@lynxship/cli 0.1.8 → 0.1.11

package/dist/desktop-signing.js

@@ -0,0 +1,200 @@
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { dirname, extname, join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { captureProcess, commandExists } from "./process-runner.js";
+async function manifest(root) {
+    try {
+        return JSON.parse(await readFile(join(root, "package.json"), "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+function hasConfiguredCertificate(configuration) {
+    if (process.platform === "win32") {
+        const windows = configuration.win;
+        if (windows?.signAndEditExecutable === false)
+            return "missing";
+        if (process.env.WIN_CSC_LINK ||
+            process.env.CSC_LINK ||
+            windows?.certificateFile ||
+            windows?.certificateSubjectName)
+            return "configured";
+        return "missing";
+    }
+    if (process.platform === "darwin") {
+        const mac = configuration.mac;
+        if (process.env.CSC_LINK ||
+            process.env.CSC_NAME ||
+            mac?.identity ||
+            mac?.certificateFile)
+            return "configured";
+        return "missing";
+    }
+    return "configured";
+}
+export async function inspectDesktopSigning(root) {
+    if (process.platform !== "win32" && process.platform !== "darwin")
+        return {
+            status: "not-required",
+            value: `${process.platform} desktop packaging does not use Authenticode or Apple code signing`,
+            fix: "Use the target operating system's distribution signing policy before publishing.",
+        };
+    const configuration = (await manifest(root)).build ?? {};
+    if (process.platform === "win32" &&
+        configuration.win?.signAndEditExecutable === false)
+        return {
+            status: "disabled",
+            value: "Windows executable signing is disabled in Electron Builder",
+            fix: "Remove build.win.signAndEditExecutable=false and configure WIN_CSC_LINK/CSC_KEY_PASSWORD or a certificateSubjectName.",
+        };
+    const configured = hasConfiguredCertificate(configuration);
+    if (configured === "configured")
+        return {
+            status: "configured",
+            value: process.platform === "win32"
+                ? "Windows Authenticode certificate input detected"
+                : "Apple desktop signing input detected",
+            fix: "The final artifact signature will be verified after packaging.",
+        };
+    return {
+        status: process.platform === "darwin" ? "unknown" : "missing",
+        value: process.platform === "win32"
+            ? "Windows Authenticode certificate not configured"
+            : "Apple desktop signing identity not explicitly configured",
+        fix: process.platform === "win32"
+            ? "Configure WIN_CSC_LINK or CSC_LINK and CSC_KEY_PASSWORD, or set build.win.certificateSubjectName, then rerun lynxship doctor --platform desktop."
+            : "Configure CSC_LINK/CSC_NAME or the mac.identity in Electron Builder; the final build must pass codesign verification.",
+    };
+}
+async function verifyWindowsArtifact(artifactPath) {
+    const windowsPowerShell = process.env.SystemRoot
+        ? join(process.env.SystemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+        : "powershell.exe";
+    const powershell = commandExists(windowsPowerShell)
+        ? windowsPowerShell
+        : commandExists("powershell.exe")
+            ? "powershell.exe"
+            : commandExists("pwsh")
+                ? "pwsh"
+                : undefined;
+    if (!powershell)
+        return {
+            signed: false,
+            status: "unavailable",
+            detail: "PowerShell is unavailable; Authenticode could not be verified.",
+        };
+    const result = await captureProcess(powershell, [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        "if (-not (Get-Command Get-AuthenticodeSignature -ErrorAction SilentlyContinue)) { Write-Output 'UNAVAILABLE'; exit 2 }; $signature = Get-AuthenticodeSignature -LiteralPath $env:LYNXSHIP_ARTIFACT_PATH; Write-Output $signature.Status; if ($signature.Status -ne 'Valid') { exit 1 }",
+    ], {
+        cwd: dirname(artifactPath),
+        env: {
+            ...process.env,
+            LYNXSHIP_ARTIFACT_PATH: artifactPath,
+            ...(process.env.SystemRoot
+                ? {
+                    PSModulePath: [
+                        join(process.env.SystemRoot, "System32", "WindowsPowerShell", "v1.0", "Modules"),
+                        process.env.ProgramFiles
+                            ? join(process.env.ProgramFiles, "WindowsPowerShell", "Modules")
+                            : undefined,
+                    ]
+                        .filter((value) => Boolean(value))
+                        .join(";"),
+                }
+                : {}),
+        },
+    });
+    const detail = (result.stdout || result.stderr).trim().split(/\r?\n/).at(-1);
+    if (result.code === 0)
+        return { signed: true, status: "signed", detail: detail || "Valid" };
+    if (result.code === 2 ||
+        /(?:couldnotautoload|commandnotfound|not recognized|unavailable)/i.test(detail ?? ""))
+        return {
+            signed: false,
+            status: "unavailable",
+            detail: "PowerShell Authenticode support is unavailable on this machine.",
+        };
+    return {
+        signed: false,
+        status: "unsigned",
+        detail: detail || "Authenticode signature is not valid.",
+    };
+}
+async function verifyMacArtifact(artifactPath) {
+    const extension = extname(artifactPath).toLowerCase();
+    let appPath = extension === ".app" ? artifactPath : undefined;
+    let mountPath;
+    try {
+        if (extension === ".dmg") {
+            if (!commandExists("hdiutil"))
+                return {
+                    signed: false,
+                    status: "unavailable",
+                    detail: "hdiutil is unavailable; the DMG application could not be inspected.",
+                };
+            mountPath = await mkdtemp(join(tmpdir(), "lynxship-dmg-"));
+            const mounted = await captureProcess("hdiutil", [
+                "attach",
+                artifactPath,
+                "-nobrowse",
+                "-readonly",
+                "-mountpoint",
+                mountPath,
+            ], { cwd: dirname(artifactPath) });
+            if (mounted.code !== 0)
+                return {
+                    signed: false,
+                    status: "unsigned",
+                    detail: (mounted.stderr || mounted.stdout).trim() ||
+                        "The DMG could not be mounted for signature verification.",
+                };
+            const entries = await readdir(mountPath, { withFileTypes: true });
+            const app = entries.find((entry) => entry.isDirectory() && entry.name.toLowerCase().endsWith(".app"));
+            appPath = app ? join(mountPath, app.name) : undefined;
+        }
+        if (!appPath || !commandExists("codesign"))
+            return {
+                signed: false,
+                status: "unavailable",
+                detail: "No verifiable macOS .app bundle was found in the Desktop artifact.",
+            };
+        const result = await captureProcess("codesign", ["--verify", "--deep", "--strict", appPath], { cwd: dirname(appPath) });
+        return result.code === 0
+            ? {
+                signed: true,
+                status: "signed",
+                detail: "codesign verification passed",
+            }
+            : {
+                signed: false,
+                status: "unsigned",
+                detail: (result.stderr || result.stdout).trim() ||
+                    "codesign verification failed",
+            };
+    }
+    finally {
+        if (mountPath) {
+            await captureProcess("hdiutil", ["detach", mountPath, "-force"], {
+                cwd: dirname(artifactPath),
+            }).catch(() => undefined);
+            await rm(mountPath, { recursive: true, force: true }).catch(() => undefined);
+        }
+    }
+}
+export async function verifyDesktopArtifactSignature(artifactPath) {
+    const absoluteArtifact = resolve(artifactPath);
+    if (process.platform === "win32" &&
+        extname(absoluteArtifact).toLowerCase() === ".exe")
+        return verifyWindowsArtifact(absoluteArtifact);
+    if (process.platform === "darwin")
+        return verifyMacArtifact(absoluteArtifact);
+    return {
+        signed: false,
+        status: "not-required",
+        detail: "No platform code-signature verification is required for this target.",
+    };
+}

package/dist/dev-qr.d.ts

@@ -0,0 +1,3 @@
+export declare function extractDevServerUrl(line: string): string | undefined;
+export declare function shouldPrintDevServerQr(line: string): boolean;
+//# sourceMappingURL=dev-qr.d.ts.map

package/dist/dev-qr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-qr.d.ts","sourceRoot":"","sources":["../src/dev-qr.ts"],"names":[],"mappings":"AAMA,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMpE;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/dist/dev-qr.js

@@ -0,0 +1,12 @@
+const URL_PATTERN = /https?:\/\/[^\s<>"'`]+/g;
+function cleanUrl(value) {
+    return value.replace(/[),.;!?]+$/u, "");
+}
+export function extractDevServerUrl(line) {
+    const urls = (line.match(URL_PATTERN) ?? []).map(cleanUrl);
+    return (urls.find((url) => url.includes("fullscreen=true")) ??
+        urls.find((url) => url.includes(".lynx.bundle")));
+}
+export function shouldPrintDevServerQr(line) {
+    return /(?:default:|fullscreen=true|\bready\b)/iu.test(line);
+}

package/dist/guidance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guidance.d.ts","sourceRoot":"","sources":["../src/guidance.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAoQD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAiG5D"}
+{"version":3,"file":"guidance.d.ts","sourceRoot":"","sources":["../src/guidance.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAiXD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAiG5D"}

package/dist/guidance.js

@@ -51,10 +51,10 @@ const guidance = {
         commands: [
             "lynxship dev",
             "lynxship android host init --application-id com.example.myapp",
+            "lynxship build --platform android --application-id com.example.myapp --profile production",
             "lynxship doctor --platform android",
-            "lynxship build --platform android --profile production",
         ],
-        note: "Use dev for Lynx Explorer. The host init path is required for a real APK/AAB; --local is only a contract test.",
+        note: "Interactive build creates a missing android/ host after asking for the application ID. CI must pass --application-id. Existing android/ directories are never overwritten.",
     },
     ANDROID_HOST_EXISTS: {
         commands: ["lynxship doctor --platform android"],
@@ -90,6 +90,99 @@ const guidance = {
         commands: ["lynxship doctor --platform android", "adb devices"],
         note: "Install Android SDK Platform-Tools and connect or start a device.",
     },
+    ANDROID_TOOLCHAIN_REQUIRED: {
+        commands: [
+            "lynxship doctor --platform android",
+            "lynxship doctor --platform android --fix",
+            "lynxship build --platform android --profile production",
+        ],
+        note: "The doctor detects the project AGP/Gradle contract and the required JDK, Android SDK packages and Build Tools. --fix installs only missing SDK packages after confirmation.",
+    },
+    WEB_CONFIGURATION_REQUIRED: {
+        commands: [
+            "lynxship doctor --platform web",
+            "lynxship build --platform web --profile production",
+        ],
+        note: "Configure environments.web in lynx.config.* or provide the project's build:web script.",
+    },
+    WEB_BUNDLE_MISSING: {
+        commands: [
+            "lynxship doctor --platform web",
+            "lynxship build --platform web --profile production",
+        ],
+        note: "The official Web output is dist/*.web.bundle; check the Rspeedy Web environment and artifact path.",
+    },
+    HARMONY_HOST_REQUIRED: {
+        commands: [
+            "lynxship doctor --platform harmony",
+            "lynxship build --platform harmony --profile production",
+        ],
+        note: "Use the official Lynx Harmony host; LynxShip does not invent a fake HAP host.",
+    },
+    HARMONY_TOOLCHAIN_REQUIRED: {
+        commands: [
+            "lynxship doctor --platform harmony",
+            "lynxship build --platform harmony --profile production",
+        ],
+        note: "Install the DevEco/OpenHarmony SDK, expose ohpm and use the host's pinned hvigorw wrapper.",
+    },
+    HARMONY_SIGN_TOOL_REQUIRED: {
+        commands: [
+            "lynxship doctor --platform harmony",
+            "lynxship build --platform harmony --profile production",
+        ],
+        note: "Set LYNXSHIP_HAP_SIGN_TOOL to the official hap-sign-tool.jar or configure build.<profile>.harmony.signTool.",
+    },
+    HARMONY_HDC_REQUIRED: {
+        commands: [
+            "lynxship doctor --platform harmony",
+            "lynxship run --platform harmony --device <device-id>",
+            "lynxship logs --platform harmony --device <device-id>",
+        ],
+        note: "Install the OpenHarmony SDK platform tools and make hdc available on PATH.",
+    },
+    DESKTOP_HOST_REQUIRED: {
+        commands: [
+            "lynxship doctor --platform desktop",
+            "lynxship build --platform desktop --profile production",
+        ],
+        note: "Use the official Lynxtron host and its electron-builder configuration or pack script.",
+    },
+    DESKTOP_ARTIFACT_MISSING: {
+        commands: [
+            "lynxship doctor --platform desktop",
+            "lynxship build --platform desktop --profile production",
+        ],
+        note: "Configure the Lynxtron pack script and set build.<profile>.desktop.artifact when output is not unique.",
+    },
+    DESKTOP_SIGNING_REQUIRED: {
+        commands: [
+            "lynxship doctor --platform desktop",
+            "lynxship build --platform desktop --profile production",
+            "lynxship build --platform desktop --profile production --no-upload --allow-unsigned",
+        ],
+        note: "Production and uploaded Desktop artifacts must pass Windows Authenticode or Apple code-signature verification. Use --allow-unsigned only for local packaging tests together with --no-upload; it can never publish an unsigned artifact.",
+    },
+    TARGET_RUN_UNSUPPORTED: {
+        commands: [
+            "lynxship preview",
+            "lynxship run --platform android --artifact <apk>",
+            "lynxship run --platform harmony --artifact <hap>",
+        ],
+        note: "Web and desktop artifacts use their target runtime or operating-system installer; only device targets are installed by this command.",
+    },
+    TARGET_LOGS_UNSUPPORTED: {
+        commands: [
+            "lynxship dev",
+            "lynxship logs --platform android",
+            "lynxship logs --platform harmony",
+        ],
+        note: "Web and desktop logs come from their runtime tooling; LynxShip streams native device logs only.",
+    },
+    CLI_DOCTOR_FIX_PLATFORM: {
+        commands: ["lynxship doctor --platform android --fix"],
+        note: "The guided repair currently installs Android SDK packages only; JDK and Android Studio remain explicit developer installations.",
+    },
     LYNX_BUNDLE_MISSING: {
         commands: ["lynxship dev", "lynxship build --platform android"],
         note: "Build the Lynx bundle with the project's configured package manager.",
@@ -98,10 +191,10 @@ const guidance = {
         commands: [
             "lynxship dev",
             "lynxship ios host init --bundle-identifier com.example.myapp",
+            "lynxship build --platform ios --bundle-identifier com.example.myapp --profile production",
             "lynxship doctor --platform ios",
-            "lynxship build --platform ios --profile production",
         ],
-        note: "Use dev for Lynx Explorer. A real IPA requires macOS, Xcode and an iOS host.",
+        note: "Interactive build creates a missing ios/ host after asking for the bundle identifier. CI must pass --bundle-identifier. Existing ios/ directories are never overwritten.",
     },
     IOS_HOST_EXISTS: {
         commands: ["lynxship doctor --platform ios"],
@@ -122,6 +215,14 @@ const guidance = {
     IOS_XCRUN_REQUIRED: {
         commands: ["xcode-select --install", "lynxship doctor --platform ios"],
     },
+    IOS_TOOLCHAIN_REQUIRED: {
+        commands: [
+            "lynxship doctor --platform ios",
+            "lynxship ios host init --bundle-identifier com.example.myapp",
+            "lynxship build --platform ios --profile production",
+        ],
+        note: "The iOS doctor checks macOS, Xcode, xcrun, CocoaPods, Xcode settings, Apple signing identities, provisioning and export options without printing certificate contents.",
+    },
     IOS_COCOAPODS_REQUIRED: {
         commands: ["brew install cocoapods", "lynxship build --platform ios"],
         note: "CocoaPods is required when the iOS host contains a Podfile.",
@@ -254,6 +355,14 @@ const guidance = {
         ],
         note: "Check the Apple certificate, provisioning profile, team and export options.",
     },
+    CLI_DEVTOOL_COMMAND: {
+        commands: [
+            "lynxship devtool doctor --platform android",
+            "lynxship trace doctor --platform android",
+            "lynxship recorder doctor --platform android",
+        ],
+        note: "Lynx Trace and Recorder are operated from Lynx DevTool Desktop after the native -dev runtime is integrated.",
+    },
 };
 export function guidanceForError(error) {
     const code = error.code;

package/dist/harmony-build.d.ts

@@ -0,0 +1,22 @@
+import { type BuildJob } from "@lynxship/contracts";
+import type { BuildProfile } from "./config.js";
+interface HarmonyBuildOptions {
+    root: string;
+    profile: BuildProfile;
+    uploadArtifacts?: boolean;
+    skipBundleBuild?: boolean;
+    quiet?: boolean;
+    onEvent?: (message: string) => void;
+    onProgress?: (value?: number, label?: string) => void;
+}
+export declare function hasHarmonyHost(root: string): boolean;
+export declare function harmonyToolchain(root: string): {
+    ok: boolean;
+    wrapper?: string;
+    ohpm: boolean;
+    hdc: boolean;
+    message: string;
+};
+export declare function runRealHarmonyBuild(job: BuildJob, options: HarmonyBuildOptions): Promise<BuildJob>;
+export {};
+//# sourceMappingURL=harmony-build.d.ts.map

package/dist/harmony-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harmony-build.d.ts","sourceRoot":"","sources":["../src/harmony-build.ts"],"names":[],"mappings":"AAIA,OAAO,EAAU,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAKhD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACvD;AAeD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOpD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAC9C,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAcA;AAmID,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAkGnB"}

package/dist/harmony-build.js

@@ -0,0 +1,194 @@
+import { copyFile, mkdir, mkdtemp, readdir, rm } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { assert } from "@lynxship/contracts";
+import { transitionBuild } from "@lynxship/build-orchestrator";
+import { publishBuiltArtifact } from "./artifact-build.js";
+import { buildLynxBundle } from "./bundle-build.js";
+import { commandExists, runProcess } from "./process-runner.js";
+function harmonyRoot(root) {
+    return join(root, "harmony");
+}
+function wrapper(root) {
+    const directory = harmonyRoot(root);
+    const candidates = process.platform === "win32"
+        ? [join(directory, "hvigorw.bat"), join(directory, "hvigorw")]
+        : [join(directory, "hvigorw"), join(directory, "hvigorw.sh")];
+    return candidates.find((candidate) => existsSync(candidate));
+}
+export function hasHarmonyHost(root) {
+    return Boolean(wrapper(root) &&
+        existsSync(join(harmonyRoot(root), "hvigorfile.ts")) &&
+        existsSync(join(harmonyRoot(root), "build-profile.json5")) &&
+        existsSync(join(harmonyRoot(root), "oh-package.json5")));
+}
+export function harmonyToolchain(root) {
+    const projectWrapper = wrapper(root);
+    const ohpm = commandExists("ohpm");
+    const hdc = commandExists("hdc");
+    return {
+        ok: Boolean(projectWrapper && ohpm),
+        wrapper: projectWrapper,
+        ohpm,
+        hdc,
+        message: projectWrapper && ohpm
+            ? "Hvigor and ohpm detected"
+            : "Harmony host requires the project hvigorw wrapper and ohpm from DevEco Studio",
+    };
+}
+async function syncBundle(root, profile) {
+    const dist = join(root, "dist");
+    const entries = await readdir(dist, { withFileTypes: true }).catch(() => []);
+    const bundles = entries
+        .filter((entry) => entry.isFile() && entry.name.endsWith(".lynx.bundle"))
+        .map((entry) => entry.name);
+    assert(bundles.length > 0, "LYNX_BUNDLE_MISSING", `No .lynx.bundle was found in ${dist}. Check the Rspeedy output configuration.`);
+    const target = resolve(root, profile.harmony?.bundleDir ?? "harmony/entry/src/main/resources/rawfile");
+    await mkdir(target, { recursive: true });
+    for (const bundle of bundles)
+        await copyFile(join(dist, bundle), join(target, bundle));
+    return bundles;
+}
+async function findHap(root, configured) {
+    if (configured) {
+        const file = resolve(root, configured);
+        assert(existsSync(file), "HARMONY_ARTIFACT_MISSING", `Configured HAP was not found: ${file}`);
+        return file;
+    }
+    const result = [];
+    async function visit(directory) {
+        const entries = await readdir(directory, { withFileTypes: true }).catch(() => []);
+        for (const entry of entries) {
+            if (entry.name === ".hvigor" || entry.name === "node_modules")
+                continue;
+            const file = join(directory, entry.name);
+            if (entry.isDirectory())
+                await visit(file);
+            else if (entry.isFile() && entry.name.endsWith(".hap"))
+                result.push(file);
+        }
+    }
+    await visit(harmonyRoot(root));
+    const signed = result.filter((file) => !file.toLowerCase().includes("unsigned"));
+    assert(signed.length === 1, "HARMONY_ARTIFACT_AMBIGUOUS", signed.length === 0
+        ? "Hvigor produced no signed HAP. Configure Harmony signing in build-profile.json5 or set build.<profile>.harmony.artifact."
+        : "Hvigor produced multiple signed HAP files. Set build.<profile>.harmony.artifact explicitly.");
+    return signed[0];
+}
+function signToolPath(root, configured) {
+    const candidates = [
+        configured ? resolve(root, configured) : undefined,
+        process.env.LYNXSHIP_HAP_SIGN_TOOL,
+        process.env.DEVECO_HAP_SIGN_TOOL,
+        process.env.HOS_SDK_HOME
+            ? join(process.env.HOS_SDK_HOME, "toolchains", "lib", "hap-sign-tool.jar")
+            : undefined,
+        process.env.DEVECO_SDK_HOME
+            ? join(process.env.DEVECO_SDK_HOME, "toolchains", "lib", "hap-sign-tool.jar")
+            : undefined,
+        join(homedir(), ".ohos", "sdk", "default", "openharmony", "toolchains", "hap-sign-tool.jar"),
+    ].filter((value) => Boolean(value));
+    return candidates.find((value) => existsSync(value));
+}
+async function verifySignedHap(root, artifact, configured) {
+    const tool = signToolPath(root, configured);
+    assert(tool, "HARMONY_SIGN_TOOL_REQUIRED", "The official hap-sign-tool.jar is required to verify a signed HAP. Set LYNXSHIP_HAP_SIGN_TOOL or build.<profile>.harmony.signTool.");
+    assert(commandExists("java"), "HARMONY_JAVA_REQUIRED", "Java is required to run hap-sign-tool.jar.");
+    const directory = await mkdtemp(join(tmpdir(), "lynxship-hap-verify-"));
+    try {
+        await runProcess("java", [
+            "-jar",
+            tool,
+            "verify-app",
+            "-inFile",
+            artifact,
+            "-outCertchain",
+            join(directory, "certchain.pem"),
+            "-outProfile",
+            join(directory, "profile.p7b"),
+        ], { cwd: root, quiet: true });
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}
+export async function runRealHarmonyBuild(job, options) {
+    const toolchain = harmonyToolchain(options.root);
+    assert(hasHarmonyHost(options.root), "HARMONY_HOST_REQUIRED", "No complete HarmonyOS host was found. Add harmony/hvigorw, hvigorfile.ts, build-profile.json5 and oh-package.json5 from an official Lynx Harmony host.");
+    assert(toolchain.ok, "HARMONY_TOOLCHAIN_REQUIRED", toolchain.message);
+    const projectWrapper = toolchain.wrapper;
+    const uploadArtifacts = options.uploadArtifacts ?? true;
+    const step = (message, value) => {
+        options.onEvent?.(message);
+        options.onProgress?.(value, message);
+    };
+    try {
+        transitionBuild(job, "uploading_source", "HarmonyOS source prepared");
+        if (!options.skipBundleBuild) {
+            step("Building Lynx bundle with Rspeedy…", 10);
+            await buildLynxBundle(options.root, {
+                quiet: options.quiet,
+                onOutput: options.onEvent,
+            });
+        }
+        step("Syncing bundle into the HarmonyOS HAP resources…", 20);
+        await syncBundle(options.root, options.profile);
+        transitionBuild(job, "queued", "HarmonyOS build queued locally");
+        transitionBuild(job, "provisioning", "HarmonyOS Hvigor toolchain selected");
+        transitionBuild(job, "installing_dependencies", "HarmonyOS dependencies selected");
+        step("Installing HarmonyOS dependencies with ohpm…", 30);
+        await runProcess("ohpm", ["install"], {
+            cwd: harmonyRoot(options.root),
+            quiet: options.quiet,
+            onOutput: options.onEvent,
+        });
+        transitionBuild(job, "building", "Hvigor HAP task started");
+        const task = options.profile.harmony?.task ?? "assembleHap";
+        step(`Running real Hvigor task ${task}…`, 45);
+        const harmony = options.profile.harmony;
+        const mode = harmony?.mode ?? "module";
+        const args = [
+            "--no-daemon",
+            "--mode",
+            mode,
+            "-p",
+            `product=${harmony?.product ?? "default"}`,
+        ];
+        if (mode === "module")
+            args.push("-p", `module=${harmony?.module ?? "entry@default"}`);
+        args.push("-p", `buildMode=${harmony?.buildMode ?? "release"}`);
+        args.push(task);
+        await runProcess(projectWrapper, args, {
+            cwd: harmonyRoot(options.root),
+            quiet: options.quiet,
+            onOutput: options.onEvent,
+        });
+        const artifact = await findHap(options.root, options.profile.harmony?.artifact);
+        step("Verifying signed HarmonyOS HAP…", 75);
+        await verifySignedHap(options.root, artifact, options.profile.harmony?.signTool);
+        return publishBuiltArtifact({
+            root: options.root,
+            job,
+            platform: "harmony",
+            artifactPath: artifact,
+            extension: "hap",
+            contentType: "application/octet-stream",
+            uploadArtifacts,
+            verificationMessage: "Signed HAP verified with the official hap-sign-tool",
+            quiet: options.quiet,
+            onEvent: options.onEvent,
+            onProgress: options.onProgress,
+        });
+    }
+    catch (error) {
+        if (!["success", "failed", "canceled", "timed_out"].includes(job.state))
+            transitionBuild(job, "failed", error instanceof Error ? error.message : "HarmonyOS build failed");
+        job.logs.push({
+            level: "error",
+            message: error instanceof Error ? error.message : "HarmonyOS build failed",
+            at: new Date().toISOString(),
+        });
+        throw error;
+    }
+}