app-builder-lib 27.0.0-alpha.6 → 27.0.0-alpha.8

package/dist/options/macOptions.d.ts

@@ -1,7 +1,7 @@
 import { TargetConfiguration, TargetSpecificOptions } from "../core.js";
 import { PlatformSpecificBuildOptions } from "./PlatformSpecificBuildOptions.js";
 import { CustomMacSign } from "../macPackager.js";
-import type { OnlySignOptions } from "@electron/osx-sign";
+import type { OnlySignOptions, SigningDistributionType } from "@electron/osx-sign";
 import type { MakeUniversalOpts } from "@electron/universal";
 /**
  * Options forwarded to `@electron/universal`'s `makeUniversalApp`.
@@ -20,15 +20,27 @@ export interface ElectronUniversalOptions extends Omit<MakeUniversalOpts, "x64Ap
 }
 /**
  * Signing options passed to `@electron/osx-sign`. Electron-builder owns the fields it must control
- * itself — `app`, `keychain`, `platform`, `version`, `optionsForFile`, and `type` (derived from the
- * build flavor: `mas-dev` → `development`, otherwise `distribution`) — and forwards everything else.
+ * itself — `app`, `keychain`, `platform`, `version`, and `optionsForFile` — and forwards everything else.
  *
  * Additionally exposes a small set of per-file convenience fields that electron-builder maps
  * internally through `optionsForFile`.
  *
  * @see https://packages.electronjs.org/osx-sign
  */
-export interface ElectronSignOptions extends Omit<OnlySignOptions, "optionsForFile" | "version" | "type"> {
+export interface ElectronSignOptions extends Omit<OnlySignOptions, "optionsForFile" | "version"> {
+    /**
+     * The type of certificate to use when signing: `development` or `distribution`.
+     *
+     * Defaults to a value derived from the build flavor: `mas-dev` → `development`, otherwise `distribution`.
+     * Set it explicitly to override — e.g. `development` on a darwin build signs with a `Mac Developer` or
+     * `Apple Development` certificate instead of `Developer ID Application` and embeds a matching
+     * development provisioning profile.
+     *
+     * Development-signed apps are blocked by Gatekeeper on other machines; users must use the
+     * right-click → Open workaround documented at https://support.apple.com/en-us/guide/mac-help/mh40616/mac.
+     * Such builds are not suitable for production distribution and cannot be notarized.
+     */
+    readonly type?: SigningDistributionType;
     /**
      * The signing identity (certificate name or SHA-1 hash). Applies to both app signing and DMG signing.
      * Prefer the environment variables `CSC_LINK` / `CSC_NAME` over hardcoding this value.
@@ -59,9 +71,7 @@ export interface ElectronSignOptions extends Omit<OnlySignOptions, "optionsForFi
      * Whether to enable [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime).
      *
      * Hardened Runtime is a prerequisite for notarization (mandatory on macOS 10.15+).
-     * Defaults to `true` for `darwin` builds and `false` for `mas-dev`.
-     *
-     * @see https://github.com/electron/fuses
+     * Defaults to `true` for `darwin` builds and `false` for MAS builds (`mas` and `mas-dev`).
      */
     readonly hardenedRuntime?: boolean;
     /**
@@ -172,7 +182,7 @@ export interface MacConfiguration extends PlatformSpecificBuildOptions {
      * - **{@link ElectronSignOptions}**: options forwarded directly to `@electron/osx-sign`.
      *
      * @see {@link ElectronSignOptions}
-     * @see https://www.electron.build/code-signing
+     * @see https://www.electron.build/docs/features/code-signing
      */
     readonly sign?: CustomMacSign | ElectronSignOptions | string | null;
     /**

package/dist/options/macOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"macOptions.d.ts","sourceRoot":"","sources":["../../src/options/macOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,cAAc,GAAG,YAAY,GAAG,OAAO,CAAC;IAC/H;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,eAAe,EAAE,gBAAgB,GAAG,SAAS,GAAG,MAAM,CAAC;IACvG;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAChD;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;CACpD;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAA;AAE/I,MAAM,WAAW,gBAAiB,SAAQ,4BAA4B;IACpE;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEjC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,eAAe,GAAG,mBAAmB,CAAC,GAAG,eAAe,GAAG,mBAAmB,GAAG,IAAI,CAAA;IAE7G;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEtC;;OAEG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE3C;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEvC;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7C;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE1C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEzC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEzC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,CAAA;IAEzB;;OAEG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7C,eAAe;IACf,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,eAAe;IACf,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEhD;;OAEG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEvD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,GAAG,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAA;IAEnE;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAEpD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,UAAW,SAAQ,qBAAqB;IACvD;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE1B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEzB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEjC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAErC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B;;OAEG;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IAE5B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;IAErE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IAE5C;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IAEzB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,CAAA;IAElB;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;IAEhD;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB;;;OAGG;IACH,CAAC,CAAC,EAAE,MAAM,CAAA;IAEV;;;OAGG;IACH,CAAC,CAAC,EAAE,MAAM,CAAA;IAEV;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,CAAC,EAAE,MAAM,CAAA;IACT;;OAEG;IACH,CAAC,EAAE,MAAM,CAAA;IACT,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAA;IAE9B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAGD,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;CAAG"}
+{"version":3,"file":"macOptions.d.ts","sourceRoot":"","sources":["../../src/options/macOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,cAAc,GAAG,YAAY,GAAG,OAAO,CAAC;IAC/H;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,eAAe,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC9F;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,uBAAuB,CAAA;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;CACpD;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAA;AAE/I,MAAM,WAAW,gBAAiB,SAAQ,4BAA4B;IACpE;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEjC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,eAAe,GAAG,mBAAmB,CAAC,GAAG,eAAe,GAAG,mBAAmB,GAAG,IAAI,CAAA;IAE7G;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEtC;;OAEG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE3C;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEvC;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7C;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE1C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEzC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEzC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,CAAA;IAEzB;;OAEG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7C,eAAe;IACf,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,eAAe;IACf,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEhD;;OAEG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAEvD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,GAAG,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAA;IAEnE;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAEpD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,UAAW,SAAQ,qBAAqB;IACvD;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE1B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEzB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEjC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAErC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B;;OAEG;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IAE5B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;IAErE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IAE5C;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IAEzB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,CAAA;IAElB;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;IAEhD;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB;;;OAGG;IACH,CAAC,CAAC,EAAE,MAAM,CAAA;IAEV;;;OAGG;IACH,CAAC,CAAC,EAAE,MAAM,CAAA;IAEV;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,CAAC,EAAE,MAAM,CAAA;IACT;;OAEG;IACH,CAAC,EAAE,MAAM,CAAA;IACT,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAA;IAE9B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAGD,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;CAAG"}

package/dist/options/macOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"macOptions.js","sourceRoot":"","sources":["../../src/options/macOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { TargetConfiguration, TargetSpecificOptions } from \"../core.js\"\nimport { PlatformSpecificBuildOptions } from \"./PlatformSpecificBuildOptions.js\"\nimport { CustomMacSign } from \"../macPackager.js\"\nimport type { OnlySignOptions } from \"@electron/osx-sign\"\nimport type { MakeUniversalOpts } from \"@electron/universal\"\n\n/**\n * Options forwarded to `@electron/universal`'s `makeUniversalApp`.\n * Electron-builder fills in the app paths and `force`; everything else is configurable here\n * and auto-tracks upstream additions to `MakeUniversalOpts`.\n *\n * @see https://github.com/electron/universal\n */\nexport interface ElectronUniversalOptions extends Omit<MakeUniversalOpts, \"x64AppPath\" | \"arm64AppPath\" | \"outAppPath\" | \"force\"> {\n  /**\n   * Whether to merge x64 and arm64 ASARs into one.\n   *\n   * @default true\n   */\n  mergeASARs?: boolean\n}\n\n/**\n * Signing options passed to `@electron/osx-sign`. Electron-builder owns the fields it must control\n * itself — `app`, `keychain`, `platform`, `version`, `optionsForFile`, and `type` (derived from the\n * build flavor: `mas-dev` → `development`, otherwise `distribution`) — and forwards everything else.\n *\n * Additionally exposes a small set of per-file convenience fields that electron-builder maps\n * internally through `optionsForFile`.\n *\n * @see https://packages.electronjs.org/osx-sign\n */\nexport interface ElectronSignOptions extends Omit<OnlySignOptions, \"optionsForFile\" | \"version\" | \"type\"> {\n  /**\n   * The signing identity (certificate name or SHA-1 hash). Applies to both app signing and DMG signing.\n   * Prefer the environment variables `CSC_LINK` / `CSC_NAME` over hardcoding this value.\n   *\n   * - **Not set** (default): electron-builder searches the keychain for a valid certificate.\n   * - **`null`**: skip signing entirely.\n   * - **`\"-\"`**: ad-hoc signing (requires disabling library validation — see `hardenedRuntime`).\n   */\n  readonly identity?: string | null\n  /**\n   * Path to the main app entitlements file.\n   * Falls back to `build/entitlements.mac.plist` if it exists, then to `@electron/osx-sign`'s\n   * built-in defaults.\n   */\n  readonly entitlements?: string | null\n  /**\n   * Path to child entitlements inherited by embedded frameworks and bundles.\n   * Falls back to `build/entitlements.mac.inherit.plist` if it exists.\n   */\n  readonly entitlementsInherit?: string | null\n  /**\n   * Path to entitlements for the Login Helper.\n   * Required when using App Sandbox, because the Login Helper cannot inherit entitlements.\n   * Defaults to the value of `entitlements`.\n   */\n  readonly entitlementsLoginHelper?: string | null\n  /**\n   * Whether to enable [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime).\n   *\n   * Hardened Runtime is a prerequisite for notarization (mandatory on macOS 10.15+).\n   * Defaults to `true` for `darwin` builds and `false` for `mas-dev`.\n   *\n   * @see https://github.com/electron/fuses\n   */\n  readonly hardenedRuntime?: boolean\n  /**\n   * Path to a [requirements file](https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/RequirementLang/RequirementLang.html).\n   * Not applicable for MAS.\n   */\n  readonly requirements?: string | null\n  /**\n   * URL of the timestamp authority server. Passed per-file to `codesign --timestamp=<url>`.\n   */\n  readonly timestamp?: string | null\n  /**\n   * Extra arguments passed to each `codesign` invocation.\n   * @example [\"--deep\"]\n   */\n  readonly additionalArguments?: Array<string> | null\n}\n\nexport type MacOsTargetName = \"default\" | \"dmg\" | \"mas\" | \"mas-dev\" | \"pkg\" | \"7z\" | \"zip\" | \"tar.xz\" | \"tar.lz\" | \"tar.gz\" | \"tar.bz2\" | \"dir\"\n\nexport interface MacConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The application category type, as shown in the Finder via *View -> Arrange by Application Category* when viewing the Applications directory.\n   *\n   * For example, `\"category\": \"public.app-category.developer-tools\"` will set the application category to *Developer Tools*.\n   *\n   * Valid values are listed in [Apple's documentation](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/LaunchServicesKeys.html#//apple_ref/doc/uid/TP40009250-SW8).\n   */\n  readonly category?: string | null\n\n  /**\n   * The target package type: list of `default`, `dmg`, `mas`, `mas-dev`, `pkg`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * Note: Squirrel.Mac auto update mechanism requires both `dmg` and `zip` to be enabled, even when only `dmg` is used. Disabling `zip` will break auto update in `dmg` packages.\n   * @default default (dmg and zip for Squirrel.Mac)\n   */\n  readonly target?: Array<MacOsTargetName | TargetConfiguration> | MacOsTargetName | TargetConfiguration | null\n\n  /**\n   * The path to application icon.\n   * Accepts `.icns` (legacy) or `.icon` (Icon Composer asset).\n   * If a `.icon` asset is provided, it will be preferred and compiled to an asset catalog.\n   * @default build/icon.icns\n   */\n  readonly icon?: string | null\n\n  /**\n   * The `CFBundleVersion`. Do not use it unless [you need to](https://github.com/electron-userland/electron-builder/issues/565#issuecomment-230678643).\n   */\n  readonly bundleVersion?: string | null\n\n  /**\n   * The `CFBundleShortVersionString`. Do not use it unless you need to.\n   */\n  readonly bundleShortVersion?: string | null\n\n  /**\n   * Whether a dark mode is supported. If your app does have a dark mode, you can make your app follow the system-wide dark mode setting.\n   * @default false\n   */\n  readonly darkModeSupport?: boolean\n\n  /**\n   * The bundle identifier to use in the application helper's plist.\n   * @default ${appBundleIdentifier}.helper\n   */\n  readonly helperBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Renderer helper's plist.\n   * @default ${appBundleIdentifier}.helper.Renderer\n   */\n  readonly helperRendererBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Plugin helper's plist.\n   * @default ${appBundleIdentifier}.helper.Plugin\n   */\n  readonly helperPluginBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the GPU helper's plist.\n   * @default ${appBundleIdentifier}.helper.GPU\n   */\n  readonly helperGPUBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the EH helper's plist.\n   * @default ${appBundleIdentifier}.helper.EH\n   */\n  readonly helperEHBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the NP helper's plist.\n   * @default ${appBundleIdentifier}.helper.NP\n   */\n  readonly helperNPBundleId?: string | null\n\n  /**\n   * The extra entries for `Info.plist`.\n   */\n  readonly extendInfo?: any\n\n  /**\n   * The minimum version of macOS required for the app to run. Corresponds to `LSMinimumSystemVersion`.\n   */\n  readonly minimumSystemVersion?: string | null\n\n  /** @private */\n  readonly cscInstallerLink?: string | null\n  /** @private */\n  readonly cscInstallerKeyPassword?: string | null\n\n  /**\n   * Extra files to put in archive. Not applicable for `tar.*`.\n   */\n  readonly extraDistFiles?: Array<string> | string | null\n\n  /**\n   * Codesigning configuration. The signing certificate is selected via `sign.identity` (or the\n   * `CSC_LINK` / `CSC_NAME` environment variables).\n   *\n   * - **Not set** (default): electron-builder auto-discovers a valid certificate in the keychain. If none is found, signing is skipped.\n   * - **`null`**: skip signing entirely.\n   * - **`string`**: path or module ID of a file that exports a {@link CustomMacSign} function.\n   * - **{@link CustomMacSign}**: inline custom signing function (JS/TS config only).\n   * - **{@link ElectronSignOptions}**: options forwarded directly to `@electron/osx-sign`.\n   *\n   * @see {@link ElectronSignOptions}\n   * @see https://www.electron.build/code-signing\n   */\n  readonly sign?: CustomMacSign | ElectronSignOptions | string | null\n\n  /**\n   * Options forwarded to `@electron/universal` when building a universal (multi-arch) app.\n   * Has no effect unless the target arch is `universal`.\n   *\n   * @see {@link ElectronUniversalOptions}\n   * @see https://github.com/electron/universal\n   */\n  readonly universal?: ElectronUniversalOptions | null\n\n  /**\n   * Whether to disable electron-builder's [@electron/notarize](https://github.com/electron/notarize) integration.\n   *\n   * Note: In order to activate the notarization step You MUST specify one of the following via environment variables:\n   *\n   * 1. `APPLE_API_KEY`, `APPLE_API_KEY_ID` and `APPLE_API_ISSUER`.\n   * 2. `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, and `APPLE_TEAM_ID`\n   * 3. `APPLE_KEYCHAIN` and `APPLE_KEYCHAIN_PROFILE`\n   *\n   * For security reasons it is recommended to use the first option (see https://github.com/electron-userland/electron-builder/issues/7859)\n   */\n  readonly notarize?: boolean\n}\n\nexport interface DmgOptions extends TargetSpecificOptions {\n  /**\n   * The path to background image (default: `build/background.tiff` or `build/background.png` if exists). The resolution of this file determines the resolution of the installer window.\n   * If background is not specified, use `window.size`. Default locations expected background size to be 540x380.\n   * @see [DMG with Retina background support](http://stackoverflow.com/a/11204769/1910191).\n   */\n  background?: string | null\n\n  /**\n   * The background color (accepts css colors). Used when no background image is set.\n   * @default #ffffff\n   */\n  backgroundColor?: string | null\n\n  /**\n   * The path to DMG icon (badge icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   */\n  badgeIcon?: string | null\n\n  /**\n   * The path to DMG icon (volume icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   * Defaults to the application icon (`build/icon.icns`).\n   */\n  icon?: string | null\n\n  /**\n   * The size of all the icons inside the DMG.\n   * @default 80\n   */\n  readonly iconSize?: number | null\n\n  /**\n   * The size of all the icon texts inside the DMG.\n   * @default 12\n   */\n  readonly iconTextSize?: number | null\n\n  /**\n   * The title of the produced DMG, which will be shown when mounted (volume name).\n   *\n   * Macro `${productName}`, `${version}` and `${name}` are supported.\n   * @default ${productName} ${version}\n   */\n  readonly title?: string | null\n\n  /**\n   * The content — to customize icon locations. The x and y coordinates refer to the position of the **center** of the icon (at 1x scale), and do not take the label into account.\n   */\n  contents?: Array<DmgContent>\n\n  /**\n   * The disk image format. `ULFO` (lzfse-compressed image (OS X 10.11+ only)). `ULMO` (lzma-compressed image (macOS 10.15+ only)).\n   * @default UDZO\n   */\n  format?: \"UDRW\" | \"UDRO\" | \"UDCO\" | \"UDZO\" | \"UDBZ\" | \"ULFO\" | \"ULMO\"\n\n  /**\n   * The filesystem for the DMG volume (e.g. `\"APFS\"` or `\"HFS+\"`)\n   * As of v27 this defaults to APFS. Set it explicitly to `\"HFS+\"` if you need compatibility with older macOS versions (pre-10.13 High Sierra cannot mount APFS volumes).\n   * @default APFS\n   */\n  readonly filesystem?: \"HFS+\" | \"APFS\" | null\n\n  /**\n   * The initial size of the DMG filesystem. Accepts the same syntax as the `-size` argument to `hdiutil`, e.g. `\"150m\"`, `\"4g\"`.\n   * If not specified, the size is calculated automatically.\n   * Set this explicitly for large apps or apps with sparse files to avoid \"No space left on device\" errors.\n   */\n  readonly size?: string | null\n\n  /**\n   * Whether to shrink the DMG filesystem to the minimum size after copying files.\n   * Set to `false` to preserve the explicit `size` you specified.\n   * @default true\n   */\n  readonly shrink?: boolean\n\n  /**\n   * The DMG window position and size. With y co-ordinates running from bottom to top.\n   *\n   * The Finder makes sure that the window will be on the user’s display, so if you want your window at the top left of the display you could use `\"x\": 0, \"y\": 100000` as the x, y co-ordinates.\n   * It is not to be possible to position the window relative to the [top left](https://github.com/electron-userland/electron-builder/issues/3990#issuecomment-512960957) or relative to the center of the user’s screen.\n   */\n  window?: DmgWindow\n\n  /**\n   * Whether to create internet-enabled disk image (when it is downloaded using a browser it will automatically decompress the image, put the application on the desktop, unmount and remove the disk image file).\n   * @default false\n   */\n  readonly internetEnabled?: boolean\n\n  /**\n   * Whether to sign the DMG or not. Signing is not required and will lead to unwanted errors in combination with notarization requirements.\n   * @default false\n   */\n  readonly sign?: boolean\n\n  /**\n   * License agreement to display when the DMG is mounted.\n   *\n   * Accepts a single file path (`.rtf`, `.txt`, or `.html`) used as the English/default license,\n   * or a language-code → file-path map for multi-language builds.\n   *\n   * When set, this takes precedence over the file-naming convention\n   * (`license_en.txt`, etc. in the build resources directory).\n   * Paths are resolved relative to the build resources directory or project root.\n   *\n   * @example Single language\n   * ```yaml\n   * dmg:\n   *   license: \"build/license.rtf\"\n   * ```\n   *\n   * @example Multi-language\n   * ```yaml\n   * dmg:\n   *   license:\n   *     en_US: \"build/license.rtf\"\n   *     de_DE: \"build/license_de.txt\"\n   *     ja_JP: \"build/license_ja.txt\"\n   * ```\n   *\n   * If not set, electron-builder scans the build resources directory for\n   * `license_LANG.{rtf,txt,html}` files automatically.\n   */\n  license?: string | Record<string, string> | null\n\n  /**\n   * @private\n   * @default true\n   */\n  writeUpdateInfo?: boolean\n}\n\nexport interface DmgWindow {\n  /**\n   * The X position relative to left of the screen.\n   * @default 400\n   */\n  x?: number\n\n  /**\n   * The Y position relative to bottom of the screen.\n   * @default 100\n   */\n  y?: number\n\n  /**\n   * The width. Defaults to background image width or 540.\n   */\n  width?: number\n\n  /**\n   * The height. Defaults to background image height or 380.\n   */\n  height?: number\n}\n\nexport interface DmgContent {\n  /**\n   * The device-independent pixel offset from the left of the window to the **center** of the icon.\n   */\n  x: number\n  /**\n   * The device-independent pixel offset from the top of the window to the **center** of the icon.\n   */\n  y: number\n  type?: \"link\" | \"file\" | \"dir\"\n\n  /**\n   * The name of the file within the DMG. Defaults to basename of `path`.\n   */\n  name?: string\n\n  /**\n   * The path of the file within the DMG.\n   */\n  path?: string\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type\nexport interface MasConfiguration extends MacConfiguration {}\n"]}
+{"version":3,"file":"macOptions.js","sourceRoot":"","sources":["../../src/options/macOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { TargetConfiguration, TargetSpecificOptions } from \"../core.js\"\nimport { PlatformSpecificBuildOptions } from \"./PlatformSpecificBuildOptions.js\"\nimport { CustomMacSign } from \"../macPackager.js\"\nimport type { OnlySignOptions, SigningDistributionType } from \"@electron/osx-sign\"\nimport type { MakeUniversalOpts } from \"@electron/universal\"\n\n/**\n * Options forwarded to `@electron/universal`'s `makeUniversalApp`.\n * Electron-builder fills in the app paths and `force`; everything else is configurable here\n * and auto-tracks upstream additions to `MakeUniversalOpts`.\n *\n * @see https://github.com/electron/universal\n */\nexport interface ElectronUniversalOptions extends Omit<MakeUniversalOpts, \"x64AppPath\" | \"arm64AppPath\" | \"outAppPath\" | \"force\"> {\n  /**\n   * Whether to merge x64 and arm64 ASARs into one.\n   *\n   * @default true\n   */\n  mergeASARs?: boolean\n}\n\n/**\n * Signing options passed to `@electron/osx-sign`. Electron-builder owns the fields it must control\n * itself — `app`, `keychain`, `platform`, `version`, and `optionsForFile` — and forwards everything else.\n *\n * Additionally exposes a small set of per-file convenience fields that electron-builder maps\n * internally through `optionsForFile`.\n *\n * @see https://packages.electronjs.org/osx-sign\n */\nexport interface ElectronSignOptions extends Omit<OnlySignOptions, \"optionsForFile\" | \"version\"> {\n  /**\n   * The type of certificate to use when signing: `development` or `distribution`.\n   *\n   * Defaults to a value derived from the build flavor: `mas-dev` → `development`, otherwise `distribution`.\n   * Set it explicitly to override — e.g. `development` on a darwin build signs with a `Mac Developer` or\n   * `Apple Development` certificate instead of `Developer ID Application` and embeds a matching\n   * development provisioning profile.\n   *\n   * Development-signed apps are blocked by Gatekeeper on other machines; users must use the\n   * right-click → Open workaround documented at https://support.apple.com/en-us/guide/mac-help/mh40616/mac.\n   * Such builds are not suitable for production distribution and cannot be notarized.\n   */\n  readonly type?: SigningDistributionType\n  /**\n   * The signing identity (certificate name or SHA-1 hash). Applies to both app signing and DMG signing.\n   * Prefer the environment variables `CSC_LINK` / `CSC_NAME` over hardcoding this value.\n   *\n   * - **Not set** (default): electron-builder searches the keychain for a valid certificate.\n   * - **`null`**: skip signing entirely.\n   * - **`\"-\"`**: ad-hoc signing (requires disabling library validation — see `hardenedRuntime`).\n   */\n  readonly identity?: string | null\n  /**\n   * Path to the main app entitlements file.\n   * Falls back to `build/entitlements.mac.plist` if it exists, then to `@electron/osx-sign`'s\n   * built-in defaults.\n   */\n  readonly entitlements?: string | null\n  /**\n   * Path to child entitlements inherited by embedded frameworks and bundles.\n   * Falls back to `build/entitlements.mac.inherit.plist` if it exists.\n   */\n  readonly entitlementsInherit?: string | null\n  /**\n   * Path to entitlements for the Login Helper.\n   * Required when using App Sandbox, because the Login Helper cannot inherit entitlements.\n   * Defaults to the value of `entitlements`.\n   */\n  readonly entitlementsLoginHelper?: string | null\n  /**\n   * Whether to enable [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime).\n   *\n   * Hardened Runtime is a prerequisite for notarization (mandatory on macOS 10.15+).\n   * Defaults to `true` for `darwin` builds and `false` for MAS builds (`mas` and `mas-dev`).\n   */\n  readonly hardenedRuntime?: boolean\n  /**\n   * Path to a [requirements file](https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/RequirementLang/RequirementLang.html).\n   * Not applicable for MAS.\n   */\n  readonly requirements?: string | null\n  /**\n   * URL of the timestamp authority server. Passed per-file to `codesign --timestamp=<url>`.\n   */\n  readonly timestamp?: string | null\n  /**\n   * Extra arguments passed to each `codesign` invocation.\n   * @example [\"--deep\"]\n   */\n  readonly additionalArguments?: Array<string> | null\n}\n\nexport type MacOsTargetName = \"default\" | \"dmg\" | \"mas\" | \"mas-dev\" | \"pkg\" | \"7z\" | \"zip\" | \"tar.xz\" | \"tar.lz\" | \"tar.gz\" | \"tar.bz2\" | \"dir\"\n\nexport interface MacConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The application category type, as shown in the Finder via *View -> Arrange by Application Category* when viewing the Applications directory.\n   *\n   * For example, `\"category\": \"public.app-category.developer-tools\"` will set the application category to *Developer Tools*.\n   *\n   * Valid values are listed in [Apple's documentation](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/LaunchServicesKeys.html#//apple_ref/doc/uid/TP40009250-SW8).\n   */\n  readonly category?: string | null\n\n  /**\n   * The target package type: list of `default`, `dmg`, `mas`, `mas-dev`, `pkg`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * Note: Squirrel.Mac auto update mechanism requires both `dmg` and `zip` to be enabled, even when only `dmg` is used. Disabling `zip` will break auto update in `dmg` packages.\n   * @default default (dmg and zip for Squirrel.Mac)\n   */\n  readonly target?: Array<MacOsTargetName | TargetConfiguration> | MacOsTargetName | TargetConfiguration | null\n\n  /**\n   * The path to application icon.\n   * Accepts `.icns` (legacy) or `.icon` (Icon Composer asset).\n   * If a `.icon` asset is provided, it will be preferred and compiled to an asset catalog.\n   * @default build/icon.icns\n   */\n  readonly icon?: string | null\n\n  /**\n   * The `CFBundleVersion`. Do not use it unless [you need to](https://github.com/electron-userland/electron-builder/issues/565#issuecomment-230678643).\n   */\n  readonly bundleVersion?: string | null\n\n  /**\n   * The `CFBundleShortVersionString`. Do not use it unless you need to.\n   */\n  readonly bundleShortVersion?: string | null\n\n  /**\n   * Whether a dark mode is supported. If your app does have a dark mode, you can make your app follow the system-wide dark mode setting.\n   * @default false\n   */\n  readonly darkModeSupport?: boolean\n\n  /**\n   * The bundle identifier to use in the application helper's plist.\n   * @default ${appBundleIdentifier}.helper\n   */\n  readonly helperBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Renderer helper's plist.\n   * @default ${appBundleIdentifier}.helper.Renderer\n   */\n  readonly helperRendererBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the Plugin helper's plist.\n   * @default ${appBundleIdentifier}.helper.Plugin\n   */\n  readonly helperPluginBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the GPU helper's plist.\n   * @default ${appBundleIdentifier}.helper.GPU\n   */\n  readonly helperGPUBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the EH helper's plist.\n   * @default ${appBundleIdentifier}.helper.EH\n   */\n  readonly helperEHBundleId?: string | null\n\n  /**\n   * The bundle identifier to use in the NP helper's plist.\n   * @default ${appBundleIdentifier}.helper.NP\n   */\n  readonly helperNPBundleId?: string | null\n\n  /**\n   * The extra entries for `Info.plist`.\n   */\n  readonly extendInfo?: any\n\n  /**\n   * The minimum version of macOS required for the app to run. Corresponds to `LSMinimumSystemVersion`.\n   */\n  readonly minimumSystemVersion?: string | null\n\n  /** @private */\n  readonly cscInstallerLink?: string | null\n  /** @private */\n  readonly cscInstallerKeyPassword?: string | null\n\n  /**\n   * Extra files to put in archive. Not applicable for `tar.*`.\n   */\n  readonly extraDistFiles?: Array<string> | string | null\n\n  /**\n   * Codesigning configuration. The signing certificate is selected via `sign.identity` (or the\n   * `CSC_LINK` / `CSC_NAME` environment variables).\n   *\n   * - **Not set** (default): electron-builder auto-discovers a valid certificate in the keychain. If none is found, signing is skipped.\n   * - **`null`**: skip signing entirely.\n   * - **`string`**: path or module ID of a file that exports a {@link CustomMacSign} function.\n   * - **{@link CustomMacSign}**: inline custom signing function (JS/TS config only).\n   * - **{@link ElectronSignOptions}**: options forwarded directly to `@electron/osx-sign`.\n   *\n   * @see {@link ElectronSignOptions}\n   * @see https://www.electron.build/docs/features/code-signing\n   */\n  readonly sign?: CustomMacSign | ElectronSignOptions | string | null\n\n  /**\n   * Options forwarded to `@electron/universal` when building a universal (multi-arch) app.\n   * Has no effect unless the target arch is `universal`.\n   *\n   * @see {@link ElectronUniversalOptions}\n   * @see https://github.com/electron/universal\n   */\n  readonly universal?: ElectronUniversalOptions | null\n\n  /**\n   * Whether to disable electron-builder's [@electron/notarize](https://github.com/electron/notarize) integration.\n   *\n   * Note: In order to activate the notarization step You MUST specify one of the following via environment variables:\n   *\n   * 1. `APPLE_API_KEY`, `APPLE_API_KEY_ID` and `APPLE_API_ISSUER`.\n   * 2. `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, and `APPLE_TEAM_ID`\n   * 3. `APPLE_KEYCHAIN` and `APPLE_KEYCHAIN_PROFILE`\n   *\n   * For security reasons it is recommended to use the first option (see https://github.com/electron-userland/electron-builder/issues/7859)\n   */\n  readonly notarize?: boolean\n}\n\nexport interface DmgOptions extends TargetSpecificOptions {\n  /**\n   * The path to background image (default: `build/background.tiff` or `build/background.png` if exists). The resolution of this file determines the resolution of the installer window.\n   * If background is not specified, use `window.size`. Default locations expected background size to be 540x380.\n   * @see [DMG with Retina background support](http://stackoverflow.com/a/11204769/1910191).\n   */\n  background?: string | null\n\n  /**\n   * The background color (accepts css colors). Used when no background image is set.\n   * @default #ffffff\n   */\n  backgroundColor?: string | null\n\n  /**\n   * The path to DMG icon (badge icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   */\n  badgeIcon?: string | null\n\n  /**\n   * The path to DMG icon (volume icon), which will be shown when mounted, relative to the [build resources](https://www.electron.build/contents#extraresources) or to the project directory.\n   * Defaults to the application icon (`build/icon.icns`).\n   */\n  icon?: string | null\n\n  /**\n   * The size of all the icons inside the DMG.\n   * @default 80\n   */\n  readonly iconSize?: number | null\n\n  /**\n   * The size of all the icon texts inside the DMG.\n   * @default 12\n   */\n  readonly iconTextSize?: number | null\n\n  /**\n   * The title of the produced DMG, which will be shown when mounted (volume name).\n   *\n   * Macro `${productName}`, `${version}` and `${name}` are supported.\n   * @default ${productName} ${version}\n   */\n  readonly title?: string | null\n\n  /**\n   * The content — to customize icon locations. The x and y coordinates refer to the position of the **center** of the icon (at 1x scale), and do not take the label into account.\n   */\n  contents?: Array<DmgContent>\n\n  /**\n   * The disk image format. `ULFO` (lzfse-compressed image (OS X 10.11+ only)). `ULMO` (lzma-compressed image (macOS 10.15+ only)).\n   * @default UDZO\n   */\n  format?: \"UDRW\" | \"UDRO\" | \"UDCO\" | \"UDZO\" | \"UDBZ\" | \"ULFO\" | \"ULMO\"\n\n  /**\n   * The filesystem for the DMG volume (e.g. `\"APFS\"` or `\"HFS+\"`)\n   * As of v27 this defaults to APFS. Set it explicitly to `\"HFS+\"` if you need compatibility with older macOS versions (pre-10.13 High Sierra cannot mount APFS volumes).\n   * @default APFS\n   */\n  readonly filesystem?: \"HFS+\" | \"APFS\" | null\n\n  /**\n   * The initial size of the DMG filesystem. Accepts the same syntax as the `-size` argument to `hdiutil`, e.g. `\"150m\"`, `\"4g\"`.\n   * If not specified, the size is calculated automatically.\n   * Set this explicitly for large apps or apps with sparse files to avoid \"No space left on device\" errors.\n   */\n  readonly size?: string | null\n\n  /**\n   * Whether to shrink the DMG filesystem to the minimum size after copying files.\n   * Set to `false` to preserve the explicit `size` you specified.\n   * @default true\n   */\n  readonly shrink?: boolean\n\n  /**\n   * The DMG window position and size. With y co-ordinates running from bottom to top.\n   *\n   * The Finder makes sure that the window will be on the user’s display, so if you want your window at the top left of the display you could use `\"x\": 0, \"y\": 100000` as the x, y co-ordinates.\n   * It is not to be possible to position the window relative to the [top left](https://github.com/electron-userland/electron-builder/issues/3990#issuecomment-512960957) or relative to the center of the user’s screen.\n   */\n  window?: DmgWindow\n\n  /**\n   * Whether to create internet-enabled disk image (when it is downloaded using a browser it will automatically decompress the image, put the application on the desktop, unmount and remove the disk image file).\n   * @default false\n   */\n  readonly internetEnabled?: boolean\n\n  /**\n   * Whether to sign the DMG or not. Signing is not required and will lead to unwanted errors in combination with notarization requirements.\n   * @default false\n   */\n  readonly sign?: boolean\n\n  /**\n   * License agreement to display when the DMG is mounted.\n   *\n   * Accepts a single file path (`.rtf`, `.txt`, or `.html`) used as the English/default license,\n   * or a language-code → file-path map for multi-language builds.\n   *\n   * When set, this takes precedence over the file-naming convention\n   * (`license_en.txt`, etc. in the build resources directory).\n   * Paths are resolved relative to the build resources directory or project root.\n   *\n   * @example Single language\n   * ```yaml\n   * dmg:\n   *   license: \"build/license.rtf\"\n   * ```\n   *\n   * @example Multi-language\n   * ```yaml\n   * dmg:\n   *   license:\n   *     en_US: \"build/license.rtf\"\n   *     de_DE: \"build/license_de.txt\"\n   *     ja_JP: \"build/license_ja.txt\"\n   * ```\n   *\n   * If not set, electron-builder scans the build resources directory for\n   * `license_LANG.{rtf,txt,html}` files automatically.\n   */\n  license?: string | Record<string, string> | null\n\n  /**\n   * @private\n   * @default true\n   */\n  writeUpdateInfo?: boolean\n}\n\nexport interface DmgWindow {\n  /**\n   * The X position relative to left of the screen.\n   * @default 400\n   */\n  x?: number\n\n  /**\n   * The Y position relative to bottom of the screen.\n   * @default 100\n   */\n  y?: number\n\n  /**\n   * The width. Defaults to background image width or 540.\n   */\n  width?: number\n\n  /**\n   * The height. Defaults to background image height or 380.\n   */\n  height?: number\n}\n\nexport interface DmgContent {\n  /**\n   * The device-independent pixel offset from the left of the window to the **center** of the icon.\n   */\n  x: number\n  /**\n   * The device-independent pixel offset from the top of the window to the **center** of the icon.\n   */\n  y: number\n  type?: \"link\" | \"file\" | \"dir\"\n\n  /**\n   * The name of the file within the DMG. Defaults to basename of `path`.\n   */\n  name?: string\n\n  /**\n   * The path of the file within the DMG.\n   */\n  path?: string\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type\nexport interface MasConfiguration extends MacConfiguration {}\n"]}

package/dist/options/pkgOptions.d.ts

@@ -48,7 +48,7 @@ export interface PkgOptions extends TargetSpecificOptions {
      */
     readonly allowRootDirectory?: boolean | null;
     /**
-     * The name of certificate to use when signing. Consider using environment variables [CSC_LINK or CSC_NAME](https://www.electron.build/code-signing) instead of specifying this option.
+     * The name of certificate to use when signing. Consider using environment variables [CSC_LINK or CSC_NAME](https://www.electron.build/docs/features/code-signing) instead of specifying this option.
      */
     readonly identity?: string | null;
     /**

package/dist/options/pkgOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"pkgOptions.js","sourceRoot":"","sources":["../../src/options/pkgOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { TargetSpecificOptions } from \"../core.js\"\n\n// noinspection SpellCheckingInspection\nexport type BackgroundAlignment = \"center\" | \"left\" | \"right\" | \"top\" | \"bottom\" | \"topleft\" | \"topright\" | \"bottomleft\" | \"bottomright\"\n// noinspection SpellCheckingInspection\nexport type BackgroundScaling = \"tofit\" | \"none\" | \"proportional\"\n\n/**\n * macOS product archive options.\n */\nexport interface PkgOptions extends TargetSpecificOptions {\n  /**\n   * The scripts directory, relative to `build` (build resources directory).\n   * The scripts can be in any language so long as the files are marked executable and have the appropriate shebang indicating the path to the interpreter.\n   * Scripts are required to be executable (`chmod +x file`).\n   * @default build/pkg-scripts\n   * @see [Scripting in installer packages](http://macinstallers.blogspot.de/2012/07/scripting-in-installer-packages.html).\n   */\n  readonly scripts?: string | null\n\n  /**\n   * should be not documented, only to experiment\n   * @private\n   */\n  readonly productbuild?: Array<string> | null\n\n  /**\n   * The install location. [Do not use it](https://stackoverflow.com/questions/12863944/how-do-you-specify-a-default-install-location-to-home-with-pkgbuild) to create per-user package.\n   * Mostly never you will need to change this option. `/Applications` would install it as expected into `/Applications` if the local system domain is chosen, or into `$HOME/Applications` if the home installation is chosen.\n   * @default /Applications\n   */\n  readonly installLocation?: string | null\n\n  /**\n   * Whether can be installed at the root of any volume, including non-system volumes. Otherwise, it cannot be installed at the root of a volume.\n   *\n   * Corresponds to [enable_anywhere](https://developer.apple.com/library/content/documentation/DeveloperTools/Reference/DistributionDefinitionRef/Chapters/Distribution_XML_Ref.html#//apple_ref/doc/uid/TP40005370-CH100-SW70).\n   * @default true\n   */\n  readonly allowAnywhere?: boolean | null\n\n  /**\n   * Whether can be installed into the current user’s home directory.\n   * A home directory installation is done as the current user (not as root), and it cannot write outside of the home directory.\n   * If the product cannot be installed in the user’s home directory and be not completely functional from user’s home directory.\n   *\n   * Corresponds to [enable_currentUserHome](https://developer.apple.com/library/content/documentation/DeveloperTools/Reference/DistributionDefinitionRef/Chapters/Distribution_XML_Ref.html#//apple_ref/doc/uid/TP40005370-CH100-SW70).\n   * @default true\n   */\n  readonly allowCurrentUserHome?: boolean | null\n\n  /**\n   * Whether can be installed into the root directory. Should usually be `true` unless the product can be installed only to the user’s home directory.\n   *\n   * Corresponds to [enable_localSystem](https://developer.apple.com/library/content/documentation/DeveloperTools/Reference/DistributionDefinitionRef/Chapters/Distribution_XML_Ref.html#//apple_ref/doc/uid/TP40005370-CH100-SW70).\n   * @default true\n   */\n  readonly allowRootDirectory?: boolean | null\n\n  /**\n   * The name of certificate to use when signing. Consider using environment variables [CSC_LINK or CSC_NAME](https://www.electron.build/code-signing) instead of specifying this option.\n   */\n  readonly identity?: string | null\n\n  /**\n   * The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants). In addition to `txt`, `rtf` and `html` supported (don't forget to use `target=\"_blank\"` for links).\n   */\n  readonly license?: string | null\n\n  /**\n   * Options for the background image for the installer.\n   */\n  readonly background?: PkgBackgroundOptions | null\n\n  /**\n   * The path to the welcome file. This may be used to customize the text on the Introduction page of the installer.\n   */\n  readonly welcome?: string | null\n\n  /**\n   * Identifies applications that must be closed before the package is installed.\n   *\n   * Corresponds to [must-close](https://developer.apple.com/library/archive/documentation/DeveloperTools/Reference/DistributionDefinitionRef/Chapters/Distribution_XML_Ref.html#//apple_ref/doc/uid/TP40005370-CH100-SW77).\n   */\n  readonly mustClose?: Array<string> | null\n\n  /**\n   * The path to the conclusion file. This may be used to customize the text on the final \"Summary\" page of the installer.\n   */\n  readonly conclusion?: string | null\n\n  /**\n   * Install bundle over previous version if moved by user?\n   * @default true\n   */\n  readonly isRelocatable?: boolean | null\n\n  /**\n   * Don't install bundle if newer version on disk?\n   * @default true\n   */\n  readonly isVersionChecked?: boolean | null\n\n  /**\n   * Require identical bundle identifiers at install path?\n   * @default true\n   */\n  readonly hasStrictIdentifier?: boolean | null\n\n  /**\n   * Specifies how an existing version of the bundle on disk should be handled when the version in\n   * the package is installed.\n   *\n   * If you specify upgrade, the bundle in the package atomi-cally replaces any version on disk;\n   * this has the effect of deleting old paths that no longer exist in the new version of\n   * the bundle.\n   *\n   * If you specify update, the bundle in the package overwrites the version on disk, and any files\n   * not contained in the package will be left intact; this is appropriate when you are delivering\n   * an update-only package.\n   *\n   * Another effect of update is that the package bundle will not be installed at all if there is\n   * not already a version on disk; this allows a package to deliver an update for an app that\n   * the user might have deleted.\n   *\n   * @default upgrade\n   */\n  readonly overwriteAction?: \"upgrade\" | \"update\" | null\n\n  /**\n   * The extra component packages directory (relative to build resources directory) for MacOS product archive\n   * Autoscans directory for any `.pkg` files and adds to `productbuild` command as `--package-path` and `--package` accordingly\n   */\n  readonly extraPkgsDir?: string | null\n}\n\n/**\n * Options for the background image in a PKG installer\n */\nexport interface PkgBackgroundOptions {\n  /**\n   * Path to the image to use as an installer background.\n   */\n  file?: string\n\n  /**\n   * Alignment of the background image.\n   * Options are: center, left, right, top, bottom, topleft, topright, bottomleft, bottomright\n   * @default center\n   */\n  alignment?: BackgroundAlignment | null\n\n  /**\n   * Scaling of the background image.\n   * Options are: tofit, none, proportional\n   * @default tofit\n   */\n  scaling?: BackgroundScaling | null\n}\n"]}
+{"version":3,"file":"pkgOptions.js","sourceRoot":"","sources":["../../src/options/pkgOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { TargetSpecificOptions } from \"../core.js\"\n\n// noinspection SpellCheckingInspection\nexport type BackgroundAlignment = \"center\" | \"left\" | \"right\" | \"top\" | \"bottom\" | \"topleft\" | \"topright\" | \"bottomleft\" | \"bottomright\"\n// noinspection SpellCheckingInspection\nexport type BackgroundScaling = \"tofit\" | \"none\" | \"proportional\"\n\n/**\n * macOS product archive options.\n */\nexport interface PkgOptions extends TargetSpecificOptions {\n  /**\n   * The scripts directory, relative to `build` (build resources directory).\n   * The scripts can be in any language so long as the files are marked executable and have the appropriate shebang indicating the path to the interpreter.\n   * Scripts are required to be executable (`chmod +x file`).\n   * @default build/pkg-scripts\n   * @see [Scripting in installer packages](http://macinstallers.blogspot.de/2012/07/scripting-in-installer-packages.html).\n   */\n  readonly scripts?: string | null\n\n  /**\n   * should be not documented, only to experiment\n   * @private\n   */\n  readonly productbuild?: Array<string> | null\n\n  /**\n   * The install location. [Do not use it](https://stackoverflow.com/questions/12863944/how-do-you-specify-a-default-install-location-to-home-with-pkgbuild) to create per-user package.\n   * Mostly never you will need to change this option. `/Applications` would install it as expected into `/Applications` if the local system domain is chosen, or into `$HOME/Applications` if the home installation is chosen.\n   * @default /Applications\n   */\n  readonly installLocation?: string | null\n\n  /**\n   * Whether can be installed at the root of any volume, including non-system volumes. Otherwise, it cannot be installed at the root of a volume.\n   *\n   * Corresponds to [enable_anywhere](https://developer.apple.com/library/content/documentation/DeveloperTools/Reference/DistributionDefinitionRef/Chapters/Distribution_XML_Ref.html#//apple_ref/doc/uid/TP40005370-CH100-SW70).\n   * @default true\n   */\n  readonly allowAnywhere?: boolean | null\n\n  /**\n   * Whether can be installed into the current user’s home directory.\n   * A home directory installation is done as the current user (not as root), and it cannot write outside of the home directory.\n   * If the product cannot be installed in the user’s home directory and be not completely functional from user’s home directory.\n   *\n   * Corresponds to [enable_currentUserHome](https://developer.apple.com/library/content/documentation/DeveloperTools/Reference/DistributionDefinitionRef/Chapters/Distribution_XML_Ref.html#//apple_ref/doc/uid/TP40005370-CH100-SW70).\n   * @default true\n   */\n  readonly allowCurrentUserHome?: boolean | null\n\n  /**\n   * Whether can be installed into the root directory. Should usually be `true` unless the product can be installed only to the user’s home directory.\n   *\n   * Corresponds to [enable_localSystem](https://developer.apple.com/library/content/documentation/DeveloperTools/Reference/DistributionDefinitionRef/Chapters/Distribution_XML_Ref.html#//apple_ref/doc/uid/TP40005370-CH100-SW70).\n   * @default true\n   */\n  readonly allowRootDirectory?: boolean | null\n\n  /**\n   * The name of certificate to use when signing. Consider using environment variables [CSC_LINK or CSC_NAME](https://www.electron.build/docs/features/code-signing) instead of specifying this option.\n   */\n  readonly identity?: string | null\n\n  /**\n   * The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants). In addition to `txt`, `rtf` and `html` supported (don't forget to use `target=\"_blank\"` for links).\n   */\n  readonly license?: string | null\n\n  /**\n   * Options for the background image for the installer.\n   */\n  readonly background?: PkgBackgroundOptions | null\n\n  /**\n   * The path to the welcome file. This may be used to customize the text on the Introduction page of the installer.\n   */\n  readonly welcome?: string | null\n\n  /**\n   * Identifies applications that must be closed before the package is installed.\n   *\n   * Corresponds to [must-close](https://developer.apple.com/library/archive/documentation/DeveloperTools/Reference/DistributionDefinitionRef/Chapters/Distribution_XML_Ref.html#//apple_ref/doc/uid/TP40005370-CH100-SW77).\n   */\n  readonly mustClose?: Array<string> | null\n\n  /**\n   * The path to the conclusion file. This may be used to customize the text on the final \"Summary\" page of the installer.\n   */\n  readonly conclusion?: string | null\n\n  /**\n   * Install bundle over previous version if moved by user?\n   * @default true\n   */\n  readonly isRelocatable?: boolean | null\n\n  /**\n   * Don't install bundle if newer version on disk?\n   * @default true\n   */\n  readonly isVersionChecked?: boolean | null\n\n  /**\n   * Require identical bundle identifiers at install path?\n   * @default true\n   */\n  readonly hasStrictIdentifier?: boolean | null\n\n  /**\n   * Specifies how an existing version of the bundle on disk should be handled when the version in\n   * the package is installed.\n   *\n   * If you specify upgrade, the bundle in the package atomi-cally replaces any version on disk;\n   * this has the effect of deleting old paths that no longer exist in the new version of\n   * the bundle.\n   *\n   * If you specify update, the bundle in the package overwrites the version on disk, and any files\n   * not contained in the package will be left intact; this is appropriate when you are delivering\n   * an update-only package.\n   *\n   * Another effect of update is that the package bundle will not be installed at all if there is\n   * not already a version on disk; this allows a package to deliver an update for an app that\n   * the user might have deleted.\n   *\n   * @default upgrade\n   */\n  readonly overwriteAction?: \"upgrade\" | \"update\" | null\n\n  /**\n   * The extra component packages directory (relative to build resources directory) for MacOS product archive\n   * Autoscans directory for any `.pkg` files and adds to `productbuild` command as `--package-path` and `--package` accordingly\n   */\n  readonly extraPkgsDir?: string | null\n}\n\n/**\n * Options for the background image in a PKG installer\n */\nexport interface PkgBackgroundOptions {\n  /**\n   * Path to the image to use as an installer background.\n   */\n  file?: string\n\n  /**\n   * Alignment of the background image.\n   * Options are: center, left, right, top, bottom, topleft, topright, bottomleft, bottomright\n   * @default center\n   */\n  alignment?: BackgroundAlignment | null\n\n  /**\n   * Scaling of the background image.\n   * Options are: tofit, none, proportional\n   * @default tofit\n   */\n  scaling?: BackgroundScaling | null\n}\n"]}

package/dist/options/winOptions.d.ts

@@ -32,10 +32,11 @@ export interface WindowsConfiguration extends PlatformSpecificBuildOptions {
      *   `https://` URL, or a base64-encoded certificate. This is the recommended setup for CI.
      * - Set to `false` or `null` to **disable** code signing entirely (executable resources such as
      *   the icon and metadata are still edited).
-     * - Set to an **object** to configure signing explicitly. The `type` field selects the signing
-     *   backend (`signtool` is the implicit default) and dispatches to a dedicated sign manager;
-     *   provide exactly one of the modes below. Each output artifact is signed individually, and by
-     *   default executables are dual-signed (see `signingHashAlgorithms`).
+     * - Set to an **object** to configure signing explicitly. The **required** `type` field selects the
+     *   signing backend (`signtool`, `hsm`, `pkcs11`, or `azure`) and dispatches to a dedicated sign
+     *   manager; provide exactly one of the modes below. When `win.sign` is left unset, the `signtool`
+     *   backend is used with env-discovered credentials. Each output artifact is signed individually,
+     *   and by default executables are dual-signed (see `signingHashAlgorithms`).
      *
      * - `{ type: "signtool", ... }` — Sign with a local certificate file (.pfx/.p12) or a
      *   certificate from the Windows certificate store. Uses Microsoft `signtool.exe` on Windows and
@@ -49,7 +50,7 @@ export interface WindowsConfiguration extends PlatformSpecificBuildOptions {
      * - `{ type: "azure", ... }` — Sign via Azure Trusted Signing (cloud service). Requires
      *   Azure Entra ID environment variables for authentication.
      *
-     * See [Code Signing](https://www.electron.build/code-signing).
+     * See [Code Signing](https://www.electron.build/docs/features/code-signing).
      */
     readonly sign?: WindowsSigningConfiguration | false | null;
     /**
@@ -166,7 +167,7 @@ interface WindowsSigningSharedOptions {
      * whether this pass is a nested signature (`isNest`), plus a `computeSignToolArgs(isWin)` helper
      * that returns the default arguments electron-builder would otherwise have used. Use this to
      * integrate an external or cloud signing service. See
-     * [Code Signing](https://www.electron.build/code-signing).
+     * [Code Signing](https://www.electron.build/docs/features/code-signing).
      */
     readonly sign?: CustomWindowsSign | string | null;
 }
@@ -187,7 +188,7 @@ export interface WindowsSigntoolSigningConfig extends WindowsSigningSharedOption
      * Prefer supplying this out-of-band via the `WIN_CSC_LINK` (or `CSC_LINK`) environment variable
      * instead of hardcoding a path — that variable also accepts an `https://` URL or a base64-encoded
      * certificate, which is safer and more convenient on CI. See
-     * [Code Signing](https://www.electron.build/code-signing).
+     * [Code Signing](https://www.electron.build/docs/features/code-signing).
      */
     readonly certificateFile?: string | null;
     /**

package/dist/options/winOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"winOptions.d.ts","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAEhF,MAAM,WAAW,oBAAqB,SAAQ,4BAA4B;IACxE;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,2BAA2B,GAAG,KAAK,GAAG,IAAI,CAAA;IAE1D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IAE5C;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAA;IAEjE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CACpC;AAED,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,kBAAkB,GAAG,sBAAsB,CAAA;AAI/F;;;;GAIG;AACH,UAAU,2BAA2B;IACnC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAEtD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAA;IAEhE;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAElD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAAA;CAClD;AAID;;;;;;GAMG;AACH,MAAM,WAAW,4BAA6B,SAAQ,2BAA2B;IAC/E,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAID;;;GAGG;AACH,MAAM,WAAW,uBAAwB,SAAQ,2BAA2B;IAC1E,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IAEpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IAEtC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA2B,SAAQ,2BAA2B;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IAEvB;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAID;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IAEtB;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAE9B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IAEvC;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IAEvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAE5B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IAEjC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrD;AAID,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG,uBAAuB,GAAG,0BAA0B,GAAG,yBAAyB,CAAA;AAEzJ,uEAAuE;AACvE,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG,uBAAuB,GAAG,0BAA0B,CAAA;AAE7H;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,oBAAoB,GAAG,2BAA2B,GAAG,IAAI,CAGnH;AAED,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAE9E"}
+{"version":3,"file":"winOptions.d.ts","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAEhF,MAAM,WAAW,oBAAqB,SAAQ,4BAA4B;IACxE;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,2BAA2B,GAAG,KAAK,GAAG,IAAI,CAAA;IAE1D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IAE5C;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAA;IAEjE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CACpC;AAED,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,kBAAkB,GAAG,sBAAsB,CAAA;AAI/F;;;;GAIG;AACH,UAAU,2BAA2B;IACnC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAEtD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAA;IAEhE;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAElD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAAA;CAClD;AAID;;;;;;GAMG;AACH,MAAM,WAAW,4BAA6B,SAAQ,2BAA2B;IAC/E,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAID;;;GAGG;AACH,MAAM,WAAW,uBAAwB,SAAQ,2BAA2B;IAC1E,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IAEpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IAEtC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA2B,SAAQ,2BAA2B;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IAEvB;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAID;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IAEtB;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAE9B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IAEvC;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IAEvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAE5B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IAEjC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrD;AAID,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG,uBAAuB,GAAG,0BAA0B,GAAG,yBAAyB,CAAA;AAEzJ,uEAAuE;AACvE,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG,uBAAuB,GAAG,0BAA0B,CAAA;AAE7H;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,oBAAoB,GAAG,2BAA2B,GAAG,IAAI,CAGnH;AAED,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAE9E"}

package/dist/options/winOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"winOptions.js","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"AA8ZA;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAA4B;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;IACvB,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACrD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,MAA4B;IACnE,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAA;AACtD,CAAC","sourcesContent":["import { CustomWindowsSign } from \"../codeSign/win/windowsSignToolManager.js\"\nimport { TargetConfigType } from \"../core.js\"\nimport { PlatformSpecificBuildOptions } from \"./PlatformSpecificBuildOptions.js\"\n\nexport interface WindowsConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` ([portable app](https://www.electron.build/nsis#portable) without installation), `appx`, `msix`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * AppX and MSIX packages can be built on Windows 10 or Windows Server 2012 R2 (version 6.3+) or later, and on macOS via Parallels Desktop.\n   *\n   * To use Squirrel.Windows please install `electron-builder-squirrel-windows` dependency.\n   *\n   * @default nsis\n   */\n  readonly target?: TargetConfigType\n\n  /**\n   * The path to application icon.\n   * @default build/icon.ico\n   */\n  readonly icon?: string | null\n\n  /**\n   * The trademarks and registered trademarks.\n   */\n  readonly legalTrademarks?: string | null\n\n  /**\n   * Code signing configuration. Code signing stamps every installer and executable\n   * electron-builder produces with an Authenticode signature, so that Windows (SmartScreen / UAC)\n   * and your auto-updater can verify the publisher and that the files were not tampered with.\n   *\n   * How this option behaves:\n   * - Leave **unset** to sign using credentials discovered from the environment — primarily a\n   *   certificate supplied via `WIN_CSC_LINK` (or `CSC_LINK`) with its password in\n   *   `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`). `WIN_CSC_LINK` accepts a file path, an\n   *   `https://` URL, or a base64-encoded certificate. This is the recommended setup for CI.\n   * - Set to `false` or `null` to **disable** code signing entirely (executable resources such as\n   *   the icon and metadata are still edited).\n   * - Set to an **object** to configure signing explicitly. The `type` field selects the signing\n   *   backend (`signtool` is the implicit default) and dispatches to a dedicated sign manager;\n   *   provide exactly one of the modes below. Each output artifact is signed individually, and by\n   *   default executables are dual-signed (see `signingHashAlgorithms`).\n   *\n   * - `{ type: \"signtool\", ... }` — Sign with a local certificate file (.pfx/.p12) or a\n   *   certificate from the Windows certificate store. Uses Microsoft `signtool.exe` on Windows and\n   *   `osslsigncode` on macOS/Linux.\n   * - `{ type: \"hsm\", ... }` — Sign using a Hardware Security Module (HSM) or FIPS-compliant\n   *   hardware token via signtool's `/csp` (cryptographic service provider) and `/kc` (key\n   *   container) flags. Requires a modern `winCodeSign` toolset (the default — only the legacy\n   *   `\"0.0.0\"` pin is unsupported). Windows-only.\n   * - `{ type: \"pkcs11\", ... }` — Sign using a PKCS#11 hardware token via osslsigncode.\n   *   Available on macOS and Linux CI without a Windows VM.\n   * - `{ type: \"azure\", ... }` — Sign via Azure Trusted Signing (cloud service). Requires\n   *   Azure Entra ID environment variables for authentication.\n   *\n   * See [Code Signing](https://www.electron.build/code-signing).\n   */\n  readonly sign?: WindowsSigningConfiguration | false | null\n\n  /**\n   * Whether the NSIS auto-updater should verify the Authenticode signature of a downloaded update\n   * before installing it. This is a **runtime** check performed by your app via electron-updater,\n   * not a build-time check.\n   *\n   * When enabled (the default), the resolved [publisher name](#publisherName) is embedded into\n   * `app-update.yml` at build time. At update time electron-updater inspects the certificate that\n   * signed the downloaded installer and compares its subject (Distinguished Name / Common Name)\n   * against that publisher name, refusing to install on a mismatch. This prevents a tampered or\n   * maliciously substituted update from being installed.\n   *\n   * Set to `false` to skip verification — in which case the publisher name is **not** embedded.\n   * Disable this only if your updates are not Authenticode-signed.\n   *\n   * @default true\n   */\n  readonly verifyUpdateCodeSignature?: boolean\n\n  /**\n   * The [security level](https://msdn.microsoft.com/en-us/library/6ad1fshk.aspx#Anchor_9) at which the application requests to be executed.\n   * Cannot be specified per target, allowed only in the `win`.\n   * @default asInvoker\n   */\n  readonly requestedExecutionLevel?: RequestedExecutionLevel | null\n\n  /**\n   * Additional file name suffixes to code sign, beyond the default. By default electron-builder\n   * only signs `.exe` files; list extra suffixes here to also sign e.g. `.dll`, `.node`, or\n   * specific file names. Advanced option — most apps do not need it.\n   *\n   * Each entry is matched with `String.endsWith`, so both bare extensions (`\".dll\"`) and full file\n   * names (`\"mybinary.dll\"`) work. Prefix a pattern with `!` to *exclude* a suffix that would\n   * otherwise be signed. Positive patterns are evaluated first, then negative ones. For example,\n   * `[\"somefilename\", \".dll\", \"!.appx\"]` signs `.dll` files (and anything ending in `somefilename`)\n   * but never signs `.appx` files.\n   *\n   * @see https://github.com/electron-userland/electron-builder/issues/7329\n   * @default null\n   */\n  readonly signExts?: string[] | null\n}\n\nexport type RequestedExecutionLevel = \"asInvoker\" | \"highestAvailable\" | \"requireAdministrator\"\n\n// ─── Shared base for signtool-family signing modes ───────────────────────────\n\n/**\n * Options shared by every certificate-based signing mode (`signtool`, `hsm`, `pkcs11`). These\n * control the signature itself — publisher identity, digest algorithms, timestamping, and the\n * extra certificates added to the signature block — independently of where the private key lives.\n */\ninterface WindowsSigningSharedOptions {\n  /**\n   * The publisher name(s) to associate with the signature, written exactly as the subject appears\n   * in your code signing certificate. May be a single string or an array — an array is useful when\n   * rotating certificates, so updates signed by either the old or the new certificate still verify.\n   *\n   * This value is not a `signtool` argument; it is consumed in two places:\n   * - **Update verification** — when [verifyUpdateCodeSignature](#verifyUpdateCodeSignature) is\n   *   enabled, it is written into `app-update.yml` and electron-updater checks it against the\n   *   certificate that signed each downloaded update.\n   * - **AppX / MSIX identity** — the package `Publisher` attribute must equal the certificate\n   *   subject, so electron-builder derives it from this value (or the certificate) to keep them\n   *   in sync; a mismatch makes packaging fail with `ERROR_BAD_FORMAT`.\n   *\n   * Defaults to the Common Name (CN) extracted from your code signing certificate. Set to `null`\n   * to opt out.\n   *\n   * @see https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073\n   */\n  readonly publisherName?: string | Array<string> | null\n\n  /**\n   * The digest (hash) algorithms to sign with, applied via signtool's `/fd` flag (or\n   * osslsigncode's `-h`). One signing pass runs per entry, in order; listing more than one\n   * **dual-signs** the file, with each additional signature appended as a nested signature\n   * (signtool `/as`). Signing with both `sha1` and `sha256` lets a single binary validate on\n   * legacy (pre-SHA-2) Windows as well as modern Windows.\n   *\n   * Some targets override this: `.msi` cannot be dual-signed (a single hash is used) and AppX/MSIX\n   * is always `sha256` only.\n   *\n   * @default ['sha1', 'sha256']\n   */\n  readonly signingHashAlgorithms?: Array<\"sha1\" | \"sha256\"> | null\n\n  /**\n   * The URL of the [RFC 3161](https://www.ietf.org/rfc/rfc3161.txt) timestamp server, used for\n   * SHA-256 and nested/appended signatures (signtool's `/tr` flag). Timestamping records *when*\n   * the file was signed so the signature stays valid after the signing certificate expires.\n   * Ignored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.\n   *\n   * @default http://timestamp.digicert.com\n   */\n  readonly rfc3161TimeStampServer?: string | null\n\n  /**\n   * The URL of the legacy Authenticode timestamp server, used for SHA-1 signatures (signtool's\n   * `/t` flag). This is also the timestamp server used by `osslsigncode` (`-t`) when signing on\n   * macOS/Linux. See [rfc3161TimeStampServer](#rfc3161TimeStampServer) for SHA-256 / nested\n   * signatures. Ignored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.\n   *\n   * @default http://timestamp.digicert.com\n   */\n  readonly timeStampServer?: string | null\n\n  /**\n   * Path to an additional certificate file (typically an intermediate / cross-signing CA\n   * certificate) whose contents are added to the signature block via signtool's `/ac` flag. Use\n   * this when the signing certificate's full chain is not already present on target machines and\n   * you want it embedded in the signature so the chain can be validated.\n   */\n  readonly additionalCertificateFile?: string | null\n\n  /**\n   * A custom signing hook that **replaces** electron-builder's built-in `signtool` /\n   * `osslsigncode` invocation. Provide a function, or the path / module id of a file that exports\n   * a `sign` function (resolved relative to the project, then as a module).\n   *\n   * The hook is invoked once per signing pass (i.e. once per entry in\n   * [signingHashAlgorithms](#signingHashAlgorithms)) and receives a configuration object describing\n   * the file to sign (`path`), the resolved certificate info (`cscInfo`), the current `hash`, and\n   * whether this pass is a nested signature (`isNest`), plus a `computeSignToolArgs(isWin)` helper\n   * that returns the default arguments electron-builder would otherwise have used. Use this to\n   * integrate an external or cloud signing service. See\n   * [Code Signing](https://www.electron.build/code-signing).\n   */\n  readonly sign?: CustomWindowsSign | string | null\n}\n\n// ─── Signing mode: signtool (file or Windows certificate store) ──────────────\n\n/**\n * Sign with a certificate file (`.pfx` / `.p12`) or with a certificate from the Windows\n * certificate store, using Microsoft `signtool.exe` on Windows and `osslsigncode` on macOS/Linux.\n * This is the default mode when `win.sign` is unset. Supply the certificate one of four ways:\n * a file via `certificateFile` (or the `WIN_CSC_LINK` env var), or a store lookup via\n * `certificateSubjectName` or `certificateSha1`.\n */\nexport interface WindowsSigntoolSigningConfig extends WindowsSigningSharedOptions {\n  /** Discriminator selecting the default file/store signing mode. */\n  readonly type: \"signtool\"\n\n  /**\n   * Path to the PKCS#12 certificate file (`.pfx` or `.p12`) holding both the signing certificate\n   * and its private key. Passed to signtool via `/f` (or osslsigncode via `-pkcs12`).\n   *\n   * Prefer supplying this out-of-band via the `WIN_CSC_LINK` (or `CSC_LINK`) environment variable\n   * instead of hardcoding a path — that variable also accepts an `https://` URL or a base64-encoded\n   * certificate, which is safer and more convenient on CI. See\n   * [Code Signing](https://www.electron.build/code-signing).\n   */\n  readonly certificateFile?: string | null\n\n  /**\n   * The password protecting the private key in `certificateFile`. Passed to signtool via `/p`\n   * (or osslsigncode via `-pass`).\n   *\n   * Prefer the `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`) environment variable so the secret\n   * never lands in your build configuration.\n   */\n  readonly certificatePassword?: string | null\n\n  /**\n   * Select the signing certificate from the Windows certificate store by (a substring of) its\n   * subject name, instead of pointing at a `.pfx` file. electron-builder enumerates the installed\n   * code-signing certificates, picks the match, and signs by its thumbprint\n   * (`/sha1 <thumbprint> /s <store>`). **Required for EV (Extended Validation) certificates**,\n   * whose private keys live on a hardware token and cannot be exported to a file.\n   *\n   * Works only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).\n   */\n  readonly certificateSubjectName?: string | null\n\n  /**\n   * Select the signing certificate from the Windows certificate store by its SHA-1 thumbprint,\n   * instead of pointing at a `.pfx` file. electron-builder looks the certificate up in the store\n   * and signs with `/sha1 <thumbprint> /s <store>`. Like\n   * [certificateSubjectName](#certificateSubjectName), this suits EV certificates backed by a\n   * hardware token; if both are set, both must resolve to the same certificate.\n   *\n   * Works only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).\n   */\n  readonly certificateSha1?: string | null\n}\n\n// ─── Signing mode: hsm (Hardware Security Module via signtool /csp /kc) ──────\n\n/**\n * @beta HSM signing is available in v27 as a beta feature. The interface is stable but\n * real-hardware test coverage is limited.\n */\nexport interface WindowsHsmSigningConfig extends WindowsSigningSharedOptions {\n  /** Discriminator selecting HSM / hardware-token signing via signtool's `/csp` and `/kc` flags. */\n  readonly type: \"hsm\"\n\n  /**\n   * The name of the cryptographic service provider (CSP) that holds the private key.\n   * Maps to signtool's `/csp` flag. Examples:\n   * - Google Cloud KMS: `\"Google Cloud KMS Provider\"`\n   * - Smart card / FIPS token: `\"Microsoft Base Smart Card Crypto Provider\"`\n   *\n   * Requires a modern `winCodeSign` toolset (the default; only the legacy `\"0.0.0\"` pin is\n   * unsupported). Windows-only — use `type: \"pkcs11\"` on macOS/Linux.\n   */\n  readonly cryptoServiceProvider: string\n\n  /**\n   * The key container name within the CSP. Maps to signtool's `/kc` flag.\n   *\n   * Example for Google Cloud KMS:\n   * `\"projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME/cryptoKeyVersions/1\"`\n   */\n  readonly keyContainer: string\n\n  /**\n   * Path to the certificate file containing the public certificate chain (.crt / .cer / .pfx).\n   * The private key is NOT read from this file — it is provided by the HSM via `cryptoServiceProvider`.\n   */\n  readonly certificateFile?: string | null\n\n  /**\n   * Alternative to `certificateFile`: locate the public certificate in the Windows certificate\n   * store by its SHA-1 thumbprint. The private key still comes from the HSM via\n   * `cryptoServiceProvider` / `keyContainer`; this only identifies which public certificate to sign\n   * with.\n   */\n  readonly certificateSha1?: string | null\n\n  /**\n   * Alternative to `certificateFile`: locate the public certificate in the Windows certificate\n   * store by (a substring of) its subject name. The private key still comes from the HSM via\n   * `cryptoServiceProvider` / `keyContainer`; this only identifies which public certificate to sign\n   * with.\n   */\n  readonly certificateSubjectName?: string | null\n}\n\n// ─── Signing mode: pkcs11 (cross-platform PKCS#11 via osslsigncode) ──────────\n\n/**\n * Sign with a PKCS#11 hardware token (smart card, USB HSM, cloud KMS exposed via a PKCS#11\n * provider) using `osslsigncode`. Unlike `hsm`, this mode does **not** require Windows or a\n * Windows VM, so it can sign Windows binaries directly from macOS/Linux CI. The token PIN is read\n * from the `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`) environment variable.\n *\n * @beta PKCS#11 signing is available in v27 as a beta feature. The interface is stable but\n * real-hardware test coverage is limited.\n */\nexport interface WindowsPkcs11SigningConfig extends WindowsSigningSharedOptions {\n  /** Discriminator selecting cross-platform PKCS#11 token signing via `osslsigncode`. */\n  readonly type: \"pkcs11\"\n\n  /**\n   * Path to the PKCS#11 shared library (`.so` on Linux, `.dylib` on macOS).\n   * The library must be installed separately — electron-builder does not bundle it.\n   *\n   * Example: `\"/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so\"`\n   *\n   * Must be paired with `pkcs11KeyUri`.\n   */\n  readonly pkcs11Module: string\n\n  /**\n   * RFC 7512 PKCS#11 URI identifying the private key within the module.\n   * Maps to osslsigncode's `-key` parameter.\n   *\n   * Example: `\"pkcs11:token=MyToken;object=MyKey;type=private\"`\n   *\n   * Must be paired with `pkcs11Module`.\n   */\n  readonly pkcs11KeyUri: string\n\n  /**\n   * Optional path to a certificate chain file to accompany the PKCS#11 key.\n   * If omitted the certificate embedded in the token is used.\n   */\n  readonly certificateFile?: string | null\n}\n\n// ─── Signing mode: azure (Azure Trusted Signing) ──────────────────────────────\n\n/**\n * The `signtool /dlib` Azure Trusted Signing integration was introduced in `toolsets.winCodeSign: 1.3.0`.\n * The legacy PowerShell integration is deprecated, but leverages the same underlying Azure APIs, so both interfaces share the same config shape.\n */\nexport interface WindowsAzureSigningConfig {\n  /** Discriminator selecting Azure Trusted Signing (cloud signing — no local certificate). */\n  readonly type: \"azure\"\n\n  /**\n   * The publisher name to associate with the signature, exactly as it appears in the certificate\n   * issued by your Trusted Signing certificate profile. Required. Used for\n   * [update verification](#verifyUpdateCodeSignature) (embedded in `app-update.yml` and checked by\n   * electron-updater) and must match the certificate subject.\n   *\n   * @see https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073\n   */\n  readonly publisherName: string\n\n  /**\n   * The Trusted Signing Account endpoint. The URI value must align to the region your Trusted\n   * Signing Account and Certificate Profile were created in.\n   *\n   * Requires Azure Entra ID environment variables per\n   * [Microsoft's documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition).\n   */\n  readonly endpoint: string\n\n  /**\n   * The name of the Trusted Signing Certificate Profile to sign with, as created in your Azure\n   * Code Signing Account. Maps to the DLib metadata field `CertificateProfileName`.\n   */\n  readonly certificateProfileName: string\n\n  /**\n   * The name of the Azure Trusted Signing (Code Signing) Account that owns the certificate profile.\n   * Maps to the DLib metadata field `CodeSigningAccountName`.\n   */\n  readonly codeSigningAccountName: string\n\n  /**\n   * The digest algorithm used to hash the files being signed. Maps to the DLib metadata field\n   * `FileDigest`.\n   * @default SHA256\n   */\n  readonly fileDigest?: string\n\n  /**\n   * The RFC3161 timestamp server. Translates to field: TimestampRfc3161.\n   * @default http://timestamp.acs.microsoft.com\n   */\n  readonly timestampRfc3161?: string\n\n  /**\n   * The timestamp digest algorithm. Translates to field: TimestampDigest.\n   * @default SHA256\n   */\n  readonly timestampDigest?: string\n\n  /**\n   * Additional fields to include verbatim in the `metadata.json` file passed to\n   * `Azure.CodeSigning.Dlib.dll` via `signtool /dmdf`. Use this for DLib-specific options\n   * not covered by the typed fields above (e.g. `ExcludeCredentials`, `CorrelationId`).\n   */\n  readonly additionalMetadata?: Record<string, string>\n}\n\n// ─── Discriminated union ──────────────────────────────────────────────────────\n\nexport type WindowsSigningConfiguration = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig | WindowsAzureSigningConfig\n\n/** Signing modes that use signtool.exe or osslsigncode (not Azure). */\nexport type WindowsSigntoolFamilyConfig = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig\n\n/**\n * Resolves the active signing configuration object. `false`, `null`, and unset all mean\n * \"no explicit signing config object\" (env-based discovery still applies when unset).\n */\nexport function resolveWindowsSigningConfiguration(config: WindowsConfiguration): WindowsSigningConfiguration | null {\n  const { sign } = config\n  return sign == null || sign === false ? null : sign\n}\n\n/** Whether Windows code signing has been explicitly disabled via `sign: false | null`. */\nexport function isWindowsSigningDisabled(config: WindowsConfiguration): boolean {\n  return config.sign === false || config.sign === null\n}\n"]}
+{"version":3,"file":"winOptions.js","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"AA+ZA;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAA4B;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;IACvB,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACrD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,MAA4B;IACnE,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAA;AACtD,CAAC","sourcesContent":["import { CustomWindowsSign } from \"../codeSign/win/windowsSignToolManager.js\"\nimport { TargetConfigType } from \"../core.js\"\nimport { PlatformSpecificBuildOptions } from \"./PlatformSpecificBuildOptions.js\"\n\nexport interface WindowsConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` ([portable app](https://www.electron.build/nsis#portable) without installation), `appx`, `msix`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * AppX and MSIX packages can be built on Windows 10 or Windows Server 2012 R2 (version 6.3+) or later, and on macOS via Parallels Desktop.\n   *\n   * To use Squirrel.Windows please install `electron-builder-squirrel-windows` dependency.\n   *\n   * @default nsis\n   */\n  readonly target?: TargetConfigType\n\n  /**\n   * The path to application icon.\n   * @default build/icon.ico\n   */\n  readonly icon?: string | null\n\n  /**\n   * The trademarks and registered trademarks.\n   */\n  readonly legalTrademarks?: string | null\n\n  /**\n   * Code signing configuration. Code signing stamps every installer and executable\n   * electron-builder produces with an Authenticode signature, so that Windows (SmartScreen / UAC)\n   * and your auto-updater can verify the publisher and that the files were not tampered with.\n   *\n   * How this option behaves:\n   * - Leave **unset** to sign using credentials discovered from the environment — primarily a\n   *   certificate supplied via `WIN_CSC_LINK` (or `CSC_LINK`) with its password in\n   *   `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`). `WIN_CSC_LINK` accepts a file path, an\n   *   `https://` URL, or a base64-encoded certificate. This is the recommended setup for CI.\n   * - Set to `false` or `null` to **disable** code signing entirely (executable resources such as\n   *   the icon and metadata are still edited).\n   * - Set to an **object** to configure signing explicitly. The **required** `type` field selects the\n   *   signing backend (`signtool`, `hsm`, `pkcs11`, or `azure`) and dispatches to a dedicated sign\n   *   manager; provide exactly one of the modes below. When `win.sign` is left unset, the `signtool`\n   *   backend is used with env-discovered credentials. Each output artifact is signed individually,\n   *   and by default executables are dual-signed (see `signingHashAlgorithms`).\n   *\n   * - `{ type: \"signtool\", ... }` — Sign with a local certificate file (.pfx/.p12) or a\n   *   certificate from the Windows certificate store. Uses Microsoft `signtool.exe` on Windows and\n   *   `osslsigncode` on macOS/Linux.\n   * - `{ type: \"hsm\", ... }` — Sign using a Hardware Security Module (HSM) or FIPS-compliant\n   *   hardware token via signtool's `/csp` (cryptographic service provider) and `/kc` (key\n   *   container) flags. Requires a modern `winCodeSign` toolset (the default — only the legacy\n   *   `\"0.0.0\"` pin is unsupported). Windows-only.\n   * - `{ type: \"pkcs11\", ... }` — Sign using a PKCS#11 hardware token via osslsigncode.\n   *   Available on macOS and Linux CI without a Windows VM.\n   * - `{ type: \"azure\", ... }` — Sign via Azure Trusted Signing (cloud service). Requires\n   *   Azure Entra ID environment variables for authentication.\n   *\n   * See [Code Signing](https://www.electron.build/docs/features/code-signing).\n   */\n  readonly sign?: WindowsSigningConfiguration | false | null\n\n  /**\n   * Whether the NSIS auto-updater should verify the Authenticode signature of a downloaded update\n   * before installing it. This is a **runtime** check performed by your app via electron-updater,\n   * not a build-time check.\n   *\n   * When enabled (the default), the resolved [publisher name](#publisherName) is embedded into\n   * `app-update.yml` at build time. At update time electron-updater inspects the certificate that\n   * signed the downloaded installer and compares its subject (Distinguished Name / Common Name)\n   * against that publisher name, refusing to install on a mismatch. This prevents a tampered or\n   * maliciously substituted update from being installed.\n   *\n   * Set to `false` to skip verification — in which case the publisher name is **not** embedded.\n   * Disable this only if your updates are not Authenticode-signed.\n   *\n   * @default true\n   */\n  readonly verifyUpdateCodeSignature?: boolean\n\n  /**\n   * The [security level](https://msdn.microsoft.com/en-us/library/6ad1fshk.aspx#Anchor_9) at which the application requests to be executed.\n   * Cannot be specified per target, allowed only in the `win`.\n   * @default asInvoker\n   */\n  readonly requestedExecutionLevel?: RequestedExecutionLevel | null\n\n  /**\n   * Additional file name suffixes to code sign, beyond the default. By default electron-builder\n   * only signs `.exe` files; list extra suffixes here to also sign e.g. `.dll`, `.node`, or\n   * specific file names. Advanced option — most apps do not need it.\n   *\n   * Each entry is matched with `String.endsWith`, so both bare extensions (`\".dll\"`) and full file\n   * names (`\"mybinary.dll\"`) work. Prefix a pattern with `!` to *exclude* a suffix that would\n   * otherwise be signed. Positive patterns are evaluated first, then negative ones. For example,\n   * `[\"somefilename\", \".dll\", \"!.appx\"]` signs `.dll` files (and anything ending in `somefilename`)\n   * but never signs `.appx` files.\n   *\n   * @see https://github.com/electron-userland/electron-builder/issues/7329\n   * @default null\n   */\n  readonly signExts?: string[] | null\n}\n\nexport type RequestedExecutionLevel = \"asInvoker\" | \"highestAvailable\" | \"requireAdministrator\"\n\n// ─── Shared base for signtool-family signing modes ───────────────────────────\n\n/**\n * Options shared by every certificate-based signing mode (`signtool`, `hsm`, `pkcs11`). These\n * control the signature itself — publisher identity, digest algorithms, timestamping, and the\n * extra certificates added to the signature block — independently of where the private key lives.\n */\ninterface WindowsSigningSharedOptions {\n  /**\n   * The publisher name(s) to associate with the signature, written exactly as the subject appears\n   * in your code signing certificate. May be a single string or an array — an array is useful when\n   * rotating certificates, so updates signed by either the old or the new certificate still verify.\n   *\n   * This value is not a `signtool` argument; it is consumed in two places:\n   * - **Update verification** — when [verifyUpdateCodeSignature](#verifyUpdateCodeSignature) is\n   *   enabled, it is written into `app-update.yml` and electron-updater checks it against the\n   *   certificate that signed each downloaded update.\n   * - **AppX / MSIX identity** — the package `Publisher` attribute must equal the certificate\n   *   subject, so electron-builder derives it from this value (or the certificate) to keep them\n   *   in sync; a mismatch makes packaging fail with `ERROR_BAD_FORMAT`.\n   *\n   * Defaults to the Common Name (CN) extracted from your code signing certificate. Set to `null`\n   * to opt out.\n   *\n   * @see https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073\n   */\n  readonly publisherName?: string | Array<string> | null\n\n  /**\n   * The digest (hash) algorithms to sign with, applied via signtool's `/fd` flag (or\n   * osslsigncode's `-h`). One signing pass runs per entry, in order; listing more than one\n   * **dual-signs** the file, with each additional signature appended as a nested signature\n   * (signtool `/as`). Signing with both `sha1` and `sha256` lets a single binary validate on\n   * legacy (pre-SHA-2) Windows as well as modern Windows.\n   *\n   * Some targets override this: `.msi` cannot be dual-signed (a single hash is used) and AppX/MSIX\n   * is always `sha256` only.\n   *\n   * @default ['sha1', 'sha256']\n   */\n  readonly signingHashAlgorithms?: Array<\"sha1\" | \"sha256\"> | null\n\n  /**\n   * The URL of the [RFC 3161](https://www.ietf.org/rfc/rfc3161.txt) timestamp server, used for\n   * SHA-256 and nested/appended signatures (signtool's `/tr` flag). Timestamping records *when*\n   * the file was signed so the signature stays valid after the signing certificate expires.\n   * Ignored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.\n   *\n   * @default http://timestamp.digicert.com\n   */\n  readonly rfc3161TimeStampServer?: string | null\n\n  /**\n   * The URL of the legacy Authenticode timestamp server, used for SHA-1 signatures (signtool's\n   * `/t` flag). This is also the timestamp server used by `osslsigncode` (`-t`) when signing on\n   * macOS/Linux. See [rfc3161TimeStampServer](#rfc3161TimeStampServer) for SHA-256 / nested\n   * signatures. Ignored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.\n   *\n   * @default http://timestamp.digicert.com\n   */\n  readonly timeStampServer?: string | null\n\n  /**\n   * Path to an additional certificate file (typically an intermediate / cross-signing CA\n   * certificate) whose contents are added to the signature block via signtool's `/ac` flag. Use\n   * this when the signing certificate's full chain is not already present on target machines and\n   * you want it embedded in the signature so the chain can be validated.\n   */\n  readonly additionalCertificateFile?: string | null\n\n  /**\n   * A custom signing hook that **replaces** electron-builder's built-in `signtool` /\n   * `osslsigncode` invocation. Provide a function, or the path / module id of a file that exports\n   * a `sign` function (resolved relative to the project, then as a module).\n   *\n   * The hook is invoked once per signing pass (i.e. once per entry in\n   * [signingHashAlgorithms](#signingHashAlgorithms)) and receives a configuration object describing\n   * the file to sign (`path`), the resolved certificate info (`cscInfo`), the current `hash`, and\n   * whether this pass is a nested signature (`isNest`), plus a `computeSignToolArgs(isWin)` helper\n   * that returns the default arguments electron-builder would otherwise have used. Use this to\n   * integrate an external or cloud signing service. See\n   * [Code Signing](https://www.electron.build/docs/features/code-signing).\n   */\n  readonly sign?: CustomWindowsSign | string | null\n}\n\n// ─── Signing mode: signtool (file or Windows certificate store) ──────────────\n\n/**\n * Sign with a certificate file (`.pfx` / `.p12`) or with a certificate from the Windows\n * certificate store, using Microsoft `signtool.exe` on Windows and `osslsigncode` on macOS/Linux.\n * This is the default mode when `win.sign` is unset. Supply the certificate one of four ways:\n * a file via `certificateFile` (or the `WIN_CSC_LINK` env var), or a store lookup via\n * `certificateSubjectName` or `certificateSha1`.\n */\nexport interface WindowsSigntoolSigningConfig extends WindowsSigningSharedOptions {\n  /** Discriminator selecting the default file/store signing mode. */\n  readonly type: \"signtool\"\n\n  /**\n   * Path to the PKCS#12 certificate file (`.pfx` or `.p12`) holding both the signing certificate\n   * and its private key. Passed to signtool via `/f` (or osslsigncode via `-pkcs12`).\n   *\n   * Prefer supplying this out-of-band via the `WIN_CSC_LINK` (or `CSC_LINK`) environment variable\n   * instead of hardcoding a path — that variable also accepts an `https://` URL or a base64-encoded\n   * certificate, which is safer and more convenient on CI. See\n   * [Code Signing](https://www.electron.build/docs/features/code-signing).\n   */\n  readonly certificateFile?: string | null\n\n  /**\n   * The password protecting the private key in `certificateFile`. Passed to signtool via `/p`\n   * (or osslsigncode via `-pass`).\n   *\n   * Prefer the `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`) environment variable so the secret\n   * never lands in your build configuration.\n   */\n  readonly certificatePassword?: string | null\n\n  /**\n   * Select the signing certificate from the Windows certificate store by (a substring of) its\n   * subject name, instead of pointing at a `.pfx` file. electron-builder enumerates the installed\n   * code-signing certificates, picks the match, and signs by its thumbprint\n   * (`/sha1 <thumbprint> /s <store>`). **Required for EV (Extended Validation) certificates**,\n   * whose private keys live on a hardware token and cannot be exported to a file.\n   *\n   * Works only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).\n   */\n  readonly certificateSubjectName?: string | null\n\n  /**\n   * Select the signing certificate from the Windows certificate store by its SHA-1 thumbprint,\n   * instead of pointing at a `.pfx` file. electron-builder looks the certificate up in the store\n   * and signs with `/sha1 <thumbprint> /s <store>`. Like\n   * [certificateSubjectName](#certificateSubjectName), this suits EV certificates backed by a\n   * hardware token; if both are set, both must resolve to the same certificate.\n   *\n   * Works only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).\n   */\n  readonly certificateSha1?: string | null\n}\n\n// ─── Signing mode: hsm (Hardware Security Module via signtool /csp /kc) ──────\n\n/**\n * @beta HSM signing is available in v27 as a beta feature. The interface is stable but\n * real-hardware test coverage is limited.\n */\nexport interface WindowsHsmSigningConfig extends WindowsSigningSharedOptions {\n  /** Discriminator selecting HSM / hardware-token signing via signtool's `/csp` and `/kc` flags. */\n  readonly type: \"hsm\"\n\n  /**\n   * The name of the cryptographic service provider (CSP) that holds the private key.\n   * Maps to signtool's `/csp` flag. Examples:\n   * - Google Cloud KMS: `\"Google Cloud KMS Provider\"`\n   * - Smart card / FIPS token: `\"Microsoft Base Smart Card Crypto Provider\"`\n   *\n   * Requires a modern `winCodeSign` toolset (the default; only the legacy `\"0.0.0\"` pin is\n   * unsupported). Windows-only — use `type: \"pkcs11\"` on macOS/Linux.\n   */\n  readonly cryptoServiceProvider: string\n\n  /**\n   * The key container name within the CSP. Maps to signtool's `/kc` flag.\n   *\n   * Example for Google Cloud KMS:\n   * `\"projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME/cryptoKeyVersions/1\"`\n   */\n  readonly keyContainer: string\n\n  /**\n   * Path to the certificate file containing the public certificate chain (.crt / .cer / .pfx).\n   * The private key is NOT read from this file — it is provided by the HSM via `cryptoServiceProvider`.\n   */\n  readonly certificateFile?: string | null\n\n  /**\n   * Alternative to `certificateFile`: locate the public certificate in the Windows certificate\n   * store by its SHA-1 thumbprint. The private key still comes from the HSM via\n   * `cryptoServiceProvider` / `keyContainer`; this only identifies which public certificate to sign\n   * with.\n   */\n  readonly certificateSha1?: string | null\n\n  /**\n   * Alternative to `certificateFile`: locate the public certificate in the Windows certificate\n   * store by (a substring of) its subject name. The private key still comes from the HSM via\n   * `cryptoServiceProvider` / `keyContainer`; this only identifies which public certificate to sign\n   * with.\n   */\n  readonly certificateSubjectName?: string | null\n}\n\n// ─── Signing mode: pkcs11 (cross-platform PKCS#11 via osslsigncode) ──────────\n\n/**\n * Sign with a PKCS#11 hardware token (smart card, USB HSM, cloud KMS exposed via a PKCS#11\n * provider) using `osslsigncode`. Unlike `hsm`, this mode does **not** require Windows or a\n * Windows VM, so it can sign Windows binaries directly from macOS/Linux CI. The token PIN is read\n * from the `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`) environment variable.\n *\n * @beta PKCS#11 signing is available in v27 as a beta feature. The interface is stable but\n * real-hardware test coverage is limited.\n */\nexport interface WindowsPkcs11SigningConfig extends WindowsSigningSharedOptions {\n  /** Discriminator selecting cross-platform PKCS#11 token signing via `osslsigncode`. */\n  readonly type: \"pkcs11\"\n\n  /**\n   * Path to the PKCS#11 shared library (`.so` on Linux, `.dylib` on macOS).\n   * The library must be installed separately — electron-builder does not bundle it.\n   *\n   * Example: `\"/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so\"`\n   *\n   * Must be paired with `pkcs11KeyUri`.\n   */\n  readonly pkcs11Module: string\n\n  /**\n   * RFC 7512 PKCS#11 URI identifying the private key within the module.\n   * Maps to osslsigncode's `-key` parameter.\n   *\n   * Example: `\"pkcs11:token=MyToken;object=MyKey;type=private\"`\n   *\n   * Must be paired with `pkcs11Module`.\n   */\n  readonly pkcs11KeyUri: string\n\n  /**\n   * Optional path to a certificate chain file to accompany the PKCS#11 key.\n   * If omitted the certificate embedded in the token is used.\n   */\n  readonly certificateFile?: string | null\n}\n\n// ─── Signing mode: azure (Azure Trusted Signing) ──────────────────────────────\n\n/**\n * The `signtool /dlib` Azure Trusted Signing integration was introduced in `toolsets.winCodeSign: 1.3.0`.\n * The legacy PowerShell integration is deprecated, but leverages the same underlying Azure APIs, so both interfaces share the same config shape.\n */\nexport interface WindowsAzureSigningConfig {\n  /** Discriminator selecting Azure Trusted Signing (cloud signing — no local certificate). */\n  readonly type: \"azure\"\n\n  /**\n   * The publisher name to associate with the signature, exactly as it appears in the certificate\n   * issued by your Trusted Signing certificate profile. Required. Used for\n   * [update verification](#verifyUpdateCodeSignature) (embedded in `app-update.yml` and checked by\n   * electron-updater) and must match the certificate subject.\n   *\n   * @see https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073\n   */\n  readonly publisherName: string\n\n  /**\n   * The Trusted Signing Account endpoint. The URI value must align to the region your Trusted\n   * Signing Account and Certificate Profile were created in.\n   *\n   * Requires Azure Entra ID environment variables per\n   * [Microsoft's documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition).\n   */\n  readonly endpoint: string\n\n  /**\n   * The name of the Trusted Signing Certificate Profile to sign with, as created in your Azure\n   * Code Signing Account. Maps to the DLib metadata field `CertificateProfileName`.\n   */\n  readonly certificateProfileName: string\n\n  /**\n   * The name of the Azure Trusted Signing (Code Signing) Account that owns the certificate profile.\n   * Maps to the DLib metadata field `CodeSigningAccountName`.\n   */\n  readonly codeSigningAccountName: string\n\n  /**\n   * The digest algorithm used to hash the files being signed. Maps to the DLib metadata field\n   * `FileDigest`.\n   * @default SHA256\n   */\n  readonly fileDigest?: string\n\n  /**\n   * The RFC3161 timestamp server. Translates to field: TimestampRfc3161.\n   * @default http://timestamp.acs.microsoft.com\n   */\n  readonly timestampRfc3161?: string\n\n  /**\n   * The timestamp digest algorithm. Translates to field: TimestampDigest.\n   * @default SHA256\n   */\n  readonly timestampDigest?: string\n\n  /**\n   * Additional fields to include verbatim in the `metadata.json` file passed to\n   * `Azure.CodeSigning.Dlib.dll` via `signtool /dmdf`. Use this for DLib-specific options\n   * not covered by the typed fields above (e.g. `ExcludeCredentials`, `CorrelationId`).\n   */\n  readonly additionalMetadata?: Record<string, string>\n}\n\n// ─── Discriminated union ──────────────────────────────────────────────────────\n\nexport type WindowsSigningConfiguration = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig | WindowsAzureSigningConfig\n\n/** Signing modes that use signtool.exe or osslsigncode (not Azure). */\nexport type WindowsSigntoolFamilyConfig = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig\n\n/**\n * Resolves the active signing configuration object. `false`, `null`, and unset all mean\n * \"no explicit signing config object\" (env-based discovery still applies when unset).\n */\nexport function resolveWindowsSigningConfiguration(config: WindowsConfiguration): WindowsSigningConfiguration | null {\n  const { sign } = config\n  return sign == null || sign === false ? null : sign\n}\n\n/** Whether Windows code signing has been explicitly disabled via `sign: false | null`. */\nexport function isWindowsSigningDisabled(config: WindowsConfiguration): boolean {\n  return config.sign === false || config.sign === null\n}\n"]}

package/dist/packager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packager.d.ts","sourceRoot":"","sources":["../src/packager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGJ,WAAW,EAUX,MAAM,EACP,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,iBAAiB,EAAqB,MAAM,sBAAsB,CAAA;AAM3E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAClH,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAGlE,OAAO,EAAE,SAAS,EAAmB,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AASxD,OAAO,EAAqB,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAE5E,OAAO,EAA8B,EAAE,EAAE,MAAM,kCAAkC,CAAA;AAMjF,KAAK,cAAc,GAAG;IACpB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAA;IAEtD,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;IACzC,YAAY,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;IAC7C,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IACvC,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IAEvC,sBAAsB,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAEnD,iBAAiB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACrC,mBAAmB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAGvC,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;CAC7C,CAAA;AAED,qBAAa,QAAQ;IAyHjB,QAAQ,CAAC,iBAAiB;IAxH5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,OAAO,CAAC,OAAO,CAAQ;IACvB,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA8D;IACxF,iBAAiB,IAAI,OAAO,CAAC,EAAE,CAAC;IAGhC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIzC,6EAA6E;IAC7E,OAAO,CAAC,SAAS,CAAwB;IACzC,IAAI,QAAQ,IAAI,QAAQ,CAEvB;IAED,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAAwB;IACjD,IAAI,gBAAgB,IAAI,QAAQ,CAE/B;IAED,0CAA0C;IAC1C,IAAI,eAAe,WAElB;IAED,OAAO,CAAC,6BAA6B,CAAQ;IAE7C,IAAI,+BAA+B,IAAI,OAAO,CAE7C;IAED,OAAO,CAAC,mBAAmB,CAAQ;IAEnC,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED,OAAO,CAAC,YAAY,CAAwB;IAC5C,IAAI,WAAW,IAAI,QAAQ,GAAG,IAAI,CAEjC;IAED,OAAO,CAAC,cAAc,CAA6B;IAEnD,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,iCAAiC,UAAQ;IAEzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0C;IAEvE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAO;IAC/B,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,QAAQ,CAAC,cAAc,SAAyB;IAKhD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiC;IAEpE,oBAAoB,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIrD,OAAO,CAAC,eAAe,CAAmH;IAE1I,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IAEjC,QAAQ,CAAC,WAAW,cAAsC;IAE1D,IAAI,cAAc,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEzD;IAED,OAAO,CAAC,2BAA2B,CAAwB;IAE3D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAE9F;IAED,OAAO,CAAC,kBAAkB,CAAsB;IAEhD,IAAI,iBAAiB,IAAI,MAAM,CAO9B;IAED,IAAI,6BAA6B,IAAI,MAAM,CAE1C;IAED,OAAO,CAAC,UAAU,CAAyB;IAC3C,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D,oBAAoB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;gBAMhD,OAAO,EAAE,eAAe,EACf,iBAAiB,oBAA0B;YA0CxC,wBAAwB;IAetC,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,WAAW,CAAC,GAAG,QAAQ;IAK3D,iBAAiB,CAAC,OAAO,EAAE,cAAc,CAAC,iBAAiB,CAAC,GAAG,QAAQ;IAKvE,4BAA4B,CAAC,KAAK,EAAE,MAAM,cAAc,EAAE,IAAI,EAAE,WAAW,GAAG,SAAS;;;;IAIvF,2BAA2B;IAIrB,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,EAAE,SAAS,CAAC,EAAE,GAAG;IAY3E;;OAEG;IACG,mBAAmB,CAAC,KAAK,EAAE,eAAe;IAI1C,0BAA0B,CAAC,KAAK,EAAE,eAAe;IAKjD,uBAAuB,CAAC,IAAI,EAAE,MAAM;IAIpC,qBAAqB,CAAC,IAAI,EAAE,MAAM;IAIlC,cAAc,CAAC,OAAO,EAAE,iBAAiB;IAIzC,aAAa,CAAC,OAAO,EAAE,gBAAgB;IAIvC,aAAa,CAAC,OAAO,EAAE,gBAAgB;IAIvC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB;IAI1C,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD/B,KAAK,CAAC,cAAc,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;YA2E1D,mDAAmD;YAenD,OAAO;YAyGP,YAAY;IAwBb,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;CAgDlF;AA+BD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;CACtC"}
+{"version":3,"file":"packager.d.ts","sourceRoot":"","sources":["../src/packager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGJ,WAAW,EAUX,MAAM,EACP,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,iBAAiB,EAAqB,MAAM,sBAAsB,CAAA;AAM3E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAClH,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAGlE,OAAO,EAAE,SAAS,EAAmB,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AASxD,OAAO,EAAqB,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAE5E,OAAO,EAA8B,EAAE,EAAE,MAAM,kCAAkC,CAAA;AAMjF,KAAK,cAAc,GAAG;IACpB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAA;IAEtD,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;IACzC,YAAY,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;IAC7C,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IACvC,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IAEvC,sBAAsB,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAEnD,iBAAiB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACrC,mBAAmB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAGvC,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;CAC7C,CAAA;AAED,qBAAa,QAAQ;IAyHjB,QAAQ,CAAC,iBAAiB;IAxH5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,OAAO,CAAC,OAAO,CAAQ;IACvB,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA8D;IACxF,iBAAiB,IAAI,OAAO,CAAC,EAAE,CAAC;IAGhC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIzC,6EAA6E;IAC7E,OAAO,CAAC,SAAS,CAAwB;IACzC,IAAI,QAAQ,IAAI,QAAQ,CAEvB;IAED,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAAwB;IACjD,IAAI,gBAAgB,IAAI,QAAQ,CAE/B;IAED,0CAA0C;IAC1C,IAAI,eAAe,WAElB;IAED,OAAO,CAAC,6BAA6B,CAAQ;IAE7C,IAAI,+BAA+B,IAAI,OAAO,CAE7C;IAED,OAAO,CAAC,mBAAmB,CAAQ;IAEnC,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED,OAAO,CAAC,YAAY,CAAwB;IAC5C,IAAI,WAAW,IAAI,QAAQ,GAAG,IAAI,CAEjC;IAED,OAAO,CAAC,cAAc,CAA6B;IAEnD,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,iCAAiC,UAAQ;IAEzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0C;IAEvE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAO;IAC/B,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,QAAQ,CAAC,cAAc,SAAyB;IAKhD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiC;IAEpE,oBAAoB,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIrD,OAAO,CAAC,eAAe,CAAmH;IAE1I,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IAEjC,QAAQ,CAAC,WAAW,cAAsC;IAE1D,IAAI,cAAc,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEzD;IAED,OAAO,CAAC,2BAA2B,CAAwB;IAE3D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAE9F;IAED,OAAO,CAAC,kBAAkB,CAAsB;IAEhD,IAAI,iBAAiB,IAAI,MAAM,CAO9B;IAED,IAAI,6BAA6B,IAAI,MAAM,CAE1C;IAED,OAAO,CAAC,UAAU,CAAyB;IAC3C,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D,oBAAoB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;gBAMhD,OAAO,EAAE,eAAe,EACf,iBAAiB,oBAA0B;YA0CxC,wBAAwB;IAetC,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,WAAW,CAAC,GAAG,QAAQ;IAK3D,iBAAiB,CAAC,OAAO,EAAE,cAAc,CAAC,iBAAiB,CAAC,GAAG,QAAQ;IAKvE,4BAA4B,CAAC,KAAK,EAAE,MAAM,cAAc,EAAE,IAAI,EAAE,WAAW,GAAG,SAAS;;;;IAIvF,2BAA2B;IAIrB,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,EAAE,SAAS,CAAC,EAAE,GAAG;IAY3E;;OAEG;IACG,mBAAmB,CAAC,KAAK,EAAE,eAAe;IAI1C,0BAA0B,CAAC,KAAK,EAAE,eAAe;IAKjD,uBAAuB,CAAC,IAAI,EAAE,MAAM;IAIpC,qBAAqB,CAAC,IAAI,EAAE,MAAM;IAIlC,cAAc,CAAC,OAAO,EAAE,iBAAiB;IAIzC,aAAa,CAAC,OAAO,EAAE,gBAAgB;IAIvC,aAAa,CAAC,OAAO,EAAE,gBAAgB;IAIvC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB;IAI1C,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD/B,KAAK,CAAC,cAAc,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;YA2E1D,mDAAmD;YAenD,OAAO;YA2GP,YAAY;IAwBb,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;CAgDlF;AA+BD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;CACtC"}

package/dist/packager.js

@@ -23,7 +23,7 @@ import asyncPool from "tiny-async-pool";
 import { determinePackageManagerEnv } from "./node-module-collector/index.js";
 import _fsExtra from "fs-extra";
 const { chmod, mkdirs, outputFile } = _fsExtra;
-import { setSevenZipPath } from "./toolsets/7zip.js";
+import { setSevenZipPath, setSevenZipVersion } from "./toolsets/7zip.js";
 import { getCustomToolsetPath } from "./toolsets/custom.js";
 export class Packager {
     get appDir() {
@@ -239,7 +239,7 @@ export class Packager {
         if (this.isTwoPackageJsonProjectLayoutUsed) {
             log.debug({ devPackageFile, appPackageFile }, "two package.json structure is used");
         }
-        checkMetadata(this.metadata, this.devMetadata, appPackageFile, devPackageFile);
+        checkMetadata(this.metadata, this.devMetadata, appPackageFile, devPackageFile, projectDir);
         await validateConfiguration(configuration, this.debugLogger);
         this._configuration = configuration;
         this._devMetadata = devMetadata;
@@ -326,6 +326,9 @@ export class Packager {
             }
             setSevenZipPath(bin);
         }
+        else {
+            setSevenZipVersion(sevenZipConfig);
+        }
         const taskManager = new AsyncTaskManager(this.cancellationToken);
         const syncTargetsIfAny = [];
         const platformToTarget = new Map();
@@ -335,7 +338,7 @@ export class Packager {
                 break;
             }
             if (platform === Platform.MAC && process.platform === Platform.WINDOWS.nodeName) {
-                throw new InvalidConfigurationError("Build for macOS is supported only on macOS, please see https://electron.build/multi-platform-build");
+                throw new InvalidConfigurationError("Build for macOS is supported only on macOS, please see https://electron.build/docs/features/multi-platform-build");
             }
             const packager = await this.createHelper(platform);
             const nameToTarget = new Map();