Distribution: artifacts, channels, and what actually ships

{
  "name": "t3",
  "version": "0.0.33",
  "license": "MIT",
  "repository": {
    "type": "git",
    "url": "https://github.com/pingdotgg/t3code",
    "directory": "apps/server"
  },
  "bin": {
    "t3": "./dist/bin.mjs"
  },
  "files": [
    "dist"
  ],
  "type": "module",
  "scripts": {
    "dev": "node --watch src/bin.ts",
    "build:bundle": "vp pack && vp pack src/service-launcher.ts --out-dir dist --no-clean",
    "start": "node dist/bin.mjs",
    "typecheck": "tsgo --noEmit",
    "test": "vp test run"

const buildCmd = Command.make(
  "build",
  {
    verbose: Flag.boolean("verbose").pipe(Flag.withDefault(false)),
  },
  (config) =>
    Effect.gen(function* () {
      const path = yield* Path.Path;
      const fs = yield* FileSystem.FileSystem;
      const repoRoot = yield* RepoRoot;
      const serverDir = path.join(repoRoot, "apps/server");
 
      yield* Effect.log("[cli] Running tsdown...");
      yield* runCommand(
        ChildProcess.make(process.execPath, ["--run", "build:bundle"], {
          cwd: serverDir,
          stdout: config.verbose ? "inherit" : "ignore",
          stderr: "inherit",
          shell: false,
        }),
      );
 
      const webDist = path.join(repoRoot, "apps/web/dist");
      const clientTarget = path.join(serverDir, "dist/client");
 
      if (yield* fs.exists(webDist)) {
        yield* fs.copy(webDist, clientTarget);
        yield* applyDevelopmentIconOverrides(repoRoot, serverDir);
        yield* Effect.log("[cli] Bundled web app into dist/client");
      } else {
        yield* Effect.logWarning("[cli] Web dist not found — skipping client bundle.");
      }
    }),
).pipe(Command.withDescription("Build the server package (tsdown + bundle web client)."));

  const buildConfig: Record<string, unknown> = {
    appId: DESKTOP_APP_ID,
    productName: resolveDesktopProductName(version),
    artifactName: "T3-Code-${version}-${arch}.${ext}",
    electronLanguages: [...DESKTOP_ELECTRON_LANGUAGES],
    files: [...DESKTOP_FILE_EXCLUSIONS],
    directories: {
      buildResources: "apps/desktop/resources",
    },
    // All platforms keep app.asar fully packed; electron-builder's default
    // smart unpack extracts native libraries, which loaders find in
    // app.asar.unpacked. Windows additionally ships the server tree as the
    // hand-packed server.asar sidecar (see WINDOWS_SERVER_ASAR_RESOURCE).
    extraResources: [
      ...DESKTOP_EXTRA_RESOURCES,
      ...(platform === "win" ? WINDOWS_SERVER_EXTRA_RESOURCES : []),
    ],
  };
  const updateChannel = resolveDesktopUpdateChannel(version);
  const publishConfig = yield* resolveGitHubPublishConfig(updateChannel);
  if (publishConfig) {
    buildConfig.publish = [publishConfig];
  } else if (mockUpdates) {
    buildConfig.publish = [
      {
        provider: "generic",
        url: resolveMockUpdateServerUrl(mockUpdateServerPort),
      },
    ];
  }
 
  if (platform === "mac") {
    buildConfig.mac = {
      target: target === "dmg" ? [target, "zip"] : [target],
      icon: "icon.icns",
      category: "public.app-category.developer-tools",
      protocols: [
        {
          name: "T3 Code",
          schemes: ["t3code", "t3code-dev"],
        },
      ],
      ...(macPasskeySigning
        ? {
            entitlements: macPasskeySigning.entitlementsPath,
            provisioningProfile: macPasskeySigning.provisioningProfilePath,
          }
        : {}),
    };

  if (platform === "linux") {
    buildConfig.linux = {
      target: [target],
      executableName: "t3code",
      icon: "icons",
      category: "Development",
      // electron-builder turns these into MimeType=x-scheme-handler/<scheme>;
      // in the .desktop entry (Exec already gets %U), so browsers can hand
      // t3code:// OAuth callbacks to the app.
      protocols: [
        {
          name: "T3 Code",
          schemes: ["t3code", "t3code-dev"],
        },
      ],
      desktop: {
        entry: {
          StartupWMClass: "t3code",
        },
      },
    };
  }
 
  if (platform === "win") {
    buildConfig.npmRebuild = false;
    // Keep blockmap-based differential downloads enabled while changing the
    // installed file topology. The optimization is in the payload shape, not
    // in trading update bandwidth for install speed.
    buildConfig.nsis = { differentialPackage: true };
    const winConfig: Record<string, unknown> = {
      target: [target],
      icon: "icon.ico",
      // Resource editing applies the product metadata and icon independently
      // of code signing. Disabling it for local unsigned builds leaves the
      // packaged executable with Electron's stock icon.
      signAndEditExecutable: true,
    };
    if (signed) {
      winConfig.azureSignOptions = yield* AzureTrustedSigningOptionsConfig;
    }
    buildConfig.win = winConfig;
  }

  build:
    name: Build ${{ matrix.label }}
    # build_wsl_node_pty stays in `needs` so it runs first and its artifact is
    # available to download, but only the Windows matrix entry consumes it. We
    # therefore gate the job on preflight + relay (must succeed) WITHOUT requiring
    # build_wsl_node_pty, so a failed Linux prebuild doesn't skip the macOS/Linux
    # builds. `!cancelled()` (not `!failure()`) lets the job run even when
    # build_wsl_node_pty failed; the Windows-only download step below then fails
    # that single platform if the prebuild is missing.
    needs: [preflight, relay_public_config, build_wsl_node_pty]
    if: ${{ !cancelled() && needs.preflight.result == 'success' && needs.relay_public_config.result == 'success' }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    env:
      T3CODE_CLERK_PUBLISHABLE_KEY: ${{ needs.relay_public_config.outputs.clerk_publishable_key }}
      T3CODE_CLERK_JWT_TEMPLATE: ${{ needs.relay_public_config.outputs.clerk_jwt_template }}
      T3CODE_CLERK_CLI_OAUTH_CLIENT_ID: ${{ needs.relay_public_config.outputs.clerk_cli_oauth_client_id }}
      T3CODE_RELAY_URL: ${{ needs.relay_public_config.outputs.relay_url }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: macOS arm64
            runner: blacksmith-12vcpu-macos-26
            platform: mac
            target: dmg
            arch: arm64
            rust_target: aarch64-apple-darwin
            resource_key: darwin-arm64
          - label: macOS x64
            runner: blacksmith-12vcpu-macos-26
            platform: mac
            target: dmg
            arch: x64
            rust_target: x86_64-apple-darwin
            resource_key: darwin-x64
          - label: Linux x64
            runner: blacksmith-32vcpu-ubuntu-2404
            platform: linux
            target: AppImage
            arch: x64
            rust_target: x86_64-unknown-linux-gnu
            resource_key: linux-x64
          - label: Windows x64
            runner: blacksmith-32vcpu-windows-2025
            platform: win
            target: nsis
            arch: x64
            rust_target: x86_64-pc-windows-msvc
            resource_key: win32-x64
          # - label: Windows arm64
          #   runner: windows-11-arm
          #   platform: win
          #   target: nsis
          #   arch: arm64
    steps:

      - name: Publish fingerprint-gated OTA
        if: steps.expo-token.outputs.present == 'true' && github.event_name == 'push'
        working-directory: apps/mobile
        env:
          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
        run: |
          message="$(git log -1 --pretty=%s | head -c 120) ($(git rev-parse --short=9 HEAD))"
          for platform in ios android; do
            # eas-cli prints an environment-loaded notice to stdout before the
            # JSON even with --json, so discard everything before the document.
            hash="$(eas fingerprint:generate --platform "$platform" --environment production --json --non-interactive | sed -n '/^{/,$p' | jq -er '.hash | select(type == "string" and length > 0)')"
            matching="$(eas build:list --platform "$platform" --build-profile production --status finished --fingerprint-hash "$hash" --limit 1 --json --non-interactive | jq 'length')"
            if [ "$matching" -gt 0 ]; then
              eas update \
                --channel production \
                --environment production \
                --platform "$platform" \
                --message "$message" \
                --non-interactive
              echo ":white_check_mark: $platform: OTA published to production (fingerprint \`$hash\`)" >> "$GITHUB_STEP_SUMMARY"
            else
              echo ":warning: $platform: no finished production build matches fingerprint \`$hash\` — OTA skipped; JS changes reach $platform only once a matching build ships" >> "$GITHUB_STEP_SUMMARY"
            fi
          done

<script>
  import { fetchLatestRelease, RELEASES_URL } from "../lib/releases";
 
  async function init() {
    const versionLabel = document.getElementById("version-label");
    // Only release-asset links; mobile store cards have no data-asset and keep their href.
    const cards = document.querySelectorAll<HTMLAnchorElement>("a[data-asset]");
 
    try {
      const release = await fetchLatestRelease();
 
      if (versionLabel && release.tag_name) {
        versionLabel.textContent = `Latest (${release.tag_name})`;
      }
 
      const changelogLink = document.getElementById("changelog-link") as HTMLAnchorElement | null;
      if (changelogLink && release.html_url) {
        changelogLink.href = release.html_url;
        changelogLink.style.display = "";
      }
 
      cards.forEach((card) => {
        const suffix = card.dataset.asset;
        if (!suffix) return;
 
        const match = (release.assets ?? []).find((a) => a.name.endsWith(`-${suffix}`));
        if (match) {
          card.href = match.browser_download_url;
        } else {
          card.href = RELEASES_URL;
        }
      });
    } catch {
      if (versionLabel) {
        versionLabel.textContent = "Could not load release info.";
      }
      cards.forEach((card) => {
        card.href = RELEASES_URL;
      });
    }
  }
 
  init();
</script>

if [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
  pkgname='t3code-bin'
elif [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-nightly\.[0-9]{8}\.[0-9]+$ ]]; then
  pkgname='t3code-nightly-bin'
else
  echo "Release $tag does not publish an AUR package."
  exit 0
fi
 
version="${tag#v}"
pkgver="${version//-/_}"
asset_name="T3-Code-${version}-x86_64.AppImage"
release_json="$(gh api "repos/$repo/releases/tags/$tag")"
asset_digest="$(jq -r --arg name "$asset_name" \
  '.assets[] | select(.name == $name) | .digest' <<<"$release_json")"
appimage_sha256="${asset_digest#sha256:}"
 
if [[ ! "$appimage_sha256" =~ ^[0-9a-f]{64}$ ]]; then
  echo "Release $tag is missing $asset_name or its SHA-256 digest." >&2
  exit 1
fi
 
work_dir="$(mktemp -d)"
trap 'rm -rf -- "$work_dir"' EXIT
gh api -H 'Accept: application/vnd.github.raw' \
  "repos/$repo/contents/LICENSE?ref=$tag" > "$work_dir/LICENSE"
license_sha256="$(sha256sum "$work_dir/LICENSE" | awk '{print $1}')"
 
package_dir="$repo_root/packaging/aur/$pkgname"
cd "$package_dir"
sed -Ei \
  -e "s/^pkgver=.*/pkgver=$pkgver/" \
  -e "s/^pkgrel=.*/pkgrel=$pkgrel/" \
  -e "/# AppImage$/s/'[0-9a-f]{64}'/'$appimage_sha256'/" \
  -e "/# upstream license$/s/'[0-9a-f]{64}'/'$license_sha256'/" \
  PKGBUILD