mweinbach6/1/2026, 5:52:11 PM

Exclude *.map, *.map.json, *.tsbuildinfo, and .DS_Store from the
electron-builder bundle (files + extraResources filter). The stale
index.js.map (53 MB) in resources/binaries/ was the single largest
waste — removing it cuts the .app upload to Apple's notary service by
~50 MB.

Add a post-build prune step in build_desktop_resources.ts that removes
stale sourcemaps, tsbuildinfo, and .DS_Store from the binaries
directory so they never reach the bundle.

Add xcrun stapler staple after notarization succeeds, so the
notarization ticket is embedded in the .app for offline Gatekeeper
validation. Previously the CI step xcrun stapler validate would fail
without this. The staple helper is DI-friendly for testing.

Parent1c3b7b2