v0.7.0-alpha.10

What to Download (below)

• Mac users: download the .dmg
• Windows users: download the "setup" .exe
• Linux: you know what you want

What's Changed

Root cause identified: The jose library v6 is ESM-only ("type": "module") and was loaded via await import('jose') from the CJS main process. In packaged Electron apps, dynamic ESM imports from CJS can fail silently due to module resolution differences between dev and production. This is the most likely reason Apple Music auth fails for the end user despite the .p8 key being present in the build.

Key changes:

1. Replaced jose with Node.js built-in crypto (main.js:1838-1870) - Uses crypto.createPrivateKey() + crypto.sign() with dsaEncoding: 'ieee-p1363' for ES256 JWT signing. Zero external dependencies, works reliably in all environments.

2. Fixed playlists-delete-from-source handler (main.js:4000) - Was only checking store.get('applemusic_developer_token'), now properly falls back to generatedMusicKitToken like all other handlers.

3. Better error diagnostics - sync:check-auth now returns specific reasons ("Missing developer token" vs "Missing user token") and the UI toast shows the actual error instead of a generic message.

4. Added musickit:token-status diagnostic IPC (preload.js, main.js:2123) - Can be called from DevTools console via window.electron.musicKit.tokenStatus() to check: key file found, token generated, user token stored, etc.

If this fix works (which I believe it will), the developer token should generate correctly from the bundled .p8 key on the user's machine.

Also:

• A number of other improvements to error handling in Apple Music connections
• Upgrade SoundCloud OAuth to 2.1 with PKCE and CSRF protection #363

Full Changelog: v0.7.0-alpha.9...v0.7.0-alpha.10