app-builder-lib 27.0.0-alpha.4 → 27.0.0-alpha.6

package/dist/codeSign/win/windowsSignAzureManager.js

@@ -4,7 +4,8 @@ import _fsExtra from "fs-extra";
 import { Lazy } from "lazy-val";
 import * as path from "path";
 import { resolveWindowsSigningConfiguration } from "../../options/winOptions.js";
-import { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle } from "../../toolsets/winCodeSign.js";
+import { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle, WIN_CODESIGN_LATEST } from "../../toolsets/winCodeSign.js";
+import { resolveToolsetVersion } from "../../toolsets/version.js";
 import { VmManager } from "../../vm/vm.js";
 import { WineVmManager } from "../../vm/WineVm.js";
 import semver from "semver";
@@ -32,20 +33,25 @@ export class WindowsSignAzureManager {
         this.signing = signing;
     }
     isLegacyMode() {
-        const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {};
-        if (typeof wcs === "string") {
-            return semver.lt(wcs, minimumWinCodeSignVersionForDlib);
+        const wcs = this.packager.config.toolsets?.winCodeSign;
+        // ToolsetCustom object = user-managed bundle (provides its own dlib alongside signtool) → not legacy.
+        if (typeof wcs === "object" && wcs != null) {
+            return false;
         }
-        // null = built-in toolset not configured → legacy; ToolsetCustom object = user-managed → not legacy
-        return wcs == null;
+        // Unset / null / "latest" resolve to the newest bundle, which ships the ATS dlib + .NET payload.
+        // An explicit version below 1.3.0 (e.g. "0.0.0", "1.2.1") has no dlib → legacy PowerShell.
+        const resolved = resolveToolsetVersion(wcs, WIN_CODESIGN_LATEST);
+        return semver.lt(resolved, minimumWinCodeSignVersionForDlib);
     }
     async initialize() {
         if (!this.isLegacyMode()) {
             return;
         }
-        const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {};
-        const reason = typeof wcs === "string" ? `toolsets.winCodeSign "${wcs}" is below the minimum "${minimumWinCodeSignVersionForDlib}"` : `toolsets.winCodeSign is not set`;
-        log.info({ reason, guidance: `set toolsets.winCodeSign to "${minimumWinCodeSignVersionForDlib}" to use the faster signtool /dlib integration` }, `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`);
+        const wcs = this.packager.config.toolsets?.winCodeSign;
+        log.info({
+            reason: `toolsets.winCodeSign "${String(wcs)}" is below the minimum "${minimumWinCodeSignVersionForDlib}"`,
+            guidance: `leave toolsets.winCodeSign unset (or set it to "${minimumWinCodeSignVersionForDlib}" / "latest") to use the faster signtool /dlib integration`,
+        }, `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`);
         const vm = await this.packager.vm.value;
         const ps = await vm.powershellCommand.value;
         log.info(null, "installing required module (TrustedSigning) with scope CurrentUser");
@@ -100,30 +106,34 @@ export class WindowsSignAzureManager {
     }
     async signFileWithDlib(options) {
         const { signing } = this;
-        const winCodeSign = this.packager.config.toolsets.winCodeSign;
+        const winCodeSign = this.packager.config.toolsets?.winCodeSign;
+        const isCustom = typeof winCodeSign === "object" && winCodeSign != null;
         // The ATS payload (dlib + its dependency closure) ships x64/x86 only; the bundle's arm64
         // dir has no dlib. On arm64 hosts use the x64 signtool + dlib — x64 signtool runs under
         // Windows-on-ARM emulation natively, and under x64 Wine on macOS/Linux.
         const arch = process.arch === "ia32" ? Arch.ia32 : Arch.x64;
-        const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, arch, resourcesDir: this.packager.buildResourcesDir });
+        const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, resourcesDir: this.packager.buildResourcesDir });
         // For custom toolsets the kit lives within buildResourcesDir; enforce that constraint.
         // For versioned/cached bundles no base constraint is needed (paths are in the tool cache).
-        const safeKitDir = sanitizeDirPath(kitDir, typeof winCodeSign === "object" ? this.packager.buildResourcesDir : undefined);
+        const safeKitDir = sanitizeDirPath(kitDir, isCustom ? this.packager.buildResourcesDir : undefined);
         const signtoolPath = path.join(safeKitDir, "signtool.exe");
         let dlibPath;
         let dotnetRootPath = null;
-        if (typeof winCodeSign === "string") {
-            // 1.3.0+: dlib ships in a separate ats-bundle with its full native dependency closure
-            // (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is in a separate dotnet-runtime
-            // bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll → shared framework.
-            const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(winCodeSign));
-            dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? "x86" : "x64", "Azure.CodeSigning.Dlib.dll");
-            dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(winCodeSign));
-        }
-        else {
+        if (typeof winCodeSign === "object" && winCodeSign != null) {
             // Custom toolset: user provides the dlib alongside signtool in the kit dir.
             dlibPath = path.join(safeKitDir, "Azure.CodeSigning.Dlib.dll");
         }
+        else {
+            // Built-in bundle. Unset / null / "latest" resolve to the newest version (>= 1.3.0); an
+            // explicit >= 1.3.0 version is used as-is. The dlib ships in a separate ats-bundle with its
+            // full native dependency closure (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is
+            // in a separate dotnet-runtime bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll →
+            // shared framework.
+            const version = resolveToolsetVersion(winCodeSign, WIN_CODESIGN_LATEST);
+            const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(version));
+            dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? "x86" : "x64", "Azure.CodeSigning.Dlib.dll");
+            dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(version));
+        }
         const metadataPath = await this.packager.getTempFile(".json");
         await _fsExtra.writeJson(metadataPath, {
             Endpoint: signing.endpoint,

package/dist/codeSign/win/windowsSignAzureManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,kCAAkC,EAAmD,MAAM,6BAA6B,CAAA;AACjI,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AAC1G,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKlD,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,MAAM,gCAAgC,GAAG,OAAO,CAAA;AAChD,MAAM,OAAO,uBAAuB;IAUlC,IAAY,aAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAA;QACzC,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAA;QAC/H,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAflD,4FAA4F;QAC3E,OAAE,GAAc,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAEhK,0BAAqB,GAAG,IAAI,IAAI,CAAuB,GAAG,EAAE;YACnE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;QAsDO,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EACnC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CACnC,CAAA;QA9CC,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC5E,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iEAAiE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAEO,YAAY;QAClB,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;QACvE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAA;QACzD,CAAC;QACD,oGAAoG;QACpG,OAAO,GAAG,IAAI,IAAI,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;QACvE,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,yBAAyB,GAAG,2BAA2B,gCAAgC,GAAG,CAAC,CAAC,CAAC,iCAAiC,CAAA;QACvK,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,QAAQ,EAAE,gCAAgC,gCAAgC,gDAAgD,EAAE,EACtI,kFAAkF,CACnF,CAAA;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAA;QACpF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC,CAAA;QAC7J,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,kEAAkE,CAAC,CAAA;QAC1H,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,2GAA2G,CAAC,CAAC,CAAA;IAC/K,CAAC;IAED,oBAAoB,CAAC,OAAe,EAAE,aAA4B;QAChE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,CAAA;IAC7D,CAAC;IAOD,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC5F,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA2B;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAE3C,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,aAAa,GAAG,0BAA0B,CAAA;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,sIAAsI,CACrK,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAuC;YACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAClF,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,QAAQ;YACpD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;YAC1C,GAAG,OAAO,CAAC,kBAAkB;YAC7B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAA;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;aAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,+EAA+E;QAC/E,gFAAgF;QAChF,mGAAmG;QACnG,MAAM,SAAS,GAAG,yBAAyB,YAAY,EAAE,CAAA;QACzD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAA;QACvF,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAA2B;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAS,CAAC,WAAY,CAAA;QAE/D,yFAAyF;QACzF,wFAAwF;QACxF,wEAAwE;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;QAC3D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAA;QACxH,uFAAuF;QACvF,2FAA2F;QAC3F,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACzH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;QAE1D,IAAI,QAAgB,CAAA;QACpB,IAAI,cAAc,GAAkB,IAAI,CAAA;QAExC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,sFAAsF;YACtF,0FAA0F;YAC1F,kFAAkF;YAClF,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC,CAAA;YACtE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAA;YAClG,cAAc,GAAG,eAAe,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAA;QAC1E,CAAC;aAAM,CAAC;YACN,4EAA4E;YAC5E,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,GAAG,OAAO,CAAC,kBAAkB;SAC9B,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG;YACX,MAAM;YACN,KAAK;YACL,CAAC,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YAC9C,KAAK;YACL,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAChE,KAAK;YACL,CAAC,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YACnD,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SAC/B,CAAA;QAED,GAAG,CAAC,IAAI,CACN;YACE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,sBAAsB;YACvC,OAAO,EAAE,OAAO,CAAC,sBAAsB;SACxC,EACD,qDAAqD,CACtD,CAAA;QAED,oFAAoF;QACpF,yFAAyF;QACzF,oDAAoD;QACpD,MAAM,WAAW,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACnH,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { Arch, isEmptyOrSpaces, log, sanitizeDirPath } from \"builder-util\"\nimport { asArray, MemoLazy } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport { resolveWindowsSigningConfiguration, WindowsAzureSigningConfig, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle } from \"../../toolsets/winCodeSign.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport { WineVmManager } from \"../../vm/WineVm.js\"\nimport { WinPackager } from \"../../winPackager.js\"\nimport { SignManager } from \"./signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo } from \"./windowsSignToolManager.js\"\nimport semver from \"semver\"\n\nconst minimumWinCodeSignVersionForDlib = \"1.3.0\"\nexport class WindowsSignAzureManager implements SignManager {\n  private readonly signing: WindowsAzureSigningConfig\n\n  // signtool.exe is a Windows PE binary; use Wine on non-Windows (same pattern as MsiTarget).\n  private readonly vm: VmManager = process.platform === \"win32\" ? new VmManager() : new WineVmManager(this.packager.config.toolsets?.wine, this.packager.buildResourcesDir)\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(() => {\n    return Promise.resolve(asArray(this.publisherName))\n  })\n\n  private get publisherName(): string {\n    const result = this.signing.publisherName\n    if (isEmptyOrSpaces(result)) {\n      throw new Error(\"Azure Trusted Signing requires 'publisherName' in win.sign config (no local certificate to derive it from)\")\n    }\n    return result\n  }\n\n  constructor(private readonly packager: WinPackager) {\n    const signing = resolveWindowsSigningConfiguration(packager.platformOptions)\n    if (signing?.type !== \"azure\") {\n      throw new Error(`WindowsSignAzureManager requires signing.type = \"azure\", got: ${signing?.type}`)\n    }\n    this.signing = signing\n  }\n\n  private isLegacyMode(): boolean {\n    const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {}\n    if (typeof wcs === \"string\") {\n      return semver.lt(wcs, minimumWinCodeSignVersionForDlib)\n    }\n    // null = built-in toolset not configured → legacy; ToolsetCustom object = user-managed → not legacy\n    return wcs == null\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.isLegacyMode()) {\n      return\n    }\n\n    const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {}\n    const reason = typeof wcs === \"string\" ? `toolsets.winCodeSign \"${wcs}\" is below the minimum \"${minimumWinCodeSignVersionForDlib}\"` : `toolsets.winCodeSign is not set`\n    log.info(\n      { reason, guidance: `set toolsets.winCodeSign to \"${minimumWinCodeSignVersionForDlib}\" to use the faster signtool /dlib integration` },\n      `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`\n    )\n\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n    log.info(null, \"installing required module (TrustedSigning) with scope CurrentUser\")\n    try {\n      await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser\"])\n    } catch (error: any) {\n      log.debug({ message: error.message || error.stack }, \"unable to install PackageProvider NuGet — may already be present\")\n    }\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-Module -Name TrustedSigning -MinimumVersion 0.5.0 -Force -Repository PSGallery -Scope CurrentUser\"])\n  }\n\n  computePublisherName(_target: Target, publisherName: string | null): Promise<string> {\n    return Promise.resolve(this.publisherName ?? publisherName)\n  }\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.packager.platformOptions,\n    _selected => Promise.resolve(null)\n  )\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    return this.isLegacyMode() ? this.signFileLegacy(options) : this.signFileWithDlib(options)\n  }\n\n  private async signFileLegacy(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n\n    // Validate additionalMetadata keys before embedding as PS parameter names.\n    // Keys flow directly into `-${field} '...'` in the command string; a key\n    // containing semicolons or quotes would be PowerShell injection.\n    const PS_PARAM_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/\n    for (const key of Object.keys(signing.additionalMetadata ?? {})) {\n      if (!PS_PARAM_NAME.test(key)) {\n        throw new Error(\n          `additionalMetadata key \"${key}\" is not a valid PowerShell parameter name. Keys must match /^[A-Za-z_][A-Za-z0-9_]*$/ (e.g. \"ExcludeCredentials\", \"CorrelationId\").`\n        )\n      }\n    }\n\n    const params: Record<string, string | undefined> = {\n      Endpoint: signing.endpoint,\n      CertificateProfileName: signing.certificateProfileName,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      TimestampRfc3161: signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      TimestampDigest: signing.timestampDigest ?? \"SHA256\",\n      FileDigest: signing.fileDigest ?? \"SHA256\",\n      ...signing.additionalMetadata,\n      Files: vm.toVmFile(options.path),\n    }\n\n    const paramsString = Object.entries(params)\n      .filter(([, value]) => value != null)\n      .map(([field, value]) => `-${field} '${String(value).replace(/'/g, \"''\")}'`)\n      .join(\" \")\n\n    // Use -EncodedCommand (Base64 UTF-16LE) so the command string is opaque to any\n    // intermediate shell or argument parser — no cmd.exe / ConHost escaping needed.\n    // PowerShell still parses the decoded string, so PS-level single-quote escaping above is retained.\n    const psCommand = `Invoke-TrustedSigning ${paramsString}`\n    const encodedCommand = Buffer.from(psCommand, \"utf16le\").toString(\"base64\")\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-EncodedCommand\", encodedCommand])\n    return true\n  }\n\n  private async signFileWithDlib(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const winCodeSign = this.packager.config.toolsets!.winCodeSign!\n\n    // The ATS payload (dlib + its dependency closure) ships x64/x86 only; the bundle's arm64\n    // dir has no dlib. On arm64 hosts use the x64 signtool + dlib — x64 signtool runs under\n    // Windows-on-ARM emulation natively, and under x64 Wine on macOS/Linux.\n    const arch = process.arch === \"ia32\" ? Arch.ia32 : Arch.x64\n    const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, arch, resourcesDir: this.packager.buildResourcesDir })\n    // For custom toolsets the kit lives within buildResourcesDir; enforce that constraint.\n    // For versioned/cached bundles no base constraint is needed (paths are in the tool cache).\n    const safeKitDir = sanitizeDirPath(kitDir, typeof winCodeSign === \"object\" ? this.packager.buildResourcesDir : undefined)\n    const signtoolPath = path.join(safeKitDir, \"signtool.exe\")\n\n    let dlibPath: string\n    let dotnetRootPath: string | null = null\n\n    if (typeof winCodeSign === \"string\") {\n      // 1.3.0+: dlib ships in a separate ats-bundle with its full native dependency closure\n      // (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is in a separate dotnet-runtime\n      // bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll → shared framework.\n      const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(winCodeSign))\n      dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? \"x86\" : \"x64\", \"Azure.CodeSigning.Dlib.dll\")\n      dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(winCodeSign))\n    } else {\n      // Custom toolset: user provides the dlib alongside signtool in the kit dir.\n      dlibPath = path.join(safeKitDir, \"Azure.CodeSigning.Dlib.dll\")\n    }\n\n    const metadataPath = await this.packager.getTempFile(\".json\")\n    await _fsExtra.writeJson(metadataPath, {\n      Endpoint: signing.endpoint,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      CertificateProfileName: signing.certificateProfileName,\n      ...signing.additionalMetadata,\n    })\n\n    const args = [\n      \"sign\",\n      \"/fd\",\n      (signing.fileDigest ?? \"SHA256\").toUpperCase(),\n      \"/tr\",\n      signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      \"/td\",\n      (signing.timestampDigest ?? \"SHA256\").toUpperCase(),\n      \"/dlib\",\n      this.vm.toVmFile(dlibPath),\n      \"/dmdf\",\n      this.vm.toVmFile(metadataPath),\n      this.vm.toVmFile(options.path),\n    ]\n\n    log.info(\n      {\n        file: log.filePath(options.path),\n        endpoint: signing.endpoint,\n        account: signing.codeSigningAccountName,\n        profile: signing.certificateProfileName,\n      },\n      \"signing with Azure Trusted Signing (signtool /dlib)\"\n    )\n\n    // DOTNET_ROOT: Ijwhost.dll (shipped in the ats-bundle) reads this env var to locate\n    // hostfxr.dll. On Wine, toVmFile converts the host path to a Z:\\ path that Wine resolves\n    // back to the same location on the host filesystem.\n    const execOptions = dotnetRootPath != null ? { env: { DOTNET_ROOT: this.vm.toVmFile(dotnetRootPath) } } : undefined\n    await this.vm.exec(signtoolPath, args, execOptions)\n    return true\n  }\n}\n"]}
+{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,kCAAkC,EAAmD,MAAM,6BAA6B,CAAA;AACjI,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AAC/H,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKlD,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,MAAM,gCAAgC,GAAG,OAAO,CAAA;AAChD,MAAM,OAAO,uBAAuB;IAUlC,IAAY,aAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAA;QACzC,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAA;QAC/H,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAflD,4FAA4F;QAC3E,OAAE,GAAc,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAEhK,0BAAqB,GAAG,IAAI,IAAI,CAAuB,GAAG,EAAE;YACnE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;QA2DO,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EACnC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CACnC,CAAA;QAnDC,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC5E,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iEAAiE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACtD,sGAAsG;QACtG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iGAAiG;QACjG,2FAA2F;QAC3F,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;QAChE,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzB,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACtD,GAAG,CAAC,IAAI,CACN;YACE,MAAM,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,2BAA2B,gCAAgC,GAAG;YAC1G,QAAQ,EAAE,mDAAmD,gCAAgC,4DAA4D;SAC1J,EACD,kFAAkF,CACnF,CAAA;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAA;QACpF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC,CAAA;QAC7J,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,kEAAkE,CAAC,CAAA;QAC1H,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,2GAA2G,CAAC,CAAC,CAAA;IAC/K,CAAC;IAED,oBAAoB,CAAC,OAAe,EAAE,aAA4B;QAChE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,CAAA;IAC7D,CAAC;IAOD,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC5F,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA2B;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAE3C,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,aAAa,GAAG,0BAA0B,CAAA;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,sIAAsI,CACrK,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAuC;YACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAClF,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,QAAQ;YACpD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;YAC1C,GAAG,OAAO,CAAC,kBAAkB;YAC7B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAA;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;aAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,+EAA+E;QAC/E,gFAAgF;QAChF,mGAAmG;QACnG,MAAM,SAAS,GAAG,yBAAyB,YAAY,EAAE,CAAA;QACzD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAA;QACvF,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAA2B;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QAC9D,MAAM,QAAQ,GAAG,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,CAAA;QAEvE,yFAAyF;QACzF,wFAAwF;QACxF,wEAAwE;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;QAC3D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAA;QAClH,uFAAuF;QACvF,2FAA2F;QAC3F,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAClG,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;QAE1D,IAAI,QAAgB,CAAA;QACpB,IAAI,cAAc,GAAkB,IAAI,CAAA;QAExC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YAC3D,4EAA4E;YAC5E,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAA;QAChE,CAAC;aAAM,CAAC;YACN,wFAAwF;YACxF,4FAA4F;YAC5F,4FAA4F;YAC5F,6FAA6F;YAC7F,oBAAoB;YACpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAA;YACvE,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;YAClE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAA;YAClG,cAAc,GAAG,eAAe,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,GAAG,OAAO,CAAC,kBAAkB;SAC9B,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG;YACX,MAAM;YACN,KAAK;YACL,CAAC,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YAC9C,KAAK;YACL,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAChE,KAAK;YACL,CAAC,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YACnD,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SAC/B,CAAA;QAED,GAAG,CAAC,IAAI,CACN;YACE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,sBAAsB;YACvC,OAAO,EAAE,OAAO,CAAC,sBAAsB;SACxC,EACD,qDAAqD,CACtD,CAAA;QAED,oFAAoF;QACpF,yFAAyF;QACzF,oDAAoD;QACpD,MAAM,WAAW,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACnH,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { Arch, isEmptyOrSpaces, log, sanitizeDirPath } from \"builder-util\"\nimport { asArray, MemoLazy } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport { resolveWindowsSigningConfiguration, WindowsAzureSigningConfig, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle, WIN_CODESIGN_LATEST } from \"../../toolsets/winCodeSign.js\"\nimport { resolveToolsetVersion } from \"../../toolsets/version.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport { WineVmManager } from \"../../vm/WineVm.js\"\nimport { WinPackager } from \"../../winPackager.js\"\nimport { SignManager } from \"./signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo } from \"./windowsSignToolManager.js\"\nimport semver from \"semver\"\n\nconst minimumWinCodeSignVersionForDlib = \"1.3.0\"\nexport class WindowsSignAzureManager implements SignManager {\n  private readonly signing: WindowsAzureSigningConfig\n\n  // signtool.exe is a Windows PE binary; use Wine on non-Windows (same pattern as MsiTarget).\n  private readonly vm: VmManager = process.platform === \"win32\" ? new VmManager() : new WineVmManager(this.packager.config.toolsets?.wine, this.packager.buildResourcesDir)\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(() => {\n    return Promise.resolve(asArray(this.publisherName))\n  })\n\n  private get publisherName(): string {\n    const result = this.signing.publisherName\n    if (isEmptyOrSpaces(result)) {\n      throw new Error(\"Azure Trusted Signing requires 'publisherName' in win.sign config (no local certificate to derive it from)\")\n    }\n    return result\n  }\n\n  constructor(private readonly packager: WinPackager) {\n    const signing = resolveWindowsSigningConfiguration(packager.platformOptions)\n    if (signing?.type !== \"azure\") {\n      throw new Error(`WindowsSignAzureManager requires signing.type = \"azure\", got: ${signing?.type}`)\n    }\n    this.signing = signing\n  }\n\n  private isLegacyMode(): boolean {\n    const wcs = this.packager.config.toolsets?.winCodeSign\n    // ToolsetCustom object = user-managed bundle (provides its own dlib alongside signtool) → not legacy.\n    if (typeof wcs === \"object\" && wcs != null) {\n      return false\n    }\n    // Unset / null / \"latest\" resolve to the newest bundle, which ships the ATS dlib + .NET payload.\n    // An explicit version below 1.3.0 (e.g. \"0.0.0\", \"1.2.1\") has no dlib → legacy PowerShell.\n    const resolved = resolveToolsetVersion(wcs, WIN_CODESIGN_LATEST)\n    return semver.lt(resolved, minimumWinCodeSignVersionForDlib)\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.isLegacyMode()) {\n      return\n    }\n\n    const wcs = this.packager.config.toolsets?.winCodeSign\n    log.info(\n      {\n        reason: `toolsets.winCodeSign \"${String(wcs)}\" is below the minimum \"${minimumWinCodeSignVersionForDlib}\"`,\n        guidance: `leave toolsets.winCodeSign unset (or set it to \"${minimumWinCodeSignVersionForDlib}\" / \"latest\") to use the faster signtool /dlib integration`,\n      },\n      `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`\n    )\n\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n    log.info(null, \"installing required module (TrustedSigning) with scope CurrentUser\")\n    try {\n      await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser\"])\n    } catch (error: any) {\n      log.debug({ message: error.message || error.stack }, \"unable to install PackageProvider NuGet — may already be present\")\n    }\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-Module -Name TrustedSigning -MinimumVersion 0.5.0 -Force -Repository PSGallery -Scope CurrentUser\"])\n  }\n\n  computePublisherName(_target: Target, publisherName: string | null): Promise<string> {\n    return Promise.resolve(this.publisherName ?? publisherName)\n  }\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.packager.platformOptions,\n    _selected => Promise.resolve(null)\n  )\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    return this.isLegacyMode() ? this.signFileLegacy(options) : this.signFileWithDlib(options)\n  }\n\n  private async signFileLegacy(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n\n    // Validate additionalMetadata keys before embedding as PS parameter names.\n    // Keys flow directly into `-${field} '...'` in the command string; a key\n    // containing semicolons or quotes would be PowerShell injection.\n    const PS_PARAM_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/\n    for (const key of Object.keys(signing.additionalMetadata ?? {})) {\n      if (!PS_PARAM_NAME.test(key)) {\n        throw new Error(\n          `additionalMetadata key \"${key}\" is not a valid PowerShell parameter name. Keys must match /^[A-Za-z_][A-Za-z0-9_]*$/ (e.g. \"ExcludeCredentials\", \"CorrelationId\").`\n        )\n      }\n    }\n\n    const params: Record<string, string | undefined> = {\n      Endpoint: signing.endpoint,\n      CertificateProfileName: signing.certificateProfileName,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      TimestampRfc3161: signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      TimestampDigest: signing.timestampDigest ?? \"SHA256\",\n      FileDigest: signing.fileDigest ?? \"SHA256\",\n      ...signing.additionalMetadata,\n      Files: vm.toVmFile(options.path),\n    }\n\n    const paramsString = Object.entries(params)\n      .filter(([, value]) => value != null)\n      .map(([field, value]) => `-${field} '${String(value).replace(/'/g, \"''\")}'`)\n      .join(\" \")\n\n    // Use -EncodedCommand (Base64 UTF-16LE) so the command string is opaque to any\n    // intermediate shell or argument parser — no cmd.exe / ConHost escaping needed.\n    // PowerShell still parses the decoded string, so PS-level single-quote escaping above is retained.\n    const psCommand = `Invoke-TrustedSigning ${paramsString}`\n    const encodedCommand = Buffer.from(psCommand, \"utf16le\").toString(\"base64\")\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-EncodedCommand\", encodedCommand])\n    return true\n  }\n\n  private async signFileWithDlib(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const winCodeSign = this.packager.config.toolsets?.winCodeSign\n    const isCustom = typeof winCodeSign === \"object\" && winCodeSign != null\n\n    // The ATS payload (dlib + its dependency closure) ships x64/x86 only; the bundle's arm64\n    // dir has no dlib. On arm64 hosts use the x64 signtool + dlib — x64 signtool runs under\n    // Windows-on-ARM emulation natively, and under x64 Wine on macOS/Linux.\n    const arch = process.arch === \"ia32\" ? Arch.ia32 : Arch.x64\n    const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, resourcesDir: this.packager.buildResourcesDir })\n    // For custom toolsets the kit lives within buildResourcesDir; enforce that constraint.\n    // For versioned/cached bundles no base constraint is needed (paths are in the tool cache).\n    const safeKitDir = sanitizeDirPath(kitDir, isCustom ? this.packager.buildResourcesDir : undefined)\n    const signtoolPath = path.join(safeKitDir, \"signtool.exe\")\n\n    let dlibPath: string\n    let dotnetRootPath: string | null = null\n\n    if (typeof winCodeSign === \"object\" && winCodeSign != null) {\n      // Custom toolset: user provides the dlib alongside signtool in the kit dir.\n      dlibPath = path.join(safeKitDir, \"Azure.CodeSigning.Dlib.dll\")\n    } else {\n      // Built-in bundle. Unset / null / \"latest\" resolve to the newest version (>= 1.3.0); an\n      // explicit >= 1.3.0 version is used as-is. The dlib ships in a separate ats-bundle with its\n      // full native dependency closure (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is\n      // in a separate dotnet-runtime bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll →\n      // shared framework.\n      const version = resolveToolsetVersion(winCodeSign, WIN_CODESIGN_LATEST)\n      const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(version))\n      dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? \"x86\" : \"x64\", \"Azure.CodeSigning.Dlib.dll\")\n      dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(version))\n    }\n\n    const metadataPath = await this.packager.getTempFile(\".json\")\n    await _fsExtra.writeJson(metadataPath, {\n      Endpoint: signing.endpoint,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      CertificateProfileName: signing.certificateProfileName,\n      ...signing.additionalMetadata,\n    })\n\n    const args = [\n      \"sign\",\n      \"/fd\",\n      (signing.fileDigest ?? \"SHA256\").toUpperCase(),\n      \"/tr\",\n      signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      \"/td\",\n      (signing.timestampDigest ?? \"SHA256\").toUpperCase(),\n      \"/dlib\",\n      this.vm.toVmFile(dlibPath),\n      \"/dmdf\",\n      this.vm.toVmFile(metadataPath),\n      this.vm.toVmFile(options.path),\n    ]\n\n    log.info(\n      {\n        file: log.filePath(options.path),\n        endpoint: signing.endpoint,\n        account: signing.codeSigningAccountName,\n        profile: signing.certificateProfileName,\n      },\n      \"signing with Azure Trusted Signing (signtool /dlib)\"\n    )\n\n    // DOTNET_ROOT: Ijwhost.dll (shipped in the ats-bundle) reads this env var to locate\n    // hostfxr.dll. On Wine, toVmFile converts the host path to a Z:\\ path that Wine resolves\n    // back to the same location on the host filesystem.\n    const execOptions = dotnetRootPath != null ? { env: { DOTNET_ROOT: this.vm.toVmFile(dotnetRootPath) } } : undefined\n    await this.vm.exec(signtoolPath, args, execOptions)\n    return true\n  }\n}\n"]}

package/dist/configuration.d.ts

@@ -7,6 +7,7 @@ import { AppImageOptions, DebOptions, FlatpakOptions, LinuxConfiguration, LinuxT
 import { DmgOptions, MacConfiguration, MasConfiguration } from "./options/macOptions.js";
 import { MsiOptions } from "./options/MsiOptions.js";
 import { MsiWrappedOptions } from "./options/MsiWrappedOptions.js";
+import { MsixOptions } from "./options/MsixOptions.js";
 import { PkgOptions } from "./options/pkgOptions.js";
 import { PlatformSpecificBuildOptions } from "./options/PlatformSpecificBuildOptions.js";
 import { SnapcraftOptions } from "./options/SnapOptions.js";
@@ -18,6 +19,17 @@ import { PlatformPackager } from "./platformPackager.js";
 import { NsisOptions, NsisWebOptions, PortableOptions } from "./targets/win/nsis/nsisOptions.js";
 import { ElectronGetOptions } from "./util/electronGet.js";
 import { FuseOptionsV1 } from "./options/FuseOptionsV1.js";
+/**
+ * Production dependencies that are excluded from the copied `node_modules` by default. These are
+ * still legitimate production dependencies (for SBOM, license, and vulnerability tracking), but
+ * electron-builder already provides them another way — notably the Electron runtime, which is
+ * embedded separately — so copying them into the app would just duplicate what is already there.
+ * Users can override the set via {@link CommonConfiguration.ignoredProductionDependencies}.
+ *
+ * Declared next to the option so the code constant, the jsdoc `@default`, and the generated
+ * `scheme.json` stay in one place; a test asserts the generated schema matches this constant.
+ */
+export declare const DEFAULT_IGNORED_PRODUCTION_DEPENDENCIES: ReadonlyArray<string>;
 /**
  * Configuration options shared across all platforms.
  *
@@ -144,6 +156,8 @@ export interface CommonConfiguration {
      * @see {@link AppXOptions}
      */
     readonly appx?: AppXOptions | null;
+    /** MSIX package options. MSIX is the modern successor to AppX with additional deployment features. */
+    readonly msix?: MsixOptions | null;
     /**
      * WiX-based MSI installer options.
      *
@@ -274,6 +288,39 @@ export interface CommonConfiguration {
      * ```
      */
     readonly npmArgs?: Array<string> | string | null;
+    /**
+     * Names of production dependencies that are excluded from the copied `node_modules`, even if they
+     * are declared in the `dependencies` section of `package.json`.
+     *
+     * electron-builder copies the resolved production dependency tree into the app. Some packages —
+     * notably `electron` — are already provided another way (the Electron runtime is embedded
+     * separately), so copying them would just duplicate what is already there. Such packages are
+     * excluded from the copy rather than rejected: they remain valid production dependencies for
+     * tooling purposes (e.g. SBOM, license, and vulnerability tracking) without being shipped twice.
+     *
+     * Only dependencies **declared by the app itself** are eligible: a listed name and the transitive
+     * dependencies required *only* by it are dropped, while anything also required by another (kept)
+     * production dependency stays bundled. A matching name that appears solely as a transitive
+     * dependency of a kept package is never excluded. Note that a kept package which `require()`s an
+     * excluded name at runtime *without declaring it* (relying on hoisting) will fail with
+     * `MODULE_NOT_FOUND` — declare such a dependency properly or remove the name from this list.
+     *
+     * Matching is by the dependency name as declared in `package.json`: an npm alias
+     * (`"custom-electron": "npm:electron@^30.0.0"`) is matched by its alias key (`custom-electron`),
+     * never by the underlying package name.
+     *
+     * Overriding this option **replaces** the default list, so include `electron` and `electron-builder`
+     * unless you intend to ship them. The most common reason to override is to *add* a dependency that a
+     * bundler (Vite, webpack, esbuild, …) already inlines into your app code: keep it in `dependencies`
+     * so SBOM/license tooling still sees it, and list it here so a duplicate copy is not packaged — e.g.
+     * `["electron", "electron-builder", "react", "react-dom"]`. Removing a default name keeps that
+     * package in the copied `node_modules`. Setting the option to `null` (or omitting it) applies the
+     * default list; to disable exclusion entirely, set it to an empty array `[]`. Each excluded package
+     * is logged once during packaging.
+     *
+     * @default ["electron", "electron-builder"]
+     */
+    readonly ignoredProductionDependencies?: Array<string> | null;
     /**
      * Configuration for native Node.js module installation and rebuilding.
      *
@@ -504,18 +551,12 @@ export type AfterPackContext = PackContext;
 export type BeforePackContext = PackContext;
 export type AfterExtractContext = PackContext;
 /**
- * Version pins and custom bundle overrides for the binary toolsets that electron-builder
- * downloads and caches locally.
+ * Version pins and custom bundle overrides for the binary toolsets that electron-builder downloads and caches locally.
  *
- * Each toolset is a versioned archive hosted at
- * [electron-userland/electron-builder-binaries](https://github.com/electron-userland/electron-builder-binaries/releases).
- * Omitting a property (or setting it to `null`) selects the modern default for that toolset.
- * Setting a property to `"0.0.0"` forces the legacy bundle — useful only for diagnosing
- * regressions introduced by newer toolset bundles.
+ * Each toolset is a versioned archive hosted at [electron-userland/electron-builder-binaries](https://github.com/electron-userland/electron-builder-binaries/releases).
+ * Omitting a property (or setting it to `latest`) selects the modern default for that toolset.
  *
- * To supply your own bundle, set the property to a {@link ToolsetCustom} object with a `url`
- * (https:// or file://) and a `checksum` for verification. The bundle must mirror the expected
- * directory layout of the corresponding built-in bundle; see the build scripts at
+ * To supply your own bundle, set the property to a {@link ToolsetCustom} object with a `url` (https:// or file://) and a `checksum` for verification. The bundle must mirror the expected directory layout of the corresponding built-in bundle; see the build scripts at
  * https://github.com/electron-userland/electron-builder-binaries/tree/master/packages.
  */
 export interface ToolsetConfig {
@@ -525,24 +566,23 @@ export interface ToolsetConfig {
      * The bundle ships:
      * - **`signtool.exe`** (Windows) / **`osslsigncode`** (macOS & Linux) — used to sign `.exe`,
      *   `.dll`, and `.msix` artifacts.
-     * - **`rcedit`** — used to embed version metadata and icons into `.exe` files.
-     * - **Windows Kits** (`10.0.26100.0`) — used by AppX/MSIX packaging (`makeappx`, `signtool`).
+     * - **`rcedit`** — embeds version metadata and icons into `.exe` files (legacy usage, migrated to npm `resedit` package).
+     * - **Windows Kits** — used by AppX/MSIX packaging (`makeappx`, `signtool`).
      *
      * Available versions:
-     * | Version | Contents |
-     * |---------|----------|
-     * | `"0.0.0"` | Legacy bundle — `winCodeSign-2.6.0` (pre-v27 default) |
-     * | `"1.0.0"` | Modern bundle — Windows Kits 10.0.26100.0, `win-codesign` v1.0.0 |
-     * | `"1.1.0"` | Modern bundle — Windows Kits 10.0.26100.0, `win-codesign` v1.1.0 |
-     * | `"1.1.1"` | Modern bundle — Windows Kits 10.0.26100.0, `win-codesign` v1.1.1 |
-     * | `"1.2.1"` | Modern bundle — Windows Kits 10.0.26100.0, `win-codesign` v1.2.1 |
-     * | `"1.3.0"` | Modern bundle — Windows Kits 10.0.26100.0, `win-codesign` v1.3.0 + separate ATS dlib bundle + .NET 8 runtime (required for Azure Trusted Signing `signtool /dlib`) |
+     * | Version | Notes |
+     * |---------|-------|
+     * | `"0.0.0"` | Legacy bundle — `winCodeSign-2.6.0` (pre-v27) |
+     * | `"1.0.0"` | Windows Kits 10.0.26100.0, `osslsigncode` v2.9 |
+     * | `"1.1.1"` | Updates `osslsigncode` to v2.11 |
+     * | `"1.2.1"` | Adds native `osslsigncode` arm64 |
+     * | `"1.3.0"` | Includes support for Azure Trusted Signing `signtool` via dlib and .NET 8 runtime |
      *
      * Releases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/win-codesign/CHANGELOG.md
      *
-     * @default "1.1.0"
+     * @default "latest"
      */
-    readonly winCodeSign?: "0.0.0" | "1.0.0" | "1.1.0" | "1.1.1" | "1.2.1" | "1.3.0" | ToolsetCustom | null;
+    readonly winCodeSign?: "0.0.0" | "1.0.0" | "1.1.0" | "1.1.1" | "1.2.1" | "1.3.0" | ToolsetCustom | "latest";
     /**
      * Version of the AppImage toolset bundle used for building `.AppImage` files.
      *
@@ -554,15 +594,15 @@ export interface ToolsetConfig {
      * Available versions:
      * | Version | Runtime date | Notes |
      * |---------|-------------|-------|
-     * | `"0.0.0"` | Legacy | FUSE2-based AppImage runtime (pre-v27 default) |
-     * | `"1.0.2"` | 20251108 | Static-runtime (FUSE3-compatible) |
-     * | `"1.0.3"` | 20251108 | Static-runtime (FUSE3-compatible); recommended (default) |
+     * | `"0.0.0"` | Legacy | FUSE2-based AppImage runtime (pre-v27) |
+     * | `"1.0.3"` | 20251108 | Introduces static AppImage runtime |
+     * | `"1.1.0"` | 20251108 | Adds `unsquashfs` support |
      *
      * Releases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/appimage/CHANGELOG.md
      *
-     * @default "1.0.3"
+     * @default "latest"
      */
-    readonly appimage?: "0.0.0" | "1.0.2" | "1.0.3" | ToolsetCustom | null;
+    readonly appimage?: "0.0.0" | "1.0.3" | "1.1.0" | ToolsetCustom | "latest";
     /**
      * Version of the NSIS toolset bundle used to compile Windows installers.
      *
@@ -575,14 +615,14 @@ export interface ToolsetConfig {
      * Available versions:
      * | Version | `makensis` version | Notes |
      * |---------|------------------|-------|
-     * | `"0.0.0"` | 3.0.4.1 | Legacy split bundle — `nsis` + `nsis-resources` archives (pre-v27 default) |
-     * | `"1.2.1"` | 3.12 | Unified bundle — single archive, entrypoint scripts auto-set `NSISDIR` (default) |
+     * | `"0.0.0"` | 3.0.4.1 | Legacy split bundle — `nsis` + `nsis-resources` archives (pre-v27) |
+     * | `"1.2.1"` | 3.12 | Unified bundle — single archive, entrypoint scripts auto-set `NSISDIR` |
      *
      * Releases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/nsis/CHANGELOG.md
      *
-     * @default "1.2.1"
+     * @default "latest"
      */
-    readonly nsis?: "0.0.0" | "1.2.1" | ToolsetCustom | null;
+    readonly nsis?: "0.0.0" | "1.2.1" | ToolsetCustom | "latest";
     /**
      * Version of the Wine bundle used to run Windows tools (NSIS, rcedit, signtool) on
      * non-Windows hosts (macOS and Linux).
@@ -593,16 +633,16 @@ export interface ToolsetConfig {
      * Available versions:
      * | Version | Wine version | Platform support | Notes |
      * |---------|-------------|-----------------|-------|
-     * | `"0.0.0"` | 4.0.1 | macOS | Legacy portable bundle (default) |
+     * | `"0.0.0"` | 4.0.1 | macOS | Legacy portable bundle (pre-v27) |
      * | `"1.0.1"` | 11.0 | macOS | Supports arm64 macOS via Rosetta |
      *
      * To use a custom Wine binary, use a `ToolsetCustom` object.
      *
      * Releases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/wine/CHANGELOG.md
      *
-     * @default "0.0.0"
+     * @default "latest"
      */
-    readonly wine?: "0.0.0" | "1.0.1" | ToolsetCustom | null;
+    readonly wine?: "0.0.0" | "1.0.1" | ToolsetCustom | "latest";
     /**
      * Version of the FPM bundle used to build Linux packages (`.deb`, `.rpm`, `.pacman`, etc.)
      * on macOS and Linux hosts.
@@ -614,9 +654,9 @@ export interface ToolsetConfig {
      *
      * Releases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/fpm/CHANGELOG.md
      *
-     * @default "2.2.1"
+     * @default "latest"
      */
-    readonly fpm?: "2.2.1" | ToolsetCustom | null;
+    readonly fpm?: "2.2.1" | ToolsetCustom | "latest";
     /**
      * Version of the Linux-tools-mac bundle used to produce `.tar.lz` archives and build
      * Linux targets on macOS hosts.
@@ -626,13 +666,13 @@ export interface ToolsetConfig {
      * Available versions:
      * | Version | Notes |
      * |---------|-------|
-     * | `"1.0.0"` | Current default |
+     * | `"1.0.0"` | gnu-tar, lzip, makedepend, glib, libgsf, libtool, pcre, gettext, binutils |
      *
      * Releases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/linux-tools-mac/CHANGELOG.md
      *
-     * @default "1.0.0"
+     * @default "latest"
      */
-    readonly linuxToolsMac?: "1.0.0" | ToolsetCustom | null;
+    readonly linuxToolsMac?: "1.0.0" | ToolsetCustom | "latest";
     /**
      * Version of the 7-Zip binary bundle used internally to extract `.7z` and `.tar.xz` archives.
      *
@@ -644,9 +684,9 @@ export interface ToolsetConfig {
      * (or a bare `file://` directory). `.7z` and `.tar.xz` archives cannot be used here because
      * extracting them requires 7za — a circular dependency.
      *
-     * @default "1.0.0"
+     * @default "latest"
      */
-    readonly sevenZip?: "1.0.0" | ToolsetCustom | null;
+    readonly sevenZip?: "1.0.0" | ToolsetCustom | "latest";
     /**
      * Version of the icons-conversion bundle used to convert source images to `.icns`, `.ico`,
      * and PNG icon sets.
@@ -656,13 +696,13 @@ export interface ToolsetConfig {
      * Available versions:
      * | Version | Notes |
      * |---------|-------|
-     * | `"1.2.1"` | Current default |
+     * | `"1.2.1"` | `wasm-vips` + `@resvg/resvg-wasm` |
      *
      * Releases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/icons/CHANGELOG.md
      *
-     * @default "1.2.1"
+     * @default "latest"
      */
-    readonly icons?: "1.2.1" | ToolsetCustom | null;
+    readonly icons?: "1.2.1" | ToolsetCustom | "latest";
 }
 /**
  * A custom toolset bundle supplied by the user in place of a built-in versioned bundle.

package/dist/configuration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../src/configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACzE,OAAO,EAAE,uCAAuC,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAClK,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAA;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAG1D;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAElC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAEjD;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAExC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACtC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACtC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACzC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAEhC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAA;IACxD;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IACpD;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IAEhD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEhD;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAEnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAErC;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAA;IAE1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,CAAA;IAE5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAEnC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAE7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAExC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAE7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CAC1C;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,mBAAmB,EAAE,4BAA4B,EAAE,KAAK;IAC7F;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAEhD;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;IAEnD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;IAErC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IAEjC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,IAAI,CAAA;CACxD;AAED,MAAM,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AAE7D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACxC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAChC;AACD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC1C,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAC3C,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAA;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,IAAI,CAAA;IAEvG;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,IAAI,CAAA;IAEtE;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,IAAI,CAAA;IAExD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,IAAI,CAAA;IAExD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAAA;IAE7C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAAA;IAEvD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAAA;IAElD;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAAA;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IAEpB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAE1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,KAAK;IACpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEnE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEvE;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEhF;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE7E;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjF;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE/D;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAExE;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE/E;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,uCAAuC,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;CAC9F;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAA;CACb"}
+{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../src/configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACzE,OAAO,EAAE,uCAAuC,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAClK,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAA;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC,EAAE,aAAa,CAAC,MAAM,CAAoC,CAAA;AAG9G;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAElC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAEjD;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAExC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACtC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACtC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACzC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAEhC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAClC,sGAAsG;IACtG,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAA;IACxD;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IACpD;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IAEhD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAE7D;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAEnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAErC;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAA;IAE1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,CAAA;IAE5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAEnC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAE7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAExC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAE7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CAC1C;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,mBAAmB,EAAE,4BAA4B,EAAE,KAAK;IAC7F;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAEhD;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;IAEnD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;IAErC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IAEjC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,IAAI,CAAA;CACxD;AAED,MAAM,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AAE7D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACxC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAChC;AACD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC1C,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAC3C,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAA;AAE7C;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE3G;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE1E;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE5D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE5D;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAEjD;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAE3D;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;IAEtD;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IAEpB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAE1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,KAAK;IACpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEnE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEvE;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEhF;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE7E;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjF;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE/D;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEjE;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAExE;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAE/E;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,uCAAuC,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;CAC9F;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAA;CACb"}

package/dist/configuration.js

@@ -1,2 +1,12 @@
-export {};
+/**
+ * Production dependencies that are excluded from the copied `node_modules` by default. These are
+ * still legitimate production dependencies (for SBOM, license, and vulnerability tracking), but
+ * electron-builder already provides them another way — notably the Electron runtime, which is
+ * embedded separately — so copying them into the app would just duplicate what is already there.
+ * Users can override the set via {@link CommonConfiguration.ignoredProductionDependencies}.
+ *
+ * Declared next to the option so the code constant, the jsdoc `@default`, and the generated
+ * `scheme.json` stay in one place; a test asserts the generated schema matches this constant.
+ */
+export const DEFAULT_IGNORED_PRODUCTION_DEPENDENCIES = ["electron", "electron-builder"];
 //# sourceMappingURL=configuration.js.map