create-zenbu-app 0.0.30 → 0.0.32

package/dist/desktop-CtHHGkP3.mjs

@@ -0,0 +1,847 @@
+import { createRequire } from "node:module";
+import path from "node:path";
+import os from "node:os";
+import fs from "node:fs";
+import { spawnSync } from "node:child_process";
+import fsp from "node:fs/promises";
+import https from "node:https";
+import crypto from "node:crypto";
+//#region src/desktop/electron-cache.ts
+/**
+* Layout under `~/.zenbu/electron/`:
+*
+*   versions/<major>/<exact-version>/Electron.app
+*   versions/<major>/.current        -> "<exact-version>" (text marker)
+*   .locks/<major>.lock              -> flock target during download
+*   .downloads/<exact>.zip           -> intermediate, deleted on success
+*/
+const ROOT = path.join(os.homedir(), ".zenbu", "electron");
+async function ensureElectronApp(opts) {
+	const { log } = opts;
+	const exact = await resolveExactVersion(opts.versionRange, log);
+	const major = parseInt(exact.split(".")[0], 10);
+	if (!Number.isFinite(major)) throw new Error(`failed to parse major from electron version "${exact}"`);
+	const versionDir = path.join(ROOT, "versions", String(major), exact);
+	const electronAppPath = path.join(versionDir, "Electron.app");
+	if (fs.existsSync(path.join(electronAppPath, "Contents", "MacOS"))) {
+		log.info(`cache hit: ${electronAppPath}`);
+		return {
+			electronAppPath,
+			version: exact,
+			major
+		};
+	}
+	await fsp.mkdir(path.join(ROOT, ".locks"), { recursive: true });
+	await fsp.mkdir(path.join(ROOT, ".downloads"), { recursive: true });
+	await withLock(path.join(ROOT, ".locks", `${major}-${exact}.lock`), async () => {
+		if (fs.existsSync(path.join(electronAppPath, "Contents", "MacOS"))) {
+			log.info(`cache hit (post-lock): ${electronAppPath}`);
+			return;
+		}
+		await downloadAndExtract({
+			version: exact,
+			versionDir,
+			log,
+			downloadBase: opts.downloadBase
+		});
+	});
+	if (!fs.existsSync(path.join(electronAppPath, "Contents", "MacOS"))) throw new Error(`electron cache install failed: ${electronAppPath} missing after extract`);
+	return {
+		electronAppPath,
+		version: exact,
+		major
+	};
+}
+async function downloadAndExtract(opts) {
+	const arch = process.arch === "arm64" ? "arm64" : "x64";
+	const filename = `electron-v${opts.version}-darwin-${arch}.zip`;
+	const url = (opts.downloadBase ?? "https://github.com/electron/electron/releases/download") + `/v${opts.version}/${filename}`;
+	const zipPath = path.join(ROOT, ".downloads", filename);
+	opts.log.info(`downloading ${url}`);
+	await downloadFile(url, zipPath, opts.log);
+	await fsp.mkdir(opts.versionDir, { recursive: true });
+	opts.log.info(`extracting -> ${opts.versionDir}`);
+	const r = spawnSync("ditto", [
+		"-x",
+		"-k",
+		zipPath,
+		opts.versionDir
+	], {
+		stdio: "pipe",
+		encoding: "utf8"
+	});
+	if (r.status !== 0) throw new Error(`ditto failed (${r.status}): ${r.stderr?.slice(0, 1e3) ?? ""}`);
+	await fsp.unlink(zipPath).catch(() => {});
+}
+async function downloadFile(url, dest, log, redirectsLeft = 5) {
+	const tmp = `${dest}.part`;
+	if (await new Promise((resolve, reject) => {
+		https.get(url, (res) => {
+			const code = res.statusCode ?? 0;
+			if (code >= 300 && code < 400 && res.headers.location) {
+				res.resume();
+				if (redirectsLeft <= 0) {
+					reject(/* @__PURE__ */ new Error(`download ${url}: too many redirects`));
+					return;
+				}
+				downloadFile(res.headers.location, dest, log, redirectsLeft - 1).then(() => resolve(false), reject);
+				return;
+			}
+			if (code !== 200) {
+				res.resume();
+				reject(/* @__PURE__ */ new Error(`download ${url} -> HTTP ${code}`));
+				return;
+			}
+			const total = parseInt(res.headers["content-length"] ?? "0", 10);
+			let received = 0;
+			let lastPct = -1;
+			const file = fs.createWriteStream(tmp);
+			res.on("data", (chunk) => {
+				received += chunk.length;
+				if (total > 0) {
+					const pct = Math.floor(received / total * 100);
+					if (pct !== lastPct && pct % 10 === 0) {
+						log.info(`  ${pct}% (${received}/${total})`);
+						lastPct = pct;
+					}
+				}
+			});
+			res.pipe(file);
+			file.on("finish", () => {
+				file.close((err) => err ? reject(err) : resolve(true));
+			});
+			file.on("error", reject);
+		}).on("error", reject);
+	})) await fsp.rename(tmp, dest);
+}
+async function withLock(lockFile, fn) {
+	const deadline = Date.now() + 5 * 6e4;
+	while (Date.now() < deadline) try {
+		const fd = fs.openSync(lockFile, "wx");
+		try {
+			return await fn();
+		} finally {
+			fs.closeSync(fd);
+			try {
+				fs.unlinkSync(lockFile);
+			} catch {}
+		}
+	} catch (err) {
+		if (err.code !== "EEXIST") throw err;
+		try {
+			const stat = fs.statSync(lockFile);
+			if (Date.now() - stat.mtimeMs > 10 * 6e4) {
+				fs.unlinkSync(lockFile);
+				continue;
+			}
+		} catch {}
+		await sleep(500);
+	}
+	throw new Error(`timed out waiting for ${lockFile}`);
+}
+function sleep(ms) {
+	return new Promise((r) => setTimeout(r, ms));
+}
+let registryCache = null;
+async function fetchRegistry() {
+	if (registryCache) return registryCache;
+	registryCache = new Promise((resolve, reject) => {
+		https.get("https://registry.npmjs.org/electron", { headers: { accept: "application/vnd.npm.install-v1+json" } }, (res) => {
+			if (res.statusCode !== 200) {
+				reject(/* @__PURE__ */ new Error(`registry HTTP ${res.statusCode}`));
+				return;
+			}
+			let body = "";
+			res.setEncoding("utf8");
+			res.on("data", (c) => body += c);
+			res.on("end", () => {
+				try {
+					resolve(JSON.parse(body));
+				} catch (err) {
+					reject(err);
+				}
+			});
+			res.on("error", reject);
+		}).on("error", reject);
+	});
+	return registryCache;
+}
+/**
+* Accepts an exact version, a caret range, or a bare major. Returns the
+* latest published electron version that satisfies it. Pure HTTP — no npm
+* CLI invocation.
+*/
+async function resolveExactVersion(range, log) {
+	const trimmed = range.trim();
+	if (/^\d+\.\d+\.\d+(?:-[\w.]+)?$/.test(trimmed)) return trimmed;
+	log.info(`resolving electron ${trimmed} from registry`);
+	const doc = await fetchRegistry();
+	const all = Object.keys(doc.versions ?? {});
+	if (/^\d+$/.test(trimmed)) return pickLatestStableMajor(all, parseInt(trimmed, 10), trimmed);
+	const caret = trimmed.match(/^\^(\d+)(?:\.(\d+))?(?:\.(\d+))?$/);
+	if (caret) return pickLatestStableMajor(all, parseInt(caret[1], 10), trimmed);
+	const tilde = trimmed.match(/^~(\d+)\.(\d+)(?:\.(\d+))?$/);
+	if (tilde) {
+		const major = parseInt(tilde[1], 10);
+		const minor = parseInt(tilde[2], 10);
+		return pickHighest(all.filter((v) => {
+			const m = v.match(/^(\d+)\.(\d+)\.(\d+)(?:-|$)/);
+			if (!m) return false;
+			return parseInt(m[1], 10) === major && parseInt(m[2], 10) === minor;
+		}), trimmed);
+	}
+	if (trimmed === "latest") {
+		const latest = doc["dist-tags"]?.latest;
+		if (!latest) throw new Error("registry has no `latest` dist-tag");
+		return latest;
+	}
+	throw new Error(`unsupported electron version spec: "${trimmed}". Use an exact version, "^MAJOR", "~MAJOR.MINOR", a bare major, or "latest".`);
+}
+function pickLatestStableMajor(all, major, raw) {
+	return pickHighest(all.filter((v) => {
+		const m = v.match(/^(\d+)\.\d+\.\d+$/);
+		return m !== null && parseInt(m[1], 10) === major;
+	}), raw);
+}
+function pickHighest(versions, raw) {
+	if (versions.length === 0) throw new Error(`no electron version matched "${raw}"`);
+	const sorted = versions.sort(compareSemver);
+	return sorted[sorted.length - 1];
+}
+function compareSemver(a, b) {
+	const pa = a.split(".").map((n) => parseInt(n, 10));
+	const pb = b.split(".").map((n) => parseInt(n, 10));
+	for (let i = 0; i < 3; i++) {
+		const da = pa[i] ?? 0;
+		const db = pb[i] ?? 0;
+		if (da !== db) return da - db;
+	}
+	return 0;
+}
+//#endregion
+//#region src/desktop/icon.ts
+const ICONSET_SIZES = [
+	{
+		name: "icon_16x16.png",
+		px: 16
+	},
+	{
+		name: "icon_16x16@2x.png",
+		px: 32
+	},
+	{
+		name: "icon_32x32.png",
+		px: 32
+	},
+	{
+		name: "icon_32x32@2x.png",
+		px: 64
+	},
+	{
+		name: "icon_128x128.png",
+		px: 128
+	},
+	{
+		name: "icon_128x128@2x.png",
+		px: 256
+	},
+	{
+		name: "icon_256x256.png",
+		px: 256
+	},
+	{
+		name: "icon_256x256@2x.png",
+		px: 512
+	},
+	{
+		name: "icon_512x512.png",
+		px: 512
+	},
+	{
+		name: "icon_512x512@2x.png",
+		px: 1024
+	}
+];
+async function prepareIcon(opts) {
+	const { source, dest, log } = opts;
+	if (!fs.existsSync(source)) throw new Error(`icon source does not exist: ${source}`);
+	await fsp.mkdir(path.dirname(dest), { recursive: true });
+	const ext = path.extname(source).toLowerCase();
+	if (ext === ".icns") {
+		log.info(`copying icns ${source} -> ${dest}`);
+		await fsp.copyFile(source, dest);
+		return;
+	}
+	if (ext !== ".png") throw new Error(`unsupported icon format "${ext}". Use .png (square, ideally 1024x1024) or .icns.`);
+	log.info(`converting png -> icns (${source})`);
+	const tmp = await fsp.mkdtemp(path.join(os.tmpdir(), "czda-iconset-"));
+	const iconset = path.join(tmp, "icon.iconset");
+	await fsp.mkdir(iconset, { recursive: true });
+	for (const { name, px } of ICONSET_SIZES) {
+		const out = path.join(iconset, name);
+		const r = spawnSync("sips", [
+			"-z",
+			String(px),
+			String(px),
+			source,
+			"--out",
+			out
+		], {
+			stdio: "pipe",
+			encoding: "utf8"
+		});
+		if (r.status !== 0) throw new Error(`sips failed for ${name} (${r.status}): ${r.stderr?.slice(0, 500) ?? ""}`);
+	}
+	const r = spawnSync("iconutil", [
+		"-c",
+		"icns",
+		iconset,
+		"-o",
+		dest
+	], {
+		stdio: "pipe",
+		encoding: "utf8"
+	});
+	if (r.status !== 0) throw new Error(`iconutil failed (${r.status}): ${r.stderr?.slice(0, 500) ?? ""}`);
+	await fsp.rm(tmp, {
+		recursive: true,
+		force: true
+	});
+}
+//#endregion
+//#region src/desktop/bundle.ts
+const ENTITLEMENTS = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+  <key>com.apple.security.cs.disable-library-validation</key>
+  <true/>
+</dict>
+</plist>
+`;
+async function synthesizeBundle(opts) {
+	const { cachedElectronApp, destApp, displayName, slug, version, bundleId = `dev.zenbu.${slug}`, iconSource, packageManager, appsDir, launcherSource, log, dryRun = false, force = false } = opts;
+	if (!fs.existsSync(cachedElectronApp)) throw new Error(`cached Electron.app missing: ${cachedElectronApp}. Did the cache step fail?`);
+	if (fs.existsSync(destApp)) {
+		if (!force) throw new Error(`${destApp} already exists. Re-run with --force to overwrite.`);
+		if (dryRun) log.info(`[dry-run] would rm -rf ${destApp}`);
+		else {
+			log.info(`removing existing ${destApp}`);
+			await fsp.rm(destApp, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	await ensureParentDir(destApp, dryRun, log);
+	await log.withStep(`clone-copy ${cachedElectronApp} -> ${destApp}`, async () => {
+		if (dryRun) return;
+		cloneCopy(cachedElectronApp, destApp, log);
+	});
+	const macosDir = path.join(destApp, "Contents", "MacOS");
+	const oldExe = path.join(macosDir, "Electron");
+	const newExe = path.join(macosDir, displayName);
+	await log.withStep(`rename executable -> ${displayName}`, async () => {
+		if (dryRun) return;
+		if (fs.existsSync(oldExe)) await fsp.rename(oldExe, newExe);
+		else if (!fs.existsSync(newExe)) throw new Error(`expected ${oldExe} or ${newExe} to exist after clone-copy`);
+	});
+	const infoPlist = path.join(destApp, "Contents", "Info.plist");
+	await log.withStep(`patch Info.plist`, async () => {
+		if (dryRun) return;
+		const ops = [
+			{
+				key: "CFBundleName",
+				type: "string",
+				value: displayName
+			},
+			{
+				key: "CFBundleDisplayName",
+				type: "string",
+				value: displayName
+			},
+			{
+				key: "CFBundleExecutable",
+				type: "string",
+				value: displayName
+			},
+			{
+				key: "CFBundleIdentifier",
+				type: "string",
+				value: bundleId
+			},
+			{
+				key: "CFBundleIconFile",
+				type: "string",
+				value: "icon.icns"
+			},
+			{
+				key: "CFBundleVersion",
+				type: "string",
+				value: version
+			},
+			{
+				key: "CFBundleShortVersionString",
+				type: "string",
+				value: version
+			},
+			{
+				key: "NSHighResolutionCapable",
+				type: "bool",
+				value: true
+			},
+			{
+				key: "LSMinimumSystemVersion",
+				type: "string",
+				value: "12.0"
+			},
+			{
+				key: "NSSupportsAutomaticGraphicsSwitching",
+				type: "bool",
+				value: true
+			},
+			{
+				key: "NSRequiresAquaSystemAppearance",
+				type: "bool",
+				value: false
+			},
+			{
+				key: "NSPrincipalClass",
+				type: "string",
+				value: "AtomApplication"
+			}
+		];
+		for (const op of ops) plutilReplace(infoPlist, op, log);
+		plutilRemove(infoPlist, ":ElectronAsarIntegrity", log);
+	});
+	const resourcesDir = path.join(destApp, "Contents", "Resources");
+	const iconDest = path.join(resourcesDir, "icon.icns");
+	await log.withStep(`install icon -> ${iconDest}`, async () => {
+		if (dryRun) return;
+		if (iconSource) await prepareIcon({
+			source: iconSource,
+			dest: iconDest,
+			log
+		});
+		else {
+			const fallback = path.join(resourcesDir, "electron.icns");
+			if (fs.existsSync(fallback)) await fsp.copyFile(fallback, iconDest);
+			else log.info(`no icon source and no electron.icns fallback; skipping`);
+		}
+	});
+	const bundleAppDir = path.join(resourcesDir, "app");
+	await log.withStep(`write Resources/app/{package.json,launcher.mjs,app-config.json,host.json}`, async () => {
+		if (dryRun) return;
+		await fsp.mkdir(bundleAppDir, { recursive: true });
+		const bundlePkg = {
+			name: slug,
+			version,
+			main: "launcher.mjs",
+			type: "module"
+		};
+		await fsp.writeFile(path.join(bundleAppDir, "package.json"), JSON.stringify(bundlePkg, null, 2) + "\n");
+		if (!fs.existsSync(launcherSource)) throw new Error(`launcher source missing: ${launcherSource}`);
+		await fsp.copyFile(launcherSource, path.join(bundleAppDir, "launcher.mjs"));
+		const appConfig = {
+			name: slug,
+			packageManager,
+			version,
+			local: true
+		};
+		await fsp.writeFile(path.join(bundleAppDir, "app-config.json"), JSON.stringify(appConfig, null, 2) + "\n");
+		await fsp.writeFile(path.join(bundleAppDir, "host.json"), JSON.stringify({ version }, null, 2) + "\n");
+		log.info(`appsDir baked into name = ${slug} (resolves to ${appsDir})`);
+	});
+	await adhocCodesign({
+		destApp,
+		log,
+		dryRun
+	});
+	await stripQuarantine({
+		destApp,
+		log,
+		dryRun
+	});
+	await log.withStep(`verify (codesign + plutil)`, async () => {
+		if (dryRun) return;
+		const cs = spawnSync("codesign", [
+			"--verify",
+			"--deep",
+			"--strict",
+			destApp
+		], {
+			stdio: "pipe",
+			encoding: "utf8"
+		});
+		if (cs.status !== 0) throw new Error(`codesign verify failed (${cs.status}): ${cs.stderr?.slice(0, 1e3) ?? ""}`);
+		const pl = spawnSync("plutil", ["-lint", infoPlist], {
+			stdio: "pipe",
+			encoding: "utf8"
+		});
+		if (pl.status !== 0) throw new Error(`plutil -lint failed (${pl.status}): ${pl.stderr?.slice(0, 500) ?? ""} ${pl.stdout?.slice(0, 500) ?? ""}`);
+	});
+}
+/**
+* Ad-hoc deep-sign a bundle with the same entitlements used at synthesize
+* time. Reusable so post-synthesize mutations (e.g. icon swap) can re-sign
+* without rebuilding the whole bundle.
+*/
+async function adhocCodesign(opts) {
+	const { destApp, log, dryRun = false } = opts;
+	const entitlementsPath = path.join(os.tmpdir(), `czda-entitlements-${process.pid}-${Date.now()}.plist`);
+	await log.withStep(`ad-hoc codesign --deep`, async () => {
+		if (dryRun) return;
+		await fsp.writeFile(entitlementsPath, ENTITLEMENTS);
+		try {
+			const r = spawnSync("codesign", [
+				"--force",
+				"--deep",
+				"--sign",
+				"-",
+				"--entitlements",
+				entitlementsPath,
+				destApp
+			], {
+				stdio: "pipe",
+				encoding: "utf8"
+			});
+			if (r.status !== 0) throw new Error(`codesign failed (${r.status}): ${r.stderr?.slice(0, 1e3) ?? ""}`);
+			log.info(r.stderr?.trim() || "codesign ok");
+		} finally {
+			await fsp.unlink(entitlementsPath).catch(() => {});
+		}
+	});
+}
+async function stripQuarantine(opts) {
+	const { destApp, log, dryRun = false } = opts;
+	await log.withStep(`xattr -dr com.apple.quarantine`, async () => {
+		if (dryRun) return;
+		spawnSync("xattr", [
+			"-dr",
+			"com.apple.quarantine",
+			destApp
+		], { stdio: "ignore" });
+	});
+}
+function cloneCopy(src, dest, log) {
+	const r = spawnSync("cp", [
+		"-c",
+		"-R",
+		src,
+		dest
+	], {
+		stdio: "pipe",
+		encoding: "utf8"
+	});
+	if (r.status === 0) return;
+	log.info(`cp -c failed, falling back to cp -R: ${r.stderr?.trim() ?? ""}`);
+	const r2 = spawnSync("cp", [
+		"-R",
+		src,
+		dest
+	], {
+		stdio: "pipe",
+		encoding: "utf8"
+	});
+	if (r2.status !== 0) throw new Error(`cp failed (${r2.status}): ${r2.stderr?.slice(0, 1e3) ?? ""}`);
+}
+async function ensureParentDir(destApp, dryRun, log) {
+	const parent = path.dirname(destApp);
+	if (fs.existsSync(parent)) return;
+	if (dryRun) {
+		log.info(`[dry-run] would mkdir -p ${parent}`);
+		return;
+	}
+	await fsp.mkdir(parent, { recursive: true });
+}
+function plutilReplace(infoPlist, op, log) {
+	const value = String(op.value);
+	if (spawnSync("plutil", [
+		"-replace",
+		op.key,
+		`-${op.type}`,
+		value,
+		infoPlist
+	], {
+		stdio: "pipe",
+		encoding: "utf8"
+	}).status === 0) return;
+	const insert = spawnSync("plutil", [
+		"-insert",
+		op.key,
+		`-${op.type}`,
+		value,
+		infoPlist
+	], {
+		stdio: "pipe",
+		encoding: "utf8"
+	});
+	if (insert.status !== 0) throw new Error(`plutil -insert ${op.key} failed (${insert.status}): ${insert.stderr?.slice(0, 500) ?? ""}`);
+	log.info(`plutil inserted ${op.key}=${value}`);
+}
+function plutilRemove(infoPlist, keyPath, log) {
+	const r = spawnSync("plutil", [
+		"-remove",
+		keyPath,
+		infoPlist
+	], {
+		stdio: "pipe",
+		encoding: "utf8"
+	});
+	if (r.status === 0) {
+		log.info(`plutil removed ${keyPath}`);
+		return;
+	}
+	log.info(`plutil -remove ${keyPath}: ${r.stderr?.trim() ?? "(no key)"}`);
+}
+/**
+* Resolve the path to `@zenbujs/core/dist/launcher.mjs` from any cwd. We
+* use `package.json` as the resolution anchor because that subpath is
+* exported (see packages/core/package.json `exports`).
+*/
+function resolveLauncherSource(fromDir) {
+	const req = createRequire(path.join(fromDir, "noop.js"));
+	let pkgPath;
+	try {
+		pkgPath = req.resolve("@zenbujs/core/package.json");
+	} catch (err) {
+		throw new Error(`failed to resolve @zenbujs/core from ${fromDir}: ${err.message}. Make sure create-zenbu-app's dependency on @zenbujs/core is installed.`);
+	}
+	const launcher = path.join(path.dirname(pkgPath), "dist", "launcher.mjs");
+	if (!fs.existsSync(launcher)) throw new Error(`@zenbujs/core launcher not found at ${launcher}. The package may be a stub or unbuilt.`);
+	return launcher;
+}
+//#endregion
+//#region src/desktop/deps-sig.ts
+function lockfileFor(type) {
+	switch (type) {
+		case "pnpm": return "pnpm-lock.yaml";
+		case "npm": return "package-lock.json";
+		case "yarn": return "yarn.lock";
+		case "bun": return "bun.lock";
+	}
+}
+/**
+* Mirror of `packages/core/src/shared/pm-install.ts#depsSignature`, with
+* `electronVersion` accepted explicitly because we run from Node (not
+* Electron) and `process.versions.electron` is undefined here.
+*
+* Must stay byte-for-byte equivalent to the launcher's recipe so the
+* pre-seeded `<appsDir>/.zenbu/deps-sig` matches what `ensureDepsInstalled`
+* recomputes on first launch and the install gate skips.
+*/
+async function depsSignature(opts) {
+	const hash = crypto.createHash("sha256");
+	await fileHash(hash, path.join(opts.appsDir, "package.json"));
+	await fileHash(hash, path.join(opts.appsDir, lockfileFor(opts.pm.type)));
+	hash.update(`${opts.pm.type}@${opts.pm.version}`);
+	hash.update("\0");
+	hash.update(opts.electronVersion);
+	hash.update("\0");
+	hash.update(opts.platform ?? process.platform);
+	hash.update("\0");
+	hash.update(opts.arch ?? process.arch);
+	return hash.digest("hex");
+}
+async function fileHash(hash, filePath) {
+	hash.update(filePath);
+	hash.update("\0");
+	try {
+		hash.update(await fsp.readFile(filePath));
+	} catch {}
+	hash.update("\0");
+}
+async function writeDepsSig(appsDir, sig) {
+	const sigPath = path.join(appsDir, ".zenbu", "deps-sig");
+	await fsp.mkdir(path.dirname(sigPath), { recursive: true });
+	await fsp.writeFile(sigPath, sig);
+}
+//#endregion
+//#region src/desktop/log.ts
+const LOG_DIR = path.join(os.homedir(), ".zenbu", "logs", "create-zenbu-app");
+function ts() {
+	return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+}
+function createLogger(opts) {
+	fs.mkdirSync(LOG_DIR, { recursive: true });
+	const file = path.join(LOG_DIR, `${ts()}-${opts.slug}.log`);
+	const stream = fs.createWriteStream(file, { flags: "a" });
+	stream.write(`=== create-zenbu-app --desktop ${(/* @__PURE__ */ new Date()).toISOString()} pid=${process.pid} slug=${opts.slug} ===\n`);
+	const writeLine = (prefix, line) => {
+		const text = `[${(/* @__PURE__ */ new Date()).toISOString()}] ${prefix}${line}\n`;
+		try {
+			stream.write(text);
+		} catch {}
+		if (opts.verbose) process.stdout.write(text);
+	};
+	return {
+		file,
+		step(label) {
+			writeLine("[STEP] ", label);
+		},
+		info(line) {
+			writeLine("", line);
+		},
+		error(line) {
+			const text = `[${(/* @__PURE__ */ new Date()).toISOString()}] [ERR] ${line}\n`;
+			try {
+				stream.write(text);
+			} catch {}
+			process.stderr.write(text);
+		},
+		async withStep(label, fn) {
+			this.step(label);
+			const start = Date.now();
+			try {
+				const out = await fn();
+				writeLine("[STEP-OK] ", `${label} (${Date.now() - start}ms)`);
+				return out;
+			} catch (err) {
+				const e = err;
+				writeLine("[STEP-FAIL] ", `${label} (${Date.now() - start}ms): ${e.stack ?? e.message ?? String(err)}`);
+				throw err;
+			}
+		},
+		tail(n = 30) {
+			try {
+				const all = fs.readFileSync(file, "utf8").split("\n");
+				return all.slice(Math.max(0, all.length - n - 1)).join("\n");
+			} catch {
+				return "";
+			}
+		},
+		close() {
+			try {
+				stream.end();
+			} catch {}
+		}
+	};
+}
+//#endregion
+//#region src/desktop/update-icon.ts
+/**
+* Swap an existing bundle's `Contents/Resources/icon.icns`, then re-codesign
+* (ad-hoc, deep) so the bundle stays valid. Optionally nudges Launch
+* Services to re-read the icon.
+*/
+async function updateBundleIcon(opts) {
+	const { destApp, iconSource, log, refreshIconServices = true } = opts;
+	if (!fs.existsSync(destApp)) throw new Error(`bundle does not exist: ${destApp}`);
+	if (!destApp.endsWith(".app")) throw new Error(`expected an .app bundle, got: ${destApp}`);
+	if (!fs.existsSync(iconSource)) throw new Error(`icon source does not exist: ${iconSource}`);
+	const iconDest = path.join(destApp, "Contents", "Resources", "icon.icns");
+	await log.withStep(`replace icon -> ${iconDest}`, async () => {
+		await prepareIcon({
+			source: iconSource,
+			dest: iconDest,
+			log
+		});
+	});
+	await adhocCodesign({
+		destApp,
+		log
+	});
+	await stripQuarantine({
+		destApp,
+		log
+	});
+	if (refreshIconServices) await log.withStep(`refresh Launch Services / Dock`, async () => {
+		const now = /* @__PURE__ */ new Date();
+		try {
+			await fsp.utimes(destApp, now, now);
+		} catch (err) {
+			log.info(`utimes failed: ${err.message}`);
+		}
+		const lsregister = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
+		if (fs.existsSync(lsregister)) {
+			const r = spawnSync(lsregister, ["-f", destApp], {
+				stdio: "pipe",
+				encoding: "utf8"
+			});
+			if (r.status !== 0) log.info(`lsregister exit=${r.status} ${r.stderr?.trim() ?? ""}`);
+		}
+		const iconSvcCache = path.join(os.homedir(), "Library", "Caches", "com.apple.iconservices.store");
+		try {
+			if (fs.existsSync(iconSvcCache)) await fsp.rm(iconSvcCache, { force: true });
+		} catch {}
+		spawnSync("killall", ["Dock"], { stdio: "ignore" });
+		spawnSync("killall", ["Finder"], { stdio: "ignore" });
+	});
+}
+//#endregion
+//#region src/desktop/index.ts
+/**
+* Default destination when `destApp` not provided. We prefer `/Applications`
+* but fall back to `~/Applications` when /Applications isn't writable
+* (e.g. without admin rights or on locked-down setups).
+*/
+function defaultDestApp(displayName) {
+	const sysApps = "/Applications";
+	try {
+		fs.accessSync(sysApps, fs.constants.W_OK);
+		return path.join(sysApps, `${displayName}.app`);
+	} catch {
+		const userApps = path.join(os.homedir(), "Applications");
+		return path.join(userApps, `${displayName}.app`);
+	}
+}
+async function buildDesktopApp(opts) {
+	const { displayName, slug, version, electronVersionRange, iconSource, appsDir, packageManager, resolveFrom, log, force = false, dryRun = false, skipDepsSig = false } = opts;
+	const destApp = opts.destApp ?? defaultDestApp(displayName);
+	const versionRange = electronVersionRange ?? await readElectronRangeFromAppsDir(appsDir) ?? "latest";
+	log.info(`displayName=${displayName} slug=${slug} version=${version}`);
+	log.info(`appsDir=${appsDir}`);
+	log.info(`destApp=${destApp}`);
+	log.info(`electronVersionRange=${versionRange}`);
+	const cache = await log.withStep(`ensure electron cache (${versionRange})`, () => ensureElectronApp({
+		versionRange,
+		log
+	}));
+	const launcherSource = resolveLauncherSource(resolveFrom);
+	log.info(`launcher source: ${launcherSource}`);
+	await synthesizeBundle({
+		cachedElectronApp: cache.electronAppPath,
+		destApp,
+		displayName,
+		slug,
+		version,
+		iconSource,
+		packageManager,
+		appsDir,
+		launcherSource,
+		log,
+		dryRun,
+		force
+	});
+	if (!skipDepsSig && !dryRun) await log.withStep(`write <appsDir>/.zenbu/deps-sig`, async () => {
+		const sig = await depsSignature({
+			appsDir,
+			pm: packageManager,
+			electronVersion: cache.version
+		});
+		await writeDepsSig(appsDir, sig);
+		log.info(`deps-sig=${sig.slice(0, 16)}…`);
+	});
+	else if (skipDepsSig) log.info(`skipping deps-sig (--no-install or skipDepsSig=true)`);
+	return {
+		destApp,
+		electronVersion: cache.version,
+		appsDir,
+		launchCommand: `open -a "${destApp}"`
+	};
+}
+async function readElectronRangeFromAppsDir(appsDir) {
+	try {
+		const raw = await fsp.readFile(path.join(appsDir, "package.json"), "utf8");
+		const pkg = JSON.parse(raw);
+		return pkg.devDependencies?.electron ?? pkg.dependencies?.electron ?? null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { writeDepsSig as a, stripQuarantine as c, ensureElectronApp as d, depsSignature as i, synthesizeBundle as l, updateBundleIcon as n, adhocCodesign as o, createLogger as r, resolveLauncherSource as s, buildDesktopApp as t, prepareIcon as u };