docs: add the Mac App Store listing and its limitations (#1656)

* docs: add the Mac App Store listing and its limitations

GeoLibre Desktop is now on the Mac App Store, so the badge and download
links point at it. The Store build is sandboxed, so the docs spell out
what it drops relative to the Homebrew and DMG build (Python sidecar
engines, PostGIS, the local Jupyter server, Earth Engine sign-in, and
external plugin installs) and keep Homebrew as the recommended route.

* Address review feedback

- Say "App Store ID" for the numeric listing identifier instead of "Apple
  ID", which reads as a user account login, and note what App Store Connect
  calls it.
- Qualify what the Store build drops as server-backed PostgreSQL/PostGIS via
  martin, so the in-browser PGlite/PostGIS engine is not read as missing too.
- Name Apache Sedona in the retained SQL Workspace row and scope the sidecar
  row to the SedonaDB sidecar: IS_MAS_BUILD skips the sidecar probe and runs
  Sedona on the in-browser CereusDB engine, so Sedona SQL still works there.

* Address Claude review feedback

- Split the comma-spliced macOS packaging bullet so the Homebrew Cask is its
  own sentence rather than a trailing fragment.

Author: giswqs

README.md

@@ -8,6 +8,7 @@
 [![image](https://img.shields.io/conda/vn/conda-forge/geolibre.svg)](https://anaconda.org/conda-forge/geolibre)
 [![Conda Recipe](https://img.shields.io/badge/recipe-geolibre-green.svg)](https://github.com/conda-forge/geolibre-feedstock)
 [![Microsoft Store](https://img.shields.io/badge/Microsoft%20Store-GeoLibre-0078D4?logo=windows)](https://apps.microsoft.com/detail/9nwt67rv531x)
+[![Mac App Store](https://img.shields.io/badge/Mac%20App%20Store-GeoLibre-000000?logo=apple&logoColor=white)](https://apps.apple.com/app/geolibre-desktop/id6796848769)
 [![Google Play](https://img.shields.io/badge/Google%20Play-GeoLibre-01875F?logo=googleplay&logoColor=white)](https://play.google.com/store/apps/details?id=org.geolibre.app)
 [![AUR version](https://img.shields.io/aur/version/geolibre-bin?logo=archlinux&label=AUR)](https://aur.archlinux.org/packages/geolibre-bin)
 [![FlatPark](https://img.shields.io/badge/FlatPark-GeoLibre-4A90D9?logo=flatpak)](https://flatpark.org/apps/app.geolibre.GeoLibre/)
@@ -22,6 +23,7 @@ GeoLibre is built with **Tauri v2**, **React**, **TypeScript**, **MapLibre GL JS
 
 - **[Launch GeoLibre Web](https://web.geolibre.app/)** — the full app in your browser, nothing to install
 - **[Download the desktop app](https://geolibre.app/downloads/)** — Windows, macOS, and Linux installers
+- **[Get it on the Mac App Store](https://apps.apple.com/app/geolibre-desktop/id6796848769)** — the sandboxed macOS build
 - **[Get it on Google Play](https://play.google.com/store/apps/details?id=org.geolibre.app)** — the native Android app
 - **[1,000+ geoprocessing tools](https://geolibre.app/user-guide/processing/#geoprocessing-toolbox)** — the full toolbox, in the browser
 - **[Get started](https://geolibre.app/getting-started/)** — install, run from source, and configure

docs/downloads.md

@@ -74,6 +74,10 @@ after each upgrade:
 xattr -dr com.apple.quarantine "/Applications/GeoLibre Desktop.app"
 ```
 
+macOS has two builds to choose from. The **Homebrew / DMG** build is the full
+app; the **Mac App Store** build is sandboxed and drops the features Apple's
+rules do not allow (see [below](#mac-app-store)).
+
 ### Homebrew (recommended)
 
 GeoLibre is available as an official
@@ -108,6 +112,60 @@ by Apple, so Gatekeeper allows them to open without any extra steps:
 2. Open the DMG and drag **GeoLibre Desktop** into **Applications**.
 3. Launch GeoLibre Desktop from Applications.
 
+### Mac App Store
+
+GeoLibre Desktop is also on the
+[Mac App Store](https://apps.apple.com/app/geolibre-desktop/id6796848769), which
+installs and updates it like any other Store app, with no Terminal and no
+Gatekeeper prompt:
+
+[Get GeoLibre Desktop on the Mac App Store](https://apps.apple.com/app/geolibre-desktop/id6796848769){ .md-button .md-button--primary }
+
+#### What the Store build leaves out
+
+The App Store requires the App Sandbox and forbids downloading or running
+executable code that changes an app's features (guideline 2.5.2). GeoLibre's
+optional Python sidecar, Jupyter server, and martin tile server are all runtime
+downloads of executable code, so the Store build compiles them out rather than
+shipping them broken. Here is how the two macOS builds compare:
+
+| Feature | Homebrew / DMG | Mac App Store |
+| --- | --- | --- |
+| Whitebox toolbox (1,000+ WebAssembly tools) | Yes | Yes |
+| Processing → Vector, browser-engine Conversion, client raster tools | Yes | Yes |
+| SQL Workspace (DuckDB-WASM, PGlite/PostGIS, in-browser Apache Sedona on CereusDB) | Yes | Yes |
+| Python sidecar engines (GeoPandas vector, rasterio raster, GDAL conversion, SamGeo segmentation, the SedonaDB sidecar behind the Apache Sedona engine) | Yes | No |
+| Add Data → PostgreSQL / PostGIS (martin tile server) | Yes | No |
+| Notebook panel on a local JupyterLab server | Yes | JupyterLite only |
+| Installing external plugins from a zip or the registry | Yes | Built-in and bundled plugins only |
+| Earth Engine sign-in | Yes | No |
+| In-app update checks | Yes | Updates come from the Store |
+
+Everything client-side is unchanged: MapLibre and deck.gl rendering, Add Data for
+local and remote files, DuckDB-WASM vector reading, the Whitebox WASM toolbox,
+Turf/Pyodide vector tools, browser-engine conversions, client raster tools, the
+SQL Workspace, the Python console, in-browser detection and segmentation,
+geocoding, and collaboration. All three SQL engines still run, Apache Sedona
+included: without a sidecar it uses its in-browser CereusDB build, which carries
+the [attribute-SQL limitation](user-guide/sql-workspace.md#choosing-a-sql-engine)
+that engine has everywhere else.
+
+The sandbox also changes three behaviors:
+
+- **Loose shapefiles**: the app can only read files you picked in the dialog, so
+  select **every** shapefile part (`.shp`, `.dbf`, `.prj`, ...) at once, or load
+  a zipped shapefile. A `.shp` picked alone loads without attributes or CRS.
+- **API keys from the shell environment**: a sandboxed app does not inherit a
+  login shell, so enter keys in Settings instead.
+- **Reopening projects that reference local files**: the file grant ends with the
+  process, so after a relaunch a layer backed by a local path outside the app
+  container needs to be re-added.
+
+If you need the Python sidecar engines, Add Data → PostgreSQL/PostGIS through
+martin, a local Jupyter server, Earth Engine, or external plugins, install the
+Homebrew / DMG build instead. See [Mac App Store](mac-app-store.md) for the full
+technical detail.
+
 ## Linux installation
 
 GeoLibre offers several Linux install options. The AUR, COPR, and Flatpak

docs/features.md

@@ -244,7 +244,8 @@ See the [Plugin API](plugin-api.md) to build your own.
     - A guided update workflow with a startup update check and update preferences
 - Desktop packaging and distribution
     - MSIX packaging support, Windows Package Manager (winget) distribution as `OpenGeos.GeoLibre`, and a Windows portable zip build that runs without installation
-    - macOS installers signed with an Apple Developer ID certificate and notarized by Apple, so they open without a Gatekeeper workaround
+    - macOS installers signed with an Apple Developer ID certificate and notarized by Apple, so they open without a Gatekeeper workaround. An official [Homebrew Cask](https://github.com/Homebrew/homebrew-cask/blob/main/Casks/g/geolibre.rb) installs and upgrades them with no tap or trust step
+    - A sandboxed [Mac App Store](https://apps.apple.com/app/geolibre-desktop/id6796848769) build of the same app, which trades the Python sidecar engines, server-backed PostgreSQL/PostGIS layers via martin, the local Jupyter server, Earth Engine sign-in, and external plugin installs for Store installation and updates. The in-browser SQL engines, including PGlite/PostGIS, still run. See [Downloads](downloads.md#mac-app-store)
     - Linux AppImages that carry embedded update information and a published `.zsync`, so AppImageUpdate, AppImageLauncher, AppManager, and AM can update the app by transferring only the blocks that changed
 - Native Android app built from the same codebase with Tauri v2 mobile, published on [Google Play](https://play.google.com/store/apps/details?id=org.geolibre.app). See [Android](android.md)
     - A GitHub Actions workflow builds both the universal App Bundle that Play ships and signed, per-architecture sideload APKs (~40 MB)

docs/getting-started.md

@@ -8,6 +8,7 @@
 [![image](https://img.shields.io/conda/vn/conda-forge/geolibre.svg)](https://anaconda.org/conda-forge/geolibre)
 [![Conda Recipe](https://img.shields.io/badge/recipe-geolibre-green.svg)](https://github.com/conda-forge/geolibre-feedstock)
 [![Microsoft Store](https://img.shields.io/badge/Microsoft%20Store-GeoLibre-0078D4?logo=windows)](https://apps.microsoft.com/detail/9nwt67rv531x)
+[![Mac App Store](https://img.shields.io/badge/Mac%20App%20Store-GeoLibre-000000?logo=apple&logoColor=white)](https://apps.apple.com/app/geolibre-desktop/id6796848769)
 [![Google Play](https://img.shields.io/badge/Google%20Play-GeoLibre-01875F?logo=googleplay&logoColor=white)](https://play.google.com/store/apps/details?id=org.geolibre.app)
 [![AUR version](https://img.shields.io/aur/version/geolibre-bin?logo=archlinux&label=AUR)](https://aur.archlinux.org/packages/geolibre-bin)
 [![FlatPark](https://img.shields.io/badge/FlatPark-GeoLibre-4A90D9?logo=flatpak)](https://flatpark.org/apps/app.geolibre.GeoLibre/)
@@ -32,10 +33,12 @@ You can load browser-selected vector data supported by DuckDB-WASM Spatial, drag
 
 ### On the desktop
 
-The desktop app adds local filesystem dialogs, local MBTiles, local raster file reads, and project save/open. Installers are available for Windows, macOS, and Linux, including the Microsoft Store, Homebrew, winget, the AUR, COPR, and Flatpak.
+The desktop app adds local filesystem dialogs, local MBTiles, local raster file reads, and project save/open. Installers are available for Windows, macOS, and Linux, including the Microsoft Store, the Mac App Store, Homebrew, winget, the AUR, COPR, and Flatpak.
 
 [Download the desktop app](downloads.md){ .md-button .md-button--primary }
 
+On macOS, prefer the Homebrew or DMG build: the [Mac App Store](https://apps.apple.com/app/geolibre-desktop/id6796848769) build is sandboxed, so it drops the Python sidecar engines, Add Data → PostgreSQL/PostGIS via martin, the local Jupyter server, Earth Engine sign-in, and external plugin installs. See [what the Store build leaves out](downloads.md#what-the-store-build-leaves-out).
+
 ### In Jupyter
 
 The [`geolibre`](python.md) Python package embeds the full GeoLibre app in a Jupyter notebook and drives the map through an expanded leafmap-style API that syncs both ways, so UI edits read back from Python.

docs/index.md

@@ -183,7 +183,7 @@ what comes next, see the [Roadmap](roadmap.md).
 - **Attribute depth** — virtual fields, persistent attribute joins, an attribute form designer, a Raster Attribute Table, and editable source layers that write vector edits back to GeoPackage, GeoJSON, and PostGIS.
 - **Catalog browsers** — a QGIS-style Browser panel (Data Source Manager) plus panels for STAC, NASA Earthdata, Hugging Face, GeoLens, Natural Earth, Source Cooperative, ArcGIS Hub, Socrata, and CKAN.
 - **Media and capture** — map recording to video, route animation with a track-follow camera, a Camera Tour recorder, a Print Layout composer with Atlas / map series, in-browser ONNX/YOLO object detection, and a native-resolution geotagged photo viewer.
-- **Distribution** — embed-friendly URL parameters including `maponly`, a versioned `postMessage` API and the typed `@geolibre/embed` client for host pages, cross-platform installers (with a macOS Homebrew Cask and a Windows Microsoft Store listing), Docker for the browser app, and a native **Android** app built from the same codebase via Tauri v2 mobile on [Google Play](https://play.google.com/store/apps/details?id=org.geolibre.app) (see [Android](android.md)) with a responsive touch layout and offline improvements (Download Offline Area plus service-worker caching of the CDN-loaded Pyodide and PGlite/PostGIS engines).
+- **Distribution** — embed-friendly URL parameters including `maponly`, a versioned `postMessage` API and the typed `@geolibre/embed` client for host pages, cross-platform installers (with a macOS Homebrew Cask, a [Mac App Store](https://apps.apple.com/app/geolibre-desktop/id6796848769) listing for the sandboxed build, and a Windows Microsoft Store listing), Docker for the browser app, and a native **Android** app built from the same codebase via Tauri v2 mobile on [Google Play](https://play.google.com/store/apps/details?id=org.geolibre.app) (see [Android](android.md)) with a responsive touch layout and offline improvements (Download Offline Area plus service-worker caching of the CDN-loaded Pyodide and PGlite/PostGIS engines).
 
 ### Recently added
 

docs/mac-app-store.md

@@ -1,5 +1,14 @@
 # Mac App Store
 
+GeoLibre Desktop is published on the
+[Mac App Store](https://apps.apple.com/app/geolibre-desktop/id6796848769):
+
+[Get GeoLibre Desktop on the Mac App Store](https://apps.apple.com/app/geolibre-desktop/id6796848769){ .md-button .md-button--primary }
+
+For the user-facing comparison of the two macOS builds, see
+[Downloads](downloads.md#mac-app-store). This page documents how the Store build
+is produced and why it differs.
+
 GeoLibre Desktop ships on macOS two ways:
 
 - **Developer ID** (the default): the notarized `.dmg` published by
@@ -167,7 +176,9 @@ Creating the inputs (Apple Developer account required):
 
 1. Create the app record in App Store Connect for `org.geolibre.desktop`
    (the same team as the iOS `org.geolibre.app` record; the two are separate
-   apps).
+   apps). This is already done for GeoLibre Desktop, App Store ID `6796848769`
+   (the numeric listing identifier App Store Connect labels "Apple ID" on the App
+   Information page), so later releases start at step 2.
 2. Download the `geolibre-mas-pkg` artifact and upload the `.pkg` with the
    **Transporter** app (or `xcrun altool --upload-app -f <pkg> -t macos`).
 3. Fill in screenshots, description, and the privacy questionnaire

docs/roadmap.md

@@ -390,6 +390,7 @@
 - [x] **Editing GeoLens datasets in place**: a dataset added as GeoJSON can be redrawn with the GeoEditor or retyped in the attribute table, and the plugin's Edits section shows what changed and writes it back to the GeoLens dataset — added, moved, and deleted features become per-feature `POST`/`PUT`/`PATCH`/`DELETE` calls, with the row ids GeoLens assigns stamped back onto the layer. Private GeoLens rasters also render now, with the API key attached to exactly their tile URLs and nothing else
 - [x] Plugins can call `addZarrLayer` to use the Zarr renderer GeoLibre already ships instead of bundling their own, keep their own paint properties on custom layers so the Style panel's sliders actually do something, and expose layer groups of their own
 - [x] GeoLibre is on **[Google Play](https://play.google.com/store/apps/details?id=org.geolibre.app)**, so Android users can install the signed, auto-updating build in one tap instead of sideloading an APK (see [Downloads](downloads.md#android-installation))
+- [x] GeoLibre Desktop is on the **[Mac App Store](https://apps.apple.com/app/geolibre-desktop/id6796848769)**, a sandboxed build of the same app that installs and updates through the Store. It trades the Python sidecar engines, server-backed PostgreSQL/PostGIS layers via martin, the local Jupyter server, Earth Engine sign-in, and external plugin installs for that convenience, so the Homebrew and DMG builds remain the full-feature route (see [Downloads](downloads.md#mac-app-store))
 - [x] Linux **AppImage releases now carry update information and a `.zsync`**, so AppImageUpdate, AppImageLauncher, AppManager, and AM can update the app and transfer only the blocks that changed instead of the whole download
 - [x] All 15 non-English locales are back at 100% coverage, Georgian included