[Bccorb]

The desktop half of #137: a runnable desktop app and backend, and the native apps guide. The CLI half waits on fells-code/seamless-cli#316 and is a marked placeholder that claims nothing, so #137 stays open.

Refs #137

The example (examples/native-desktop/)

• Electron 44.9.2 app: signs in through the system browser with PKCE S256 and a loopback redirect on an OS-picked port, no client secret, no webview. Tokens live in the OS keychain through @napi-rs/keyring (pinned to secret-service on Linux, where it otherwise falls back silently to a memory-only keyring).
• Express backend: verifies access tokens with createResourceServer from published @seamless-auth/express 0.24.0, requires a recent phishing-resistant sign-in on one route, and sends an account notice through the client link.
• Electron over Tauri for CI cost: Playwright drives both the app and the hosted page, and Tauri needs a Rust build and WebKitGTK on the runner.
• tsconfig.json excludes examples, so nothing reaches the site build.

The guide

Extends build/native-apps-oidc: keychain storage, a versions table, the three registry records, backend verification with the client_id allowlist, step-up, notices through a link, the runnable example, and where DPoP will fit (marked not shipped). API v0.23.0 is labelled unpublished wherever links or clientId appear. It also corrects a claim: on edge v0.3.0 a native client's loopback post_logout_redirect_uri matches on any port (tested).

What was run

e2e/run.mjs against the local recipe: 64 of 64 checks on macOS and in an Ubuntu 24.04 container under xvfb-run and gnome-keyring. It covers state refusal, the listener not reachable off loopback, the refresh token in the keychain and in no file, max_age expiry and the challenge, the backend refusing its own client credentials token, restore on relaunch, revocation and sign-out. The new workflow has not run on GitHub until this PR. It was run at recipe commit ddd5009; the pin is now the merge commit 30be59b, whose local/ is identical.

Not tested

The OS opening a real browser (Playwright's Chromium stands in), a real passkey (virtual authenticator), Windows Credential Manager, a packaged and signed build, a private-use scheme redirect, fail-closed with no Secret Service, and the refresh token replay rule.

Known gaps

• The recipe's seed does not set noticesEnabled, so scripts/enable-notices.mjs does. The recipe's mailbox also drops the subject, so only the body attribution is asserted.
• Until API v0.23.0 ships, CI runs an API built from source, not the "released API and edge" ADR 0002 N11 asks for.
• The page says CI runs on a schedule, which is true once this merges. The example's GitHub link 404s until then.