electron-builder.json5

// @see - https://www.electron.build/configuration/configuration
{
  "$schema": "https://raw.githubusercontent.com/electron-userland/electron-builder/master/packages/app-builder-lib/scheme.json",
  "appId": "com.etiennelescot.openscreen",
  "asar": true,
  "productName": "Openscreen",
  // There is deliberately no `electronVersion` here. electron-builder needs an EXACT
  // version because it downloads the binaries for one release, and it takes that from
  // package.json's `electron` devDependency, which is pinned without a caret for this
  // reason. Setting it here as well would make the version two facts that have to agree,
  // and nothing would notice when they stopped.
  //
  // The error that leads people here is "Electron version ... is a range, not a fixed
  // version", raised when the project has no `node_modules/electron` of its own — a git
  // worktree, typically, where module resolution finds the parent checkout's copy but
  // electron-builder looks only at the project's. The fix is `npm ci` in the worktree, not
  // a second declaration of the version.
  // Declared rather than left to default BECAUSE the default is package.json's `author` — one
  // name, where LICENSE has two holders. Feeds Info.plist's NSHumanReadableCopyright and the
  // Windows LegalCopyright, so leaving it implicit put an attribution on the binary that the
  // LICENSE it ships alongside does not make. Any other surface that renders this line must
  // repeat it byte-for-byte.
  "copyright": "© 2025-2026 OpenScreen contributors — MIT License",
  // Declared explicitly, NOT to start publishing from CI — every build still passes
  // `--publish never`, which suppresses uploading only. What this turns on is the update
  // METADATA: `latest.yml` / `latest-mac.yml` / `latest-linux.yml`, the `.blockmap` used for
  // differential downloads, `app-update.yml` inside resources, and the `package-type` marker
  // in deb/rpm/pacman that tells electron-updater which installer to run.
  //
  // Some of that was already being produced, because app-builder-lib falls back to inferring
  // the provider from `.git/config`'s origin when no publish config is declared — which works
  // in CI and silently stops working for anyone building from a source tarball. Declaring it
  // (plus `repository` in package.json) makes it deterministic instead of incidental.
  //
  // The Store (appx) target deliberately gets NO publish config: `isSuitableWindowsTarget()`
  // only writes `app-update.yml` for nsis, so the MSIX build cannot arm an updater that its
  // read-only container could never run. Do not add `appx.electronUpdaterAware`.
  "publish": [
    {
      "provider": "github",
      "owner": "getopenscreen",
      "repo": "openscreen"
    }
  ],
  // Fails the build when compositor_view.node is older than the crates/ Rust sources. Plain
  // `npm run build` does not rebuild the addon, and a stale one fails SILENTLY at runtime
  // (unknown scene fields are #[serde(default)]) rather than erroring. See the script header
  // and technical-documentation/engineering/build-and-packaging.md.
  "beforePack": "scripts/before-pack.cjs",
  // Writes app-update.yml into the macOS bundle, which `--mac --dir` never gets (#1431).
  "afterPack": "scripts/after-pack.cjs",
  // Standard AppImage updates need .upd_info and a .zsync alongside electron-updater's blockmap.
  "artifactBuildCompleted": "scripts/appimage-updates.cjs",
  "afterAllArtifactBuild": "scripts/appimage-updates.cjs",
  "npmRebuild": true,
  // sharp ships ABI-stable (napi) prebuilt binaries with bundled libvips. Building it from source
  // needs a system libvips we don't provide and breaks on CI/local ("vips-cpp.42 not found"), so we
  // let electron-builder use the prebuilt instead of recompiling.
  "buildDependenciesFromSource": false,
  // The static AppImage runtime does not require libfuse2 on the host.
  "toolsets": {
    "appimage": "1.0.3"
  },
  "compression": "normal",
  // Strip unused Chromium locale pak files (saves ~20 MB). Only package locales supported by OpenScreen.
  // Note: macOS uses underscore variants (e.g. pt_BR.lproj, zh_CN.lproj, zh_TW.lproj), while Windows
  // and Linux use hyphenated pak files (e.g. pt-BR.pak, zh-CN.pak, zh-TW.pak). Both forms are listed
  // so app-builder-lib retains the correct locale assets across all platforms.
  "electronLanguages": [
    "en-US",
    "fr",
    "ar",
    "cs",
    "de",
    "es",
    "it",
    "ja",
    "ko",
    "pt-BR",
    "pt_BR",
    "ru",
    "tr",
    "vi",
    "zh-CN",
    "zh_CN",
    "zh-TW",
    "zh_TW"
  ],
  "directories": {
    "output": "release/${version}",
    // Electron-builder's default, spelled out because the appx target depends on it:
    // it looks for Store tile assets in `<buildResources>/appx/` and, when that
    // directory is absent, silently packages its own vendored placeholders instead
    // (winCodeSign's SampleAppx.*.png — blank white squares). Shipping those failed
    // Store certification 10.1.1.11 "On Device Tiles". `build/appx/` is committed and
    // regenerated by `npm run assets:appx`.
    "buildResources": "build"
  },
  "files": [
    "dist",
    "dist-electron",
    // public/demo.gif and public/preview*.png are kept only so external pages that hotlink the
    // old raw.githubusercontent.com URLs keep working; Vite copies them into dist/, so drop them.
    "!dist/demo.gif",
    "!dist/preview*.png",
    // Exclude assets already bundled into extraResources (saves ~17 MB duplicate in asar)
    "!dist/wallpapers/**",
    "!dist/cursors/**",
    "!dist/mediapipe/**",
    "!dist/fonts/**",
    // Exclude dead-weight node_modules: all frontend and electron code is pre-bundled by Vite (saves ~238 MB)
    "!node_modules/**",
    "!*.png",
    "!preview*.png",
    "!*.md",
    "!README.md",
    "!CONTRIBUTING.md",
    "!LICENSE"
  ],
  // Asset layout contract: "wallpapers/" and "cursors/" under resourcesPath must
  // align with assetBaseDir in electron/preload.ts (packaged branch).
  // Native capture helpers + whisper-stt-server binaries (and their ggml
  // backend sidecars) live under `electron/native/bin/<platform>-<arch>/`
  // and the per-platform sections below limit them to the matching arch in
  // each installer.
  //
  // ponytail: the STT model (ggml-small-q8_0.bin) is downloaded into the
  // userData cache on first use by electron/stt/modelManager.ts, so no model
  // files are bundled at build time.
  "extraResources": [
    // Attribution + LGPL source offer for the bundled ffmpeg DLLs and
    // whisper.cpp binaries. Redistributing LGPL libraries obliges us to ship
    // the notice with them, so it goes in resources/, not just in the repo.
    {
      "from": "THIRD-PARTY-NOTICES.md",
      "to": "THIRD-PARTY-NOTICES.md"
    },
    // The full licence texts of the npm packages Vite bundles and of the crates compiled into
    // the compositor addon. Generated, not committed: every build:* script and build.yml's
    // macOS job run `npm run licenses:generate` first. electron-builder only warns about a
    // missing source here, so scripts/before-pack.cjs is what refuses to package without it.
    {
      "from": "build-licenses/THIRD-PARTY-LICENSES.txt",
      "to": "THIRD-PARTY-LICENSES.txt"
    },
    {
      "from": "LICENSE",
      "to": "LICENSE"
    },
    {
      "from": "public/wallpapers",
      "to": "wallpapers"
    },
    {
      "from": "public/cursors",
      "to": "cursors"
    },
    // The segmentation model, out of the asar for the same reason as the two above: the main
    // process resolves it with `original-fs` (see realExistsSync in compositorViewService.ts),
    // which cannot see inside app.asar, so a copy that ships only in `dist` resolves to null and
    // the compositor draws the webcam unsegmented — the whole camera-background feature, silently
    // off in every installer. 457 KB.
    {
      "from": "public/mediapipe",
      "to": "mediapipe"
    },
    // The only fonts captions and annotations are drawn in: the compositor registers them
    // privately (OPENSCREEN_FONTS_DIR, compositorViewService.ts) and never reads the machine's
    // installed fonts. Out of the asar for the same raw-path reason as the model above; the
    // renderer's picker specimens load the same copy through the asset base URL. 2.3 MB, with
    // each family's OFL text beside it as the licence requires.
    {
      "from": "public/fonts",
      "to": "fonts"
    }
  ],

  "mac": {
    // Declared, not merely documented. Electron 41's own LSMinimumSystemVersion is 12.0
    // and the .app inherits it verbatim when this key is absent — so before this line the
    // bundle advertised macOS 12 while its native payload was built for 13, and a
    // Monterey user got as far as the record button before anything went wrong (#515).
    // LaunchServices now refuses to open the app below 13 instead, which is the honest
    // signal.
    //
    // macOS 13 because ScreenCaptureKit capture requires it: ScreenCaptureRecorder is
    // `@available(macOS 13.0, *)`. Keep in step with README.md, website/docs/
    // installation.md, and electron/native/screencapturekit/Package.swift.
    "minimumSystemVersion": "13.0",
    "notarize": false,
    "hardenedRuntime": true,
    "entitlements": "macos.entitlements",
    "entitlementsInherit": "macos.entitlements",
    // Squirrel.Mac can only install from a ZIP, so auto-update needs one beside each DMG.
    // It is NOT listed here on purpose: the macOS job packs with `electron-builder --mac --dir`,
    // and `--dir` skips every target — so adding "zip" (or anything else) to this list would be
    // dead config that reads as if it worked. The DMG below is likewise hand-rolled with
    // `hdiutil` in build.yml, which is why the release assets are named `-macOS-Apple-Silicon-`
    // rather than following `artifactName`. The update ZIP is produced with `ditto` in the same
    // job, from the signed and stapled .app. Same trap as `linux.target` below, where the CLI
    // target list replaces this one.
    "target": [
      {
        "target": "dmg",
        "arch": ["x64", "arm64"]
      }
    ],
    "icon": "icons/icons/mac/icon.icns",
    "artifactName": "${productName}-Mac-${arch}-${version}-Installer.${ext}",
    "extraResources": [
      {
        "from": "electron/native/bin",
        "to": "electron/native/bin",
        "filter": ["darwin-*/*"]
      }
    ],
    "extendInfo": {
      "NSAudioCaptureUsageDescription": "OpenScreen needs audio capture permission to record system audio.",
      "NSMicrophoneUsageDescription": "OpenScreen needs microphone access to record voice audio.",
      "NSCameraUsageDescription": "OpenScreen needs camera access to record webcam video.",
      "NSScreenCaptureUsageDescription": "OpenScreen needs screen recording permission to detect and capture windows.",
      "NSCameraUseContinuityCameraDeviceType": true
    }
  },
  "linux": {
    // Cette liste ne suffit PAS à produire un artefact en CI : `build:linux` passe
    // ses cibles en ligne de commande (`electron-builder --linux AppImage deb pacman
    // rpm`), et la CLI REMPLACE `linux.target` au lieu de le compléter. Toute cible
    // ajoutée ici doit l'être aussi dans le script, sinon elle n'existe que pour un
    // `electron-builder --linux` nu, que rien n'exécute.
    "target": [
      "AppImage",
      "deb",
      "pacman",
      "rpm"
    ],
    "icon": "icons/icons/png",
    "artifactName": "${productName}-Linux-${version}.${ext}",
    "maintainer": "Etienne Lescot <etiennelescot@gmail.com>",
    "category": "AudioVideo",
    "extraResources": [
      {
        "from": "electron/native/bin",
        "to": "electron/native/bin",
        // `**`, not `*`: the capture helper's ffmpeg libraries live one level
        // deeper, in `linux-x64/helper-ffmpeg/`. They are in their own directory
        // because `linux-x64/` also holds the compositor addon's copies of the
        // same sonames with every symbol renamed to `osff_*`, and the helper
        // must not find those — see scripts/build-linux-pipewire-helper.mjs.
        // A single-level filter ships a helper that cannot start.
        //
        // The name is `helper-ffmpeg` rather than `ffmpeg` because that shorter
        // name is taken: `linux-x64/ffmpeg` is the ffmpeg executable (the SDK's
        // shared CLI, staged by build-linux-pipewire-helper.mjs with its RUNPATH
        // on helper-ffmpeg/), and audioPeaks.ts resolves it by that path.
        "filter": ["linux-*/**"]
      }
    ]
  },
  // Le compositeur natif rend via wgpu/Vulkan (crates/compositor/src/d3d_linux.rs).
  // Sans AUCUN ICD Vulkan installé, `request_adapter` ne rend rien : pas de pilote
  // GPU, et pas non plus le repli logiciel lavapipe — donc `probe()` répond `"none"`
  // et l'aperçu s'ouvre sur « Aperçu indisponible sur cette machine ». Le paquet
  // Mesa est ce qui garantit qu'au minimum le rastériseur logiciel existe.
  //
  // `depends` REMPLACE la liste par défaut d'electron-builder au lieu de s'y ajouter
  // (app-builder-lib, FpmTarget.getDefaultDepends) : le défaut y est repris verbatim,
  // de `libgtk-3-0` à `libsecret-1-0`, et en retirer une casse le paquet silencieusement.
  // Ce qui suit est à NOUS, et se lit par nom plutôt que par position — un compteur
  // « les N dernières » se périme à chaque ajout, et l'a déjà fait :
  // `mesa-vulkan-drivers`, `libgbm1`, `libasound2`, `libgomp1`, `xdg-desktop-portal`.
  //
  // L'AppImage n'a pas de mécanisme de dépendances et reste donc exposée : c'est
  // pour elle que `d3d_linux::diagnose` nomme le paquet à installer.
  //
  // `libgbm1`, `libasound2` et `libgomp1` comblent des sonames que rien ne déclarait ni
  // n'embarquait, mesurés sur la 1.9.1 installée dans une Ubuntu 22.04 nue :
  //
  //   libgbm1     — réclamé par le binaire Electron LUI-MÊME. Sans lui l'app sort en
  //                 127 sur `libgbm.so.1: cannot open shared object file`, avant toute
  //                 fenêtre. Absent du défaut d'electron-builder, qui n'a jamais suivi
  //                 le passage de Chromium à GBM.
  //   libasound2  — même binaire, même conséquence. Sur 24.04+ le paquet réel est
  //                 `libasound2t64`, qui `Provides: libasound2` : le nom court résout
  //                 sur les deux, comme `libgtk-3-0` plus haut.
  //   libgomp1    — l'OpenMP de GCC, réclamé par les 32 ELF de la pile STT
  //                 (whisper-stt-server, les libggml*, libwhisper, libparakeet). Sans
  //                 lui l'app démarre et seule la transcription meurt dans ld.so.
  //
  // Aucun n'a été vu avant parce que les métapaquets de bureau les tirent tous les
  // trois — libgomp1 seulement via libfftw3-single3, libimagequant0 et libsoxr0, trois
  // libs média périphériques. Une install minimale ou un WM monté à la main n'a
  // aucune de ces garanties. C'est ce que le job `verify-linux-package` prouve
  // désormais à chaque build, en interrogeant le loader plutôt que cette liste.
  //
  // `xdg-desktop-portal` est la MÊME classe de bug, et le job ci-dessus ne la verra
  // jamais : il interroge ld.so, or un portail est un service D-Bus et n'apparaît dans
  // aucun DT_NEEDED. Toute la capture Linux passe par lui — X11 compris, le helper
  // n'a pas d'autre chemin — et sans lui l'app affiche l'erreur zbus brute (#324).
  //
  // Le déclarer ne suffit PAS à lui seul, et il faut le dire clairement plutôt que
  // laisser croire que la ligne referme le sujet : le frontend ne fait que router, et
  // l'implémentation de ScreenCast vient d'un backend qui dépend du bureau
  // (-gnome, -kde, -hyprland, -wlr, -gtk). On ne peut pas en choisir un ici sans se
  // tromper sur la moitié des machines. Ce que la déclaration achète, c'est que la
  // contrainte devient explicite au lieu d'être héritée par accident du métapaquet de
  // bureau, exactement comme les trois sonames au-dessus. Le reste est fait à
  // l'exécution par `portal.rs::portal_unavailable`, qui nomme le backend à installer —
  // et c'est la seule moitié qui couvre l'AppImage, qui ne déclare rien.
  //
  // Nom identique sur les trois distributions, et vérifié plutôt que supposé :
  // `verify-linux-package.sh` installe réellement le paquet dans une image nue, où un nom
  // inexistant fait échouer la transaction entière — c'est comme ça que `http-parser` a
  // été pris sur pacman. Les trois formats répondent `ok install: declared depends
  // resolved` sur ubuntu:22.04, fedora:40 et archlinux:latest (run 31391020354).
  "deb": {
    "depends": [
      "libgtk-3-0",
      "libnotify4",
      "libnss3",
      "libxss1",
      "libxtst6",
      "xdg-utils",
      "libatspi2.0-0",
      "libuuid1",
      "libsecret-1-0",
      "mesa-vulkan-drivers",
      "libgbm1",
      "libasound2",
      "libgomp1",
      "xdg-desktop-portal"
    ]
  },
  "pacman": {
    // `vulkan-swrast` est le lavapipe d'Arch ; il tire `vulkan-icd-loader` avec lui.
    //
    // `mesa`, `alsa-lib` et `libgomp` sont les équivalents Arch des sonames décrits sur
    // `deb`, et `xdg-desktop-portal` y porte le même nom. Noms relevés dans un conteneur
    // archlinux, pas devinés : `libgomp.so.1` appartient à `libgomp` (core), PAS à
    // `gcc-libs` — il en a été sorti.
    //
    // `http-parser` A ÉTÉ RETIRÉ, et c'est la seule entrée de ce fichier qui s'écarte
    // volontairement du défaut d'electron-builder. Arch l'a supprimé de ses dépôts
    // (Node est passé à llhttp il y a des années) et RIEN ne le fournit plus, donc
    // pacman refusait la transaction entière : « unable to satisfy dependency
    // 'http-parser' ». Le paquet Arch de la 1.9.1 est intégralement non installable,
    // pour cette seule ligne. Aucun des 49 sonames du payload ne le réclame.
    //
    // `libappindicator-gtk3` est dans le même état de péremption mais reste correct :
    // `libappindicator` le déclare en `Provides` ET en `Replaces`, donc il résout.
    "depends": [
      "c-ares",
      "ffmpeg",
      "gtk3",
      "libevent",
      "libvpx",
      "libxslt",
      "libxss",
      "minizip",
      "nss",
      "re2",
      "snappy",
      "libnotify",
      "libappindicator-gtk3",
      "vulkan-swrast",
      "mesa",
      "alsa-lib",
      "libgomp",
      "xdg-desktop-portal"
    ]
  },
  "rpm": {
    // Même règle que ci-dessus : la liste REMPLACE le défaut d'electron-builder, donc
    // celui-ci est repris verbatim de `gtk3` à `(libuuid or libuuid1)`
    // (FpmTarget.getDefaultDepends, cas "rpm"). Le reste est à nous, par nom et non par
    // position : `libsecret`, `mesa-vulkan-drivers`, `mesa-libgbm`, `alsa-lib`,
    // `libgomp`, `xdg-desktop-portal`.
    //
    // `mesa-vulkan-drivers` porte le même nom sur Fedora que sur Debian : c'est le
    // paquet qui garantit lavapipe, sans quoi l'aperçu du compositeur est indisponible.
    //
    // `libsecret` n'est PAS dans le défaut rpm alors qu'il l'est dans le défaut deb
    // (`libsecret-1-0`). `safeStorage` chiffre les clés d'API des fournisseurs LLM
    // (electron/ai-edition/llm-config-store.ts) et passe par le Secret Service :
    // sans lui, `isEncryptionAvailable()` répond faux et l'enregistrement d'une clé
    // lève. Une omission d'electron-builder, pas un choix.
    //
    // `mesa-libgbm`, `alsa-lib` et `libgomp` sont les équivalents Fedora des sonames
    // décrits sur `deb`, relevés par `dnf provides` : `libgbm.so.1` vient de
    // `mesa-libgbm` et non du `mesa` d'Arch. `libgomp` fait partie de l'install de base
    // sur Fedora, donc le rpm y était moins exposé que le deb — le déclarer reste ce qui
    // rend la contrainte vraie plutôt que chanceuse. `xdg-desktop-portal` y porte le même
    // nom que sur Debian et Arch.
    "depends": [
      "gtk3",
      "libnotify",
      "nss",
      "libXScrnSaver",
      "(libXtst or libXtst6)",
      "xdg-utils",
      "at-spi2-core",
      "(libuuid or libuuid1)",
      "libsecret",
      "mesa-vulkan-drivers",
      "mesa-libgbm",
      "alsa-lib",
      "libgomp",
      "xdg-desktop-portal"
    ]
  },
  "win": {
    "target": [
      "nsis"
    ],
    "icon": "icons/icons/win/icon.ico",
    "artifactName": "${productName}.Setup.${version}-${arch}.${ext}",
    "extraResources": [
      {
        "from": "electron/native/bin",
        "to": "electron/native/bin",
        // The static ffmpeg.exe is excluded on purpose. scripts/fetch-ffmpeg.mjs
        // vendors two artifacts into this directory: the shared av*.dll set,
        // which the D3D11 compositor addon dlopens at require() time and
        // therefore MUST ship, and a standalone static ffmpeg.exe that nothing
        // in the app spawns. Shipping it added a large binary to every Windows
        // installer, plus an LGPL redistribution obligation, for a file no
        // shipped code opens.
        "filter": ["win32-*/*", "!win32-*/ffmpeg.exe"]
      }
    ],
    // The D3D11 compositor addon deliberately does NOT travel through `files` into
    // app.asar. It ships with the ffmpeg DLLs it links against, via the
    // `extraResources` entry above, because it has to sit in the SAME directory as
    // them — exactly like the Metal addon on macOS.
    //
    // It used to be listed here and unpacked to app.asar.unpacked/…, one directory
    // away from `electron/native/bin/win32-x64/*.dll`. That only ever worked because
    // `ensureFfmpegSharedDllsOnPath` prepends the DLL directory to PATH before the
    // require. MSIX ignores PATH when resolving dependent DLLs — it resolves through
    // the package graph — so the Store build of 1.9.0 loaded no compositor at all and
    // the editor ran with no preview while audio kept playing.
    //
    // Node loads .node files with LOAD_WITH_ALTERED_SEARCH_PATH, so the addon's own
    // directory is searched for its dependencies; colocation makes the load work with
    // no PATH at all, on every Windows packaging format.
  },
  "nsis": {
    "oneClick": false,
    "allowToChangeInstallationDirectory": true
  },
  // Microsoft Store packaging identity, from Partner Center's "Product identity" page
  // (Applications et jeux > OpenScreen > Product identity).
  "appx": {
    "identityName": "EtienneLescot.OpenScreen",
    "publisher": "CN=03B0FC8C-2067-45D9-BE82-9F15CE264B4A",
    "publisherDisplayName": "Etienne Lescot",
    "applicationId": "Openscreen",
    "displayName": "OpenScreen",
    "backgroundColor": "transparent",
    "capabilities": ["runFullTrust", "microphone", "webcam"],
    // `openscreen` on the PATH (%LOCALAPPDATA%\Microsoft\WindowsApps), so the CLI and
    // `openscreen mcp` have a path that survives Store updates: the package's own folder
    // is versioned. An execution alias needs Windows 10 1709 (16299); the app needs 1903.
    "customExtensionsPath": "build/appx-extensions.xml",
    "minVersion": "10.0.18362.0",
    // Mirrors SUPPORTED_LOCALES in src/i18n/config.ts. This list is what the Store
    // shows as "supported languages" on the product page and what lets the listing
    // surface in each language's Store search — declaring only en-US/fr-FR advertised
    // 2 of the 15 languages the app actually ships. Bare tags (ar, es, ...) match every
    // region of that language, which is what the renderer's locale resolution does too.
    "languages": [
      "en-US",
      "fr-FR",
      "ar",
      "cs",
      "de",
      "es",
      "it",
      "ja-JP",
      "ko-KR",
      "pt-BR",
      "ru",
      "tr",
      "vi",
      "zh-CN",
      "zh-TW"
    ],
    "showNameOnTiles": true
  }
}