app-builder-lib 27.0.0-alpha.1 → 27.0.0-alpha.3

package/dist/options/macOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"macOptions.js","sourceRoot":"","sources":["../../src/options/macOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { TargetConfiguration, TargetSpecificOptions } from \"../core.js\"\nimport { PlatformSpecificBuildOptions } from \"./PlatformSpecificBuildOptions.js\"\nimport { CustomMacSign } from \"../macPackager.js\"\n\nexport type MacOsTargetName = \"default\" | \"dmg\" | \"mas\" | \"mas-dev\" | \"pkg\" | \"7z\" | \"zip\" | \"tar.xz\" | \"tar.lz\" | \"tar.gz\" | \"tar.bz2\" | \"dir\"\n\nexport interface MacConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The application category type, as shown in the Finder via *View -> Arrange by Application Category* when viewing the Applications directory.\n   *\n   * For example, `\"category\": \"public.app-category.developer-tools\"` will set the application category to *Developer Tools*.\n   *\n   * Valid values are listed in [Apple's documentation](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/LaunchServicesKeys.html#//apple_ref/doc/uid/TP40009250-SW8).\n   */\n  readonly category?: string | null\n\n  /**\n   * The target package type: list of `default`, `dmg`, `mas`, `mas-dev`, `pkg`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * Note: Squirrel.Mac auto update mechanism requires both `dmg` and `zip` to be enabled, even when only `dmg` is used. Disabling `zip` will break auto update in `dmg` packages.\n   * @default default (dmg and zip for Squirrel.Mac)\n   */\n  readonly target?: Array<MacOsTargetName | TargetConfiguration> | MacOsTargetName | TargetConfiguration | null\n\n  /**\n   * The signing identity (certificate name) to use when signing. Consider using environment variables [CSC_LINK or CSC_NAME](https://www.electron.build/code-signing) instead of specifying this option.\n   * MAS installer identity is specified in the [mas](https://www.electron.build/mas).\n   *\n   * - **Not set** (default): electron-builder searches the keychain for a valid signing certificate. If none is found, signing is skipped for all architectures — there is no automatic ad-hoc fallback.\n   * - **`null`**: skip signing entirely.\n   * - **`\"-\"`**: opt in to ad-hoc signing explicitly. Note that `hardenedRuntime: true` (the default) combined with ad-hoc signing requires\n   *   the [`com.apple.security.cs.disable-library-validation`](https://developer.apple.com/documentation/BundleResources/Entitlements/com.apple.security.cs.disable-library-validation)\n   *   entitlement to prevent app launch failures; otherwise set `hardenedRuntime: false`.\n   */\n  readonly identity?: string | null\n\n  /**\n   * The path to application icon.\n   * Accepts `.icns` (legacy) or `.icon` (Icon Composer asset).\n   * If a `.icon` asset is provided, it will be preferred and compiled to an asset catalog.\n   * @default build/icon.icns\n   */\n  readonly icon?: string | null\n\n  /**\n   * The path to entitlements file for signing the app. `build/entitlements.mac.plist` will be used if exists (it is a recommended way to set).\n   * MAS entitlements is specified in the [mas](https://www.electron.build/mas).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   * Be aware that your app may crash if the right entitlements are not set like `com.apple.security.cs.allow-jit` for example on arm64 builds with Electron 20+.\n   * See [Signing and Notarizing macOS Builds from the Electron documentation](https://www.electronjs.org/docs/latest/tutorial/code-signing#signing--notarizing-macos-builds) for more information.\n   */\n  readonly entitlements?: string | null\n\n  /**\n   * The path to child entitlements which inherit the security settings for signing frameworks and bundles of a distribution. `build/entitlements.mac.inherit.plist` will be used if exists (it is a recommended way to set).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   *\n   * This option only applies when signing with `entitlements` provided.\n   */\n  readonly entitlementsInherit?: string | null\n\n  /**\n   * Path to login helper entitlement file.\n   * When using App Sandbox, the the `com.apple.security.inherit` key that is normally in the inherited entitlements cannot be inherited since the login helper is a standalone executable.\n   * Defaults to the value provided for `entitlements`. This option only applies when signing with `entitlements` provided.\n   */\n  readonly entitlementsLoginHelper?: string | null\n\n  /**\n   * The path to the provisioning profile to use when signing, absolute or relative to the app root.\n   */\n  readonly provisioningProfile?: string | null\n\n  /**\n   * The `CFBundleVersion`. Do not use it unless [you need to](https://github.com/electron-userland/electron-builder/issues/565#issuecomment-230678643).\n   */\n  readonly bundleVersion?: string | null\n\n  /**\n   * The `CFBundleShortVersionString`. Do not use it unless you need to.\n   */\n  readonly bundleShortVersion?: string | null\n\n  /**\n   * Whether a dark mode is supported. If your app does have a dark mode, you can make your app follow the system-wide dark mode setting.\n   * @default false\n   */\n  readonly darkModeSupport?: boolean\n\n  /**\n   * The bundle identifier to use in the application helper's plist.\n   * @default ${appBundleIdentifier}.helper\n   */\n  readonly helperBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Renderer helper's plist.\n   * @default ${appBundleIdentifier}.helper.Renderer\n   */\n  readonly helperRendererBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Plugin helper's plist.\n   * @default ${appBundleIdentifier}.helper.Plugin\n   */\n  readonly helperPluginBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the GPU helper's plist.\n   * @default ${appBundleIdentifier}.helper.GPU\n   */\n  readonly helperGPUBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the EH helper's plist.\n   * @default ${appBundleIdentifier}.helper.EH\n   */\n  readonly helperEHBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the NP helper's plist.\n   * @default ${appBundleIdentifier}.helper.NP\n   */\n  readonly helperNPBundleId?: string | null\n\n  /**\n   * Whether to sign app for development or for distribution.\n   * @default distribution\n   */\n  readonly type?: \"distribution\" | \"development\" | null\n\n  /**\n   * The extra entries for `Info.plist`.\n   */\n  readonly extendInfo?: any\n\n  /**\n   * Paths of any extra binaries that need to be signed.\n   */\n  readonly binaries?: Array<string> | null\n\n  /**\n   * The minimum version of macOS required for the app to run. Corresponds to `LSMinimumSystemVersion`.\n   */\n  readonly minimumSystemVersion?: string | null\n\n  /**\n   * Path of [requirements file](https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/RequirementLang/RequirementLang.html) used in signing. Not applicable for MAS.\n   */\n  readonly requirements?: string | null\n\n  /** @private */\n  readonly cscInstallerLink?: string | null\n  /** @private */\n  readonly cscInstallerKeyPassword?: string | null\n\n  /**\n   * Extra files to put in archive. Not applicable for `tar.*`.\n   */\n  readonly extraDistFiles?: Array<string> | string | null\n\n  /**\n   * Whether your app has to be signed with hardened runtime.\n   *\n   * When using ad-hoc signing (`identity: \"-\"`), hardened runtime enforces library validation which\n   * will reject pre-signed Electron frameworks that carry a different Team ID. To resolve this either\n   * set `hardenedRuntime: false` or add the\n   * [`com.apple.security.cs.disable-library-validation`](https://developer.apple.com/documentation/BundleResources/Entitlements/com.apple.security.cs.disable-library-validation)\n   * entitlement to your entitlements file.\n   * @default true\n   */\n  readonly hardenedRuntime?: boolean\n\n  /**\n   * Whether to let `@electron/osx-sign` validate the signing or not.\n   * @default false\n   */\n  readonly gatekeeperAssess?: boolean\n\n  /**\n   * Whether to let `@electron/osx-sign` verify the contents or not.\n   * @default true\n   */\n  readonly strictVerify?: boolean\n\n  /**\n   * Whether to enable entitlements automation from `@electron/osx-sign`.\n   * @default true\n   */\n  readonly preAutoEntitlements?: boolean\n\n  /**\n   * Regex or an array of regex's that signal skipping signing a file.\n   */\n  readonly signIgnore?: Array<string> | string | null\n\n  /**\n   * The custom function (or path to file or module id) to sign an app bundle.\n   */\n  readonly sign?: CustomMacSign | string | null\n\n  /**\n   * Specify the URL of the timestamp authority server\n   */\n  readonly timestamp?: string | null\n\n  /**\n   * Whether to merge ASAR files for different architectures or not.\n   *\n   * This option has no effect unless building for \"universal\" arch.\n   * @default true\n   */\n  readonly mergeASARs?: boolean\n\n  /**\n   * Minimatch pattern of paths that are allowed to be present in one of the\n   * ASAR files, but not in the other.\n   *\n   * This option has no effect unless building for \"universal\" arch and applies\n   * only if `mergeASARs` is `true`.\n   */\n  readonly singleArchFiles?: string | null\n\n  /**\n   * Minimatch pattern of paths that are allowed to be x64 binaries in both\n   * ASAR files\n   *\n   * This option has no effect unless building for \"universal\" arch and applies\n   * only if `mergeASARs` is `true`.\n   */\n  readonly x64ArchFiles?: string | null\n\n  /**\n   * Array of strings specifying additional arguments to pass to the `codesign` command used to sign a specific file.\n   *\n   * Some subresources that you may include in your Electron app may need to be signed with --deep, this is not typically safe to apply to the entire Electron app and therefore should be applied to just your file.\n   * Usage Example: `['--deep']`\n   */\n  readonly additionalArguments?: Array<string> | null\n\n  /**\n   * Whether to disable electron-builder's [@electron/notarize](https://github.com/electron/notarize) integration.\n   *\n   * Note: In order to activate the notarization step You MUST specify one of the following via environment variables:\n   *\n   * 1. `APPLE_API_KEY`, `APPLE_API_KEY_ID` and `APPLE_API_ISSUER`.\n   * 2. `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, and `APPLE_TEAM_ID`\n   * 3. `APPLE_KEYCHAIN` and `APPLE_KEYCHAIN_PROFILE`\n   *\n   * For security reasons it is recommended to use the first option (see https://github.com/electron-userland/electron-builder/issues/7859)\n   */\n  readonly notarize?: boolean\n}\n\nexport interface DmgOptions extends TargetSpecificOptions {\n  /**\n   * The path to background image (default: `build/background.tiff` or `build/background.png` if exists). The resolution of this file determines the resolution of the installer window.\n   * If background is not specified, use `window.size`. Default locations expected background size to be 540x380.\n   * @see [DMG with Retina background support](http://stackoverflow.com/a/11204769/1910191).\n   */\n  background?: string | null\n\n  /**\n   * The background color (accepts css colors). Used when no background image is set.\n   * @default #ffffff\n   */\n  backgroundColor?: string | null\n\n  /**\n   * The path to DMG icon (badge icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   */\n  badgeIcon?: string | null\n\n  /**\n   * The path to DMG icon (volume icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   * Defaults to the application icon (`build/icon.icns`).\n   */\n  icon?: string | null\n\n  /**\n   * The size of all the icons inside the DMG.\n   * @default 80\n   */\n  readonly iconSize?: number | null\n\n  /**\n   * The size of all the icon texts inside the DMG.\n   * @default 12\n   */\n  readonly iconTextSize?: number | null\n\n  /**\n   * The title of the produced DMG, which will be shown when mounted (volume name).\n   *\n   * Macro `${productName}`, `${version}` and `${name}` are supported.\n   * @default ${productName} ${version}\n   */\n  readonly title?: string | null\n\n  /**\n   * The content — to customize icon locations. The x and y coordinates refer to the position of the **center** of the icon (at 1x scale), and do not take the label into account.\n   */\n  contents?: Array<DmgContent>\n\n  /**\n   * The disk image format. `ULFO` (lzfse-compressed image (OS X 10.11+ only)).\n   * @default UDZO\n   */\n  format?: \"UDRW\" | \"UDRO\" | \"UDCO\" | \"UDZO\" | \"UDBZ\" | \"ULFO\"\n\n  /**\n   * The filesystem for the DMG volume (e.g. `\"APFS\"` or `\"HFS+\"`)\n   * This will be changed to APFS in the next major release, so it is recommended to set it explicitly to HFS+ if you want to keep using HFS+ (e.g. for better compatibility with older macOS versions).\n   * @default HFS+\n   */\n  readonly filesystem?: \"HFS+\" | \"APFS\" | null\n\n  /**\n   * The initial size of the DMG filesystem. Accepts the same syntax as the `-size` argument to `hdiutil`, e.g. `\"150m\"`, `\"4g\"`.\n   * If not specified, the size is calculated automatically.\n   * Set this explicitly for large apps or apps with sparse files to avoid \"No space left on device\" errors.\n   */\n  readonly size?: string | null\n\n  /**\n   * Whether to shrink the DMG filesystem to the minimum size after copying files.\n   * Set to `false` to preserve the explicit `size` you specified.\n   * @default true\n   */\n  readonly shrink?: boolean\n\n  /**\n   * The DMG window position and size. With y co-ordinates running from bottom to top.\n   *\n   * The Finder makes sure that the window will be on the user’s display, so if you want your window at the top left of the display you could use `\"x\": 0, \"y\": 100000` as the x, y co-ordinates.\n   * It is not to be possible to position the window relative to the [top left](https://github.com/electron-userland/electron-builder/issues/3990#issuecomment-512960957) or relative to the center of the user’s screen.\n   */\n  window?: DmgWindow\n\n  /**\n   * Whether to create internet-enabled disk image (when it is downloaded using a browser it will automatically decompress the image, put the application on the desktop, unmount and remove the disk image file).\n   * @default false\n   */\n  readonly internetEnabled?: boolean\n\n  /**\n   * Whether to sign the DMG or not. Signing is not required and will lead to unwanted errors in combination with notarization requirements.\n   * @default false\n   */\n  readonly sign?: boolean\n\n  /**\n   * License agreement to display when the DMG is mounted.\n   *\n   * Accepts a single file path (`.rtf`, `.txt`, or `.html`) used as the English/default license,\n   * or a language-code → file-path map for multi-language builds.\n   *\n   * When set, this takes precedence over the file-naming convention\n   * (`license_en.txt`, etc. in the build resources directory).\n   * Paths are resolved relative to the build resources directory or project root.\n   *\n   * @example Single language\n   * ```yaml\n   * dmg:\n   *   license: \"build/license.rtf\"\n   * ```\n   *\n   * @example Multi-language\n   * ```yaml\n   * dmg:\n   *   license:\n   *     en_US: \"build/license.rtf\"\n   *     de_DE: \"build/license_de.txt\"\n   *     ja_JP: \"build/license_ja.txt\"\n   * ```\n   *\n   * If not set, electron-builder scans the build resources directory for\n   * `license_LANG.{rtf,txt,html}` files automatically.\n   */\n  license?: string | Record<string, string> | null\n\n  /**\n   * @private\n   * @default true\n   */\n  writeUpdateInfo?: boolean\n}\n\nexport interface DmgWindow {\n  /**\n   * The X position relative to left of the screen.\n   * @default 400\n   */\n  x?: number\n\n  /**\n   * The Y position relative to bottom of the screen.\n   * @default 100\n   */\n  y?: number\n\n  /**\n   * The width. Defaults to background image width or 540.\n   */\n  width?: number\n\n  /**\n   * The height. Defaults to background image height or 380.\n   */\n  height?: number\n}\n\nexport interface DmgContent {\n  /**\n   * The device-independent pixel offset from the left of the window to the **center** of the icon.\n   */\n  x: number\n  /**\n   * The device-independent pixel offset from the top of the window to the **center** of the icon.\n   */\n  y: number\n  type?: \"link\" | \"file\" | \"dir\"\n\n  /**\n   * The name of the file within the DMG. Defaults to basename of `path`.\n   */\n  name?: string\n\n  /**\n   * The path of the file within the DMG.\n   */\n  path?: string\n}\n\nexport interface MasConfiguration extends MacConfiguration {\n  /**\n   * The path to entitlements file for signing the app. `build/entitlements.mas.plist` will be used if exists (it is a recommended way to set).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   * Be aware that your app may crash if the right entitlements are not set like `com.apple.security.cs.allow-jit` for example on arm64 builds with Electron 20+.\n   * See [Signing and Notarizing macOS Builds from the Electron documentation](https://www.electronjs.org/docs/latest/tutorial/code-signing#signing--notarizing-macos-builds) for more information.\n   */\n  readonly entitlements?: string | null\n\n  /**\n   * The path to child entitlements which inherit the security settings for signing frameworks and bundles of a distribution. `build/entitlements.mas.inherit.plist` will be used if exists (it is a recommended way to set).\n   * See [this folder in osx-sign's repository](https://github.com/electron/osx-sign/tree/main/entitlements) for examples.\n   */\n  readonly entitlementsInherit?: string | null\n\n  /**\n   * Paths of any extra binaries that need to be signed.\n   */\n  readonly binaries?: Array<string> | null\n}\n"]}
+{"version":3,"file":"macOptions.js","sourceRoot":"","sources":["../../src/options/macOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { TargetConfiguration, TargetSpecificOptions } from \"../core.js\"\nimport { PlatformSpecificBuildOptions } from \"./PlatformSpecificBuildOptions.js\"\nimport { CustomMacSign } from \"../macPackager.js\"\nimport type { OnlySignOptions } from \"@electron/osx-sign\"\nimport type { MakeUniversalOpts } from \"@electron/universal\"\n\n/**\n * Options forwarded to `@electron/universal`'s `makeUniversalApp`.\n * Electron-builder fills in the app paths and `force`; everything else is configurable here\n * and auto-tracks upstream additions to `MakeUniversalOpts`.\n *\n * @see https://github.com/electron/universal\n */\nexport interface ElectronUniversalOptions extends Omit<MakeUniversalOpts, \"x64AppPath\" | \"arm64AppPath\" | \"outAppPath\" | \"force\"> {\n  /**\n   * Whether to merge x64 and arm64 ASARs into one.\n   *\n   * @default true\n   */\n  mergeASARs?: boolean\n}\n\n/**\n * Signing options passed to `@electron/osx-sign`. Electron-builder owns the fields it must control\n * itself — `app`, `keychain`, `platform`, `version`, `optionsForFile`, and `type` (derived from the\n * build flavor: `mas-dev` → `development`, otherwise `distribution`) — and forwards everything else.\n *\n * Additionally exposes a small set of per-file convenience fields that electron-builder maps\n * internally through `optionsForFile`.\n *\n * @see https://packages.electronjs.org/osx-sign\n */\nexport interface ElectronSignOptions extends Omit<OnlySignOptions, \"optionsForFile\" | \"version\" | \"type\"> {\n  /**\n   * The signing identity (certificate name or SHA-1 hash). Applies to both app signing and DMG signing.\n   * Prefer the environment variables `CSC_LINK` / `CSC_NAME` over hardcoding this value.\n   *\n   * - **Not set** (default): electron-builder searches the keychain for a valid certificate.\n   * - **`null`**: skip signing entirely.\n   * - **`\"-\"`**: ad-hoc signing (requires disabling library validation — see `hardenedRuntime`).\n   */\n  readonly identity?: string | null\n  /**\n   * Path to the main app entitlements file.\n   * Falls back to `build/entitlements.mac.plist` if it exists, then to `@electron/osx-sign`'s\n   * built-in defaults.\n   */\n  readonly entitlements?: string | null\n  /**\n   * Path to child entitlements inherited by embedded frameworks and bundles.\n   * Falls back to `build/entitlements.mac.inherit.plist` if it exists.\n   */\n  readonly entitlementsInherit?: string | null\n  /**\n   * Path to entitlements for the Login Helper.\n   * Required when using App Sandbox, because the Login Helper cannot inherit entitlements.\n   * Defaults to the value of `entitlements`.\n   */\n  readonly entitlementsLoginHelper?: string | null\n  /**\n   * Whether to enable [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime).\n   *\n   * Hardened Runtime is a prerequisite for notarization (mandatory on macOS 10.15+).\n   * Defaults to `true` for `darwin` builds and `false` for `mas-dev`.\n   *\n   * @see https://github.com/electron/fuses\n   */\n  readonly hardenedRuntime?: boolean\n  /**\n   * Path to a [requirements file](https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/RequirementLang/RequirementLang.html).\n   * Not applicable for MAS.\n   */\n  readonly requirements?: string | null\n  /**\n   * URL of the timestamp authority server. Passed per-file to `codesign --timestamp=<url>`.\n   */\n  readonly timestamp?: string | null\n  /**\n   * Extra arguments passed to each `codesign` invocation.\n   * @example [\"--deep\"]\n   */\n  readonly additionalArguments?: Array<string> | null\n}\n\nexport type MacOsTargetName = \"default\" | \"dmg\" | \"mas\" | \"mas-dev\" | \"pkg\" | \"7z\" | \"zip\" | \"tar.xz\" | \"tar.lz\" | \"tar.gz\" | \"tar.bz2\" | \"dir\"\n\nexport interface MacConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The application category type, as shown in the Finder via *View -> Arrange by Application Category* when viewing the Applications directory.\n   *\n   * For example, `\"category\": \"public.app-category.developer-tools\"` will set the application category to *Developer Tools*.\n   *\n   * Valid values are listed in [Apple's documentation](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/LaunchServicesKeys.html#//apple_ref/doc/uid/TP40009250-SW8).\n   */\n  readonly category?: string | null\n\n  /**\n   * The target package type: list of `default`, `dmg`, `mas`, `mas-dev`, `pkg`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * Note: Squirrel.Mac auto update mechanism requires both `dmg` and `zip` to be enabled, even when only `dmg` is used. Disabling `zip` will break auto update in `dmg` packages.\n   * @default default (dmg and zip for Squirrel.Mac)\n   */\n  readonly target?: Array<MacOsTargetName | TargetConfiguration> | MacOsTargetName | TargetConfiguration | null\n\n  /**\n   * The path to application icon.\n   * Accepts `.icns` (legacy) or `.icon` (Icon Composer asset).\n   * If a `.icon` asset is provided, it will be preferred and compiled to an asset catalog.\n   * @default build/icon.icns\n   */\n  readonly icon?: string | null\n\n  /**\n   * The `CFBundleVersion`. Do not use it unless [you need to](https://github.com/electron-userland/electron-builder/issues/565#issuecomment-230678643).\n   */\n  readonly bundleVersion?: string | null\n\n  /**\n   * The `CFBundleShortVersionString`. Do not use it unless you need to.\n   */\n  readonly bundleShortVersion?: string | null\n\n  /**\n   * Whether a dark mode is supported. If your app does have a dark mode, you can make your app follow the system-wide dark mode setting.\n   * @default false\n   */\n  readonly darkModeSupport?: boolean\n\n  /**\n   * The bundle identifier to use in the application helper's plist.\n   * @default ${appBundleIdentifier}.helper\n   */\n  readonly helperBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Renderer helper's plist.\n   * @default ${appBundleIdentifier}.helper.Renderer\n   */\n  readonly helperRendererBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Plugin helper's plist.\n   * @default ${appBundleIdentifier}.helper.Plugin\n   */\n  readonly helperPluginBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the GPU helper's plist.\n   * @default ${appBundleIdentifier}.helper.GPU\n   */\n  readonly helperGPUBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the EH helper's plist.\n   * @default ${appBundleIdentifier}.helper.EH\n   */\n  readonly helperEHBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the NP helper's plist.\n   * @default ${appBundleIdentifier}.helper.NP\n   */\n  readonly helperNPBundleId?: string | null\n\n  /**\n   * The extra entries for `Info.plist`.\n   */\n  readonly extendInfo?: any\n\n  /**\n   * The minimum version of macOS required for the app to run. Corresponds to `LSMinimumSystemVersion`.\n   */\n  readonly minimumSystemVersion?: string | null\n\n  /** @private */\n  readonly cscInstallerLink?: string | null\n  /** @private */\n  readonly cscInstallerKeyPassword?: string | null\n\n  /**\n   * Extra files to put in archive. Not applicable for `tar.*`.\n   */\n  readonly extraDistFiles?: Array<string> | string | null\n\n  /**\n   * Codesigning configuration. The signing certificate is selected via `sign.identity` (or the\n   * `CSC_LINK` / `CSC_NAME` environment variables).\n   *\n   * - **Not set** (default): electron-builder auto-discovers a valid certificate in the keychain. If none is found, signing is skipped.\n   * - **`null`**: skip signing entirely.\n   * - **`string`**: path or module ID of a file that exports a {@link CustomMacSign} function.\n   * - **{@link CustomMacSign}**: inline custom signing function (JS/TS config only).\n   * - **{@link ElectronSignOptions}**: options forwarded directly to `@electron/osx-sign`.\n   *\n   * @see {@link ElectronSignOptions}\n   * @see https://www.electron.build/code-signing\n   */\n  readonly sign?: CustomMacSign | ElectronSignOptions | string | null\n\n  /**\n   * Options forwarded to `@electron/universal` when building a universal (multi-arch) app.\n   * Has no effect unless the target arch is `universal`.\n   *\n   * @see {@link ElectronUniversalOptions}\n   * @see https://github.com/electron/universal\n   */\n  readonly universal?: ElectronUniversalOptions | null\n\n  /**\n   * Whether to disable electron-builder's [@electron/notarize](https://github.com/electron/notarize) integration.\n   *\n   * Note: In order to activate the notarization step You MUST specify one of the following via environment variables:\n   *\n   * 1. `APPLE_API_KEY`, `APPLE_API_KEY_ID` and `APPLE_API_ISSUER`.\n   * 2. `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, and `APPLE_TEAM_ID`\n   * 3. `APPLE_KEYCHAIN` and `APPLE_KEYCHAIN_PROFILE`\n   *\n   * For security reasons it is recommended to use the first option (see https://github.com/electron-userland/electron-builder/issues/7859)\n   */\n  readonly notarize?: boolean\n}\n\nexport interface DmgOptions extends TargetSpecificOptions {\n  /**\n   * The path to background image (default: `build/background.tiff` or `build/background.png` if exists). The resolution of this file determines the resolution of the installer window.\n   * If background is not specified, use `window.size`. Default locations expected background size to be 540x380.\n   * @see [DMG with Retina background support](http://stackoverflow.com/a/11204769/1910191).\n   */\n  background?: string | null\n\n  /**\n   * The background color (accepts css colors). Used when no background image is set.\n   * @default #ffffff\n   */\n  backgroundColor?: string | null\n\n  /**\n   * The path to DMG icon (badge icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   */\n  badgeIcon?: string | null\n\n  /**\n   * The path to DMG icon (volume icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   * Defaults to the application icon (`build/icon.icns`).\n   */\n  icon?: string | null\n\n  /**\n   * The size of all the icons inside the DMG.\n   * @default 80\n   */\n  readonly iconSize?: number | null\n\n  /**\n   * The size of all the icon texts inside the DMG.\n   * @default 12\n   */\n  readonly iconTextSize?: number | null\n\n  /**\n   * The title of the produced DMG, which will be shown when mounted (volume name).\n   *\n   * Macro `${productName}`, `${version}` and `${name}` are supported.\n   * @default ${productName} ${version}\n   */\n  readonly title?: string | null\n\n  /**\n   * The content — to customize icon locations. The x and y coordinates refer to the position of the **center** of the icon (at 1x scale), and do not take the label into account.\n   */\n  contents?: Array<DmgContent>\n\n  /**\n   * The disk image format. `ULFO` (lzfse-compressed image (OS X 10.11+ only)).\n   * @default UDZO\n   */\n  format?: \"UDRW\" | \"UDRO\" | \"UDCO\" | \"UDZO\" | \"UDBZ\" | \"ULFO\"\n\n  /**\n   * The filesystem for the DMG volume (e.g. `\"APFS\"` or `\"HFS+\"`)\n   * This will be changed to APFS in the next major release, so it is recommended to set it explicitly to HFS+ if you want to keep using HFS+ (e.g. for better compatibility with older macOS versions).\n   * @default HFS+\n   */\n  readonly filesystem?: \"HFS+\" | \"APFS\" | null\n\n  /**\n   * The initial size of the DMG filesystem. Accepts the same syntax as the `-size` argument to `hdiutil`, e.g. `\"150m\"`, `\"4g\"`.\n   * If not specified, the size is calculated automatically.\n   * Set this explicitly for large apps or apps with sparse files to avoid \"No space left on device\" errors.\n   */\n  readonly size?: string | null\n\n  /**\n   * Whether to shrink the DMG filesystem to the minimum size after copying files.\n   * Set to `false` to preserve the explicit `size` you specified.\n   * @default true\n   */\n  readonly shrink?: boolean\n\n  /**\n   * The DMG window position and size. With y co-ordinates running from bottom to top.\n   *\n   * The Finder makes sure that the window will be on the user’s display, so if you want your window at the top left of the display you could use `\"x\": 0, \"y\": 100000` as the x, y co-ordinates.\n   * It is not to be possible to position the window relative to the [top left](https://github.com/electron-userland/electron-builder/issues/3990#issuecomment-512960957) or relative to the center of the user’s screen.\n   */\n  window?: DmgWindow\n\n  /**\n   * Whether to create internet-enabled disk image (when it is downloaded using a browser it will automatically decompress the image, put the application on the desktop, unmount and remove the disk image file).\n   * @default false\n   */\n  readonly internetEnabled?: boolean\n\n  /**\n   * Whether to sign the DMG or not. Signing is not required and will lead to unwanted errors in combination with notarization requirements.\n   * @default false\n   */\n  readonly sign?: boolean\n\n  /**\n   * License agreement to display when the DMG is mounted.\n   *\n   * Accepts a single file path (`.rtf`, `.txt`, or `.html`) used as the English/default license,\n   * or a language-code → file-path map for multi-language builds.\n   *\n   * When set, this takes precedence over the file-naming convention\n   * (`license_en.txt`, etc. in the build resources directory).\n   * Paths are resolved relative to the build resources directory or project root.\n   *\n   * @example Single language\n   * ```yaml\n   * dmg:\n   *   license: \"build/license.rtf\"\n   * ```\n   *\n   * @example Multi-language\n   * ```yaml\n   * dmg:\n   *   license:\n   *     en_US: \"build/license.rtf\"\n   *     de_DE: \"build/license_de.txt\"\n   *     ja_JP: \"build/license_ja.txt\"\n   * ```\n   *\n   * If not set, electron-builder scans the build resources directory for\n   * `license_LANG.{rtf,txt,html}` files automatically.\n   */\n  license?: string | Record<string, string> | null\n\n  /**\n   * @private\n   * @default true\n   */\n  writeUpdateInfo?: boolean\n}\n\nexport interface DmgWindow {\n  /**\n   * The X position relative to left of the screen.\n   * @default 400\n   */\n  x?: number\n\n  /**\n   * The Y position relative to bottom of the screen.\n   * @default 100\n   */\n  y?: number\n\n  /**\n   * The width. Defaults to background image width or 540.\n   */\n  width?: number\n\n  /**\n   * The height. Defaults to background image height or 380.\n   */\n  height?: number\n}\n\nexport interface DmgContent {\n  /**\n   * The device-independent pixel offset from the left of the window to the **center** of the icon.\n   */\n  x: number\n  /**\n   * The device-independent pixel offset from the top of the window to the **center** of the icon.\n   */\n  y: number\n  type?: \"link\" | \"file\" | \"dir\"\n\n  /**\n   * The name of the file within the DMG. Defaults to basename of `path`.\n   */\n  name?: string\n\n  /**\n   * The path of the file within the DMG.\n   */\n  path?: string\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type\nexport interface MasConfiguration extends MacConfiguration {}\n"]}

package/dist/options/winOptions.d.ts

@@ -1,4 +1,3 @@
-import { Nullish } from "builder-util-runtime";
 import { CustomWindowsSign } from "../codeSign/win/windowsSignToolManager.js";
 import { TargetConfigType } from "../core.js";
 import { PlatformSpecificBuildOptions } from "./PlatformSpecificBuildOptions.js";
@@ -22,15 +21,22 @@ export interface WindowsConfiguration extends PlatformSpecificBuildOptions {
      */
     readonly legalTrademarks?: string | null;
     /**
-     * Options for usage with signtool.exe
-     * Cannot be used in conjunction with `azureSignOptions`, signing will default to Azure Trusted Signing
-     */
-    readonly signtoolOptions?: WindowsSigntoolConfiguration | null;
-    /**
-     * Options for usage of Azure Trusted Signing service
-     * Cannot be used in conjunction with `signtoolOptions`, signing will default to Azure Trusted Signing
-     */
-    readonly azureSignOptions?: WindowsAzureSigningConfiguration | null;
+     * Code signing configuration. Set to `false` or `null` to disable Windows code signing
+     * (executable resources such as the icon and metadata are still edited). Leave unset to
+     * sign using credentials discovered from the environment (e.g. `WIN_CSC_LINK`). Otherwise
+     * provide exactly one of the following signing modes:
+     *
+     * - `{ type: "signtool", ... }` — Sign with a local certificate file (.pfx/.p12) or a
+     *   certificate from the Windows certificate store.
+     * - `{ type: "hsm", ... }` — Sign using a Hardware Security Module (HSM) or FIPS-compliant
+     *   hardware token via signtool's `/csp` (cryptographic service provider) and `/kc` (key
+     *   container) flags. Requires `toolsets.winCodeSign: "1.x"`. Windows-only.
+     * - `{ type: "pkcs11", ... }` — Sign using a PKCS#11 hardware token via osslsigncode.
+     *   Available on macOS and Linux CI without a Windows VM.
+     * - `{ type: "azure", ... }` — Sign via Azure Trusted Signing (cloud service). Requires
+     *   Azure Entra ID environment variables for authentication.
+     */
+    readonly sign?: WindowsSigningConfiguration | false | null;
     /**
      * Whether to verify the signature of an available update before installation.
      * The [publisher name](#publisherName) will be used for the signature verification.
@@ -44,24 +50,6 @@ export interface WindowsConfiguration extends PlatformSpecificBuildOptions {
      * @default asInvoker
      */
     readonly requestedExecutionLevel?: RequestedExecutionLevel | null;
-    /**
-     * Whether to sign and add metadata to executable via [`resedit`](https://www.npmjs.com/package/resedit).
-     * Metadata includes information about the app name/description/version, publisher, copyright, etc.
-     * This property also is responsible for adding the app icon and setting execution level.
-     * Set to `false` only if you need to fully disable resedit-based resource editing.
-     * To skip only code signing while keeping resource editing, use `signExecutable: false` instead.
-     * @default true
-     */
-    readonly signAndEditExecutable?: boolean;
-    /**
-     * Whether to sign Windows executables and any additional files matched by `signExts`.
-     * Set to `false` to skip Windows code signing while still editing executable resources
-     * (icon, metadata, etc. via [`resedit`](https://www.npmjs.com/package/resedit)).
-     * This option is not limited to the main executable edit/sign flow and can also affect
-     * signing of Windows installers or other artifacts that use the standard signing path.
-     * @default true
-     */
-    readonly signExecutable?: boolean;
     /**
      * Explicit file name/extensions (`str.endsWith`) to also sign. Advanced option.
      * Supports negative patterns, e.g. example that excludes `.appx` files: `["somefilename", ".dll", "!.appx"]`.
@@ -71,96 +59,182 @@ export interface WindowsConfiguration extends PlatformSpecificBuildOptions {
     readonly signExts?: string[] | null;
 }
 export type RequestedExecutionLevel = "asInvoker" | "highestAvailable" | "requireAdministrator";
-export interface WindowsSigntoolConfiguration {
+interface WindowsSigningSharedOptions {
     /**
-     * The custom function (or path to file or module id) to sign Windows executables
+     * [The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.
+     * Defaults to common name from your code signing certificate.
      */
-    readonly sign?: CustomWindowsSign | string | null;
+    readonly publisherName?: string | Array<string> | null;
     /**
      * Array of signing algorithms used. For AppX `sha256` is always used.
      * @default ['sha1', 'sha256']
      */
     readonly signingHashAlgorithms?: Array<"sha1" | "sha256"> | null;
     /**
-     * The path to the *.pfx certificate you want to sign with. Please use it only if you cannot use env variable `CSC_LINK` (`WIN_CSC_LINK`) for some reason.
-     * Please see [Code Signing](https://www.electron.build/code-signing).
+     * The URL of the RFC 3161 time stamp server.
+     * @default http://timestamp.digicert.com
+     */
+    readonly rfc3161TimeStampServer?: string | null;
+    /**
+     * The URL of the time stamp server.
+     * @default http://timestamp.digicert.com
+     */
+    readonly timeStampServer?: string | null;
+    /**
+     * The path to an additional certificate file you want to add to the signature block.
+     */
+    readonly additionalCertificateFile?: string | null;
+    /**
+     * The custom function (or path to file or module id) to sign Windows executables.
+     */
+    readonly sign?: CustomWindowsSign | string | null;
+}
+export interface WindowsSigntoolSigningConfig extends WindowsSigningSharedOptions {
+    readonly type: "signtool";
+    /**
+     * The path to the *.pfx or *.p12 certificate file. Prefer the `WIN_CSC_LINK` environment
+     * variable when possible. See [Code Signing](https://www.electron.build/code-signing).
      */
     readonly certificateFile?: string | null;
     /**
-     * The password to the certificate provided in `certificateFile`. Please use it only if you cannot use env variable `CSC_KEY_PASSWORD` (`WIN_CSC_KEY_PASSWORD`) for some reason.
-     * Please see [Code Signing](https://www.electron.build/code-signing).
+     * The password to the certificate provided in `certificateFile`. Prefer the
+     * `WIN_CSC_KEY_PASSWORD` environment variable when possible.
      */
     readonly certificatePassword?: string | null;
     /**
-     * The name of the subject of the signing certificate, which is often labeled with the field name `issued to`. Required only for EV Code Signing and works only on Windows (or on macOS if [Parallels Desktop](https://www.parallels.com/products/desktop/) Windows 10 virtual machines exits).
+     * The name of the subject of the signing certificate. Required for EV Code Signing.
+     * Works only on Windows (or macOS with Parallels Desktop).
      */
     readonly certificateSubjectName?: string | null;
     /**
-     * The SHA1 hash of the signing certificate. The SHA1 hash is commonly specified when multiple certificates satisfy the criteria specified by the remaining switches. Works only on Windows (or on macOS if [Parallels Desktop](https://www.parallels.com/products/desktop/) Windows 10 virtual machines exits).
+     * The SHA1 hash of the signing certificate. Works only on Windows (or macOS with Parallels Desktop).
      */
     readonly certificateSha1?: string | null;
+}
+/**
+ * @beta HSM signing is available in v27 as a beta feature. The interface is stable but
+ * real-hardware test coverage is limited.
+ */
+export interface WindowsHsmSigningConfig extends WindowsSigningSharedOptions {
+    readonly type: "hsm";
+    /**
+     * The name of the cryptographic service provider (CSP) that holds the private key.
+     * Maps to signtool's `/csp` flag. Examples:
+     * - Google Cloud KMS: `"Google Cloud KMS Provider"`
+     * - Smart card / FIPS token: `"Microsoft Base Smart Card Crypto Provider"`
+     *
+     * Requires `toolsets.winCodeSign: "1.x"`. Windows-only — use `type: "pkcs11"` on macOS/Linux.
+     */
+    readonly cryptoServiceProvider: string;
     /**
-     * The path to an additional certificate file you want to add to the signature block.
+     * The key container name within the CSP. Maps to signtool's `/kc` flag.
+     *
+     * Example for Google Cloud KMS:
+     * `"projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME/cryptoKeyVersions/1"`
      */
-    readonly additionalCertificateFile?: string | null;
+    readonly keyContainer: string;
     /**
-     * The URL of the RFC 3161 time stamp server.
-     * @default http://timestamp.digicert.com
+     * Path to the certificate file containing the public certificate chain (.crt / .cer / .pfx).
+     * The private key is NOT read from this file — it is provided by the HSM via `cryptoServiceProvider`.
      */
-    readonly rfc3161TimeStampServer?: string | null;
+    readonly certificateFile?: string | null;
     /**
-     * The URL of the time stamp server.
-     * @default http://timestamp.digicert.com
+     * The SHA1 thumbprint of the certificate in the Windows certificate store.
      */
-    readonly timeStampServer?: string | null;
+    readonly certificateSha1?: string | null;
     /**
-     * [The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.
-     * Defaults to common name from your code signing certificate.
+     * The subject name of the certificate in the Windows certificate store.
      */
-    readonly publisherName?: string | Array<string> | null;
+    readonly certificateSubjectName?: string | null;
 }
-export interface WindowsAzureSigningConfiguration {
+/**
+ * @beta PKCS#11 signing is available in v27 as a beta feature. The interface is stable but
+ * real-hardware test coverage is limited.
+ */
+export interface WindowsPkcs11SigningConfig extends WindowsSigningSharedOptions {
+    readonly type: "pkcs11";
+    /**
+     * Path to the PKCS#11 shared library (`.so` on Linux, `.dylib` on macOS).
+     * The library must be installed separately — electron-builder does not bundle it.
+     *
+     * Example: `"/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so"`
+     *
+     * Must be paired with `pkcs11KeyUri`.
+     */
+    readonly pkcs11Module: string;
+    /**
+     * RFC 7512 PKCS#11 URI identifying the private key within the module.
+     * Maps to osslsigncode's `-key` parameter.
+     *
+     * Example: `"pkcs11:token=MyToken;object=MyKey;type=private"`
+     *
+     * Must be paired with `pkcs11Module`.
+     */
+    readonly pkcs11KeyUri: string;
+    /**
+     * Optional path to a certificate chain file to accompany the PKCS#11 key.
+     * If omitted the certificate embedded in the token is used.
+     */
+    readonly certificateFile?: string | null;
+}
+/**
+ * @beta The `signtool /dlib` Azure Trusted Signing integration introduced in v27 is a beta
+ * feature. The legacy PowerShell fallback (triggered when `toolsets.winCodeSign` is unset or
+ * `"0.0.0"`) remains supported for migration.
+ */
+export interface WindowsAzureSigningConfig {
+    readonly type: "azure";
     /**
      * [The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.
      */
     readonly publisherName: string;
     /**
-     * The Trusted Signing Account endpoint. The URI value must have a URI that aligns to the
-     * region your Trusted Signing Account and Certificate Profile you are specifying were created
-     * in during the setup of these resources.
-     *
-     * Translates to field: Endpoint
+     * The Trusted Signing Account endpoint. The URI value must align to the region your Trusted
+     * Signing Account and Certificate Profile were created in.
      *
-     * Requires one of environment variable configurations for authenticating to Microsoft Entra ID per [Microsoft's documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition)
+     * Requires Azure Entra ID environment variables per
+     * [Microsoft's documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition).
      */
     readonly endpoint: string;
     /**
-     * The Certificate Profile name. Translates to field: CertificateProfileName
+     * The Certificate Profile name. Translates to field: CertificateProfileName.
      */
     readonly certificateProfileName: string;
     /**
-     * The Code Signing Signing Account name. Translates to field: CodeSigningAccountName
+     * The Code Signing Account name. Translates to field: CodeSigningAccountName.
      */
     readonly codeSigningAccountName: string;
     /**
-     * The File Digest for signing each file. Translates to field: FileDigest
+     * The file digest algorithm. Translates to field: FileDigest.
      * @default SHA256
      */
     readonly fileDigest?: string;
     /**
-     * The Timestamp rfc3161 server. Translates to field: TimestampRfc3161
+     * The RFC3161 timestamp server. Translates to field: TimestampRfc3161.
      * @default http://timestamp.acs.microsoft.com
      */
     readonly timestampRfc3161?: string;
     /**
-     * The Timestamp Digest. Translates to field: TimestampDigest
+     * The timestamp digest algorithm. Translates to field: TimestampDigest.
      * @default SHA256
      */
     readonly timestampDigest?: string;
     /**
-     * Allow other CLI parameters (verbatim case-sensitive) to `Invoke-TrustedSigning`
-     * Note: Key-Value pairs with `undefined`/`null` value are filtered out of the command.
+     * Additional fields to include verbatim in the `metadata.json` file passed to
+     * `Azure.CodeSigning.Dlib.dll` via `signtool /dmdf`. Use this for DLib-specific options
+     * not covered by the typed fields above (e.g. `ExcludeCredentials`, `CorrelationId`).
      */
-    [k: string]: string | Nullish;
+    readonly additionalMetadata?: Record<string, string>;
 }
+export type WindowsSigningConfiguration = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig | WindowsAzureSigningConfig;
+/** Signing modes that use signtool.exe or osslsigncode (not Azure). */
+export type WindowsSigntoolFamilyConfig = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig;
+/**
+ * Resolves the active signing configuration object. `false`, `null`, and unset all mean
+ * "no explicit signing config object" (env-based discovery still applies when unset).
+ */
+export declare function resolveWindowsSigningConfiguration(config: WindowsConfiguration): WindowsSigningConfiguration | null;
+/** Whether Windows code signing has been explicitly disabled via `sign: false | null`. */
+export declare function isWindowsSigningDisabled(config: WindowsConfiguration): boolean;
+export {};
 //# sourceMappingURL=winOptions.d.ts.map

package/dist/options/winOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"winOptions.d.ts","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAEhF,MAAM,WAAW,oBAAqB,SAAQ,4BAA4B;IACxE;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,4BAA4B,GAAG,IAAI,CAAA;IAE9D;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gCAAgC,GAAG,IAAI,CAAA;IAEnE;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IAE5C;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAA;IAEjE;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAExC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IAEjC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CACpC;AAED,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,kBAAkB,GAAG,sBAAsB,CAAA;AAE/F,MAAM,WAAW,4BAA4B;IAC3C;;OAEG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjD;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAA;IAEhE;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5C;;OAEG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;OAEG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAElD;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;CACvD;AAGD,MAAM,WAAW,gCAAgC;IAC/C;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC;;OAEG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;OAGG;IACH,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;CAC9B"}
+{"version":3,"file":"winOptions.d.ts","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAEhF,MAAM,WAAW,oBAAqB,SAAQ,4BAA4B;IACxE;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,2BAA2B,GAAG,KAAK,GAAG,IAAI,CAAA;IAE1D;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IAE5C;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAA;IAEjE;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CACpC;AAED,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,kBAAkB,GAAG,sBAAsB,CAAA;AAI/F,UAAU,2BAA2B;IACnC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAEtD;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAA;IAEhE;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;OAEG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAElD;;OAEG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAAA;CAClD;AAID,MAAM,WAAW,4BAA6B,SAAQ,2BAA2B;IAC/E,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IAEzB;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5C;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAID;;;GAGG;AACH,MAAM,WAAW,uBAAwB,SAAQ,2BAA2B;IAC1E,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IAEpB;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IAEtC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;OAEG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD;AAID;;;GAGG;AACH,MAAM,WAAW,0BAA2B,SAAQ,2BAA2B;IAC7E,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IAEvB;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAID;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAE9B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB;;OAEG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IAEvC;;OAEG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IAEvC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAE5B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IAEjC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrD;AAID,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG,uBAAuB,GAAG,0BAA0B,GAAG,yBAAyB,CAAA;AAEzJ,uEAAuE;AACvE,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG,uBAAuB,GAAG,0BAA0B,CAAA;AAE7H;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,oBAAoB,GAAG,2BAA2B,GAAG,IAAI,CAGnH;AAED,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAE9E"}

package/dist/options/winOptions.js

@@ -1,2 +1,13 @@
-export {};
+/**
+ * Resolves the active signing configuration object. `false`, `null`, and unset all mean
+ * "no explicit signing config object" (env-based discovery still applies when unset).
+ */
+export function resolveWindowsSigningConfiguration(config) {
+    const { sign } = config;
+    return sign == null || sign === false ? null : sign;
+}
+/** Whether Windows code signing has been explicitly disabled via `sign: false | null`. */
+export function isWindowsSigningDisabled(config) {
+    return config.sign === false || config.sign === null;
+}
 //# sourceMappingURL=winOptions.js.map

package/dist/options/winOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"winOptions.js","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { Nullish } from \"builder-util-runtime\"\nimport { CustomWindowsSign } from \"../codeSign/win/windowsSignToolManager.js\"\nimport { TargetConfigType } from \"../core.js\"\nimport { PlatformSpecificBuildOptions } from \"./PlatformSpecificBuildOptions.js\"\n\nexport interface WindowsConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` ([portable]https://www.electron.build/nsis#portable) app without installation), `appx`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * AppX package can be built only on Windows 10.\n   *\n   * To use Squirrel.Windows please install `electron-builder-squirrel-windows` dependency.\n   *\n   * @default nsis\n   */\n  readonly target?: TargetConfigType\n\n  /**\n   * The path to application icon.\n   * @default build/icon.ico\n   */\n  readonly icon?: string | null\n\n  /**\n   * The trademarks and registered trademarks.\n   */\n  readonly legalTrademarks?: string | null\n\n  /**\n   * Options for usage with signtool.exe\n   * Cannot be used in conjunction with `azureSignOptions`, signing will default to Azure Trusted Signing\n   */\n  readonly signtoolOptions?: WindowsSigntoolConfiguration | null\n\n  /**\n   * Options for usage of Azure Trusted Signing service\n   * Cannot be used in conjunction with `signtoolOptions`, signing will default to Azure Trusted Signing\n   */\n  readonly azureSignOptions?: WindowsAzureSigningConfiguration | null\n\n  /**\n   * Whether to verify the signature of an available update before installation.\n   * The [publisher name](#publisherName) will be used for the signature verification.\n   *\n   * @default true\n   */\n  readonly verifyUpdateCodeSignature?: boolean\n\n  /**\n   * The [security level](https://msdn.microsoft.com/en-us/library/6ad1fshk.aspx#Anchor_9) at which the application requests to be executed.\n   * Cannot be specified per target, allowed only in the `win`.\n   * @default asInvoker\n   */\n  readonly requestedExecutionLevel?: RequestedExecutionLevel | null\n\n  /**\n   * Whether to sign and add metadata to executable via [`resedit`](https://www.npmjs.com/package/resedit).\n   * Metadata includes information about the app name/description/version, publisher, copyright, etc.\n   * This property also is responsible for adding the app icon and setting execution level.\n   * Set to `false` only if you need to fully disable resedit-based resource editing.\n   * To skip only code signing while keeping resource editing, use `signExecutable: false` instead.\n   * @default true\n   */\n  readonly signAndEditExecutable?: boolean\n\n  /**\n   * Whether to sign Windows executables and any additional files matched by `signExts`.\n   * Set to `false` to skip Windows code signing while still editing executable resources\n   * (icon, metadata, etc. via [`resedit`](https://www.npmjs.com/package/resedit)).\n   * This option is not limited to the main executable edit/sign flow and can also affect\n   * signing of Windows installers or other artifacts that use the standard signing path.\n   * @default true\n   */\n  readonly signExecutable?: boolean\n\n  /**\n   * Explicit file name/extensions (`str.endsWith`) to also sign. Advanced option.\n   * Supports negative patterns, e.g. example that excludes `.appx` files: `[\"somefilename\", \".dll\", \"!.appx\"]`.\n   * @see https://github.com/electron-userland/electron-builder/issues/7329\n   * @default null\n   */\n  readonly signExts?: string[] | null\n}\n\nexport type RequestedExecutionLevel = \"asInvoker\" | \"highestAvailable\" | \"requireAdministrator\"\n\nexport interface WindowsSigntoolConfiguration {\n  /**\n   * The custom function (or path to file or module id) to sign Windows executables\n   */\n  readonly sign?: CustomWindowsSign | string | null\n\n  /**\n   * Array of signing algorithms used. For AppX `sha256` is always used.\n   * @default ['sha1', 'sha256']\n   */\n  readonly signingHashAlgorithms?: Array<\"sha1\" | \"sha256\"> | null\n\n  /**\n   * The path to the *.pfx certificate you want to sign with. Please use it only if you cannot use env variable `CSC_LINK` (`WIN_CSC_LINK`) for some reason.\n   * Please see [Code Signing](https://www.electron.build/code-signing).\n   */\n  readonly certificateFile?: string | null\n\n  /**\n   * The password to the certificate provided in `certificateFile`. Please use it only if you cannot use env variable `CSC_KEY_PASSWORD` (`WIN_CSC_KEY_PASSWORD`) for some reason.\n   * Please see [Code Signing](https://www.electron.build/code-signing).\n   */\n  readonly certificatePassword?: string | null\n\n  /**\n   * The name of the subject of the signing certificate, which is often labeled with the field name `issued to`. Required only for EV Code Signing and works only on Windows (or on macOS if [Parallels Desktop](https://www.parallels.com/products/desktop/) Windows 10 virtual machines exits).\n   */\n  readonly certificateSubjectName?: string | null\n\n  /**\n   * The SHA1 hash of the signing certificate. The SHA1 hash is commonly specified when multiple certificates satisfy the criteria specified by the remaining switches. Works only on Windows (or on macOS if [Parallels Desktop](https://www.parallels.com/products/desktop/) Windows 10 virtual machines exits).\n   */\n  readonly certificateSha1?: string | null\n\n  /**\n   * The path to an additional certificate file you want to add to the signature block.\n   */\n  readonly additionalCertificateFile?: string | null\n\n  /**\n   * The URL of the RFC 3161 time stamp server.\n   * @default http://timestamp.digicert.com\n   */\n  readonly rfc3161TimeStampServer?: string | null\n\n  /**\n   * The URL of the time stamp server.\n   * @default http://timestamp.digicert.com\n   */\n  readonly timeStampServer?: string | null\n\n  /**\n   * [The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.\n   * Defaults to common name from your code signing certificate.\n   */\n  readonly publisherName?: string | Array<string> | null\n}\n\n// https://learn.microsoft.com/en-us/azure/trusted-signing/how-to-signing-integrations\nexport interface WindowsAzureSigningConfiguration {\n  /**\n   * [The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.\n   */\n  readonly publisherName: string\n  /**\n   * The Trusted Signing Account endpoint. The URI value must have a URI that aligns to the\n   * region your Trusted Signing Account and Certificate Profile you are specifying were created\n   * in during the setup of these resources.\n   *\n   * Translates to field: Endpoint\n   *\n   * Requires one of environment variable configurations for authenticating to Microsoft Entra ID per [Microsoft's documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition)\n   */\n  readonly endpoint: string\n  /**\n   * The Certificate Profile name. Translates to field: CertificateProfileName\n   */\n  readonly certificateProfileName: string\n  /**\n   * The Code Signing Signing Account name. Translates to field: CodeSigningAccountName\n   */\n  readonly codeSigningAccountName: string\n  /**\n   * The File Digest for signing each file. Translates to field: FileDigest\n   * @default SHA256\n   */\n  readonly fileDigest?: string\n  /**\n   * The Timestamp rfc3161 server. Translates to field: TimestampRfc3161\n   * @default http://timestamp.acs.microsoft.com\n   */\n  readonly timestampRfc3161?: string\n  /**\n   * The Timestamp Digest. Translates to field: TimestampDigest\n   * @default SHA256\n   */\n  readonly timestampDigest?: string\n  /**\n   * Allow other CLI parameters (verbatim case-sensitive) to `Invoke-TrustedSigning`\n   * Note: Key-Value pairs with `undefined`/`null` value are filtered out of the command.\n   */\n  [k: string]: string | Nullish\n}\n"]}
+{"version":3,"file":"winOptions.js","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"AA4RA;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAA4B;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;IACvB,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACrD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,MAA4B;IACnE,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAA;AACtD,CAAC","sourcesContent":["import { CustomWindowsSign } from \"../codeSign/win/windowsSignToolManager.js\"\nimport { TargetConfigType } from \"../core.js\"\nimport { PlatformSpecificBuildOptions } from \"./PlatformSpecificBuildOptions.js\"\n\nexport interface WindowsConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` ([portable]https://www.electron.build/nsis#portable) app without installation), `appx`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * AppX package can be built only on Windows 10.\n   *\n   * To use Squirrel.Windows please install `electron-builder-squirrel-windows` dependency.\n   *\n   * @default nsis\n   */\n  readonly target?: TargetConfigType\n\n  /**\n   * The path to application icon.\n   * @default build/icon.ico\n   */\n  readonly icon?: string | null\n\n  /**\n   * The trademarks and registered trademarks.\n   */\n  readonly legalTrademarks?: string | null\n\n  /**\n   * Code signing configuration. Set to `false` or `null` to disable Windows code signing\n   * (executable resources such as the icon and metadata are still edited). Leave unset to\n   * sign using credentials discovered from the environment (e.g. `WIN_CSC_LINK`). Otherwise\n   * provide exactly one of the following signing modes:\n   *\n   * - `{ type: \"signtool\", ... }` — Sign with a local certificate file (.pfx/.p12) or a\n   *   certificate from the Windows certificate store.\n   * - `{ type: \"hsm\", ... }` — Sign using a Hardware Security Module (HSM) or FIPS-compliant\n   *   hardware token via signtool's `/csp` (cryptographic service provider) and `/kc` (key\n   *   container) flags. Requires `toolsets.winCodeSign: \"1.x\"`. Windows-only.\n   * - `{ type: \"pkcs11\", ... }` — Sign using a PKCS#11 hardware token via osslsigncode.\n   *   Available on macOS and Linux CI without a Windows VM.\n   * - `{ type: \"azure\", ... }` — Sign via Azure Trusted Signing (cloud service). Requires\n   *   Azure Entra ID environment variables for authentication.\n   */\n  readonly sign?: WindowsSigningConfiguration | false | null\n\n  /**\n   * Whether to verify the signature of an available update before installation.\n   * The [publisher name](#publisherName) will be used for the signature verification.\n   *\n   * @default true\n   */\n  readonly verifyUpdateCodeSignature?: boolean\n\n  /**\n   * The [security level](https://msdn.microsoft.com/en-us/library/6ad1fshk.aspx#Anchor_9) at which the application requests to be executed.\n   * Cannot be specified per target, allowed only in the `win`.\n   * @default asInvoker\n   */\n  readonly requestedExecutionLevel?: RequestedExecutionLevel | null\n\n  /**\n   * Explicit file name/extensions (`str.endsWith`) to also sign. Advanced option.\n   * Supports negative patterns, e.g. example that excludes `.appx` files: `[\"somefilename\", \".dll\", \"!.appx\"]`.\n   * @see https://github.com/electron-userland/electron-builder/issues/7329\n   * @default null\n   */\n  readonly signExts?: string[] | null\n}\n\nexport type RequestedExecutionLevel = \"asInvoker\" | \"highestAvailable\" | \"requireAdministrator\"\n\n// ─── Shared base for signtool-family signing modes ───────────────────────────\n\ninterface WindowsSigningSharedOptions {\n  /**\n   * [The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.\n   * Defaults to common name from your code signing certificate.\n   */\n  readonly publisherName?: string | Array<string> | null\n\n  /**\n   * Array of signing algorithms used. For AppX `sha256` is always used.\n   * @default ['sha1', 'sha256']\n   */\n  readonly signingHashAlgorithms?: Array<\"sha1\" | \"sha256\"> | null\n\n  /**\n   * The URL of the RFC 3161 time stamp server.\n   * @default http://timestamp.digicert.com\n   */\n  readonly rfc3161TimeStampServer?: string | null\n\n  /**\n   * The URL of the time stamp server.\n   * @default http://timestamp.digicert.com\n   */\n  readonly timeStampServer?: string | null\n\n  /**\n   * The path to an additional certificate file you want to add to the signature block.\n   */\n  readonly additionalCertificateFile?: string | null\n\n  /**\n   * The custom function (or path to file or module id) to sign Windows executables.\n   */\n  readonly sign?: CustomWindowsSign | string | null\n}\n\n// ─── Signing mode: signtool (file or Windows certificate store) ──────────────\n\nexport interface WindowsSigntoolSigningConfig extends WindowsSigningSharedOptions {\n  readonly type: \"signtool\"\n\n  /**\n   * The path to the *.pfx or *.p12 certificate file. Prefer the `WIN_CSC_LINK` environment\n   * variable when possible. See [Code Signing](https://www.electron.build/code-signing).\n   */\n  readonly certificateFile?: string | null\n\n  /**\n   * The password to the certificate provided in `certificateFile`. Prefer the\n   * `WIN_CSC_KEY_PASSWORD` environment variable when possible.\n   */\n  readonly certificatePassword?: string | null\n\n  /**\n   * The name of the subject of the signing certificate. Required for EV Code Signing.\n   * Works only on Windows (or macOS with Parallels Desktop).\n   */\n  readonly certificateSubjectName?: string | null\n\n  /**\n   * The SHA1 hash of the signing certificate. Works only on Windows (or macOS with Parallels Desktop).\n   */\n  readonly certificateSha1?: string | null\n}\n\n// ─── Signing mode: hsm (Hardware Security Module via signtool /csp /kc) ──────\n\n/**\n * @beta HSM signing is available in v27 as a beta feature. The interface is stable but\n * real-hardware test coverage is limited.\n */\nexport interface WindowsHsmSigningConfig extends WindowsSigningSharedOptions {\n  readonly type: \"hsm\"\n\n  /**\n   * The name of the cryptographic service provider (CSP) that holds the private key.\n   * Maps to signtool's `/csp` flag. Examples:\n   * - Google Cloud KMS: `\"Google Cloud KMS Provider\"`\n   * - Smart card / FIPS token: `\"Microsoft Base Smart Card Crypto Provider\"`\n   *\n   * Requires `toolsets.winCodeSign: \"1.x\"`. Windows-only — use `type: \"pkcs11\"` on macOS/Linux.\n   */\n  readonly cryptoServiceProvider: string\n\n  /**\n   * The key container name within the CSP. Maps to signtool's `/kc` flag.\n   *\n   * Example for Google Cloud KMS:\n   * `\"projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME/cryptoKeyVersions/1\"`\n   */\n  readonly keyContainer: string\n\n  /**\n   * Path to the certificate file containing the public certificate chain (.crt / .cer / .pfx).\n   * The private key is NOT read from this file — it is provided by the HSM via `cryptoServiceProvider`.\n   */\n  readonly certificateFile?: string | null\n\n  /**\n   * The SHA1 thumbprint of the certificate in the Windows certificate store.\n   */\n  readonly certificateSha1?: string | null\n\n  /**\n   * The subject name of the certificate in the Windows certificate store.\n   */\n  readonly certificateSubjectName?: string | null\n}\n\n// ─── Signing mode: pkcs11 (cross-platform PKCS#11 via osslsigncode) ──────────\n\n/**\n * @beta PKCS#11 signing is available in v27 as a beta feature. The interface is stable but\n * real-hardware test coverage is limited.\n */\nexport interface WindowsPkcs11SigningConfig extends WindowsSigningSharedOptions {\n  readonly type: \"pkcs11\"\n\n  /**\n   * Path to the PKCS#11 shared library (`.so` on Linux, `.dylib` on macOS).\n   * The library must be installed separately — electron-builder does not bundle it.\n   *\n   * Example: `\"/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so\"`\n   *\n   * Must be paired with `pkcs11KeyUri`.\n   */\n  readonly pkcs11Module: string\n\n  /**\n   * RFC 7512 PKCS#11 URI identifying the private key within the module.\n   * Maps to osslsigncode's `-key` parameter.\n   *\n   * Example: `\"pkcs11:token=MyToken;object=MyKey;type=private\"`\n   *\n   * Must be paired with `pkcs11Module`.\n   */\n  readonly pkcs11KeyUri: string\n\n  /**\n   * Optional path to a certificate chain file to accompany the PKCS#11 key.\n   * If omitted the certificate embedded in the token is used.\n   */\n  readonly certificateFile?: string | null\n}\n\n// ─── Signing mode: azure (Azure Trusted Signing) ──────────────────────────────\n\n/**\n * @beta The `signtool /dlib` Azure Trusted Signing integration introduced in v27 is a beta\n * feature. The legacy PowerShell fallback (triggered when `toolsets.winCodeSign` is unset or\n * `\"0.0.0\"`) remains supported for migration.\n */\nexport interface WindowsAzureSigningConfig {\n  readonly type: \"azure\"\n\n  /**\n   * [The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.\n   */\n  readonly publisherName: string\n\n  /**\n   * The Trusted Signing Account endpoint. The URI value must align to the region your Trusted\n   * Signing Account and Certificate Profile were created in.\n   *\n   * Requires Azure Entra ID environment variables per\n   * [Microsoft's documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition).\n   */\n  readonly endpoint: string\n\n  /**\n   * The Certificate Profile name. Translates to field: CertificateProfileName.\n   */\n  readonly certificateProfileName: string\n\n  /**\n   * The Code Signing Account name. Translates to field: CodeSigningAccountName.\n   */\n  readonly codeSigningAccountName: string\n\n  /**\n   * The file digest algorithm. Translates to field: FileDigest.\n   * @default SHA256\n   */\n  readonly fileDigest?: string\n\n  /**\n   * The RFC3161 timestamp server. Translates to field: TimestampRfc3161.\n   * @default http://timestamp.acs.microsoft.com\n   */\n  readonly timestampRfc3161?: string\n\n  /**\n   * The timestamp digest algorithm. Translates to field: TimestampDigest.\n   * @default SHA256\n   */\n  readonly timestampDigest?: string\n\n  /**\n   * Additional fields to include verbatim in the `metadata.json` file passed to\n   * `Azure.CodeSigning.Dlib.dll` via `signtool /dmdf`. Use this for DLib-specific options\n   * not covered by the typed fields above (e.g. `ExcludeCredentials`, `CorrelationId`).\n   */\n  readonly additionalMetadata?: Record<string, string>\n}\n\n// ─── Discriminated union ──────────────────────────────────────────────────────\n\nexport type WindowsSigningConfiguration = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig | WindowsAzureSigningConfig\n\n/** Signing modes that use signtool.exe or osslsigncode (not Azure). */\nexport type WindowsSigntoolFamilyConfig = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig\n\n/**\n * Resolves the active signing configuration object. `false`, `null`, and unset all mean\n * \"no explicit signing config object\" (env-based discovery still applies when unset).\n */\nexport function resolveWindowsSigningConfiguration(config: WindowsConfiguration): WindowsSigningConfiguration | null {\n  const { sign } = config\n  return sign == null || sign === false ? null : sign\n}\n\n/** Whether Windows code signing has been explicitly disabled via `sign: false | null`. */\nexport function isWindowsSigningDisabled(config: WindowsConfiguration): boolean {\n  return config.sign === false || config.sign === null\n}\n"]}

package/dist/platformPackager.d.ts

@@ -9,12 +9,14 @@ import { GetFileMatchersOptions } from "./fileMatcher.js";
 import { Framework } from "./Framework.js";
 import { Platform, SourceRepositoryInfo } from "./core.js";
 import type { AfterPackContext, CompressionLevel, Configuration, ElectronPlatformName, FileAssociation, Packager, PackagerOptions, PlatformSpecificBuildOptions, Target, TargetSpecificOptions } from "./index.js";
+import type { PlatformType } from "./targets/mac/MacTargetHelper.js";
 import { IconFormat, IconInfo } from "./util/iconConverter.js";
 import { AssetCatalogResult } from "./util/mac/macosIconComposer.js";
 export type DoPackOptions<DC extends PlatformSpecificBuildOptions> = {
     outDir: string;
     appOutDir: string;
     platformName: ElectronPlatformName;
+    platformType?: PlatformType;
     arch: Arch;
     platformSpecificBuildOptions: DC;
     targets: Array<Target>;
@@ -90,10 +92,10 @@ export declare abstract class PlatformPackager<DC extends PlatformSpecificBuildO
      * ```
      */
     addElectronFuses(context: AfterPackContext, fuses: FuseConfig): Promise<number>;
-    protected doSignAfterPack(outDir: string, appOutDir: string, platformName: ElectronPlatformName, arch: Arch, platformSpecificBuildOptions: DC, targets: Array<Target>): Promise<void>;
+    protected doSignAfterPack(outDir: string, appOutDir: string, platformName: ElectronPlatformName, platformType: PlatformType | undefined, arch: Arch, platformSpecificBuildOptions: DC, targets: Array<Target>): Promise<void>;
     protected createTransformerForExtraFiles(packContext: AfterPackContext): FileTransformer | null;
     private copyAppFiles;
-    protected signApp(packContext: AfterPackContext, isAsar: boolean): Promise<boolean>;
+    protected signApp(packContext: AfterPackContext, isAsar: boolean, _platformType?: PlatformType): Promise<boolean>;
     getIconPath(): Promise<string | null>;
     private computeAsarOptions;
     getElectronSrcDir(dist: string): string;

package/dist/platformPackager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platformPackager.d.ts","sourceRoot":"","sources":["../src/platformPackager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAgB,MAAM,iBAAiB,CAAA;AAE/D,OAAO,EACL,IAAI,EAEJ,gBAAgB,EAChB,WAAW,EAEX,eAAe,EAShB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,iBAAiB,EAAc,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAO7E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAKtC,OAAO,EAA2C,sBAAsB,EAAiD,MAAM,kBAAkB,CAAA;AAEjJ,OAAO,EAAE,SAAS,EAAmB,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAG1D,OAAO,KAAK,EACV,gBAAgB,EAEhB,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,eAAe,EAEf,QAAQ,EACR,eAAe,EACf,4BAA4B,EAC5B,MAAM,EACN,qBAAqB,EACtB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAe,UAAU,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAE3E,OAAO,EAAE,kBAAkB,EAA+B,MAAM,iCAAiC,CAAA;AAEjG,MAAM,MAAM,aAAa,CAAC,EAAE,SAAS,4BAA4B,IAAI;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,oBAAoB,CAAA;IAClC,IAAI,EAAE,IAAI,CAAA;IACV,4BAA4B,EAAE,EAAE,CAAA;IAChC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACtB,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,oBAAoB,CAAC,EAAE,OAAO,CAAA;QAC9B,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,CAAA;CACF,CAAA;AAED,8BAAsB,gBAAgB,CAAC,EAAE,SAAS,4BAA4B;IAyC1E,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ;IAzC7B,IAAI,eAAe,IAAI,eAAe,CAErC;IAED,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,SAAS,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,CAAA;IAEnD,sFAAsF;IACtF,IAAI,eAAe,IAAI,EAAE,CAExB;IAED;;;OAGG;IACH,mBAAmB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC;IAItC,IAAI,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAEzC;IAED,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4F;IAE1H,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IAEzB,SAAS,aACY,IAAI,EAAE,QAAQ,EACxB,QAAQ,EAAE,QAAQ;IAM7B,IAAI,WAAW,IAAI,gBAAgB,CAOlC;IAED,IAAI,WAAW,IAAI,WAAW,CAE7B;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,IAAI,QAAQ,IAAI,QAAQ,CAEvB;IAED,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED,IAAI,cAAc,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEzD;IAED,IAAI,6BAA6B,IAAI,MAAM,CAE1C;IAED,IAAI,sBAAsB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAEpG;IAED,IAAI,+BAA+B,IAAI,OAAO,CAE7C;IAED,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAInC,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,iBAAiB,IAAI,OAAO,CAAC,OAAO,kCAAkC,EAAE,EAAE,CAAC;IAI3E,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,EAAE,SAAS,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,0BAA0B,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,QAAQ,KAAK,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,CAAA;IAG3C,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO;IAIzC,OAAO,CAAC,MAAM,CAAC,qCAAqC;IAIpD,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,KAAK,IAAI,GAAG,IAAI;IAEzH,cAAc,IAAI,MAAM;IAUxB,UAAU,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO;IAM1D,gBAAgB,IAAI,MAAM,GAAG,OAAO;IAKpC,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM;IAWxD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC;IAa3G,SAAS,CAAC,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,GAAG,IAAI;IAoBlI,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAQhC,OAAO,CAAC,oBAAoB;IAM5B,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,4BAA4B,GAAG,sBAAsB;cASlH,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;cAgJrC,kBAAkB,CAAC,WAAW,EAAE,gBAAgB;YAQlD,kBAAkB;IAkChC;;;;;;;;;OASG;IACU,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU;cAoB1D,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,4BAA4B,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;IAoB3K,SAAS,CAAC,8BAA8B,CAAC,WAAW,EAAE,gBAAgB,GAAG,eAAe,GAAG,IAAI;IAI/F,OAAO,CAAC,YAAY;IAuFpB,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAInF,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAIvB,kBAAkB;IA4BzB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAIvC,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI3D,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAUnC,qCAAqC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIhE,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;YAIxC,kBAAkB;YAyClB,kBAAkB;IAkBhC,uBAAuB,CACrB,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,EAClB,eAAe,UAAO,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,SAAsC,GAChD,MAAM,GAAG,IAAI;IAMhB,yBAAyB,CACvB,qBAAqB,EAAE,qBAAqB,GAAG,OAAO,EACtD,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,EAClB,cAAc,CAAC,EAAE,MAAM,EACvB,eAAe,UAAO,EACtB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM;IAKT,qBAAqB,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,SAAS;;;;IAQhH,+BAA+B,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM;IAKhI,OAAO,CAAC,mBAAmB;IAO3B,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,GAAQ,EAAE,sBAAsB,UAAO,GAAG,MAAM;IAI1G,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM;IAM5F,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI5C,IAAI,gBAAgB,IAAI,KAAK,CAAC,eAAe,CAAC,CAE7C;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA+B5F,IAAI,gBAAgB,IAAI,OAAO,CAG9B;IAED,OAAO,CAAC,mBAAmB,CAAiD;IAC5E,SAAS,CAAC,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAYjF,OAAO,CAAC,sBAAsB,CAAqC;IAC7D,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAqB7C,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA0B5E,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAMlC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;CA4B9H;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,WAE5C;AAED,wBAAgB,+BAA+B,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,EAAE,gBAAgB,EAAE,MAAM,MAAM,GAAG,MAAM,GAAG,IAAI,CAe3H;AAGD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,UAEvC;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,OAAO,GAAG,CAAC,GAAG,OAAO,CAE9E"}
+{"version":3,"file":"platformPackager.d.ts","sourceRoot":"","sources":["../src/platformPackager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAgB,MAAM,iBAAiB,CAAA;AAE/D,OAAO,EACL,IAAI,EAEJ,gBAAgB,EAChB,WAAW,EAEX,eAAe,EAShB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,iBAAiB,EAAc,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAO7E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAKtC,OAAO,EAA2C,sBAAsB,EAAiD,MAAM,kBAAkB,CAAA;AAEjJ,OAAO,EAAE,SAAS,EAAmB,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAG1D,OAAO,KAAK,EACV,gBAAgB,EAEhB,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,eAAe,EAEf,QAAQ,EACR,eAAe,EACf,4BAA4B,EAC5B,MAAM,EACN,qBAAqB,EACtB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AAEpE,OAAO,EAAe,UAAU,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAE3E,OAAO,EAAE,kBAAkB,EAA+B,MAAM,iCAAiC,CAAA;AAEjG,MAAM,MAAM,aAAa,CAAC,EAAE,SAAS,4BAA4B,IAAI;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,oBAAoB,CAAA;IAElC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,IAAI,EAAE,IAAI,CAAA;IACV,4BAA4B,EAAE,EAAE,CAAA;IAChC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACtB,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,oBAAoB,CAAC,EAAE,OAAO,CAAA;QAC9B,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,CAAA;CACF,CAAA;AAED,8BAAsB,gBAAgB,CAAC,EAAE,SAAS,4BAA4B;IAyC1E,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ;IAzC7B,IAAI,eAAe,IAAI,eAAe,CAErC;IAED,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,SAAS,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,CAAA;IAEnD,sFAAsF;IACtF,IAAI,eAAe,IAAI,EAAE,CAExB;IAED;;;OAGG;IACH,mBAAmB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC;IAItC,IAAI,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAEzC;IAED,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4F;IAE1H,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IAEzB,SAAS,aACY,IAAI,EAAE,QAAQ,EACxB,QAAQ,EAAE,QAAQ;IAM7B,IAAI,WAAW,IAAI,gBAAgB,CAOlC;IAED,IAAI,WAAW,IAAI,WAAW,CAE7B;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,IAAI,QAAQ,IAAI,QAAQ,CAEvB;IAED,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED,IAAI,cAAc,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEzD;IAED,IAAI,6BAA6B,IAAI,MAAM,CAE1C;IAED,IAAI,sBAAsB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAEpG;IAED,IAAI,+BAA+B,IAAI,OAAO,CAE7C;IAED,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAInC,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,iBAAiB,IAAI,OAAO,CAAC,OAAO,kCAAkC,EAAE,EAAE,CAAC;IAI3E,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,EAAE,SAAS,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,0BAA0B,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,QAAQ,KAAK,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,CAAA;IAG3C,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO;IAIzC,OAAO,CAAC,MAAM,CAAC,qCAAqC;IAIpD,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,KAAK,IAAI,GAAG,IAAI;IAEzH,cAAc,IAAI,MAAM;IAUxB,UAAU,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO;IAM1D,gBAAgB,IAAI,MAAM,GAAG,OAAO;IAKpC,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM;IAWxD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC;IAa3G,SAAS,CAAC,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,GAAG,IAAI;IAoBlI,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAQhC,OAAO,CAAC,oBAAoB;IAM5B,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,4BAA4B,GAAG,sBAAsB;cASlH,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;cAiJrC,kBAAkB,CAAC,WAAW,EAAE,gBAAgB;YAQlD,kBAAkB;IAqChC;;;;;;;;;OASG;IACU,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU;cAoB1D,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,oBAAoB,EAClC,YAAY,EAAE,YAAY,GAAG,SAAS,EACtC,IAAI,EAAE,IAAI,EACV,4BAA4B,EAAE,EAAE,EAChC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;IAqBxB,SAAS,CAAC,8BAA8B,CAAC,WAAW,EAAE,gBAAgB,GAAG,eAAe,GAAG,IAAI;IAI/F,OAAO,CAAC,YAAY;IAuFpB,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjH,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAIvB,kBAAkB;IA4BzB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAIvC,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI3D,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAUnC,qCAAqC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIhE,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;YAIxC,kBAAkB;YAyClB,kBAAkB;IAkBhC,uBAAuB,CACrB,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,EAClB,eAAe,UAAO,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,SAAsC,GAChD,MAAM,GAAG,IAAI;IAMhB,yBAAyB,CACvB,qBAAqB,EAAE,qBAAqB,GAAG,OAAO,EACtD,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,EAClB,cAAc,CAAC,EAAE,MAAM,EACvB,eAAe,UAAO,EACtB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM;IAKT,qBAAqB,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,SAAS;;;;IAQhH,+BAA+B,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM;IAKhI,OAAO,CAAC,mBAAmB;IAO3B,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,GAAQ,EAAE,sBAAsB,UAAO,GAAG,MAAM;IAI1G,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM;IAM5F,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI5C,IAAI,gBAAgB,IAAI,KAAK,CAAC,eAAe,CAAC,CAE7C;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA+B5F,IAAI,gBAAgB,IAAI,OAAO,CAG9B;IAED,OAAO,CAAC,mBAAmB,CAAiD;IAC5E,SAAS,CAAC,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAYjF,OAAO,CAAC,sBAAsB,CAAqC;IAC7D,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAqB7C,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA0B5E,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAMlC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;CA4B9H;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,WAE5C;AAED,wBAAgB,+BAA+B,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,EAAE,gBAAgB,EAAE,MAAM,MAAM,GAAG,MAAM,GAAG,IAAI,CAe3H;AAGD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,UAEvC;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,OAAO,GAAG,CAAC,GAAG,OAAO,CAE9E"}

package/dist/platformPackager.js

@@ -208,7 +208,7 @@ export class PlatformPackager {
         }
         // Due to node-gyp rewriting GYP_MSVS_VERSION when reused across the same session, we must reset the env var: https://github.com/electron-userland/electron-builder/issues/7256
         delete process.env.GYP_MSVS_VERSION;
-        const { outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets, options } = packOptions;
+        const { outDir, appOutDir, platformName, platformType, arch, platformSpecificBuildOptions, targets, options } = packOptions;
         await this.info.emitBeforePack({
             appOutDir,
             outDir,
@@ -288,6 +288,7 @@ export class PlatformPackager {
                 appOutDir,
                 asarIntegrity,
                 platformName,
+                platformType,
             });
         }
         if (this.info.cancellationToken.cancelled) {
@@ -309,7 +310,7 @@ export class PlatformPackager {
             await this.doAddElectronFuses(packContext);
         }
         if (options?.sign ?? true) {
-            await this.doSignAfterPack(outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets);
+            await this.doSignAfterPack(outDir, appOutDir, platformName, platformType, arch, platformSpecificBuildOptions, targets);
         }
     }
     // the fuses MUST be flipped right before signing
@@ -351,6 +352,9 @@ export class PlatformPackager {
         if (fuses.grantFileProtocolExtraPrivileges != null) {
             config[FuseV1Options.GrantFileProtocolExtraPrivileges] = fuses.grantFileProtocolExtraPrivileges;
         }
+        if (fuses.wasmTrapHandlers != null) {
+            config[FuseV1Options.WasmTrapHandlers] = fuses.wasmTrapHandlers;
+        }
         return config;
     }
     /**
@@ -379,7 +383,7 @@ export class PlatformPackager {
         const { flipFuses } = await dynamicImport("@electron/fuses");
         return flipFuses(electronBinaryPath, fuses);
     }
-    async doSignAfterPack(outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets) {
+    async doSignAfterPack(outDir, appOutDir, platformName, platformType, arch, platformSpecificBuildOptions, targets) {
         const asarOptions = await this.computeAsarOptions(platformSpecificBuildOptions);
         const isAsar = asarOptions != null;
         const packContext = {
@@ -390,7 +394,7 @@ export class PlatformPackager {
             packager: this,
             electronPlatformName: platformName,
         };
-        const didSign = await this.signApp(packContext, isAsar);
+        const didSign = await this.signApp(packContext, isAsar, platformType);
         if (didSign) {
             await this.info.emitAfterSign(packContext);
         }
@@ -474,7 +478,7 @@ export class PlatformPackager {
         }
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    signApp(packContext, isAsar) {
+    signApp(packContext, isAsar, _platformType) {
         return Promise.resolve(false);
     }
     getIconPath() {
@@ -529,7 +533,7 @@ export class PlatformPackager {
         }
         const relativeFile = path.relative(this.info.appDir, path.resolve(this.info.appDir, file));
         if (isAsar) {
-            await checkFileInArchive(path.join(resourcesDir, "app.asar"), relativeFile, messagePrefix);
+            checkFileInArchive(path.join(resourcesDir, "app.asar"), relativeFile, messagePrefix);
             return;
         }
         const pathParsed = path.parse(file);
@@ -548,7 +552,7 @@ export class PlatformPackager {
             const asarPath = path.join(...pathSplit.slice(0, partWithAsarIndex + 1));
             let mainPath = pathSplit.length > partWithAsarIndex + 1 ? path.join.apply(pathSplit.slice(partWithAsarIndex + 1)) : "";
             mainPath += path.join(mainPath, pathParsed.base);
-            await checkFileInArchive(path.join(resourcesDir, "app", asarPath), mainPath, messagePrefix);
+            checkFileInArchive(path.join(resourcesDir, "app", asarPath), mainPath, messagePrefix);
         }
         else {
             const fullPath = path.join(resourcesDir, "app", relativeFile);