@oniroproject/core 0.10.0 → 0.11.0

package/dist/index.js

@@ -38,6 +38,8 @@ var defaultPaths = {
   sdkRootDir: () => path.join(os.homedir(), "setup-ohos-sdk"),
   cmdToolsPath: () => path.join(os.homedir(), "command-line-tools"),
   emulatorDir: () => path.join(os.homedir(), "oniro-emulator"),
+  harmonyosAuthDir: () => path.join(os.homedir(), ".oniro", "harmonyos"),
+  harmonyosSigningDir: () => path.join(os.homedir(), ".ohos", "config"),
   hapPath: "entry/build/default/outputs/default/entry-default-signed.hap",
   emulatorUrl: "https://github.com/eclipse-oniro4openharmony/device_board_oniro/releases/latest/download/oniro_emulator.zip",
   // The Huawei mirror only hosts a public Linux build of the command-line tools.
@@ -202,14 +204,94 @@ function getSdkFilename(version) {
 }
 
 // src/sdk/paths.ts
+import * as fs2 from "fs";
+import * as os4 from "os";
+import * as path3 from "path";
+
+// src/harmonyos/sdk.ts
 import * as fs from "fs";
 import * as os3 from "os";
 import * as path2 from "path";
+function readSdkPkg(sdkPath) {
+  let data;
+  try {
+    data = JSON.parse(fs.readFileSync(path2.join(sdkPath, "default", "sdk-pkg.json"), "utf8")).data;
+  } catch {
+    return {};
+  }
+  const text = (value) => typeof value === "string" || typeof value === "number" ? String(value) || void 0 : void 0;
+  const platformVersion = text(data?.platformVersion);
+  const apiVersion = text(data?.apiVersion);
+  return {
+    displayName: text(data?.displayName),
+    version: platformVersion && apiVersion ? `${platformVersion}(${apiVersion})` : void 0
+  };
+}
+function resolveSdk(root, requireHarmonyOs) {
+  const nested = path2.join(root, "sdk");
+  const sdkPath = [nested, root].find((dir) => fs.existsSync(path2.join(dir, "default", "openharmony")));
+  if (!sdkPath) return null;
+  const pkg = readSdkPkg(sdkPath);
+  if (requireHarmonyOs && !pkg.displayName?.startsWith("HarmonyOS")) return null;
+  return { sdkPath, installRoot: sdkPath === nested ? root : path2.dirname(root), ...pkg };
+}
+function studioCandidates() {
+  if (process.platform === "darwin") {
+    return [
+      "/Applications/DevEco-Studio.app/Contents",
+      path2.join(os3.homedir(), "Applications", "DevEco-Studio.app", "Contents")
+    ];
+  }
+  if (process.platform === "win32") {
+    return [path2.join(process.env.ProgramFiles ?? "C:\\Program Files", "Huawei", "DevEco Studio")];
+  }
+  return [];
+}
+function findHarmonyOsSdk(opts) {
+  const logger = opts.logger ?? noopLogger;
+  const configured = opts.config.get("harmonyosSdkPath", "");
+  if (configured) {
+    const sdk = resolveSdk(configured, false);
+    if (sdk) return sdk;
+    logger.warn(`ONIRO_HARMONYOS_SDK_PATH points at ${configured}, which holds no SDK; ignoring it.`);
+  }
+  const candidates = [
+    ...studioCandidates(),
+    opts.config.get("cmdToolsPath", defaultPaths.cmdToolsPath())
+  ];
+  for (const candidate of candidates) {
+    const sdk = resolveSdk(candidate, true);
+    if (sdk) {
+      logger.debug(`[harmonyos] Using the ${sdk.displayName} SDK at ${sdk.sdkPath}.`);
+      return sdk;
+    }
+  }
+  return null;
+}
+function requireHarmonyOsSdk(opts) {
+  const sdk = findHarmonyOsSdk(opts);
+  if (sdk) return sdk;
+  throw new OniroError(
+    "No HarmonyOS SDK found. It ships inside DevEco Studio or the HarmonyOS command-line tools and cannot be downloaded the way the OpenHarmony SDK is. Install one, then set ONIRO_HARMONYOS_SDK_PATH to the install (or its sdk directory)."
+  );
+}
+function findHarmonyOsTool(sdk, name) {
+  const names = process.platform === "win32" ? [`${name}.bat`, `${name}.cmd`, `${name}.exe`] : [name];
+  for (const dir of [path2.join(sdk.installRoot, "bin"), path2.join(sdk.installRoot, "tools", name, "bin")]) {
+    for (const candidate of names) {
+      const full = path2.join(dir, candidate);
+      if (fs.existsSync(full)) return full;
+    }
+  }
+  return null;
+}
+
+// src/sdk/paths.ts
 function getSdkRootDir(config) {
   return config.get("sdkRootDir", defaultPaths.sdkRootDir());
 }
 function getOhosBaseSdkHome(config) {
-  return path2.join(getSdkRootDir(config), getOsFolder());
+  return path3.join(getSdkRootDir(config), getOsFolder());
 }
 function getCmdToolsPath(config) {
   return config.get("cmdToolsPath", defaultPaths.cmdToolsPath());
@@ -217,31 +299,31 @@ function getCmdToolsPath(config) {
 function getEmulatorDir(config) {
   return config.get("emulatorDir", defaultPaths.emulatorDir());
 }
-function toLongPath(p, platform7 = os3.platform()) {
+function toLongPath(p, platform7 = os4.platform()) {
   if (platform7 !== "win32") return p;
   try {
-    return fs.realpathSync.native(p);
+    return fs2.realpathSync.native(p);
   } catch {
     return p;
   }
 }
 function pickExisting(candidates) {
   for (const c of candidates) {
-    if (fs.existsSync(c)) return c;
+    if (fs2.existsSync(c)) return c;
   }
   return candidates[0];
 }
 function getCmdToolsBin(config, name = "ohpm") {
-  const binDir = path2.join(getCmdToolsPath(config), "bin");
-  if (os3.platform() === "win32") {
+  const binDir = path3.join(getCmdToolsPath(config), "bin");
+  if (os4.platform() === "win32") {
     return pickExisting([
-      path2.join(binDir, `${name}.exe`),
-      path2.join(binDir, `${name}.cmd`),
-      path2.join(binDir, `${name}.bat`),
-      path2.join(binDir, name)
+      path3.join(binDir, `${name}.exe`),
+      path3.join(binDir, `${name}.cmd`),
+      path3.join(binDir, `${name}.bat`),
+      path3.join(binDir, name)
     ]);
   }
-  return path2.join(binDir, name);
+  return path3.join(binDir, name);
 }
 function getOhpmPath(config) {
   return getCmdToolsBin(config, "ohpm");
@@ -249,45 +331,52 @@ function getOhpmPath(config) {
 function getHdcPath(config) {
   const override = config.get("hdcPath", "");
   if (override) return override;
-  const base = path2.join(getCmdToolsPath(config), "sdk", "default", "openharmony", "toolchains");
-  if (os3.platform() === "win32") {
+  const hdc = hdcInSdk(path3.join(getCmdToolsPath(config), "sdk"));
+  if (fs2.existsSync(hdc)) return hdc;
+  const harmonySdk = findHarmonyOsSdk({ config });
+  const harmonyHdc = harmonySdk ? hdcInSdk(harmonySdk.sdkPath) : void 0;
+  return harmonyHdc && fs2.existsSync(harmonyHdc) ? harmonyHdc : hdc;
+}
+function hdcInSdk(sdkDir) {
+  const base = path3.join(sdkDir, "default", "openharmony", "toolchains");
+  if (os4.platform() === "win32") {
     return pickExisting([
-      path2.join(base, "hdc.exe"),
-      path2.join(base, "hdc.bat"),
-      path2.join(base, "hdc.cmd"),
-      path2.join(base, "hdc")
+      path3.join(base, "hdc.exe"),
+      path3.join(base, "hdc.bat"),
+      path3.join(base, "hdc.cmd"),
+      path3.join(base, "hdc")
     ]);
   }
-  return path2.join(base, "hdc");
+  return path3.join(base, "hdc");
 }
-function getHvigorwPath(config, projectDir, platform7 = os3.platform()) {
+function getHvigorwPath(config, projectDir, platform7 = os4.platform()) {
   const posixFirst = ["hvigorw", "hvigorw.bat", "hvigorw.cmd"];
   const windowsFirst = ["hvigorw.bat", "hvigorw.cmd", "hvigorw"];
   const names = platform7 === "win32" ? windowsFirst : posixFirst;
-  const local = pickExisting(names.map((n) => path2.join(projectDir, n)));
-  if (fs.existsSync(local) && isProjectLocalHvigorwWorking(projectDir)) {
+  const local = pickExisting(names.map((n) => path3.join(projectDir, n)));
+  if (fs2.existsSync(local) && isProjectLocalHvigorwWorking(projectDir)) {
     return local;
   }
   return getCmdToolsBin(config, "hvigorw");
 }
 function isProjectLocalHvigorwWorking(projectDir) {
-  const wrapper = path2.join(projectDir, "hvigor", "hvigor-wrapper.js");
-  const nodeModules = path2.join(projectDir, "hvigor", "node_modules");
-  return fs.existsSync(wrapper) && fs.existsSync(nodeModules);
+  const wrapper = path3.join(projectDir, "hvigor", "hvigor-wrapper.js");
+  const nodeModules = path3.join(projectDir, "hvigor", "node_modules");
+  return fs2.existsSync(wrapper) && fs2.existsSync(nodeModules);
 }
 
 // src/sdk/detectProjectSdk.ts
-import * as fs2 from "fs";
-import * as path3 from "path";
+import * as fs3 from "fs";
+import * as path4 from "path";
 import JSON5 from "json5";
 function detectProjectSdkVersion(projectRoot, logger = noopLogger) {
-  const buildProfilePath = path3.join(projectRoot, "build-profile.json5");
-  if (!fs2.existsSync(buildProfilePath)) {
+  const buildProfilePath = path4.join(projectRoot, "build-profile.json5");
+  if (!fs3.existsSync(buildProfilePath)) {
     logger.warn(`build-profile.json5 not found at ${projectRoot}`);
     return void 0;
   }
   try {
-    const content = fs2.readFileSync(buildProfilePath, "utf-8");
+    const content = fs3.readFileSync(buildProfilePath, "utf-8");
     const config = JSON5.parse(content);
     const product = config.app?.products?.[0];
     const v = product?.compileSdkVersion;
@@ -299,26 +388,26 @@ function detectProjectSdkVersion(projectRoot, logger = noopLogger) {
 }
 
 // src/sdk/tmp.ts
-import * as fs3 from "fs";
-import * as os4 from "os";
-import * as path4 from "path";
+import * as fs4 from "fs";
+import * as os5 from "os";
+import * as path5 from "path";
 var INSTALL_TMP_DIRNAME = ".oniro-tmp";
 var TMPFS_MAGIC = 16914836;
 var RAMFS_MAGIC = 2240043254;
-var HINT_EXAMPLE = os4.platform() === "win32" ? "D:\\oniro-tmp" : "~/.cache/oniro-tmp";
+var HINT_EXAMPLE = os5.platform() === "win32" ? "D:\\oniro-tmp" : "~/.cache/oniro-tmp";
 var TMP_DIR_HINT = `Point the scratch directory at a filesystem with more room using --tmp-dir <path> (or the ONIRO_TMP_DIR environment variable), e.g. --tmp-dir ${HINT_EXAMPLE}.`;
 function resolveTmpRoot(config, override, installRoot) {
   const explicit = (override ?? "").trim();
-  if (explicit) return path4.resolve(explicit);
+  if (explicit) return path5.resolve(explicit);
   const configured = config.get("tmpDir", "").trim();
-  if (configured) return path4.resolve(configured);
-  if (installRoot) return path4.join(path4.resolve(installRoot), INSTALL_TMP_DIRNAME);
-  return os4.tmpdir();
+  if (configured) return path5.resolve(configured);
+  if (installRoot) return path5.join(path5.resolve(installRoot), INSTALL_TMP_DIRNAME);
+  return os5.tmpdir();
 }
 function createTempWorkDir(root, prefix) {
   try {
-    fs3.mkdirSync(root, { recursive: true });
-    return fs3.mkdtempSync(path4.join(root, prefix));
+    fs4.mkdirSync(root, { recursive: true });
+    return fs4.mkdtempSync(path5.join(root, prefix));
   } catch (err) {
     if (isOutOfSpaceError(err)) throw toSpaceError(err, root, "a temporary directory");
     throw new OniroError(
@@ -329,10 +418,10 @@ ${TMP_DIR_HINT}`,
   }
 }
 function removeTempWorkDir(dir, root) {
-  fs3.rmSync(dir, { recursive: true, force: true });
-  if (!root || path4.basename(root) !== INSTALL_TMP_DIRNAME) return;
+  fs4.rmSync(dir, { recursive: true, force: true });
+  if (!root || path5.basename(root) !== INSTALL_TMP_DIRNAME) return;
   try {
-    fs3.rmdirSync(root);
+    fs4.rmdirSync(root);
   } catch {
   }
 }
@@ -342,18 +431,18 @@ function createInstallTempDir(opts) {
   try {
     return { dir: createTempWorkDir(root, opts.prefix), root };
   } catch (err) {
-    const fallback = os4.tmpdir();
-    if (requested || isOutOfSpaceError(err) || path4.resolve(fallback) === path4.resolve(root)) throw err;
+    const fallback = os5.tmpdir();
+    if (requested || isOutOfSpaceError(err) || path5.resolve(fallback) === path5.resolve(root)) throw err;
     const reason = err instanceof Error ? err.message.split(/\r?\n/)[0] : String(err);
     (opts.logger ?? noopLogger).warn(`${reason} Falling back to '${fallback}'.`);
     return { dir: createTempWorkDir(fallback, opts.prefix), root: fallback };
   }
 }
 function nearestExisting(dir) {
-  let current = path4.resolve(dir);
+  let current = path5.resolve(dir);
   for (; ; ) {
-    if (fs3.existsSync(current)) return current;
-    const parent = path4.dirname(current);
+    if (fs4.existsSync(current)) return current;
+    const parent = path5.dirname(current);
     if (parent === current) return null;
     current = parent;
   }
@@ -362,7 +451,7 @@ function getFreeSpaceBytes(dir) {
   const target = nearestExisting(dir);
   if (!target) return null;
   try {
-    const stats = fs3.statfsSync(target);
+    const stats = fs4.statfsSync(target);
     return Number(stats.bsize) * Number(stats.bavail);
   } catch {
     return null;
@@ -372,7 +461,7 @@ function isRamBackedPath(dir) {
   const target = nearestExisting(dir);
   if (!target) return false;
   try {
-    const type = Number(fs3.statfsSync(target).type);
+    const type = Number(fs4.statfsSync(target).type);
     return type === TMPFS_MAGIC || type === RAMFS_MAGIC;
   } catch {
     return false;
@@ -436,16 +525,16 @@ function errorPath(err) {
   return null;
 }
 function isInside(child, parent) {
-  const rel = path4.relative(path4.resolve(parent), path4.resolve(child));
-  return rel === "" || !rel.startsWith("..") && !path4.isAbsolute(rel);
+  const rel = path5.relative(path5.resolve(parent), path5.resolve(child));
+  return rel === "" || !rel.startsWith("..") && !path5.isAbsolute(rel);
 }
 function toSpaceError(err, tmpRoot, what) {
   if (err instanceof InsufficientSpaceError) return err;
   if (!isOutOfSpaceError(err)) return err;
   const failed = errorPath(err);
-  const failedDir = failed ? path4.dirname(path4.resolve(failed)) : path4.resolve(tmpRoot);
+  const failedDir = failed ? path5.dirname(path5.resolve(failed)) : path5.resolve(tmpRoot);
   const inTmp = isInside(failedDir, tmpRoot);
-  const dir = inTmp ? path4.resolve(tmpRoot) : failedDir;
+  const dir = inTmp ? path5.resolve(tmpRoot) : failedDir;
   return new InsufficientSpaceError(
     spaceMessage(dir, what, { freeBytes: getFreeSpaceBytes(dir), tmpDirHint: inTmp }),
     dir,
@@ -454,8 +543,8 @@ function toSpaceError(err, tmpRoot, what) {
 }
 
 // src/sdk/download.ts
-import * as fs4 from "fs";
-import * as path5 from "path";
+import * as fs5 from "fs";
+import * as path6 from "path";
 import * as crypto from "crypto";
 import { pipeline } from "stream";
 import { promisify } from "util";
@@ -465,26 +554,26 @@ var pipelineAsync = promisify(pipeline);
 async function downloadFile(opts) {
   const { url, dest, progress, abortSignal } = opts;
   const proto = url.startsWith("https") ? https : http;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const s = Math.max(0, Math.min(100, opts.start ?? 0));
     const r = Math.max(0, Math.min(100 - s, opts.range ?? 100));
     let settled = false;
     const done = (err) => {
       if (settled) return;
       settled = true;
-      err ? reject(err) : resolve4();
+      err ? reject(err) : resolve6();
     };
     if (abortSignal?.aborted) {
       done(new CancelledError("Download cancelled before start."));
       return;
     }
-    const destDir = path5.dirname(path5.resolve(dest));
+    const destDir = path6.dirname(path6.resolve(dest));
     const what = opts.what ?? `the download of '${url}'`;
     const writeFailed = (err) => isOutOfSpaceError(err) ? toSpaceError(err, opts.tmpRoot ?? destDir, what) : new OniroError(`Error writing '${dest}': ${err instanceof Error ? err.message : String(err)}`, err);
-    const file = fs4.createWriteStream(dest);
+    const file = fs5.createWriteStream(dest);
     let activeResponse;
     const failWith = (err) => {
-      file.close(() => fs4.rm(dest, { force: true }, () => done(err)));
+      file.close(() => fs5.rm(dest, { force: true }, () => done(err)));
     };
     file.on("error", (err) => {
       try {
@@ -556,9 +645,9 @@ async function downloadFile(opts) {
   });
 }
 async function verifySha256(filePath, sha256Path) {
-  const expected = fs4.readFileSync(sha256Path, "utf8").split(/\s+/)[0];
+  const expected = fs5.readFileSync(sha256Path, "utf8").split(/\s+/)[0];
   const hash = crypto.createHash("sha256");
-  await pipelineAsync(fs4.createReadStream(filePath), hash);
+  await pipelineAsync(fs5.createReadStream(filePath), hash);
   const actual = hash.digest("hex");
   if (actual !== expected) {
     throw new ChecksumMismatchError(expected, actual);
@@ -566,9 +655,9 @@ async function verifySha256(filePath, sha256Path) {
 }
 
 // src/sdk/extract.ts
-import * as fs5 from "fs";
-import * as os5 from "os";
-import * as path6 from "path";
+import * as fs6 from "fs";
+import * as os6 from "os";
+import * as path7 from "path";
 import { pipeline as pipeline2 } from "stream";
 import { promisify as promisify2 } from "util";
 import * as tar from "tar";
@@ -585,12 +674,12 @@ async function extractZipWithProgress(opts) {
   const r = Math.max(0, Math.min(100 - s, opts.range ?? 100));
   let processed = 0;
   let lastOverall = Math.round(s);
-  await fs5.promises.mkdir(dest, { recursive: true });
-  const destRoot = path6.resolve(dest);
+  await fs6.promises.mkdir(dest, { recursive: true });
+  const destRoot = path7.resolve(dest);
   const safeResolveTarget = (entryName) => {
-    const resolved = path6.resolve(destRoot, entryName);
-    const rel = path6.relative(destRoot, resolved);
-    if (rel.startsWith("..") || path6.isAbsolute(rel)) {
+    const resolved = path7.resolve(destRoot, entryName);
+    const rel = path7.relative(destRoot, resolved);
+    if (rel.startsWith("..") || path7.isAbsolute(rel)) {
       throw new OniroError(`Blocked ZIP entry with illegal path: ${entryName}`);
     }
     return resolved;
@@ -602,25 +691,25 @@ async function extractZipWithProgress(opts) {
       const attr = file.attr ? file.attr >>> 16 : 0;
       const isSymlink = "isSymbolicLink" in file ? Boolean(file.isSymbolicLink) : (attr & 61440) === 40960;
       if (file.isDirectory) {
-        await fs5.promises.mkdir(targetPath, { recursive: true });
+        await fs6.promises.mkdir(targetPath, { recursive: true });
       } else if (isSymlink) {
-        await fs5.promises.mkdir(path6.dirname(targetPath), { recursive: true });
+        await fs6.promises.mkdir(path7.dirname(targetPath), { recursive: true });
         const linkTargetBuffer = await zip.entryData(file);
         const linkTarget = linkTargetBuffer.toString("utf8");
         try {
-          const isWin = os5.platform() === "win32";
-          await fs5.promises.symlink(linkTarget, targetPath, isWin ? "file" : void 0);
+          const isWin = os6.platform() === "win32";
+          await fs6.promises.symlink(linkTarget, targetPath, isWin ? "file" : void 0);
         } catch (e) {
           logger.warn(`Failed to create symlink at ${targetPath}: ${String(e)}`);
         }
       } else {
-        await fs5.promises.mkdir(path6.dirname(targetPath), { recursive: true });
+        await fs6.promises.mkdir(path7.dirname(targetPath), { recursive: true });
         const readStream = await zip.stream(file);
-        const writeStream = fs5.createWriteStream(targetPath);
+        const writeStream = fs6.createWriteStream(targetPath);
         await pipelineAsync2(readStream, writeStream);
         if (attr > 0) {
           try {
-            await fs5.promises.chmod(targetPath, attr & 511);
+            await fs6.promises.chmod(targetPath, attr & 511);
           } catch {
           }
         }
@@ -652,41 +741,41 @@ async function extractTarball(tarPath, dest, strip = 0) {
 }
 
 // src/sdk/list.ts
-import * as fs6 from "fs";
-import * as path7 from "path";
+import * as fs7 from "fs";
+import * as path8 from "path";
 function getSupportedSdksForUi(config) {
-  const base = path7.join(getSdkRootDir(config), getOsFolder());
+  const base = path8.join(getSdkRootDir(config), getOsFolder());
   return ALL_SDKS.map((sdk) => ({
     version: sdk.version,
     api: sdk.api,
-    installed: fs6.existsSync(path7.join(base, sdk.api))
+    installed: fs7.existsSync(path8.join(base, sdk.api))
   })).sort((a, b) => Number(b.api) - Number(a.api));
 }
 function getInstalledSdks(config) {
   const sdkRoot = getSdkRootDir(config);
   const versions = /* @__PURE__ */ new Set();
-  if (!fs6.existsSync(sdkRoot)) return [];
+  if (!fs7.existsSync(sdkRoot)) return [];
   for (const osFolder of ["linux", "darwin", "windows"]) {
-    const osPath = path7.join(sdkRoot, osFolder);
-    if (!fs6.existsSync(osPath) || !fs6.statSync(osPath).isDirectory()) continue;
-    for (const api of fs6.readdirSync(osPath)) {
-      const apiPath = path7.join(osPath, api);
-      if (fs6.statSync(apiPath).isDirectory()) versions.add(api);
+    const osPath = path8.join(sdkRoot, osFolder);
+    if (!fs7.existsSync(osPath) || !fs7.statSync(osPath).isDirectory()) continue;
+    for (const api of fs7.readdirSync(osPath)) {
+      const apiPath = path8.join(osPath, api);
+      if (fs7.statSync(apiPath).isDirectory()) versions.add(api);
     }
   }
   return ALL_SDKS.filter((sdk) => versions.has(sdk.api)).map((sdk) => sdk.version);
 }
 
 // src/sdk/remove.ts
-import * as fs7 from "fs";
-import * as path8 from "path";
+import * as fs8 from "fs";
+import * as path9 from "path";
 function removeSdk(config, api) {
   const sdkRoot = getSdkRootDir(config);
   let removed = false;
   for (const osFolder of ["linux", "darwin", "windows"]) {
-    const sdkPath = path8.join(sdkRoot, osFolder, api);
-    if (fs7.existsSync(sdkPath)) {
-      fs7.rmSync(sdkPath, { recursive: true, force: true });
+    const sdkPath = path9.join(sdkRoot, osFolder, api);
+    if (fs8.existsSync(sdkPath)) {
+      fs8.rmSync(sdkPath, { recursive: true, force: true });
       removed = true;
     }
   }
@@ -694,18 +783,18 @@ function removeSdk(config, api) {
 }
 
 // src/sdk/install.ts
-import * as fs9 from "fs";
-import * as path9 from "path";
+import * as fs10 from "fs";
+import * as path10 from "path";
 
 // src/sdk/move.ts
-import * as fs8 from "fs";
+import * as fs9 from "fs";
 function movePath(src, dest) {
   try {
-    fs8.renameSync(src, dest);
+    fs9.renameSync(src, dest);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    fs8.cpSync(src, dest, { recursive: true });
-    fs8.rmSync(src, { recursive: true, force: true });
+    fs9.cpSync(src, dest, { recursive: true });
+    fs9.rmSync(src, { recursive: true, force: true });
   }
 }
 
@@ -726,12 +815,12 @@ async function downloadAndInstallSdk(opts) {
     prefix: "oniro-sdk-",
     logger
   });
-  const tarPath = path9.join(tmpDir, filename);
-  const sha256Path = path9.join(tmpDir, `${filename}.sha256`);
-  const extractDir = path9.join(tmpDir, "extract");
-  fs9.mkdirSync(extractDir);
-  const sdkInstallDir = path9.join(sdkRoot, osFolder, api);
-  fs9.mkdirSync(path9.dirname(sdkInstallDir), { recursive: true });
+  const tarPath = path10.join(tmpDir, filename);
+  const sha256Path = path10.join(tmpDir, `${filename}.sha256`);
+  const extractDir = path10.join(tmpDir, "extract");
+  fs10.mkdirSync(extractDir);
+  const sdkInstallDir = path10.join(sdkRoot, osFolder, api);
+  fs10.mkdirSync(path10.dirname(sdkInstallDir), { recursive: true });
   const checkCancelled = () => {
     if (abortSignal?.aborted) throw new CancelledError();
   };
@@ -748,13 +837,13 @@ async function downloadAndInstallSdk(opts) {
     await extractTarball(tarPath, extractDir, strip);
     progress?.report({ message: "Extracting SDK (this may take a while)...", increment: 10 });
     checkCancelled();
-    const osContentPath = path9.join(extractDir, osFolder);
-    if (!fs9.existsSync(osContentPath)) {
+    const osContentPath = path10.join(extractDir, osFolder);
+    if (!fs10.existsSync(osContentPath)) {
       throw new OniroError(
         `Expected folder '${osFolder}' not found in extracted SDK. Tarball layout may have changed.`
       );
     }
-    const zipFiles = fs9.readdirSync(osContentPath).filter((n2) => n2.endsWith(".zip"));
+    const zipFiles = fs10.readdirSync(osContentPath).filter((n2) => n2.endsWith(".zip"));
     const componentsStart = 60;
     const componentsBudget = 35;
     const n = zipFiles.length;
@@ -769,16 +858,16 @@ async function downloadAndInstallSdk(opts) {
     for (const zipFile of zipFiles) {
       checkCancelled();
       logger.info(`Extracting component ${zipFile}`);
-      const zipPath = path9.join(osContentPath, zipFile);
+      const zipPath = path10.join(osContentPath, zipFile);
       const thisBudget = base + (rem > 0 ? 1 : 0);
       if (rem > 0) rem--;
       await extractZipWithProgress({ zipPath, dest: osContentPath, progress, start: cursor, range: thisBudget, logger });
       cursor += thisBudget;
-      fs9.unlinkSync(zipPath);
+      fs10.unlinkSync(zipPath);
     }
     progress?.report({ message: "Finalizing installation...", increment: 0 });
-    if (fs9.existsSync(sdkInstallDir)) {
-      fs9.rmSync(sdkInstallDir, { recursive: true, force: true });
+    if (fs10.existsSync(sdkInstallDir)) {
+      fs10.rmSync(sdkInstallDir, { recursive: true, force: true });
     }
     movePath(osContentPath, sdkInstallDir);
     progress?.report({ message: "Finalizing installation...", increment: 3 });
@@ -794,13 +883,13 @@ async function downloadAndInstallSdk(opts) {
 }
 
 // src/cmdTools/install.ts
-import * as fs10 from "fs";
-import * as os6 from "os";
-import * as path11 from "path";
+import * as fs11 from "fs";
+import * as os7 from "os";
+import * as path12 from "path";
 import { spawnSync } from "child_process";
 
 // src/hdc/spawnCompat.ts
-import * as path10 from "path";
+import * as path11 from "path";
 import { spawn } from "child_process";
 var WINDOWS_BATCH_RE = /\.(bat|cmd)$/i;
 var CMD_META_RE = /([()[\]%!^"`<>&|;, *?])/g;
@@ -824,7 +913,7 @@ function escapeCmdCommand(command) {
 function buildCmdWrapper(command, args) {
   assertCmdSafe(command, `command ${command}`);
   args.forEach((a, i) => assertCmdSafe(a, `argument ${i} (${a})`));
-  const normalized = path10.normalize(command);
+  const normalized = path11.normalize(command);
   const double = CMD_SHIM_RE.test(normalized);
   const line = [escapeCmdCommand(normalized), ...args.map((a) => escapeCmdArgument(a, double))].join(" ");
   return {
@@ -872,7 +961,7 @@ function killProcessTree(child) {
 }
 
 // src/cmdTools/install.ts
-function getCmdToolsDownloadUrl(config, platform7 = os6.platform()) {
+function getCmdToolsDownloadUrl(config, platform7 = os7.platform()) {
   if (platform7 === "linux") {
     return config.get("cmdToolsUrlLinux", defaultPaths.cmdToolsUrlLinux);
   }
@@ -898,16 +987,16 @@ function getCmdToolsDownloadUrl(config, platform7 = os6.platform()) {
 }
 function findCmdToolsSourceDir(extractPath) {
   const known = [
-    path11.join(extractPath, "command-line-tools"),
-    path11.join(extractPath, "oh-command-line-tools"),
-    path11.join(extractPath, "commandline-tools")
+    path12.join(extractPath, "command-line-tools"),
+    path12.join(extractPath, "oh-command-line-tools"),
+    path12.join(extractPath, "commandline-tools")
   ];
   for (const c of known) {
-    if (fs10.existsSync(c)) return c;
+    if (fs11.existsSync(c)) return c;
   }
-  const entries = fs10.readdirSync(extractPath, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path11.join(extractPath, e.name));
+  const entries = fs11.readdirSync(extractPath, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path12.join(extractPath, e.name));
   for (const dir of entries) {
-    if (fs10.existsSync(path11.join(dir, "bin"))) return dir;
+    if (fs11.existsSync(path12.join(dir, "bin"))) return dir;
   }
   throw new OniroError("Could not locate command line tools folder in the extracted archive.");
 }
@@ -919,12 +1008,12 @@ async function installCmdTools(opts) {
   const { dir: tmpDir, root: tmpRoot } = createInstallTempDir({
     config,
     override: opts.tmpDir,
-    installRoot: path11.dirname(CMD_PATH),
+    installRoot: path12.dirname(CMD_PATH),
     prefix: "oniro-cmdtools-",
     logger
   });
-  const zipPath = opts.localZipPath ?? path11.join(tmpDir, "oh-command-line-tools.zip");
-  const extractPath = path11.join(tmpDir, "oh-command-line-tools");
+  const zipPath = opts.localZipPath ?? path12.join(tmpDir, "oh-command-line-tools.zip");
+  const extractPath = path12.join(tmpDir, "oh-command-line-tools");
   try {
     if (!opts.localZipPath) {
       const url = getCmdToolsDownloadUrl(config);
@@ -933,22 +1022,22 @@ async function installCmdTools(opts) {
     }
     progress?.report({ message: "Extracting tools...", increment: 0 });
     await extractZipWithProgress({ zipPath, dest: extractPath, progress, start: 50, range: 45, logger });
-    fs10.mkdirSync(CMD_PATH, { recursive: true });
+    fs11.mkdirSync(CMD_PATH, { recursive: true });
     const srcDir = findCmdToolsSourceDir(extractPath);
-    for (const entry of fs10.readdirSync(srcDir)) {
-      const src = path11.join(srcDir, entry);
-      const dest = path11.join(CMD_PATH, entry);
-      if (fs10.statSync(src).isDirectory()) {
-        if (fs10.existsSync(dest)) fs10.rmSync(dest, { recursive: true, force: true });
+    for (const entry of fs11.readdirSync(srcDir)) {
+      const src = path12.join(srcDir, entry);
+      const dest = path12.join(CMD_PATH, entry);
+      if (fs11.statSync(src).isDirectory()) {
+        if (fs11.existsSync(dest)) fs11.rmSync(dest, { recursive: true, force: true });
         movePath(src, dest);
       } else {
-        fs10.copyFileSync(src, dest);
+        fs11.copyFileSync(src, dest);
       }
     }
-    const binDir = path11.join(CMD_PATH, "bin");
-    if (fs10.existsSync(binDir) && os6.platform() !== "win32") {
-      for (const file of fs10.readdirSync(binDir)) {
-        fs10.chmodSync(path11.join(binDir, file), 493);
+    const binDir = path12.join(CMD_PATH, "bin");
+    if (fs11.existsSync(binDir) && os7.platform() !== "win32") {
+      for (const file of fs11.readdirSync(binDir)) {
+        fs11.chmodSync(path12.join(binDir, file), 493);
       }
     }
     progress?.report({ message: "Finalizing installation...", increment: 5 });
@@ -961,16 +1050,16 @@ async function installCmdTools(opts) {
 }
 function getCmdToolsStatus(config) {
   const cmdPath = getCmdToolsPath(config);
-  const binDir = path11.join(cmdPath, "bin");
-  const candidates = os6.platform() === "win32" ? ["ohpm.exe", "ohpm.cmd", "ohpm.bat", "ohpm"] : ["ohpm"];
-  const bin = candidates.map((c) => path11.join(binDir, c)).find((p) => fs10.existsSync(p));
+  const binDir = path12.join(cmdPath, "bin");
+  const candidates = os7.platform() === "win32" ? ["ohpm.exe", "ohpm.cmd", "ohpm.bat", "ohpm"] : ["ohpm"];
+  const bin = candidates.map((c) => path12.join(binDir, c)).find((p) => fs11.existsSync(p));
   if (!bin) {
     return { installed: false, status: "Not installed" };
   }
   try {
-    const versionFile = path11.join(cmdPath, "version.txt");
-    if (fs10.existsSync(versionFile)) {
-      const content = fs10.readFileSync(versionFile, "utf8");
+    const versionFile = path12.join(cmdPath, "version.txt");
+    if (fs11.existsSync(versionFile)) {
+      const content = fs11.readFileSync(versionFile, "utf8");
       for (const line of content.split(/\r?\n/)) {
         const m = line.match(/^\s*#\s*Version:\s*(.+)$/);
         if (m?.[1]) return { installed: true, status: `Installed (${m[1].trim()})` };
@@ -997,14 +1086,14 @@ function isCmdToolsInstalled(config) {
 }
 function removeCmdTools(config) {
   const cmdPath = getCmdToolsPath(config);
-  if (fs10.existsSync(cmdPath)) {
-    fs10.rmSync(cmdPath, { recursive: true, force: true });
+  if (fs11.existsSync(cmdPath)) {
+    fs11.rmSync(cmdPath, { recursive: true, force: true });
   }
 }
 
 // src/sign/encryptKey.ts
-import * as fs11 from "fs";
-import * as path12 from "path";
+import * as fs12 from "fs";
+import * as path13 from "path";
 import * as crypto2 from "crypto";
 var DAEMON_ROOT_KEY_COMPONENT_LENGTH = 16;
 var DAEMON_SALT_KEY_LENGTH = 16;
@@ -1076,33 +1165,33 @@ function getRootKey(fdComponents, salt) {
 function createAndStoreKey(dir, keyLength) {
   const key = crypto2.randomBytes(keyLength);
   const hash = crypto2.createHash("sha256").update(key).digest("hex");
-  const filePath = path12.join(dir, hash);
-  fs11.writeFileSync(filePath, key);
-  fs11.chmodSync(filePath, KEY_FILE_PERMISSIONS);
+  const filePath = path13.join(dir, hash);
+  fs12.writeFileSync(filePath, key);
+  fs12.chmodSync(filePath, KEY_FILE_PERMISSIONS);
   return key;
 }
 function createAndStoreEnKey(rootKey, ceDir) {
   const workKey = crypto2.randomBytes(DAEMON_WORK_KEY_LENGTH);
   const encrypted = encrypt(rootKey, workKey);
   const hash = crypto2.createHash("sha256").update(encrypted).digest("hex");
-  const filePath = path12.join(ceDir, hash);
-  fs11.writeFileSync(filePath, encrypted);
-  fs11.chmodSync(filePath, KEY_FILE_PERMISSIONS);
+  const filePath = path13.join(ceDir, hash);
+  fs12.writeFileSync(filePath, encrypted);
+  fs12.chmodSync(filePath, KEY_FILE_PERMISSIONS);
 }
 function createMaterial(materialPath) {
-  fs11.mkdirSync(materialPath, { recursive: true });
-  fs11.chmodSync(materialPath, KEY_FILE_DIRECTORY_PERMISSIONS);
-  const fdDir = path12.join(materialPath, "fd");
-  const acDir = path12.join(materialPath, "ac");
-  const ceDir = path12.join(materialPath, "ce");
-  fs11.mkdirSync(fdDir, { recursive: true });
-  fs11.mkdirSync(acDir, { recursive: true });
-  fs11.mkdirSync(ceDir, { recursive: true });
+  fs12.mkdirSync(materialPath, { recursive: true });
+  fs12.chmodSync(materialPath, KEY_FILE_DIRECTORY_PERMISSIONS);
+  const fdDir = path13.join(materialPath, "fd");
+  const acDir = path13.join(materialPath, "ac");
+  const ceDir = path13.join(materialPath, "ce");
+  fs12.mkdirSync(fdDir, { recursive: true });
+  fs12.mkdirSync(acDir, { recursive: true });
+  fs12.mkdirSync(ceDir, { recursive: true });
   const fdSubDirs = ["0", "1", "2"];
   const fdComponents = [];
   for (const sub of fdSubDirs) {
-    const subDir = path12.join(fdDir, sub);
-    fs11.mkdirSync(subDir, { recursive: true });
+    const subDir = path13.join(fdDir, sub);
+    fs12.mkdirSync(subDir, { recursive: true });
     const comp = createAndStoreKey(subDir, DAEMON_ROOT_KEY_COMPONENT_LENGTH);
     fdComponents.push(comp);
   }
@@ -1111,24 +1200,24 @@ function createMaterial(materialPath) {
   createAndStoreEnKey(rootKey, ceDir);
 }
 function readSingleFile(dir) {
-  if (!fs11.existsSync(dir) || !fs11.statSync(dir).isDirectory()) {
+  if (!fs12.existsSync(dir) || !fs12.statSync(dir).isDirectory()) {
     throw new Error(`Missing signing material directory: ${dir}`);
   }
-  const files = fs11.readdirSync(dir).filter((f) => f !== ".DS_Store");
+  const files = fs12.readdirSync(dir).filter((f) => f !== ".DS_Store");
   if (files.length !== 1) {
     throw new Error(`Signing material in ${dir} is illegal (expected exactly one file).`);
   }
-  return fs11.readFileSync(path12.join(dir, files[0]));
+  return fs12.readFileSync(path13.join(dir, files[0]));
 }
 function getKey(materialPath) {
-  if (!fs11.existsSync(materialPath) || !fs11.statSync(materialPath).isDirectory()) {
+  if (!fs12.existsSync(materialPath) || !fs12.statSync(materialPath).isDirectory()) {
     throw new Error("Material directory does not exist.");
   }
-  const fdDir = path12.join(materialPath, "fd");
-  const fdComponents = ["0", "1", "2"].map((sub) => readSingleFile(path12.join(fdDir, sub)));
-  const salt = readSingleFile(path12.join(materialPath, "ac"));
+  const fdDir = path13.join(materialPath, "fd");
+  const fdComponents = ["0", "1", "2"].map((sub) => readSingleFile(path13.join(fdDir, sub)));
+  const salt = readSingleFile(path13.join(materialPath, "ac"));
   const rootKey = getRootKey(fdComponents, salt);
-  const workMaterial = readSingleFile(path12.join(materialPath, "ce"));
+  const workMaterial = readSingleFile(path13.join(materialPath, "ce"));
   return decrypt(rootKey, workMaterial);
 }
 function encryptPwd(password, materialPath) {
@@ -1143,8 +1232,8 @@ function decryptPwd(encryptedHex, materialPath) {
 }
 
 // src/sign/generateSigningConfigs.ts
-import * as fs12 from "fs";
-import * as path13 from "path";
+import * as fs13 from "fs";
+import * as path14 from "path";
 import { execFileSync } from "child_process";
 import JSON52 from "json5";
 
@@ -1214,17 +1303,17 @@ var SIGNING_KIND_CONFIG = {
 };
 function copyFilesToProject(projectDir, paths, kind, logger, applicationCertPath) {
   logger.info("[sign] Copying signing material into project...");
-  const signaturesDir = path13.join(projectDir, "signatures");
-  fs12.mkdirSync(signaturesDir, { recursive: true });
-  fs12.copyFileSync(paths.keystore, path13.join(signaturesDir, "OpenHarmony.p12"));
-  fs12.copyFileSync(paths.profileCert, path13.join(signaturesDir, "OpenHarmonyProfileRelease.pem"));
-  fs12.copyFileSync(paths.unsignedProfileTemplate, path13.join(signaturesDir, "UnsgnedReleasedProfileTemplate.json"));
+  const signaturesDir = path14.join(projectDir, "signatures");
+  fs13.mkdirSync(signaturesDir, { recursive: true });
+  fs13.copyFileSync(paths.keystore, path14.join(signaturesDir, "OpenHarmony.p12"));
+  fs13.copyFileSync(paths.profileCert, path14.join(signaturesDir, "OpenHarmonyProfileRelease.pem"));
+  fs13.copyFileSync(paths.unsignedProfileTemplate, path14.join(signaturesDir, "UnsgnedReleasedProfileTemplate.json"));
   if (kind === "application-release") {
-    const dest = path13.join(signaturesDir, "OpenHarmonyApplication.cer");
+    const dest = path14.join(signaturesDir, "OpenHarmonyApplication.cer");
     if (applicationCertPath) {
-      fs12.copyFileSync(applicationCertPath, dest);
+      fs13.copyFileSync(applicationCertPath, dest);
     } else {
-      fs12.writeFileSync(dest, OPEN_HARMONY_APPLICATION_CERT);
+      fs13.writeFileSync(dest, OPEN_HARMONY_APPLICATION_CERT);
     }
   }
 }
@@ -1233,7 +1322,7 @@ function resolveAppFeature(apl, override) {
   return apl === "normal" ? "hos_normal_app" : "hos_system_app";
 }
 function extractLeafCertificate(chainPath) {
-  const certContent = fs12.readFileSync(chainPath, "utf-8");
+  const certContent = fs13.readFileSync(chainPath, "utf-8");
   const parts = certContent.split("-----END CERTIFICATE-----");
   if (parts.length < 3) {
     throw new OniroError(`${chainPath} does not contain enough certificates.`);
@@ -1243,20 +1332,20 @@ function extractLeafCertificate(chainPath) {
 function modifyProfileTemplate(projectDir, apl, appFeature, logger, options = {}) {
   const kind = options.kind ?? pickSigningKind(apl);
   logger.info(`[sign] Modifying profile template (apl=${apl}, app-feature=${appFeature}, kind=${kind})...`);
-  const appJsonPath = path13.join(projectDir, "AppScope/app.json5");
-  const profileTemplatePath = path13.join(projectDir, "signatures/UnsgnedReleasedProfileTemplate.json");
-  if (!fs12.existsSync(appJsonPath)) {
+  const appJsonPath = path14.join(projectDir, "AppScope/app.json5");
+  const profileTemplatePath = path14.join(projectDir, "signatures/UnsgnedReleasedProfileTemplate.json");
+  if (!fs13.existsSync(appJsonPath)) {
     throw new OniroError(`${appJsonPath} does not exist.`);
   }
   let appJson;
   try {
-    appJson = JSON52.parse(fs12.readFileSync(appJsonPath, "utf-8"));
+    appJson = JSON52.parse(fs13.readFileSync(appJsonPath, "utf-8"));
   } catch (e) {
     throw new OniroError(`Error parsing ${appJsonPath}: ${e.message}`, e);
   }
   let profileTemplate;
   try {
-    profileTemplate = JSON.parse(fs12.readFileSync(profileTemplatePath, "utf-8"));
+    profileTemplate = JSON.parse(fs13.readFileSync(profileTemplatePath, "utf-8"));
   } catch (e) {
     throw new OniroError(`Error parsing ${profileTemplatePath}: ${e.message}`, e);
   }
@@ -1269,7 +1358,7 @@ function modifyProfileTemplate(projectDir, apl, appFeature, logger, options = {}
   profileTemplate["bundle-info"]["bundle-name"] = appJson.app.bundleName;
   profileTemplate["bundle-info"]["apl"] = apl;
   profileTemplate["bundle-info"]["app-feature"] = appFeature;
-  const distCertChainPath = path13.join(
+  const distCertChainPath = path14.join(
     projectDir,
     "signatures",
     SIGNING_KIND_CONFIG[kind].certBasename
@@ -1279,13 +1368,13 @@ function modifyProfileTemplate(projectDir, apl, appFeature, logger, options = {}
     profileTemplate.acls = profileTemplate.acls ?? {};
     profileTemplate.acls["allowed-acls"] = options.acls;
   }
-  fs12.writeFileSync(profileTemplatePath, JSON.stringify(profileTemplate, null, 2));
+  fs13.writeFileSync(profileTemplatePath, JSON.stringify(profileTemplate, null, 2));
 }
 function generateP7bFile(projectDir, paths, logger, passwords) {
   logger.info("[sign] Generating P7b profile via hap-sign-tool...");
-  const signaturesDir = path13.join(projectDir, "signatures");
-  const profileTemplatePath = path13.join(signaturesDir, "UnsgnedReleasedProfileTemplate.json");
-  const outputProfilePath = path13.join(signaturesDir, "app1-profile.p7b");
+  const signaturesDir = path14.join(projectDir, "signatures");
+  const profileTemplatePath = path14.join(signaturesDir, "UnsgnedReleasedProfileTemplate.json");
+  const outputProfilePath = path14.join(signaturesDir, "app1-profile.p7b");
   const args = [
     "-jar",
     paths.signTool,
@@ -1319,11 +1408,11 @@ function generateP7bFile(projectDir, paths, logger, passwords) {
   }
 }
 function detectSigningConfigNames(projectDir) {
-  const buildProfilePath = path13.join(projectDir, "build-profile.json5");
-  if (!fs12.existsSync(buildProfilePath)) return ["default"];
+  const buildProfilePath = path14.join(projectDir, "build-profile.json5");
+  if (!fs13.existsSync(buildProfilePath)) return ["default"];
   let parsed;
   try {
-    parsed = JSON52.parse(fs12.readFileSync(buildProfilePath, "utf-8"));
+    parsed = JSON52.parse(fs13.readFileSync(buildProfilePath, "utf-8"));
   } catch {
     return ["default"];
   }
@@ -1340,14 +1429,14 @@ function detectSigningConfigNames(projectDir) {
 }
 function updateBuildProfile(projectDir, kind, logger, passwords) {
   logger.info("[sign] Writing signing configs into build-profile.json5...");
-  const materialDir = path13.join(projectDir, "signatures", "material");
-  const buildProfilePath = path13.join(projectDir, "build-profile.json5");
+  const materialDir = path14.join(projectDir, "signatures", "material");
+  const buildProfilePath = path14.join(projectDir, "build-profile.json5");
   const encryptedStorePassword = encryptPwd(passwords.store, materialDir);
   const encryptedKeyPassword = encryptPwd(passwords.key, materialDir);
   let buildProfile = { app: {} };
-  if (fs12.existsSync(buildProfilePath)) {
+  if (fs13.existsSync(buildProfilePath)) {
     try {
-      buildProfile = JSON52.parse(fs12.readFileSync(buildProfilePath, "utf-8"));
+      buildProfile = JSON52.parse(fs13.readFileSync(buildProfilePath, "utf-8"));
     } catch (e) {
       throw new OniroError(`Error parsing ${buildProfilePath}: ${e.message}`, e);
     }
@@ -1368,13 +1457,13 @@ function updateBuildProfile(projectDir, kind, logger, passwords) {
       storeFile: "./signatures/OpenHarmony.p12"
     }
   }));
-  fs12.writeFileSync(buildProfilePath, JSON.stringify(buildProfile, null, 2));
+  fs13.writeFileSync(buildProfilePath, JSON.stringify(buildProfile, null, 2));
 }
 function prepareMaterialDirectory(projectDir, logger) {
   logger.info("[sign] Generating fresh signing material...");
-  const materialDir = path13.join(projectDir, "signatures", "material");
-  if (fs12.existsSync(materialDir)) {
-    fs12.rmSync(materialDir, { recursive: true, force: true });
+  const materialDir = path14.join(projectDir, "signatures", "material");
+  if (fs13.existsSync(materialDir)) {
+    fs13.rmSync(materialDir, { recursive: true, force: true });
   }
   createMaterial(materialDir);
 }
@@ -1397,15 +1486,15 @@ function generateSigningConfigs(options) {
       "Could not detect project SDK version (compileSdkVersion missing in build-profile.json5)."
     );
   }
-  const sdkPath = path13.join(sdkHome, String(sdkVersion));
-  if (!fs12.existsSync(sdkPath)) {
+  const sdkPath = path14.join(sdkHome, String(sdkVersion));
+  if (!fs13.existsSync(sdkPath)) {
     throw new OniroError(`SDK path does not exist: ${sdkPath}`);
   }
   const paths = {
-    signTool: path13.join(sdkPath, "toolchains/lib/hap-sign-tool.jar"),
-    keystore: path13.join(sdkPath, "toolchains/lib/OpenHarmony.p12"),
-    profileCert: path13.join(sdkPath, "toolchains/lib/OpenHarmonyProfileRelease.pem"),
-    unsignedProfileTemplate: path13.join(sdkPath, "toolchains/lib/UnsgnedReleasedProfileTemplate.json")
+    signTool: path14.join(sdkPath, "toolchains/lib/hap-sign-tool.jar"),
+    keystore: path14.join(sdkPath, "toolchains/lib/OpenHarmony.p12"),
+    profileCert: path14.join(sdkPath, "toolchains/lib/OpenHarmonyProfileRelease.pem"),
+    unsignedProfileTemplate: path14.join(sdkPath, "toolchains/lib/UnsgnedReleasedProfileTemplate.json")
   };
   const kind = pickSigningKind(apl);
   const passwords = options.passwords ?? DEFAULT_PASSWORDS;
@@ -1419,8 +1508,8 @@ function generateSigningConfigs(options) {
 }
 
 // src/emulator/install.ts
-import * as fs13 from "fs";
-import * as path14 from "path";
+import * as fs14 from "fs";
+import * as path15 from "path";
 async function installEmulator(opts) {
   const { config, progress, abortSignal } = opts;
   const logger = opts.logger ?? noopLogger;
@@ -1430,20 +1519,20 @@ async function installEmulator(opts) {
   const { dir: tmpDir, root: tmpRoot } = createInstallTempDir({
     config,
     override: opts.tmpDir,
-    installRoot: path14.dirname(emulatorDir),
+    installRoot: path15.dirname(emulatorDir),
     prefix: "oniro-emulator-",
     logger
   });
-  const tmpZip = path14.join(tmpDir, "oniro_emulator.zip");
+  const tmpZip = path15.join(tmpDir, "oniro_emulator.zip");
   try {
-    fs13.mkdirSync(emulatorDir, { recursive: true });
+    fs14.mkdirSync(emulatorDir, { recursive: true });
     progress?.report({ message: "Downloading emulator...", increment: 0 });
     await downloadFile({ url, dest: tmpZip, progress, abortSignal, start: 0, range: 50, what, tmpRoot });
     progress?.report({ message: "Extracting emulator...", increment: 0 });
     await extractZipWithProgress({ zipPath: tmpZip, dest: emulatorDir, progress, start: 50, range: 45, logger });
-    const runSh = path14.join(emulatorDir, "images", "run.sh");
-    if (fs13.existsSync(runSh)) {
-      fs13.chmodSync(runSh, 493);
+    const runSh = path15.join(emulatorDir, "images", "run.sh");
+    if (fs14.existsSync(runSh)) {
+      fs14.chmodSync(runSh, 493);
     }
     progress?.report({ message: "Finalizing installation...", increment: 5 });
   } catch (err) {
@@ -1453,24 +1542,24 @@ async function installEmulator(opts) {
   }
 }
 function isEmulatorInstalled(config) {
-  const imagesDir = path14.join(getEmulatorDir(config), "images");
-  return fs13.existsSync(path14.join(imagesDir, "run.sh")) || fs13.existsSync(path14.join(imagesDir, "run.bat"));
+  const imagesDir = path15.join(getEmulatorDir(config), "images");
+  return fs14.existsSync(path15.join(imagesDir, "run.sh")) || fs14.existsSync(path15.join(imagesDir, "run.bat"));
 }
 function removeEmulator(config) {
   const emulatorDir = getEmulatorDir(config);
-  if (fs13.existsSync(emulatorDir)) {
-    fs13.rmSync(emulatorDir, { recursive: true, force: true });
+  if (fs14.existsSync(emulatorDir)) {
+    fs14.rmSync(emulatorDir, { recursive: true, force: true });
   }
 }
 
 // src/emulator/lifecycle.ts
-import * as fs15 from "fs";
-import * as os7 from "os";
-import * as path15 from "path";
+import * as fs16 from "fs";
+import * as os8 from "os";
+import * as path16 from "path";
 import { spawn as spawn2 } from "child_process";
 
 // src/hdc/exec.ts
-import * as fs14 from "fs";
+import * as fs15 from "fs";
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -1478,12 +1567,12 @@ function runProcess(opts) {
   const { command, args, cwd, env, onOutput } = opts;
   const timeoutMs = opts.timeoutMs ?? 6e4;
   const { abortSignal } = opts;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     if (abortSignal?.aborted) {
       reject(new CancelledError(`Command aborted before start: ${command}`));
       return;
     }
-    if (needsCmdWrapper(command) && !fs14.existsSync(command)) {
+    if (needsCmdWrapper(command) && !fs15.existsSync(command)) {
       reject(new OniroError(`Failed to spawn ${command}: ENOENT (no such file)`));
       return;
     }
@@ -1543,7 +1632,7 @@ ${stderr.trim()}` : "")
         );
         return;
       }
-      resolve4({ code: code ?? -1, stdout, stderr });
+      resolve6({ code: code ?? -1, stdout, stderr });
     });
   });
 }
@@ -1591,7 +1680,7 @@ function ensureRemoteOk(result, command) {
 }
 
 // src/emulator/lifecycle.ts
-var PID_FILE = path15.join(os7.tmpdir(), "oniro_emulator.pid");
+var PID_FILE = path16.join(os8.tmpdir(), "oniro_emulator.pid");
 async function attemptHdcConnection(config, address = "127.0.0.1:55555", logger = noopLogger) {
   try {
     await hdcExec({ config, args: ["start", "-r"], logger });
@@ -1604,24 +1693,24 @@ async function attemptHdcConnection(config, address = "127.0.0.1:55555", logger
   }
 }
 function resolveLauncher(imagesPath, headless, connect) {
-  const runSh = path15.join(imagesPath, "run.sh");
-  const runBat = path15.join(imagesPath, "run.bat");
+  const runSh = path16.join(imagesPath, "run.sh");
+  const runBat = path16.join(imagesPath, "run.bat");
   const extra = [];
   if (headless) extra.push("--headless");
   if (connect) extra.push("--connect", connect);
-  if (os7.platform() === "win32") {
-    if (fs15.existsSync(runBat)) {
+  if (os8.platform() === "win32") {
+    if (fs16.existsSync(runBat)) {
       return { command: "cmd.exe", args: ["/c", runBat, ...extra], cwd: imagesPath };
     }
-    if (fs15.existsSync(runSh)) {
+    if (fs16.existsSync(runSh)) {
       return { command: "bash", args: [runSh, ...extra], cwd: imagesPath };
     }
     throw new OniroError(`No emulator launcher (run.bat or run.sh) found in ${imagesPath}.`);
   }
-  if (fs15.existsSync(runSh)) {
+  if (fs16.existsSync(runSh)) {
     return { command: "bash", args: [runSh, ...extra], cwd: imagesPath };
   }
-  if (fs15.existsSync(runBat)) {
+  if (fs16.existsSync(runBat)) {
     return { command: "bash", args: [runBat, ...extra], cwd: imagesPath };
   }
   throw new OniroError(`No emulator launcher (run.sh or run.bat) found in ${imagesPath}.`);
@@ -1629,9 +1718,9 @@ function resolveLauncher(imagesPath, headless, connect) {
 async function startEmulator(opts) {
   const { config } = opts;
   const logger = opts.logger ?? noopLogger;
-  if (os7.platform() !== "win32" && fs15.existsSync(PID_FILE)) {
+  if (os8.platform() !== "win32" && fs16.existsSync(PID_FILE)) {
     try {
-      const pid = Number(fs15.readFileSync(PID_FILE, "utf8").trim());
+      const pid = Number(fs16.readFileSync(PID_FILE, "utf8").trim());
       if (Number.isFinite(pid) && pid > 0) {
         try {
           process.kill(pid, 0);
@@ -1647,13 +1736,13 @@ async function startEmulator(opts) {
       logger.warn(`Could not read PID file: ${err.message}`);
     }
   }
-  const imagesPath = path15.join(getEmulatorDir(config), "images");
-  if (!fs15.existsSync(imagesPath)) {
+  const imagesPath = path16.join(getEmulatorDir(config), "images");
+  if (!fs16.existsSync(imagesPath)) {
     throw new OniroError(`Emulator images directory not found at ${imagesPath}. Run \`oniro-app emulator install\` first.`);
   }
   const launcher = resolveLauncher(imagesPath, opts.headless === true, opts.connect);
-  const logPath = opts.logFile ?? (os7.platform() === "win32" ? "NUL" : "/dev/null");
-  const logFd = fs15.openSync(logPath, "a");
+  const logPath = opts.logFile ?? (os8.platform() === "win32" ? "NUL" : "/dev/null");
+  const logFd = fs16.openSync(logPath, "a");
   let child;
   try {
     child = spawn2(launcher.command, [...launcher.args], {
@@ -1663,19 +1752,19 @@ async function startEmulator(opts) {
       windowsHide: true
     });
   } finally {
-    fs15.closeSync(logFd);
+    fs16.closeSync(logFd);
   }
   if (!child.pid) {
     throw new OniroError(`Failed to spawn launcher (${launcher.command} ${launcher.args.join(" ")}).`);
   }
-  fs15.writeFileSync(PID_FILE, String(child.pid));
+  fs16.writeFileSync(PID_FILE, String(child.pid));
   child.unref();
   logger.info(`Emulator launched (PID ${child.pid}). Logs: ${logPath}`);
-  const earlyExit = new Promise((resolve4) => {
-    child.once("exit", (code) => resolve4(code));
-    child.once("error", () => resolve4(-1));
+  const earlyExit = new Promise((resolve6) => {
+    child.once("exit", (code) => resolve6(code));
+    child.once("error", () => resolve6(-1));
   });
-  const liveness = new Promise((resolve4) => setTimeout(() => resolve4("alive"), 2e3));
+  const liveness = new Promise((resolve6) => setTimeout(() => resolve6("alive"), 2e3));
   const outcome = await Promise.race([earlyExit, liveness]);
   if (outcome !== "alive") {
     const tail = readTail(logPath, 4e3);
@@ -1715,24 +1804,24 @@ ${tail}` : ""}`);
 }
 function readTail(filePath, bytes) {
   try {
-    const stat = fs15.statSync(filePath);
+    const stat = fs16.statSync(filePath);
     const start = Math.max(0, stat.size - bytes);
-    const fd = fs15.openSync(filePath, "r");
+    const fd = fs16.openSync(filePath, "r");
     try {
       const buf = Buffer.alloc(stat.size - start);
-      fs15.readSync(fd, buf, 0, buf.length, start);
+      fs16.readSync(fd, buf, 0, buf.length, start);
       return buf.toString("utf8");
     } finally {
-      fs15.closeSync(fd);
+      fs16.closeSync(fd);
     }
   } catch {
     return "";
   }
 }
 async function stopEmulator(logger = noopLogger) {
-  if (fs15.existsSync(PID_FILE)) {
+  if (fs16.existsSync(PID_FILE)) {
     try {
-      const pid = Number(fs15.readFileSync(PID_FILE, "utf8").trim());
+      const pid = Number(fs16.readFileSync(PID_FILE, "utf8").trim());
       if (Number.isFinite(pid) && pid > 0) {
         try {
           process.kill(pid, "SIGTERM");
@@ -1745,13 +1834,13 @@ async function stopEmulator(logger = noopLogger) {
       logger.warn(`Could not read PID file: ${err.message}`);
     }
   }
-  const [killCmd, ...killArgs] = os7.platform() === "win32" ? ["taskkill", "/IM", "qemu-system-x86_64.exe", "/F"] : ["pkill", "-f", "qemu-system-x86_64"];
+  const [killCmd, ...killArgs] = os8.platform() === "win32" ? ["taskkill", "/IM", "qemu-system-x86_64.exe", "/F"] : ["pkill", "-f", "qemu-system-x86_64"];
   try {
     await runProcess({ command: killCmd, args: killArgs, logger });
   } catch (err) {
     logger.warn(`[emulator] could not run ${killCmd}: ${err.message}`);
   }
-  fs15.rm(PID_FILE, { force: true }, (err) => {
+  fs16.rm(PID_FILE, { force: true }, (err) => {
     if (err) logger.warn(`Could not remove PID file: ${err.message}`);
   });
 }
@@ -1874,7 +1963,7 @@ async function getDisplaySize(config, opts = {}) {
 
 // src/hdc/wait.ts
 function delay(ms, signal) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     if (signal?.aborted) {
       reject(new CancelledError("Wait cancelled."));
       return;
@@ -1889,7 +1978,7 @@ function delay(ms, signal) {
     };
     const timer = setTimeout(() => {
       cleanup();
-      resolve4();
+      resolve6();
     }, ms);
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -1918,20 +2007,20 @@ async function waitForCondition(opts) {
 }
 
 // src/hdc/app.ts
-import * as fs17 from "fs";
-import * as path17 from "path";
+import * as fs18 from "fs";
+import * as path18 from "path";
 
 // src/hdc/project.ts
-import * as fs16 from "fs";
-import * as path16 from "path";
+import * as fs17 from "fs";
+import * as path17 from "path";
 import JSON53 from "json5";
 function readJson5(filePath) {
-  const content = fs16.readFileSync(filePath, "utf-8");
+  const content = fs17.readFileSync(filePath, "utf-8");
   return JSON53.parse(content);
 }
 function getBundleName(projectDir) {
-  const appJsonPath = path16.join(projectDir, "AppScope", "app.json5");
-  if (!fs16.existsSync(appJsonPath)) {
+  const appJsonPath = path17.join(projectDir, "AppScope", "app.json5");
+  if (!fs17.existsSync(appJsonPath)) {
     throw new OniroError(`Could not find app.json5 at ${appJsonPath}`);
   }
   const appJson = readJson5(appJsonPath);
@@ -1941,8 +2030,8 @@ function getBundleName(projectDir) {
   return appJson.app.bundleName;
 }
 function getMainAbility(projectDir, moduleName = "entry", abilityName) {
-  const moduleJsonPath = path16.join(projectDir, moduleName, "src", "main", "module.json5");
-  if (!fs16.existsSync(moduleJsonPath)) {
+  const moduleJsonPath = path17.join(projectDir, moduleName, "src", "main", "module.json5");
+  if (!fs17.existsSync(moduleJsonPath)) {
     throw new OniroError(`Could not find module.json5 at ${moduleJsonPath}`);
   }
   const moduleJson = readJson5(moduleJsonPath);
@@ -1965,8 +2054,8 @@ function getMainAbility(projectDir, moduleName = "entry", abilityName) {
 async function installApp(opts) {
   const logger = scopedLogger(opts.logger ?? noopLogger, "hdc");
   const relativeHapPath = opts.hapPath ?? opts.config.get("hapPath", defaultPaths.hapPath);
-  const hapPath = path17.isAbsolute(relativeHapPath) ? relativeHapPath : path17.join(opts.projectDir, relativeHapPath);
-  if (!fs17.existsSync(hapPath)) {
+  const hapPath = path18.isAbsolute(relativeHapPath) ? relativeHapPath : path18.join(opts.projectDir, relativeHapPath);
+  if (!fs18.existsSync(hapPath)) {
     throw new OniroError(`HAP file not found at: ${hapPath}. Build and sign the app first.`);
   }
   const result = await hdcExec({
@@ -2055,7 +2144,7 @@ function listRunningProcesses(config, options = {}) {
   const logger = options.logger ?? noopLogger;
   const timeoutMs = options.timeoutMs ?? 1e3;
   const hdc = getHdcPath(config);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     let proc;
     try {
       proc = spawnCompat(hdc, ["track-jpid"]);
@@ -2075,7 +2164,7 @@ function listRunningProcesses(config, options = {}) {
         if (options.targetProcessName && name === options.targetProcessName && !resolved) {
           resolved = true;
           killProcessTree(proc);
-          resolve4(pid);
+          resolve6(pid);
           return;
         }
       }
@@ -2096,7 +2185,7 @@ function listRunningProcesses(config, options = {}) {
       if (options.targetProcessName) {
         reject(new OniroError(`Could not find process for bundle: ${options.targetProcessName}`));
       } else {
-        resolve4(processes);
+        resolve6(processes);
       }
     }, timeoutMs);
     proc.on("close", () => {
@@ -2106,7 +2195,7 @@ function listRunningProcesses(config, options = {}) {
       if (options.targetProcessName) {
         reject(new OniroError(`Could not find process for bundle: ${options.targetProcessName}`));
       } else {
-        resolve4(processes);
+        resolve6(processes);
       }
     });
   });
@@ -2250,12 +2339,12 @@ async function reboot(opts) {
 }
 
 // src/hdc/screen.ts
-import * as fs18 from "fs";
-import * as os8 from "os";
-import * as path18 from "path";
+import * as fs19 from "fs";
+import * as os9 from "os";
+import * as path19 from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 function tmpName(ext) {
-  return path18.join(os8.tmpdir(), `oniro_screen_${randomBytes2(6).toString("hex")}.${ext}`);
+  return path19.join(os9.tmpdir(), `oniro_screen_${randomBytes2(6).toString("hex")}.${ext}`);
 }
 async function takeScreenshot(opts) {
   const remote = "/data/local/tmp/oniro_screenshot.jpeg";
@@ -2265,11 +2354,11 @@ async function takeScreenshot(opts) {
   const local = tmpName("jpeg");
   try {
     await recvFile({ config: opts.config, remote, local, deviceSerial: opts.deviceSerial, timeoutMs });
-    const pixels = await fs18.promises.readFile(local);
+    const pixels = await fs19.promises.readFile(local);
     const size = await getDisplaySize(opts.config, { deviceSerial: opts.deviceSerial }) ?? { width: 0, height: 0 };
     return { pixels, width: size.width, height: size.height };
   } finally {
-    fs18.promises.unlink(local).catch(() => {
+    fs19.promises.unlink(local).catch(() => {
     });
     void shell({ config: opts.config, command: `rm -f ${remote}`, deviceSerial: opts.deviceSerial }).catch(() => {
     });
@@ -2288,9 +2377,9 @@ async function captureBurst(opts) {
       const local = tmpName(`burst_${i}.jpeg`);
       try {
         await recvFile({ config: opts.config, remote: `${remoteDir}/f${i}.jpeg`, local, deviceSerial: opts.deviceSerial });
-        frames.push(await fs18.promises.readFile(local));
+        frames.push(await fs19.promises.readFile(local));
       } finally {
-        fs18.promises.unlink(local).catch(() => {
+        fs19.promises.unlink(local).catch(() => {
         });
       }
     }
@@ -2416,9 +2505,9 @@ async function sendRawTouch(opts) {
 }
 
 // src/hdc/dump.ts
-import * as fs19 from "fs";
-import * as os9 from "os";
-import * as path19 from "path";
+import * as fs20 from "fs";
+import * as os10 from "os";
+import * as path20 from "path";
 import { randomBytes as randomBytes3 } from "crypto";
 function parseBounds(s) {
   const m = /^\[(-?\d+),(-?\d+)\]\[(-?\d+),(-?\d+)\]$/.exec(s ?? "");
@@ -2503,10 +2592,10 @@ async function dumpLayout(opts) {
   if (!m) throw new OniroError(`Could not parse dumpLayout output:
 ${dump.stdout}`);
   const remote = m[1];
-  const local = path19.join(os9.tmpdir(), `oniro_layout_${randomBytes3(6).toString("hex")}.json`);
+  const local = path20.join(os10.tmpdir(), `oniro_layout_${randomBytes3(6).toString("hex")}.json`);
   try {
     await recvFile({ config: opts.config, remote, local, deviceSerial: opts.deviceSerial, timeoutMs });
-    const parsed = JSON.parse(await fs19.promises.readFile(local, "utf8"));
+    const parsed = JSON.parse(await fs20.promises.readFile(local, "utf8"));
     const display = await getDisplaySize(opts.config, { deviceSerial: opts.deviceSerial });
     if (opts.prune === false) {
       return { display, tree: parsed };
@@ -2515,7 +2604,7 @@ ${dump.stdout}`);
     const tree = Array.isArray(prunedRaw) ? { children: prunedRaw } : prunedRaw ?? { children: [] };
     return { display, tree };
   } finally {
-    fs19.promises.unlink(local).catch(() => {
+    fs20.promises.unlink(local).catch(() => {
     });
     void shell({ config: opts.config, command: `rm -f ${remote}`, deviceSerial: opts.deviceSerial }).catch(() => {
     });
@@ -2526,7 +2615,7 @@ ${dump.stdout}`);
 function setHilogLevel(opts) {
   const logger = opts.logger ?? noopLogger;
   const hdc = getHdcPath(opts.config);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     let child;
     try {
       child = spawnCompat(hdc, ["shell", "hilog", "-b", opts.level]);
@@ -2546,7 +2635,7 @@ function setHilogLevel(opts) {
     });
     child.once("close", (code) => {
       if (code === 0) {
-        resolve4();
+        resolve6();
       } else {
         const msg = stderr.trim() || `hdc shell hilog -b ${opts.level} exited with code ${code}`;
         logger.error(`[hilog] ${msg}`);
@@ -2601,7 +2690,7 @@ async function resolveProcessId(config, bundle, deviceSerial) {
   return proc?.pid;
 }
 function waitForLog(opts) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const deadline = Date.now() + opts.timeoutMs;
     let settled = false;
     let child = null;
@@ -2620,7 +2709,7 @@ function waitForLog(opts) {
       if (settled) return;
       settled = true;
       cleanup();
-      resolve4(entry);
+      resolve6(entry);
     };
     const fail = (err) => {
       if (settled) return;
@@ -2667,7 +2756,7 @@ function waitForLog(opts) {
   });
 }
 function watchLog(opts) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const matches = [];
     let settled = false;
     let child = null;
@@ -2684,7 +2773,7 @@ function watchLog(opts) {
       if (settled) return;
       settled = true;
       cleanup();
-      resolve4(opts.dedup === false ? matches : dedupEntries(matches));
+      resolve6(opts.dedup === false ? matches : dedupEntries(matches));
     };
     const onAbort = () => {
       if (settled) return;
@@ -2740,8 +2829,43 @@ async function dumpLog(opts) {
 }
 
 // src/build/runHvigorw.ts
-import * as fs20 from "fs";
-import * as path20 from "path";
+import * as fs22 from "fs";
+import * as path22 from "path";
+
+// src/harmonyos/target.ts
+import * as fs21 from "fs";
+import * as path21 from "path";
+import JSON54 from "json5";
+function detectRuntimeOs(projectDir, productName) {
+  let products = [];
+  try {
+    const parsed = JSON54.parse(fs21.readFileSync(path21.join(projectDir, "build-profile.json5"), "utf-8"));
+    if (Array.isArray(parsed.app?.products)) products = parsed.app.products;
+  } catch {
+    return "OpenHarmony";
+  }
+  const product = products.find((p) => p.name === productName) ?? products[0];
+  return product?.runtimeOS === "HarmonyOS" ? "HarmonyOS" : "OpenHarmony";
+}
+var HARMONYOS_SDK_VERSIONS = /* @__PURE__ */ new Map([
+  [12, "5.0.0"],
+  [13, "5.0.1"],
+  [14, "5.0.2"],
+  [15, "5.0.3"],
+  [16, "5.0.4"],
+  [17, "5.0.5"],
+  [18, "5.1.0"],
+  [19, "5.1.1"],
+  [20, "6.0.0"],
+  [21, "6.0.1"],
+  [24, "6.1.1"]
+]);
+function harmonyOsSdkLabelForApi(api) {
+  const version = HARMONYOS_SDK_VERSIONS.get(api);
+  return version ? `${version}(${api})` : void 0;
+}
+
+// src/build/runHvigorw.ts
 function buildHvigorwArgs(opts) {
   const args = [opts.task ?? "assembleHap", "--mode", "module"];
   args.push("-p", `product=${opts.product ?? "default"}`);
@@ -2756,28 +2880,36 @@ function runHvigorw(opts) {
   const { config } = opts;
   const projectDir = toLongPath(opts.projectDir);
   const logger = opts.logger ?? noopLogger;
-  if (!fs20.existsSync(path20.join(projectDir, "build-profile.json5"))) {
+  if (!fs22.existsSync(path22.join(projectDir, "build-profile.json5"))) {
     throw new OniroError(`Not an OpenHarmony project: ${projectDir} (build-profile.json5 not found).`);
   }
-  if (!fs20.existsSync(getCmdToolsPath(config))) {
-    throw new CmdToolsNotInstalledError(getCmdToolsPath(config));
+  let hvigorw;
+  let sdkEnv;
+  if (detectRuntimeOs(projectDir, opts.product) === "HarmonyOS") {
+    const sdk = requireHarmonyOsSdk({ config, logger });
+    sdkEnv = { DEVECO_SDK_HOME: sdk.sdkPath };
+    const resolved = getHvigorwPath(config, projectDir);
+    hvigorw = resolved.startsWith(projectDir) ? resolved : findHarmonyOsTool(sdk, "hvigorw") ?? resolved;
+    logger.info(`[build] Building for HarmonyOS against the SDK at ${sdk.sdkPath}.`);
+  } else {
+    if (!fs22.existsSync(getCmdToolsPath(config))) {
+      throw new CmdToolsNotInstalledError(getCmdToolsPath(config));
+    }
+    sdkEnv = { OHOS_BASE_SDK_HOME: getOhosBaseSdkHome(config) };
+    hvigorw = getHvigorwPath(config, projectDir);
   }
-  const hvigorw = getHvigorwPath(config, projectDir);
-  if (!fs20.existsSync(hvigorw)) {
+  if (!fs22.existsSync(hvigorw)) {
     throw new OniroError(`hvigorw wrapper not found at ${hvigorw}.`);
   }
   const args = buildHvigorwArgs(opts);
   if (process.platform !== "win32") {
     try {
-      fs20.chmodSync(hvigorw, 493);
+      fs22.chmodSync(hvigorw, 493);
     } catch {
     }
   }
-  const env = {
-    ...process.env,
-    OHOS_BASE_SDK_HOME: getOhosBaseSdkHome(config)
-  };
-  return new Promise((resolve4, reject) => {
+  const env = { ...process.env, ...sdkEnv };
+  return new Promise((resolve6, reject) => {
     if (opts.abortSignal?.aborted) {
       reject(new CancelledError("hvigorw build cancelled."));
       return;
@@ -2821,15 +2953,15 @@ function runHvigorw(opts) {
       settled = true;
       cleanup();
       const exitCode = code ?? 1;
-      if (exitCode === 0) resolve4({ exitCode });
+      if (exitCode === 0) resolve6({ exitCode });
       else reject(new OniroError(`hvigorw exited with code ${exitCode}`));
     });
   });
 }
 
 // src/build/discoverHaps.ts
-import * as fs21 from "fs";
-import * as path21 from "path";
+import * as fs23 from "fs";
+import * as path23 from "path";
 function moduleOfHap(hapFileName) {
   const dash = hapFileName.indexOf("-");
   return dash > 0 ? hapFileName.slice(0, dash) : hapFileName.replace(/\.hap$/i, "");
@@ -2840,9 +2972,9 @@ async function discoverHaps(opts) {
   const result = {};
   const walk = async (dir, depth) => {
     if (depth > maxDepth) return;
-    const entries = await fs21.promises.readdir(dir, { withFileTypes: true }).catch(() => []);
+    const entries = await fs23.promises.readdir(dir, { withFileTypes: true }).catch(() => []);
     for (const e of entries) {
-      const full = path21.join(dir, e.name);
+      const full = path23.join(dir, e.name);
       if (e.isDirectory()) {
         if (e.name === "node_modules" || e.name === "oh_modules" || e.name === ".git") continue;
         await walk(full, depth + 1);
@@ -2859,11 +2991,11 @@ async function discoverHaps(opts) {
 }
 
 // src/build/ohpm.ts
-import * as fs22 from "fs";
-import * as path22 from "path";
+import * as fs24 from "fs";
+import * as path24 from "path";
 function runOhpm(opts) {
   return runProcess({
-    command: getOhpmPath(opts.config),
+    command: opts.ohpmPath ?? getOhpmPath(opts.config),
     args: [...opts.args],
     cwd: opts.projectDir,
     timeoutMs: opts.timeoutMs ?? 6e5,
@@ -2873,12 +3005,13 @@ function runOhpm(opts) {
   });
 }
 async function ensureOhModules(opts) {
-  if (fs22.existsSync(path22.join(opts.projectDir, "oh_modules"))) {
+  if (fs24.existsSync(path24.join(opts.projectDir, "oh_modules"))) {
     return { installed: false };
   }
   const res = await runOhpm({
     config: opts.config,
     projectDir: opts.projectDir,
+    ohpmPath: opts.ohpmPath,
     args: ["install", "--all"],
     abortSignal: opts.abortSignal,
     onOutput: opts.onOutput,
@@ -2926,10 +3059,13 @@ async function buildHap(opts) {
   const warnings = [];
   const start = Date.now();
   const projectDir = toLongPath(opts.projectDir);
+  const isHarmonyOs = detectRuntimeOs(projectDir, opts.product) === "HarmonyOS";
   if (opts.autoInstallDeps !== false) {
+    const harmonySdk = isHarmonyOs ? findHarmonyOsSdk({ config: opts.config, logger: opts.logger }) : null;
     const r = await ensureOhModules({
       config: opts.config,
       projectDir,
+      ohpmPath: (harmonySdk && findHarmonyOsTool(harmonySdk, "ohpm")) ?? void 0,
       abortSignal: opts.abortSignal,
       onOutput: opts.onOutput,
       logger: opts.logger
@@ -2952,7 +3088,7 @@ async function buildHap(opts) {
   const anySigned = Object.values(discoveredHaps).some((m) => m.signed.length > 0);
   if (!anySigned) {
     warnings.push(
-      "No signed HAPs found \u2014 configure signingConfigs in build-profile.json5 (unsigned HAPs are rejected by most devices)."
+      isHarmonyOs ? "No signed HAPs found \u2014 run `oniro-app sign --harmonyos` to have AppGallery Connect issue a certificate and profile." : "No signed HAPs found \u2014 configure signingConfigs in build-profile.json5 (unsigned HAPs are rejected by most devices)."
     );
   }
   return { exitCode, durationMs: Date.now() - start, discoveredHaps, warnings };
@@ -2969,21 +3105,21 @@ function isValidBundleName(bundleName) {
 }
 
 // src/project/templates.ts
-import * as fs23 from "fs";
-import * as path23 from "path";
+import * as fs25 from "fs";
+import * as path25 from "path";
 function toHumanTemplateName(folderName) {
   return folderName.replace(/([a-z])([A-Z])/g, "$1 $2");
 }
 function listTemplates(templateRoot) {
-  if (!fs23.existsSync(templateRoot)) return [];
-  const entries = fs23.readdirSync(templateRoot, { withFileTypes: true });
+  if (!fs25.existsSync(templateRoot)) return [];
+  const entries = fs25.readdirSync(templateRoot, { withFileTypes: true });
   return entries.filter((e) => e.isDirectory()).map((e) => {
-    const dir = path23.join(templateRoot, e.name);
-    const metaPath = path23.join(dir, "template.json");
+    const dir = path25.join(templateRoot, e.name);
+    const metaPath = path25.join(dir, "template.json");
     let meta = {};
-    if (fs23.existsSync(metaPath)) {
+    if (fs25.existsSync(metaPath)) {
       try {
-        meta = JSON.parse(fs23.readFileSync(metaPath, "utf8"));
+        meta = JSON.parse(fs25.readFileSync(metaPath, "utf8"));
       } catch {
       }
     }
@@ -2998,57 +3134,57 @@ function listTemplates(templateRoot) {
 function validateTemplateLayout(templateDir, defaultModuleName) {
   const required = [
     "build-profile.json5",
-    path23.join("AppScope", "app.json5"),
-    path23.join(defaultModuleName, "src", "main", "module.json5"),
-    path23.join(defaultModuleName, "oh-package.json5"),
+    path25.join("AppScope", "app.json5"),
+    path25.join(defaultModuleName, "src", "main", "module.json5"),
+    path25.join(defaultModuleName, "oh-package.json5"),
     "hvigorfile.ts"
   ];
-  return required.filter((rel) => !fs23.existsSync(path23.join(templateDir, rel)));
+  return required.filter((rel) => !fs25.existsSync(path25.join(templateDir, rel)));
 }
 
 // src/project/createScaffold.ts
-import * as fs25 from "fs";
-import * as path24 from "path";
+import * as fs27 from "fs";
+import * as path26 from "path";
 
 // src/project/jsonHelpers.ts
-import * as fs24 from "fs";
-import JSON54 from "json5";
+import * as fs26 from "fs";
+import JSON55 from "json5";
 function readJson5File(filePath) {
-  return JSON54.parse(fs24.readFileSync(filePath, "utf8"));
+  return JSON55.parse(fs26.readFileSync(filePath, "utf8"));
 }
 function writeJson5File(filePath, value) {
-  fs24.writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", "utf8");
+  fs26.writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", "utf8");
 }
 function readJsonFile(filePath) {
-  return JSON.parse(fs24.readFileSync(filePath, "utf8"));
+  return JSON.parse(fs26.readFileSync(filePath, "utf8"));
 }
 function writeJsonFile(filePath, value) {
-  fs24.writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", "utf8");
+  fs26.writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", "utf8");
 }
 
 // src/project/createScaffold.ts
 var IGNORED_DIRS = /* @__PURE__ */ new Set(["oh_modules", "node_modules", "build", ".hvigor"]);
 async function pathExists(p) {
   try {
-    await fs25.promises.access(p);
+    await fs27.promises.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function copyDirRecursive(srcDir, destDir) {
-  await fs25.promises.mkdir(destDir, { recursive: true });
-  const entries = await fs25.promises.readdir(srcDir, { withFileTypes: true });
+  await fs27.promises.mkdir(destDir, { recursive: true });
+  const entries = await fs27.promises.readdir(srcDir, { withFileTypes: true });
   for (const entry of entries) {
-    const src = path24.join(srcDir, entry.name);
-    const dest = path24.join(destDir, entry.name);
+    const src = path26.join(srcDir, entry.name);
+    const dest = path26.join(destDir, entry.name);
     if (entry.isDirectory()) {
       await copyDirRecursive(src, dest);
     } else if (entry.isSymbolicLink()) {
       continue;
     } else if (entry.isFile()) {
       if (entry.name === "template.json") continue;
-      await fs25.promises.copyFile(src, dest);
+      await fs27.promises.copyFile(src, dest);
     }
   }
 }
@@ -3056,9 +3192,9 @@ async function normalizeJson5ToJson(projectDir, logger) {
   const stack = [projectDir];
   while (stack.length > 0) {
     const currentDir = stack.pop();
-    const entries = await fs25.promises.readdir(currentDir, { withFileTypes: true });
+    const entries = await fs27.promises.readdir(currentDir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path24.join(currentDir, entry.name);
+      const fullPath = path26.join(currentDir, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
         stack.push(fullPath);
@@ -3080,23 +3216,23 @@ function toJavaPropertiesPath(p) {
 function createOrUpdateLocalProperties(projectDir, sdkDir) {
   const content = `sdk.dir=${toJavaPropertiesPath(sdkDir)}
 `;
-  fs25.writeFileSync(path24.join(projectDir, "local.properties"), content, "utf8");
+  fs27.writeFileSync(path26.join(projectDir, "local.properties"), content, "utf8");
 }
 function renameIfExists(fromPath, toPath) {
-  if (fs25.existsSync(fromPath) && fromPath !== toPath) {
-    fs25.renameSync(fromPath, toPath);
+  if (fs27.existsSync(fromPath) && fromPath !== toPath) {
+    fs27.renameSync(fromPath, toPath);
   }
 }
 function updateTemplateConfigs(projectDir, args, sdkBaseDir) {
-  const appJsonPath = path24.join(projectDir, "AppScope", "app.json5");
-  if (fs25.existsSync(appJsonPath)) {
+  const appJsonPath = path26.join(projectDir, "AppScope", "app.json5");
+  if (fs27.existsSync(appJsonPath)) {
     const appJson = readJson5File(appJsonPath);
     appJson.app = appJson.app ?? {};
     appJson.app.bundleName = args.bundleName;
     writeJson5File(appJsonPath, appJson);
   }
-  const stringsPath = path24.join(projectDir, "AppScope", "resources", "base", "element", "string.json");
-  if (fs25.existsSync(stringsPath)) {
+  const stringsPath = path26.join(projectDir, "AppScope", "resources", "base", "element", "string.json");
+  if (fs27.existsSync(stringsPath)) {
     const strings = readJsonFile(stringsPath);
     if (Array.isArray(strings.string)) {
       const appName = strings.string.find((s) => s.name === "app_name");
@@ -3104,13 +3240,13 @@ function updateTemplateConfigs(projectDir, args, sdkBaseDir) {
     }
     writeJsonFile(stringsPath, strings);
   }
-  const buildProfilePath = path24.join(projectDir, "build-profile.json5");
-  if (fs25.existsSync(buildProfilePath)) {
+  const buildProfilePath = path26.join(projectDir, "build-profile.json5");
+  if (fs27.existsSync(buildProfilePath)) {
     const buildProfile = readJson5File(buildProfilePath);
     buildProfile.app = buildProfile.app ?? {};
     if (Array.isArray(buildProfile.app.products) && buildProfile.app.products.length > 0) {
-      buildProfile.app.products[0].compileSdkVersion = args.sdkApi;
-      buildProfile.app.products[0].compatibleSdkVersion = args.sdkApi;
+      buildProfile.app.products[0].compileSdkVersion = args.sdkVersion;
+      buildProfile.app.products[0].compatibleSdkVersion = args.sdkVersion;
     }
     if (Array.isArray(buildProfile.modules) && buildProfile.modules.length > 0) {
       buildProfile.modules[0].name = args.moduleName;
@@ -3118,23 +3254,23 @@ function updateTemplateConfigs(projectDir, args, sdkBaseDir) {
     }
     writeJson5File(buildProfilePath, buildProfile);
   }
-  const moduleJsonPath = path24.join(projectDir, args.moduleName, "src", "main", "module.json5");
-  if (fs25.existsSync(moduleJsonPath)) {
+  const moduleJsonPath = path26.join(projectDir, args.moduleName, "src", "main", "module.json5");
+  if (fs27.existsSync(moduleJsonPath)) {
     const moduleJson = readJson5File(moduleJsonPath);
     moduleJson.module = moduleJson.module ?? {};
     moduleJson.module.name = args.moduleName;
     writeJson5File(moduleJsonPath, moduleJson);
   }
-  const moduleOhPackagePath = path24.join(projectDir, args.moduleName, "oh-package.json5");
-  if (fs25.existsSync(moduleOhPackagePath)) {
+  const moduleOhPackagePath = path26.join(projectDir, args.moduleName, "oh-package.json5");
+  if (fs27.existsSync(moduleOhPackagePath)) {
     const pkg = readJson5File(moduleOhPackagePath);
     pkg.name = args.moduleName;
     writeJson5File(moduleOhPackagePath, pkg);
   }
-  const vscodeDir = path24.join(projectDir, ".vscode");
-  fs25.mkdirSync(vscodeDir, { recursive: true });
+  const vscodeDir = path26.join(projectDir, ".vscode");
+  fs27.mkdirSync(vscodeDir, { recursive: true });
   const hapPath = `${args.moduleName}/build/default/outputs/default/${args.moduleName}-default-signed.hap`;
-  writeJsonFile(path24.join(vscodeDir, "settings.json"), {
+  writeJsonFile(path26.join(vscodeDir, "settings.json"), {
     "oniro.hapPath": hapPath,
     "files.associations": { "*.json5": "jsonc" }
   });
@@ -3151,7 +3287,7 @@ async function createScaffold(opts) {
   if (!opts.location || !await pathExists(opts.location)) {
     throw new OniroError(`Location does not exist: ${opts.location}`);
   }
-  const templateDir = path24.join(opts.templateRoot, opts.templateId);
+  const templateDir = path26.join(opts.templateRoot, opts.templateId);
   if (!await pathExists(templateDir)) {
     throw new OniroError(`Template not found: ${templateDir}`);
   }
@@ -3164,38 +3300,60 @@ async function createScaffold(opts) {
     throw new OniroError(`Template '${opts.templateId}' is missing required files:
 - ${missing.join("\n- ")}`);
   }
-  const projectDir = path24.join(opts.location, opts.projectName);
+  let sdkVersion = opts.sdkApi;
+  let sdkBaseDir = getOhosBaseSdkHome(opts.config);
+  if (detectRuntimeOs(templateDir) === "HarmonyOS") {
+    const harmonySdk = findHarmonyOsSdk({ config: opts.config, logger });
+    const label = harmonySdk?.version?.endsWith(`(${opts.sdkApi})`) ? harmonySdk.version : harmonyOsSdkLabelForApi(opts.sdkApi);
+    if (!label) {
+      throw new OniroError(
+        `No HarmonyOS release is known for API ${opts.sdkApi}. Known: ${[...HARMONYOS_SDK_VERSIONS.keys()].join(", ")}` + (harmonySdk?.version ? `, and the installed SDK's ${harmonySdk.version}.` : ".")
+      );
+    }
+    sdkVersion = label;
+    if (!harmonySdk) {
+      logger.warn("[create] No HarmonyOS SDK found; set ONIRO_HARMONYOS_SDK_PATH before building.");
+    } else {
+      sdkBaseDir = harmonySdk.sdkPath;
+      if (harmonySdk.version && harmonySdk.version !== label) {
+        logger.warn(
+          `[create] The HarmonyOS SDK at ${harmonySdk.sdkPath} is ${harmonySdk.version}, so a project declaring ${label} will not build against it. Install ${label}, or create with the installed API level.`
+        );
+      }
+    }
+  }
+  const projectDir = path26.join(opts.location, opts.projectName);
   if (await pathExists(projectDir)) {
     if (!opts.overwrite) {
       throw new OniroError(`Destination already exists: ${projectDir}. Pass overwrite: true to replace it.`);
     }
-    await fs25.promises.rm(projectDir, { recursive: true, force: true });
+    await fs27.promises.rm(projectDir, { recursive: true, force: true });
   }
   logger.info(`[create] Scaffolding ${opts.templateId} at ${projectDir}`);
   await copyDirRecursive(templateDir, projectDir);
   if (moduleName !== defaultModuleName) {
-    renameIfExists(path24.join(projectDir, defaultModuleName), path24.join(projectDir, moduleName));
+    renameIfExists(path26.join(projectDir, defaultModuleName), path26.join(projectDir, moduleName));
   }
   updateTemplateConfigs(
     projectDir,
     {
       projectName: opts.projectName,
       bundleName: opts.bundleName,
-      sdkApi: opts.sdkApi,
+      sdkVersion,
       moduleName
     },
-    getOhosBaseSdkHome(opts.config)
+    sdkBaseDir
   );
   await normalizeJson5ToJson(projectDir, logger);
   return { projectDir };
 }
 
 // src/project/listModules.ts
-import * as fs26 from "fs";
-import * as path25 from "path";
+import * as fs28 from "fs";
+import * as path27 from "path";
 function listModules(opts) {
-  const buildProfile = path25.join(opts.projectDir, "build-profile.json5");
-  if (!fs26.existsSync(buildProfile)) {
+  const buildProfile = path27.join(opts.projectDir, "build-profile.json5");
+  if (!fs28.existsSync(buildProfile)) {
     throw new OniroError(`build-profile.json5 not found at ${buildProfile}`);
   }
   const parsed = readJson5File(buildProfile);
@@ -3207,12 +3365,12 @@ function listModules(opts) {
 }
 
 // src/project/abilities.ts
-import * as fs27 from "fs";
-import * as path26 from "path";
+import * as fs29 from "fs";
+import * as path28 from "path";
 function listAbilities(opts) {
   const moduleName = opts.moduleName ?? "entry";
-  const moduleJsonPath = path26.join(opts.projectDir, moduleName, "src", "main", "module.json5");
-  if (!fs27.existsSync(moduleJsonPath)) {
+  const moduleJsonPath = path28.join(opts.projectDir, moduleName, "src", "main", "module.json5");
+  if (!fs29.existsSync(moduleJsonPath)) {
     throw new OniroError(`Could not find module.json5 at ${moduleJsonPath}`);
   }
   const parsed = readJson5File(moduleJsonPath);
@@ -3220,12 +3378,12 @@ function listAbilities(opts) {
 }
 
 // src/project/prepareSigning.ts
-import * as fs28 from "fs";
-import * as path27 from "path";
+import * as fs30 from "fs";
+import * as path29 from "path";
 function hasSigningArtifacts(dir) {
-  if (!fs28.existsSync(path27.join(dir, "signatures"))) return false;
-  const buildProfile = path27.join(dir, "build-profile.json5");
-  if (!fs28.existsSync(buildProfile)) return false;
+  if (!fs30.existsSync(path29.join(dir, "signatures"))) return false;
+  const buildProfile = path29.join(dir, "build-profile.json5");
+  if (!fs30.existsSync(buildProfile)) return false;
   try {
     const parsed = readJson5File(buildProfile);
     return Array.isArray(parsed.app?.signingConfigs) && parsed.app.signingConfigs.length > 0;
@@ -3315,8 +3473,8 @@ async function diffHapAssets(opts) {
 }
 
 // src/install/apply.ts
-import * as fs29 from "fs";
-import * as path28 from "path";
+import * as fs31 from "fs";
+import * as path30 from "path";
 function decideInstallMethod(s) {
   if (!s.signInfoInconsistent) return "replace";
   if (s.isSystemBundle && !s.allowUninstall) return "refuse";
@@ -3337,7 +3495,7 @@ async function pidOf(config, bundle, deviceSerial) {
 async function resolveHapPath(opts) {
   let hapPath = opts.hapPath;
   if (hapPath) {
-    if (!path28.isAbsolute(hapPath) && opts.projectDir) hapPath = path28.join(opts.projectDir, hapPath);
+    if (!path30.isAbsolute(hapPath) && opts.projectDir) hapPath = path30.join(opts.projectDir, hapPath);
   } else {
     if (!opts.projectDir) throw new OniroError("applyChanges requires hapPath or projectDir.");
     const haps = await discoverHaps({ projectDir: opts.projectDir });
@@ -3356,7 +3514,7 @@ async function resolveHapPath(opts) {
       hapPath = withSigned[0][1].signed[0];
     }
   }
-  if (!fs29.existsSync(hapPath)) throw new OniroError(`HAP not found at ${hapPath}.`);
+  if (!fs31.existsSync(hapPath)) throw new OniroError(`HAP not found at ${hapPath}.`);
   return hapPath;
 }
 async function applyChanges(opts) {
@@ -3366,7 +3524,7 @@ async function applyChanges(opts) {
   const allowUninstall = opts.allowUninstall ?? false;
   const hapPath = await resolveHapPath(opts);
   let assetsChanged = false;
-  if (opts.installedHapPath && fs29.existsSync(opts.installedHapPath)) {
+  if (opts.installedHapPath && fs31.existsSync(opts.installedHapPath)) {
     try {
       const diff = await diffHapAssets({ installedHap: opts.installedHapPath, newHap: hapPath });
       assetsChanged = diff.addedAssetPaths.length > 0 || diff.removedAssetPaths.length > 0;
@@ -3407,20 +3565,1201 @@ async function applyChanges(opts) {
   return { method, preInstallPid, postInstallPid, replaced: installMethod === "replace", cacheCleared };
 }
 
+// src/harmonyos/auth/endpoints.ts
+var HUAWEI_APP_ID = "1009";
+var HUAWEI_API_VERSION = "1.0.0";
+var LOGIN_TIMEOUT_MS = 6e5;
+var HUAWEI_SITES = {
+  CN: {
+    code: "CN",
+    siteId: "1",
+    siteParam: "CN",
+    loginUrl: "https://cn.devecostudio.huawei.com",
+    agcBaseUrl: "https://connect-api.cloud.huawei.com",
+    language: "zh_CN"
+  },
+  SG: {
+    code: "SG",
+    siteId: "5",
+    siteParam: "SG",
+    loginUrl: "https://sg.devecostudio.huawei.com",
+    agcBaseUrl: "https://connect-api-dra.cloud.huawei.com",
+    language: "zh_CN"
+  },
+  EU: {
+    code: "EU",
+    siteId: "7",
+    siteParam: "DE",
+    loginUrl: "https://de.devecostudio.huawei.com",
+    agcBaseUrl: "https://connect-api-dre.cloud.huawei.com",
+    language: "de_DE"
+  },
+  RU: {
+    code: "RU",
+    siteId: "8",
+    siteParam: "RU",
+    loginUrl: "https://ru.devecostudio.huawei.com",
+    agcBaseUrl: "https://connect-api-drru.cloud.huawei.com",
+    language: "ru_RU"
+  }
+};
+var AGC_TEAMS_URL = "https://connect-api.cloud.huawei.com/api/ups/user-permission-service/v1/user-team-list";
+function siteForId(siteId) {
+  return Object.values(HUAWEI_SITES).find((s) => s.siteId === siteId) ?? null;
+}
+var AUTH_PATHS = {
+  /** The browser authenticates here, then redirects to the loopback server. */
+  AUTH_APPLY: "console/DevEcoIDE/apply",
+  /** Exchanges the browser's temp token for a JWT. */
+  TEMP_TOKEN_CHECK: "authrouter/auth/api/temptoken/check",
+  /** Validates a JWT and, with `refresh`, mints an AGC access token. */
+  JWT_TOKEN_CHECK: "authrouter/auth/api/jwToken/check",
+  LOGIN_SUCCESS: "console/DevEcoCLI/loginSuccess",
+  LOGIN_FAILED: "console/DevEcoCLI/loginFailed",
+  LOGOUT: "authrouter/auth/api/logout",
+  /**
+   * Whether an account without real-name verification accepted the developer
+   * agreement, which is what lets it sign. From DevEco Studio (`space.agr.url`).
+   */
+  UNREALNAME_AGREEMENT: "authrouter/unrealname/agreement"
+};
+
+// src/harmonyos/auth/tokenStore.ts
+import * as fs32 from "fs";
+import * as os11 from "os";
+import * as path31 from "path";
+import * as crypto3 from "crypto";
+var ALGORITHM = "aes-256-gcm";
+var KEY_LENGTH = 32;
+var IV_LENGTH = 12;
+var TOKEN_FILE = "token.enc";
+var KEY_FILE = "kek.bin";
+var DIR_MODE = 448;
+var FILE_MODE = 384;
+function encrypt2(key, plaintext) {
+  const iv = crypto3.randomBytes(IV_LENGTH);
+  const cipher = crypto3.createCipheriv(ALGORITHM, key, iv);
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  return {
+    version: 1,
+    algorithm: ALGORITHM,
+    ciphertext: ciphertext.toString("base64"),
+    iv: iv.toString("base64"),
+    authTag: cipher.getAuthTag().toString("base64")
+  };
+}
+function decrypt2(key, blob) {
+  const decipher = crypto3.createDecipheriv(ALGORITHM, key, Buffer.from(blob.iv, "base64"));
+  decipher.setAuthTag(Buffer.from(blob.authTag, "base64"));
+  return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "base64")), decipher.final()]);
+}
+function isEncryptedBlob(value) {
+  if (!value || typeof value !== "object") return false;
+  const b = value;
+  return b.algorithm === ALGORITHM && typeof b.ciphertext === "string" && typeof b.iv === "string" && typeof b.authTag === "string";
+}
+function permissionHint(dir) {
+  return process.platform === "win32" ? `Permission denied writing ${dir}. Grant write permission to that directory.` : `Permission denied writing ${dir}. Try: chown -R "$(whoami)" ${dir}`;
+}
+function ensureDir(dir) {
+  try {
+    fs32.mkdirSync(dir, { recursive: true, mode: DIR_MODE });
+  } catch (err) {
+    if (err.code === "EACCES") {
+      throw new OniroError(permissionHint(dir), err);
+    }
+    throw err;
+  }
+}
+function createTokenStore(opts) {
+  const logger = opts.logger ?? noopLogger;
+  const authDir = opts.config.get("harmonyosAuthDir", defaultPaths.harmonyosAuthDir());
+  const tokenPath = path31.join(authDir, TOKEN_FILE);
+  const keyPath = path31.join(os11.homedir(), ".local", "share", "oniro-app", "keys", KEY_FILE);
+  function loadOrCreateKey() {
+    if (fs32.existsSync(keyPath)) {
+      const existing = fs32.readFileSync(keyPath);
+      if (existing.length === KEY_LENGTH) return existing;
+      logger.warn("[harmonyos] The token key file was malformed; regenerating (you will need to log in again).");
+    }
+    ensureDir(path31.dirname(keyPath));
+    const key = crypto3.randomBytes(KEY_LENGTH);
+    fs32.writeFileSync(keyPath, key, { mode: FILE_MODE });
+    return key;
+  }
+  return {
+    tokenPath,
+    save(session) {
+      if (!session.jwtToken) throw new OniroError("Refusing to store an empty token.");
+      const payload = Buffer.from(JSON.stringify(session), "utf8");
+      const blob = encrypt2(loadOrCreateKey(), payload);
+      ensureDir(authDir);
+      fs32.writeFileSync(tokenPath, JSON.stringify(blob, null, 2), { mode: FILE_MODE });
+    },
+    load() {
+      if (!fs32.existsSync(tokenPath)) return null;
+      try {
+        const blob = JSON.parse(fs32.readFileSync(tokenPath, "utf8"));
+        if (!isEncryptedBlob(blob)) return null;
+        const { jwtToken, siteId } = JSON.parse(decrypt2(loadOrCreateKey(), blob).toString("utf8"));
+        return typeof jwtToken === "string" && jwtToken && typeof siteId === "string" ? { jwtToken, siteId } : null;
+      } catch (err) {
+        const code = err.code;
+        if (code === "EACCES" || code === "EPERM") {
+          logger.warn(`[harmonyos] Cannot read ${tokenPath}: ${permissionHint(authDir)}`);
+          return null;
+        }
+        logger.debug(`[harmonyos] Discarding unreadable token at ${tokenPath}.`);
+        try {
+          fs32.rmSync(tokenPath, { force: true });
+        } catch {
+        }
+        return null;
+      }
+    },
+    clear() {
+      try {
+        fs32.rmSync(tokenPath, { force: true });
+      } catch (err) {
+        throw new OniroError(`Failed to remove ${tokenPath}.`, err);
+      }
+    }
+  };
+}
+
+// src/harmonyos/auth/session.ts
+import * as crypto5 from "crypto";
+
+// src/harmonyos/http.ts
+import { EnvHttpProxyAgent, fetch } from "undici";
+var DEFAULT_HEADERS = {
+  "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+  "accept-language": "zh-CN",
+  accept: "application/json, text/plain, */*"
+};
+var DEFAULT_TIMEOUT_MS = 2e4;
+var SENSITIVE_PARAMS = /* @__PURE__ */ new Set(["temptoken", "jwttoken", "code", "oauth2token", "accesstoken"]);
+function redactUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return url;
+  }
+  for (const key of [...parsed.searchParams.keys()]) {
+    if (SENSITIVE_PARAMS.has(key.toLowerCase())) parsed.searchParams.set(key, "***");
+  }
+  return parsed.toString();
+}
+function previewBody(body, limit = 300) {
+  const trimmed = body.trim();
+  if (!trimmed) return "(empty body)";
+  if (/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(trimmed)) return "(a token-shaped value)";
+  const collapsed = trimmed.replace(/\s+/g, " ");
+  return collapsed.length > limit ? `${collapsed.slice(0, limit)}\u2026` : collapsed;
+}
+function describeResponse(response) {
+  const status = `HTTP ${response.statusCode}${response.statusText ? ` ${response.statusText}` : ""}`;
+  return `${status}: ${previewBody(response.data)}`;
+}
+function buildUrl(url, query) {
+  if (!query) return url;
+  const parsed = new URL(url);
+  for (const [key, value] of Object.entries(query)) {
+    if (value !== void 0 && value !== null) parsed.searchParams.set(key, String(value));
+  }
+  return parsed.toString();
+}
+function createHttpClient(opts = {}) {
+  const logger = opts.logger ?? noopLogger;
+  const dispatcher = new EnvHttpProxyAgent();
+  async function send(method, url, options) {
+    const target = buildUrl(url, options.query);
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const headers = { ...DEFAULT_HEADERS, ...options.headers };
+    let body;
+    if (options.body !== void 0) {
+      body = JSON.stringify(options.body);
+      headers["content-type"] = "application/json";
+    }
+    logger.debug(`[harmonyos] ${method} ${redactUrl(target)}`);
+    try {
+      return await fetch(target, {
+        method,
+        headers,
+        body,
+        signal: AbortSignal.timeout(timeoutMs),
+        dispatcher
+      });
+    } catch (err) {
+      const reason = err instanceof Error && err.name === "TimeoutError" ? `timed out after ${timeoutMs}ms` : err instanceof Error ? err.message : String(err);
+      throw new OniroError(
+        `${method} ${redactUrl(target)} failed: ${reason}. Check the network connection and any proxy configuration (HTTPS_PROXY / HTTP_PROXY).`,
+        err
+      );
+    }
+  }
+  async function request(method, url, options = {}) {
+    const response = await send(method, url, options);
+    return { data: await response.text(), statusCode: response.status, statusText: response.statusText };
+  }
+  return {
+    get: (url, o) => request("GET", url, o),
+    post: (url, o) => request("POST", url, o),
+    delete: (url, o) => request("DELETE", url, o),
+    async getBinary(url, o = {}) {
+      const response = await send("GET", url, o);
+      if (!response.ok) {
+        throw new OniroError(`Download of ${redactUrl(response.url || url)} failed (HTTP ${response.status}).`);
+      }
+      return Buffer.from(await response.arrayBuffer());
+    }
+  };
+}
+
+// src/harmonyos/auth/callbackServer.ts
+import * as http2 from "http";
+import * as crypto4 from "crypto";
+var CALLBACK_PATH = "/callback";
+var MAX_BODY_BYTES = 65536;
+function codeMatches(code, secret) {
+  const a = Buffer.from(code ?? "", "utf8");
+  const b = Buffer.from(secret, "utf8");
+  return a.length === b.length && crypto4.timingSafeEqual(a, b);
+}
+function isQuit(quit) {
+  return quit === "true" || quit === "access_denied" || quit === "quit";
+}
+async function startCallbackServer(opts) {
+  let resolveCallback;
+  let rejectCallback;
+  const callback = new Promise((resolve6, reject) => {
+    resolveCallback = resolve6;
+    rejectCallback = reject;
+  });
+  callback.catch(() => {
+  });
+  const server = http2.createServer((req, res) => {
+    const host = (req.headers.host ?? "").toLowerCase();
+    const port2 = server.address()?.port;
+    if (host !== `127.0.0.1:${port2}` && host !== `localhost:${port2}`) {
+      res.writeHead(400);
+      res.end("Bad Host");
+      return;
+    }
+    const url = new URL(req.url ?? "", `http://${host}`);
+    if (url.pathname !== CALLBACK_PATH) {
+      res.writeHead(404);
+      res.end("Not Found");
+      return;
+    }
+    const finish = (params) => {
+      if (!codeMatches(params.get("code"), opts.clientSecret)) {
+        res.writeHead(400);
+        res.end("Bad Request");
+        return;
+      }
+      if (isQuit(params.get("quit"))) {
+        res.writeHead(302, { Location: `${opts.baseUrl}/${opts.failedPath}` });
+        res.end();
+        rejectCallback(new CancelledError("Login was cancelled in the browser."));
+        return;
+      }
+      const tempToken = params.get("tempToken");
+      const siteId = params.get("siteId");
+      if (!tempToken || !siteId) {
+        res.writeHead(400);
+        res.end("Bad Request");
+        return;
+      }
+      res.writeHead(302, { Location: `${opts.baseUrl}/${opts.successPath}` });
+      res.end();
+      resolveCallback({ tempToken, siteId });
+    };
+    if (req.method === "POST") {
+      let body = "";
+      let size = 0;
+      req.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_BODY_BYTES) {
+          req.destroy(new Error("Request body too large"));
+          return;
+        }
+        body += chunk.toString();
+      });
+      req.on("end", () => finish(body.trim() ? new URLSearchParams(body) : url.searchParams));
+    } else {
+      finish(url.searchParams);
+    }
+  });
+  server.keepAliveTimeout = 1;
+  await new Promise((resolve6, reject) => {
+    server.once("error", (err) => reject(new OniroError("Failed to start the local login callback server.", err)));
+    server.listen(0, "127.0.0.1", resolve6);
+  });
+  const port = server.address().port;
+  return {
+    port,
+    waitForCallback(timeoutMs) {
+      let timer;
+      const timeout = new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new OniroError(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the browser login to complete.`)),
+          timeoutMs
+        );
+      });
+      return Promise.race([callback, timeout]).finally(() => clearTimeout(timer));
+    },
+    stop() {
+      return new Promise((resolve6) => {
+        server.closeAllConnections?.();
+        const timer = setTimeout(resolve6, 100);
+        server.close(() => {
+          clearTimeout(timer);
+          resolve6();
+        });
+      });
+    }
+  };
+}
+
+// src/harmonyos/auth/browser.ts
+import { spawn as spawn3 } from "child_process";
+function isSafeUrl(url) {
+  try {
+    const parsed = new URL(url);
+    return ["http:", "https:"].includes(parsed.protocol) && parsed.hostname !== "" && !url.includes('"');
+  } catch {
+    return false;
+  }
+}
+function escapeForCmd(s) {
+  return s.replace(/[&|<>()^%!]/g, (c) => `^${c}`);
+}
+function openBrowser(url) {
+  if (!isSafeUrl(url)) {
+    return Promise.reject(new OniroError(`Refusing to open unsafe URL: ${JSON.stringify(url)}`));
+  }
+  const [command, args] = process.platform === "win32" ? ["cmd", ["/c", "start", '""', escapeForCmd(url)]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+  const child = spawn3(command, args, {
+    stdio: "ignore",
+    shell: false,
+    detached: true,
+    windowsHide: true
+  });
+  child.unref();
+  return new Promise((resolve6, reject) => {
+    child.on("error", (err) => reject(new OniroError(`Failed to open a browser (${command}).`, err)));
+    child.on(
+      "exit",
+      (code) => code === 0 ? resolve6() : reject(new OniroError(`Browser launcher '${command}' exited with code ${code}.`))
+    );
+  });
+}
+
+// src/harmonyos/auth/session.ts
+var NOT_SIGNED_IN = "Not signed in. Run `oniro-app auth login` first.";
+function createHarmonyOsSession(opts) {
+  const logger = opts.logger ?? noopLogger;
+  const http3 = opts.http ?? createHttpClient({ logger });
+  const store = opts.tokenStore ?? createTokenStore({ config: opts.config, logger });
+  async function exchangeTempToken(site, tempToken) {
+    const response = await http3.get(`${site.loginUrl}/${AUTH_PATHS.TEMP_TOKEN_CHECK}`, {
+      query: {
+        // The page sometimes appends extra `&`-joined parameters to the token.
+        tempToken: tempToken.split("&")[0],
+        site: site.siteParam,
+        version: HUAWEI_API_VERSION,
+        appid: HUAWEI_APP_ID
+      }
+    });
+    const jwtToken = response.data.trim();
+    if (response.statusCode === 200 && /^[^.]+\.[^.]+\.[^.]+$/.test(jwtToken)) return jwtToken;
+    throw new OniroError(
+      `${site.loginUrl} would not exchange the login token for a session (${describeResponse(response)}). Login tokens are single-use and short-lived; run \`oniro-app auth login\` again.`
+    );
+  }
+  async function userFromJwt(site, jwtToken, refresh) {
+    const response = await http3.get(`${site.loginUrl}/${AUTH_PATHS.JWT_TOKEN_CHECK}`, {
+      headers: { refresh: String(refresh), jwtToken }
+    });
+    let info;
+    try {
+      if (response.statusCode !== 200) throw new Error();
+      info = JSON.parse(response.data);
+    } catch {
+      throw new OniroError(`Could not validate the session with ${site.loginUrl} (${describeResponse(response)}).`);
+    }
+    const user = info.userInfo;
+    if (!info.status || !user?.accessToken) return null;
+    return {
+      userId: user.userId ?? "",
+      userName: user.name ?? "",
+      accessToken: user.accessToken,
+      countryCode: user.nationalCode ?? "",
+      siteCode: site.code,
+      isRealName: String(user.realName) === "true"
+    };
+  }
+  async function getUserInfo(o = {}) {
+    const stored = store.load();
+    const site = stored && siteForId(stored.siteId);
+    const user = site ? await userFromJwt(site, stored.jwtToken, o.refresh ?? false) : null;
+    if (stored && !user) {
+      logger.debug("[harmonyos] The stored session is no longer valid; clearing it.");
+      store.clear();
+    }
+    return user;
+  }
+  async function requireUser() {
+    const user = await getUserInfo({ refresh: true });
+    if (!user) throw new OniroError(NOT_SIGNED_IN);
+    return user;
+  }
+  async function getDeveloperAgreement(user) {
+    try {
+      const response = await http3.get(`${HUAWEI_SITES[user.siteCode].loginUrl}/${AUTH_PATHS.UNREALNAME_AGREEMENT}`, {
+        headers: { accessToken: user.accessToken }
+      });
+      const payload = JSON.parse(response.data);
+      if (response.statusCode !== 200 || String(payload.success) !== "true" || !payload.body) return null;
+      return { signed: payload.body.signedFlag === true, latest: payload.body.signLastestFlag === true };
+    } catch {
+      return null;
+    }
+  }
+  return {
+    tokenPath: store.tokenPath,
+    getUserInfo,
+    getDeveloperAgreement,
+    async login(o = {}) {
+      const start = HUAWEI_SITES.CN.loginUrl;
+      const clientSecret = crypto5.randomUUID().replace(/-/g, "");
+      const server = await startCallbackServer({
+        clientSecret,
+        baseUrl: start,
+        successPath: AUTH_PATHS.LOGIN_SUCCESS,
+        failedPath: AUTH_PATHS.LOGIN_FAILED
+      });
+      try {
+        const loginUrl = `${start}/${AUTH_PATHS.AUTH_APPLY}?port=${server.port}&appid=${HUAWEI_APP_ID}&code=${clientSecret}`;
+        opts.onLoginUrl?.(loginUrl);
+        openBrowser(loginUrl).catch((err) => {
+          logger.warn(`[harmonyos] Could not open a browser automatically: ${err.message}`);
+        });
+        const callback = await server.waitForCallback(o.timeoutMs ?? LOGIN_TIMEOUT_MS);
+        const site = siteForId(callback.siteId);
+        if (!site) {
+          throw new OniroError(`The account belongs to a Huawei region oniro-app does not know (siteId ${callback.siteId}).`);
+        }
+        const jwtToken = await exchangeTempToken(site, callback.tempToken);
+        const user = await userFromJwt(site, jwtToken, false);
+        if (!user) throw new OniroError("Login did not yield a usable session. Try again.");
+        store.save({ jwtToken, siteId: site.siteId });
+        logger.info(`[harmonyos] Signed in as ${user.userName || user.userId} (${site.code}).`);
+        return user;
+      } finally {
+        await server.stop();
+      }
+    },
+    async logout() {
+      const stored = store.load();
+      if (!stored) return false;
+      const site = siteForId(stored.siteId);
+      try {
+        if (site) {
+          await http3.post(`${site.loginUrl}/${AUTH_PATHS.LOGOUT}`, {
+            query: { jwtToken: stored.jwtToken },
+            timeoutMs: 5e3
+          });
+        }
+      } catch {
+      } finally {
+        store.clear();
+      }
+      return true;
+    },
+    async listTeams() {
+      const user = await requireUser();
+      const response = await http3.get(AGC_TEAMS_URL, {
+        headers: {
+          oauth2Token: user.accessToken,
+          uid: user.userId,
+          source: "cli",
+          lang: HUAWEI_SITES[user.siteCode].language
+        },
+        timeoutMs: 15e3
+      });
+      if (response.statusCode === 401) {
+        throw new OniroError("The session has expired. Run `oniro-app auth login` again.");
+      }
+      if (response.statusCode !== 200) {
+        throw new OniroError(`Could not list AGC teams (${describeResponse(response)}).`);
+      }
+      return parseTeamList(response.data);
+    },
+    async resolveAgcAuth(o = {}) {
+      const user = await requireUser();
+      if (!user.isRealName) {
+        const agreement = await getDeveloperAgreement(user);
+        if (agreement && !(agreement.signed && agreement.latest)) {
+          throw new OniroError(
+            "This Huawei account has not accepted the current HUAWEI Developer Basic Service Agreement, which accounts without real-name verification need before AppGallery Connect issues signing material. Accept it in AppGallery Connect (https://developer.huawei.com/consumer/en/service/josp/agc/index.html) or by running automatic signing once in DevEco Studio, then try again."
+          );
+        }
+      }
+      return {
+        uid: user.userId,
+        // Personal accounts sign under their own user id; `--team-id` picks another team.
+        teamId: o.teamId ?? user.userId,
+        accessToken: user.accessToken,
+        baseUrl: HUAWEI_SITES[user.siteCode].agcBaseUrl
+      };
+    }
+  };
+}
+function parseTeamList(body) {
+  let payload;
+  try {
+    payload = JSON.parse(body);
+  } catch {
+    return [];
+  }
+  if (payload.ret && payload.ret.code !== 0) {
+    throw new OniroError(
+      `AppGallery Connect refused the team list (code ${payload.ret.code}${payload.ret.msg ? `: ${payload.ret.msg}` : ""}).`
+    );
+  }
+  if (!Array.isArray(payload.teams)) return [];
+  return payload.teams.map((t) => ({ id: String(t?.id ?? ""), name: String(t?.name ?? "") })).filter((t) => t.id);
+}
+
+// src/harmonyos/signing/errors.ts
+var AgcError = class extends OniroError {
+  constructor(message, statusCode, retCode) {
+    super(message);
+    this.statusCode = statusCode;
+    this.retCode = retCode;
+    this.name = "AgcError";
+  }
+  statusCode;
+  retCode;
+};
+var SIGNING_ERRORS = {
+  FORBIDDEN: "This account has no AppGallery Connect permission for the selected team. Ask the team administrator for access, or pass --team-id for a team you do have access to (`oniro-app auth team list`).",
+  UNAUTHORIZED: "AppGallery Connect rejected the access token. Run `oniro-app auth login` again.",
+  NETWORK: "Could not reach AppGallery Connect. Check the network connection and any proxy configuration (HTTPS_PROXY / HTTP_PROXY).",
+  USER_NOT_HARMONY: "This Huawei account is not enrolled for HarmonyOS development. Request HarmonyOS access for it in AppGallery Connect.",
+  CERT_REQUEST: "AppGallery Connect did not issue the debug certificate.",
+  CERT_LIMIT: "This team has reached its debug-certificate limit. Delete an unused certificate in AppGallery Connect and retry.",
+  DEVICE_ADD: "AppGallery Connect did not register the device.",
+  DEVICE_LIMIT: "This team has reached its device limit. Remove an unused device in AppGallery Connect and retry.",
+  DEVICE_NAME_REPEAT: "A device with that name is already registered. Retry.",
+  DEVICE_NONE: "No device is connected and none is registered to this team, but a debug profile must name at least one. Connect a device and retry.",
+  PROFILE_ADD: "AppGallery Connect did not issue the provisioning profile.",
+  PROFILE_NAME_REPEAT: "A provisioning profile with that name already exists in AppGallery Connect. Retry.",
+  PROVISION_LIMIT: "This team has reached its debug-profile limit. Delete unused profiles in AppGallery Connect and retry.",
+  CERT_INVALID: "AppGallery Connect returned an unreadable certificate. Retry with --force.",
+  CERT_EXPIRED: "The signing certificate is outside its validity window. Check the system clock, then retry with --force.",
+  CERT_PROFILE_MISMATCH: "The provisioning profile was not issued for the downloaded certificate. Retry with --force.",
+  KEYSTORE_CERT_MISMATCH: "The local keystore does not hold the key the downloaded certificate was issued for. Retry with --force.",
+  BUNDLE_NAME_INVALID: "Invalid bundle name. It must be 7\u2013128 characters, start with a letter, and have at least three dot-separated segments (for example com.example.app)."
+};
+var RET_CODE_ERRORS = {
+  "205389872": SIGNING_ERRORS.CERT_LIMIT,
+  "205389904": SIGNING_ERRORS.USER_NOT_HARMONY,
+  "205389859": SIGNING_ERRORS.DEVICE_LIMIT,
+  "205389857": SIGNING_ERRORS.DEVICE_NAME_REPEAT,
+  "205389938": SIGNING_ERRORS.PROVISION_LIMIT,
+  "205389830": SIGNING_ERRORS.PROFILE_NAME_REPEAT
+};
+var PROXY_BLOCKED = "Openproxy_Blocked_URL_list";
+function readRet(body) {
+  try {
+    let ret = JSON.parse(body).ret;
+    if (typeof ret === "string") ret = JSON.parse(ret);
+    return ret && typeof ret === "object" ? ret : null;
+  } catch {
+    return null;
+  }
+}
+var FALLBACK = {
+  cert: SIGNING_ERRORS.CERT_REQUEST,
+  device: SIGNING_ERRORS.DEVICE_ADD,
+  profile: SIGNING_ERRORS.PROFILE_ADD
+};
+function mapAgcError(operation, statusCode, reasonPhrase, body) {
+  if (statusCode === 403) {
+    return new AgcError(reasonPhrase === PROXY_BLOCKED ? SIGNING_ERRORS.NETWORK : SIGNING_ERRORS.FORBIDDEN, 403);
+  }
+  if (statusCode === 401) return new AgcError(SIGNING_ERRORS.UNAUTHORIZED, 401);
+  const ret = readRet(body);
+  const retCode = ret?.code === void 0 ? void 0 : String(ret.code);
+  const msg = typeof ret?.msg === "string" && ret.msg.trim() ? ret.msg : void 0;
+  return new AgcError(retCode && RET_CODE_ERRORS[retCode] || msg || FALLBACK[operation], statusCode, retCode);
+}
+
+// src/harmonyos/signing/profile.ts
+import * as fs33 from "fs";
+import { X509Certificate } from "crypto";
+import forge from "node-forge";
+function extractProfileJson(buffer) {
+  const text = buffer.toString("latin1");
+  for (let start = text.indexOf("{"); start !== -1; start = text.indexOf("{", start + 1)) {
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = start; i < text.length; i++) {
+      const ch = text[i];
+      if (escaped) escaped = false;
+      else if (inString) {
+        if (ch === "\\") escaped = true;
+        else if (ch === '"') inString = false;
+      } else if (ch === '"') inString = true;
+      else if (ch === "{") depth++;
+      else if (ch === "}" && --depth === 0) {
+        const json = Buffer.from(text.slice(start, i + 1), "latin1").toString("utf8");
+        try {
+          if ("bundle-info" in JSON.parse(json)) return json;
+        } catch {
+        }
+        break;
+      }
+    }
+  }
+  return null;
+}
+function readProvisionProfile(profilePath) {
+  let raw;
+  try {
+    const json = extractProfileJson(fs33.readFileSync(profilePath));
+    if (!json) return null;
+    raw = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  const str = (v) => typeof v === "string" ? v : void 0;
+  const strings = (v) => Array.isArray(v) ? v.filter((x2) => typeof x2 === "string") : [];
+  const notAfter = raw.validity?.["not-after"];
+  const bundle = raw["bundle-info"] ?? {};
+  return {
+    bundleName: str(bundle["bundle-name"]),
+    developerId: str(bundle["developer-id"]),
+    // Epoch seconds.
+    notAfter: typeof notAfter === "number" ? new Date(notAfter * 1e3) : void 0,
+    deviceIds: strings(raw["debug-info"]?.["device-ids"]).map((d) => d.toUpperCase()),
+    aclPermissions: strings(raw.acls?.["allowed-acls"]),
+    developmentCertificate: str(bundle["development-certificate"])
+  };
+}
+function parseCertificate(pem) {
+  try {
+    return new X509Certificate(pem);
+  } catch {
+    throw new AgcError(SIGNING_ERRORS.CERT_INVALID);
+  }
+}
+function keystoreHoldsKey(p12Path, keyAlias, keyPwd, certificate) {
+  try {
+    const der = forge.util.createBuffer(fs33.readFileSync(p12Path).toString("binary"));
+    const p12 = forge.pkcs12.pkcs12FromAsn1(forge.asn1.fromDer(der), keyPwd);
+    const certBag = forge.pki.oids.certBag ?? "1.2.840.113549.1.12.10.1.3";
+    const wanted = certificate.publicKey.export({ type: "spki", format: "der" });
+    return (p12.getBags({ bagType: certBag })[certBag] ?? []).some((bag) => {
+      if (bag.attributes?.friendlyName?.[0]?.toLowerCase() !== keyAlias.toLowerCase()) return false;
+      const asn1 = bag.cert ? forge.pki.certificateToAsn1(bag.cert) : bag.asn1;
+      if (!asn1) return false;
+      const bagCert = new X509Certificate(Buffer.from(forge.asn1.toDer(asn1).getBytes(), "binary"));
+      return bagCert.publicKey.export({ type: "spki", format: "der" }).equals(wanted);
+    });
+  } catch {
+    return false;
+  }
+}
+function verifySigningMaterial(opts) {
+  const pems = fs33.readFileSync(opts.cerPath, "utf8").match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+  const chain = (pems ?? []).map(parseCertificate);
+  const leaf = chain.find((c) => !c.ca) ?? chain.at(-1);
+  if (!leaf) throw new AgcError(SIGNING_ERRORS.CERT_INVALID);
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  if (chain.some((c) => now < new Date(c.validFrom) || now > new Date(c.validTo))) {
+    throw new AgcError(SIGNING_ERRORS.CERT_EXPIRED);
+  }
+  const issuedFor = readProvisionProfile(opts.profilePath)?.developmentCertificate;
+  if (!issuedFor || parseCertificate(issuedFor).fingerprint256 !== leaf.fingerprint256) {
+    throw new AgcError(SIGNING_ERRORS.CERT_PROFILE_MISMATCH);
+  }
+  if (!keystoreHoldsKey(opts.p12Path, opts.keyAlias, opts.keyPwd, leaf)) {
+    throw new AgcError(SIGNING_ERRORS.KEYSTORE_CERT_MISMATCH);
+  }
+}
+
+// src/harmonyos/signing/autoSign.ts
+import * as crypto9 from "crypto";
+import * as fs38 from "fs";
+import * as path37 from "path";
+import JSON57 from "json5";
+
+// src/harmonyos/signing/agc.ts
+import * as crypto6 from "crypto";
+import * as fs34 from "fs";
+import * as path32 from "path";
+var ENDPOINTS = {
+  CERT_LIST: "/api/cps/harmony-cert-manage/v1/cert/list",
+  CERT_ADD: "/api/cps/harmony-cert-manage/v1/cert/add",
+  CERT_DELETE: "/api/cps/harmony-cert-manage/v1/cert/delete",
+  /** Exchanges an object id for a short-lived signed download URL. */
+  OBJECT_URL: "/api/amis/app-manage/v1/objects/url/reapply",
+  DEVICE_LIST: "/api/cps/device-manage/v1/device/list",
+  DEVICE_ADD: "/api/cps/device-manage/v1/device/add",
+  /** Debug ("test") provisioning profiles — the only kind oniro-app issues. */
+  PROVISION_ADD: "/api/cps/provision-manage/v1/ide/test/provision/add",
+  PROVISION_DELETE: "/api/cps/provision-manage/v1/provision/delete"
+};
+var DEVICE_TYPE_CODES = { liteWearable: 1, wearable: 2, tv: 3, phone: 4 };
+function createAgcClient(http3, auth) {
+  async function call(operation, method, endpoint, opts = {}) {
+    const response = await http3[method](`${auth.baseUrl}${endpoint}`, {
+      ...opts,
+      headers: { uid: auth.uid, teamId: auth.teamId, oauth2Token: auth.accessToken }
+    });
+    if (response.statusCode !== 200 || readRet(response.data)?.code !== 0) {
+      throw mapAgcError(operation, response.statusCode, response.statusText, response.data);
+    }
+    return JSON.parse(response.data);
+  }
+  return {
+    async listCertificates() {
+      return (await call("cert", "post", ENDPOINTS.CERT_LIST)).certList ?? [];
+    },
+    async addCertificate(certName, csr) {
+      await call("cert", "post", ENDPOINTS.CERT_ADD, { body: { csr, certName, certType: "1" } });
+    },
+    async deleteCertificate(certId) {
+      await call("cert", "delete", ENDPOINTS.CERT_DELETE, { body: { certIds: [certId] } });
+    },
+    /** Every device registered to the team, across pages. */
+    async listDevices() {
+      const pageSize = 100;
+      const devices = [];
+      for (let start = 1; ; start++) {
+        const page = await call("device", "get", ENDPOINTS.DEVICE_LIST, {
+          query: { encodeFlag: 0, start, pageSize }
+        });
+        devices.push(...page.list ?? []);
+        if (!page.list?.length || devices.length >= (page.totalCount ?? 0)) return devices;
+      }
+    },
+    async addDevice(udid, deviceKind) {
+      const deviceName = `oniro_app_device_${crypto6.randomBytes(4).toString("hex")}`;
+      await call("device", "post", ENDPOINTS.DEVICE_ADD, {
+        body: { deviceName, udid, deviceType: String(DEVICE_TYPE_CODES[deviceKind] ?? DEVICE_TYPE_CODES.phone) }
+      });
+    },
+    /** Issue a debug profile; returns its id and object handle. */
+    async addDebugProfile(opts) {
+      return call("profile", "post", ENDPOINTS.PROVISION_ADD, {
+        body: {
+          provisionName: opts.provisionName,
+          packageName: opts.bundleName,
+          certList: [opts.certId],
+          deviceList: opts.deviceIds,
+          ...opts.aclPermissions.length ? { aclPermissionList: opts.aclPermissions } : {}
+        }
+      });
+    },
+    async deleteProfile(id) {
+      await call("profile", "delete", ENDPOINTS.PROVISION_DELETE, { query: { id } });
+    },
+    /**
+     * Download a certificate or profile object to `dest`, checking the digest AGC
+     * supplies with the URL. Nothing is written unless it matches.
+     */
+    async download(operation, objectId, dest) {
+      const { urlsInfo } = await call(
+        operation,
+        "post",
+        ENDPOINTS.OBJECT_URL,
+        { body: { sourceUrls: objectId } }
+      );
+      const target = urlsInfo?.[0];
+      if (!target) throw mapAgcError(operation, 200, "", "");
+      const buffer = await http3.getBinary(target.newUrl, { timeoutMs: 6e4 });
+      const actual = crypto6.createHash("sha256").update(buffer).digest("hex");
+      if (target.sha256 && actual !== target.sha256.toLowerCase()) {
+        throw new ChecksumMismatchError(target.sha256, actual);
+      }
+      fs34.mkdirSync(path32.dirname(dest), { recursive: true, mode: 448 });
+      fs34.writeFileSync(dest, buffer, { mode: 384 });
+    }
+  };
+}
+
+// src/harmonyos/signing/devices.ts
+function parseUdid(stdout) {
+  return stdout.match(/\b[A-Fa-f0-9]{64}\b/)?.[0].toUpperCase() ?? "";
+}
+function parseDeviceKind(stdout) {
+  return ["liteWearable", "wearable", "tv"].find((kind) => stdout.includes(kind)) ?? "phone";
+}
+async function collectLocalDevices(config, logger) {
+  const devices = [];
+  for (const target of await listDevices(config, { logger, timeoutMs: 15e3 })) {
+    if (target.status !== "Connected") continue;
+    const shell2 = async (...args) => (await hdcExec({ config, deviceSerial: target.serial, args: ["shell", ...args], timeoutMs: 15e3, logger })).stdout;
+    try {
+      const udid = parseUdid(await shell2("bm", "get", "-u"));
+      if (!udid) {
+        logger.warn(`[harmonyos] ${target.serial} did not report a UDID; skipping it.`);
+        continue;
+      }
+      devices.push({ serial: target.serial, udid, kind: parseDeviceKind(await shell2("getprop", "hw_sc.build.os.deviceType")) });
+    } catch (err) {
+      logger.warn(`[harmonyos] Could not read ${target.serial}: ${err.message}`);
+    }
+  }
+  return devices;
+}
+async function registerDevices(agc, connected, logger) {
+  let devices = await agc.listDevices();
+  const registered = new Set(devices.map((d) => d.udid.toUpperCase()));
+  const unregistered = connected.filter((d) => !registered.has(d.udid));
+  for (const device of unregistered) {
+    logger.info(`[harmonyos] Registering ${device.serial} with AppGallery Connect...`);
+    await agc.addDevice(device.udid, device.kind);
+  }
+  if (unregistered.length > 0) devices = await agc.listDevices();
+  const deviceIds = devices.map((d) => d.id);
+  if (deviceIds.length === 0) throw new AgcError(SIGNING_ERRORS.DEVICE_NONE);
+  if (connected.length === 0) {
+    logger.warn(
+      `[harmonyos] No device is connected; the profile will name the ${deviceIds.length} device(s) already registered to this team.`
+    );
+  }
+  return deviceIds;
+}
+
+// src/harmonyos/signing/keystore.ts
+import * as crypto7 from "crypto";
+import * as fs36 from "fs";
+import * as path34 from "path";
+
+// src/harmonyos/java.ts
+import * as fs35 from "fs";
+import * as path33 from "path";
+var JAVA_BIN = process.platform === "win32" ? "java.exe" : "java";
+function findJava(sdk, env = process.env) {
+  const candidates = [
+    env.JAVA_HOME && path33.join(env.JAVA_HOME, "bin", JAVA_BIN),
+    sdk && path33.join(sdk.installRoot, "jbr", "bin", JAVA_BIN),
+    // macOS: the JBR is itself a bundle inside Studio's Contents.
+    sdk && path33.join(sdk.installRoot, "jbr", "Contents", "Home", "bin", JAVA_BIN),
+    ...(env.PATH ?? "").split(path33.delimiter).map((dir) => dir && path33.join(dir, JAVA_BIN))
+  ];
+  const found = candidates.find((c) => !!c && fs35.existsSync(c));
+  if (found) return found;
+  throw new OniroError(
+    "No Java runtime found. HarmonyOS signing runs the SDK's hap-sign-tool.jar, which needs one: install a JDK and set JAVA_HOME, or install DevEco Studio, whose bundled runtime is used automatically."
+  );
+}
+
+// src/harmonyos/signing/keystore.ts
+var KEY_ALIAS = "debugKey";
+var SIGN_ALG = "SHA256withECDSA";
+function redactArgs(args) {
+  return args.map((arg, i) => args[i - 1] === "-keyPwd" || args[i - 1] === "-keystorePwd" ? "******" : arg);
+}
+async function generateKeystoreAndCsr(opts) {
+  const jar = path34.join(opts.sdk.sdkPath, "default", "openharmony", "toolchains", "lib", "hap-sign-tool.jar");
+  if (!fs36.existsSync(jar)) {
+    throw new OniroError(`hap-sign-tool.jar not found at ${jar}; the HarmonyOS SDK looks incomplete.`);
+  }
+  const java = findJava(opts.sdk);
+  const keyPwd = crypto7.randomBytes(12).toString("base64url").replaceAll(/[-_]/g, "");
+  fs36.mkdirSync(path34.dirname(opts.p12Path), { recursive: true, mode: 448 });
+  const run = async (what, args) => {
+    const argv = ["-jar", jar, ...args, "-keyAlias", KEY_ALIAS, "-keystoreFile", opts.p12Path, "-keystorePwd", keyPwd, "-keyPwd", keyPwd];
+    opts.logger.debug(`[harmonyos] ${java} ${redactArgs(argv).join(" ")}`);
+    const result = await runProcess({ command: java, args: argv, timeoutMs: 12e4, logger: opts.logger });
+    if (result.code !== 0) {
+      const detail = (result.stderr || result.stdout || "").trim();
+      throw new OniroError(`hap-sign-tool failed to ${what} (exit ${result.code}).${detail ? `
+${detail}` : ""}`);
+    }
+  };
+  opts.logger.info("[harmonyos] Generating the local keystore and certificate signing request...");
+  await run("generate the key pair", ["generate-keypair", "-keyAlg", "ECC", "-keySize", "NIST-P-256"]);
+  await run("generate the CSR", ["generate-csr", "-subject", "CN=DebugKey", "-signAlg", SIGN_ALG, "-outFile", opts.csrPath]);
+  return { keyPwd, csr: fs36.readFileSync(opts.csrPath, "utf8") };
+}
+
+// src/harmonyos/signing/paths.ts
+import * as crypto8 from "crypto";
+import * as path35 from "path";
+function sanitizeNamePart(raw) {
+  const safe = (raw?.trim() ?? "").replace(/[\\/:*?"<>|=.-]+/g, "_");
+  return safe.slice(0, 64) || "default";
+}
+function resolveSigningMaterialPaths(config, productName, projectRoot) {
+  const hash = crypto8.createHash("sha256").update(projectRoot, "utf8").digest("base64url").replaceAll(/[-_]/g, "");
+  const base = path35.join(
+    config.get("harmonyosSigningDir", defaultPaths.harmonyosSigningDir()),
+    `${sanitizeNamePart(productName)}_${path35.basename(projectRoot)}_${hash}=`
+  );
+  return { p12Path: `${base}.p12`, csrPath: `${base}.csr`, cerPath: `${base}.cer`, profilePath: `${base}.p7b` };
+}
+
+// src/harmonyos/signing/project.ts
+import * as fs37 from "fs";
+import * as path36 from "path";
+import JSON56 from "json5";
+
+// src/harmonyos/signing/aclPermissionList.ts
+var ACL_PERMISSIONS = /* @__PURE__ */ new Set([
+  "ohos.permission.ACCESS_DDK_HID",
+  "ohos.permission.ACCESS_DDK_SCSI_PERIPHERAL",
+  "ohos.permission.ACCESS_DDK_USB",
+  "ohos.permission.ACCESS_DDK_USB_SERIAL",
+  "ohos.permission.ACCESS_DISK_PHY_INFO",
+  "ohos.permission.ACCESS_FIDO2_ONLINEAUTH",
+  "ohos.permission.ACCESS_NET_TRACE_INFO",
+  "ohos.permission.ACCESS_USER_FULL_DISK",
+  "ohos.permission.ACCESS_VIRTUAL_SCREEN",
+  "ohos.permission.CUSTOMIZE_SAVE_BUTTON",
+  "ohos.permission.CUSTOM_SCREEN_RECORDING",
+  "ohos.permission.DLP_GET_HIDE_STATUS",
+  "ohos.permission.FILE_ACCESS_PERSIST",
+  "ohos.permission.GET_ABILITY_INFO",
+  "ohos.permission.GET_ETHERNET_LOCAL_MAC",
+  "ohos.permission.GET_IP_MAC_INFO",
+  "ohos.permission.GET_WIFI_LOCAL_MAC",
+  "ohos.permission.GET_WIFI_PEERS_MAC",
+  "ohos.permission.HOOK_KEY_EVENT",
+  "ohos.permission.INPUT_MONITORING",
+  "ohos.permission.INTERCEPT_INPUT_EVENT",
+  "ohos.permission.KEEP_BACKGROUND_RUNNING_SYSTEM",
+  "ohos.permission.LINKTURBO",
+  "ohos.permission.MANAGE_APN_SETTING",
+  "ohos.permission.MANAGE_PASTEBOARD_APP_SHARE_OPTION",
+  "ohos.permission.MANAGE_SCREEN_TIME_GUARD",
+  "ohos.permission.MANAGE_UDMF_APP_SHARE_OPTION",
+  "ohos.permission.PERSISTENT_BLUETOOTH_PEERS_MAC",
+  "ohos.permission.PERSONAL_MANAGE_RESTRICTIONS",
+  "ohos.permission.PRELOAD_FILE",
+  "ohos.permission.READ_AUDIO",
+  "ohos.permission.READ_CONTACTS",
+  "ohos.permission.READ_IMAGEVIDEO",
+  "ohos.permission.READ_LOCAL_DEVICE_NAME",
+  "ohos.permission.READ_PASTEBOARD",
+  "ohos.permission.READ_WRITE_DESKTOP_DIRECTORY",
+  "ohos.permission.READ_WRITE_DOCUMENTS_DIRECTORY",
+  "ohos.permission.READ_WRITE_DOWNLOAD_DIRECTORY",
+  "ohos.permission.READ_WRITE_USB_DEV",
+  "ohos.permission.READ_WRITE_USER_FILE",
+  "ohos.permission.SET_PAC_URL",
+  "ohos.permission.SET_SYSTEMSHARE_APPLAUNCHTRUSTLIST",
+  "ohos.permission.SHORT_TERM_WRITE_IMAGEVIDEO",
+  "ohos.permission.START_PROVISIONING_MESSAGE",
+  "ohos.permission.SUBSCRIBE_NOTIFICATION",
+  "ohos.permission.SYSTEM_FLOAT_WINDOW",
+  "ohos.permission.USE_FLOAT_BALL",
+  "ohos.permission.USE_FRAUD_APP_PICKER",
+  "ohos.permission.USE_FRAUD_CALL_LOG_PICKER",
+  "ohos.permission.USE_FRAUD_MESSAGES_PICKER",
+  "ohos.permission.WEB_NATIVE_MESSAGING",
+  "ohos.permission.WRITE_AUDIO",
+  "ohos.permission.WRITE_CONTACTS",
+  "ohos.permission.WRITE_IMAGEVIDEO",
+  "ohos.permission.atomicService.MANAGE_STORAGE",
+  "ohos.permission.kernel.ALLOW_EXECUTABLE_FORT_MEMORY",
+  "ohos.permission.kernel.ALLOW_WRITABLE_CODE_MEMORY",
+  "ohos.permission.kernel.DISABLE_CODE_MEMORY_PROTECTION",
+  "ohos.permission.kernel.DISABLE_GOTPLT_RO_PROTECTION"
+]);
+
+// src/harmonyos/signing/project.ts
+function readRequestedPermissions(moduleConfigPath) {
+  if (!fs37.existsSync(moduleConfigPath)) return [];
+  try {
+    const parsed = JSON56.parse(fs37.readFileSync(moduleConfigPath, "utf-8"));
+    return (parsed.module?.requestPermissions ?? []).map((p) => p?.name).filter((n) => typeof n === "string" && n.length > 0);
+  } catch {
+    return [];
+  }
+}
+function collectAclPermissions(projectDir, logger = noopLogger) {
+  const requested = /* @__PURE__ */ new Set();
+  for (const module of listModules({ projectDir })) {
+    const moduleRoot = path36.resolve(projectDir, module.srcPath);
+    for (const sourceSet of ["main", "ohosTest"]) {
+      for (const name of readRequestedPermissions(
+        path36.join(moduleRoot, "src", sourceSet, "module.json5")
+      )) {
+        requested.add(name);
+      }
+    }
+  }
+  const acls = [...requested].filter((p) => ACL_PERMISSIONS.has(p)).sort();
+  if (acls.length > 0) {
+    logger.info(`[harmonyos] Project requests ${acls.length} ACL permission(s): ${acls.join(", ")}`);
+  }
+  return acls;
+}
+
+// src/harmonyos/signing/autoSign.ts
+function shouldRegenerate(input) {
+  if (input.force) return "--force was passed";
+  const missing = Object.values(input.paths).find((file) => !fs38.existsSync(file));
+  if (missing) return `${missing} is missing`;
+  const config = input.buildProfile.app?.signingConfigs?.find((c) => c.name === input.productName);
+  if (config?.type !== "HarmonyOS" || config.material?.profile !== input.paths.profilePath) {
+    return "build-profile.json5 has no signingConfig for this material";
+  }
+  const profile = readProvisionProfile(input.paths.profilePath);
+  if (!profile) return "the provisioning profile could not be read";
+  if (profile.bundleName !== input.bundleName) return `the profile is for bundle '${profile.bundleName}'`;
+  if (profile.developerId && profile.developerId !== input.teamId) {
+    return `the profile was issued to team '${profile.developerId}'`;
+  }
+  if (profile.notAfter && profile.notAfter <= (input.now ?? /* @__PURE__ */ new Date())) return "the profile has expired";
+  const unnamed = input.connectedUdids.filter((udid) => !profile.deviceIds.includes(udid.toUpperCase()));
+  if (unnamed.length > 0) return `${unnamed.length} connected device(s) are not named in the profile`;
+  const acls = input.aclPermissions.filter((p) => !profile.aclPermissions.includes(p));
+  if (acls.length > 0) return `the profile lacks ACL permission(s) ${acls.join(", ")}`;
+  return null;
+}
+function writeSigningConfig(opts) {
+  const app = opts.buildProfile.app ??= {};
+  const entry = {
+    name: opts.productName,
+    // `type` is what makes hvigor treat this as HarmonyOS signing material.
+    type: "HarmonyOS",
+    material: {
+      certpath: opts.paths.cerPath,
+      keyAlias: KEY_ALIAS,
+      keyPassword: opts.encryptedPassword,
+      profile: opts.paths.profilePath,
+      signAlg: SIGN_ALG,
+      storeFile: opts.paths.p12Path,
+      storePassword: opts.encryptedPassword
+    }
+  };
+  app.signingConfigs = [...(app.signingConfigs ?? []).filter((c) => c.name !== opts.productName), entry];
+  for (const product of app.products ?? []) {
+    if (product.name === opts.productName) product.signingConfig = opts.productName;
+  }
+  fs38.writeFileSync(opts.buildProfilePath, JSON.stringify(opts.buildProfile, null, 2));
+}
+async function harmonyOsAutoSign(opts) {
+  const logger = opts.logger ?? noopLogger;
+  const productName = opts.productName ?? "default";
+  const projectDir = path37.resolve(opts.projectDir);
+  const buildProfilePath = path37.join(projectDir, "build-profile.json5");
+  let buildProfile;
+  try {
+    buildProfile = JSON57.parse(fs38.readFileSync(buildProfilePath, "utf-8"));
+  } catch (err) {
+    throw new OniroError(`Could not read ${buildProfilePath}: ${err.message}`, err);
+  }
+  const product = buildProfile.app?.products?.find((p) => p.name === productName);
+  if (!product) throw new OniroError(`${buildProfilePath} declares no product named '${productName}'.`);
+  const bundleName = product.bundleName || getBundleName(projectDir);
+  if (!isValidBundleName(bundleName) || bundleName.split(".").length < 3 || bundleName.length < 7 || bundleName.length > 128) {
+    throw new AgcError(SIGNING_ERRORS.BUNDLE_NAME_INVALID);
+  }
+  const sdk = requireHarmonyOsSdk({ config: opts.config, logger });
+  const auth = await opts.session.resolveAgcAuth({ teamId: opts.teamId });
+  const aclPermissions = collectAclPermissions(projectDir, logger);
+  const paths = resolveSigningMaterialPaths(opts.config, productName, projectDir);
+  logger.info(`[harmonyos] Signing ${bundleName} (product '${productName}', team ${auth.teamId}).`);
+  const connected = await collectLocalDevices(opts.config, logger);
+  const result = (regenerated) => ({
+    bundleName,
+    teamId: auth.teamId,
+    paths,
+    regenerated,
+    deviceIds: readProvisionProfile(paths.profilePath)?.deviceIds ?? []
+  });
+  const reason = shouldRegenerate({
+    paths,
+    buildProfile,
+    productName,
+    bundleName,
+    teamId: auth.teamId,
+    connectedUdids: connected.map((d) => d.udid),
+    aclPermissions,
+    force: opts.force
+  });
+  if (!reason) {
+    logger.info("[harmonyos] Reusing the existing signing material, which is still valid.");
+    return result(false);
+  }
+  logger.info(`[harmonyos] Regenerating signing material: ${reason}.`);
+  const agc = createAgcClient(opts.http ?? createHttpClient({ logger }), auth);
+  const deviceIds = await registerDevices(agc, connected, logger);
+  for (const file of Object.values(paths)) fs38.rmSync(file, { force: true });
+  const certName = `oniro_debug_${auth.teamId.replace(/[\\/.:]/g, "")}.cer`;
+  const stale = (await agc.listCertificates()).find((c) => c.certName === certName);
+  if (stale) {
+    logger.info(`[harmonyos] Replacing the previous '${certName}' certificate in AppGallery Connect...`);
+    await agc.deleteCertificate(stale.id);
+  }
+  const { keyPwd, csr } = await generateKeystoreAndCsr({ sdk, p12Path: paths.p12Path, csrPath: paths.csrPath, logger });
+  logger.info("[harmonyos] Requesting a debug certificate from AppGallery Connect...");
+  await agc.addCertificate(certName, csr);
+  const cert = (await agc.listCertificates()).find((c) => c.certName === certName);
+  if (!cert) throw new AgcError(SIGNING_ERRORS.CERT_REQUEST);
+  await agc.download("cert", cert.certObjectId, paths.cerPath);
+  logger.info("[harmonyos] Issuing the debug provisioning profile...");
+  const profile = await agc.addDebugProfile({
+    provisionName: `oniro_${crypto9.randomBytes(6).toString("hex")}`,
+    bundleName,
+    certId: cert.id,
+    deviceIds,
+    aclPermissions
+  });
+  try {
+    await agc.download("profile", profile.provisionFileUrl, paths.profilePath);
+  } finally {
+    await agc.deleteProfile(profile.id).catch((err) => {
+      logger.debug(`[harmonyos] Could not delete profile ${profile.id} from AppGallery Connect: ${err.message}`);
+    });
+  }
+  try {
+    verifySigningMaterial({ ...paths, keyAlias: KEY_ALIAS, keyPwd });
+  } catch (err) {
+    fs38.rmSync(paths.profilePath, { force: true });
+    throw err;
+  }
+  const materialDir = path37.join(path37.dirname(paths.p12Path), "material");
+  try {
+    getKey(materialDir);
+  } catch {
+    createMaterial(materialDir);
+  }
+  writeSigningConfig({ buildProfilePath, buildProfile, productName, paths, encryptedPassword: encryptPwd(keyPwd, materialDir) });
+  logger.info(`[harmonyos] Wrote signingConfigs['${productName}'] to ${buildProfilePath}.`);
+  return result(true);
+}
+
 // src/index.ts
-var VERSION = "0.10.0";
+var VERSION = "0.11.0";
 export {
   ALL_SDKS,
   APL_VALUES,
   APP_FEATURE_VALUES,
+  AgcError,
   CancelledError,
   ChecksumMismatchError,
   CmdToolsNotInstalledError,
   CommandFailedError,
+  HARMONYOS_SDK_VERSIONS,
+  HUAWEI_SITES,
   INSTALL_TMP_DIRNAME,
   InsufficientSpaceError,
   OHOS_URL_BASE,
   OniroError,
+  SIGNING_ERRORS,
   SdkNotInstalledError,
   TMP_DIR_HINT,
   UnsupportedPlatformError,
@@ -3436,10 +4775,12 @@ export {
   buildRawTouchCommand,
   captureBurst,
   consoleLogger,
+  createHarmonyOsSession,
   createInstallTempDir,
   createMaterial,
   createScaffold,
   createTempWorkDir,
+  createTokenStore,
   decideInstallMethod,
   decideReboot,
   decryptPwd,
@@ -3448,6 +4789,7 @@ export {
   defaultPaths,
   detectAaStartFailure,
   detectProjectSdkVersion,
+  detectRuntimeOs,
   detectSigningConfigNames,
   diffEntryNames,
   diffHapAssets,
@@ -3470,6 +4812,7 @@ export {
   extractZipWithProgress,
   findAppProcessId,
   findCmdToolsSourceDir,
+  findHarmonyOsSdk,
   findRunningProcess,
   forceStop,
   formatBytes,
@@ -3494,6 +4837,8 @@ export {
   getSdkFilename,
   getSdkRootDir,
   getSupportedSdksForUi,
+  harmonyOsAutoSign,
+  harmonyOsSdkLabelForApi,
   hdcExec,
   installApp,
   installCmdTools,
@@ -3528,12 +4873,14 @@ export {
   pruneLayout,
   readJson5File,
   readJsonFile,
+  readProvisionProfile,
   reboot,
   recvFile,
   removeCmdTools,
   removeEmulator,
   removeSdk,
   removeTempWorkDir,
+  requireHarmonyOsSdk,
   resolveTmpRoot,
   runCodelinter,
   runHvigorw,