app-builder-lib 27.0.0-alpha.2 → 27.0.0-alpha.4

package/dist/macPackager.d.ts

@@ -1,28 +1,31 @@
-import { SignOptions } from "@electron/osx-sign/dist/cjs/types";
-import type { Identity } from "@electron/osx-sign/dist/cjs/util-identities";
+import type { SignOptions } from "@electron/osx-sign";
 import { Arch, AsyncTaskManager } from "builder-util";
 import { MemoLazy, Nullish } from "builder-util-runtime";
 import { AppInfo } from "./appInfo.js";
-import { CodeSigningInfo, CreateKeychainOptions } from "./codeSign/mac/macCodeSign.js";
+import { CodeSigningInfo, CreateKeychainOptions, Identity } from "./codeSign/mac/macCodeSign.js";
 import { Target } from "./core.js";
-import { AfterPackContext } from "./index.js";
-import { MacTargetHelper } from "./targets/mac/MacTargetHelper.js";
+import { AfterPackContext, ElectronPlatformName } from "./index.js";
+import { MacTargetHelper, PlatformType } from "./targets/mac/MacTargetHelper.js";
 import { MacConfiguration, MasConfiguration } from "./options/macOptions.js";
 import { Packager } from "./packager.js";
 import { DoPackOptions, PlatformPackager } from "./platformPackager.js";
 export type CustomMacSignOptions = SignOptions;
 export type CustomMacSign = (configuration: CustomMacSignOptions, packager: MacPackager) => Promise<void>;
+interface PlatformConfig {
+    type: PlatformType;
+    config: MacConfiguration | MasConfiguration;
+    platformName: ElectronPlatformName;
+}
 export declare class MacPackager extends PlatformPackager<MacConfiguration | MasConfiguration> {
     readonly codeSigningInfo: MemoLazy<CreateKeychainOptions | null, CodeSigningInfo>;
     private _iconPath;
-    private _activePackConfig;
     readonly helper: MacTargetHelper;
     constructor(info: Packager);
     get defaultTarget(): Array<string>;
     /**
      * Get the merged configuration for a specific platform type
      */
-    private getPlatformConfig;
+    getPlatformConfig(platformType: PlatformType): PlatformConfig;
     expandArch(pattern: string, arch?: Arch | null): string[];
     protected prepareAppInfo(appInfo: AppInfo): AppInfo;
     getIconPath(): Promise<string | null>;
@@ -32,6 +35,11 @@ export declare class MacPackager extends PlatformPackager<MacConfiguration | Mas
      * Handle universal build packing
      */
     private doUniversalPack;
+    /**
+     * Builds the `singleArchFiles` glob passed to `@electron/universal` by scanning both packed slices for
+     * single-architecture binaries that can't be lipo-merged. Merges any user-provided `mac.universal.singleArchFiles`.
+     */
+    private computeSingleArchFiles;
     pack(outDir: string, arch: Arch, targets: Array<Target>, taskManager: AsyncTaskManager): Promise<void>;
     private packMasTargets;
     private packMacTargets;
@@ -40,11 +48,12 @@ export declare class MacPackager extends PlatformPackager<MacConfiguration | Mas
      * Main signing method with platform awareness
      */
     private sign;
-    protected doSign(opts: SignOptions, customSignOptions: MacConfiguration | MasConfiguration, identity: Identity | null): Promise<void>;
+    protected doSign(opts: SignOptions, signConfig: MacConfiguration["sign"], identity: Identity | null): Promise<void>;
     doFlat(appPath: string, outFile: string, identity: Identity, keychain: string | Nullish): Promise<any>;
     getElectronSrcDir(dist: string): string;
     getElectronDestinationDir(appOutDir: string): string;
-    applyCommonInfo(appPlist: any, contentsPath: string): Promise<void>;
-    protected signApp(packContext: AfterPackContext, isAsar: boolean): Promise<boolean>;
+    applyCommonInfo(appPlist: any, contentsPath: string, cascadedOptions: MacConfiguration | MasConfiguration): Promise<void>;
+    protected signApp(packContext: AfterPackContext, isAsar: boolean, platformType?: PlatformType): Promise<boolean>;
 }
+export {};
 //# sourceMappingURL=macPackager.d.ts.map

package/dist/macPackager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"macPackager.d.ts","sourceRoot":"","sources":["../src/macPackager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6CAA6C,CAAA;AAG3E,OAAO,EACL,IAAI,EACJ,gBAAgB,EAYjB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAKxD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,eAAe,EAAkB,qBAAqB,EAAuC,MAAM,+BAA+B,CAAA;AAC3I,OAAO,EAAwB,MAAM,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAwB,MAAM,YAAY,CAAA;AACnE,OAAO,EAAE,eAAe,EAAgB,MAAM,kCAAkC,CAAA;AAChF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAiB,aAAa,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAStF,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAA;AAC9C,MAAM,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,oBAAoB,EAAE,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AASzG,qBAAa,WAAY,SAAQ,gBAAgB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IACpF,QAAQ,CAAC,eAAe,0DA+BvB;IAED,OAAO,CAAC,SAAS,CAAgD;IAIjE,OAAO,CAAC,iBAAiB,CAAmD;IAE5E,QAAQ,CAAC,MAAM,kBAA4B;gBAE/B,IAAI,EAAE,QAAQ;IAI1B,IAAI,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,CAEjC;IAED;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,EAAE;IAUzD,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO;IAK7C,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI3C,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,KAAK,IAAI,GAAG,IAAI;cA8BhG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAc7E;;OAEG;YACW,eAAe;IA8FvB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;YAiB9F,cAAc;YAiCd,cAAc;YAkBd,OAAO;IAKrB;;OAEG;YACW,IAAI;cA4CF,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB9H,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAY5G,iBAAiB,CAAC,IAAI,EAAE,MAAM;IAI9B,yBAAyB,CAAC,SAAS,EAAE,MAAM;IAK5C,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM;cAyEzC,OAAO,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;CAiC1F"}
+{"version":3,"file":"macPackager.d.ts","sourceRoot":"","sources":["../src/macPackager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGrD,OAAO,EACL,IAAI,EACJ,gBAAgB,EAYjB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAKxD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,eAAe,EAAkB,qBAAqB,EAAE,QAAQ,EAAuC,MAAM,+BAA+B,CAAA;AACrJ,OAAO,EAAwB,MAAM,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AAChF,OAAO,EAAuB,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACjG,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAiB,aAAa,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAUtF,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAA;AAC9C,MAAM,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,oBAAoB,EAAE,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAMzG,UAAU,cAAc;IACtB,IAAI,EAAE,YAAY,CAAA;IAClB,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAAA;IAC3C,YAAY,EAAE,oBAAoB,CAAA;CACnC;AAED,qBAAa,WAAY,SAAQ,gBAAgB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IACpF,QAAQ,CAAC,eAAe,0DA+BvB;IAED,OAAO,CAAC,SAAS,CAAgD;IAEjE,QAAQ,CAAC,MAAM,kBAA4B;gBAE/B,IAAI,EAAE,QAAQ;IAI1B,IAAI,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,CAEjC;IAED;;OAEG;IACH,iBAAiB,CAAC,YAAY,EAAE,YAAY,GAAG,cAAc;IA2B7D,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,EAAE;IAUzD,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO;IAK7C,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI3C,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,KAAK,IAAI,GAAG,IAAI;cA8BhG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAO7E;;OAEG;YACW,eAAe;IAyG7B;;;OAGG;YACW,sBAAsB;IA2B9B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;YAiB9F,cAAc;YAmCd,cAAc;YAmBd,OAAO;IAKrB;;OAEG;YACW,IAAI;cAqDF,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB5G,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAY5G,iBAAiB,CAAC,IAAI,EAAE,MAAM;IAI9B,yBAAyB,CAAC,SAAS,EAAE,MAAM;IAK5C,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;cAyE/G,OAAO,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;CAgCvH"}

package/dist/macPackager.js

@@ -14,10 +14,14 @@ import { chooseNotNull, PlatformPackager } from "./platformPackager.js";
 import { ArchiveTarget } from "./targets/ArchiveTarget.js";
 import { PkgTarget, prepareProductBuildArgs } from "./targets/mac/pkg.js";
 import { createCommonTarget, NoOpTarget } from "./targets/targetFactory.js";
-import { dynamicImport } from "./util/dynamicImport.js";
 import { isMacOsHighSierra } from "./util/mac/macosVersion.js";
+import { buildSingleArchFilesPattern, collectIdenticalSingleArchMachOFiles, collectSingleArchPackageNames } from "./util/archCompatibility.js";
 import { expandMacro as doExpandMacro } from "./util/macroExpander.js";
 import { resolveFunction } from "./util/resolve.js";
+import { makeUniversalApp } from "@electron/universal";
+function isElectronSignOptions(sign) {
+    return typeof sign === "object" && sign !== null;
+}
 export class MacPackager extends PlatformPackager {
     constructor(info) {
         super(info, Platform.MAC);
@@ -48,9 +52,6 @@ export class MacPackager extends PlatformPackager {
             return Promise.resolve({ keychainFile: process.env.CSC_KEYCHAIN || null });
         });
         this._iconPath = new Lazy(() => this.getOrConvertIcon("icns"));
-        // Set/cleared in doPack so applyCommonInfo can read the per-pack platformSpecificBuildOptions
-        // (the framework call chain doesn't thread it through to applyCommonInfo). Fixes #8909.
-        this._activePackConfig = null;
         this.helper = new MacTargetHelper(this);
     }
     get defaultTarget() {
@@ -61,29 +62,25 @@ export class MacPackager extends PlatformPackager {
      */
     getPlatformConfig(platformType) {
         let config;
-        let isDevelopment = false;
         let platformName;
         switch (platformType) {
             case "mas":
                 config = deepAssign({}, this.platformSpecificBuildOptions, this.config.mas);
-                isDevelopment = false;
                 platformName = "mas";
                 break;
             case "mas-dev":
-                config = deepAssign({}, this.platformSpecificBuildOptions, this.config.mas, this.config.masDev, {
-                    type: "development",
-                });
-                isDevelopment = true;
+                // `mas-dev` cascades mac → mas → masDev. The development/distribution distinction is no longer
+                // carried as a config field; it is derived from `platformType` wherever signing happens.
+                config = deepAssign({}, this.platformSpecificBuildOptions, this.config.mas, this.config.masDev);
                 platformName = "mas";
                 break;
             case "mac":
             default:
                 config = this.platformSpecificBuildOptions;
-                isDevelopment = false;
                 platformName = this.platform.nodeName;
                 break;
         }
-        return { type: platformType, config, isDevelopment, platformName };
+        return { type: platformType, config, platformName };
     }
     expandArch(pattern, arch) {
         if (arch === Arch.universal) {
@@ -130,96 +127,115 @@ export class MacPackager extends PlatformPackager {
         if (config.arch === Arch.universal) {
             return this.doUniversalPack(config);
         }
-        // Bridge the per-pack platformSpecificBuildOptions to applyCommonInfo, which is called deep in the
-        // framework stack (doPack → beforeCopyExtraFiles → createMacApp → applyCommonInfo) without it.
-        this._activePackConfig = config.platformSpecificBuildOptions;
-        try {
-            return await super.doPack(config);
-        }
-        finally {
-            this._activePackConfig = null;
-        }
+        return await super.doPack(config);
     }
     /**
      * Handle universal build packing
      */
     async doUniversalPack(config) {
-        this._activePackConfig = config.platformSpecificBuildOptions;
-        try {
-            const { outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets } = config;
-            const outDirName = (arch) => `${appOutDir}-${Arch[arch]}-temp`;
-            const options = {
-                ...config,
-                options: {
-                    sign: false,
-                    disableAsarIntegrity: true,
-                    disableFuses: true,
-                },
-            };
-            const x64Arch = Arch.x64;
-            const x64AppOutDir = outDirName(x64Arch);
-            await super.doPack({ ...options, appOutDir: x64AppOutDir, arch: x64Arch });
-            if (this.info.cancellationToken.cancelled) {
-                return;
-            }
-            const arm64Arch = Arch.arm64;
-            const arm64AppOutPath = outDirName(arm64Arch);
-            await super.doPack({ ...options, appOutDir: arm64AppOutPath, arch: arm64Arch });
-            if (this.info.cancellationToken.cancelled) {
-                return;
-            }
-            const framework = this.info.framework;
-            log.info({
-                platform: platformName,
-                arch: Arch[arch],
-                [`${framework.name}`]: framework.version,
-                appOutDir: log.filePath(appOutDir),
-            }, `packaging`);
-            const appFile = `${this.appInfo.productFilename}.app`;
-            // Make sure the Assets.car file is the same for both architectures
-            const safeX64AppOutDir = sanitizeDirPath(x64AppOutDir);
-            const safeArm64AppOutPath = sanitizeDirPath(arm64AppOutPath);
-            const safeAppOutDir = sanitizeDirPath(appOutDir);
-            const sourceCatalogPath = path.join(safeX64AppOutDir, appFile, "Contents/Resources/Assets.car");
-            if (await exists(sourceCatalogPath)) {
-                const targetCatalogPath = path.join(safeArm64AppOutPath, appFile, "Contents/Resources/Assets.car");
-                await fs.copyFile(sourceCatalogPath, targetCatalogPath);
-            }
-            const { makeUniversalApp } = await dynamicImport("@electron/universal");
-            await makeUniversalApp({
-                x64AppPath: path.join(safeX64AppOutDir, appFile),
-                arm64AppPath: path.join(safeArm64AppOutPath, appFile),
-                outAppPath: path.join(safeAppOutDir, appFile),
-                force: true,
-                mergeASARs: platformSpecificBuildOptions.mergeASARs ?? true, // must be ?? to allow false
-                singleArchFiles: platformSpecificBuildOptions.singleArchFiles || undefined,
-                x64ArchFiles: platformSpecificBuildOptions.x64ArchFiles || undefined,
-            });
-            await fs.rm(x64AppOutDir, { recursive: true, force: true });
-            await fs.rm(arm64AppOutPath, { recursive: true, force: true });
-            // Give users a final opportunity to perform things on the combined universal package before signing
-            const packContext = {
-                appOutDir,
-                outDir,
-                arch,
-                targets,
-                packager: this,
-                electronPlatformName: platformName,
-            };
-            await this.info.emitAfterPack(packContext);
-            if (this.info.cancellationToken.cancelled) {
-                return;
-            }
-            await this.doAddElectronFuses(packContext);
-            // Mirror the base-class guard: skip signing when the caller explicitly set sign:false
-            // (e.g. packMasTargets passes sign:false so that signMas() is the sole signing step).
-            if (config.options?.sign ?? true) {
-                await this.doSignAfterPack(outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets);
-            }
+        const { outDir, appOutDir, platformName, platformType, arch, platformSpecificBuildOptions, targets } = config;
+        const outDirName = (arch) => `${appOutDir}-${Arch[arch]}-temp`;
+        const options = {
+            ...config,
+            options: {
+                sign: false,
+                disableAsarIntegrity: true,
+                disableFuses: true,
+                // Keep both slices symmetric: don't drop platform-mismatched modules per-arch (that asymmetry breaks
+                // the universal merge). Single-arch binaries are reconciled below via `computeSingleArchFiles`.
+                disableArchFilter: true,
+            },
+        };
+        const x64Arch = Arch.x64;
+        const x64AppOutDir = outDirName(x64Arch);
+        await super.doPack({ ...options, appOutDir: x64AppOutDir, arch: x64Arch });
+        if (this.info.cancellationToken.cancelled) {
+            return;
         }
-        finally {
-            this._activePackConfig = null;
+        const arm64Arch = Arch.arm64;
+        const arm64AppOutPath = outDirName(arm64Arch);
+        await super.doPack({ ...options, appOutDir: arm64AppOutPath, arch: arm64Arch });
+        if (this.info.cancellationToken.cancelled) {
+            return;
         }
+        const framework = this.info.framework;
+        log.info({
+            platform: platformName,
+            arch: Arch[arch],
+            [`${framework.name}`]: framework.version,
+            appOutDir: log.filePath(appOutDir),
+        }, `packaging`);
+        const appFile = `${this.appInfo.productFilename}.app`;
+        // Make sure the Assets.car file is the same for both architectures
+        const safeX64AppOutDir = sanitizeDirPath(x64AppOutDir);
+        const safeArm64AppOutPath = sanitizeDirPath(arm64AppOutPath);
+        const safeAppOutDir = sanitizeDirPath(appOutDir);
+        const sourceCatalogPath = path.join(safeX64AppOutDir, appFile, "Contents/Resources/Assets.car");
+        if (await exists(sourceCatalogPath)) {
+            const targetCatalogPath = path.join(safeArm64AppOutPath, appFile, "Contents/Resources/Assets.car");
+            await fs.copyFile(sourceCatalogPath, targetCatalogPath);
+        }
+        const universalOpts = platformSpecificBuildOptions.universal;
+        // Single-arch binaries that can't be merged into a universal Mach-O. Two sources:
+        //  1. `cpu`/`os`-declared platform packages (e.g. `@esbuild/darwin-arm64`), which the collection filter
+        //     confines to their native slice — mark the whole package so unique non-binary siblings don't trip the merge.
+        //  2. Host binaries identical in both slices inside packages that declare no `cpu`/`os` (e.g. esbuild's
+        //     install script overwriting `esbuild/bin/esbuild` with the platform binary) — mark the file.
+        // Both are reported to `@electron/universal` via `singleArchFiles`; otherwise it aborts on the arch mismatch.
+        const singleArchFiles = await this.computeSingleArchFiles(path.join(safeX64AppOutDir, appFile), path.join(safeArm64AppOutPath, appFile), universalOpts?.singleArchFiles ?? undefined);
+        await makeUniversalApp({
+            mergeASARs: true, // preserve electron-builder v2 default; user can override via mac.universal.mergeASARs
+            ...universalOpts,
+            singleArchFiles,
+            x64AppPath: path.join(safeX64AppOutDir, appFile),
+            arm64AppPath: path.join(safeArm64AppOutPath, appFile),
+            outAppPath: path.join(safeAppOutDir, appFile),
+            force: true,
+        });
+        await fs.rm(x64AppOutDir, { recursive: true, force: true });
+        await fs.rm(arm64AppOutPath, { recursive: true, force: true });
+        // Give users a final opportunity to perform things on the combined universal package before signing
+        const packContext = {
+            appOutDir,
+            outDir,
+            arch,
+            targets,
+            packager: this,
+            electronPlatformName: platformName,
+        };
+        await this.info.emitAfterPack(packContext);
+        if (this.info.cancellationToken.cancelled) {
+            return;
+        }
+        await this.doAddElectronFuses(packContext);
+        // Mirror the base-class guard: skip signing when the caller explicitly set sign:false
+        // (e.g. packMasTargets passes sign:false so that signMas() is the sole signing step).
+        if (config.options?.sign ?? true) {
+            await this.doSignAfterPack(outDir, appOutDir, platformName, platformType, arch, platformSpecificBuildOptions, targets);
+        }
+    }
+    /**
+     * Builds the `singleArchFiles` glob passed to `@electron/universal` by scanning both packed slices for
+     * single-architecture binaries that can't be lipo-merged. Merges any user-provided `mac.universal.singleArchFiles`.
+     */
+    async computeSingleArchFiles(x64AppPath, arm64AppPath, userPattern) {
+        const unpacked = (appPath) => path.join(appPath, "Contents", "Resources", "app.asar.unpacked");
+        const x64Unpacked = unpacked(x64AppPath);
+        const arm64Unpacked = unpacked(arm64AppPath);
+        // (1) `cpu`/`os`-declared platform packages confined to one slice — mark the whole package.
+        const packageNames = new Set();
+        await collectSingleArchPackageNames(path.join(x64Unpacked, "node_modules"), packageNames);
+        await collectSingleArchPackageNames(path.join(arm64Unpacked, "node_modules"), packageNames);
+        // (2) undeclared host binaries identical in both slices (e.g. `esbuild/bin/esbuild`) — mark the file.
+        const machOFiles = await collectIdenticalSingleArchMachOFiles(x64Unpacked, arm64Unpacked);
+        const patterns = [...Array.from(packageNames).map(name => `**/${name}/**`), ...machOFiles];
+        if (patterns.length === 0) {
+            return userPattern;
+        }
+        log.warn({ packages: Array.from(packageNames).sort().join(", ") || "(none)", files: machOFiles.sort().join(", ") || "(none)" }, "Universal build contains single-architecture binaries; they are copied as-is per slice (not lipo-merged), so each is only usable on architectures whose platform package was installed on this build host. " +
+            "If these are build-only tools (e.g. esbuild), move them to `devDependencies` or exclude them via `files` to omit them entirely. " +
+            "If they are needed at runtime, install every target architecture's variant so the universal app works on both Intel and Apple Silicon (pnpm/yarn: `supportedArchitectures`; npm: `--cpu`/`--os`).");
+        return buildSingleArchFilesPattern(patterns, userPattern);
     }
     async pack(outDir, arch, targets, taskManager) {
         const masTargets = targets.filter(it => MacTargetHelper.isMasTarget(it.name));
@@ -247,22 +263,24 @@ export class MacPackager extends PlatformPackager {
             if (relativeTargetOutDir.startsWith("..") || path.isAbsolute(relativeTargetOutDir)) {
                 throw new InvalidConfigurationError(`Invalid target output directory: ${targetOutDir}`);
             }
-            if (prepackaged == null) {
+            let appPath = path.join(targetOutDir, `${this.appInfo.productFilename}.app`);
+            if (prepackaged != null) {
+                appPath = prepackaged;
+            }
+            else {
                 await this.doPack({
                     outDir: resolvedOutDir,
                     appOutDir: targetOutDir,
                     platformName: platformConfig.platformName,
+                    platformType: platformConfig.type,
                     arch,
                     platformSpecificBuildOptions: platformConfig.config,
                     targets: [target],
                     options: { sign: false },
                 });
                 MacTargetHelper.assertSafePathForCommandUsage(this.appInfo.productFilename, "product filename");
-                await this.signMas(path.resolve(targetOutDir, `${path.basename(this.appInfo.productFilename)}.app`), targetOutDir, platformConfig, arch);
-            }
-            else {
-                await this.signMas(prepackaged, targetOutDir, platformConfig, arch);
             }
+            await this.signMas(appPath, targetOutDir, arch, platformType);
         }
     }
     async packMacTargets(outDir, arch, targets, prepackaged, taskManager) {
@@ -273,6 +291,7 @@ export class MacPackager extends PlatformPackager {
                 outDir,
                 appOutDir: path.dirname(appPath),
                 platformName: platformConfig.platformName,
+                platformType: platformConfig.type,
                 arch,
                 platformSpecificBuildOptions: platformConfig.config,
                 targets,
@@ -280,38 +299,46 @@ export class MacPackager extends PlatformPackager {
         }
         this.packageInDistributableFormat(appPath, arch, targets, taskManager);
     }
-    async signMas(appPath, outDir, platformConfig, arch) {
-        const signed = await this.sign(appPath, outDir, platformConfig.config, arch, true);
+    async signMas(appPath, outDir, arch, targetPlatform) {
+        const signed = await this.sign(appPath, outDir, arch, targetPlatform);
         return signed;
     }
     /**
      * Main signing method with platform awareness
      */
-    async sign(appPath, outDir, options, arch, isMas = false) {
+    async sign(appPath, outDir, arch, targetPlatform) {
         if (!isSignAllowed()) {
             return false;
         }
-        const config = options ?? this.platformSpecificBuildOptions;
-        const qualifier = config.identity;
+        // getPlatformConfig cascades mac → mas → masDev, so `sign` (and `sign.identity`) is already merged for this flavor.
+        const config = this.getPlatformConfig(targetPlatform).config.sign;
+        // sign: null → user explicitly disabled signing
+        if (config === null) {
+            return this.helper.handleNullIdentity();
+        }
+        const signOpts = isElectronSignOptions(config) ? config : undefined;
+        // sign.identity: null → explicit skip; undefined → auto-discover
+        const qualifier = signOpts?.identity;
         if (qualifier === null) {
             return this.helper.handleNullIdentity();
         }
         const keychainFile = (await this.codeSigningInfo.value).keychainFile;
-        const explicitType = config.type;
-        const type = explicitType || "distribution";
-        const isDevelopment = type === "development";
-        const identity = await this.helper.findSigningIdentity(isMas, isDevelopment, qualifier, keychainFile, config);
+        // `config` is a custom fn/string module path when it's non-null and not an options object
+        const hasCustomSign = config != null && !signOpts;
+        const isMas = MacTargetHelper.isMasTarget(targetPlatform);
+        const isDevelopment = MacTargetHelper.isMasDevelopment(targetPlatform);
+        const identity = await this.helper.findSigningIdentity(targetPlatform, qualifier, keychainFile, hasCustomSign, signOpts);
         if (!identity) {
             return false;
         }
         if (!isMacOsHighSierra()) {
             throw new InvalidConfigurationError("macOS High Sierra 10.13.6 is required to sign");
         }
-        const signOptions = await this.helper.buildSignOptions(appPath, identity, type, isMas, config, keychainFile, arch);
+        const signOptions = await this.helper.buildSignOptions(appPath, identity, signOpts, keychainFile, arch, targetPlatform);
         await this.doSign(signOptions, config, identity);
         // Handle MAS installer creation
         if (isMas && !isDevelopment && outDir) {
-            await this.helper.createMasInstaller(appPath, outDir, config, keychainFile, isDevelopment, arch);
+            await this.helper.createMasInstaller(appPath, outDir, this.getPlatformConfig(targetPlatform).config, keychainFile, targetPlatform, arch, qualifier);
         }
         // Handle notarization for non-MAS builds
         if (!isMas) {
@@ -320,8 +347,10 @@ export class MacPackager extends PlatformPackager {
         return true;
     }
     //noinspection JSMethodCanBeStatic
-    async doSign(opts, customSignOptions, identity) {
-        const customSign = await resolveFunction(this.appInfo.type, customSignOptions.sign, "sign", await this.info.getWorkspaceRoot());
+    async doSign(opts, signConfig, identity) {
+        // Resolve a custom signer only when signConfig is a function or string module path.
+        // ElectronSignOptions objects and undefined use @electron/osx-sign directly.
+        const customSign = signConfig == null || isElectronSignOptions(signConfig) ? null : await resolveFunction(this.appInfo.type, signConfig, "sign", await this.info.getWorkspaceRoot());
         const { app, platform, type, provisioningProfile } = opts;
         log.info({
             file: log.filePath(app),
@@ -351,7 +380,7 @@ export class MacPackager extends PlatformPackager {
         return path.join(appOutDir, this.info.framework.distMacOsAppName);
     }
     // todo fileAssociations
-    async applyCommonInfo(appPlist, contentsPath) {
+    async applyCommonInfo(appPlist, contentsPath, cascadedOptions) {
         const appInfo = this.appInfo;
         const appFilename = appInfo.productFilename;
         // https://github.com/electron-userland/electron-builder/issues/1278
@@ -392,9 +421,9 @@ export class MacPackager extends PlatformPackager {
         if (minimumSystemVersion != null) {
             appPlist.LSMinimumSystemVersion = minimumSystemVersion;
         }
-        const activeOpts = this._activePackConfig ?? this.platformSpecificBuildOptions;
-        appPlist.CFBundleShortVersionString = activeOpts.bundleShortVersion || appInfo.version;
-        appPlist.CFBundleVersion = activeOpts.bundleVersion || appInfo.buildVersion;
+        // const activeOpts = this.getPlatformConfig(distType).config
+        appPlist.CFBundleShortVersionString = cascadedOptions.bundleShortVersion || appInfo.version;
+        appPlist.CFBundleVersion = cascadedOptions.bundleVersion || appInfo.buildVersion;
         use(this.platformSpecificBuildOptions.category || this.config.category, it => (appPlist.LSApplicationCategoryType = it));
         appPlist.NSHumanReadableCopyright = appInfo.copyright;
         if (this.platformSpecificBuildOptions.darkModeSupport) {
@@ -410,9 +439,8 @@ export class MacPackager extends PlatformPackager {
             }
         }
     }
-    async signApp(packContext, isAsar) {
-        const isMas = packContext.electronPlatformName === "mas";
-        const activeConfig = this._activePackConfig ?? this.platformSpecificBuildOptions;
+    async signApp(packContext, isAsar, platformType) {
+        const targetPlatform = platformType ?? (packContext.electronPlatformName === "mas" ? "mas" : "mac");
         const readDirectoryAndSign = async (sourceDirectory, directories, shouldSign) => {
             const normalizedSourceDirectory = path.resolve(sourceDirectory);
             MacTargetHelper.assertSafePathForCommandUsage(normalizedSourceDirectory, "application output directory");
@@ -424,7 +452,7 @@ export class MacPackager extends PlatformPackager {
                     }
                     const signTarget = path.resolve(normalizedSourceDirectory, entryName);
                     const safeSignTarget = sanitizeDirPath(signTarget, normalizedSourceDirectory);
-                    await this.sign(safeSignTarget, null, isMas ? activeConfig : null, packContext.arch, isMas);
+                    await this.sign(safeSignTarget, null, packContext.arch, targetPlatform);
                 }
             }));
             return true;