app-builder-lib 27.0.0-alpha.3 → 27.0.0-alpha.4

package/dist/util/mac/macosIconComposer.js

@@ -1,7 +1,6 @@
 // Adapted from https://github.com/electron/packager/pull/1806
 import { spawn } from "builder-util";
 import * as fs from "fs/promises";
-import * as os from "node:os";
 import * as path from "node:path";
 import plist from "plist";
 import * as semver from "semver";
@@ -38,62 +37,45 @@ async function checkActoolVersion(tmpDir) {
  * @param inputPath The path to the `.icon` file
  * @returns The asset catalog and extra assets
  */
-export async function generateAssetCatalogForIcon(inputPath) {
-    const tmpDir = await fs.mkdtemp(path.resolve(os.tmpdir(), "icon-compile-"));
-    const cleanup = async () => {
-        await fs.rm(tmpDir, {
-            recursive: true,
-            force: true,
-        });
-    };
-    try {
-        await checkActoolVersion(tmpDir);
-    }
-    catch (error) {
-        await cleanup();
-        throw error;
-    }
-    const iconPath = path.resolve(tmpDir, "Icon.icon");
-    const outputPath = path.resolve(tmpDir, "out");
-    try {
-        await fs.cp(inputPath, iconPath, {
-            recursive: true,
-        });
-        await fs.mkdir(outputPath, {
-            recursive: true,
-        });
-        await spawn("actool", [
-            iconPath,
-            "--compile",
-            outputPath,
-            "--output-format",
-            "human-readable-text",
-            "--notices",
-            "--warnings",
-            "--output-partial-info-plist",
-            path.resolve(outputPath, "assetcatalog_generated_info.plist"),
-            "--app-icon",
-            "Icon",
-            "--include-all-app-icons",
-            "--accent-color",
-            "AccentColor",
-            "--enable-on-demand-resources",
-            "NO",
-            "--development-region",
-            "en",
-            "--target-device",
-            "mac",
-            "--minimum-deployment-target",
-            "26.0",
-            "--platform",
-            "macosx",
-        ]);
-        const assetCatalog = await fs.readFile(path.resolve(outputPath, "Assets.car"));
-        const icnsFile = await fs.readFile(path.resolve(outputPath, "Icon.icns"));
-        return { assetCatalog, icnsFile };
-    }
-    finally {
-        await cleanup();
-    }
+export async function generateAssetCatalogForIcon(tmpDir, inputPath) {
+    const tmpDirPath = await tmpDir.createTempDir({ prefix: "macos-icon-composer" });
+    await checkActoolVersion(tmpDirPath);
+    const iconPath = path.resolve(tmpDirPath, "Icon.icon");
+    const outputPath = path.resolve(tmpDirPath, "out");
+    await fs.cp(inputPath, iconPath, {
+        recursive: true,
+    });
+    await fs.mkdir(outputPath, {
+        recursive: true,
+    });
+    await spawn("actool", [
+        iconPath,
+        "--compile",
+        outputPath,
+        "--output-format",
+        "human-readable-text",
+        "--notices",
+        "--warnings",
+        "--output-partial-info-plist",
+        path.resolve(outputPath, "assetcatalog_generated_info.plist"),
+        "--app-icon",
+        "Icon",
+        "--include-all-app-icons",
+        "--accent-color",
+        "AccentColor",
+        "--enable-on-demand-resources",
+        "NO",
+        "--development-region",
+        "en",
+        "--target-device",
+        "mac",
+        "--minimum-deployment-target",
+        "26.0",
+        "--platform",
+        "macosx",
+    ]);
+    const assetCatalog = await fs.readFile(path.resolve(outputPath, "Assets.car"));
+    const icnsFile = await fs.readFile(path.resolve(outputPath, "Icon.icns"));
+    return { assetCatalog, icnsFile };
 }
 //# sourceMappingURL=macosIconComposer.js.map

package/dist/util/mac/macosIconComposer.js.map

@@ -1 +1 @@
-{"version":3,"file":"macosIconComposer.js","sourceRoot":"","sources":["../../../src/util/mac/macosIconComposer.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACpC,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAOhC,MAAM,4BAA4B,GAAG,IAAI,KAAK,CAC5C,qIAAqI,CACtI,CAAA;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAc;IAC9C,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAE/D,IAAI,WAAW,GAAuD,SAAS,CAAA;IAE/E,IAAI,gBAAgB,GAAyB,IAAI,CAAA;IACjD,IAAI,WAAW,GAAiB,IAAI,CAAA;IACpC,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;QAC3D,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACrG,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;QAC3E,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAA2C,CAAA;IAC1F,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,WAAW,GAAG,CAAC,CAAA;IACjB,CAAC;YAAS,CAAC;QACT,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,gBAAgB,CAAC,KAAK,EAAE,CAAA;QAChC,CAAC;IACH,CAAC;IAED,IAAI,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChJ,MAAM,4BAA4B,CAAA;IACpC,CAAC;IAED,MAAM,aAAa,GAAG,WAAW,CAAC,0BAA0B,CAAC,CAAC,sBAAsB,CAAC,CAAA;IACrF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,4EAA4E,aAAa,oEAAoE,CAAC,CAAA;IAChL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,SAAiB;IACjE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE;YAClB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI;SACZ,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,EAAE,CAAA;QACf,MAAM,KAAK,CAAA;IACb,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE;YAC/B,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,KAAK,CAAC,QAAQ,EAAE;YACpB,QAAQ;YACR,WAAW;YACX,UAAU;YACV,iBAAiB;YACjB,qBAAqB;YACrB,WAAW;YACX,YAAY;YACZ,6BAA6B;YAC7B,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,mCAAmC,CAAC;YAC7D,YAAY;YACZ,MAAM;YACN,yBAAyB;YACzB,gBAAgB;YAChB,aAAa;YACb,8BAA8B;YAC9B,IAAI;YACJ,sBAAsB;YACtB,IAAI;YACJ,iBAAiB;YACjB,KAAK;YACL,6BAA6B;YAC7B,MAAM;YACN,YAAY;YACZ,QAAQ;SACT,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;QAEzE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAA;IACnC,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAA;IACjB,CAAC;AACH,CAAC","sourcesContent":["// Adapted from https://github.com/electron/packager/pull/1806\n\nimport { spawn } from \"builder-util\"\nimport * as fs from \"fs/promises\"\nimport * as os from \"node:os\"\nimport * as path from \"node:path\"\nimport plist from \"plist\"\nimport * as semver from \"semver\"\n\nexport interface AssetCatalogResult {\n  assetCatalog: Buffer\n  icnsFile: Buffer\n}\n\nconst INVALID_ACTOOL_VERSION_ERROR = new Error(\n  \"Failed to check actool version. Is Xcode 26 or higher installed? See output of the `actool --version` CLI command for more details.\"\n)\n\nasync function checkActoolVersion(tmpDir: string) {\n  const acToolOutputFileName = path.resolve(tmpDir, \"actool.log\")\n\n  let versionInfo: Record<string, Record<string, string>> | undefined = undefined\n\n  let acToolOutputFile: fs.FileHandle | null = null\n  let errorQueued: Error | null = null\n  try {\n    acToolOutputFile = await fs.open(acToolOutputFileName, \"w\")\n    await spawn(\"actool\", [\"--version\"], { stdio: [\"ignore\", acToolOutputFile.fd, acToolOutputFile.fd] })\n    const acToolVersionOutput = await fs.readFile(acToolOutputFileName, \"utf8\")\n    versionInfo = plist.parse(acToolVersionOutput) as Record<string, Record<string, string>>\n  } catch (e: any) {\n    errorQueued = e\n  } finally {\n    if (acToolOutputFile) {\n      await acToolOutputFile.close()\n    }\n  }\n\n  if (errorQueued || !versionInfo || !versionInfo[\"com.apple.actool.version\"] || !versionInfo[\"com.apple.actool.version\"][\"short-bundle-version\"]) {\n    throw INVALID_ACTOOL_VERSION_ERROR\n  }\n\n  const acToolVersion = versionInfo[\"com.apple.actool.version\"][\"short-bundle-version\"]\n  if (!semver.gte(semver.coerce(acToolVersion)!, \"26.0.0\")) {\n    throw new Error(`Unsupported actool version. Must be on actool 26.0.0 or higher but found ${acToolVersion}. Install Xcode 26 or higher to get a supported version of actool.`)\n  }\n}\n\n/**\n * Generates an asset catalog and extra assets that are useful for packaging the app.\n * @param inputPath The path to the `.icon` file\n * @returns The asset catalog and extra assets\n */\nexport async function generateAssetCatalogForIcon(inputPath: string): Promise<AssetCatalogResult> {\n  const tmpDir = await fs.mkdtemp(path.resolve(os.tmpdir(), \"icon-compile-\"))\n  const cleanup = async () => {\n    await fs.rm(tmpDir, {\n      recursive: true,\n      force: true,\n    })\n  }\n\n  try {\n    await checkActoolVersion(tmpDir)\n  } catch (error) {\n    await cleanup()\n    throw error\n  }\n\n  const iconPath = path.resolve(tmpDir, \"Icon.icon\")\n  const outputPath = path.resolve(tmpDir, \"out\")\n\n  try {\n    await fs.cp(inputPath, iconPath, {\n      recursive: true,\n    })\n\n    await fs.mkdir(outputPath, {\n      recursive: true,\n    })\n\n    await spawn(\"actool\", [\n      iconPath,\n      \"--compile\",\n      outputPath,\n      \"--output-format\",\n      \"human-readable-text\",\n      \"--notices\",\n      \"--warnings\",\n      \"--output-partial-info-plist\",\n      path.resolve(outputPath, \"assetcatalog_generated_info.plist\"),\n      \"--app-icon\",\n      \"Icon\",\n      \"--include-all-app-icons\",\n      \"--accent-color\",\n      \"AccentColor\",\n      \"--enable-on-demand-resources\",\n      \"NO\",\n      \"--development-region\",\n      \"en\",\n      \"--target-device\",\n      \"mac\",\n      \"--minimum-deployment-target\",\n      \"26.0\",\n      \"--platform\",\n      \"macosx\",\n    ])\n\n    const assetCatalog = await fs.readFile(path.resolve(outputPath, \"Assets.car\"))\n    const icnsFile = await fs.readFile(path.resolve(outputPath, \"Icon.icns\"))\n\n    return { assetCatalog, icnsFile }\n  } finally {\n    await cleanup()\n  }\n}\n"]}
+{"version":3,"file":"macosIconComposer.js","sourceRoot":"","sources":["../../../src/util/mac/macosIconComposer.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EAAE,KAAK,EAAU,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAOhC,MAAM,4BAA4B,GAAG,IAAI,KAAK,CAC5C,qIAAqI,CACtI,CAAA;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAc;IAC9C,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAE/D,IAAI,WAAW,GAAuD,SAAS,CAAA;IAE/E,IAAI,gBAAgB,GAAyB,IAAI,CAAA;IACjD,IAAI,WAAW,GAAiB,IAAI,CAAA;IACpC,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;QAC3D,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACrG,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;QAC3E,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAA2C,CAAA;IAC1F,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,WAAW,GAAG,CAAC,CAAA;IACjB,CAAC;YAAS,CAAC;QACT,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,gBAAgB,CAAC,KAAK,EAAE,CAAA;QAChC,CAAC;IACH,CAAC;IAED,IAAI,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChJ,MAAM,4BAA4B,CAAA;IACpC,CAAC;IAED,MAAM,aAAa,GAAG,WAAW,CAAC,0BAA0B,CAAC,CAAC,sBAAsB,CAAC,CAAA;IACrF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,4EAA4E,aAAa,oEAAoE,CAAC,CAAA;IAChL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,MAAc,EAAE,SAAiB;IACjF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAEhF,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAElD,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE;QAC/B,SAAS,EAAE,IAAI;KAChB,CAAC,CAAA;IAEF,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE;QACzB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAA;IAEF,MAAM,KAAK,CAAC,QAAQ,EAAE;QACpB,QAAQ;QACR,WAAW;QACX,UAAU;QACV,iBAAiB;QACjB,qBAAqB;QACrB,WAAW;QACX,YAAY;QACZ,6BAA6B;QAC7B,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,mCAAmC,CAAC;QAC7D,YAAY;QACZ,MAAM;QACN,yBAAyB;QACzB,gBAAgB;QAChB,aAAa;QACb,8BAA8B;QAC9B,IAAI;QACJ,sBAAsB;QACtB,IAAI;QACJ,iBAAiB;QACjB,KAAK;QACL,6BAA6B;QAC7B,MAAM;QACN,YAAY;QACZ,QAAQ;KACT,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAA;IAC9E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;IAEzE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAA;AACnC,CAAC","sourcesContent":["// Adapted from https://github.com/electron/packager/pull/1806\n\nimport { spawn, TmpDir } from \"builder-util\"\nimport * as fs from \"fs/promises\"\nimport * as path from \"node:path\"\nimport plist from \"plist\"\nimport * as semver from \"semver\"\n\nexport interface AssetCatalogResult {\n  assetCatalog: Buffer\n  icnsFile: Buffer\n}\n\nconst INVALID_ACTOOL_VERSION_ERROR = new Error(\n  \"Failed to check actool version. Is Xcode 26 or higher installed? See output of the `actool --version` CLI command for more details.\"\n)\n\nasync function checkActoolVersion(tmpDir: string) {\n  const acToolOutputFileName = path.resolve(tmpDir, \"actool.log\")\n\n  let versionInfo: Record<string, Record<string, string>> | undefined = undefined\n\n  let acToolOutputFile: fs.FileHandle | null = null\n  let errorQueued: Error | null = null\n  try {\n    acToolOutputFile = await fs.open(acToolOutputFileName, \"w\")\n    await spawn(\"actool\", [\"--version\"], { stdio: [\"ignore\", acToolOutputFile.fd, acToolOutputFile.fd] })\n    const acToolVersionOutput = await fs.readFile(acToolOutputFileName, \"utf8\")\n    versionInfo = plist.parse(acToolVersionOutput) as Record<string, Record<string, string>>\n  } catch (e: any) {\n    errorQueued = e\n  } finally {\n    if (acToolOutputFile) {\n      await acToolOutputFile.close()\n    }\n  }\n\n  if (errorQueued || !versionInfo || !versionInfo[\"com.apple.actool.version\"] || !versionInfo[\"com.apple.actool.version\"][\"short-bundle-version\"]) {\n    throw INVALID_ACTOOL_VERSION_ERROR\n  }\n\n  const acToolVersion = versionInfo[\"com.apple.actool.version\"][\"short-bundle-version\"]\n  if (!semver.gte(semver.coerce(acToolVersion)!, \"26.0.0\")) {\n    throw new Error(`Unsupported actool version. Must be on actool 26.0.0 or higher but found ${acToolVersion}. Install Xcode 26 or higher to get a supported version of actool.`)\n  }\n}\n\n/**\n * Generates an asset catalog and extra assets that are useful for packaging the app.\n * @param inputPath The path to the `.icon` file\n * @returns The asset catalog and extra assets\n */\nexport async function generateAssetCatalogForIcon(tmpDir: TmpDir, inputPath: string): Promise<AssetCatalogResult> {\n  const tmpDirPath = await tmpDir.createTempDir({ prefix: \"macos-icon-composer\" })\n\n  await checkActoolVersion(tmpDirPath)\n\n  const iconPath = path.resolve(tmpDirPath, \"Icon.icon\")\n  const outputPath = path.resolve(tmpDirPath, \"out\")\n\n  await fs.cp(inputPath, iconPath, {\n    recursive: true,\n  })\n\n  await fs.mkdir(outputPath, {\n    recursive: true,\n  })\n\n  await spawn(\"actool\", [\n    iconPath,\n    \"--compile\",\n    outputPath,\n    \"--output-format\",\n    \"human-readable-text\",\n    \"--notices\",\n    \"--warnings\",\n    \"--output-partial-info-plist\",\n    path.resolve(outputPath, \"assetcatalog_generated_info.plist\"),\n    \"--app-icon\",\n    \"Icon\",\n    \"--include-all-app-icons\",\n    \"--accent-color\",\n    \"AccentColor\",\n    \"--enable-on-demand-resources\",\n    \"NO\",\n    \"--development-region\",\n    \"en\",\n    \"--target-device\",\n    \"mac\",\n    \"--minimum-deployment-target\",\n    \"26.0\",\n    \"--platform\",\n    \"macosx\",\n  ])\n\n  const assetCatalog = await fs.readFile(path.resolve(outputPath, \"Assets.car\"))\n  const icnsFile = await fs.readFile(path.resolve(outputPath, \"Icon.icns\"))\n\n  return { assetCatalog, icnsFile }\n}\n"]}

package/dist/util/streamSpawnToFile.d.ts

@@ -0,0 +1,47 @@
+export interface StreamSpawnResult {
+    /** The child's exit code (null if it was killed by a signal). */
+    code: number | null;
+    /** Everything the child wrote to stderr, accumulated. */
+    stderr: string;
+}
+/**
+ * Spawns a command and streams its stdout to a file, returning the exit code and captured stderr.
+ *
+ * stdout is piped straight to `outputFile` (never buffered in memory), so arbitrarily large output —
+ * a full dependency tree, a verbose `install` log — costs no heap. stderr is small by comparison and
+ * is accumulated so the caller can surface it on failure.
+ *
+ * On Windows the package-manager command is typically a `.cmd` shim (npm.cmd/pnpm.cmd/yarn.cmd),
+ * which Node can no longer spawn directly (CVE-2024-27980). Rather than spawn with `shell: true` —
+ * which emits the DEP0190 "args with shell" deprecation warning and forces manual metacharacter
+ * escaping — wrap the invocation in a single PowerShell `-EncodedCommand`. The base64 (UTF-16LE)
+ * payload sidesteps every shell-quoting layer, and `powershell.exe` is a real executable we spawn
+ * directly with no shell. See buildPowerShellEncodedArgs for the UTF-8 / exit-code handling. This
+ * also avoids the cmd.exe "The batch file cannot be found." re-open race that plagues `.cmd` shims.
+ *
+ * Resolves with `{ code, stderr }` for ANY exit code — interpreting a non-zero code is the caller's
+ * job (e.g. `npm list` returns 1 in expected scenarios). Only genuine infrastructure failures —
+ * spawn errors and write-stream errors — reject.
+ *
+ * @param command - The command to execute
+ * @param args - Array of command-line arguments
+ * @param cwd - The working directory to execute the command in
+ * @param outputFile - The path to the file where stdout will be streamed
+ * @param env - The environment for the child process (callers are responsible for stripping secrets)
+ */
+export declare function streamSpawnToFile(command: string, args: string[], cwd: string, outputFile: string, env: NodeJS.ProcessEnv): Promise<StreamSpawnResult>;
+/**
+ * Build the argv for invoking a Windows command through `powershell.exe -EncodedCommand`.
+ *
+ * Each token is wrapped in a PowerShell single-quoted string (with embedded single quotes doubled),
+ * so no character is interpreted by a shell. The script:
+ *   - pins `[Console]::OutputEncoding` to UTF-8 *without* a BOM so the JSON dependency tree is not
+ *     corrupted by the console's OEM code page (and no BOM is prepended to break `JSON.parse`),
+ *   - invokes the command via the call operator `&`,
+ *   - re-emits the command's own exit code via `exit $LASTEXITCODE` (e.g. `npm list` returns 1 in
+ *     expected scenarios, which the caller's shouldIgnore logic relies on).
+ *
+ * The whole script is base64-encoded as UTF-16LE per PowerShell's `-EncodedCommand` contract.
+ */
+export declare function buildPowerShellEncodedArgs(command: string, args: string[]): string[];
+//# sourceMappingURL=streamSpawnToFile.d.ts.map

package/dist/util/streamSpawnToFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamSpawnToFile.d.ts","sourceRoot":"","sources":["../../src/util/streamSpawnToFile.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkEtJ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAMpF"}

package/dist/util/streamSpawnToFile.js

@@ -0,0 +1,110 @@
+import * as childProcess from "child_process";
+import { createWriteStream } from "node:fs";
+/**
+ * Spawns a command and streams its stdout to a file, returning the exit code and captured stderr.
+ *
+ * stdout is piped straight to `outputFile` (never buffered in memory), so arbitrarily large output —
+ * a full dependency tree, a verbose `install` log — costs no heap. stderr is small by comparison and
+ * is accumulated so the caller can surface it on failure.
+ *
+ * On Windows the package-manager command is typically a `.cmd` shim (npm.cmd/pnpm.cmd/yarn.cmd),
+ * which Node can no longer spawn directly (CVE-2024-27980). Rather than spawn with `shell: true` —
+ * which emits the DEP0190 "args with shell" deprecation warning and forces manual metacharacter
+ * escaping — wrap the invocation in a single PowerShell `-EncodedCommand`. The base64 (UTF-16LE)
+ * payload sidesteps every shell-quoting layer, and `powershell.exe` is a real executable we spawn
+ * directly with no shell. See buildPowerShellEncodedArgs for the UTF-8 / exit-code handling. This
+ * also avoids the cmd.exe "The batch file cannot be found." re-open race that plagues `.cmd` shims.
+ *
+ * Resolves with `{ code, stderr }` for ANY exit code — interpreting a non-zero code is the caller's
+ * job (e.g. `npm list` returns 1 in expected scenarios). Only genuine infrastructure failures —
+ * spawn errors and write-stream errors — reject.
+ *
+ * @param command - The command to execute
+ * @param args - Array of command-line arguments
+ * @param cwd - The working directory to execute the command in
+ * @param outputFile - The path to the file where stdout will be streamed
+ * @param env - The environment for the child process (callers are responsible for stripping secrets)
+ */
+export function streamSpawnToFile(command, args, cwd, outputFile, env) {
+    const [spawnCommand, spawnArgs] = process.platform === "win32" ? ["powershell.exe", buildPowerShellEncodedArgs(command, args)] : [command, args];
+    return new Promise((resolve, reject) => {
+        const outStream = createWriteStream(outputFile);
+        const child = childProcess.spawn(spawnCommand, spawnArgs, { cwd, env });
+        let stderr = "";
+        // The process can close before all piped stdout has been flushed to disk. Resolving on the
+        // child's "close" alone races the write stream and lets the caller read a TRUNCATED file
+        // (manifesting as "No JSON content found in output"). Gate the settle on BOTH the child exit
+        // (for the code/stderr) and the write stream's "finish" (all bytes flushed).
+        let exitCode = null;
+        let childClosed = false;
+        let streamFinished = false;
+        let settled = false;
+        // `pipe` ends `outStream` when stdout EOFs, which triggers its "finish" once flushed.
+        child.stdout.pipe(outStream);
+        child.stderr.on("data", chunk => {
+            stderr += chunk.toString();
+        });
+        const fail = (err) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            // Best-effort cleanup: stop the child and close the stream so we don't
+            // waste CPU writing to a broken fd after rejection.
+            try {
+                child.kill();
+            }
+            catch {
+                // ignore
+            }
+            try {
+                outStream.destroy();
+            }
+            catch {
+                // ignore
+            }
+            reject(err);
+        };
+        const settle = () => {
+            if (settled || !childClosed || !streamFinished) {
+                return;
+            }
+            settled = true;
+            resolve({ code: exitCode, stderr });
+        };
+        outStream.on("error", err => fail(new Error(`Failed writing process output (${command}): ${err.message}`)));
+        outStream.on("finish", () => {
+            streamFinished = true;
+            settle();
+        });
+        child.on("error", err => {
+            fail(new Error(`Process spawn (${command} ${JSON.stringify(args)}) failed: ${err.message}`));
+        });
+        child.on("close", code => {
+            exitCode = code;
+            childClosed = true;
+            settle();
+        });
+    });
+}
+/**
+ * Build the argv for invoking a Windows command through `powershell.exe -EncodedCommand`.
+ *
+ * Each token is wrapped in a PowerShell single-quoted string (with embedded single quotes doubled),
+ * so no character is interpreted by a shell. The script:
+ *   - pins `[Console]::OutputEncoding` to UTF-8 *without* a BOM so the JSON dependency tree is not
+ *     corrupted by the console's OEM code page (and no BOM is prepended to break `JSON.parse`),
+ *   - invokes the command via the call operator `&`,
+ *   - re-emits the command's own exit code via `exit $LASTEXITCODE` (e.g. `npm list` returns 1 in
+ *     expected scenarios, which the caller's shouldIgnore logic relies on).
+ *
+ * The whole script is base64-encoded as UTF-16LE per PowerShell's `-EncodedCommand` contract.
+ */
+export function buildPowerShellEncodedArgs(command, args) {
+    const psQuote = (value) => `'${value.replace(/'/g, "''")}'`;
+    const invocation = ["&", psQuote(command), ...args.map(psQuote)].join(" ");
+    const script = `[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new($false); ${invocation}; exit $LASTEXITCODE`;
+    const encoded = Buffer.from(script, "utf16le").toString("base64");
+    return ["-NoProfile", "-NonInteractive", "-EncodedCommand", encoded];
+}
+//# sourceMappingURL=streamSpawnToFile.js.map

package/dist/util/streamSpawnToFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamSpawnToFile.js","sourceRoot":"","sources":["../../src/util/streamSpawnToFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,YAAY,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAS3C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAc,EAAE,GAAW,EAAE,UAAkB,EAAE,GAAsB;IACxH,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAE,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAW,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,IAAI,CAAW,CAAA;IAEtK,OAAO,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxD,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;QAE/C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QAEvE,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,2FAA2F;QAC3F,yFAAyF;QACzF,6FAA6F;QAC7F,6EAA6E;QAC7E,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAClC,IAAI,WAAW,GAAG,KAAK,CAAA;QACvB,IAAI,cAAc,GAAG,KAAK,CAAA;QAC1B,IAAI,OAAO,GAAG,KAAK,CAAA;QAEnB,sFAAsF;QACtF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YAC9B,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;QAC5B,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,CAAC,GAAU,EAAE,EAAE;YAC1B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAM;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAA;YACd,uEAAuE;YACvE,oDAAoD;YACpD,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,EAAE,CAAA;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,SAAS,CAAC,OAAO,EAAE,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAA;QAED,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC/C,OAAM;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAA;YACd,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QACrC,CAAC,CAAA;QAED,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,kCAAkC,OAAO,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3G,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC1B,cAAc,GAAG,IAAI,CAAA;YACrB,MAAM,EAAE,CAAA;QACV,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACtB,IAAI,CAAC,IAAI,KAAK,CAAC,kBAAkB,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAC9F,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACvB,QAAQ,GAAG,IAAI,CAAA;YACf,WAAW,GAAG,IAAI,CAAA;YAClB,MAAM,EAAE,CAAA;QACV,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe,EAAE,IAAc;IACxE,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,sEAAsE,UAAU,sBAAsB,CAAA;IACrH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACjE,OAAO,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;AACtE,CAAC","sourcesContent":["import * as childProcess from \"child_process\"\nimport { createWriteStream } from \"node:fs\"\n\nexport interface StreamSpawnResult {\n  /** The child's exit code (null if it was killed by a signal). */\n  code: number | null\n  /** Everything the child wrote to stderr, accumulated. */\n  stderr: string\n}\n\n/**\n * Spawns a command and streams its stdout to a file, returning the exit code and captured stderr.\n *\n * stdout is piped straight to `outputFile` (never buffered in memory), so arbitrarily large output —\n * a full dependency tree, a verbose `install` log — costs no heap. stderr is small by comparison and\n * is accumulated so the caller can surface it on failure.\n *\n * On Windows the package-manager command is typically a `.cmd` shim (npm.cmd/pnpm.cmd/yarn.cmd),\n * which Node can no longer spawn directly (CVE-2024-27980). Rather than spawn with `shell: true` —\n * which emits the DEP0190 \"args with shell\" deprecation warning and forces manual metacharacter\n * escaping — wrap the invocation in a single PowerShell `-EncodedCommand`. The base64 (UTF-16LE)\n * payload sidesteps every shell-quoting layer, and `powershell.exe` is a real executable we spawn\n * directly with no shell. See buildPowerShellEncodedArgs for the UTF-8 / exit-code handling. This\n * also avoids the cmd.exe \"The batch file cannot be found.\" re-open race that plagues `.cmd` shims.\n *\n * Resolves with `{ code, stderr }` for ANY exit code — interpreting a non-zero code is the caller's\n * job (e.g. `npm list` returns 1 in expected scenarios). Only genuine infrastructure failures —\n * spawn errors and write-stream errors — reject.\n *\n * @param command - The command to execute\n * @param args - Array of command-line arguments\n * @param cwd - The working directory to execute the command in\n * @param outputFile - The path to the file where stdout will be streamed\n * @param env - The environment for the child process (callers are responsible for stripping secrets)\n */\nexport function streamSpawnToFile(command: string, args: string[], cwd: string, outputFile: string, env: NodeJS.ProcessEnv): Promise<StreamSpawnResult> {\n  const [spawnCommand, spawnArgs] = process.platform === \"win32\" ? ([\"powershell.exe\", buildPowerShellEncodedArgs(command, args)] as const) : ([command, args] as const)\n\n  return new Promise<StreamSpawnResult>((resolve, reject) => {\n    const outStream = createWriteStream(outputFile)\n\n    const child = childProcess.spawn(spawnCommand, spawnArgs, { cwd, env })\n\n    let stderr = \"\"\n    // The process can close before all piped stdout has been flushed to disk. Resolving on the\n    // child's \"close\" alone races the write stream and lets the caller read a TRUNCATED file\n    // (manifesting as \"No JSON content found in output\"). Gate the settle on BOTH the child exit\n    // (for the code/stderr) and the write stream's \"finish\" (all bytes flushed).\n    let exitCode: number | null = null\n    let childClosed = false\n    let streamFinished = false\n    let settled = false\n\n    // `pipe` ends `outStream` when stdout EOFs, which triggers its \"finish\" once flushed.\n    child.stdout.pipe(outStream)\n    child.stderr.on(\"data\", chunk => {\n      stderr += chunk.toString()\n    })\n\n    const fail = (err: Error) => {\n      if (settled) {\n        return\n      }\n      settled = true\n      // Best-effort cleanup: stop the child and close the stream so we don't\n      // waste CPU writing to a broken fd after rejection.\n      try {\n        child.kill()\n      } catch {\n        // ignore\n      }\n      try {\n        outStream.destroy()\n      } catch {\n        // ignore\n      }\n      reject(err)\n    }\n\n    const settle = () => {\n      if (settled || !childClosed || !streamFinished) {\n        return\n      }\n      settled = true\n      resolve({ code: exitCode, stderr })\n    }\n\n    outStream.on(\"error\", err => fail(new Error(`Failed writing process output (${command}): ${err.message}`)))\n    outStream.on(\"finish\", () => {\n      streamFinished = true\n      settle()\n    })\n    child.on(\"error\", err => {\n      fail(new Error(`Process spawn (${command} ${JSON.stringify(args)}) failed: ${err.message}`))\n    })\n    child.on(\"close\", code => {\n      exitCode = code\n      childClosed = true\n      settle()\n    })\n  })\n}\n\n/**\n * Build the argv for invoking a Windows command through `powershell.exe -EncodedCommand`.\n *\n * Each token is wrapped in a PowerShell single-quoted string (with embedded single quotes doubled),\n * so no character is interpreted by a shell. The script:\n *   - pins `[Console]::OutputEncoding` to UTF-8 *without* a BOM so the JSON dependency tree is not\n *     corrupted by the console's OEM code page (and no BOM is prepended to break `JSON.parse`),\n *   - invokes the command via the call operator `&`,\n *   - re-emits the command's own exit code via `exit $LASTEXITCODE` (e.g. `npm list` returns 1 in\n *     expected scenarios, which the caller's shouldIgnore logic relies on).\n *\n * The whole script is base64-encoded as UTF-16LE per PowerShell's `-EncodedCommand` contract.\n */\nexport function buildPowerShellEncodedArgs(command: string, args: string[]): string[] {\n  const psQuote = (value: string) => `'${value.replace(/'/g, \"''\")}'`\n  const invocation = [\"&\", psQuote(command), ...args.map(psQuote)].join(\" \")\n  const script = `[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new($false); ${invocation}; exit $LASTEXITCODE`\n  const encoded = Buffer.from(script, \"utf16le\").toString(\"base64\")\n  return [\"-NoProfile\", \"-NonInteractive\", \"-EncodedCommand\", encoded]\n}\n"]}

package/dist/util/toolsetLock.d.ts

@@ -1,2 +1,4 @@
 export declare function withToolsetLock<T>(task: () => Promise<T>): Promise<T>;
+export declare function withSigntoolLock<T>(task: () => Promise<T>): Promise<T>;
+export declare function withIconsLock<T>(task: () => Promise<T>): Promise<T>;
 //# sourceMappingURL=toolsetLock.d.ts.map

package/dist/util/toolsetLock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toolsetLock.d.ts","sourceRoot":"","sources":["../../src/util/toolsetLock.ts"],"names":[],"mappings":"AAQA,wBAAsB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAW3E"}
+{"version":3,"file":"toolsetLock.d.ts","sourceRoot":"","sources":["../../src/util/toolsetLock.ts"],"names":[],"mappings":"AAuBA,wBAAgB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAErE;AAUD,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEtE;AASD,wBAAgB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnE"}

package/dist/util/toolsetLock.js

@@ -3,10 +3,12 @@ import { writeFile } from "fs/promises";
 import * as lockfile from "proper-lockfile";
 import * as os from "os";
 import * as path from "path";
-const LOCK_FILE = path.join(os.tmpdir(), ".electron-builder-toolset.lock");
-export async function withToolsetLock(task) {
-    await writeFile(LOCK_FILE, "", { flag: "a" });
-    const release = await lockfile.lock(LOCK_FILE, {
+const TOOLSET_LOCK_FILE = path.join(os.tmpdir(), ".electron-builder-toolset.lock");
+const SIGNTOOL_LOCK_FILE = path.join(os.tmpdir(), ".electron-builder-signtool.lock");
+const ICONS_LOCK_FILE = path.join(os.tmpdir(), ".electron-builder-icons.lock");
+async function withLock(lockFile, task) {
+    await writeFile(lockFile, "", { flag: "a" });
+    const release = await lockfile.lock(lockFile, {
         retries: { retries: 100, minTimeout: 1000, maxTimeout: 5000 },
         stale: 120_000,
     });
@@ -14,7 +16,31 @@ export async function withToolsetLock(task) {
         return await task();
     }
     finally {
-        await release().catch((err) => log.warn({ err }, "failed to release toolset lock"));
+        await release().catch((err) => log.warn({ err }, "failed to release lock"));
     }
 }
+export function withToolsetLock(task) {
+    return withLock(TOOLSET_LOCK_FILE, task);
+}
+// `signtool sign /f <pfx>` imports the PFX via PFXImportCertStore, which mutates the per-user
+// CryptoAPI/CNG key+cert storage — a process-global resource that is not safe for concurrent access.
+// winPackager already serializes signing within a single packager (signingQueue), but parallel builds
+// (e.g. the test harness running multiple packagers across vitest workers that share one Windows user
+// profile) race on that shared store and intermittently fail, after cert selection, with
+// "SignTool Error: An error occurred while attempting to load the signing certificate". A dedicated
+// cross-process lock (separate from the toolset lock so it does not block MSI/Squirrel builds)
+// serializes signtool invocations. No-op overhead for real single builds, which are already serial.
+export function withSigntoolLock(task) {
+    return withLock(SIGNTOOL_LOCK_FILE, task);
+}
+// The icons toolset CLI (icon-tool.js) converts via a WebAssembly-backed image pipeline, and each
+// invocation reserves a large `WebAssembly.Memory`. A single build converting one icon is fine, but
+// parallel builds — most acutely the test harness running many packagers across forked vitest workers
+// on one machine — spawn enough concurrent icon-tool processes to exhaust memory, failing with
+// "WebAssembly.Memory(): could not allocate memory". A cross-process lock (separate from the toolset
+// lock so it does not serialize against MSI/Squirrel/DMG builds) caps icon conversion at one at a
+// time. No-op overhead for real single builds, which are already serial.
+export function withIconsLock(task) {
+    return withLock(ICONS_LOCK_FILE, task);
+}
 //# sourceMappingURL=toolsetLock.js.map

package/dist/util/toolsetLock.js.map

@@ -1 +1 @@
-{"version":3,"file":"toolsetLock.js","sourceRoot":"","sources":["../../src/util/toolsetLock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAA;AAE1E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,IAAsB;IAC7D,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE;QAC7C,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;QAC7D,KAAK,EAAE,OAAO;KACf,CAAC,CAAA;IACF,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAA;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,gCAAgC,CAAC,CAAC,CAAA;IAC5F,CAAC;AACH,CAAC","sourcesContent":["import { log } from \"builder-util\"\nimport { writeFile } from \"fs/promises\"\nimport * as lockfile from \"proper-lockfile\"\nimport * as os from \"os\"\nimport * as path from \"path\"\n\nconst LOCK_FILE = path.join(os.tmpdir(), \".electron-builder-toolset.lock\")\n\nexport async function withToolsetLock<T>(task: () => Promise<T>): Promise<T> {\n  await writeFile(LOCK_FILE, \"\", { flag: \"a\" })\n  const release = await lockfile.lock(LOCK_FILE, {\n    retries: { retries: 100, minTimeout: 1000, maxTimeout: 5000 },\n    stale: 120_000,\n  })\n  try {\n    return await task()\n  } finally {\n    await release().catch((err: Error) => log.warn({ err }, \"failed to release toolset lock\"))\n  }\n}\n"]}
+{"version":3,"file":"toolsetLock.js","sourceRoot":"","sources":["../../src/util/toolsetLock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAA;AAClF,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;AACpF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAA;AAE9E,KAAK,UAAU,QAAQ,CAAI,QAAgB,EAAE,IAAsB;IACjE,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC5C,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;QAC7D,KAAK,EAAE,OAAO;KACf,CAAC,CAAA;IACF,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAA;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAA;IACpF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAI,IAAsB;IACvD,OAAO,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;AAC1C,CAAC;AAED,8FAA8F;AAC9F,qGAAqG;AACrG,sGAAsG;AACtG,sGAAsG;AACtG,yFAAyF;AACzF,oGAAoG;AACpG,+FAA+F;AAC/F,oGAAoG;AACpG,MAAM,UAAU,gBAAgB,CAAI,IAAsB;IACxD,OAAO,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAA;AAC3C,CAAC;AAED,kGAAkG;AAClG,oGAAoG;AACpG,sGAAsG;AACtG,+FAA+F;AAC/F,qGAAqG;AACrG,kGAAkG;AAClG,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAI,IAAsB;IACrD,OAAO,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;AACxC,CAAC","sourcesContent":["import { log } from \"builder-util\"\nimport { writeFile } from \"fs/promises\"\nimport * as lockfile from \"proper-lockfile\"\nimport * as os from \"os\"\nimport * as path from \"path\"\n\nconst TOOLSET_LOCK_FILE = path.join(os.tmpdir(), \".electron-builder-toolset.lock\")\nconst SIGNTOOL_LOCK_FILE = path.join(os.tmpdir(), \".electron-builder-signtool.lock\")\nconst ICONS_LOCK_FILE = path.join(os.tmpdir(), \".electron-builder-icons.lock\")\n\nasync function withLock<T>(lockFile: string, task: () => Promise<T>): Promise<T> {\n  await writeFile(lockFile, \"\", { flag: \"a\" })\n  const release = await lockfile.lock(lockFile, {\n    retries: { retries: 100, minTimeout: 1000, maxTimeout: 5000 },\n    stale: 120_000,\n  })\n  try {\n    return await task()\n  } finally {\n    await release().catch((err: Error) => log.warn({ err }, \"failed to release lock\"))\n  }\n}\n\nexport function withToolsetLock<T>(task: () => Promise<T>): Promise<T> {\n  return withLock(TOOLSET_LOCK_FILE, task)\n}\n\n// `signtool sign /f <pfx>` imports the PFX via PFXImportCertStore, which mutates the per-user\n// CryptoAPI/CNG key+cert storage — a process-global resource that is not safe for concurrent access.\n// winPackager already serializes signing within a single packager (signingQueue), but parallel builds\n// (e.g. the test harness running multiple packagers across vitest workers that share one Windows user\n// profile) race on that shared store and intermittently fail, after cert selection, with\n// \"SignTool Error: An error occurred while attempting to load the signing certificate\". A dedicated\n// cross-process lock (separate from the toolset lock so it does not block MSI/Squirrel builds)\n// serializes signtool invocations. No-op overhead for real single builds, which are already serial.\nexport function withSigntoolLock<T>(task: () => Promise<T>): Promise<T> {\n  return withLock(SIGNTOOL_LOCK_FILE, task)\n}\n\n// The icons toolset CLI (icon-tool.js) converts via a WebAssembly-backed image pipeline, and each\n// invocation reserves a large `WebAssembly.Memory`. A single build converting one icon is fine, but\n// parallel builds — most acutely the test harness running many packagers across forked vitest workers\n// on one machine — spawn enough concurrent icon-tool processes to exhaust memory, failing with\n// \"WebAssembly.Memory(): could not allocate memory\". A cross-process lock (separate from the toolset\n// lock so it does not serialize against MSI/Squirrel/DMG builds) caps icon conversion at one at a\n// time. No-op overhead for real single builds, which are already serial.\nexport function withIconsLock<T>(task: () => Promise<T>): Promise<T> {\n  return withLock(ICONS_LOCK_FILE, task)\n}\n"]}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const PACKAGE_VERSION = "27.0.0-alpha.3";
+export declare const PACKAGE_VERSION = "27.0.0-alpha.4";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = "27.0.0-alpha.3";
+export const PACKAGE_VERSION = "27.0.0-alpha.4";
 //# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAA","sourcesContent":["export const PACKAGE_VERSION = \"27.0.0-alpha.3\"\n"]}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAA","sourcesContent":["export const PACKAGE_VERSION = \"27.0.0-alpha.4\"\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "app-builder-lib",
   "description": "electron-builder lib",
-  "version": "27.0.0-alpha.3",
+  "version": "27.0.0-alpha.4",
   "type": "module",
   "main": "./dist/index.js",
   "exports": {
@@ -98,9 +98,9 @@
     "undici": "^7.27.1",
     "unzipper": "^0.12.3",
     "which": "^5.0.0",
-    "builder-util": "27.0.0-alpha.3",
-    "electron-publish": "27.0.0-alpha.3",
-    "builder-util-runtime": "10.0.0-alpha.2"
+    "builder-util": "27.0.0-alpha.4",
+    "builder-util-runtime": "10.0.0-alpha.3",
+    "electron-publish": "27.0.0-alpha.4"
   },
   "///": "babel in devDependencies for proton tests",
   "devDependencies": {
@@ -115,12 +115,12 @@
     "@types/unzipper": "^0.10.11",
     "@types/which": "^3.0.4",
     "toml": "^3.0.0",
-    "dmg-builder": "27.0.0-alpha.3",
-    "electron-builder-squirrel-windows": "27.0.0-alpha.3"
+    "dmg-builder": "27.0.0-alpha.4",
+    "electron-builder-squirrel-windows": "27.0.0-alpha.4"
   },
   "peerDependencies": {
-    "dmg-builder": "27.0.0-alpha.3",
-    "electron-builder-squirrel-windows": "27.0.0-alpha.3"
+    "dmg-builder": "27.0.0-alpha.4",
+    "electron-builder-squirrel-windows": "27.0.0-alpha.4"
   },
   "//": "electron-builder-squirrel-windows and dmg-builder added as dev dep for tests (as otherwise `require` doesn't work using Yarn 2)",
   "types": "./dist/index.d.ts",

package/scheme.json

@@ -2421,11 +2421,6 @@
           "$ref": "#/definitions/ReleaseInfo",
           "description": "The release info. Intended for command line usage:\n\n```\n-c.releaseInfo.releaseNotes=\"new features\"\n```"
         },
-        "syncDesktopName": {
-          "default": false,
-          "description": "When `true`, the installed `.desktop` filename is derived from `desktopName` in `package.json`\n(minus the `.desktop` suffix) so that it matches `StartupWMClass` and Electron's `app_id`.\nFalls back to `executableName` when `desktopName` is absent.",
-          "type": "boolean"
-        },
         "synopsis": {
           "description": "The [short description](https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Description).",
           "type": [
@@ -7806,15 +7801,15 @@
               "$ref": "#/definitions/ToolsetCustom"
             },
             {
-              "const": "1.1.0",
+              "const": "1.2.1",
               "type": "string"
             },
             {
               "type": "null"
             }
           ],
-          "default": "1.1.0",
-          "description": "Version of the icons-conversion bundle used to convert source images to `.icns`, `.ico`,\nand PNG icon sets.\n\nSet to a {@link ToolsetCustom} object to supply your own icons bundle directory.\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"1.1.0\"` | Current default |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/icons/CHANGELOG.md"
+          "default": "1.2.1",
+          "description": "Version of the icons-conversion bundle used to convert source images to `.icns`, `.ico`,\nand PNG icon sets.\n\nSet to a {@link ToolsetCustom} object to supply your own icons bundle directory.\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"1.2.1\"` | Current default |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/icons/CHANGELOG.md"
         },
         "linuxToolsMac": {
           "anyOf": [

package/templates/appx/appxmanifest.xml

@@ -5,10 +5,9 @@
    xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
    xmlns:desktop="http://schemas.microsoft.com/appx/manifest/desktop/windows10"
    xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities">
-  <!-- use single quotes to avoid double quotes escaping in the publisher value  -->
   <Identity Name="${identityName}"
     ProcessorArchitecture="${arch}"
-    Publisher='${publisher}'
+    Publisher="${publisher}"
     Version="${version}" />
   <Properties>
     <DisplayName>${displayName}</DisplayName>