Justfile

label            := "com.jackwoods.streamdeck-plus"
binary           := "streamdeck-plus-darwin"
bundle_name      := "StreamDeckPlus.app"
bundle_path      := justfile_directory() / "dist" / bundle_name
bundle_binary    := bundle_path / "Contents" / "MacOS" / binary
installed_bundle := env_var('HOME') / "Applications" / bundle_name
installed_binary := installed_bundle / "Contents" / "MacOS" / binary
signing_cn       := "StreamDeckPlus CodeSign"
log_path         := justfile_directory() / "logs" / "streamdeck-plus.log"
plist_path       := env_var('HOME') / "Library" / "LaunchAgents" / (label + ".plist")

# List available recipes
default:
    @just --list

# Type-check the TypeScript sources
typecheck:
    @bun run typecheck

# One-time: create a stable self-signed code-signing cert in the login keychain (idempotent)
setup-signing:
    #!/usr/bin/env sh
    set -e
    if security find-certificate -c "{{signing_cn}}" >/dev/null 2>&1; then
        echo "signing cert already present — nothing to do."
        exit 0
    fi
    tmp=$(mktemp -d)
    trap 'rm -rf "$tmp"' EXIT
    # Force /usr/bin/openssl (LibreSSL). MacPorts/Homebrew OpenSSL 3.x
    # produces PKCS12 bags that macOS's `security` command can't decode,
    # failing with "MAC verification failed" regardless of -legacy flags.
    openssl=/usr/bin/openssl
    $openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
        -subj "/CN={{signing_cn}}" \
        -addext "keyUsage=critical,digitalSignature" \
        -addext "extendedKeyUsage=codeSigning" \
        -addext "basicConstraints=critical,CA:FALSE" \
        -keyout "$tmp/key.pem" -out "$tmp/cert.pem" 2>/dev/null
    # Throwaway password for the PKCS12 bag — `security import` rejects
    # empty-password bags. The private key lands ACL-protected in the
    # keychain after import, not password-protected.
    pw=$($openssl rand -hex 16)
    $openssl pkcs12 -export -out "$tmp/cert.p12" \
        -inkey "$tmp/key.pem" -in "$tmp/cert.pem" \
        -passout "pass:$pw" -name "{{signing_cn}}"
    security import "$tmp/cert.p12" \
        -k "$HOME/Library/Keychains/login.keychain-db" \
        -P "$pw" -T /usr/bin/codesign
    # Trust for code signing in the user's login keychain. Prompts for keychain password.
    security add-trusted-cert -r trustRoot -p codeSign \
        -k "$HOME/Library/Keychains/login.keychain-db" "$tmp/cert.pem"
    echo "signing cert '{{signing_cn}}' installed and trusted for codesigning."

# Compile the macOS binary, build + sign the .app bundle at dist/StreamDeckPlus.app
build:
    #!/usr/bin/env sh
    set -e
    bun run build:darwin
    # Build the bundle in a staging dir outside the project tree. ~/Documents
    # is typically iCloud-synced and the file provider daemon continuously
    # re-adds `com.apple.FinderInfo` xattrs that codesign refuses to sign
    # through. Staging outside iCloud keeps the bundle clean through signing;
    # ditto --noextattr strips residual xattrs when we copy back into dist/.
    staging=$(mktemp -d)
    trap 'rm -rf "$staging"' EXIT
    bundle="$staging/{{bundle_name}}"
    mkdir -p "$bundle/Contents/MacOS"
    swiftc -O "{{justfile_directory()}}/scripts/mediakey.swift" \
        -o "$bundle/Contents/MacOS/mediakey"
    mv "{{justfile_directory()}}/dist/{{binary}}" "$bundle/Contents/MacOS/{{binary}}"
    cp "{{justfile_directory()}}/scripts/Info.plist" "$bundle/Contents/Info.plist"
    if security find-certificate -c "{{signing_cn}}" >/dev/null 2>&1; then
        identity="{{signing_cn}}"
    else
        echo "warning: signing cert '{{signing_cn}}' not found — falling back to ad-hoc." >&2
        echo "  TCC grants will not persist across rebuilds. Run 'just setup-signing' once." >&2
        identity="-"
    fi
    # `bun build --compile` output (and swiftc's) carries a partial sig that
    # trips codesign's bundle pass with "invalid or unsupported format for
    # signature". Stripping any existing sig on each inner binary before the
    # bundle-level sign makes --deep succeed.
    codesign --remove-signature "$bundle/Contents/MacOS/{{binary}}" 2>/dev/null || true
    codesign --remove-signature "$bundle/Contents/MacOS/mediakey" 2>/dev/null || true
    codesign --force --deep --sign "$identity" "$bundle"
    # Replace the in-tree bundle via ditto --noextattr so the installed copy
    # starts clean of iCloud xattrs even though it lives under ~/Documents.
    rm -rf "{{bundle_path}}"
    mkdir -p "{{justfile_directory()}}/dist"
    ditto --noextattr "$bundle" "{{bundle_path}}"
    echo "Built {{bundle_path}}"

# Compile the Windows binary. Cross-building from macOS works for pure-TS
# sources, but `@napi-rs/canvas` and `@elgato-stream-deck/node` ship
# per-platform native modules — run this on a Windows host to get a
# binary that actually loads its native deps.
build-win32:
    @bun run build:win32

# Install the Scheduled Task (run in an elevated prompt on Windows)
install-win32:
    @{{justfile_directory()}}/dist/streamdeck-plus-win32.exe install

# Remove the Scheduled Task
uninstall-win32:
    @{{justfile_directory()}}/dist/streamdeck-plus-win32.exe uninstall

# Query the service state
status-win32:
    @{{justfile_directory()}}/dist/streamdeck-plus-win32.exe status

# Stop the running task
stop-win32:
    @{{justfile_directory()}}/dist/streamdeck-plus-win32.exe stop

# Stop + start the task (picks up a new binary)
restart-win32:
    @{{justfile_directory()}}/dist/streamdeck-plus-win32.exe restart

# Build + install (or restart) the launchd service
deploy: build
    #!/usr/bin/env sh
    set -e
    ditto "{{bundle_path}}" "{{installed_bundle}}"
    if launchctl list {{label}} >/dev/null 2>&1; then
        "{{installed_binary}}" restart
        echo "Deployed and restarted service."
    else
        "{{installed_binary}}" install
        echo "Deployed and installed service."
    fi

# Install the bundle to ~/Applications and register with launchd
install: build
    #!/usr/bin/env sh
    set -e
    ditto "{{bundle_path}}" "{{installed_bundle}}"
    "{{installed_binary}}" install

# Remove the launchd plist and the installed bundle
uninstall:
    #!/usr/bin/env sh
    if [ -x "{{installed_binary}}" ]; then
        "{{installed_binary}}" uninstall 2>/dev/null || true
    fi
    rm -rf "{{installed_bundle}}"
    # Also nuke any stale plist even if the installed binary is gone.
    rm -f "{{plist_path}}"

# Tell launchd to start the service
start:
    @"{{installed_binary}}" start

# Stop the running daemon
stop:
    @"{{installed_binary}}" stop 2>/dev/null || true

# Stop + start the service (picks up a new binary)
restart:
    @"{{installed_binary}}" restart

# Reconnect to the deck without restarting the daemon
reload:
    @"{{installed_binary}}" reload

# Show launchd status for the service
status:
    @"{{installed_binary}}" status

# Watch-mode dev: unloads the installed service first, reloads it on Ctrl+C
dev:
    #!/usr/bin/env sh
    set -e
    was_loaded=false
    if launchctl list {{label}} >/dev/null 2>&1; then
        was_loaded=true
        # `binary stop` asks the daemon to exit, but KeepAlive=true makes
        # launchd respawn it within seconds. Unload the plist instead so
        # the job is truly stopped for the duration of the dev session.
        launchctl unload "{{plist_path}}" 2>/dev/null || true
    fi
    # Match the binary name regardless of path — covers both dist/ and
    # ~/Applications/ locations and any stale processes.
    pkill -f "/{{binary}}$" 2>/dev/null || true
    sleep 1
    if pgrep -f "/{{binary}}$" >/dev/null 2>&1; then
        echo "ERROR: another prod binary is still holding the deck:" >&2
        pgrep -lf "/{{binary}}$" >&2
        echo "Kill it manually and re-run 'just dev'." >&2
        exit 1
    fi
    trap '
        echo ""
        if [ "$was_loaded" = true ]; then
            echo "Rebuilding and reloading installed service..."
            just deploy
        else
            echo "Exiting dev mode (no installed service to restore)."
        fi
    ' INT TERM
    LOG_LEVEL=debug bun run dev

# One-time Spotify OAuth bootstrap (writes data/state/spotify.json)
spotify-auth:
    @bun run dev spotify-auth

# Tail the launchd-managed log file
logs:
    @mkdir -p {{justfile_directory()}}/logs
    @tail -f {{log_path}}

# Re-fetch the curated Material Design Icons set
fetch-icons:
    @bun run fetch-icons

# Remove build artifacts
clean:
    @rm -rf dist