@multiplatform.one/core 7.0.0 → 7.2.0

package/src/app/devtoolsTrigger.ts

@@ -0,0 +1,385 @@
+import { EventClient } from "@tanstack/devtools-event-client";
+import { useEffect } from "react";
+
+// ---------------------------------------------------------------------------
+// Keyboard trigger
+// ---------------------------------------------------------------------------
+
+/**
+ * Keyboard shortcut that toggles the devtools shell (Ctrl+` / Cmd+`).
+ * Handled inside `@tanstack/react-devtools`, which skips editable targets
+ * (inputs, textareas, contentEditable), so it cannot collide with app
+ * typing. Exported so tests pin the binding.
+ */
+export const devtoolsOpenHotkey = ["CtrlOrMeta", "`"] as const;
+
+// ---------------------------------------------------------------------------
+// Programmatic open — the same event the devtools shell's own trigger emits
+// ---------------------------------------------------------------------------
+
+/**
+ * Plugin id of the TanStack Devtools shell's internal event client
+ * (`devtoolsEventClient` in `@tanstack/devtools-client`). The shell
+ * subscribes to `<pluginId>:trigger-toggled` and opens/closes on the
+ * payload's `isOpen`. The spec asserts both strings
+ * against the installed packages so an upstream rename fails the build
+ * instead of silently breaking shake-to-open.
+ */
+export const devtoolsShellPluginId = "tanstack-devtools-core";
+
+/** Event suffix the shell listens on for open/close state changes. */
+export const devtoolsTriggerToggledEvent = "trigger-toggled";
+
+interface DevtoolsShellEventMap {
+  "trigger-toggled": { isOpen: boolean };
+}
+
+let shellEventClient: EventClient<DevtoolsShellEventMap> | undefined;
+
+/**
+ * Open the TanStack Devtools shell programmatically by emitting the same
+ * bus event the shell's own (hidden) trigger button uses. Open-only by
+ * design: a continued shake must not immediately re-close the panel —
+ * closing stays on the close button / Escape / the keyboard shortcut.
+ * The event client queues emits until the bus connects, so an early shake
+ * racing the shell mount is still delivered.
+ */
+export function openDevtoolsShell() {
+  shellEventClient ??= new EventClient<DevtoolsShellEventMap>({
+    pluginId: devtoolsShellPluginId,
+  });
+  shellEventClient.emit(devtoolsTriggerToggledEvent, { isOpen: true });
+}
+
+// ---------------------------------------------------------------------------
+// Shake detection — pure state machine over devicemotion samples
+// ---------------------------------------------------------------------------
+
+const gravityMs2 = 9.81;
+
+/** Defaults: deliberate shakes peak 15–25 m/s²; walking/bumps stay under ~8. */
+export const shakeDefaults = {
+  /** m/s² a sample must exceed to count as a shake peak. */
+  threshold: 12,
+  /** Minimum ms between counted peaks (one swing = one peak, not many samples). */
+  minPeakGapMs: 80,
+  /** Peaks required inside the rolling window to fire. */
+  peakCount: 3,
+  /** Rolling window (ms) the peaks must land in. */
+  windowMs: 1000,
+  /** Dead time (ms) after firing before the detector re-arms. */
+  cooldownMs: 2000,
+} as const;
+
+interface MotionAxes {
+  x?: number | null;
+  y?: number | null;
+  z?: number | null;
+}
+
+/** Structural subset of DeviceMotionEvent the detector needs (testable in node). */
+export interface MotionEventLike {
+  acceleration?: MotionAxes | null;
+  accelerationIncludingGravity?: MotionAxes | null;
+}
+
+/**
+ * Acceleration magnitude (m/s²) of a devicemotion sample. Prefers the
+ * gravity-excluded reading; falls back to the including-gravity reading
+ * minus standard gravity. Returns null when the event carries no data
+ * (some desktop browsers fire devicemotion with all-null axes).
+ */
+export function motionMagnitude(event: MotionEventLike): number | null {
+  const a = event.acceleration;
+  if (a && (a.x != null || a.y != null || a.z != null)) {
+    return Math.hypot(a.x ?? 0, a.y ?? 0, a.z ?? 0);
+  }
+  const g = event.accelerationIncludingGravity;
+  if (g && (g.x != null || g.y != null || g.z != null)) {
+    return Math.abs(Math.hypot(g.x ?? 0, g.y ?? 0, g.z ?? 0) - gravityMs2);
+  }
+  return null;
+}
+
+export interface ShakeDetectorOptions {
+  onShake: () => void;
+  threshold?: number;
+  minPeakGapMs?: number;
+  peakCount?: number;
+  windowMs?: number;
+  cooldownMs?: number;
+}
+
+export interface ShakeDetector {
+  /** Feed a devicemotion sample. `now` is injectable for tests. */
+  handleMotion: (event: MotionEventLike, now?: number) => void;
+  /** Drop all peaks and cooldown state. */
+  reset: () => void;
+}
+
+/**
+ * Debounced shake detector: fires `onShake` when `peakCount` peaks above
+ * `threshold` (each at least `minPeakGapMs` apart) land inside a rolling
+ * `windowMs`, then goes dead for `cooldownMs` before re-arming.
+ */
+export function createShakeDetector({
+  onShake,
+  threshold = shakeDefaults.threshold,
+  minPeakGapMs = shakeDefaults.minPeakGapMs,
+  peakCount = shakeDefaults.peakCount,
+  windowMs = shakeDefaults.windowMs,
+  cooldownMs = shakeDefaults.cooldownMs,
+}: ShakeDetectorOptions): ShakeDetector {
+  let peaks: number[] = [];
+  let lastPeakAt = Number.NEGATIVE_INFINITY;
+  let cooldownUntil = Number.NEGATIVE_INFINITY;
+
+  function reset() {
+    peaks = [];
+    lastPeakAt = Number.NEGATIVE_INFINITY;
+    cooldownUntil = Number.NEGATIVE_INFINITY;
+  }
+
+  function handleMotion(event: MotionEventLike, now: number = Date.now()) {
+    if (now < cooldownUntil) return;
+    const magnitude = motionMagnitude(event);
+    if (magnitude == null || magnitude <= threshold) return;
+    if (now - lastPeakAt < minPeakGapMs) return;
+    lastPeakAt = now;
+    peaks = peaks.filter((at) => now - at <= windowMs);
+    peaks.push(now);
+    if (peaks.length < peakCount) return;
+    peaks = [];
+    lastPeakAt = Number.NEGATIVE_INFINITY;
+    cooldownUntil = now + cooldownMs;
+    onShake();
+  }
+
+  return { handleMotion, reset };
+}
+
+// ---------------------------------------------------------------------------
+// Motion permission — iOS 13+ WebKit gesture-gated grant flow
+// ---------------------------------------------------------------------------
+
+export type MotionPermissionState = "granted" | "awaiting-gesture" | "requesting" | "denied";
+
+export interface MotionPermissionFlow {
+  readonly state: MotionPermissionState;
+  /**
+   * Call from a user gesture (pointerup/click). Resolves once the
+   * permission settles; no-ops unless state is "awaiting-gesture".
+   */
+  handleGesture: () => Promise<void>;
+}
+
+/**
+ * Permission state machine. Platforms without
+ * `DeviceMotionEvent.requestPermission` (Android, desktop) grant
+ * immediately; iOS WebKit waits for a user gesture, asks once, and lands
+ * on granted or denied. A denial is terminal for this page load — Safari
+ * remembers the answer per site, so later loads resolve silently.
+ */
+export function createMotionPermissionFlow({
+  requestPermission,
+  onGranted,
+  onDenied,
+}: {
+  requestPermission?: () => Promise<string>;
+  onGranted: () => void;
+  onDenied?: () => void;
+}): MotionPermissionFlow {
+  let state: MotionPermissionState = requestPermission ? "awaiting-gesture" : "granted";
+  if (state === "granted") onGranted();
+
+  async function handleGesture() {
+    if (state !== "awaiting-gesture" || !requestPermission) return;
+    state = "requesting";
+    let result: string;
+    try {
+      result = await requestPermission();
+    } catch {
+      // requestPermission rejects when called outside a user gesture or in
+      // an insecure context — treat as denied for this load.
+      result = "denied";
+    }
+    if (result === "granted") {
+      state = "granted";
+      onGranted();
+    } else {
+      state = "denied";
+      onDenied?.();
+    }
+  }
+
+  return {
+    get state() {
+      return state;
+    },
+    handleGesture,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Motion arming — a DELIBERATE, app-driven grant (no arbitrary tap grab)
+// ---------------------------------------------------------------------------
+
+interface DeviceMotionEventConstructorLike {
+  requestPermission?: () => Promise<string>;
+}
+
+function motionEventCtor(): DeviceMotionEventConstructorLike | undefined {
+  return (globalThis as { DeviceMotionEvent?: DeviceMotionEventConstructorLike }).DeviceMotionEvent;
+}
+
+/**
+ * True only on the platform that gates devicemotion behind a user-gesture
+ * grant: iOS 13+ WebKit exposes `DeviceMotionEvent.requestPermission`.
+ * Android and desktop return false — they deliver motion events without a
+ * prompt, so shake-to-open arms itself there and no trigger UI is needed.
+ */
+export function isMotionPermissionRequired(): boolean {
+  return typeof motionEventCtor()?.requestPermission === "function";
+}
+
+/**
+ * The window event an app dispatches from a DELIBERATE user gesture to arm
+ * shake-to-open on iOS (e.g. the SHC console's triple-tap on the build
+ * number in Settings › Estate). It is a window CustomEvent rather than an
+ * imported function on purpose: the trigger lives in a feature package that
+ * does not — and must not — depend on this core build. `dispatchEvent` is
+ * synchronous, so the `requestPermission()` this fires runs INSIDE the
+ * originating gesture's call stack, which is the whole reason iOS accepts
+ * it. `armDevtoolsMotion()` dispatches it for callers that CAN import core.
+ */
+export const devtoolsArmMotionEvent = "mpo:devtools-arm-motion";
+
+/**
+ * The window event core dispatches back once an arm attempt settles, so a
+ * trigger UI can report the honest outcome. `detail.granted` is true only
+ * when motion is now live.
+ */
+export const devtoolsMotionArmedEvent = "mpo:devtools-motion-armed";
+
+// The grant is a one-shot module latch plus a set of attachers (one per
+// mounted `useShakeToOpen`). Once granted, a shell that mounts LATER — a
+// colour-scheme change remounts it under a new key — attaches immediately
+// instead of waiting for a second arm gesture.
+let motionGranted = false;
+const motionAttachers = new Set<() => void>();
+
+function registerMotionAttacher(attach: () => void): () => void {
+  if (motionGranted) {
+    attach();
+    return () => {};
+  }
+  motionAttachers.add(attach);
+  return () => {
+    motionAttachers.delete(attach);
+  };
+}
+
+function grantAndAttachAll() {
+  motionGranted = true;
+  // Safe to iterate directly: `attach` adds a devicemotion listener and
+  // never mutates the set, and a shell mounting mid-grant sees
+  // motionGranted === true and attaches without registering.
+  for (const attach of motionAttachers) attach();
+}
+
+/** Test seam: forget the grant and drop attachers between cases. */
+export function __resetMotionArming() {
+  motionGranted = false;
+  motionAttachers.clear();
+}
+
+/**
+ * Request motion permission from within a user gesture and, on grant,
+ * attach every waiting shake listener. Idempotent once granted. Resolves
+ * to the settled permission state; a denial is terminal for this page load
+ * (Safari remembers it per site). Broadcast the outcome on
+ * `devtoolsMotionArmedEvent` so a trigger UI can report it.
+ */
+export async function requestMotionPermissionFromGesture(): Promise<MotionPermissionState> {
+  if (motionGranted) return "granted";
+  const ctor = motionEventCtor();
+  const flow = createMotionPermissionFlow({
+    // Invoke as a static method on the constructor — a detached reference
+    // throws in WebKit.
+    requestPermission:
+      typeof ctor?.requestPermission === "function" ? () => ctor.requestPermission!() : undefined,
+    onGranted: grantAndAttachAll,
+  });
+  // Non-iOS: the flow granted (and attached) synchronously in its
+  // constructor — nothing to await.
+  if (flow.state !== "granted") await flow.handleGesture();
+  if (typeof window !== "undefined") {
+    window.dispatchEvent(
+      new CustomEvent(devtoolsMotionArmedEvent, {
+        detail: { granted: flow.state === "granted" },
+      }),
+    );
+  }
+  return flow.state;
+}
+
+/**
+ * Arm shake-to-open programmatically. For callers that CAN import core
+ * (the app layer); a feature package instead dispatches
+ * `devtoolsArmMotionEvent` directly. Must be called from a user gesture on
+ * iOS. No-op on the server.
+ */
+export function armDevtoolsMotion(): void {
+  if (typeof window === "undefined") return;
+  window.dispatchEvent(new Event(devtoolsArmMotionEvent));
+}
+
+// ---------------------------------------------------------------------------
+// React wiring
+// ---------------------------------------------------------------------------
+
+/**
+ * Shake-to-open for the devtools shell. Attaches a `devicemotion` listener
+ * and opens the shell on a detected shake. Desktop browsers deliver no
+ * devicemotion events, so the listener is inert there — the keyboard
+ * shortcut is the desktop path.
+ *
+ * iOS 13+ gates devicemotion behind a permission prompt that can ONLY be
+ * requested from a user gesture, and the first shake cannot self-grant. So
+ * on iOS the listener attaches only after the app arms it — by dispatching
+ * `devtoolsArmMotionEvent` from a deliberate gesture (the console wires the
+ * build-number triple-tap). Android/desktop attach immediately. SSR-safe;
+ * every listener is torn down on unmount.
+ */
+export function useShakeToOpen(enabled: boolean, onShake: () => void = openDevtoolsShell) {
+  useEffect(() => {
+    if (!enabled || typeof window === "undefined") return;
+
+    const detector = createShakeDetector({ onShake });
+    const motionListener = (event: Event) =>
+      detector.handleMotion(event as unknown as MotionEventLike);
+    const attach = () => window.addEventListener("devicemotion", motionListener, { passive: true });
+    const detach = () => window.removeEventListener("devicemotion", motionListener);
+
+    if (!isMotionPermissionRequired()) {
+      // Android / desktop: no grant needed — listen right away.
+      attach();
+      return detach;
+    }
+
+    // iOS: attach now if a prior deliberate arm already granted; otherwise
+    // wait for the app's arm event (dispatched from a user gesture, so the
+    // permission request it fires stays inside that gesture's stack).
+    const removeAttacher = registerMotionAttacher(attach);
+    const armListener = () => {
+      void requestMotionPermissionFromGesture();
+    };
+    window.addEventListener(devtoolsArmMotionEvent, armListener);
+
+    return () => {
+      detach();
+      removeAttacher();
+      window.removeEventListener(devtoolsArmMotionEvent, armListener);
+    };
+  }, [enabled, onShake]);
+}

package/types/app/CreateApp.d.ts

@@ -15,6 +15,15 @@ export declare function followPageOriginForLoopback(configured: string): string;
 export interface TanstackConfig {
     /** Show React Query devtools (web only, ignored on native and in Storybook). */
     debug?: boolean;
+    /**
+     * Shake the device to open the devtools shell (web only; requires
+     * `debug`). Defaults to true whenever the devtools mount. On iOS 13+
+     * WebKit the motion permission is requested once from the user's first
+     * tap; Android and desktop need no permission (desktop simply never
+     * fires devicemotion — use the Ctrl/Cmd+` shortcut there). Set false to
+     * keep the keyboard shortcut as the only trigger.
+     */
+    shakeToOpen?: boolean;
     /** Options forwarded to the QueryClient constructor. */
     queryClientOptions?: Record<string, unknown>;
     /**
@@ -33,6 +42,22 @@ export interface TanstackConfig {
      * Passed automatically by `createApp()` from the theme config.
      */
     tamaguiConfig?: unknown;
+    /**
+     * Theme COLOR names the devtools panel offers in its accent dropdown
+     * (e.g. `["", "blue", "green", "purple"]`; `""` is the base theme).
+     * The panel renders the dropdown only when this AND `onThemeColorChange`
+     * are both set, and only then does the panel's Randomize action touch the
+     * accent — otherwise the picker is inert.
+     */
+    themeColors?: string[];
+    /** The theme color the app currently has applied (`""` for the base). */
+    currentThemeColor?: string;
+    /**
+     * Apply a theme color the user picked. The app owns this because a theme
+     * color is app state, not devtools state: the panel changes nothing on its
+     * own, it hands the choice back.
+     */
+    onThemeColorChange?: (color: string) => void;
 }
 export interface KeycloakConfig {
     /** Force-enable or disable. When omitted, reads KEYCLOAK_ENABLED from env config. */

package/types/app/CreateApp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApp.d.ts","sourceRoot":"","sources":["../../src/app/CreateApp.tsx"],"names":[],"mappings":"AAAA,OAAc,EAKZ,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAEvB,MAAM,OAAO,CAAC;AAEf,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAU5D,MAAM,MAAM,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;AAIjE;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAWtE;AAMD,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM;QACpB,OAAO,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;QACrC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;QACxB,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC;KAC/C,CAAC;IACF;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B;;qBAEiB;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iHAAiH;IACjH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAMD,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IACpC,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IACpC,uFAAuF;IACvF,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC;IAChC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,gDAAgD;IAChD,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B,gFAAgF;IAChF,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAQD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,eAAe;;iDAsLW,gBAAgB;;;cA2B5D,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,aAAa,CAAC,CAAC,CAAC,KAAG,aAAa,CAAC,CAAC,CAAC;wBAatE,eAAe;EAKzC"}
+{"version":3,"file":"CreateApp.d.ts","sourceRoot":"","sources":["../../src/app/CreateApp.tsx"],"names":[],"mappings":"AAAA,OAAc,EAKZ,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAEvB,MAAM,OAAO,CAAC;AAEf,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAU5D,MAAM,MAAM,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;AAIjE;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAWtE;AAMD,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM;QACpB,OAAO,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;QACrC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;QACxB,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC;KAC/C,CAAC;IACF;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,cAAc;IAC7B,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B;;qBAEiB;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iHAAiH;IACjH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAMD,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IACpC,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IACpC,uFAAuF;IACvF,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC;IAChC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,gDAAgD;IAChD,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B,gFAAgF;IAChF,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAQD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,eAAe;;iDAsLW,gBAAgB;;;cA2B5D,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,aAAa,CAAC,CAAC,CAAC,KAAG,aAAa,CAAC,CAAC,CAAC;wBAatE,eAAe;EAKzC"}

package/types/app/CreateRootLayout.web.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CreateRootLayout.web.d.ts","sourceRoot":"","sources":["../../src/app/CreateRootLayout.web.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,OAAO,CAAC;AAOtD,OAAO,KAAK,EAAE,sBAAsB,EAAkB,MAAM,oBAAoB,CAAC;AAEjF,YAAY,EACV,sBAAsB,EACtB,UAAU,EACV,eAAe,EACf,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,sBAAsB,GAAG,aAAa,CAoL3E"}
+{"version":3,"file":"CreateRootLayout.web.d.ts","sourceRoot":"","sources":["../../src/app/CreateRootLayout.web.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,OAAO,CAAC;AAQtD,OAAO,KAAK,EAAE,sBAAsB,EAAkB,MAAM,oBAAoB,CAAC;AAEjF,YAAY,EACV,sBAAsB,EACtB,UAAU,EACV,eAAe,EACf,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,sBAAsB,GAAG,aAAa,CA4L3E"}

package/types/app/RuntimePublicConfigScript.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Publishes the SSR-resolved PUBLIC config into the served document.
+ *
+ * Mounted in `<head>` by `createRootLayout` (web). Deliberately the SAME shape
+ * one uses for `__one_server_context__` — an inline `<script>` assigning a
+ * `globalThis` key, `async` + `href` so React 19 keys it stably, and
+ * `suppressHydrationWarning` because the client renders an EMPTY body for the
+ * already-executed script (one's `server/ServerContextScript` does exactly
+ * this). It is a sibling payload on the established seam, not a second
+ * transport.
+ *
+ * XSS: the injected string is NOT user content. It is built by
+ * `serializeRuntimePublicConfig`, which (a) walks the BUILD-TIME public key
+ * allowlist rather than any request-derived input, and (b) emits the values
+ * through a JSON serializer that escapes `<`, `>`, U+2028 and U+2029 — so the
+ * body cannot close its own `</script>` tag or terminate a JS statement. This
+ * is the same sanitizer shape one ships as `utils/htmlEscape.safeJsonStringify`
+ * for the server-context payload. React offers no other way to emit a script
+ * body: text children of `<script>` are HTML-escaped, which would corrupt the
+ * JSON quoting.
+ *
+ * Ordering: an inline classic script in `<head>` runs during document parse,
+ * while the app bundle is a deferred module script — so `globalThis` already
+ * carries the payload by the time `@multiplatform.one/platform` constructs its
+ * `Config`.
+ *
+ * On the browser the body is empty: `serializeRuntimePublicConfig()` reads
+ * `process.env`, which only exists on the server. Rendering it client-side
+ * would publish an EMPTY payload over the real one.
+ */
+export declare function RuntimePublicConfigScript(): import("react/jsx-runtime").JSX.Element;
+export declare namespace RuntimePublicConfigScript {
+    var displayName: string;
+}
+//# sourceMappingURL=RuntimePublicConfigScript.d.ts.map

package/types/app/RuntimePublicConfigScript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RuntimePublicConfigScript.d.ts","sourceRoot":"","sources":["../../src/app/RuntimePublicConfigScript.tsx"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,yBAAyB,4CAgBxC;yBAhBe,yBAAyB"}

package/types/app/TanstackDevtools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TanstackDevtools.d.ts","sourceRoot":"","sources":["../../src/app/TanstackDevtools.tsx"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAsBlD,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,OAAO,GAAG,MAAM,CAAC;IACjC,cAAc,EAAE,cAAc,CAAC;CAChC;AAkED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAC9C,cAAc,EACd,cAAc,GACf,EAAE,qBAAqB,2CA0CvB"}
+{"version":3,"file":"TanstackDevtools.d.ts","sourceRoot":"","sources":["../../src/app/TanstackDevtools.tsx"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAoClD,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,OAAO,GAAG,MAAM,CAAC;IACjC,cAAc,EAAE,cAAc,CAAC;CAChC;AAkED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAC9C,cAAc,EACd,cAAc,GACf,EAAE,qBAAqB,2CAiEvB"}

package/types/app/devtoolsTrigger.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Keyboard shortcut that toggles the devtools shell (Ctrl+` / Cmd+`).
+ * Handled inside `@tanstack/react-devtools`, which skips editable targets
+ * (inputs, textareas, contentEditable), so it cannot collide with app
+ * typing. Exported so tests pin the binding.
+ */
+export declare const devtoolsOpenHotkey: readonly ["CtrlOrMeta", "`"];
+/**
+ * Plugin id of the TanStack Devtools shell's internal event client
+ * (`devtoolsEventClient` in `@tanstack/devtools-client`). The shell
+ * subscribes to `<pluginId>:trigger-toggled` and opens/closes on the
+ * payload's `isOpen`. The spec asserts both strings
+ * against the installed packages so an upstream rename fails the build
+ * instead of silently breaking shake-to-open.
+ */
+export declare const devtoolsShellPluginId = "tanstack-devtools-core";
+/** Event suffix the shell listens on for open/close state changes. */
+export declare const devtoolsTriggerToggledEvent = "trigger-toggled";
+/**
+ * Open the TanStack Devtools shell programmatically by emitting the same
+ * bus event the shell's own (hidden) trigger button uses. Open-only by
+ * design: a continued shake must not immediately re-close the panel —
+ * closing stays on the close button / Escape / the keyboard shortcut.
+ * The event client queues emits until the bus connects, so an early shake
+ * racing the shell mount is still delivered.
+ */
+export declare function openDevtoolsShell(): void;
+/** Defaults: deliberate shakes peak 15–25 m/s²; walking/bumps stay under ~8. */
+export declare const shakeDefaults: {
+    /** m/s² a sample must exceed to count as a shake peak. */
+    readonly threshold: 12;
+    /** Minimum ms between counted peaks (one swing = one peak, not many samples). */
+    readonly minPeakGapMs: 80;
+    /** Peaks required inside the rolling window to fire. */
+    readonly peakCount: 3;
+    /** Rolling window (ms) the peaks must land in. */
+    readonly windowMs: 1000;
+    /** Dead time (ms) after firing before the detector re-arms. */
+    readonly cooldownMs: 2000;
+};
+interface MotionAxes {
+    x?: number | null;
+    y?: number | null;
+    z?: number | null;
+}
+/** Structural subset of DeviceMotionEvent the detector needs (testable in node). */
+export interface MotionEventLike {
+    acceleration?: MotionAxes | null;
+    accelerationIncludingGravity?: MotionAxes | null;
+}
+/**
+ * Acceleration magnitude (m/s²) of a devicemotion sample. Prefers the
+ * gravity-excluded reading; falls back to the including-gravity reading
+ * minus standard gravity. Returns null when the event carries no data
+ * (some desktop browsers fire devicemotion with all-null axes).
+ */
+export declare function motionMagnitude(event: MotionEventLike): number | null;
+export interface ShakeDetectorOptions {
+    onShake: () => void;
+    threshold?: number;
+    minPeakGapMs?: number;
+    peakCount?: number;
+    windowMs?: number;
+    cooldownMs?: number;
+}
+export interface ShakeDetector {
+    /** Feed a devicemotion sample. `now` is injectable for tests. */
+    handleMotion: (event: MotionEventLike, now?: number) => void;
+    /** Drop all peaks and cooldown state. */
+    reset: () => void;
+}
+/**
+ * Debounced shake detector: fires `onShake` when `peakCount` peaks above
+ * `threshold` (each at least `minPeakGapMs` apart) land inside a rolling
+ * `windowMs`, then goes dead for `cooldownMs` before re-arming.
+ */
+export declare function createShakeDetector({ onShake, threshold, minPeakGapMs, peakCount, windowMs, cooldownMs, }: ShakeDetectorOptions): ShakeDetector;
+export type MotionPermissionState = "granted" | "awaiting-gesture" | "requesting" | "denied";
+export interface MotionPermissionFlow {
+    readonly state: MotionPermissionState;
+    /**
+     * Call from a user gesture (pointerup/click). Resolves once the
+     * permission settles; no-ops unless state is "awaiting-gesture".
+     */
+    handleGesture: () => Promise<void>;
+}
+/**
+ * Permission state machine. Platforms without
+ * `DeviceMotionEvent.requestPermission` (Android, desktop) grant
+ * immediately; iOS WebKit waits for a user gesture, asks once, and lands
+ * on granted or denied. A denial is terminal for this page load — Safari
+ * remembers the answer per site, so later loads resolve silently.
+ */
+export declare function createMotionPermissionFlow({ requestPermission, onGranted, onDenied, }: {
+    requestPermission?: () => Promise<string>;
+    onGranted: () => void;
+    onDenied?: () => void;
+}): MotionPermissionFlow;
+/**
+ * True only on the platform that gates devicemotion behind a user-gesture
+ * grant: iOS 13+ WebKit exposes `DeviceMotionEvent.requestPermission`.
+ * Android and desktop return false — they deliver motion events without a
+ * prompt, so shake-to-open arms itself there and no trigger UI is needed.
+ */
+export declare function isMotionPermissionRequired(): boolean;
+/**
+ * The window event an app dispatches from a DELIBERATE user gesture to arm
+ * shake-to-open on iOS (e.g. the SHC console's triple-tap on the build
+ * number in Settings › Estate). It is a window CustomEvent rather than an
+ * imported function on purpose: the trigger lives in a feature package that
+ * does not — and must not — depend on this core build. `dispatchEvent` is
+ * synchronous, so the `requestPermission()` this fires runs INSIDE the
+ * originating gesture's call stack, which is the whole reason iOS accepts
+ * it. `armDevtoolsMotion()` dispatches it for callers that CAN import core.
+ */
+export declare const devtoolsArmMotionEvent = "mpo:devtools-arm-motion";
+/**
+ * The window event core dispatches back once an arm attempt settles, so a
+ * trigger UI can report the honest outcome. `detail.granted` is true only
+ * when motion is now live.
+ */
+export declare const devtoolsMotionArmedEvent = "mpo:devtools-motion-armed";
+/** Test seam: forget the grant and drop attachers between cases. */
+export declare function __resetMotionArming(): void;
+/**
+ * Request motion permission from within a user gesture and, on grant,
+ * attach every waiting shake listener. Idempotent once granted. Resolves
+ * to the settled permission state; a denial is terminal for this page load
+ * (Safari remembers it per site). Broadcast the outcome on
+ * `devtoolsMotionArmedEvent` so a trigger UI can report it.
+ */
+export declare function requestMotionPermissionFromGesture(): Promise<MotionPermissionState>;
+/**
+ * Arm shake-to-open programmatically. For callers that CAN import core
+ * (the app layer); a feature package instead dispatches
+ * `devtoolsArmMotionEvent` directly. Must be called from a user gesture on
+ * iOS. No-op on the server.
+ */
+export declare function armDevtoolsMotion(): void;
+/**
+ * Shake-to-open for the devtools shell. Attaches a `devicemotion` listener
+ * and opens the shell on a detected shake. Desktop browsers deliver no
+ * devicemotion events, so the listener is inert there — the keyboard
+ * shortcut is the desktop path.
+ *
+ * iOS 13+ gates devicemotion behind a permission prompt that can ONLY be
+ * requested from a user gesture, and the first shake cannot self-grant. So
+ * on iOS the listener attaches only after the app arms it — by dispatching
+ * `devtoolsArmMotionEvent` from a deliberate gesture (the console wires the
+ * build-number triple-tap). Android/desktop attach immediately. SSR-safe;
+ * every listener is torn down on unmount.
+ */
+export declare function useShakeToOpen(enabled: boolean, onShake?: () => void): void;
+export {};
+//# sourceMappingURL=devtoolsTrigger.d.ts.map

package/types/app/devtoolsTrigger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtoolsTrigger.d.ts","sourceRoot":"","sources":["../../src/app/devtoolsTrigger.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,8BAA+B,CAAC;AAM/D;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D,sEAAsE;AACtE,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAQ7D;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,SAKhC;AAQD,gFAAgF;AAChF,eAAO,MAAM,aAAa;IACxB,0DAA0D;;IAE1D,iFAAiF;;IAEjF,wDAAwD;;IAExD,kDAAkD;;IAElD,+DAA+D;;CAEvD,CAAC;AAEX,UAAU,UAAU;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IACjC,4BAA4B,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAUrE;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,YAAY,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7D,yCAAyC;IACzC,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,SAAmC,EACnC,YAAyC,EACzC,SAAmC,EACnC,QAAiC,EACjC,UAAqC,GACtC,EAAE,oBAAoB,GAAG,aAAa,CA2BtC;AAMD,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,kBAAkB,GAAG,YAAY,GAAG,QAAQ,CAAC;AAE7F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC;;;OAGG;IACH,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,iBAAiB,EACjB,SAAS,EACT,QAAQ,GACT,EAAE;IACD,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACvB,GAAG,oBAAoB,CA8BvB;AAcD;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AA4BpE,oEAAoE;AACpE,wBAAgB,mBAAmB,SAGlC;AAED;;;;;;GAMG;AACH,wBAAsB,kCAAkC,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAqBzF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,MAAM,IAAwB,QA+BvF"}