Bundling

npm install @ade-dev/runtime

@ade-dev/runtime-darwin-arm64/
  package.json          { "os": ["darwin"], "cpu": ["arm64"] }
  bin/ade               the runtime binary (ade.exe on Windows), mode 0755
  native/               ADE_RUNTIME_ROOT
    node_modules/       ADE_RUNTIME_NODE_MODULES — the modules the binary dlopens
    vendor/crsqlite/…   the cr-sqlite extension
    tuiClient/
  LICENSE
  RUNTIME-EMBEDDING-EXCEPTION.md
  README.md

import { createAdeChat } from "@ade-dev/sdk";

const ade = await createAdeChat({
  home: path.join(app.getPath("userData"), "ade"),
  allowDownload: false,
});

import { createAdeChat, resolvePackagedRuntime } from "@ade-dev/sdk";

const packaged = app.isPackaged ? resolvePackagedRuntime(process.resourcesPath) : null;

const ade = await createAdeChat({
  home: path.join(app.getPath("userData"), "ade"),
  ...(packaged ?? {}),
  allowDownload: false,
});

const runtime = path.join(process.resourcesPath, "ade-runtime");

const ade = await createAdeChat({
  home: path.join(app.getPath("userData"), "ade"),
  binaryPath: path.join(runtime, "bin", "ade"),
  runtimeNodeModules: path.join(runtime, "native", "node_modules"),
  allowDownload: false,
});

codesign --force --options runtime --timestamp \
  --entitlements entitlements.runtime.plist \
  --sign "$IDENTITY" \
  "$RESOURCES/ade-runtime/bin/ade"

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
  </dict>
</plist>

codesign --force --options runtime --timestamp --sign "$IDENTITY" "$file"

{
  "build": {
    "extraResources": [
      {
        "from": "node_modules/@ade-dev/runtime-darwin-arm64",
        "to": "ade-runtime",
        "filter": ["bin/**", "native/**"]
      }
    ],
    "mac": {
      "hardenedRuntime": true,
      "entitlements": "build/entitlements.mac.plist",
      "entitlementsInherit": "build/entitlements.mac.inherit.plist",
      "signIgnore": ["/Contents/Resources/ade-runtime/"],
      "notarize": true
    },
    "afterPack": "./scripts/sign-ade-runtime.cjs"
  }
}

// scripts/sign-ade-runtime.cjs — electron-builder `afterPack` hook
const { execFileSync } = require("node:child_process");
const fs = require("node:fs");
const path = require("node:path");

const MACHO_MAGIC = new Set([
  "feedface", "feedfacf", "cefaedfe", "cffaedfe",
  "cafebabe", "bebafeca", "cafebabf", "bfbafeca",
]);

function isMachO(file) {
  const handle = fs.openSync(file, "r");
  try {
    const head = Buffer.alloc(4);
    if (fs.readSync(handle, head, 0, 4, 0) < 4) return false;
    return MACHO_MAGIC.has(head.toString("hex"));
  } finally {
    fs.closeSync(handle);
  }
}

function* walk(dir) {
  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
    const full = path.join(dir, entry.name);
    if (entry.isDirectory()) yield* walk(full);
    else if (entry.isFile()) yield full;
  }
}

// The files to sign, in order: every Mach-O under native/ first, bin/ade last.
function signingPlan(runtimeDir, packageDir) {
  const manifestPath = path.join(packageDir, "signing", "manifest.json");
  if (fs.existsSync(manifestPath)) {
    const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
    return {
      entitlements: path.join(packageDir, manifest.entitlements),
      sign: manifest.sign.map((item) => ({ ...item, path: path.join(runtimeDir, item.path) })),
    };
  }
  const nativeFiles = [...walk(path.join(runtimeDir, "native"))].filter(isMachO).sort();
  return {
    entitlements: path.join(__dirname, "..", "build", "entitlements.runtime.plist"),
    sign: [
      ...nativeFiles.map((file) => ({ path: file, entitlements: false })),
      { path: path.join(runtimeDir, "bin", "ade"), entitlements: true },
    ],
  };
}

exports.default = async function signAdeRuntime(context) {
  if (context.electronPlatformName !== "darwin") return;
  // The full identity name, for example "Developer ID Application: Example Inc (TEAMID)".
  const identity = process.env.ADE_RUNTIME_SIGN_IDENTITY;
  if (!identity) throw new Error("Set ADE_RUNTIME_SIGN_IDENTITY.");
  const runtimeDir = path.join(
    context.appOutDir,
    `${context.packager.appInfo.productFilename}.app`,
    "Contents", "Resources", "ade-runtime",
  );
  // electron-builder's Arch enum: 1 = x64, 3 = arm64. Copy the matching
  // package in `extraResources` for each architecture you build.
  const archName = { 1: "x64", 3: "arm64" }[context.arch];
  if (!archName) throw new Error(`No ADE runtime package for arch ${context.arch}.`);
  const packageDir = path.dirname(require.resolve(`@ade-dev/runtime-darwin-${archName}/package.json`, {
    paths: [context.packager.projectDir],
  }));
  const plan = signingPlan(runtimeDir, packageDir);
  for (const item of plan.sign) {
    execFileSync("codesign", [
      "--force", "--options", "runtime", "--timestamp",
      ...(item.entitlements ? ["--entitlements", plan.entitlements] : []),
      "--sign", identity, item.path,
    ], { stdio: "inherit" });
  }
};

APP="dist/mac-arm64/My App.app"
codesign --verify --deep --strict --verbose=2 "$APP"
spctl --assess --type execute --verbose=4 "$APP"
codesign --display --entitlements - "$APP/Contents/Resources/ade-runtime/bin/ade"

const report = await ade.doctor();
console.log(report.runtime.source);     // "packaged" with resolvePackagedRuntime
console.log(report.runtime.signature);  // { signed: true, authority: "…", accepted: true }