@akanjs/devkit 3.0.0-beta.27 → 3.0.0-beta.29

package/mobile/nativeConfig.ts

@@ -1,6 +1,16 @@
+import { readFileSync } from "node:fs";
 import path from "node:path";
 import type { AkanNativeConfig } from "@akanjs/native/config";
-import type { AkanMobileTargetConfig, AkanNativeValue, AkanPluginNativeConfig, MobilePermission } from "akanjs";
+import type {
+  AkanMobileTargetConfig,
+  AkanNativeValue,
+  AkanPluginNativeConfig,
+  MobileEnv,
+  MobilePermission,
+} from "akanjs";
+import type { DesktopServerBundle } from "./desktopServerStage";
+import { type NativePlatform, resolveAppId } from "./mobileTarget";
+import type { NativePluginFolder } from "./nativePluginFolders";
 import { toIosInfoPlistUsageDescriptions } from "./usageDescriptions";
 
 export interface NativeConfigInput {
@@ -12,6 +22,15 @@ export interface NativeConfigInput {
   /** What the app's and its libs' plugins declare. */
   contributions: AkanPluginNativeConfig[];
   locales: readonly string[];
+  /** The backend the binary talks to; an updates channel left unnamed follows it. */
+  env?: MobileEnv;
+  platform: NativePlatform;
+  /** A desktop build that carries its server (the target's `native.desktop.server`). */
+  desktopServer?: DesktopServerBundle;
+  /** The plugins in the app's and its libs' `native/` folders. */
+  nativePlugins?: NativePluginFolder[];
+  /** A desktop build's staged `bin` executables (DesktopBin). */
+  desktopBin?: string;
 }
 
 export interface NativeConfigResult {
@@ -68,7 +87,18 @@ export class NativeConfig {
     speech: { permission: "speech" },
   };
 
-  static build({ appPath, target, webDir, contributions, locales }: NativeConfigInput): NativeConfigResult {
+  static build({
+    appPath,
+    target,
+    webDir,
+    contributions,
+    locales,
+    env,
+    platform,
+    desktopServer,
+    nativePlugins = [],
+    desktopBin,
+  }: NativeConfigInput): NativeConfigResult {
     const warnings: string[] = [];
     const applied = (target.permissions ?? []).flatMap((permission) => {
       const claimed = contributions.filter((contribution) => contribution.permission === permission);
@@ -78,13 +108,30 @@ export class NativeConfig {
       return used;
     });
     const abs = (relative: string) => path.resolve(appPath, relative);
+    const updates = NativeConfig.#updates(target, env);
+    const folders = new Set(nativePlugins.map((plugin) => path.resolve(plugin.dir)));
+    const folderIds = new Set(nativePlugins.map((plugin) => plugin.id));
+    //? A `native/<id>` folder ships by itself; listed again, by path or by id, it would reach the runtime twice.
+    const listed = (target.native?.plugins ?? []).filter((spec) =>
+      NativeConfig.#isId(spec) ? !folderIds.has(spec) : !folders.has(path.resolve(appPath, spec)),
+    );
     const plugins = [
       ...new Set([
         ...NativeConfig.basePlugins,
+        //? Windows and Linux open a link by starting the app again; without the hand-over it runs as a second app and
+        //? the instance whose auth-session start() waits for the callback never hears it.
+        ...(target.deepLinks?.schemes?.length ? ["single-instance"] : []),
         ...applied.flatMap((contribution) => contribution.plugins ?? []),
-        ...(target.native?.plugins ?? []),
+        //? A second copy of the app would start a second server on the same data.
+        ...(desktopServer ? ["single-instance"] : []),
+        ...(updates ? ["updates"] : []),
+        ...listed,
+        ...nativePlugins.map((plugin) => plugin.dir),
       ]),
     ];
+    const pluginIds = plugins.map(
+      (spec) => nativePlugins.find((plugin) => plugin.dir === spec)?.id ?? NativeConfig.#pluginId(appPath, spec),
+    );
     const usageDescriptions = Object.fromEntries(
       Object.entries(
         toIosInfoPlistUsageDescriptions(
@@ -119,9 +166,17 @@ export class NativeConfig {
     const resources = Object.entries(target.files ?? {}).map(([to, from]) => ({ from: abs(from), to }));
     const native = NativeConfig.#compact({ ios, android, resources });
     const googleServices = target.native?.android?.googleServices;
+    const pushAndroid = target.native?.push?.android;
+    const desktop = NativeConfig.#compact<NonNullable<AkanNativeConfig["desktop"]>>({
+      recovery: target.native?.desktop?.recovery,
+      screenCapture: target.native?.desktop?.screenCapture,
+      window: NativeConfig.#compact({ ...target.native?.desktop?.window }),
+      server: desktopServer,
+      bin: desktopBin,
+    });
     const config: AkanNativeConfig = {
       app: {
-        id: target.appId,
+        id: resolveAppId(target.appId, platform),
         name: target.appName,
         fileName: target.fileName ?? NativeConfig.fileNameOf(path.basename(appPath)),
         version: target.version,
@@ -135,7 +190,7 @@ export class NativeConfig {
         {
           identifier: "app",
           description: `The plugins ${target.appName} ships, each with its default permissions`,
-          permissions: plugins.map((plugin) => `${plugin}:default`),
+          permissions: pluginIds.map((id) => `${id}:default`),
         },
       ],
       ...(Object.keys(usageDescriptions).length ? { usageDescriptions } : {}),
@@ -143,20 +198,74 @@ export class NativeConfig {
         ? { deepLinks: NativeConfig.#deepLinks(target, locales) }
         : {}),
       ...(native ? { native } : {}),
+      ...(updates ? { updates } : {}),
+      ...(pushAndroid
+        ? {
+            push: {
+              android: { ...pushAndroid, ...(pushAndroid.smallIcon ? { smallIcon: abs(pushAndroid.smallIcon) } : {}) },
+            },
+          }
+        : {}),
+      ...(target.native?.privacy ? { privacy: target.native.privacy } : {}),
       //? assetlinks.json vouches for `<appId>.debug` outside main, the suffix a debug build installs under.
-      android: { debugAppIdSuffix: ".debug", ...(googleServices ? { googleServices: abs(googleServices) } : {}) },
+      android: {
+        debugAppIdSuffix: ".debug",
+        ...(googleServices ? { googleServices: abs(googleServices) } : {}),
+        ...(target.native?.android?.autoplay ? { autoplay: true } : {}),
+      },
       keyboard: { resize: "none" },
-      ...(target.assets?.icon ? { icon: abs(target.assets.icon) } : {}),
-      ...(target.assets?.splash ? { splash: { image: abs(target.assets.splash) } } : {}),
+      ...(desktop ? { desktop } : {}),
+      ...(target.assets?.icon ? { icon: NativeConfig.#icon(target.assets.icon, abs) } : {}),
+      ...(target.assets?.splash ? { splash: NativeConfig.#splash(target.assets.splash, abs) } : {}),
     };
     return { config, warnings };
   }
 
+  static #icon(
+    icon: NonNullable<NonNullable<AkanMobileTargetConfig["assets"]>["icon"]>,
+    abs: (relative: string) => string,
+  ): NonNullable<AkanNativeConfig["icon"]> {
+    return typeof icon === "string" ? abs(icon) : { ...icon, image: abs(icon.image) };
+  }
+
+  static #splash(
+    splash: NonNullable<NonNullable<AkanMobileTargetConfig["assets"]>["splash"]>,
+    abs: (relative: string) => string,
+  ): NonNullable<AkanNativeConfig["splash"]> {
+    if (typeof splash === "string") return { image: abs(splash) };
+    return { ...splash, ...(splash.image ? { image: abs(splash.image) } : {}) };
+  }
+
+  //? akanConfig refuses a target whose merged updates lack url or publicKey; the type still has them optional.
+  static #updates(
+    target: AkanMobileTargetConfig,
+    env?: MobileEnv,
+  ): NonNullable<AkanNativeConfig["updates"]> | undefined {
+    const { url, publicKey, channel = env, ...rest } = target.updates ?? {};
+    return url && publicKey ? { ...rest, url, publicKey, ...(channel ? { channel } : {}) } : undefined;
+  }
+
   /** Letters, digits, `.`, `_` and `-` only; the folder name of an akan app already is one almost always. */
   static fileNameOf(name: string) {
     return name.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[-.]+|[-.]+$/g, "") || "app";
   }
 
+  //? A permission names a plugin by its id, and a plugin given by folder is named in its manifest; a spec the runtime
+  //? cannot read is left as it is for the runtime to report.
+  static #pluginId(appPath: string, spec: string) {
+    if (NativeConfig.#isId(spec)) return spec;
+    try {
+      const { id } = JSON.parse(readFileSync(path.join(path.resolve(appPath, spec), "native-plugin.json"), "utf8"));
+      return typeof id === "string" ? id : spec;
+    } catch {
+      return spec;
+    }
+  }
+
+  static #isId(spec: string) {
+    return !spec.startsWith(".") && !path.isAbsolute(spec);
+  }
+
   /** Drops empty arrays and objects, and answers undefined when nothing is left. */
   static #compact<T extends object>(value: { [key: string]: unknown }): T | undefined {
     const kept = Object.entries(value).filter(([, entry]) =>

package/mobile/nativePluginFolders.test.ts

@@ -0,0 +1,81 @@
+import { describe, expect, test } from "bun:test";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import type { App } from "../commandDecorators";
+import { tempDirs } from "../testHelpers";
+import { NativePluginFolders } from "./nativePluginFolders";
+
+const makeTempRoot = tempDirs("akan-native-plugin-folders-");
+
+const writePlugin = async (root: string, folder: string, id: unknown = folder) => {
+  const dir = path.join(root, "native", folder);
+  await mkdir(dir, { recursive: true });
+  await writeFile(path.join(dir, "native-plugin.json"), JSON.stringify({ id, apiVersion: 1, methods: [] }));
+  return dir;
+};
+
+const fakeApp = (root: string, libs: string[]) =>
+  ({
+    name: "board",
+    cwdPath: path.join(root, "apps", "board"),
+    workspace: { workspaceRoot: root },
+    getScanInfo: () => ({ getLibs: () => libs }),
+  }) as unknown as App;
+
+describe("NativePluginFolders", () => {
+  test("finds each plugin folder in native/, by name", async () => {
+    const root = await makeTempRoot();
+    const kiosk = await writePlugin(root, "kiosk");
+    const audio = await writePlugin(root, "audio-output");
+    await writeFile(path.join(root, "native", "README.md"), "notes");
+
+    expect(await NativePluginFolders.in(root, "apps/board")).toEqual([
+      { id: "audio-output", dir: audio, owner: "apps/board" },
+      { id: "kiosk", dir: kiosk, owner: "apps/board" },
+    ]);
+  });
+
+  test("answers nothing for an app with no native folder", async () => {
+    expect(await NativePluginFolders.in(await makeTempRoot(), "apps/board")).toEqual([]);
+  });
+
+  test("refuses a folder without a manifest, or one named apart from its id", async () => {
+    const root = await makeTempRoot();
+    await mkdir(path.join(root, "native", "helpers"), { recursive: true });
+    await expect(NativePluginFolders.in(root, "apps/board")).rejects.toThrow(
+      "apps/board/native/helpers has no native-plugin.json",
+    );
+
+    const other = await makeTempRoot();
+    await writePlugin(other, "kiosk-tools", "kiosk");
+    await expect(NativePluginFolders.in(other, "libs/kiosk")).rejects.toThrow(
+      'libs/kiosk/native/kiosk-tools/native-plugin.json has id "kiosk"; name the folder after its id.',
+    );
+  });
+
+  test("the app's own plugin wins an id, and two libs may not both hold one", () => {
+    const app = { id: "kiosk", dir: "/w/apps/board/native/kiosk", owner: "apps/board" };
+    const libKiosk = { id: "kiosk", dir: "/w/libs/signage/native/kiosk", owner: "libs/signage" };
+    const libAudio = { id: "audio", dir: "/w/libs/signage/native/audio", owner: "libs/signage" };
+
+    expect(NativePluginFolders.select([app], [libKiosk, libAudio])).toEqual([app, libAudio]);
+    expect(() =>
+      NativePluginFolders.select(
+        [],
+        [libKiosk, { ...libKiosk, dir: "/w/libs/venue/native/kiosk", owner: "libs/venue" }],
+      ),
+    ).toThrow('libs/signage and libs/venue both hold native plugin "kiosk"; give the app its own native/kiosk');
+  });
+
+  test("an app ships its own plugins and those of the libs it depends on, not of other libs", async () => {
+    const root = await makeTempRoot();
+    const own = await writePlugin(path.join(root, "apps", "board"), "kiosk");
+    const used = await writePlugin(path.join(root, "libs", "signage"), "audio");
+    await writePlugin(path.join(root, "libs", "unused"), "camera-rig");
+
+    expect(await NativePluginFolders.of(fakeApp(root, ["signage"]))).toEqual([
+      { id: "kiosk", dir: own, owner: "apps/board" },
+      { id: "audio", dir: used, owner: "libs/signage" },
+    ]);
+  });
+});

package/mobile/nativePluginFolders.ts

@@ -0,0 +1,60 @@
+import { readdir } from "node:fs/promises";
+import path from "node:path";
+import type { App } from "../commandDecorators";
+
+export interface NativePluginFolder {
+  id: string;
+  /** Absolute: the native build takes a plugin that is not builtin by its folder. */
+  dir: string;
+  /** Whose `native/` holds it: `apps/<app>` or `libs/<lib>`. */
+  owner: string;
+}
+
+//* An app's and its libs' own native plugins, each in `native/<id>/` beside its `native-plugin.json`. Every mobile and
+//* desktop target of the app ships them (the manifest says per platform what runs there); a lib's reach only the apps
+//* that depend on it.
+export class NativePluginFolders {
+  static readonly folder = "native";
+
+  static async in(root: string, owner: string): Promise<NativePluginFolder[]> {
+    const base = path.join(root, NativePluginFolders.folder);
+    const entries = await readdir(base, { withFileTypes: true }).catch(() => []);
+    const folders = entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+    return await Promise.all(
+      folders.sort().map(async (name) => {
+        const where = `${owner}/${NativePluginFolders.folder}/${name}`;
+        const manifest = Bun.file(path.join(base, name, "native-plugin.json"));
+        if (!(await manifest.exists()))
+          throw new Error(`${where} has no native-plugin.json; a folder in native/ is one native plugin.`);
+        const { id } = (await manifest.json()) as { id?: unknown };
+        if (id !== name)
+          throw new Error(`${where}/native-plugin.json has id ${JSON.stringify(id)}; name the folder after its id.`);
+        return { id, dir: path.join(base, name), owner };
+      }),
+    );
+  }
+
+  /** The app's own plugin wins an id; two libs may not both claim one. */
+  static select(own: NativePluginFolder[], fromLibs: NativePluginFolder[]): NativePluginFolder[] {
+    const chosen = new Map(own.map((plugin) => [plugin.id, plugin]));
+    for (const plugin of fromLibs) {
+      const held = chosen.get(plugin.id);
+      if (!held) chosen.set(plugin.id, plugin);
+      else if (held.owner.startsWith("libs/"))
+        throw new Error(
+          `${held.owner} and ${plugin.owner} both hold native plugin "${plugin.id}"; give the app its own native/${plugin.id} to pick one.`,
+        );
+    }
+    return [...chosen.values()];
+  }
+
+  static async of(app: App): Promise<NativePluginFolder[]> {
+    const scanInfo = app.getScanInfo({ allowEmpty: true }) ?? (await app.scan({ write: false }));
+    const root = app.workspace.workspaceRoot;
+    const [own, ...fromLibs] = await Promise.all([
+      NativePluginFolders.in(app.cwdPath, `apps/${app.name}`),
+      ...scanInfo.getLibs().map((lib) => NativePluginFolders.in(path.join(root, "libs", lib), `libs/${lib}`)),
+    ]);
+    return NativePluginFolders.select(own ?? [], fromLibs.flat());
+  }
+}

package/mobile/nativeWebDir.ts

@@ -34,12 +34,16 @@ export class NativeWebDir {
   }
   static readonly #targetTag = "<script>window.__AKAN_MOBILE_TARGET__=";
 
+  async clear() {
+    await rm(this.dir, { recursive: true, force: true });
+    await mkdir(this.dir, { recursive: true });
+  }
+
   /** Rebuilds the folder from scratch and answers its files as web paths: relative, `/`-separated and sorted. */
   async assemble(target: AkanMobileTargetConfig, { html, publicDir, fontsDir }: NativeWebDirSources) {
     if (!(await Bun.file(html).exists()))
       throw new Error(`CSR html for mobile target '${target.name}' not found: ${html}`);
-    await rm(this.dir, { recursive: true, force: true });
-    await mkdir(this.dir, { recursive: true });
+    await this.clear();
     if (publicDir && (await NativeWebDir.#isDir(publicDir))) await cp(publicDir, this.dir, { recursive: true });
     if (fontsDir && (await NativeWebDir.#isDir(fontsDir)))
       await cp(fontsDir, path.join(this.dir, "_akan", "fonts"), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akanjs/devkit",
-  "version": "3.0.0-beta.27",
+  "version": "3.0.0-beta.29",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -47,7 +47,7 @@
     "@earendil-works/pi-tui": "0.86.1",
     "@inquirer/prompts": "^8.4.3",
     "@tailwindcss/node": "^4.3.0",
-    "akanjs": "3.0.0-beta.27",
+    "akanjs": "3.0.0-beta.29",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "dayjs": "^1.11.20",

package/transforms/serverEnvPlugin.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import { tempDirs, writeText as write } from "../testHelpers";
+import { createServerEnvPlugin } from "./serverEnvPlugin";
+
+const makeTempRoot = tempDirs("akan-devkit-server-env-");
+const environments = ["local", "testing", "debug", "develop", "main", "qa"];
+
+const writeApp = async (root: string) => {
+  const envDir = path.join(root, "apps/demo/env");
+  await write(
+    path.join(envDir, "env.server.ts"),
+    [
+      ...environments.map((name) => `import { env as ${name} } from "./env.server.${name}";`),
+      `const envConfigs = { ${environments.join(", ")} };`,
+      'const currentEnv = process.env.AKAN_PUBLIC_ENV ?? "local";',
+      "export const env = envConfigs[currentEnv as keyof typeof envConfigs];",
+      "",
+    ].join("\n"),
+  );
+  await write(path.join(envDir, "env.server.type.ts"), 'export const libEnv = { shared: "shared-value" };\n');
+  for (const name of environments)
+    await write(
+      path.join(envDir, `env.server.${name}.ts`),
+      [
+        'import { libEnv } from "./env.server.type";',
+        `export const env = { ...libEnv, secret: "${name}-secret" };`,
+        `export default "${name}-default";`,
+        "",
+      ].join("\n"),
+    );
+  const entry = path.join(root, "apps/demo/server.ts");
+  await write(entry, 'import { env } from "./env/env.server";\nconsole.info(JSON.stringify({ ...env }));\n');
+  return { envDir, entry };
+};
+
+const build = async (root: string, environment: string) => {
+  const { envDir, entry } = await writeApp(root);
+  const result = await Bun.build({
+    entrypoints: [entry],
+    outdir: path.join(root, "out"),
+    target: "bun",
+    plugins: [createServerEnvPlugin({ envDir, environment, environments })],
+  });
+  expect(result.success).toBe(true);
+  const output = result.outputs.find((artifact) => artifact.kind === "entry-point");
+  if (!output) throw new Error("no entry output");
+  return { file: output.path, text: await output.text() };
+};
+
+const run = (file: string, environment: string) =>
+  Bun.spawnSync([process.execPath, file], { env: { ...process.env, AKAN_PUBLIC_ENV: environment } });
+
+describe("createServerEnvPlugin", () => {
+  test("bundles only the environment the image runs", async () => {
+    const { text } = await build(await makeTempRoot(), "main");
+    expect(text).toContain("main-secret");
+    expect(text).toContain("shared-value");
+    for (const name of environments.filter((name) => name !== "main")) {
+      expect(text).not.toContain(`${name}-secret`);
+      expect(text).not.toContain(`${name}-default`);
+    }
+  });
+
+  test("the built environment boots with its own values", async () => {
+    const { file } = await build(await makeTempRoot(), "main");
+    const proc = run(file, "main");
+    expect(proc.exitCode).toBe(0);
+    expect(JSON.parse(proc.stdout.toString())).toEqual({ shared: "shared-value", secret: "main-secret" });
+  });
+
+  test("another environment refuses to boot and names the build to make", async () => {
+    const { file } = await build(await makeTempRoot(), "main");
+    const proc = run(file, "develop");
+    expect(proc.exitCode).not.toBe(0);
+    expect(proc.stderr.toString()).toContain(
+      "env/env.server.develop.ts is not in this build: `akan build` bundles the server env of AKAN_PUBLIC_ENV=main alone",
+    );
+    expect(proc.stderr.toString()).toContain(
+      "To run develop, build for it: AKAN_PUBLIC_ENV=develop in the workspace's .env, which outranks the shell, or --env develop on a desktop or mobile build.",
+    );
+  });
+
+  test("a custom branch is its own environment", async () => {
+    const { text } = await build(await makeTempRoot(), "qa");
+    expect(text).toContain("qa-secret");
+    expect(text).not.toContain("main-secret");
+  });
+
+  test("leaves env files outside the app's env directory alone", async () => {
+    const root = await makeTempRoot();
+    const other = path.join(root, "libs/shared/env/env.server.testing.ts");
+    await write(other, 'export const env = { secret: "lib-testing-secret" };\n');
+    const { envDir, entry } = await writeApp(root);
+    await write(entry, `import { env } from ${JSON.stringify(other)};\nconsole.info(env.secret);\n`);
+    const result = await Bun.build({
+      entrypoints: [entry],
+      target: "bun",
+      plugins: [createServerEnvPlugin({ envDir, environment: "main", environments })],
+    });
+    expect(await result.outputs[0]?.text()).toContain("lib-testing-secret");
+  });
+});

package/transforms/serverEnvPlugin.ts

@@ -0,0 +1,41 @@
+import { existsSync, realpathSync } from "node:fs";
+import path from "node:path";
+import type { BunPlugin } from "bun";
+
+export interface ServerEnvPluginOptions {
+  envDir: string;
+  /** The environment the image runs: its Dockerfile fixes `AKAN_PUBLIC_ENV` to it. */
+  environment: string;
+  environments: Iterable<string>;
+}
+
+const escapeRegExp = (value: string) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+//* `env.server.ts` imports every environment's file, so an image would hand out the secrets of each environment it
+//* never runs. Every file but the image's own is swapped for exports that refuse to be read.
+export const createServerEnvPlugin = ({ envDir, environment, environments }: ServerEnvPluginOptions): BunPlugin => {
+  const others = [...new Set(environments)].filter((name) => name !== environment);
+  //? Bun hands onLoad the real path, which differs from the given one under a symlink (macOS's /var -> /private/var).
+  const dirs = new Set([path.resolve(envDir), existsSync(envDir) ? realpathSync.native(envDir) : envDir]);
+  const names = others.map(escapeRegExp).join("|");
+  const filter = new RegExp(`^(?:${[...dirs].map(escapeRegExp).join("|")})[\\\\/]env\\.server\\.(?:${names})\\.ts$`);
+  return {
+    name: "akan-server-env",
+    setup(build) {
+      if (!others.length) return;
+      build.onLoad({ filter }, async (args) => {
+        const name = path.basename(args.path, ".ts").slice("env.server.".length);
+        const { exports } = new Bun.Transpiler({ loader: "ts" }).scan(await Bun.file(args.path).text());
+        const message = `env/env.server.${name}.ts is not in this build: \`akan build\` bundles the server env of AKAN_PUBLIC_ENV=${environment} alone, the environment its image runs. To run ${name}, build for it: AKAN_PUBLIC_ENV=${name} in the workspace's .env, which outranks the shell, or --env ${name} on a desktop or mobile build.`;
+        return {
+          loader: "js",
+          contents: [
+            `const refuse = () => { throw new Error(${JSON.stringify(message)}); };`,
+            "const unbuilt = new Proxy({}, { get: refuse, has: refuse, ownKeys: refuse, getOwnPropertyDescriptor: refuse });",
+            `export { ${exports.map((exported) => `unbuilt as ${JSON.stringify(exported)}`).join(", ")} };`,
+          ].join("\n"),
+        };
+      });
+    },
+  };
+};

package/types.ts

@@ -10,6 +10,7 @@ export interface PackageJson {
   peerDependencies?: Record<string, string>;
   peerDependenciesMeta?: Record<string, { optional?: boolean }>;
   optionalDependencies?: Record<string, string>;
+  trustedDependencies?: string[];
   overrides?: Record<string, string>;
   engines?: Record<string, string>;
   exports?: Record<string, string | Record<string, string>>;

package/workspaceLayout.test.ts

@@ -21,6 +21,11 @@ describe("app root layout allowlist", () => {
     }
   });
 
+  test("admits the native plugins an app owns, and a lib too", () => {
+    expect(appRootAllowedDirs.has("native")).toBe(true);
+    expect(libRootAllowedDirs.has("native")).toBe(true);
+  });
+
   test("rejects an app root entry no facet owns", () => {
     expect(appRootAllowedFiles.has("helper.ts")).toBe(false);
     expect(appRootAllowedDirs.has("base")).toBe(false);

package/workspaceLayout.ts

@@ -21,6 +21,7 @@ export const appRootAllowedDirs = new Set([
   "common",
   "env",
   "lib",
+  "native",
   "page",
   "plugin",
   "private",
@@ -52,6 +53,7 @@ export const libRootAllowedDirs = new Set([
   "common",
   "env",
   "lib",
+  "native",
   "page",
   "plugin",
   "private",