pakstr 0.30.0 → 1.0.0

package/desktop-runtime/dist/preload.js

@@ -0,0 +1,53 @@
+"use strict";
+
+// desktop-runtime/src/preload.js
+var { contextBridge, ipcRenderer } = require("electron");
+if (location.protocol === "pakstr:" && location.host === "app") {
+  const nostr = {
+    async call(method, payload) {
+      let response;
+      try {
+        response = await ipcRenderer.invoke("pakstr:nostr", method, payload);
+      } catch {
+        throw { error: "SIGNER_ERROR", message: "Invalid request" };
+      }
+      if (!response?.ok) throw response?.error ?? { error: "SIGNER_ERROR", message: "Unknown signer error" };
+      return response.result;
+    }
+  };
+  contextBridge.executeInMainWorld({
+    func: (bridge) => {
+      if (window.nostr) return;
+      window.nostr = {
+        getPublicKey: async () => bridge.call("getPublicKey"),
+        signEvent: async (event) => bridge.call("signEvent", event),
+        nip04: {
+          encrypt: async (pubkey, plaintext) => bridge.call("nip04_encrypt", { pubkey, plaintext }),
+          decrypt: async (pubkey, ciphertext) => bridge.call("nip04_decrypt", { pubkey, ciphertext })
+        },
+        nip44: {
+          encrypt: async (pubkey, plaintext) => bridge.call("nip44_encrypt", { pubkey, plaintext }),
+          decrypt: async (pubkey, ciphertext) => bridge.call("nip44_decrypt", { pubkey, ciphertext })
+        }
+      };
+    },
+    args: [nostr]
+  });
+  contextBridge.exposeInMainWorld("PakstrBridge", {
+    getApiBaseUrl: () => {
+      try {
+        return ipcRenderer.sendSync("pakstr:get-api-base-url") ?? null;
+      } catch {
+        return null;
+      }
+    },
+    setApiBaseUrl: (url) => {
+      if (typeof url !== "string") return false;
+      try {
+        return ipcRenderer.sendSync("pakstr:set-api-base-url", url) === true;
+      } catch {
+        return false;
+      }
+    }
+  });
+}

package/dist/cli.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCLI = runCLI;
 const path_1 = __importDefault(require("path"));
 const build_1 = require("./commands/build");
+const buildDesktop_1 = require("./commands/buildDesktop");
 const sign_1 = require("./commands/sign");
 const publish_1 = require("./commands/publish");
 const run_1 = require("./commands/run");
@@ -40,9 +41,19 @@ async function runCLI(argv) {
         case "init":
             await (0, init_1.initCommand)({ force: args.includes("--force"), out: configFlag });
             return;
-        case "build":
-            await (0, build_1.buildCommand)(configFlag ?? undefined);
+        case "build": {
+            const target = args.includes("--target") ? extractFlag(args, "--target") : "android";
+            if (target === "android") {
+                await (0, build_1.buildCommand)(configFlag ?? undefined);
+            }
+            else if (target && buildDesktop_1.DESKTOP_TARGETS.includes(target)) {
+                await (0, buildDesktop_1.buildDesktopCommand)(configFlag ?? undefined, target);
+            }
+            else {
+                throw new Error(`pakstr build --target must be one of: android, ${buildDesktop_1.DESKTOP_TARGETS.join(", ")}`);
+            }
             return;
+        }
         case "sign":
             await (0, sign_1.signCommand)(configFlag ?? undefined);
             return;
@@ -112,7 +123,7 @@ Pakstr — one-step nsec -> build -> sign -> publish.
 
 Usage:
   pakstr init [--force] [--config <path>]
-  pakstr build [--config <path>]
+  pakstr build [--config <path>] [--target android|macos-arm64|windows-x64|linux-x64]
   pakstr sign [--config <path>]
   pakstr nsite [--config <path>] [--dir <path>] [--dry-run]
   pakstr publish [--config <path>] [--dry-run] [--verify] [--out-json <path>]
@@ -120,6 +131,9 @@ Usage:
   pakstr delete --publisher [--config <path>] [--execute]
   pakstr run [--config <path>] [--dry-run] [--verify-publish] [--publish-out-json <path>]
 
+  build --target macos-arm64 writes an ad-hoc signed <appId>-macos-arm64.zip next to build.out (macOS only).
+  build --target windows-x64 writes an unsigned <appId>-windows-x64-setup.exe and portable .zip (needs NSIS 3).
+  build --target linux-x64 writes <appId>-linux-x64.AppImage and portable .zip (macOS/Linux, needs squashfs-tools).
   delete inventories app-scoped Zapstore events by default; --execute submits NIP-09 requests.
   --delete-blobs inventories release blobs; HTTP DELETE requires --execute --delete-blobs.
   --publisher inventories all configured-publisher events; --execute submits NIP-09 requests only.

package/dist/commands/build.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildCommand = buildCommand;
+exports.validateOutputParent = validateOutputParent;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const template_1 = require("../android/template");

package/dist/commands/buildDesktop.js

@@ -0,0 +1,140 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DESKTOP_MIN_NODE_VERSION = exports.DESKTOP_TARGETS = void 0;
+exports.assertDesktopNodeVersion = assertDesktopNodeVersion;
+exports.buildDesktopCommand = buildDesktopCommand;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const linux_1 = require("../desktop/linux");
+const macos_1 = require("../desktop/macos");
+const stage_1 = require("../desktop/stage");
+const windows_1 = require("../desktop/windows");
+const artifactPublisher_1 = require("./artifactPublisher");
+const build_1 = require("./build");
+exports.DESKTOP_TARGETS = [macos_1.MACOS_ARM64_TARGET, windows_1.WINDOWS_X64_TARGET, linux_1.LINUX_X64_TARGET];
+/**
+ * Same as the package's engines minimum, checked at run time because npm only
+ * warns about engines (and skips the optional @electron tools) on older Node.
+ */
+exports.DESKTOP_MIN_NODE_VERSION = "22.12.0";
+function assertDesktopNodeVersion(version = process.versions.node) {
+    const [major, minor] = version.split(".").map(Number);
+    const [minMajor, minMinor] = exports.DESKTOP_MIN_NODE_VERSION.split(".").map(Number);
+    if (!Number.isInteger(major) || !Number.isInteger(minor) || major < minMajor || (major === minMajor && minor < minMinor)) {
+        throw new Error(`Desktop builds require Node.js >= ${exports.DESKTOP_MIN_NODE_VERSION} (running ${version}). Upgrade Node.js.`);
+    }
+}
+/**
+ * `pakstr build --target macos-arm64` — an ad-hoc signed `<appName>.app` in
+ * `<appId>-macos-arm64.zip` next to build.out. No nsec, keystore, or Docker
+ * involved; the Android build, sign, and publish flows are untouched.
+ */
+async function buildDesktopCommand(configPath, target) {
+    if (target === windows_1.WINDOWS_X64_TARGET)
+        return buildWindowsDesktop(configPath);
+    if (target === linux_1.LINUX_X64_TARGET)
+        return buildLinuxDesktop(configPath);
+    if (target !== macos_1.MACOS_ARM64_TARGET)
+        throw new Error(`Unsupported desktop target: ${target}`);
+    assertDesktopNodeVersion();
+    if (process.platform !== "darwin") {
+        throw new Error("macOS desktop packages can only be built on macOS (codesign and ditto are required)");
+    }
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    (0, stage_1.assertDesktopAppName)(config.app.appName);
+    const finalPath = (0, stage_1.desktopOutputPath)(config.build.out, config.app.appId, target);
+    console.log("\n🚀 pakstr build --target", target);
+    console.log("📦 App:", config.app.appName, `(${(0, macos_1.macosBundleId)(config.app.appId)})`);
+    console.log("🌐 Web:", config.build.web);
+    console.log("🖥️  Out:", finalPath);
+    (0, build_1.validateOutputParent)(finalPath);
+    const workDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "pakstr-desktop-"));
+    try {
+        const stagingDir = path_1.default.join(workDir, "app");
+        fs_1.default.mkdirSync(stagingDir);
+        (0, stage_1.stageDesktopApp)({ stagingDir, webDir: config.build.web, app: config.app, runtime: config.runtime });
+        const zipPath = await (0, macos_1.packageMacosApp)({ stagingDir, workDir, app: config.app });
+        (0, artifactPublisher_1.publishArtifact)((0, artifactPublisher_1.stageArtifact)(zipPath, finalPath, "macOS package"), finalPath);
+    }
+    finally {
+        fs_1.default.rmSync(workDir, { recursive: true, force: true });
+    }
+    console.log("\n✅ DESKTOP BUILD COMPLETE (ad-hoc signed, not notarized)");
+    console.log("📦 Output:", finalPath);
+    return finalPath;
+}
+/**
+ * `pakstr build --target windows-x64` — an unsigned per-user NSIS installer
+ * `<appId>-windows-x64-setup.exe` and a portable `<appId>-windows-x64.zip`
+ * next to build.out. Builds on any host with NSIS 3 (`makensis`); returns the
+ * installer path.
+ */
+async function buildWindowsDesktop(configPath) {
+    assertDesktopNodeVersion();
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    (0, windows_1.assertWindowsAppIdentity)(config.app);
+    (0, windows_1.windowsVersion)(config.app.versionName);
+    const outputs = (0, windows_1.windowsOutputPaths)(config.build.out, config.app.appId);
+    console.log("\n🚀 pakstr build --target", windows_1.WINDOWS_X64_TARGET);
+    console.log("📦 App:", config.app.appName, `(${config.app.appId})`);
+    console.log("🌐 Web:", config.build.web);
+    console.log("🖥️  Out:", outputs.installer);
+    console.log("🖥️  Out:", outputs.portable);
+    (0, build_1.validateOutputParent)(outputs.installer);
+    const workDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "pakstr-desktop-"));
+    try {
+        const stagingDir = path_1.default.join(workDir, "app");
+        fs_1.default.mkdirSync(stagingDir);
+        (0, stage_1.stageDesktopApp)({ stagingDir, webDir: config.build.web, app: config.app, runtime: config.runtime });
+        const built = await (0, windows_1.packageWindowsApp)({ stagingDir, workDir, app: config.app });
+        (0, artifactPublisher_1.publishArtifact)((0, artifactPublisher_1.stageArtifact)(built.installer, outputs.installer, "Windows installer"), outputs.installer);
+        (0, artifactPublisher_1.publishArtifact)((0, artifactPublisher_1.stageArtifact)(built.portable, outputs.portable, "Windows portable package"), outputs.portable);
+    }
+    finally {
+        fs_1.default.rmSync(workDir, { recursive: true, force: true });
+    }
+    console.log("\n✅ DESKTOP BUILD COMPLETE (unsigned)");
+    console.log("📦 Installer:", outputs.installer);
+    console.log("📦 Portable:", outputs.portable);
+    return outputs.installer;
+}
+/**
+ * `pakstr build --target linux-x64` — an AppImage `<appId>-linux-x64.AppImage`
+ * and a portable `<appId>-linux-x64.zip` next to build.out. Builds on macOS or
+ * Linux with squashfs-tools; returns the AppImage path.
+ */
+async function buildLinuxDesktop(configPath) {
+    assertDesktopNodeVersion();
+    (0, linux_1.assertLinuxBuildHost)();
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    (0, stage_1.assertDesktopAppName)(config.app.appName);
+    const outputs = (0, linux_1.linuxOutputPaths)(config.build.out, config.app.appId);
+    console.log("\n🚀 pakstr build --target", linux_1.LINUX_X64_TARGET);
+    console.log("📦 App:", config.app.appName, `(${config.app.appId})`);
+    console.log("🌐 Web:", config.build.web);
+    for (const format of linux_1.LINUX_PACKAGE_FORMATS)
+        console.log("🖥️  Out:", outputs[format]);
+    (0, build_1.validateOutputParent)(outputs.appimage);
+    const workDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "pakstr-desktop-"));
+    try {
+        const stagingDir = path_1.default.join(workDir, "app");
+        fs_1.default.mkdirSync(stagingDir);
+        (0, stage_1.stageDesktopApp)({ stagingDir, webDir: config.build.web, app: config.app, runtime: config.runtime });
+        const built = await (0, linux_1.packageLinuxApp)({ stagingDir, workDir, app: config.app, configDir: config.configDir });
+        for (const format of linux_1.LINUX_PACKAGE_FORMATS) {
+            (0, artifactPublisher_1.publishArtifact)((0, artifactPublisher_1.stageArtifact)(built[format], outputs[format], `Linux ${format} package`), outputs[format]);
+        }
+    }
+    finally {
+        fs_1.default.rmSync(workDir, { recursive: true, force: true });
+    }
+    console.log("\n✅ DESKTOP BUILD COMPLETE (unsigned)");
+    for (const format of linux_1.LINUX_PACKAGE_FORMATS)
+        console.log(`📦 ${format === "appimage" ? "AppImage" : "Portable"}:`, outputs[format]);
+    return outputs.appimage;
+}

package/dist/desktop/common/artifacts.js

@@ -0,0 +1,16 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.desktopOutputDir = desktopOutputDir;
+exports.desktopArtifactPath = desktopArtifactPath;
+const path_1 = __importDefault(require("path"));
+/** Desktop packages are written next to build.out, like the APK. */
+function desktopOutputDir(buildOut) {
+    return path_1.default.dirname(path_1.default.resolve(buildOut));
+}
+/** `<dir>/<appId>-<target><suffix>`, e.g. com.example.app-windows-x64-setup.exe. */
+function desktopArtifactPath(dir, appId, target, suffix) {
+    return path_1.default.join(dir, `${appId}-${target}${suffix}`);
+}

package/dist/desktop/common/asar.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAppAsar = verifyAppAsar;
+exports.assertAsarEntries = assertAsarEntries;
+exports.asarHeaderHash = asarHeaderHash;
+exports.assertAsarFileIntegrity = assertAsarFileIntegrity;
+const stage_1 = require("../stage");
+const files_1 = require("./files");
+/** Files that must be in every packaged app.asar. */
+const REQUIRED_ASAR_ENTRIES = [
+    "/package.json",
+    `/${stage_1.DESKTOP_DESCRIPTOR_FILE}`,
+    ...stage_1.DESKTOP_RUNTIME_FILES.map((file) => `/runtime/${file}`),
+    "/web/index.html",
+    "/web/pakstr-runtime.json",
+];
+/** The packaged app.asar holds only the allowlisted layout and this app's descriptor. */
+async function verifyAppAsar(asarPath, app) {
+    const asar = await import("@electron/asar");
+    assertAsarEntries(asar.listPackage(asarPath, { isPack: false }));
+    const descriptor = JSON.parse(asar.extractFile(asarPath, stage_1.DESKTOP_DESCRIPTOR_FILE).toString("utf8"));
+    if (descriptor.appId !== app.appId || descriptor.appName !== app.appName || Object.keys(descriptor).length !== 2) {
+        throw new Error(`Packaged ${stage_1.DESKTOP_DESCRIPTOR_FILE} does not match the app identity`);
+    }
+}
+/** Every packaged path is in the allowlist and the required files are present. */
+function assertAsarEntries(entries) {
+    const normalized = entries.map((entry) => entry.replace(/\\/g, "/"));
+    const unexpected = normalized.filter((entry) => !(0, stage_1.isAllowedAppPath)(entry));
+    if (unexpected.length > 0)
+        throw new Error(`app.asar contains files outside the allowlist: ${unexpected.join(", ")}`);
+    const missing = REQUIRED_ASAR_ENTRIES.filter((entry) => !normalized.includes(entry));
+    if (missing.length > 0)
+        throw new Error(`app.asar is missing: ${missing.join(", ")}`);
+}
+/** SHA-256 of the archive's header: the value Electron's embedded asar integrity records. */
+async function asarHeaderHash(asarPath) {
+    const asar = await import("@electron/asar");
+    return (0, files_1.sha256)(asar.getRawHeader(asarPath).headerString);
+}
+/** Every file in the archive is inside it (no unpacked or linked entries) and matches its SHA-256. */
+async function assertAsarFileIntegrity(asarPath) {
+    const asar = await import("@electron/asar");
+    const walk = (node, prefix) => {
+        for (const [name, child] of Object.entries(node.files ?? {})) {
+            const rel = prefix ? `${prefix}/${name}` : name;
+            if (child.files) {
+                walk(child, rel);
+                continue;
+            }
+            if (child.unpacked || child.link !== undefined)
+                throw new Error(`app.asar entry ${rel} is not stored in the archive`);
+            const hash = (0, files_1.sha256)(asar.extractFile(asarPath, rel));
+            if (child.integrity?.algorithm !== "SHA256" || child.integrity.hash !== hash) {
+                throw new Error(`app.asar entry ${rel} does not match its integrity hash`);
+            }
+        }
+    };
+    walk(asar.getRawHeader(asarPath).header, "");
+}

package/dist/desktop/common/electron.js

@@ -0,0 +1,50 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LINUX_ELECTRON_ZIP = exports.WINDOWS_ELECTRON_ZIP = exports.MACOS_ELECTRON_ZIP = exports.ELECTRON_VERSION = void 0;
+exports.fetchElectronZip = fetchElectronZip;
+exports.assertPinnedElectronZip = assertPinnedElectronZip;
+const path_1 = __importDefault(require("path"));
+const files_1 = require("./files");
+/** The Electron the desktop runtime is built and tested against (desktop-runtime/package.json). */
+exports.ELECTRON_VERSION = "45.0.0";
+// Every pin is from the release's SHASUMS256.txt, so a swapped download or cache entry is rejected.
+exports.MACOS_ELECTRON_ZIP = {
+    platform: "darwin",
+    arch: "arm64",
+    name: `electron-v${exports.ELECTRON_VERSION}-darwin-arm64.zip`,
+    sha256: "896c3a50b148e89a158dca08a6996a022ddf39b23aac871e107f5b4087f8caa9",
+};
+exports.WINDOWS_ELECTRON_ZIP = {
+    platform: "win32",
+    arch: "x64",
+    name: `electron-v${exports.ELECTRON_VERSION}-win32-x64.zip`,
+    sha256: "ae53887a23bb640369c93dbd38c408a2af5c0deb86f2fa76c6c244cb444b7f47",
+};
+exports.LINUX_ELECTRON_ZIP = {
+    platform: "linux",
+    arch: "x64",
+    name: `electron-v${exports.ELECTRON_VERSION}-linux-x64.zip`,
+    sha256: "22f6a10bd3f7fef987ddbb379d3375ce664ad0c98a9a50f80c89f1718a0c3e3a",
+};
+/** Download (or reuse the cached) pinned Electron zip and verify its SHA-256 ourselves. */
+async function fetchElectronZip(pinned) {
+    const { downloadArtifact } = await import("@electron/get");
+    const zip = await downloadArtifact({
+        version: exports.ELECTRON_VERSION,
+        platform: pinned.platform,
+        arch: pinned.arch,
+        artifactName: "electron",
+        checksums: { [pinned.name]: pinned.sha256 },
+    });
+    await assertPinnedElectronZip(zip, pinned);
+    return zip;
+}
+/** The file is the pinned release zip: its name and SHA-256 both match. */
+async function assertPinnedElectronZip(zip, pinned) {
+    if (path_1.default.basename(zip) !== pinned.name || (await (0, files_1.sha256File)(zip)) !== pinned.sha256) {
+        throw new Error(`Electron download does not match the pinned ${pinned.name} checksum: ${zip}`);
+    }
+}

package/dist/desktop/common/files.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sha256 = sha256;
+exports.sha256File = sha256File;
+exports.readHead = readHead;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const promises_1 = require("stream/promises");
+function sha256(data) {
+    return crypto_1.default.createHash("sha256").update(data).digest("hex");
+}
+async function sha256File(file) {
+    const hash = crypto_1.default.createHash("sha256");
+    await (0, promises_1.pipeline)(fs_1.default.createReadStream(file), hash);
+    return hash.digest("hex");
+}
+/** Up to `length` bytes from the start of `file` (fewer if the file is shorter). */
+function readHead(file, length) {
+    const fd = fs_1.default.openSync(file, "r");
+    try {
+        const head = Buffer.alloc(length);
+        return head.subarray(0, fs_1.default.readSync(fd, head, 0, length, 0));
+    }
+    finally {
+        fs_1.default.closeSync(fd);
+    }
+}

package/dist/desktop/common/fuses.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DESKTOP_FUSES = void 0;
+exports.desktopFuseConfig = desktopFuseConfig;
+exports.assertFuseWire = assertFuseWire;
+exports.flipDesktopFuses = flipDesktopFuses;
+exports.verifyDesktopFuses = verifyDesktopFuses;
+/**
+ * Electron fuses for every desktop package, by @electron/fuses option name.
+ * All are set explicitly (strictlyRequireAllFuses), so an Electron upgrade
+ * that adds a fuse fails the build instead of inheriting its default.
+ */
+exports.DESKTOP_FUSES = {
+    RunAsNode: false,
+    EnableCookieEncryption: true,
+    EnableNodeOptionsEnvironmentVariable: false,
+    EnableNodeCliInspectArguments: false,
+    EnableEmbeddedAsarIntegrityValidation: true,
+    OnlyLoadAppFromAsar: true,
+    LoadBrowserProcessSpecificV8Snapshot: false,
+    GrantFileProtocolExtraPrivileges: false,
+    WasmTrapHandlers: true,
+};
+// @electron/fuses FuseState byte values.
+const FUSE_ENABLED = 0x31;
+const FUSE_DISABLED = 0x30;
+/** @electron/fuses config with wire indices resolved from the library's FuseV1Options enum. */
+function desktopFuseConfig(fuseOptions) {
+    const config = { version: "1", strictlyRequireAllFuses: true };
+    for (const [name, enabled] of Object.entries(exports.DESKTOP_FUSES)) {
+        config[fuseIndex(fuseOptions, name)] = enabled;
+    }
+    return config;
+}
+/** Throws unless the binary's fuse wire (getCurrentFuseWire) matches DESKTOP_FUSES exactly. */
+function assertFuseWire(wire, fuseOptions) {
+    const fuseCount = Object.keys(wire).filter((key) => /^\d+$/.test(key)).length;
+    if (wire.version !== "1" || fuseCount !== Object.keys(exports.DESKTOP_FUSES).length) {
+        throw new Error(`Unexpected Electron fuse wire (version ${String(wire.version)}, ${fuseCount} fuses)`);
+    }
+    for (const [name, enabled] of Object.entries(exports.DESKTOP_FUSES)) {
+        if (wire[fuseIndex(fuseOptions, name)] !== (enabled ? FUSE_ENABLED : FUSE_DISABLED)) {
+            throw new Error(`Electron fuse ${name} is not ${enabled ? "enabled" : "disabled"} in the packaged app`);
+        }
+    }
+}
+function fuseIndex(fuseOptions, name) {
+    const index = fuseOptions[name];
+    if (typeof index !== "number")
+        throw new Error(`Unknown Electron fuse: ${name}`);
+    return index;
+}
+/** Flip DESKTOP_FUSES in a packaged app: the .app bundle on macOS, the executable elsewhere. */
+async function flipDesktopFuses(target) {
+    const fuses = await import("@electron/fuses");
+    await fuses.flipFuses(target, desktopFuseConfig(fuses.FuseV1Options));
+}
+/** Read the fuse wire back from a packaged app and check it against DESKTOP_FUSES. */
+async function verifyDesktopFuses(target) {
+    const fuses = await import("@electron/fuses");
+    assertFuseWire((await fuses.getCurrentFuseWire(target)), fuses.FuseV1Options);
+}

package/dist/desktop/common/packager.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.basePackagerOptions = basePackagerOptions;
+exports.runPackager = runPackager;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const stage_1 = require("../stage");
+const electron_1 = require("./electron");
+/**
+ * @electron/packager options every desktop package shares. The staging
+ * directory already holds only the allowlisted layout; `ignore` enforces the
+ * same allowlist again. Platform builders add platform, arch, and identity.
+ */
+function basePackagerOptions(options) {
+    const { stagingDir, outDir, electronZipDir } = options;
+    return {
+        dir: stagingDir,
+        out: outDir,
+        electronZipDir,
+        electronVersion: electron_1.ELECTRON_VERSION,
+        asar: true,
+        prune: false,
+        derefSymlinks: false,
+        junk: true,
+        overwrite: false,
+        quiet: true,
+        ignore: (file) => file !== "" && !(0, stage_1.isAllowedAppPath)(file.replace(/\\/g, "/")),
+    };
+}
+/**
+ * Run @electron/packager and check its output folder holds `product` (the
+ * .app bundle or the app executable). Returns the folder and the product path.
+ */
+async function runPackager(options, product) {
+    const { packager } = await import("@electron/packager");
+    const [appDir] = await packager(options);
+    const productPath = path_1.default.join(appDir, product.name);
+    const stat = fs_1.default.lstatSync(productPath, { throwIfNoEntry: false });
+    if (!(product.type === "directory" ? stat?.isDirectory() : stat?.isFile())) {
+        throw new Error(`Packager did not produce ${product.name}`);
+    }
+    return { appDir, productPath };
+}