app-builder-lib 27.0.0-alpha.5 → 27.0.0-alpha.7

package/scheme.json

@@ -16,6 +16,9 @@
         {
           "$ref": "#/definitions/SpacesOptions"
         },
+        {
+          "$ref": "#/definitions/R2Options"
+        },
         {
           "$ref": "#/definitions/GenericServerOptions"
         },
@@ -136,6 +139,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -301,6 +307,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -451,7 +460,7 @@
     },
     "BitbucketOptions": {
       "additionalProperties": false,
-      "description": "Bitbucket options.\nhttps://bitbucket.org/\nDefine `BITBUCKET_TOKEN` environment variable.\n\nFor converting an app password to a usable token, you can utilize this\n```typescript\nconvertAppPassword(owner: string, appPassword: string) {\nconst base64encodedData = Buffer.from(`${owner}:${appPassword.trim()}`).toString(\"base64\")\nreturn `Basic ${base64encodedData}`\n}\n```",
+      "description": "Bitbucket options.\nhttps://bitbucket.org/\nDefine `BITBUCKET_TOKEN` environment variable.\n\nBitbucket Cloud is [retiring app passwords](https://www.atlassian.com/blog/bitbucket/bitbucket-cloud-transitions-to-api-tokens) in favor of API tokens and access tokens. Authentication is selected by whether a `username` is provided:\n- With `username` — the token is sent via HTTP Basic auth. Use a Bitbucket username + [app password](https://bitbucket.org/account/settings/app-passwords), or an Atlassian account email + [API token](https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/).\n- Without `username` — the token is sent as a repository/project/workspace [access token](https://support.atlassian.com/bitbucket-cloud/docs/using-access-tokens/) via Bearer auth.\n\nFor the auto-updater on a private repository, pass the matching header to `autoUpdater.addAuthHeader(...)`:\n```typescript\n// access token (no username)\nautoUpdater.addAuthHeader(`Bearer ${token}`)\n// app password or API token (with username)\nautoUpdater.addAuthHeader(`Basic ${Buffer.from(`${username}:${token}`).toString(\"base64\")}`)\n```",
       "properties": {
         "channel": {
           "default": "latest",
@@ -505,7 +514,7 @@
           ]
         },
         "token": {
-          "description": "The [app password](https://bitbucket.org/account/settings/app-passwords) to support auto-update from private bitbucket repositories.",
+          "description": "The token to support auto-update from private bitbucket repositories. Depending on `username`, this is a Bitbucket [app password](https://bitbucket.org/account/settings/app-passwords), an Atlassian [API token](https://support.atlassian.com/bitbucket-cloud/docs/using-api-tokens/), or a repository/project/workspace [access token](https://support.atlassian.com/bitbucket-cloud/docs/using-access-tokens/).",
           "type": [
             "null",
             "string"
@@ -518,7 +527,7 @@
           ]
         },
         "username": {
-          "description": "The user name to support auto-update from private bitbucket repositories.",
+          "description": "The user name to support auto-update from private bitbucket repositories. Provide a Bitbucket username (for an app password) or an Atlassian account email (for an API token) to authenticate with HTTP Basic auth. Leave unset to send `token` as a Bearer access token.",
           "type": [
             "null",
             "string"
@@ -846,6 +855,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -994,19 +1006,20 @@
               "type": "null"
             }
           ],
-          "default": "HFS+",
-          "description": "The filesystem for the DMG volume (e.g. `\"APFS\"` or `\"HFS+\"`)\nThis will be changed to APFS in the next major release, so it is recommended to set it explicitly to HFS+ if you want to keep using HFS+ (e.g. for better compatibility with older macOS versions)."
+          "default": "APFS",
+          "description": "The filesystem for the DMG volume (e.g. `\"APFS\"` or `\"HFS+\"`)\nAs of v27 this defaults to APFS. Set it explicitly to `\"HFS+\"` if you need compatibility with older macOS versions (pre-10.13 High Sierra cannot mount APFS volumes)."
         },
         "format": {
           "default": "UDZO",
-          "description": "The disk image format. `ULFO` (lzfse-compressed image (OS X 10.11+ only)).",
+          "description": "The disk image format. `ULFO` (lzfse-compressed image (OS X 10.11+ only)). `ULMO` (lzma-compressed image (macOS 10.15+ only)).",
           "enum": [
             "UDBZ",
             "UDCO",
             "UDRO",
             "UDRW",
             "UDZO",
-            "ULFO"
+            "ULFO",
+            "ULMO"
           ],
           "type": "string"
         },
@@ -1066,6 +1079,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -1203,7 +1219,7 @@
     },
     "ElectronSignOptions": {
       "additionalProperties": false,
-      "description": "Signing options passed to `@electron/osx-sign`. Electron-builder owns the fields it must control\nitself — `app`, `keychain`, `platform`, `version`, `optionsForFile`, and `type` (derived from the\nbuild flavor: `mas-dev` → `development`, otherwise `distribution`) — and forwards everything else.\n\nAdditionally exposes a small set of per-file convenience fields that electron-builder maps\ninternally through `optionsForFile`.",
+      "description": "Signing options passed to `@electron/osx-sign`. Electron-builder owns the fields it must control\nitself — `app`, `keychain`, `platform`, `version`, and `optionsForFile` — and forwards everything else.\n\nAdditionally exposes a small set of per-file convenience fields that electron-builder maps\ninternally through `optionsForFile`.",
       "properties": {
         "additionalArguments": {
           "anyOf": [
@@ -1252,7 +1268,7 @@
           ]
         },
         "hardenedRuntime": {
-          "description": "Whether to enable [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime).\n\nHardened Runtime is a prerequisite for notarization (mandatory on macOS 10.15+).\nDefaults to `true` for `darwin` builds and `false` for `mas-dev`.",
+          "description": "Whether to enable [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime).\n\nHardened Runtime is a prerequisite for notarization (mandatory on macOS 10.15+).\nDefaults to `true` for `darwin` builds and `false` for MAS builds (`mas` and `mas-dev`).",
           "type": "boolean"
         },
         "identity": {
@@ -1315,6 +1331,14 @@
             "null",
             "string"
           ]
+        },
+        "type": {
+          "description": "The type of certificate to use when signing: `development` or `distribution`.\n\nDefaults to a value derived from the build flavor: `mas-dev` → `development`, otherwise `distribution`.\nSet it explicitly to override — e.g. `development` on a darwin build signs with a `Mac Developer` or\n`Apple Development` certificate instead of `Developer ID Application` and embeds a matching\ndevelopment provisioning profile.\n\nDevelopment-signed apps are blocked by Gatekeeper on other machines; users must use the\nright-click → Open workaround documented at https://support.apple.com/en-us/guide/mac-help/mh40616/mac.\nSuch builds are not suitable for production distribution and cannot be notarized.",
+          "enum": [
+            "development",
+            "distribution"
+          ],
+          "type": "string"
         }
       },
       "type": "object"
@@ -1562,6 +1586,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -2379,6 +2406,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -2657,6 +2687,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -3059,6 +3092,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -3537,6 +3573,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -3772,6 +3811,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -3901,6 +3943,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -3964,6 +4009,259 @@
       },
       "type": "object"
     },
+    "MsixOptions": {
+      "additionalProperties": false,
+      "properties": {
+        "addAutoLaunchExtension": {
+          "description": "Whether to add auto launch extension. Defaults to `true` if electron-winstore-auto-launch is in the dependencies.",
+          "type": "boolean"
+        },
+        "applicationId": {
+          "description": "The application id. Defaults to `identityName`. This string contains alpha-numeric fields separated by periods.\nEach field must begin with an ASCII alphabetic character.",
+          "type": "string"
+        },
+        "artifactName": {
+          "description": "The [artifact file name template](https://www.electron.build/configuration#artifact-file-name-template).",
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "backgroundColor": {
+          "default": "#464646",
+          "description": "The background color of the app tile.",
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "capabilities": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": [
+            "runFullTrust"
+          ],
+          "description": "The list of capabilities to be added to the AppxManifest.xml.\nThe `runFullTrust` capability is obligatory for Electron apps and will be auto-added if not specified."
+        },
+        "createMsixbundle": {
+          "default": true,
+          "description": "Whether to produce a .msixbundle when more than one architecture is built.",
+          "type": "boolean"
+        },
+        "createMsixupload": {
+          "default": false,
+          "description": "Whether to produce a .msixupload archive suitable for submission to the Microsoft Store Partner Center.",
+          "type": "boolean"
+        },
+        "customExtensionsPath": {
+          "description": "Relative path to custom extensions xml to be included in the AppxManifest.xml.",
+          "type": "string"
+        },
+        "customManifestPath": {
+          "description": "Relative path to a custom AppxManifest.xml template located in the build resources directory.\nSupports the same `${}` template macros as the default template, including the MSIX-specific\n`${packageIntegrity}` macro. Windows services are injected via the `${extensions}` macro\nalongside protocol/file-association extensions.",
+          "type": "string"
+        },
+        "displayName": {
+          "description": "A friendly name displayed to users. Corresponds to Properties.DisplayName. Defaults to the application product name.",
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "electronUpdaterAware": {
+          "type": "boolean"
+        },
+        "enforcePackageIntegrity": {
+          "default": false,
+          "description": "Enforce package integrity (uap10:PackageIntegrity). Requires Windows 10 version 2004 (build 19041) or later.\nWhen enabled, Windows verifies that no files have been tampered with after the package was signed.",
+          "type": "boolean"
+        },
+        "identityName": {
+          "description": "The package identity name. Corresponds to Identity.Name. Defaults to the application name.",
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "languages": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "default": [
+            "en-US"
+          ],
+          "description": "The list of supported languages listed in the Windows Store. The first entry (index 0) will be the default language."
+        },
+        "makeappxArgs": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "maxVersionTested": {
+          "default": "same as minVersion",
+          "description": "Set the MaxVersionTested field in the AppxManifest.xml.",
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "minVersion": {
+          "default": "\"10.0.17763.0\" (Windows 10 version 1809 — minimum for Store submissions)",
+          "description": "Set the MinVersion field in the AppxManifest.xml.",
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "publish": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/GithubOptions"
+            },
+            {
+              "$ref": "#/definitions/GitlabOptions"
+            },
+            {
+              "$ref": "#/definitions/S3Options"
+            },
+            {
+              "$ref": "#/definitions/SpacesOptions"
+            },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
+            {
+              "$ref": "#/definitions/GenericServerOptions"
+            },
+            {
+              "$ref": "#/definitions/CustomPublishOptions"
+            },
+            {
+              "$ref": "#/definitions/KeygenOptions"
+            },
+            {
+              "$ref": "#/definitions/SnapStoreOptions"
+            },
+            {
+              "$ref": "#/definitions/BitbucketOptions"
+            },
+            {
+              "items": {
+                "$ref": "#/definitions/AllPublishOptions"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ]
+        },
+        "publisher": {
+          "description": "The Windows Store publisher. Not used if MSIX is built for testing.",
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "publisherDisplayName": {
+          "description": "A friendly name for the publisher displayed to users. Corresponds to Properties.PublisherDisplayName.\nDefaults to company name from the application metadata.",
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "setBuildNumber": {
+          "default": false,
+          "description": "Whether to set the build number in the version field.",
+          "type": "boolean"
+        },
+        "showNameOnTiles": {
+          "default": false,
+          "description": "Whether to overlay the app's name on top of tile images on the Start screen.",
+          "type": "boolean"
+        },
+        "windowsServices": {
+          "description": "Windows Services to register with the MSIX package (desktop6 namespace).\nRequires Windows 10 version 1903 or later, and the `packagedServices` (or `localSystemServices`)\nrestricted capability declared via `capabilities`.",
+          "items": {
+            "$ref": "#/definitions/MsixWindowsService"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "MsixWindowsService": {
+      "additionalProperties": false,
+      "properties": {
+        "arguments": {
+          "description": "Optional command-line arguments passed to the service executable.",
+          "type": "string"
+        },
+        "executable": {
+          "description": "Relative path to the service executable within the package.\nDefaults to the main app executable.",
+          "type": "string"
+        },
+        "name": {
+          "description": "The service name used in the Windows Service Control Manager.",
+          "type": "string"
+        },
+        "startAccount": {
+          "default": "localSystem",
+          "description": "The account the service runs under. Required by the desktop6 schema.",
+          "enum": [
+            "localService",
+            "localSystem",
+            "networkService"
+          ],
+          "type": "string"
+        },
+        "startupType": {
+          "default": "manual",
+          "description": "How Windows starts the service. Required by the desktop6 schema.",
+          "enum": [
+            "auto",
+            "disabled",
+            "manual"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
     "NativeModulesConfig": {
       "additionalProperties": false,
       "description": "Configuration for native Node.js module installation and rebuilding.\n\nAll options that control how electron-builder handles native modules — from forcing source\nbuilds at install time through to the `@electron/rebuild` compilation mode.",
@@ -4220,6 +4518,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -4573,6 +4874,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -5298,6 +5602,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -5558,6 +5865,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -5678,6 +5988,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -5782,6 +6095,105 @@
       ],
       "type": "object"
     },
+    "R2Options": {
+      "additionalProperties": false,
+      "description": "[Cloudflare R2](https://developers.cloudflare.com/r2/) options.\nCredentials are required; define `CF_R2_ACCESS_KEY_ID` and `CF_R2_SECRET_ACCESS_KEY` environment variables\nwith an R2 API token (see https://developers.cloudflare.com/r2/api/s3/tokens/).\n\n**Public access for auto-updates:** R2 buckets are private by default. The S3-compatible API endpoint\nalways requires authentication, so `electron-updater` cannot download updates directly from it.\nYou must either enable a custom domain or an r2.dev subdomain for the bucket in the Cloudflare\ndashboard (see https://developers.cloudflare.com/r2/buckets/public-buckets/) and then set\n`publicUrl` to that base URL so the updater knows where to fetch update metadata and binaries.\n\n**ACLs:** R2 does not support S3 ACLs. The `acl` option from `BaseS3Options` is intentionally\nexcluded here. Configure public bucket access in the Cloudflare dashboard instead.\n\nExample configuration:\n\n```json\n{\n\"build\": {\n \"publish\": {\n   \"provider\": \"r2\",\n   \"bucket\": \"my-releases\",\n   \"accountId\": \"abcdef1234567890abcdef1234567890\",\n   \"publicUrl\": \"https://pub-abcdef1234567890abcdef1234567890.r2.dev\"\n }\n}\n}\n```",
+      "properties": {
+        "accountId": {
+          "description": "Your Cloudflare account ID (32-character hex string). Found on the R2 overview page\nin the Cloudflare dashboard. Used to construct the S3-compatible upload endpoint:\n`https://<accountId>.r2.cloudflarestorage.com`",
+          "type": "string"
+        },
+        "bucket": {
+          "description": "The R2 bucket name.",
+          "type": "string"
+        },
+        "channel": {
+          "default": "latest",
+          "description": "The update channel.",
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "jurisdiction": {
+          "anyOf": [
+            {
+              "enum": [
+                "eu",
+                "fedramp"
+              ],
+              "type": "string"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "The jurisdiction of the R2 bucket, if the bucket was created with a jurisdictional\nrestriction. Buckets created in a jurisdiction live on a separate endpoint —\n`https://<accountId>.<jurisdiction>.r2.cloudflarestorage.com` — so this must match\nthe jurisdiction the bucket was created with. Omit for regular buckets.\n\nSee https://developers.cloudflare.com/r2/reference/data-location/#jurisdictional-restrictions"
+        },
+        "path": {
+          "default": "/",
+          "description": "The directory path.",
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "provider": {
+          "const": "r2",
+          "description": "The provider. Must be `r2`.",
+          "type": "string"
+        },
+        "publicUrl": {
+          "description": "The public base URL from which `electron-updater` will download update metadata and\nbinaries. This must be the URL of your bucket's **custom domain** or **r2.dev subdomain**\n(e.g. `https://pub-xxx.r2.dev` or `https://cdn.example.com`).\n\nRequired when `publishAutoUpdate` is not `false`. The R2 S3 API endpoint requires\nauthentication and cannot serve unauthenticated download requests.\n\nSee https://developers.cloudflare.com/r2/buckets/public-buckets/",
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "publishAutoUpdate": {
+          "default": true,
+          "description": "Whether to publish auto update info files.\n\nAuto update relies only on the first provider in the list (you can specify several publishers).\nThus, probably, there`s no need to upload the metadata files for the other configured providers. But by default will be uploaded.",
+          "type": "boolean"
+        },
+        "publisherName": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "requestHeaders": {
+          "$ref": "#/definitions/OutgoingHttpHeaders",
+          "description": "Any custom request headers"
+        },
+        "timeout": {
+          "default": 120000,
+          "description": "Request timeout in milliseconds. (Default is 2 minutes; O is ignored)",
+          "type": [
+            "null",
+            "number"
+          ]
+        },
+        "updaterCacheDirName": {
+          "type": [
+            "null",
+            "string"
+          ]
+        }
+      },
+      "required": [
+        "accountId",
+        "bucket",
+        "provider"
+      ],
+      "type": "object"
+    },
     "Record<string,App>": {
       "type": "object",
       "additionalProperties": {}
@@ -5874,7 +6286,7 @@
     },
     "RemoteBuildOptions": {
       "additionalProperties": false,
-      "description": "Configuration for a remote snap build on [Launchpad](https://launchpad.net/).\nRemote builds run on Canonical's infrastructure without requiring native hardware or nested virtualisation.\n\nEach electron-builder build invocation targets exactly one architecture — to build for multiple\narchitectures, configure the top-level `arch` option (e.g. `arch: [\"x64\", \"arm64\"]`); each arch\nspawns a separate `snapcraft remote-build` job on Launchpad.\n\nAuthentication is resolved in this order:\n1. `cscLink` config field — base64-encoded credentials or a file path\n2. `SNAP_CSC_LINK` environment variable — same format as `cscLink`\n   (CI-recommended; follows the same pattern as `WIN_CSC_LINK` for Windows code signing)\n3. `SNAPCRAFT_STORE_CREDENTIALS` environment variable (read directly by snapcraft)\n4. An active interactive `snapcraft login` session\n\n**CI setup** (set once as a CI secret):\n```sh\nexport SNAP_CSC_LINK=$(snapcraft export-login - | base64 -w0)\n```\nThe resolved credentials are injected only into the spawned `snapcraft` subprocess\nenvironment and never exposed through `process.env`.",
+      "description": "Configuration for a remote snap build on [Launchpad](https://launchpad.net/).\nRemote builds run on Canonical's infrastructure without requiring native hardware or nested virtualisation.\n\nA single remote build can target one or more architectures. Set `buildFor` to a string for one\narch, or to an array (e.g. `[\"amd64\", \"arm64\"]`) to build several architectures in a single\n`snapcraft remote-build` job on Launchpad that emits a separate snap artifact per arch.\nAlternatively, the top-level `arch` option (e.g. `arch: [\"x64\", \"arm64\"]`) spawns a separate\nremote-build job per architecture — do not combine that with a `buildFor` array (mutually exclusive).\n\nAuthentication is resolved in this order:\n1. `cscLink` config field — base64-encoded credentials or a file path\n2. `SNAP_CSC_LINK` environment variable — same format as `cscLink`\n   (CI-recommended; follows the same pattern as `WIN_CSC_LINK` for Windows code signing)\n3. `SNAPCRAFT_STORE_CREDENTIALS` environment variable (read directly by snapcraft)\n4. An active interactive `snapcraft login` session\n\n**CI setup** (set once as a CI secret):\n```sh\nexport SNAP_CSC_LINK=$(snapcraft export-login - | base64 -w0)\n```\nThe resolved credentials are injected only into the spawned `snapcraft` subprocess\nenvironment and never exposed through `process.env`.",
       "properties": {
         "acceptPublicUpload": {
           "description": "Suppress the Launchpad public-upload consent prompt by automatically accepting it.\nYour source code will be uploaded to a **public** Launchpad repository.\nSet to `true` in CI once you understand the implications.",
@@ -6095,6 +6507,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -6564,6 +6979,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -6602,7 +7020,7 @@
               "type": "null"
             }
           ],
-          "description": "Configuration for a remote build on [Launchpad](https://launchpad.net/).\nEnables cross-architecture builds in CI without native hardware or nested virtualisation.\nEach build invocation targets one arch; use `arch: [\"x64\", \"arm64\"]` to build for multiple."
+          "description": "Configuration for a remote build on [Launchpad](https://launchpad.net/).\nEnables cross-architecture builds in CI without native hardware or nested virtualisation.\nSet `remoteBuild.buildFor: [\"amd64\", \"arm64\"]` to build several architectures in one Launchpad\njob, or the top-level `arch: [\"x64\", \"arm64\"]` option to spawn a separate job per architecture\n(the two are mutually exclusive)."
         },
         "slots": {
           "anyOf": [
@@ -6960,6 +7378,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -7225,6 +7646,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -7656,6 +8080,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -7786,14 +8213,14 @@
             },
             {
               "enum": [
-                "1.2.1",
+                "1.2.3",
                 "latest"
               ],
               "type": "string"
             }
           ],
           "default": "latest",
-          "description": "Version of the icons-conversion bundle used to convert source images to `.icns`, `.ico`,\nand PNG icon sets.\n\nSet to a {@link ToolsetCustom} object to supply your own icons bundle directory.\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"1.2.1\"` | `wasm-vips` + `@resvg/resvg-wasm` |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/icons/CHANGELOG.md"
+          "description": "Version of the icons-conversion bundle used to convert source images to `.icns`, `.ico`,\nand PNG icon sets.\n\nSet to a {@link ToolsetCustom} object to supply your own icons bundle directory.\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"1.2.3\"` | Writes 16px/32px ICNS entries as `ic04`/`ic05` ARGB (fixes corrupt small icons in Finder) |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/icons/CHANGELOG.md"
         },
         "linuxToolsMac": {
           "anyOf": [
@@ -8208,6 +8635,9 @@
             {
               "$ref": "#/definitions/SpacesOptions"
             },
+            {
+              "$ref": "#/definitions/R2Options"
+            },
             {
               "$ref": "#/definitions/GenericServerOptions"
             },
@@ -8281,7 +8711,7 @@
               "type": "null"
             }
           ],
-          "description": "Code signing configuration. Code signing stamps every installer and executable\nelectron-builder produces with an Authenticode signature, so that Windows (SmartScreen / UAC)\nand your auto-updater can verify the publisher and that the files were not tampered with.\n\nHow this option behaves:\n- Leave **unset** to sign using credentials discovered from the environment — primarily a\n  certificate supplied via `WIN_CSC_LINK` (or `CSC_LINK`) with its password in\n  `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`). `WIN_CSC_LINK` accepts a file path, an\n  `https://` URL, or a base64-encoded certificate. This is the recommended setup for CI.\n- Set to `false` or `null` to **disable** code signing entirely (executable resources such as\n  the icon and metadata are still edited).\n- Set to an **object** to configure signing explicitly. The `type` field selects the signing\n  backend (`signtool` is the implicit default) and dispatches to a dedicated sign manager;\n  provide exactly one of the modes below. Each output artifact is signed individually, and by\n  default executables are dual-signed (see `signingHashAlgorithms`).\n\n- `{ type: \"signtool\", ... }` — Sign with a local certificate file (.pfx/.p12) or a\n  certificate from the Windows certificate store. Uses Microsoft `signtool.exe` on Windows and\n  `osslsigncode` on macOS/Linux.\n- `{ type: \"hsm\", ... }` — Sign using a Hardware Security Module (HSM) or FIPS-compliant\n  hardware token via signtool's `/csp` (cryptographic service provider) and `/kc` (key\n  container) flags. Requires a modern `winCodeSign` toolset (the default — only the legacy\n  `\"0.0.0\"` pin is unsupported). Windows-only.\n- `{ type: \"pkcs11\", ... }` — Sign using a PKCS#11 hardware token via osslsigncode.\n  Available on macOS and Linux CI without a Windows VM.\n- `{ type: \"azure\", ... }` — Sign via Azure Trusted Signing (cloud service). Requires\n  Azure Entra ID environment variables for authentication.\n\nSee [Code Signing](https://www.electron.build/code-signing)."
+          "description": "Code signing configuration. Code signing stamps every installer and executable\nelectron-builder produces with an Authenticode signature, so that Windows (SmartScreen / UAC)\nand your auto-updater can verify the publisher and that the files were not tampered with.\n\nHow this option behaves:\n- Leave **unset** to sign using credentials discovered from the environment — primarily a\n  certificate supplied via `WIN_CSC_LINK` (or `CSC_LINK`) with its password in\n  `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`). `WIN_CSC_LINK` accepts a file path, an\n  `https://` URL, or a base64-encoded certificate. This is the recommended setup for CI.\n- Set to `false` or `null` to **disable** code signing entirely (executable resources such as\n  the icon and metadata are still edited).\n- Set to an **object** to configure signing explicitly. The **required** `type` field selects the\n  signing backend (`signtool`, `hsm`, `pkcs11`, or `azure`) and dispatches to a dedicated sign\n  manager; provide exactly one of the modes below. When `win.sign` is left unset, the `signtool`\n  backend is used with env-discovered credentials. Each output artifact is signed individually,\n  and by default executables are dual-signed (see `signingHashAlgorithms`).\n\n- `{ type: \"signtool\", ... }` — Sign with a local certificate file (.pfx/.p12) or a\n  certificate from the Windows certificate store. Uses Microsoft `signtool.exe` on Windows and\n  `osslsigncode` on macOS/Linux.\n- `{ type: \"hsm\", ... }` — Sign using a Hardware Security Module (HSM) or FIPS-compliant\n  hardware token via signtool's `/csp` (cryptographic service provider) and `/kc` (key\n  container) flags. Requires a modern `winCodeSign` toolset (the default — only the legacy\n  `\"0.0.0\"` pin is unsupported). Windows-only.\n- `{ type: \"pkcs11\", ... }` — Sign using a PKCS#11 hardware token via osslsigncode.\n  Available on macOS and Linux CI without a Windows VM.\n- `{ type: \"azure\", ... }` — Sign via Azure Trusted Signing (cloud service). Requires\n  Azure Entra ID environment variables for authentication.\n\nSee [Code Signing](https://www.electron.build/code-signing)."
         },
         "signExts": {
           "anyOf": [
@@ -8324,7 +8754,7 @@
             }
           ],
           "default": "nsis",
-          "description": "The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` ([portable]https://www.electron.build/nsis#portable) app without installation), `appx`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\nAppX package can be built only on Windows 10.\n\nTo use Squirrel.Windows please install `electron-builder-squirrel-windows` dependency."
+          "description": "The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` ([portable app](https://www.electron.build/nsis#portable) without installation), `appx`, `msix`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\nAppX and MSIX packages can be built on Windows 10 or Windows Server 2012 R2 (version 6.3+) or later, and on macOS via Parallels Desktop.\n\nTo use Squirrel.Windows please install `electron-builder-squirrel-windows` dependency."
         },
         "verifyUpdateCodeSignature": {
           "default": true,
@@ -8732,6 +9162,24 @@
       ],
       "description": "Called after code signing but **before** the signed app is packed into the final\ndistributable format (e.g. before `dmg` is created from the signed `.app`).\n\nUse this hook to perform post-sign validation or to add signed resources that are not part of\nthe main app bundle.\n\nReceives an {@link AfterPackContext}."
     },
+    "allowMissingDependencies": {
+      "anyOf": [
+        {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        {
+          "type": [
+            "null",
+            "boolean"
+          ]
+        }
+      ],
+      "default": false,
+      "description": "Whether production dependencies that cannot be resolved during node-module collection are\nallowed — i.e. whether the build should continue with a warning instead of failing.\n\nDuring collection every production dependency must resolve to an installed package on disk. A\ndependency that does not resolve (`cannot find path for dependency` / `dependency not found on\ndisk`) is not bundled, which typically breaks the packaged app at runtime with\n`MODULE_NOT_FOUND`.\n\n- `false` or `null` (default): the build fails after dependency collection completes,\n  reporting the **complete** list of missing production dependencies at once.\n- `string[]`: the listed dependency names are allowed to be missing; any other missing\n  production dependency still fails the build. Entries match the package name of the reported\n  `name@version` entry (e.g. `some-native-module`, `@scope/pkg`), or an exact `name@version`\n  string to allow only that resolved version to be missing.\n- `true`: missing production dependencies are only logged as warnings (the electron-builder\n  ≤ 26 behavior).\n\nMissing *optional* dependencies (declared in `optionalDependencies`, e.g. `fsevents` on\nLinux/Windows, or platform-specific packages) are always allowed and never fail the build.\n\nIndependent of {@link ignoredProductionDependencies}, which controls which dependencies are\nexcluded from the copied `node_modules`; this option only controls validation of the\ncollection result."
+    },
     "apk": {
       "anyOf": [
         {
@@ -8989,7 +9437,7 @@
           ]
         }
       ],
-      "description": "Override the source of the Electron distribution to stage.\n\nShould return the path to either:\n- A **directory** containing a pre-built, unpacked Electron app (e.g. `~/electron/out/R`).\n- A **directory** containing Electron zip archives following the naming convention\n  `electron-v${version}-${platformName}-${arch}.zip`.\n\nWhen not set, electron-builder downloads the official Electron release from GitHub (or the\nmirror configured via `electronDownload`).\n\nReceives a {@link PrepareApplicationStageDirectoryOptions}."
+      "description": "Override the source of the Electron distribution to stage.\n\nShould return the path to either:\n- A **directory** containing a pre-built, unpacked Electron app (e.g. `~/electron/out/R`).\n- A **directory** containing Electron zip archives following the naming convention\n  `electron-v${version}-${platformName}-${arch}.zip`.\n\nWhen not set, electron-builder downloads the official Electron release from GitHub (or the\nmirror configured via `electronGet`).\n\nReceives a {@link PrepareApplicationStageDirectoryOptions}."
     },
     "electronFuses": {
       "anyOf": [
@@ -9011,7 +9459,7 @@
           "type": "null"
         }
       ],
-      "description": "Options forwarded to [`@electron/get`](https://github.com/electron/get) when downloading the\nElectron distribution to package."
+      "description": "Options forwarded to [`@electron/get`](https://github.com/electron/get) when downloading the\nElectron distribution to package.\n\n`checksums` (a map of artifact file name → SHA-256 hex) makes checksum validation fully offline —\nwithout it, `@electron/get` fetches `SHASUMS256.txt` from the network on every build, even when the\nartifact itself is already cached. When `checksums` is not configured, electron-builder automatically\npicks up a locally seeded `SHASUMS256.txt-<version>` (or `SHASUMS256.txt`) file at the root of the\nElectron cache directory. See the\n[air-gapped / offline builds guide](https://www.electron.build/tutorials/offline-air-gapped-builds)."
     },
     "electronLanguages": {
       "anyOf": [
@@ -9201,6 +9649,24 @@
         "string"
       ]
     },
+    "ignoredProductionDependencies": {
+      "anyOf": [
+        {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "default": [
+        "electron",
+        "electron-builder"
+      ],
+      "description": "Names of production dependencies that are excluded from the copied `node_modules`, even if they\nare declared in the `dependencies` section of `package.json`.\n\nelectron-builder copies the resolved production dependency tree into the app. Some packages —\nnotably `electron` — are already provided another way (the Electron runtime is embedded\nseparately), so copying them would just duplicate what is already there. Such packages are\nexcluded from the copy rather than rejected: they remain valid production dependencies for\ntooling purposes (e.g. SBOM, license, and vulnerability tracking) without being shipped twice.\n\nOnly dependencies **declared by the app itself** are eligible: a listed name and the transitive\ndependencies required *only* by it are dropped, while anything also required by another (kept)\nproduction dependency stays bundled. A matching name that appears solely as a transitive\ndependency of a kept package is never excluded. Note that a kept package which `require()`s an\nexcluded name at runtime *without declaring it* (relying on hoisting) will fail with\n`MODULE_NOT_FOUND` — declare such a dependency properly or remove the name from this list.\n\nMatching is by the dependency name as declared in `package.json`: an npm alias\n(`\"custom-electron\": \"npm:electron@^30.0.0\"`) is matched by its alias key (`custom-electron`),\nnever by the underlying package name.\n\nOverriding this option **replaces** the default list, so include `electron` and `electron-builder`\nunless you intend to ship them. The most common reason to override is to *add* a dependency that a\nbundler (Vite, webpack, esbuild, …) already inlines into your app code: keep it in `dependencies`\nso SBOM/license tooling still sees it, and list it here so a duplicate copy is not packaged — e.g.\n`[\"electron\", \"electron-builder\", \"react\", \"react-dom\"]`. Removing a default name keeps that\npackage in the copied `node_modules`. Setting the option to `null` (or omitting it) applies the\ndefault list; to disable exclusion entirely, set it to an empty array `[]`. Each excluded package\nis logged once during packaging."
+    },
     "includePdb": {
       "default": false,
       "description": "Whether to include `.pdb` (Program Database) symbol files in the output.\n\nPDB files enable Windows crash-dump analysis but significantly increase artifact size. Enable\nfor internal builds where you want symbol information; disable for public distribution.",
@@ -9286,6 +9752,17 @@
       ],
       "description": "MSI-wrapped NSIS installer options.\n\nWraps the standard NSIS installer inside an MSI package so that it can be deployed via\nGroup Policy or other MSI-only channels while preserving the NSIS installer UX."
     },
+    "msix": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/MsixOptions"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "MSIX package options. MSIX is the modern successor to AppX with additional deployment features."
+    },
     "nativeModules": {
       "anyOf": [
         {
@@ -9429,6 +9906,9 @@
         {
           "$ref": "#/definitions/SpacesOptions"
         },
+        {
+          "$ref": "#/definitions/R2Options"
+        },
         {
           "$ref": "#/definitions/GenericServerOptions"
         },
@@ -9542,7 +10022,7 @@
           "type": "null"
         }
       ],
-      "description": "Pinned versions of the binary toolsets electron-builder downloads and uses internally.\n\nEach property selects a specific release of the corresponding tool bundle. Set a property to\n`\"0.0.0\"` to force the legacy bundle (pre-v27 behaviour). Leave a property unset (or set to\n`null`) to use the modern default for that toolset."
+      "description": "Pinned versions of the binary toolsets electron-builder downloads and uses internally.\n\nEach property selects a specific release of the corresponding tool bundle. Set a property to\n`\"0.0.0\"` to force the legacy bundle (pre-v27 behaviour). Leave a property unset (or set it to\n`\"latest\"`) to use the modern default (newest bundle) for that toolset.\n\nNote: Toolset versioning can drop intermediate releases (such as if a problem is discovered in a bundle). If you need to pin to a specific release, check the release notes for the toolset to ensure the version you specify is valid."
     },
     "win": {
       "anyOf": [