable 26.x line. (electron-builder 27+
+     *   defaults to `false` and fails the build instead.)
+     * - `false` or `null`: the build fails after dependency collection completes, reporting the
+     *   **complete** list of missing production dependencies at once.
+     * - `string[]`: the listed dependency names are allowed to be missing; any other missing
+     *   production dependency fails the build. Entries match the package name of the reported
+     *   `name@version` entry (e.g. `some-native-module`, `@scope/pkg`), or an exact `name@version`
+     *   string to allow only that resolved version to be missing.
+     *
+     * Missing *optional* dependencies (declared in `optionalDependencies`, e.g. `fsevents` on
+     * Linux/Windows, or platform-specific packages) are always allowed and never fail the build.
+     *
+     * @default true
+     */
+    readonly allowMissingDependencies?: boolean | Array<string> | null;
     /**
      * The build number. Maps to the `--iteration` flag for builds using FPM on Linux.
      * If not defined, then it will fallback to `BUILD_NUMBER` or `TRAVIS_BUILD_NUMBER` or `APPVEYOR_BUILD_NUMBER` or `CIRCLE_BUILD_NUM` or `BUILD_BUILDNUMBER` or `CI_PIPELINE_IID` env.
@@ -247,6 +272,13 @@ export interface Configuration extends CommonConfiguration, PlatformSpecificBuil
     /**
      * The [electron-download](https://github.com/electron-userland/electron-download#usage) options. (legacy)
      * Alternatively, you can use [electron/get](https://github.com/electron/get#usage) options.
+     *
+     * `checksums` (a map of artifact file name → SHA-256 hex) makes checksum validation fully offline —
+     * without it, `@electron/get` fetches `SHASUMS256.txt` from the network on every build, even when the
+     * artifact itself is already cached. When `checksums` is not configured, electron-builder automatically
+     * picks up a locally seeded `SHASUMS256.txt-<version>` (or `SHASUMS256.txt`) file at the root of the
+     * Electron cache directory. See the
+     * [air-gapped / offline builds guide](https://www.electron.build/tutorials/offline-air-gapped-builds).
      */
     readonly electronDownload?: ElectronDownloadOptions | ElectronGetOptions | null;
     /**

package/out/configuration.js.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../src/configuration.ts"],"names":[],"mappings":"","sourcesContent":["import { Arch } from \"builder-util\"\nimport { BeforeBuildContext, Target } from \"./core\"\nimport { ElectronBrandingOptions } from \"./electron/ElectronFramework\"\nimport { PrepareApplicationStageDirectoryOptions } from \"./Framework\"\nimport { AppXOptions } from \"./options/AppXOptions\"\nimport { AppImageOptions, DebOptions, FlatpakOptions, LinuxConfiguration, LinuxTargetSpecificOptions, PacmanOptions, RpmOptions } from \"./options/linuxOptions\"\nimport { DmgOptions, MacConfiguration, MasConfiguration } from \"./options/macOptions\"\nimport { MsiOptions } from \"./options/MsiOptions\"\nimport { MsiWrappedOptions } from \"./options/MsiWrappedOptions\"\nimport { PkgOptions } from \"./options/pkgOptions\"\nimport { PlatformSpecificBuildOptions } from \"./options/PlatformSpecificBuildOptions\"\nimport { SnapcraftOptions, SnapOptions } from \"./options/SnapOptions\"\nimport { SquirrelWindowsOptions } from \"./options/SquirrelWindowsOptions\"\nimport { WindowsConfiguration } from \"./options/winOptions\"\nimport { BuildResult } from \"./packager\"\nimport { ArtifactBuildStarted, ArtifactCreated } from \"./packagerApi\"\nimport { PlatformPackager } from \"./platformPackager\"\nimport { NsisOptions, NsisWebOptions, PortableOptions } from \"./targets/nsis/nsisOptions\"\nimport { ElectronDownloadOptions, ElectronGetOptions } from \"./util/electronGet\"\n\n// duplicate appId here because it is important\n/**\n * Configuration Options\n */\nexport interface CommonConfiguration {\n  /**\n   * The application id. Used as [CFBundleIdentifier](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html#//apple_ref/doc/uid/20001431-102070) for MacOS and as\n   * [Application User Model ID](https://msdn.microsoft.com/en-us/library/windows/desktop/dd378459(v=vs.85).aspx) for Windows (NSIS target only, Squirrel.Windows not supported). It is strongly recommended that an explicit ID is set.\n   * @default com.electron.${name}\n   */\n  readonly appId?: string | null\n\n  /**\n   * As [name](#metadata), but allows you to specify a product name for your executable which contains spaces and other special characters not allowed in the [name property](https://docs.npmjs.com/files/package.json#name).\n   * If not specified inside of the `build` configuration, `productName` property defined at the top level of `package.json` is used. If not specified at the top level of `package.json`, [name property](https://docs.npmjs.com/files/package.json#name) is used.\n   */\n  readonly productName?: string | null\n\n  /**\n   * The human-readable copyright line for the app.\n   * @default Copyright © year ${author}\n   */\n  readonly copyright?: string | null\n\n  /**\n   * Directories for build resources\n   */\n  readonly directories?: MetadataDirectories | null\n\n  /**\n   * Configuration of toolsets utilized by electron-builder\n   */\n  readonly toolsets?: ToolsetConfig | null\n\n  /**\n   * Options related to how build macOS targets.\n   */\n  readonly mac?: MacConfiguration | null\n  /**\n   * MAS (Mac Application Store) options.\n   */\n  readonly mas?: MasConfiguration | null\n  /**\n   * MAS (Mac Application Store) development options (`mas-dev` target).\n   */\n  readonly masDev?: MasConfiguration | null\n  /**\n   * macOS DMG options.\n   */\n  readonly dmg?: DmgOptions | null\n  /**\n   * macOS PKG options.\n   */\n  readonly pkg?: PkgOptions | null\n\n  /**\n   * Options related to how build Windows targets.\n   */\n  readonly win?: WindowsConfiguration | null\n  /** NSIS installer options. */\n  readonly nsis?: NsisOptions | null\n  /** NSIS web installer options (downloads app package at install time). */\n  readonly nsisWeb?: NsisWebOptions | null\n  /** Portable executable options (no installation required). */\n  readonly portable?: PortableOptions | null\n  /** Windows Store (AppX) package options. */\n  readonly appx?: AppXOptions | null\n  /**\n   * MSI package options.\n   */\n  readonly msi?: MsiOptions | null\n  /**\n   * MSI-wrapped installer options.\n   */\n  readonly msiWrapped?: MsiWrappedOptions | null\n  /**\n   * Squirrel.Windows installer options. Requires the `electron-builder-squirrel-windows` dependency.\n   */\n  readonly squirrelWindows?: SquirrelWindowsOptions | null\n  /**\n   * General Linux build options shared across all Linux targets (icon, category, desktop entry,\n   * executable name, etc.). Target-specific compression and packaging options live in the\n   * per-format interfaces (`DebOptions`, `RpmOptions`, `PacmanOptions`, etc.).\n   */\n  readonly linux?: LinuxConfiguration | null\n  /**\n   * Debian package options. Targets Debian, Ubuntu, and Debian-based distributions.\n   * Produces a `.deb` archive installable via `dpkg -i` or `apt install`.\n   */\n  readonly deb?: DebOptions | null\n  /**\n   * Flat snap configuration targeting core22 and older snap bases.\n   *\n   * @deprecated Use `snapcraft` instead — it supersedes `snap` when both are present and supports\n   * all snap bases including core24. `snap` will be removed in a future major release.\n   * See {@link SnapOptions} for available properties.\n   */\n  readonly snap?: SnapOptions | null\n  /**\n   * Snapcraft configuration. Prefer this over the deprecated `snap` field.\n   *\n   * Selects the snapcraft base and provides per-core options:\n   * - `base: \"core18\" | \"core20\" | \"core22\"` — legacy builds; accepts the same options as `snap`\n   * - `base: \"core24\"` — modern builds with the GNOME extension (recommended for new apps, requires Electron 25+)\n   * - `base: \"custom\"` — pass an existing `snapcraft.yaml` through unchanged; no plugs, extensions,\n   *   or desktop files are injected\n   *\n   * When both `snapcraft` and `snap` are set, `snapcraft` takes precedence.\n   *\n   * @example\n   * ```json\n   * { \"snapcraft\": { \"base\": \"core24\", \"core24\": { \"useLXD\": true } } }\n   * ```\n   *\n   * See {@link SnapcraftOptions} for all available properties.\n   */\n  readonly snapcraft?: SnapcraftOptions | null\n  /**\n   * AppImage options. AppImage is a portable application format that bundles the app\n   * and its dependencies into a single self-contained executable that runs on most\n   * Linux distributions without installation.\n   */\n  readonly appImage?: AppImageOptions | null\n  /**\n   * Flatpak options. Flatpak is a sandboxed application distribution format for Linux\n   * that runs in a controlled environment and is distributed via [Flathub](https://flathub.org/)\n   * or other Flatpak repositories.\n   */\n  readonly flatpak?: FlatpakOptions | null\n  /**\n   * Pacman package options. Targets Arch Linux and Arch-based distributions\n   * (Manjaro, EndeavourOS, etc.). Produces a `.pacman` archive installable via `pacman -U`.\n   */\n  readonly pacman?: PacmanOptions | null\n  /**\n   * RPM package options. Targets Fedora, Red Hat Enterprise Linux, SUSE, and related\n   * distributions. Produces a `.rpm` archive installable via `rpm` or `dnf`.\n   */\n  readonly rpm?: RpmOptions | null\n  /**\n   * FreeBSD package options. Produces a `.pkg` archive for the FreeBSD `pkg` package manager.\n   */\n  readonly freebsd?: LinuxTargetSpecificOptions | null\n  /**\n   * Solaris IPS package options. Produces a `.p5p` archive for the Solaris Image Packaging\n   * System (`pkg`).\n   */\n  readonly p5p?: LinuxTargetSpecificOptions | null\n  /**\n   * Alpine Linux APK package options. Produces an `.apk` archive installable via `apk add`.\n   */\n  readonly apk?: LinuxTargetSpecificOptions | null\n\n  /**\n   * Whether to build the application native dependencies from source.\n   * @default false\n   */\n  buildDependenciesFromSource?: boolean\n  /**\n   * Whether to execute `node-gyp rebuild` before starting to package the app.\n   *\n   * Don't [use](https://github.com/electron-userland/electron-builder/issues/683#issuecomment-241214075) [npm](http://electron.atom.io/docs/tutorial/using-native-node-modules/#using-npm) (neither `.npmrc`) for configuring electron headers. Use `electron-builder node-gyp-rebuild` instead.\n   * @default false\n   */\n  readonly nodeGypRebuild?: boolean\n  /**\n   * Additional command line arguments to use when installing app native deps.\n   */\n  readonly npmArgs?: Array<string> | string | null\n  /**\n   * Whether to [rebuild](https://docs.npmjs.com/cli/rebuild) native dependencies before starting to package the app.\n   * @default true\n   */\n  readonly npmRebuild?: boolean\n  /**\n   * Use `legacy` app-builder binary for installing native dependencies, or `@electron/rebuild` in `sequential` or `parallel` compilation modes.\n   * @default sequential\n   */\n  readonly nativeRebuilder?: \"legacy\" | \"sequential\" | \"parallel\" | null\n\n  /**\n   * The build number. Maps to the `--iteration` flag for builds using FPM on Linux.\n   * If not defined, then it will fallback to `BUILD_NUMBER` or `TRAVIS_BUILD_NUMBER` or `APPVEYOR_BUILD_NUMBER` or `CIRCLE_BUILD_NUM` or `BUILD_BUILDNUMBER` or `CI_PIPELINE_IID` env.\n   */\n  readonly buildNumber?: string | null\n\n  /**\n   * The build version. Maps to the `CFBundleVersion` on macOS, and `FileVersion` metadata property on Windows. Defaults to the `version`.\n   * If `buildVersion` is not defined and `buildNumber` (or one of the `buildNumber` envs) is defined, it will be used as a build version (`version.buildNumber`).\n   */\n  readonly buildVersion?: string | null\n\n  /**\n   * Whether to download the alternate FFmpeg library from Electron's release assets and replace the default FFmpeg library prior to signing\n   */\n  readonly downloadAlternateFFmpeg?: boolean\n\n  /**\n   * Inject properties to `package.json`.\n   */\n  readonly extraMetadata?: any\n\n  /**\n   * Whether to fail if the application is not signed (to prevent unsigned app if code signing configuration is not correct).\n   * @default false\n   */\n  readonly forceCodeSigning?: boolean\n\n  /**\n   * Whether to include PDB files.\n   * @default false\n   */\n  readonly includePdb?: boolean\n\n  /**\n   * Whether to remove `scripts` field from `package.json` files.\n   *\n   * @default true\n   */\n  readonly removePackageScripts?: boolean\n\n  /**\n   * Whether to remove `keywords` field from `package.json` files.\n   *\n   * @default true\n   */\n  readonly removePackageKeywords?: boolean\n\n  /**\n   * Options to pass to `@electron/fuses`\n   * Ref: https://github.com/electron/fuses\n   */\n  readonly electronFuses?: FuseOptionsV1 | null\n\n  /**\n   * [Experimental] Configuration for concurrent builds.\n   */\n  readonly concurrency?: Concurrency | null\n}\n\nexport interface Configuration extends CommonConfiguration, PlatformSpecificBuildOptions, Hooks {\n  /**\n   * Whether to use [electron-compile](http://github.com/electron/electron-compile) to compile app. Defaults to `true` if `electron-compile` in the dependencies. And `false` if in the `devDependencies` or doesn't specified.\n   * @deprecated `electron-compile` is no longer maintained. Compile your app with a modern bundler (webpack, vite, etc.) instead.\n   */\n  readonly electronCompile?: boolean\n\n  /**\n   * The [electron-download](https://github.com/electron-userland/electron-download#usage) options. (legacy)\n   * Alternatively, you can use [electron/get](https://github.com/electron/get#usage) options.\n   */\n  readonly electronDownload?: ElectronDownloadOptions | ElectronGetOptions | null\n\n  /**\n   * The branding used by Electron's distributables. This is needed if a fork has modified Electron's BRANDING.json file.\n   */\n  readonly electronBranding?: ElectronBrandingOptions\n\n  /**\n   * The version of electron you are packaging for. Defaults to version of `electron`, `electron-prebuilt` or `electron-prebuilt-compile` dependency.\n   */\n  electronVersion?: string | null\n\n  /**\n   * The name of a built-in configuration preset (currently, only `react-cra` is supported) or any number of paths to config files (relative to project dir).\n   *\n   * The latter allows to mixin a config from multiple other configs, as if you `Object.assign` them, but properly combine `files` glob patterns.\n   *\n   * If `react-scripts` in the app dependencies, `react-cra` will be set automatically. Set to `null` to disable automatic detection.\n   */\n  extends?: Array<string> | string | null\n\n  /**\n   * *libui-based frameworks only* The version of NodeJS you are packaging for.\n   * You can set it to `current` to set the Node.js version that you use to run.\n   * @deprecated libui-based frameworks (proton-native, etc.) are no longer actively maintained. This option has no effect when using Electron.\n   */\n  readonly nodeVersion?: string | null\n\n  /**\n   * *libui-based frameworks only* The version of LaunchUI you are packaging for. Applicable for Windows only. Defaults to version suitable for used framework version.\n   * @deprecated libui-based frameworks (proton-native, etc.) are no longer actively maintained. This option has no effect when using Electron.\n   */\n  readonly launchUiVersion?: boolean | string | null\n\n  /**\n   * The framework name. One of `electron`, `proton`, `libui`. Defaults to `electron`.\n   * @deprecated `proton` and `libui` framework support is no longer actively maintained. Use `electron` (the default).\n   */\n  readonly framework?: string | null\n\n  /**\n   * Whether to disable sanity check asar package (useful for custom electron forks that implement their own encrypted integrity validation)\n   * @default false\n   */\n  readonly disableSanityCheckAsar?: boolean\n\n  /**\n   * Whether to skip ASAR integrity hash computation. Useful for custom electron forks with encrypted ASAR support where the header is not readable by standard tools.\n   * @default false\n   */\n  readonly disableAsarIntegrity?: boolean\n}\n\nexport type Hook<T, V> = (contextOrPath: T) => Promise<V> | V\n\nexport interface PackContext {\n  readonly outDir: string\n  readonly appOutDir: string\n  readonly packager: PlatformPackager<any>\n  readonly electronPlatformName: string\n  readonly arch: Arch\n  readonly targets: Array<Target>\n}\nexport type AfterPackContext = PackContext\nexport type BeforePackContext = PackContext\nexport type AfterExtractContext = PackContext\n\n/**\n * Configuration of toolsets utilized by electron-builder\n */\nexport interface ToolsetConfig {\n  /**\n   * `win-codesign` version to use for signing Windows artifacts.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=win-codesign&expanded=true\n   *\n   * Stable:\n   * v0.0.0 (winCodeSign)\n   *\n   * Beta:\n   * Windows Kits 10.0.26100.0\n   * v1.0.0, v1.1.0\n   *\n   * @default \"0.0.0\"\n   */\n  readonly winCodeSign?: \"0.0.0\" | \"1.0.0\" | \"1.1.0\" | null\n\n  /**\n   * `appimage` bundle version to use for Appimage packaging and runtime.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=appimage&expanded=true\n   * 0.0.0 - legacy toolset (appimage)\n   *\n   * Betas:\n   * 1.0.2 - Runtime 20251108\n   * 1.0.3 - Runtime 20251108 (Resolves GH issue #9598)\n   *\n   * @default \"0.0.0\"\n   */\n  readonly appimage?: \"0.0.0\" | \"1.0.2\" | \"1.0.3\" | null\n\n  /**\n   * `nsis` bundle version to use for NSIS installer compilation.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=nsis&expanded=true\n   * 0.0.0 - legacy toolset (nsis-3.0.4.1 + nsis-resources-3.4.1)\n   *\n   * Betas:\n   * 1.2.1 - unified bundle (makensis 3.12 + plugins in one archive, entrypoint scripts auto-set NSISDIR)\n   *\n   * @default \"0.0.0\"\n   */\n  readonly nsis?: \"0.0.0\" | \"1.2.1\" | null\n\n  /**\n   * `wine` bundle version to use for running Windows tools on non-Windows platforms.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=wine&expanded=true\n   * 0.0.0 - legacy toolset (wine 4.0.1 portable; mac-only support)\n   *\n   * Beta:\n   * 1.0.1 - Wine 11 bundle (unified wine binary, ia32 via WoW64)\n   *\n   * @default \"0.0.0\"\n   */\n  readonly wine?: \"0.0.0\" | \"1.0.1\" | null\n}\n\nexport interface Hooks {\n  /**\n   * The function (or path to file or module id) to be run before pack.\n   * Receives a {@link BeforePackContext}.\n   *\n   * Can be specified inline as a function in JavaScript configs:\n   * ```js\n   * // electron-builder.config.js\n   * module.exports = {\n   *   beforePack: async (context) => {\n   *     // your code\n   *   }\n   * }\n   * ```\n   *\n   * Or as a path to a module that exports the function as its default export:\n   * ```json\n   * { \"build\": { \"beforePack\": \"./myBeforePackHook.js\" } }\n   * ```\n   * ```js\n   * // myBeforePackHook.js\n   * exports.default = async function(context) {\n   *   // your custom code\n   * }\n   * ```\n   */\n  readonly beforePack?: Hook<BeforePackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after the prebuilt Electron binary has been extracted to the output directory.\n   * Receives an {@link AfterExtractContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterExtract?: Hook<AfterExtractContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after pack but before pack into distributable format and sign.\n   * Receives an {@link AfterPackContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterPack?: Hook<AfterPackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after pack and sign but before pack into distributable format.\n   * Receives an {@link AfterPackContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterSign?: Hook<AfterPackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run when an individual artifact build starts.\n   * Receives an {@link ArtifactBuildStarted}. For file/module setup, see {@link beforePack}.\n   */\n  readonly artifactBuildStarted?: Hook<ArtifactBuildStarted, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run when an individual artifact build completes.\n   * Receives an {@link ArtifactCreated}. For file/module setup, see {@link beforePack}.\n   */\n  readonly artifactBuildCompleted?: Hook<ArtifactCreated, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run after all artifacts are built.\n   * Receives a {@link BuildResult}. May return an array of additional file paths to publish.\n   *\n   * For file/module setup, see {@link beforePack}.\n   *\n   * @example\n   * ```js\n   * exports.default = function () {\n   *   // return additional files to publish\n   *   return [\"/path/to/additional/result/file\"]\n   * }\n   * ```\n   */\n  readonly afterAllArtifactBuild?: Hook<BuildResult, Array<string>> | string | null\n  /**\n   * The function (or path to file or module id) to be run after MSI project created on disk - not packed into .msi package yet.\n   */\n  readonly msiProjectCreated?: Hook<string, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run after Appx manifest created on disk - not packed into .appx package yet.\n   */\n  readonly appxManifestCreated?: Hook<string, void> | string | null\n  /**\n   * The function (or path to file or module id) to be [run on each node module](#onnodemodulefile) file. Returning `true`/`false` will determine whether to force include or to use the default copier logic\n   */\n  readonly onNodeModuleFile?: Hook<string, void | boolean> | string | null\n  /**\n   * The function (or path to file or module id) to be run before dependencies are installed or rebuilt. Works when `npmRebuild` is set to `true`. Resolving to `false` will skip dependencies install or rebuild.\n   *\n   * If provided and `node_modules` are missing, it will not invoke production dependencies check.\n   */\n  readonly beforeBuild?: Hook<BeforeBuildContext, boolean | void> | string | null\n  /**\n   * The function (or path to file or module id) to be run when staging the electron artifact environment.\n   * Returns the path to custom Electron build (e.g. `~/electron/out/R`) or folder of electron zips.\n   *\n   * Zip files must follow the pattern `electron-v${version}-${platformName}-${arch}.zip`, otherwise it will be assumed to be an unpacked Electron app directory\n   */\n  readonly electronDist?: Hook<PrepareApplicationStageDirectoryOptions, string> | string | null\n}\n\nexport interface MetadataDirectories {\n  /**\n   * The path to build resources.\n   *\n   * Please note — build resources are not packed into the app. If you need to use some files, e.g. as tray icon, please include required files explicitly: `\"files\": [\"**\\/*\", \"build/icon.*\"]`\n   * @default build\n   */\n  readonly buildResources?: string | null\n\n  /**\n   * The output directory. [File macros](https://www.electron.build/file-patterns#file-macros) are supported.\n   * @default dist\n   */\n  readonly output?: string | null\n\n  /**\n   * The application directory (containing the application package.json), defaults to `app`, `www` or working directory.\n   */\n  readonly app?: string | null\n}\n\n/**\n * All options come from [@electron/fuses](https://github.com/electron/fuses)\n * Ref: https://raw.githubusercontent.com/electron/electron/refs/heads/main/docs/tutorial/fuses.md\n */\nexport interface FuseOptionsV1 {\n  /**\n   *The runAsNode fuse toggles whether the `ELECTRON_RUN_AS_NODE` environment variable is respected or not.  Please note that if this fuse is disabled then `process.fork` in the main process will not function as expected as it depends on this environment variable to function. Instead, we recommend that you use [Utility Processes](https://github.com/electron/electron/blob/main/docs/api/utility-process.md), which work for many use cases where you need a standalone Node.js process (like a Sqlite server process or similar scenarios).\n   */\n  runAsNode?: boolean\n  /**\n   * The cookieEncryption fuse toggles whether the cookie store on disk is encrypted using OS level cryptography keys.  By default the sqlite database that Chromium uses to store cookies stores the values in plaintext.  If you wish to ensure your apps cookies are encrypted in the same way Chrome does then you should enable this fuse.  Please note it is a one-way transition, if you enable this fuse existing unencrypted cookies will be encrypted-on-write but if you then disable the fuse again your cookie store will effectively be corrupt and useless.  Most apps can safely enable this fuse.\n   */\n  enableCookieEncryption?: boolean\n  /**\n   * The nodeOptions fuse toggles whether the [`NODE_OPTIONS`](https://nodejs.org/api/cli.html#node_optionsoptions)  and [`NODE_EXTRA_CA_CERTS`](https://github.com/nodejs/node/blob/main/doc/api/cli.md#node_extra_ca_certsfile) environment variables are respected.  The `NODE_OPTIONS` environment variable can be used to pass all kinds of custom options to the Node.js runtime and isn't typically used by apps in production.  Most apps can safely disable this fuse.\n   */\n  enableNodeOptionsEnvironmentVariable?: boolean\n  /**\n   * The nodeCliInspect fuse toggles whether the `--inspect`, `--inspect-brk`, etc. flags are respected or not.  When disabled it also ensures that `SIGUSR1` signal does not initialize the main process inspector.  Most apps can safely disable this fuse.\n   */\n  enableNodeCliInspectArguments?: boolean\n  /**\n   * The embeddedAsarIntegrityValidation fuse toggles an experimental feature on macOS that validates the content of the `app.asar` file when it is loaded.  This feature is designed to have a minimal performance impact but may marginally slow down file reads from inside the `app.asar` archive.\n   * Currently, ASAR integrity checking is supported on:\n   *\n   *  - macOS as of electron>=16.0.0\n   *  - Windows as of electron>=30.0.0\n   *\n   * For more information on how to use asar integrity validation please read the [Asar Integrity](https://github.com/electron/electron/blob/main/docs/tutorial/asar-integrity.md) documentation.\n   */\n  enableEmbeddedAsarIntegrityValidation?: boolean\n  /**\n   * The onlyLoadAppFromAsar fuse changes the search system that Electron uses to locate your app code.  By default Electron will search in the following order `app.asar` -> `app` -> `default_app.asar`.  When this fuse is enabled the search order becomes a single entry `app.asar` thus ensuring that when combined with the `embeddedAsarIntegrityValidation` fuse it is impossible to load non-validated code.\n   */\n  onlyLoadAppFromAsar?: boolean\n  /**\n   * The loadBrowserProcessSpecificV8Snapshot fuse changes which V8 snapshot file is used for the browser process.  By default Electron's processes will all use the same V8 snapshot file.  When this fuse is enabled the browser process uses the file called `browser_v8_context_snapshot.bin` for its V8 snapshot. The other processes will use the V8 snapshot file that they normally do.\n   */\n  loadBrowserProcessSpecificV8Snapshot?: boolean\n  /**\n   * The grantFileProtocolExtraPrivileges fuse changes whether pages loaded from the `file://` protocol are given privileges beyond what they would receive in a traditional web browser.  This behavior was core to Electron apps in original versions of Electron but is no longer required as apps should be [serving local files from custom protocols](https://github.com/electron/electron/blob/main/docs/tutorial/security.md#18-avoid-usage-of-the-file-protocol-and-prefer-usage-of-custom-protocols) now instead.  If you aren't serving pages from `file://` you should disable this fuse.\n   * The extra privileges granted to the `file://` protocol by this fuse are incompletely documented below:\n   *\n   *  - `file://` protocol pages can use `fetch` to load other assets over `file://`\n   *  - `file://` protocol pages can use service workers\n   *  - `file://` protocol pages have universal access granted to child frames also running on `file://` protocols regardless of sandbox settings\n   */\n  grantFileProtocolExtraPrivileges?: boolean\n  /**\n   * Resets the app signature, specifically used for macOS.\n   * Note: This should be unneeded since electron-builder signs the app directly after flipping the fuses.\n   * Ref: https://github.com/electron/fuses?tab=readme-ov-file#apple-silicon\n   */\n  resetAdHocDarwinSignature?: boolean\n}\n\nexport interface Concurrency {\n  /**\n   * The maximum number of concurrent jobs to run.\n   * @default 1\n   */\n  jobs: number\n}\n"]}
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../src/configuration.ts"],"names":[],"mappings":"","sourcesContent":["import { Arch } from \"builder-util\"\nimport { BeforeBuildContext, Target } from \"./core\"\nimport { ElectronBrandingOptions } from \"./electron/ElectronFramework\"\nimport { PrepareApplicationStageDirectoryOptions } from \"./Framework\"\nimport { AppXOptions } from \"./options/AppXOptions\"\nimport { AppImageOptions, DebOptions, FlatpakOptions, LinuxConfiguration, LinuxTargetSpecificOptions, PacmanOptions, RpmOptions } from \"./options/linuxOptions\"\nimport { DmgOptions, MacConfiguration, MasConfiguration } from \"./options/macOptions\"\nimport { MsiOptions } from \"./options/MsiOptions\"\nimport { MsiWrappedOptions } from \"./options/MsiWrappedOptions\"\nimport { PkgOptions } from \"./options/pkgOptions\"\nimport { PlatformSpecificBuildOptions } from \"./options/PlatformSpecificBuildOptions\"\nimport { SnapcraftOptions, SnapOptions } from \"./options/SnapOptions\"\nimport { SquirrelWindowsOptions } from \"./options/SquirrelWindowsOptions\"\nimport { WindowsConfiguration } from \"./options/winOptions\"\nimport { BuildResult } from \"./packager\"\nimport { ArtifactBuildStarted, ArtifactCreated } from \"./packagerApi\"\nimport { PlatformPackager } from \"./platformPackager\"\nimport { NsisOptions, NsisWebOptions, PortableOptions } from \"./targets/nsis/nsisOptions\"\nimport { ElectronDownloadOptions, ElectronGetOptions } from \"./util/electronGet\"\n\n// duplicate appId here because it is important\n/**\n * Configuration Options\n */\nexport interface CommonConfiguration {\n  /**\n   * The application id. Used as [CFBundleIdentifier](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html#//apple_ref/doc/uid/20001431-102070) for MacOS and as\n   * [Application User Model ID](https://msdn.microsoft.com/en-us/library/windows/desktop/dd378459(v=vs.85).aspx) for Windows (NSIS target only, Squirrel.Windows not supported). It is strongly recommended that an explicit ID is set.\n   * @default com.electron.${name}\n   */\n  readonly appId?: string | null\n\n  /**\n   * As [name](#metadata), but allows you to specify a product name for your executable which contains spaces and other special characters not allowed in the [name property](https://docs.npmjs.com/files/package.json#name).\n   * If not specified inside of the `build` configuration, `productName` property defined at the top level of `package.json` is used. If not specified at the top level of `package.json`, [name property](https://docs.npmjs.com/files/package.json#name) is used.\n   */\n  readonly productName?: string | null\n\n  /**\n   * The human-readable copyright line for the app.\n   * @default Copyright © year ${author}\n   */\n  readonly copyright?: string | null\n\n  /**\n   * Directories for build resources\n   */\n  readonly directories?: MetadataDirectories | null\n\n  /**\n   * Configuration of toolsets utilized by electron-builder\n   */\n  readonly toolsets?: ToolsetConfig | null\n\n  /**\n   * Options related to how build macOS targets.\n   */\n  readonly mac?: MacConfiguration | null\n  /**\n   * MAS (Mac Application Store) options.\n   */\n  readonly mas?: MasConfiguration | null\n  /**\n   * MAS (Mac Application Store) development options (`mas-dev` target).\n   */\n  readonly masDev?: MasConfiguration | null\n  /**\n   * macOS DMG options.\n   */\n  readonly dmg?: DmgOptions | null\n  /**\n   * macOS PKG options.\n   */\n  readonly pkg?: PkgOptions | null\n\n  /**\n   * Options related to how build Windows targets.\n   */\n  readonly win?: WindowsConfiguration | null\n  /** NSIS installer options. */\n  readonly nsis?: NsisOptions | null\n  /** NSIS web installer options (downloads app package at install time). */\n  readonly nsisWeb?: NsisWebOptions | null\n  /** Portable executable options (no installation required). */\n  readonly portable?: PortableOptions | null\n  /** Windows Store (AppX) package options. */\n  readonly appx?: AppXOptions | null\n  /**\n   * MSI package options.\n   */\n  readonly msi?: MsiOptions | null\n  /**\n   * MSI-wrapped installer options.\n   */\n  readonly msiWrapped?: MsiWrappedOptions | null\n  /**\n   * Squirrel.Windows installer options. Requires the `electron-builder-squirrel-windows` dependency.\n   */\n  readonly squirrelWindows?: SquirrelWindowsOptions | null\n  /**\n   * General Linux build options shared across all Linux targets (icon, category, desktop entry,\n   * executable name, etc.). Target-specific compression and packaging options live in the\n   * per-format interfaces (`DebOptions`, `RpmOptions`, `PacmanOptions`, etc.).\n   */\n  readonly linux?: LinuxConfiguration | null\n  /**\n   * Debian package options. Targets Debian, Ubuntu, and Debian-based distributions.\n   * Produces a `.deb` archive installable via `dpkg -i` or `apt install`.\n   */\n  readonly deb?: DebOptions | null\n  /**\n   * Flat snap configuration targeting core22 and older snap bases.\n   *\n   * @deprecated Use `snapcraft` instead — it supersedes `snap` when both are present and supports\n   * all snap bases including core24. `snap` will be removed in a future major release.\n   * See {@link SnapOptions} for available properties.\n   */\n  readonly snap?: SnapOptions | null\n  /**\n   * Snapcraft configuration. Prefer this over the deprecated `snap` field.\n   *\n   * Selects the snapcraft base and provides per-core options:\n   * - `base: \"core18\" | \"core20\" | \"core22\"` — legacy builds; accepts the same options as `snap`\n   * - `base: \"core24\"` — modern builds with the GNOME extension (recommended for new apps, requires Electron 25+)\n   * - `base: \"custom\"` — pass an existing `snapcraft.yaml` through unchanged; no plugs, extensions,\n   *   or desktop files are injected\n   *\n   * When both `snapcraft` and `snap` are set, `snapcraft` takes precedence.\n   *\n   * @example\n   * ```json\n   * { \"snapcraft\": { \"base\": \"core24\", \"core24\": { \"useLXD\": true } } }\n   * ```\n   *\n   * See {@link SnapcraftOptions} for all available properties.\n   */\n  readonly snapcraft?: SnapcraftOptions | null\n  /**\n   * AppImage options. AppImage is a portable application format that bundles the app\n   * and its dependencies into a single self-contained executable that runs on most\n   * Linux distributions without installation.\n   */\n  readonly appImage?: AppImageOptions | null\n  /**\n   * Flatpak options. Flatpak is a sandboxed application distribution format for Linux\n   * that runs in a controlled environment and is distributed via [Flathub](https://flathub.org/)\n   * or other Flatpak repositories.\n   */\n  readonly flatpak?: FlatpakOptions | null\n  /**\n   * Pacman package options. Targets Arch Linux and Arch-based distributions\n   * (Manjaro, EndeavourOS, etc.). Produces a `.pacman` archive installable via `pacman -U`.\n   */\n  readonly pacman?: PacmanOptions | null\n  /**\n   * RPM package options. Targets Fedora, Red Hat Enterprise Linux, SUSE, and related\n   * distributions. Produces a `.rpm` archive installable via `rpm` or `dnf`.\n   */\n  readonly rpm?: RpmOptions | null\n  /**\n   * FreeBSD package options. Produces a `.pkg` archive for the FreeBSD `pkg` package manager.\n   */\n  readonly freebsd?: LinuxTargetSpecificOptions | null\n  /**\n   * Solaris IPS package options. Produces a `.p5p` archive for the Solaris Image Packaging\n   * System (`pkg`).\n   */\n  readonly p5p?: LinuxTargetSpecificOptions | null\n  /**\n   * Alpine Linux APK package options. Produces an `.apk` archive installable via `apk add`.\n   */\n  readonly apk?: LinuxTargetSpecificOptions | null\n\n  /**\n   * Whether to build the application native dependencies from source.\n   * @default false\n   */\n  buildDependenciesFromSource?: boolean\n  /**\n   * Whether to execute `node-gyp rebuild` before starting to package the app.\n   *\n   * Don't [use](https://github.com/electron-userland/electron-builder/issues/683#issuecomment-241214075) [npm](http://electron.atom.io/docs/tutorial/using-native-node-modules/#using-npm) (neither `.npmrc`) for configuring electron headers. Use `electron-builder node-gyp-rebuild` instead.\n   * @default false\n   */\n  readonly nodeGypRebuild?: boolean\n  /**\n   * Additional command line arguments to use when installing app native deps.\n   */\n  readonly npmArgs?: Array<string> | string | null\n  /**\n   * Whether to [rebuild](https://docs.npmjs.com/cli/rebuild) native dependencies before starting to package the app.\n   * @default true\n   */\n  readonly npmRebuild?: boolean\n  /**\n   * Use `legacy` app-builder binary for installing native dependencies, or `@electron/rebuild` in `sequential` or `parallel` compilation modes.\n   * @default sequential\n   */\n  readonly nativeRebuilder?: \"legacy\" | \"sequential\" | \"parallel\" | null\n\n  /**\n   * Whether production dependencies that cannot be resolved during node-module collection are\n   * allowed — i.e. whether the build should continue with a warning instead of failing.\n   *\n   * During collection every production dependency must resolve to an installed package on disk. A\n   * dependency that does not resolve (`cannot find path for dependency` / `dependency not found on\n   * disk`) is not bundled, which typically breaks the packaged app at runtime with\n   * `MODULE_NOT_FOUND`.\n   *\n   * - `true` (or omitted — the v26 default): missing production dependencies are only logged as\n   *   warnings, keeping the historical behavior of the stable 26.x line. (electron-builder 27+\n   *   defaults to `false` and fails the build instead.)\n   * - `false` or `null`: the build fails after dependency collection completes, reporting the\n   *   **complete** list of missing production dependencies at once.\n   * - `string[]`: the listed dependency names are allowed to be missing; any other missing\n   *   production dependency fails the build. Entries match the package name of the reported\n   *   `name@version` entry (e.g. `some-native-module`, `@scope/pkg`), or an exact `name@version`\n   *   string to allow only that resolved version to be missing.\n   *\n   * Missing *optional* dependencies (declared in `optionalDependencies`, e.g. `fsevents` on\n   * Linux/Windows, or platform-specific packages) are always allowed and never fail the build.\n   *\n   * @default true\n   */\n  readonly allowMissingDependencies?: boolean | Array<string> | null\n\n  /**\n   * The build number. Maps to the `--iteration` flag for builds using FPM on Linux.\n   * If not defined, then it will fallback to `BUILD_NUMBER` or `TRAVIS_BUILD_NUMBER` or `APPVEYOR_BUILD_NUMBER` or `CIRCLE_BUILD_NUM` or `BUILD_BUILDNUMBER` or `CI_PIPELINE_IID` env.\n   */\n  readonly buildNumber?: string | null\n\n  /**\n   * The build version. Maps to the `CFBundleVersion` on macOS, and `FileVersion` metadata property on Windows. Defaults to the `version`.\n   * If `buildVersion` is not defined and `buildNumber` (or one of the `buildNumber` envs) is defined, it will be used as a build version (`version.buildNumber`).\n   */\n  readonly buildVersion?: string | null\n\n  /**\n   * Whether to download the alternate FFmpeg library from Electron's release assets and replace the default FFmpeg library prior to signing\n   */\n  readonly downloadAlternateFFmpeg?: boolean\n\n  /**\n   * Inject properties to `package.json`.\n   */\n  readonly extraMetadata?: any\n\n  /**\n   * Whether to fail if the application is not signed (to prevent unsigned app if code signing configuration is not correct).\n   * @default false\n   */\n  readonly forceCodeSigning?: boolean\n\n  /**\n   * Whether to include PDB files.\n   * @default false\n   */\n  readonly includePdb?: boolean\n\n  /**\n   * Whether to remove `scripts` field from `package.json` files.\n   *\n   * @default true\n   */\n  readonly removePackageScripts?: boolean\n\n  /**\n   * Whether to remove `keywords` field from `package.json` files.\n   *\n   * @default true\n   */\n  readonly removePackageKeywords?: boolean\n\n  /**\n   * Options to pass to `@electron/fuses`\n   * Ref: https://github.com/electron/fuses\n   */\n  readonly electronFuses?: FuseOptionsV1 | null\n\n  /**\n   * [Experimental] Configuration for concurrent builds.\n   */\n  readonly concurrency?: Concurrency | null\n}\n\nexport interface Configuration extends CommonConfiguration, PlatformSpecificBuildOptions, Hooks {\n  /**\n   * Whether to use [electron-compile](http://github.com/electron/electron-compile) to compile app. Defaults to `true` if `electron-compile` in the dependencies. And `false` if in the `devDependencies` or doesn't specified.\n   * @deprecated `electron-compile` is no longer maintained. Compile your app with a modern bundler (webpack, vite, etc.) instead.\n   */\n  readonly electronCompile?: boolean\n\n  /**\n   * The [electron-download](https://github.com/electron-userland/electron-download#usage) options. (legacy)\n   * Alternatively, you can use [electron/get](https://github.com/electron/get#usage) options.\n   *\n   * `checksums` (a map of artifact file name → SHA-256 hex) makes checksum validation fully offline —\n   * without it, `@electron/get` fetches `SHASUMS256.txt` from the network on every build, even when the\n   * artifact itself is already cached. When `checksums` is not configured, electron-builder automatically\n   * picks up a locally seeded `SHASUMS256.txt-<version>` (or `SHASUMS256.txt`) file at the root of the\n   * Electron cache directory. See the\n   * [air-gapped / offline builds guide](https://www.electron.build/tutorials/offline-air-gapped-builds).\n   */\n  readonly electronDownload?: ElectronDownloadOptions | ElectronGetOptions | null\n\n  /**\n   * The branding used by Electron's distributables. This is needed if a fork has modified Electron's BRANDING.json file.\n   */\n  readonly electronBranding?: ElectronBrandingOptions\n\n  /**\n   * The version of electron you are packaging for. Defaults to version of `electron`, `electron-prebuilt` or `electron-prebuilt-compile` dependency.\n   */\n  electronVersion?: string | null\n\n  /**\n   * The name of a built-in configuration preset (currently, only `react-cra` is supported) or any number of paths to config files (relative to project dir).\n   *\n   * The latter allows to mixin a config from multiple other configs, as if you `Object.assign` them, but properly combine `files` glob patterns.\n   *\n   * If `react-scripts` in the app dependencies, `react-cra` will be set automatically. Set to `null` to disable automatic detection.\n   */\n  extends?: Array<string> | string | null\n\n  /**\n   * *libui-based frameworks only* The version of NodeJS you are packaging for.\n   * You can set it to `current` to set the Node.js version that you use to run.\n   * @deprecated libui-based frameworks (proton-native, etc.) are no longer actively maintained. This option has no effect when using Electron.\n   */\n  readonly nodeVersion?: string | null\n\n  /**\n   * *libui-based frameworks only* The version of LaunchUI you are packaging for. Applicable for Windows only. Defaults to version suitable for used framework version.\n   * @deprecated libui-based frameworks (proton-native, etc.) are no longer actively maintained. This option has no effect when using Electron.\n   */\n  readonly launchUiVersion?: boolean | string | null\n\n  /**\n   * The framework name. One of `electron`, `proton`, `libui`. Defaults to `electron`.\n   * @deprecated `proton` and `libui` framework support is no longer actively maintained. Use `electron` (the default).\n   */\n  readonly framework?: string | null\n\n  /**\n   * Whether to disable sanity check asar package (useful for custom electron forks that implement their own encrypted integrity validation)\n   * @default false\n   */\n  readonly disableSanityCheckAsar?: boolean\n\n  /**\n   * Whether to skip ASAR integrity hash computation. Useful for custom electron forks with encrypted ASAR support where the header is not readable by standard tools.\n   * @default false\n   */\n  readonly disableAsarIntegrity?: boolean\n}\n\nexport type Hook<T, V> = (contextOrPath: T) => Promise<V> | V\n\nexport interface PackContext {\n  readonly outDir: string\n  readonly appOutDir: string\n  readonly packager: PlatformPackager<any>\n  readonly electronPlatformName: string\n  readonly arch: Arch\n  readonly targets: Array<Target>\n}\nexport type AfterPackContext = PackContext\nexport type BeforePackContext = PackContext\nexport type AfterExtractContext = PackContext\n\n/**\n * Configuration of toolsets utilized by electron-builder\n */\nexport interface ToolsetConfig {\n  /**\n   * `win-codesign` version to use for signing Windows artifacts.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=win-codesign&expanded=true\n   *\n   * Stable:\n   * v0.0.0 (winCodeSign)\n   *\n   * Beta:\n   * Windows Kits 10.0.26100.0\n   * v1.0.0, v1.1.0\n   *\n   * @default \"0.0.0\"\n   */\n  readonly winCodeSign?: \"0.0.0\" | \"1.0.0\" | \"1.1.0\" | null\n\n  /**\n   * `appimage` bundle version to use for Appimage packaging and runtime.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=appimage&expanded=true\n   * 0.0.0 - legacy toolset (appimage)\n   *\n   * Betas:\n   * 1.0.2 - Runtime 20251108\n   * 1.0.3 - Runtime 20251108 (Resolves GH issue #9598)\n   *\n   * @default \"0.0.0\"\n   */\n  readonly appimage?: \"0.0.0\" | \"1.0.2\" | \"1.0.3\" | null\n\n  /**\n   * `nsis` bundle version to use for NSIS installer compilation.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=nsis&expanded=true\n   * 0.0.0 - legacy toolset (nsis-3.0.4.1 + nsis-resources-3.4.1)\n   *\n   * Betas:\n   * 1.2.1 - unified bundle (makensis 3.12 + plugins in one archive, entrypoint scripts auto-set NSISDIR)\n   *\n   * @default \"0.0.0\"\n   */\n  readonly nsis?: \"0.0.0\" | \"1.2.1\" | null\n\n  /**\n   * `wine` bundle version to use for running Windows tools on non-Windows platforms.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=wine&expanded=true\n   * 0.0.0 - legacy toolset (wine 4.0.1 portable; mac-only support)\n   *\n   * Beta:\n   * 1.0.1 - Wine 11 bundle (unified wine binary, ia32 via WoW64)\n   *\n   * @default \"0.0.0\"\n   */\n  readonly wine?: \"0.0.0\" | \"1.0.1\" | null\n}\n\nexport interface Hooks {\n  /**\n   * The function (or path to file or module id) to be run before pack.\n   * Receives a {@link BeforePackContext}.\n   *\n   * Can be specified inline as a function in JavaScript configs:\n   * ```js\n   * // electron-builder.config.js\n   * module.exports = {\n   *   beforePack: async (context) => {\n   *     // your code\n   *   }\n   * }\n   * ```\n   *\n   * Or as a path to a module that exports the function as its default export:\n   * ```json\n   * { \"build\": { \"beforePack\": \"./myBeforePackHook.js\" } }\n   * ```\n   * ```js\n   * // myBeforePackHook.js\n   * exports.default = async function(context) {\n   *   // your custom code\n   * }\n   * ```\n   */\n  readonly beforePack?: Hook<BeforePackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after the prebuilt Electron binary has been extracted to the output directory.\n   * Receives an {@link AfterExtractContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterExtract?: Hook<AfterExtractContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after pack but before pack into distributable format and sign.\n   * Receives an {@link AfterPackContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterPack?: Hook<AfterPackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after pack and sign but before pack into distributable format.\n   * Receives an {@link AfterPackContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterSign?: Hook<AfterPackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run when an individual artifact build starts.\n   * Receives an {@link ArtifactBuildStarted}. For file/module setup, see {@link beforePack}.\n   */\n  readonly artifactBuildStarted?: Hook<ArtifactBuildStarted, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run when an individual artifact build completes.\n   * Receives an {@link ArtifactCreated}. For file/module setup, see {@link beforePack}.\n   */\n  readonly artifactBuildCompleted?: Hook<ArtifactCreated, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run after all artifacts are built.\n   * Receives a {@link BuildResult}. May return an array of additional file paths to publish.\n   *\n   * For file/module setup, see {@link beforePack}.\n   *\n   * @example\n   * ```js\n   * exports.default = function () {\n   *   // return additional files to publish\n   *   return [\"/path/to/additional/result/file\"]\n   * }\n   * ```\n   */\n  readonly afterAllArtifactBuild?: Hook<BuildResult, Array<string>> | string | null\n  /**\n   * The function (or path to file or module id) to be run after MSI project created on disk - not packed into .msi package yet.\n   */\n  readonly msiProjectCreated?: Hook<string, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run after Appx manifest created on disk - not packed into .appx package yet.\n   */\n  readonly appxManifestCreated?: Hook<string, void> | string | null\n  /**\n   * The function (or path to file or module id) to be [run on each node module](#onnodemodulefile) file. Returning `true`/`false` will determine whether to force include or to use the default copier logic\n   */\n  readonly onNodeModuleFile?: Hook<string, void | boolean> | string | null\n  /**\n   * The function (or path to file or module id) to be run before dependencies are installed or rebuilt. Works when `npmRebuild` is set to `true`. Resolving to `false` will skip dependencies install or rebuild.\n   *\n   * If provided and `node_modules` are missing, it will not invoke production dependencies check.\n   */\n  readonly beforeBuild?: Hook<BeforeBuildContext, boolean | void> | string | null\n  /**\n   * The function (or path to file or module id) to be run when staging the electron artifact environment.\n   * Returns the path to custom Electron build (e.g. `~/electron/out/R`) or folder of electron zips.\n   *\n   * Zip files must follow the pattern `electron-v${version}-${platformName}-${arch}.zip`, otherwise it will be assumed to be an unpacked Electron app directory\n   */\n  readonly electronDist?: Hook<PrepareApplicationStageDirectoryOptions, string> | string | null\n}\n\nexport interface MetadataDirectories {\n  /**\n   * The path to build resources.\n   *\n   * Please note — build resources are not packed into the app. If you need to use some files, e.g. as tray icon, please include required files explicitly: `\"files\": [\"**\\/*\", \"build/icon.*\"]`\n   * @default build\n   */\n  readonly buildResources?: string | null\n\n  /**\n   * The output directory. [File macros](https://www.electron.build/file-patterns#file-macros) are supported.\n   * @default dist\n   */\n  readonly output?: string | null\n\n  /**\n   * The application directory (containing the application package.json), defaults to `app`, `www` or working directory.\n   */\n  readonly app?: string | null\n}\n\n/**\n * All options come from [@electron/fuses](https://github.com/electron/fuses)\n * Ref: https://raw.githubusercontent.com/electron/electron/refs/heads/main/docs/tutorial/fuses.md\n */\nexport interface FuseOptionsV1 {\n  /**\n   *The runAsNode fuse toggles whether the `ELECTRON_RUN_AS_NODE` environment variable is respected or not.  Please note that if this fuse is disabled then `process.fork` in the main process will not function as expected as it depends on this environment variable to function. Instead, we recommend that you use [Utility Processes](https://github.com/electron/electron/blob/main/docs/api/utility-process.md), which work for many use cases where you need a standalone Node.js process (like a Sqlite server process or similar scenarios).\n   */\n  runAsNode?: boolean\n  /**\n   * The cookieEncryption fuse toggles whether the cookie store on disk is encrypted using OS level cryptography keys.  By default the sqlite database that Chromium uses to store cookies stores the values in plaintext.  If you wish to ensure your apps cookies are encrypted in the same way Chrome does then you should enable this fuse.  Please note it is a one-way transition, if you enable this fuse existing unencrypted cookies will be encrypted-on-write but if you then disable the fuse again your cookie store will effectively be corrupt and useless.  Most apps can safely enable this fuse.\n   */\n  enableCookieEncryption?: boolean\n  /**\n   * The nodeOptions fuse toggles whether the [`NODE_OPTIONS`](https://nodejs.org/api/cli.html#node_optionsoptions)  and [`NODE_EXTRA_CA_CERTS`](https://github.com/nodejs/node/blob/main/doc/api/cli.md#node_extra_ca_certsfile) environment variables are respected.  The `NODE_OPTIONS` environment variable can be used to pass all kinds of custom options to the Node.js runtime and isn't typically used by apps in production.  Most apps can safely disable this fuse.\n   */\n  enableNodeOptionsEnvironmentVariable?: boolean\n  /**\n   * The nodeCliInspect fuse toggles whether the `--inspect`, `--inspect-brk`, etc. flags are respected or not.  When disabled it also ensures that `SIGUSR1` signal does not initialize the main process inspector.  Most apps can safely disable this fuse.\n   */\n  enableNodeCliInspectArguments?: boolean\n  /**\n   * The embeddedAsarIntegrityValidation fuse toggles an experimental feature on macOS that validates the content of the `app.asar` file when it is loaded.  This feature is designed to have a minimal performance impact but may marginally slow down file reads from inside the `app.asar` archive.\n   * Currently, ASAR integrity checking is supported on:\n   *\n   *  - macOS as of electron>=16.0.0\n   *  - Windows as of electron>=30.0.0\n   *\n   * For more information on how to use asar integrity validation please read the [Asar Integrity](https://github.com/electron/electron/blob/main/docs/tutorial/asar-integrity.md) documentation.\n   */\n  enableEmbeddedAsarIntegrityValidation?: boolean\n  /**\n   * The onlyLoadAppFromAsar fuse changes the search system that Electron uses to locate your app code.  By default Electron will search in the following order `app.asar` -> `app` -> `default_app.asar`.  When this fuse is enabled the search order becomes a single entry `app.asar` thus ensuring that when combined with the `embeddedAsarIntegrityValidation` fuse it is impossible to load non-validated code.\n   */\n  onlyLoadAppFromAsar?: boolean\n  /**\n   * The loadBrowserProcessSpecificV8Snapshot fuse changes which V8 snapshot file is used for the browser process.  By default Electron's processes will all use the same V8 snapshot file.  When this fuse is enabled the browser process uses the file called `browser_v8_context_snapshot.bin` for its V8 snapshot. The other processes will use the V8 snapshot file that they normally do.\n   */\n  loadBrowserProcessSpecificV8Snapshot?: boolean\n  /**\n   * The grantFileProtocolExtraPrivileges fuse changes whether pages loaded from the `file://` protocol are given privileges beyond what they would receive in a traditional web browser.  This behavior was core to Electron apps in original versions of Electron but is no longer required as apps should be [serving local files from custom protocols](https://github.com/electron/electron/blob/main/docs/tutorial/security.md#18-avoid-usage-of-the-file-protocol-and-prefer-usage-of-custom-protocols) now instead.  If you aren't serving pages from `file://` you should disable this fuse.\n   * The extra privileges granted to the `file://` protocol by this fuse are incompletely documented below:\n   *\n   *  - `file://` protocol pages can use `fetch` to load other assets over `file://`\n   *  - `file://` protocol pages can use service workers\n   *  - `file://` protocol pages have universal access granted to child frames also running on `file://` protocols regardless of sandbox settings\n   */\n  grantFileProtocolExtraPrivileges?: boolean\n  /**\n   * Resets the app signature, specifically used for macOS.\n   * Note: This should be unneeded since electron-builder signs the app directly after flipping the fuses.\n   * Ref: https://github.com/electron/fuses?tab=readme-ov-file#apple-silicon\n   */\n  resetAdHocDarwinSignature?: boolean\n}\n\nexport interface Concurrency {\n  /**\n   * The maximum number of concurrent jobs to run.\n   * @default 1\n   */\n  jobs: number\n}\n"]}

package/out/electron/ElectronFramework.d.ts

@@ -1,5 +1,5 @@
 import { Configuration } from "../configuration";
-import { BeforeCopyExtraFilesOptions, Framework } from "../Framework";
+import { BeforeCopyExtraFilesOptions, Framework, PrepareApplicationStageDirectoryOptions } from "../Framework";
 import { Packager } from "../index";
 import { ElectronDownloadOptions } from "../util/electronGet";
 export { ElectronDownloadOptions };
@@ -15,3 +15,4 @@ export interface ElectronBrandingOptions {
 export declare function createBrandingOpts(opts: Configuration): Required<ElectronBrandingOptions>;
 export declare function removeUnusedLanguagesIfNeeded(options: BeforeCopyExtraFilesOptions): Promise<void>;
 export declare function createElectronFrameworkSupport(configuration: Configuration, packager: Packager): Promise<Framework>;
+export declare function cleanupAfterUnpack(prepareOptions: PrepareApplicationStageDirectoryOptions, distMacOsAppName: string, isFullCleanup: boolean): Promise<[void, void, void]>;

package/out/electron/ElectronFramework.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createBrandingOpts = createBrandingOpts;
 exports.removeUnusedLanguagesIfNeeded = removeUnusedLanguagesIfNeeded;
 exports.createElectronFrameworkSupport = createElectronFrameworkSupport;
+exports.cleanupAfterUnpack = cleanupAfterUnpack;
 const builder_util_1 = require("builder-util");
 const fs_extra_1 = require("fs-extra");
 const path = require("path");
@@ -237,11 +238,18 @@ function cleanupAfterUnpack(prepareOptions, distMacOsAppName, isFullCleanup) {
     return Promise.all([
         isFullCleanup ? (0, builder_util_1.unlinkIfExists)(path.join(resourcesPath, "default_app.asar")) : Promise.resolve(),
         isFullCleanup ? (0, builder_util_1.unlinkIfExists)(path.join(out, "version")) : Promise.resolve(),
-        isMac
-            ? Promise.resolve()
-            : (0, fs_extra_1.rename)(path.join(out, "LICENSE"), path.join(out, "LICENSE.electron.txt")).catch(() => {
-                /* ignore */
-            }),
+        retainElectronLicenseFiles(out, resourcesPath, isMac),
     ]);
 }
+/**
+ * The Electron dist ships Electron's own `LICENSE` and Chromium's `LICENSES.chromium.html` next to the binary, and both licenses require them to be
+ * retained in distributables. On win/linux they stay next to the executable, but on macOS they sit outside the `.app` bundle, which is the only thing
+ * packaged into the artifacts, so move them into `Contents/Resources`. See https://github.com/electron-userland/electron-builder/issues/9407
+ */
+async function retainElectronLicenseFiles(appOutDir, resourcesPath, isMac) {
+    const destinationDir = isMac ? resourcesPath : appOutDir;
+    // a custom Electron distribution may not ship license files, so only a missing source file is tolerated; any other error propagates
+    const move = (name, newName = name) => (0, builder_util_1.orIfFileNotExist)((0, fs_extra_1.rename)(path.join(appOutDir, name), path.join(destinationDir, newName)), undefined);
+    await Promise.all([move("LICENSE", "LICENSE.electron.txt"), ...(isMac ? [move("LICENSES.chromium.html")] : [])]);
+}
 //# sourceMappingURL=ElectronFramework.js.map