#!/usr/bin/env node import * as NodeModule from "node:module"; import { fromYaml } from "@t3tools/shared/schemaYaml";import { HostProcessPlatform } from "@t3tools/shared/hostProcess";import { clerkFrontendApiHostnameFromPublishableKey } from "@t3tools/shared/relayAuth";import { resolveSpawnCommand } from "@t3tools/shared/shell";import rootPackageJson from "../package.json" with { type: "json" };import desktopPackageJson from "../apps/desktop/package.json" with { type: "json" };import serverPackageJson from "../apps/server/package.json" with { type: "json" }; import { BRAND_ASSET_PATHS } from "./lib/brand-assets.ts";import { getDefaultBuildArch } from "./lib/build-target-arch.ts";import { loadRepoEnv } from "./lib/public-config.ts";import { resolveCatalogDependencies } from "./lib/resolve-catalog.ts"; import * as NodeRuntime from "@effect/platform-node/NodeRuntime";import * as NodeServices from "@effect/platform-node/NodeServices";import * as Config from "effect/Config";import * as Data from "effect/Data";import * as Effect from "effect/Effect";import * as FileSystem from "effect/FileSystem";import * as Layer from "effect/Layer";import * as Logger from "effect/Logger";import * as Option from "effect/Option";import * as Path from "effect/Path";import * as Schema from "effect/Schema";import * as Stream from "effect/Stream";import { Command, Flag } from "effect/unstable/cli";import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process"; const LINUX_ICON_SIZES = [16, 22, 24, 32, 48, 64, 128, 256, 512] as const;const DESKTOP_APP_ID = "com.t3tools.t3code";const APPLE_TEAM_ID_PATTERN = /^[A-Z0-9]{10}$/u; const BuildPlatform = Schema.Literals(["mac", "linux", "win"]);const BuildArch = Schema.Literals(["arm64", "x64", "universal"]); const WorkspaceConfig = Schema.Struct({ catalog: Schema.optional(Schema.Record(Schema.String, Schema.String)), overrides: Schema.optional(Schema.Record(Schema.String, Schema.String)), patchedDependencies: Schema.optional(Schema.Record(Schema.String, Schema.String)),});type WorkspaceConfig = typeof WorkspaceConfig.Type; const StageWorkspaceConfig = Schema.Struct({ supportedArchitectures: Schema.Struct({ os: Schema.Array(Schema.String), cpu: Schema.Array(Schema.String), }),}); const RepoRoot = Effect.service(Path.Path).pipe( Effect.flatMap((path) => path.fromFileUrl(new URL("..", import.meta.url))),);const encodeJsonString = Schema.encodeEffect(Schema.UnknownFromJsonString);const decodeWorkspaceConfig = Schema.decodeEffect(fromYaml(WorkspaceConfig));const encodeStageWorkspaceConfig = Schema.encodeEffect(fromYaml(StageWorkspaceConfig)); const readWorkspaceConfig = Effect.fn("readWorkspaceConfig")(function* () { const fs = yield* FileSystem.FileSystem; const path = yield* Path.Path; const repoRoot = yield* RepoRoot; const workspaceYaml = yield* fs.readFileString(path.join(repoRoot, "pnpm-workspace.yaml")); return yield* decodeWorkspaceConfig(workspaceYaml);}); interface DesktopBuildIconAssets { readonly macIconPng: string; readonly linuxIconPng: string; readonly windowsIconIco: string;} interface PlatformConfig { readonly cliFlag: "--mac" | "--linux" | "--win"; readonly defaultTarget: string; readonly archChoices: ReadonlyArray<typeof BuildArch.Type>;} const PLATFORM_CONFIG: Record<typeof BuildPlatform.Type, PlatformConfig> = { mac: { cliFlag: "--mac", defaultTarget: "dmg", archChoices: ["arm64", "x64", "universal"], }, linux: { cliFlag: "--linux", defaultTarget: "AppImage", archChoices: ["x64", "arm64"], }, win: { cliFlag: "--win", defaultTarget: "nsis", archChoices: ["x64", "arm64"], },}; interface BuildCliInput { readonly platform: Option.Option<typeof BuildPlatform.Type>; readonly target: Option.Option<string>; readonly arch: Option.Option<typeof BuildArch.Type>; readonly buildVersion: Option.Option<string>; readonly outputDir: Option.Option<string>; readonly skipBuild: Option.Option<boolean>; readonly keepStage: Option.Option<boolean>; readonly signed: Option.Option<boolean>; readonly verbose: Option.Option<boolean>; readonly mockUpdates: Option.Option<boolean>; readonly mockUpdateServerPort: Option.Option<number>;} function detectHostBuildPlatform(hostPlatform: string): typeof BuildPlatform.Type | undefined { if (hostPlatform === "darwin") return "mac"; if (hostPlatform === "linux") return "linux"; if (hostPlatform === "win32") return "win"; return undefined;} const getDefaultArch = Effect.fn("getDefaultArch")(function* (platform: typeof BuildPlatform.Type) { const config = PLATFORM_CONFIG[platform]; if (!config) { return "x64"; } return yield* getDefaultBuildArch(platform, config);}); class BuildScriptError extends Data.TaggedError("BuildScriptError")<{ readonly message: string; readonly cause?: unknown;}> {} const collectStreamAsString = <E>(stream: Stream.Stream<Uint8Array, E>): Effect.Effect<string, E> => stream.pipe( Stream.decodeText(), Stream.runFold( () => "", (acc, chunk) => acc + chunk, ), ); const COMMAND_OUTPUT_TAIL_LENGTH = 20_000; function appendOutputTail(acc: string, chunk: string): string { const next = acc + chunk; return next.length > COMMAND_OUTPUT_TAIL_LENGTH ? next.slice(-COMMAND_OUTPUT_TAIL_LENGTH) : next;} function formatOutputSection(label: string, output: string): string | undefined { const trimmed = output.trim(); if (!trimmed) return undefined; return `${label} tail:\n${trimmed}`;} const collectCommandStream = <E>( stream: Stream.Stream<Uint8Array, E>, output: NodeJS.WriteStream, verbose: boolean,): Effect.Effect<string, E> => stream.pipe( Stream.decodeText(), Stream.runFoldEffect( () => "", (acc, chunk) => Effect.as( verbose ? Effect.sync(() => output.write(chunk)) : Effect.void, appendOutputTail(acc, chunk), ), ), ); const spawnAndCollectOutput = Effect.fn("spawnAndCollectOutput")(function* ( command: ChildProcess.Command,) { const spawner = yield* ChildProcessSpawner.ChildProcessSpawner; const child = yield* spawner.spawn(command); const [stdout, stderr, exitCode] = yield* Effect.all( [ collectStreamAsString(child.stdout), collectStreamAsString(child.stderr), child.exitCode.pipe(Effect.map(Number)), ], { concurrency: "unbounded" }, ); return { stdout, stderr, exitCode } as const;}); const resolveGitCommitHash = Effect.fn("resolveGitCommitHash")(function* (repoRoot: string) { const result = yield* spawnAndCollectOutput( ChildProcess.make("git", ["rev-parse", "--short=12", "HEAD"], { cwd: repoRoot, }), ).pipe( Effect.orElseSucceed(() => ({ stdout: "", stderr: "", exitCode: 1, })), ); if (result.exitCode !== 0) { return "unknown"; } const hash = result.stdout.trim(); if (!/^[0-9a-f]{7,40}$/i.test(hash)) { return "unknown"; } return hash.toLowerCase();}); const resolvePythonForNodeGyp = Effect.fn("resolvePythonForNodeGyp")(function* () { const fs = yield* FileSystem.FileSystem; const path = yield* Path.Path; const hostPlatform = yield* HostProcessPlatform; const env = yield* Config.all({ configuredPython: Config.string("npm_config_python").pipe( Config.orElse(() => Config.string("PYTHON")), Config.option, ), localAppData: Config.string("LOCALAPPDATA").pipe(Config.option), }); const configured = Option.getOrUndefined(env.configuredPython); if (configured && (yield* fs.exists(configured))) { return configured; } if (hostPlatform === "win32") { const localAppData = Option.getOrUndefined(env.localAppData); if (localAppData) { for (const version of ["Python313", "Python312", "Python311", "Python310"]) { const candidate = path.join(localAppData, "Programs", "Python", version, "python.exe"); if (yield* fs.exists(candidate)) { return candidate; } } } } const probe = yield* spawnAndCollectOutput( ChildProcess.make("python", ["-c", "import sys;print(sys.executable)"]), ).pipe( Effect.orElseSucceed(() => ({ stdout: "", stderr: "", exitCode: 1, })), ); if (probe.exitCode !== 0) { return undefined; } const executable = probe.stdout.trim(); if (!executable || !(yield* fs.exists(executable))) { return undefined; } return executable;}); interface ResolvedBuildOptions { readonly platform: typeof BuildPlatform.Type; readonly target: string; readonly arch: typeof BuildArch.Type; readonly version: string | undefined; readonly outputDir: string; readonly skipBuild: boolean; readonly keepStage: boolean; readonly signed: boolean; readonly verbose: boolean; readonly mockUpdates: boolean; readonly mockUpdateServerPort: number | undefined;} interface StagePackageJson { readonly name: string; readonly version: string; readonly buildVersion: string; readonly t3codeCommitHash: string; readonly private: true; readonly packageManager: string; readonly description: string; readonly author: string; readonly main: string; readonly build: Record<string, unknown>; readonly dependencies: Record<string, unknown>; readonly devDependencies: { readonly electron: string; }; readonly overrides: Record<string, unknown>; readonly pnpm?: { readonly patchedDependencies?: Record<string, string>; };} export const STAGE_INSTALL_ARGS = ["install", "--prod"] as const;export const DESKTOP_ASAR_UNPACK = ["node_modules/@ff-labs/fff-bin-*/**/*"] as const; export interface MacPasskeySigningConfiguration { readonly appId: string; readonly teamId: string; readonly rpDomains: readonly string[]; readonly provisioningProfilePath: string;} function normalizePasskeyRpDomain(value: string): string { const normalized = value.trim().toLowerCase(); let parsed: URL; try { parsed = new URL(`https://${normalized}`); } catch { throw new Error(`Invalid passkey RP domain: ${value}`); } if ( normalized.length === 0 || parsed.host !== normalized || parsed.username.length > 0 || parsed.password.length > 0 || parsed.port.length > 0 || parsed.pathname !== "/" || parsed.search.length > 0 || parsed.hash.length > 0 ) { throw new Error(`Invalid passkey RP domain: ${value}`); } return parsed.hostname;} export function resolveMacPasskeySigningConfiguration( env: Readonly<Record<string, string | undefined>>,): MacPasskeySigningConfiguration { const teamId = env.T3CODE_APPLE_TEAM_ID?.trim().toUpperCase() ?? ""; if (!APPLE_TEAM_ID_PATTERN.test(teamId)) { throw new Error("T3CODE_APPLE_TEAM_ID must be a 10-character Apple Developer Team ID."); } const provisioningProfilePath = env.T3CODE_MACOS_PROVISIONING_PROFILE?.trim() ?? ""; if (provisioningProfilePath.length === 0) { throw new Error( "T3CODE_MACOS_PROVISIONING_PROFILE must point to an Associated Domains provisioning profile.", ); } const configuredRpDomains = env.T3CODE_CLERK_PASSKEY_RP_DOMAINS?.trim(); let rpDomains: readonly string[]; if (configuredRpDomains) { rpDomains = configuredRpDomains.split(",").map(normalizePasskeyRpDomain); } else { const publishableKey = env.T3CODE_CLERK_PUBLISHABLE_KEY?.trim(); if (!publishableKey) { throw new Error( "T3CODE_CLERK_PUBLISHABLE_KEY or T3CODE_CLERK_PASSKEY_RP_DOMAINS is required for signed macOS passkey builds.", ); } rpDomains = [ normalizePasskeyRpDomain(clerkFrontendApiHostnameFromPublishableKey(publishableKey)), ]; } const uniqueRpDomains = [...new Set(rpDomains)]; if (uniqueRpDomains.length === 0) { throw new Error("At least one Clerk passkey RP domain is required."); } return { appId: DESKTOP_APP_ID, teamId, rpDomains: uniqueRpDomains, provisioningProfilePath, };} function escapeXml(value: string): string { return value .replaceAll("&", "&") .replaceAll("<", "<") .replaceAll(">", ">") .replaceAll('"', """) .replaceAll("'", "'");} export function renderMacPasskeyEntitlements( configuration: MacPasskeySigningConfiguration,): string { const associatedDomains = configuration.rpDomains .map((domain) => ` <string>webcredentials:${escapeXml(domain)}</string>`) .join("\n"); return `<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"> <dict> <key>com.apple.application-identifier</key> <string>${escapeXml(`${configuration.teamId}.${configuration.appId}`)}</string> <key>com.apple.developer.team-identifier</key> <string>${escapeXml(configuration.teamId)}</string> <key>com.apple.developer.associated-domains</key> <array>${associatedDomains} </array> <key>com.apple.security.cs.allow-jit</key> <true/> <key>com.apple.security.cs.allow-unsigned-executable-memory</key> <true/> <key>com.apple.security.cs.disable-library-validation</key> <true/> </dict></plist>`;} export function resolveFffNativeDependencies( platform: typeof BuildPlatform.Type, arch: typeof BuildArch.Type, version: string,): Record<string, string> { const architectures = arch === "universal" ? (["arm64", "x64"] as const) : [arch]; if (platform === "mac") { return Object.fromEntries( architectures.map((architecture) => [`@ff-labs/fff-bin-darwin-${architecture}`, version]), ); } if (platform === "win") { return Object.fromEntries( architectures.map((architecture) => [`@ff-labs/fff-bin-win32-${architecture}`, version]), ); } return Object.fromEntries( architectures.flatMap((architecture) => ["gnu", "musl"].map((libc) => [`@ff-labs/fff-bin-linux-${architecture}-${libc}`, version]), ), );} export interface ClerkPasskeyNativeArtifact { readonly packageName: string; readonly binaryFileName: string;} export function resolveClerkPasskeyNativeArtifacts( platform: typeof BuildPlatform.Type, arch: typeof BuildArch.Type,): readonly ClerkPasskeyNativeArtifact[] { const architectures = arch === "universal" ? (["arm64", "x64"] as const) : [arch]; if (platform === "mac") { return architectures.map((architecture) => ({ packageName: `@clerk/electron-passkeys-darwin-${architecture}`, binaryFileName: `electron-passkeys.darwin-${architecture}.node`, })); } if (platform === "win") { return architectures.map((architecture) => ({ packageName: `@clerk/electron-passkeys-win32-${architecture}-msvc`, binaryFileName: `electron-passkeys.win32-${architecture}-msvc.node`, })); } return [];} // pnpm nests the architecture package under @clerk/electron-passkeys, while electron-builder only// retains collected top-level dependencies. The SDK loader checks beside index.js first, so stage// the binary there and let electron-builder's native-addon handling unpack it from the ASAR.const stageClerkPasskeyNativeBinaries = Effect.fn("stageClerkPasskeyNativeBinaries")(function* ( stageAppDir: string, platform: typeof BuildPlatform.Type, arch: typeof BuildArch.Type,) { const fs = yield* FileSystem.FileSystem; const path = yield* Path.Path; const packageEntryPath = yield* fs.realPath( path.join(stageAppDir, "node_modules", "@clerk", "electron-passkeys", "index.js"), ); const packageDir = path.dirname(packageEntryPath); const packageRequire = NodeModule.createRequire(packageEntryPath); for (const artifact of resolveClerkPasskeyNativeArtifacts(platform, arch)) { const sourcePath = yield* Effect.try({ try: () => packageRequire.resolve(artifact.packageName), catch: (cause) => new BuildScriptError({ message: `Clerk passkey native package is missing: ${artifact.packageName}`, cause, }), }); yield* fs.copyFile(sourcePath, path.join(packageDir, artifact.binaryFileName)); }}); export function createStageWorkspaceConfig(Lines 1–500 of 1409. Load more
#!/usr/bin/env node import * as NodeModule from "node:module"; import { fromYaml } from "@t3tools/shared/schemaYaml"; import { HostProcessPlatform } from "@t3tools/shared/hostProcess"; import { clerkFrontendApiHostnameFromPublishableKey } from "@t3tools/shared/relayAuth"; import { resolveSpawnCommand } from "@t3tools/shared/shell"; import rootPackageJson from "../package.json" with { type: "json" }; import desktopPackageJson from "../apps/desktop/package.json" with { type: "json" }; import serverPackageJson from "../apps/server/package.json" with { type: "json" }; import { BRAND_ASSET_PATHS } from "./lib/brand-assets.ts"; import { getDefaultBuildArch } from "./lib/build-target-arch.ts"; import { loadRepoEnv } from "./lib/public-config.ts"; import { resolveCatalogDependencies } from "./lib/resolve-catalog.ts"; import * as NodeRuntime from "@effect/platform-node/NodeRuntime"; import * as NodeServices from "@effect/platform-node/NodeServices"; import * as Config from "effect/Config"; import * as Data from "effect/Data"; import * as Effect from "effect/Effect"; import * as FileSystem from "effect/FileSystem"; import * as Layer from "effect/Layer"; import * as Logger from "effect/Logger"; import * as Option from "effect/Option"; import * as Path from "effect/Path"; import * as Schema from "effect/Schema"; import * as Stream from "effect/Stream"; import { Command, Flag } from "effect/unstable/cli"; import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process"; const LINUX_ICON_SIZES = [16, 22, 24, 32, 48, 64, 128, 256, 512] as const; const DESKTOP_APP_ID = "com.t3tools.t3code"; const APPLE_TEAM_ID_PATTERN = /^[A-Z0-9]{10}$/u; const BuildPlatform = Schema.Literals(["mac", "linux", "win"]); const BuildArch = Schema.Literals(["arm64", "x64", "universal"]); const WorkspaceConfig = Schema.Struct({ catalog: Schema.optional(Schema.Record(Schema.String, Schema.String)), overrides: Schema.optional(Schema.Record(Schema.String, Schema.String)), patchedDependencies: Schema.optional(Schema.Record(Schema.String, Schema.String)), }); type WorkspaceConfig = typeof WorkspaceConfig.Type; const StageWorkspaceConfig = Schema.Struct({ supportedArchitectures: Schema.Struct({ os: Schema.Array(Schema.String), cpu: Schema.Array(Schema.String), }), }); const RepoRoot = Effect.service(Path.Path).pipe( Effect.flatMap((path) => path.fromFileUrl(new URL("..", import.meta.url))), ); const encodeJsonString = Schema.encodeEffect(Schema.UnknownFromJsonString); const decodeWorkspaceConfig = Schema.decodeEffect(fromYaml(WorkspaceConfig)); const encodeStageWorkspaceConfig = Schema.encodeEffect(fromYaml(StageWorkspaceConfig)); const readWorkspaceConfig = Effect.fn("readWorkspaceConfig")(function* () { const fs = yield* FileSystem.FileSystem; const path = yield* Path.Path; const repoRoot = yield* RepoRoot; const workspaceYaml = yield* fs.readFileString(path.join(repoRoot, "pnpm-workspace.yaml")); return yield* decodeWorkspaceConfig(workspaceYaml); }); interface DesktopBuildIconAssets { readonly macIconPng: string; readonly linuxIconPng: string; readonly windowsIconIco: string; } interface PlatformConfig { readonly cliFlag: "--mac" | "--linux" | "--win"; readonly defaultTarget: string; readonly archChoices: ReadonlyArray<typeof BuildArch.Type>; } const PLATFORM_CONFIG: Record<typeof BuildPlatform.Type, PlatformConfig> = { mac: { cliFlag: "--mac", defaultTarget: "dmg", archChoices: ["arm64", "x64", "universal"], }, linux: { cliFlag: "--linux", defaultTarget: "AppImage", archChoices: ["x64", "arm64"], }, win: { cliFlag: "--win", defaultTarget: "nsis", archChoices: ["x64", "arm64"], }, }; interface BuildCliInput { readonly platform: Option.Option<typeof BuildPlatform.Type>; readonly target: Option.Option<string>; readonly arch: Option.Option<typeof BuildArch.Type>; readonly buildVersion: Option.Option<string>; readonly outputDir: Option.Option<string>; readonly skipBuild: Option.Option<boolean>; readonly keepStage: Option.Option<boolean>; readonly signed: Option.Option<boolean>; readonly verbose: Option.Option<boolean>; readonly mockUpdates: Option.Option<boolean>; readonly mockUpdateServerPort: Option.Option<number>; } function detectHostBuildPlatform(hostPlatform: string): typeof BuildPlatform.Type | undefined { if (hostPlatform === "darwin") return "mac"; if (hostPlatform === "linux") return "linux"; if (hostPlatform === "win32") return "win"; return undefined; } const getDefaultArch = Effect.fn("getDefaultArch")(function* (platform: typeof BuildPlatform.Type) { const config = PLATFORM_CONFIG[platform]; if (!config) { return "x64"; } return yield* getDefaultBuildArch(platform, config); }); class BuildScriptError extends Data.TaggedError("BuildScriptError")<{ readonly message: string; readonly cause?: unknown; }> {} const collectStreamAsString = <E>(stream: Stream.Stream<Uint8Array, E>): Effect.Effect<string, E> => stream.pipe( Stream.decodeText(), Stream.runFold( () => "", (acc, chunk) => acc + chunk, ), ); const COMMAND_OUTPUT_TAIL_LENGTH = 20_000; function appendOutputTail(acc: string, chunk: string): string { const next = acc + chunk; return next.length > COMMAND_OUTPUT_TAIL_LENGTH ? next.slice(-COMMAND_OUTPUT_TAIL_LENGTH) : next; } function formatOutputSection(label: string, output: string): string | undefined { const trimmed = output.trim(); if (!trimmed) return undefined; return `${label} tail:\n${trimmed}`; } const collectCommandStream = <E>( stream: Stream.Stream<Uint8Array, E>, output: NodeJS.WriteStream, verbose: boolean, ): Effect.Effect<string, E> => stream.pipe( Stream.decodeText(), Stream.runFoldEffect( () => "", (acc, chunk) => Effect.as( verbose ? Effect.sync(() => output.write(chunk)) : Effect.void, appendOutputTail(acc, chunk), ), ), ); const spawnAndCollectOutput = Effect.fn("spawnAndCollectOutput")(function* ( command: ChildProcess.Command, ) { const spawner = yield* ChildProcessSpawner.ChildProcessSpawner; const child = yield* spawner.spawn(command); const [stdout, stderr, exitCode] = yield* Effect.all( [ collectStreamAsString(child.stdout), collectStreamAsString(child.stderr), child.exitCode.pipe(Effect.map(Number)), ], { concurrency: "unbounded" }, ); return { stdout, stderr, exitCode } as const; }); const resolveGitCommitHash = Effect.fn("resolveGitCommitHash")(function* (repoRoot: string) { const result = yield* spawnAndCollectOutput( ChildProcess.make("git", ["rev-parse", "--short=12", "HEAD"], { cwd: repoRoot, }), ).pipe( Effect.orElseSucceed(() => ({ stdout: "", stderr: "", exitCode: 1, })), ); if (result.exitCode !== 0) { return "unknown"; } const hash = result.stdout.trim(); if (!/^[0-9a-f]{7,40}$/i.test(hash)) { return "unknown"; } return hash.toLowerCase(); }); const resolvePythonForNodeGyp = Effect.fn("resolvePythonForNodeGyp")(function* () { const fs = yield* FileSystem.FileSystem; const path = yield* Path.Path; const hostPlatform = yield* HostProcessPlatform; const env = yield* Config.all({ configuredPython: Config.string("npm_config_python").pipe( Config.orElse(() => Config.string("PYTHON")), Config.option, ), localAppData: Config.string("LOCALAPPDATA").pipe(Config.option), }); const configured = Option.getOrUndefined(env.configuredPython); if (configured && (yield* fs.exists(configured))) { return configured; } if (hostPlatform === "win32") { const localAppData = Option.getOrUndefined(env.localAppData); if (localAppData) { for (const version of ["Python313", "Python312", "Python311", "Python310"]) { const candidate = path.join(localAppData, "Programs", "Python", version, "python.exe"); if (yield* fs.exists(candidate)) { return candidate; } } } } const probe = yield* spawnAndCollectOutput( ChildProcess.make("python", ["-c", "import sys;print(sys.executable)"]), ).pipe( Effect.orElseSucceed(() => ({ stdout: "", stderr: "", exitCode: 1, })), ); if (probe.exitCode !== 0) { return undefined; } const executable = probe.stdout.trim(); if (!executable || !(yield* fs.exists(executable))) { return undefined; } return executable; }); interface ResolvedBuildOptions { readonly platform: typeof BuildPlatform.Type; readonly target: string; readonly arch: typeof BuildArch.Type; readonly version: string | undefined; readonly outputDir: string; readonly skipBuild: boolean; readonly keepStage: boolean; readonly signed: boolean; readonly verbose: boolean; readonly mockUpdates: boolean; readonly mockUpdateServerPort: number | undefined; } interface StagePackageJson { readonly name: string; readonly version: string; readonly buildVersion: string; readonly t3codeCommitHash: string; readonly private: true; readonly packageManager: string; readonly description: string; readonly author: string; readonly main: string; readonly build: Record<string, unknown>; readonly dependencies: Record<string, unknown>; readonly devDependencies: { readonly electron: string; }; readonly overrides: Record<string, unknown>; readonly pnpm?: { readonly patchedDependencies?: Record<string, string>; }; } export const STAGE_INSTALL_ARGS = ["install", "--prod"] as const; export const DESKTOP_ASAR_UNPACK = ["node_modules/@ff-labs/fff-bin-*/**/*"] as const; export interface MacPasskeySigningConfiguration { readonly appId: string; readonly teamId: string; readonly rpDomains: readonly string[]; readonly provisioningProfilePath: string; } function normalizePasskeyRpDomain(value: string): string { const normalized = value.trim().toLowerCase(); let parsed: URL; try { parsed = new URL(`https://${normalized}`); } catch { throw new Error(`Invalid passkey RP domain: ${value}`); } if ( normalized.length === 0 || parsed.host !== normalized || parsed.username.length > 0 || parsed.password.length > 0 || parsed.port.length > 0 || parsed.pathname !== "/" || parsed.search.length > 0 || parsed.hash.length > 0 ) { throw new Error(`Invalid passkey RP domain: ${value}`); } return parsed.hostname; } export function resolveMacPasskeySigningConfiguration( env: Readonly<Record<string, string | undefined>>, ): MacPasskeySigningConfiguration { const teamId = env.T3CODE_APPLE_TEAM_ID?.trim().toUpperCase() ?? ""; if (!APPLE_TEAM_ID_PATTERN.test(teamId)) { throw new Error("T3CODE_APPLE_TEAM_ID must be a 10-character Apple Developer Team ID."); } const provisioningProfilePath = env.T3CODE_MACOS_PROVISIONING_PROFILE?.trim() ?? ""; if (provisioningProfilePath.length === 0) { throw new Error( "T3CODE_MACOS_PROVISIONING_PROFILE must point to an Associated Domains provisioning profile.", ); } const configuredRpDomains = env.T3CODE_CLERK_PASSKEY_RP_DOMAINS?.trim(); let rpDomains: readonly string[]; if (configuredRpDomains) { rpDomains = configuredRpDomains.split(",").map(normalizePasskeyRpDomain); } else { const publishableKey = env.T3CODE_CLERK_PUBLISHABLE_KEY?.trim(); if (!publishableKey) { throw new Error( "T3CODE_CLERK_PUBLISHABLE_KEY or T3CODE_CLERK_PASSKEY_RP_DOMAINS is required for signed macOS passkey builds.", ); } rpDomains = [ normalizePasskeyRpDomain(clerkFrontendApiHostnameFromPublishableKey(publishableKey)), ]; } const uniqueRpDomains = [...new Set(rpDomains)]; if (uniqueRpDomains.length === 0) { throw new Error("At least one Clerk passkey RP domain is required."); } return { appId: DESKTOP_APP_ID, teamId, rpDomains: uniqueRpDomains, provisioningProfilePath, }; } function escapeXml(value: string): string { return value .replaceAll("&", "&") .replaceAll("<", "<") .replaceAll(">", ">") .replaceAll('"', """) .replaceAll("'", "'"); } export function renderMacPasskeyEntitlements( configuration: MacPasskeySigningConfiguration, ): string { const associatedDomains = configuration.rpDomains .map((domain) => ` <string>webcredentials:${escapeXml(domain)}</string>`) .join("\n"); return `<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.application-identifier</key> <string>${escapeXml(`${configuration.teamId}.${configuration.appId}`)}</string> <key>com.apple.developer.team-identifier</key> <string>${escapeXml(configuration.teamId)}</string> <key>com.apple.developer.associated-domains</key> <array> ${associatedDomains} </array> <key>com.apple.security.cs.allow-jit</key> <true/> <key>com.apple.security.cs.allow-unsigned-executable-memory</key> <true/> <key>com.apple.security.cs.disable-library-validation</key> <true/> </dict> </plist> `; } export function resolveFffNativeDependencies( platform: typeof BuildPlatform.Type, arch: typeof BuildArch.Type, version: string, ): Record<string, string> { const architectures = arch === "universal" ? (["arm64", "x64"] as const) : [arch]; if (platform === "mac") { return Object.fromEntries( architectures.map((architecture) => [`@ff-labs/fff-bin-darwin-${architecture}`, version]), ); } if (platform === "win") { return Object.fromEntries( architectures.map((architecture) => [`@ff-labs/fff-bin-win32-${architecture}`, version]), ); } return Object.fromEntries( architectures.flatMap((architecture) => ["gnu", "musl"].map((libc) => [`@ff-labs/fff-bin-linux-${architecture}-${libc}`, version]), ), ); } export interface ClerkPasskeyNativeArtifact { readonly packageName: string; readonly binaryFileName: string; } export function resolveClerkPasskeyNativeArtifacts( platform: typeof BuildPlatform.Type, arch: typeof BuildArch.Type, ): readonly ClerkPasskeyNativeArtifact[] { const architectures = arch === "universal" ? (["arm64", "x64"] as const) : [arch]; if (platform === "mac") { return architectures.map((architecture) => ({ packageName: `@clerk/electron-passkeys-darwin-${architecture}`, binaryFileName: `electron-passkeys.darwin-${architecture}.node`, })); } if (platform === "win") { return architectures.map((architecture) => ({ packageName: `@clerk/electron-passkeys-win32-${architecture}-msvc`, binaryFileName: `electron-passkeys.win32-${architecture}-msvc.node`, })); } return []; } // pnpm nests the architecture package under @clerk/electron-passkeys, while electron-builder only // retains collected top-level dependencies. The SDK loader checks beside index.js first, so stage // the binary there and let electron-builder's native-addon handling unpack it from the ASAR. const stageClerkPasskeyNativeBinaries = Effect.fn("stageClerkPasskeyNativeBinaries")(function* ( stageAppDir: string, platform: typeof BuildPlatform.Type, arch: typeof BuildArch.Type, ) { const fs = yield* FileSystem.FileSystem; const path = yield* Path.Path; const packageEntryPath = yield* fs.realPath( path.join(stageAppDir, "node_modules", "@clerk", "electron-passkeys", "index.js"), ); const packageDir = path.dirname(packageEntryPath); const packageRequire = NodeModule.createRequire(packageEntryPath); for (const artifact of resolveClerkPasskeyNativeArtifacts(platform, arch)) { const sourcePath = yield* Effect.try({ try: () => packageRequire.resolve(artifact.packageName), catch: (cause) => new BuildScriptError({ message: `Clerk passkey native package is missing: ${artifact.packageName}`, cause, }), }); yield* fs.copyFile(sourcePath, path.join(packageDir, artifact.binaryFileName)); } }); export function createStageWorkspaceConfig(