@oniroproject/core 0.15.1 → 0.16.0

package/dist/index.js

@@ -581,14 +581,14 @@ var pipelineAsync = promisify(pipeline);
 async function downloadFile(opts) {
   const { url, dest, progress, abortSignal } = opts;
   const proto = url.startsWith("https") ? https : http;
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     const s = Math.max(0, Math.min(100, opts.start ?? 0));
     const r = Math.max(0, Math.min(100 - s, opts.range ?? 100));
     let settled = false;
     const done = (err) => {
       if (settled) return;
       settled = true;
-      err ? reject(err) : resolve7();
+      err ? reject(err) : resolve9();
     };
     if (abortSignal?.aborted) {
       done(new CancelledError("Download cancelled before start."));
@@ -766,15 +766,26 @@ async function extractZipWithProgress(opts) {
 async function extractTarball(tarPath, dest, strip = 0, filter) {
   await tar.x({ file: tarPath, cwd: dest, strip, ...filter ? { filter: (p) => filter(p) } : {} });
 }
-async function readZipEntry(zipPath, match) {
-  const zip = new StreamZip.async({ file: zipPath });
+var SIGNED_HAP_CHUNK_SIZE = 128 * 1024;
+async function withHapZip(zipPath, use) {
+  const zip = new StreamZip({ file: zipPath, chunkSize: SIGNED_HAP_CHUNK_SIZE, storeEntries: true });
+  const close = () => new Promise((resolve9) => zip.close(() => resolve9()));
   try {
-    const entry = Object.values(await zip.entries()).find((e) => !e.isDirectory && match(e.name));
-    return entry ? await zip.entryData(entry) : void 0;
+    await new Promise((resolve9, reject) => {
+      zip.once("ready", () => resolve9());
+      zip.once("error", (err) => reject(err));
+    });
+    return await use({ entries: () => zip.entries(), entryData: (name) => zip.entryDataSync(name) });
   } finally {
-    await zip.close();
+    await close();
   }
 }
+function readZipEntry(zipPath, match) {
+  return withHapZip(zipPath, (zip) => {
+    const entry = Object.values(zip.entries()).find((e) => !e.isDirectory && match(e.name));
+    return entry ? zip.entryData(entry.name) : void 0;
+  });
+}
 
 // src/sdk/list.ts
 import * as fs7 from "fs";
@@ -1425,9 +1436,16 @@ var SIGNING_KIND_CONFIG = {
     certBasename: "OpenHarmonyApplication.cer"
   }
 };
-function copyFilesToProject(projectDir, paths, kind, logger, applicationCertPath) {
-  logger.info("[sign] Copying signing material into project...");
-  const signaturesDir = path14.join(projectDir, "signatures");
+function sdkSigningFiles(sdkPath) {
+  return {
+    signTool: path14.join(sdkPath, "toolchains/lib/hap-sign-tool.jar"),
+    keystore: path14.join(sdkPath, "toolchains/lib/OpenHarmony.p12"),
+    profileCert: path14.join(sdkPath, "toolchains/lib/OpenHarmonyProfileRelease.pem"),
+    unsignedProfileTemplate: path14.join(sdkPath, "toolchains/lib/UnsgnedReleasedProfileTemplate.json")
+  };
+}
+function copySigningFiles(signaturesDir, paths, kind, logger, applicationCertPath) {
+  logger.info(`[sign] Copying signing material into ${signaturesDir}...`);
   fs13.mkdirSync(signaturesDir, { recursive: true });
   fs13.copyFileSync(paths.keystore, path14.join(signaturesDir, "OpenHarmony.p12"));
   fs13.copyFileSync(paths.profileCert, path14.join(signaturesDir, "OpenHarmonyProfileRelease.pem"));
@@ -1454,10 +1472,7 @@ function extractLeafCertificate(chainPath) {
   return parts[2].trim() + "\n-----END CERTIFICATE-----\n";
 }
 function modifyProfileTemplate(projectDir, apl, appFeature, logger, options = {}) {
-  const kind = options.kind ?? pickSigningKind(apl);
-  logger.info(`[sign] Modifying profile template (apl=${apl}, app-feature=${appFeature}, kind=${kind})...`);
   const appJsonPath = path14.join(projectDir, "AppScope/app.json5");
-  const profileTemplatePath = path14.join(projectDir, "signatures/UnsgnedReleasedProfileTemplate.json");
   if (!fs13.existsSync(appJsonPath)) {
     throw new OniroError(`${appJsonPath} does not exist.`);
   }
@@ -1467,26 +1482,28 @@ function modifyProfileTemplate(projectDir, apl, appFeature, logger, options = {}
   } catch (e) {
     throw new OniroError(`Error parsing ${appJsonPath}: ${e.message}`, e);
   }
+  if (!appJson.app?.bundleName) {
+    throw new OniroError("app.json5 does not contain app.bundleName.");
+  }
+  applyProfileTemplate(path14.join(projectDir, "signatures"), appJson.app.bundleName, apl, appFeature, logger, options);
+}
+function applyProfileTemplate(signaturesDir, bundleName, apl, appFeature, logger, options = {}) {
+  const kind = options.kind ?? pickSigningKind(apl);
+  logger.info(`[sign] Modifying profile template (apl=${apl}, app-feature=${appFeature}, kind=${kind})...`);
+  const profileTemplatePath = path14.join(signaturesDir, "UnsgnedReleasedProfileTemplate.json");
   let profileTemplate;
   try {
     profileTemplate = JSON.parse(fs13.readFileSync(profileTemplatePath, "utf-8"));
   } catch (e) {
     throw new OniroError(`Error parsing ${profileTemplatePath}: ${e.message}`, e);
   }
-  if (!appJson.app?.bundleName) {
-    throw new OniroError("app.json5 does not contain app.bundleName.");
-  }
   if (!profileTemplate["bundle-info"]) {
     throw new OniroError("UnsgnedReleasedProfileTemplate.json is missing the bundle-info section.");
   }
-  profileTemplate["bundle-info"]["bundle-name"] = appJson.app.bundleName;
+  profileTemplate["bundle-info"]["bundle-name"] = bundleName;
   profileTemplate["bundle-info"]["apl"] = apl;
   profileTemplate["bundle-info"]["app-feature"] = appFeature;
-  const distCertChainPath = path14.join(
-    projectDir,
-    "signatures",
-    SIGNING_KIND_CONFIG[kind].certBasename
-  );
+  const distCertChainPath = path14.join(signaturesDir, SIGNING_KIND_CONFIG[kind].certBasename);
   profileTemplate["bundle-info"]["distribution-certificate"] = extractLeafCertificate(distCertChainPath);
   if (options.acls !== void 0) {
     profileTemplate.acls = profileTemplate.acls ?? {};
@@ -1497,9 +1514,8 @@ function modifyProfileTemplate(projectDir, apl, appFeature, logger, options = {}
   }
   fs13.writeFileSync(profileTemplatePath, JSON.stringify(profileTemplate, null, 2));
 }
-function generateP7bFile(projectDir, paths, logger, passwords) {
+function generateP7bFile(signaturesDir, paths, logger, passwords) {
   logger.info("[sign] Generating P7b profile via hap-sign-tool...");
-  const signaturesDir = path14.join(projectDir, "signatures");
   const profileTemplatePath = path14.join(signaturesDir, "UnsgnedReleasedProfileTemplate.json");
   const outputProfilePath = path14.join(signaturesDir, "app1-profile.p7b");
   const args = [
@@ -1623,30 +1639,201 @@ function generateSigningConfigs(options) {
   if (!fs13.existsSync(sdkPath)) {
     throw new SdkNotInstalledError(String(sdkVersion), sdkPath, ALL_SDKS.find((s) => s.api === String(sdkVersion))?.version);
   }
-  const paths = {
-    signTool: path14.join(sdkPath, "toolchains/lib/hap-sign-tool.jar"),
-    keystore: path14.join(sdkPath, "toolchains/lib/OpenHarmony.p12"),
-    profileCert: path14.join(sdkPath, "toolchains/lib/OpenHarmonyProfileRelease.pem"),
-    unsignedProfileTemplate: path14.join(sdkPath, "toolchains/lib/UnsgnedReleasedProfileTemplate.json")
-  };
+  const paths = sdkSigningFiles(sdkPath);
   const kind = pickSigningKind(apl);
   const passwords = options.passwords ?? DEFAULT_PASSWORDS;
   logger.info("[sign] Starting signing configuration generation...");
-  copyFilesToProject(projectDir, paths, kind, logger, options.applicationCertPath);
+  const signaturesDir = path14.join(projectDir, "signatures");
+  copySigningFiles(signaturesDir, paths, kind, logger, options.applicationCertPath);
   modifyProfileTemplate(projectDir, apl, appFeature, logger, {
     kind,
     acls: options.acls,
     appPrivilegeCapabilities: options.appPrivilegeCapabilities
   });
-  generateP7bFile(projectDir, paths, logger, passwords);
+  generateP7bFile(signaturesDir, paths, logger, passwords);
   prepareMaterialDirectory(projectDir, logger);
   updateBuildProfile(projectDir, kind, logger, passwords);
   logger.info("[sign] Signing configuration generated successfully.");
 }
 
-// src/emulator/install.ts
+// src/sign/hapInfo.ts
+import * as crypto3 from "crypto";
 import * as fs14 from "fs";
 import * as path15 from "path";
+function parseHapModuleJson(text, hapPath) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text.replace(/^\uFEFF/, ""));
+  } catch (err) {
+    throw new OniroError(`The module.json in ${hapPath} is not valid JSON: ${err.message}`, err);
+  }
+  const bundleName = parsed.app?.bundleName;
+  if (typeof bundleName !== "string" || !bundleName) {
+    throw new OniroError(`The module.json in ${hapPath} names no app.bundleName.`);
+  }
+  const requested = Array.isArray(parsed.module?.requestPermissions) ? parsed.module.requestPermissions : [];
+  const { compileSdkType, targetAPIVersion } = parsed.app ?? {};
+  return {
+    bundleName,
+    requestedPermissions: requested.map((p) => p?.name).filter((n) => typeof n === "string" && n.length > 0),
+    compileSdkType: typeof compileSdkType === "string" && compileSdkType ? compileSdkType : void 0,
+    targetApiVersion: typeof targetAPIVersion === "number" ? targetAPIVersion : void 0
+  };
+}
+async function readHapSigningInfo(hapPath) {
+  if (!fs14.existsSync(hapPath)) throw new OniroError(`${hapPath} does not exist.`);
+  let moduleJson;
+  try {
+    moduleJson = await readZipEntry(hapPath, (n) => n === "module.json");
+    if (!moduleJson && await readZipEntry(hapPath, (n) => n === "config.json")) {
+      throw new OniroError(
+        `${hapPath} is an FA-model HAP (config.json, no module.json). Only stage-model HAPs can be signed without their project.`
+      );
+    }
+  } catch (err) {
+    if (err instanceof OniroError) throw err;
+    throw new OniroError(`Could not read ${hapPath} as a HAP: ${err.message}`, err);
+  }
+  if (!moduleJson) throw new OniroError(`${hapPath} holds no module.json, so it is not a HAP.`);
+  return parseHapModuleJson(moduleJson.toString("utf8"), hapPath);
+}
+function defaultSignedHapPath(hapPath) {
+  const dir = path15.dirname(hapPath);
+  const name = path15.basename(hapPath);
+  if (/-signed\.hap$/i.test(name)) return path15.join(dir, name.replace(/-signed\.hap$/i, "-resigned.hap"));
+  return path15.join(dir, `${name.replace(/(-unsigned)?\.hap$/i, "")}-signed.hap`);
+}
+async function writeHapAtomically(outPath, sign) {
+  const dir = path15.dirname(outPath);
+  try {
+    fs14.mkdirSync(dir, { recursive: true });
+  } catch (err) {
+    throw new OniroError(`Cannot create ${dir} for the signed HAP: ${err.message}`, err);
+  }
+  const tmpPath = path15.join(dir, `.${path15.basename(outPath)}.${crypto3.randomBytes(4).toString("hex")}.tmp`);
+  try {
+    await sign(tmpPath);
+    fs14.renameSync(tmpPath, outPath);
+  } finally {
+    fs14.rmSync(tmpPath, { force: true });
+  }
+}
+
+// src/sign/signHap.ts
+import * as fs15 from "fs";
+import * as os8 from "os";
+import * as path16 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+
+// src/project/validators.ts
+function isValidProjectName(name) {
+  if (!name) return false;
+  if (name.includes("/") || name.includes("\\")) return false;
+  return /^[A-Za-z0-9._-]+$/.test(name);
+}
+function isValidBundleName(bundleName) {
+  return /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/.test(bundleName);
+}
+
+// src/sign/signHap.ts
+function pickSigningSdk(sdkHome, targetApiVersion) {
+  let apis;
+  try {
+    apis = fs15.readdirSync(sdkHome).filter((api2) => /^\d+$/.test(api2));
+  } catch {
+    return null;
+  }
+  const usable = apis.filter((api2) => fs15.existsSync(sdkSigningFiles(path16.join(sdkHome, api2)).signTool)).sort((a, b) => Number(b) - Number(a));
+  const api = usable.find((a) => targetApiVersion !== void 0 && Number(a) === targetApiVersion) ?? usable[0];
+  return api ? { api, sdkPath: path16.join(sdkHome, api) } : null;
+}
+async function signOpenHarmonyHap(opts) {
+  const logger = opts.logger ?? noopLogger;
+  const hapPath = path16.resolve(opts.hapPath);
+  const outPath = path16.resolve(opts.outPath ?? defaultSignedHapPath(hapPath));
+  const apl = opts.apl ?? "normal";
+  if (!APL_VALUES.includes(apl)) {
+    throw new OniroError(`Invalid apl '${apl}'. Expected one of: ${APL_VALUES.join(", ")}.`);
+  }
+  const appFeature = resolveAppFeature(apl, opts.appFeature);
+  if (!APP_FEATURE_VALUES.includes(appFeature)) {
+    throw new OniroError(`Invalid appFeature '${appFeature}'. Expected one of: ${APP_FEATURE_VALUES.join(", ")}.`);
+  }
+  const info = await readHapSigningInfo(hapPath);
+  if (info.compileSdkType === "HarmonyOS") {
+    throw new OniroError(
+      `${hapPath} was built for HarmonyOS, which needs a certificate from AppGallery Connect: run \`oniro-app auth login\` once, then \`oniro-app sign --harmonyos --hap\`.`
+    );
+  }
+  if (!isValidBundleName(info.bundleName)) {
+    throw new OniroError(`${hapPath} names an invalid bundle name '${info.bundleName}'.`);
+  }
+  const sdk = pickSigningSdk(opts.sdkHome, info.targetApiVersion);
+  if (!sdk) {
+    throw new OniroError(
+      `No OpenHarmony SDK with hap-sign-tool.jar under ${opts.sdkHome}; install one with \`oniro-app sdk install\`.`
+    );
+  }
+  const files = sdkSigningFiles(sdk.sdkPath);
+  const kind = pickSigningKind(apl);
+  const passwords = opts.passwords ?? DEFAULT_PASSWORDS;
+  logger.info(`[sign] Signing ${path16.basename(hapPath)} as ${info.bundleName} with the API ${sdk.api} SDK's material...`);
+  const signaturesDir = fs15.mkdtempSync(path16.join(os8.tmpdir(), "oniro-sign-hap-"));
+  try {
+    copySigningFiles(signaturesDir, files, kind, logger, opts.applicationCertPath);
+    applyProfileTemplate(signaturesDir, info.bundleName, apl, appFeature, logger, {
+      kind,
+      acls: opts.acls,
+      appPrivilegeCapabilities: opts.appPrivilegeCapabilities
+    });
+    generateP7bFile(signaturesDir, files, logger, passwords);
+    logger.info("[sign] Signing the HAP via hap-sign-tool...");
+    const { hapKeyAlias, certBasename } = SIGNING_KIND_CONFIG[kind];
+    await writeHapAtomically(outPath, (tmpPath) => {
+      const args = [
+        "-jar",
+        files.signTool,
+        "sign-app",
+        "-mode",
+        "localSign",
+        "-keyAlias",
+        hapKeyAlias,
+        "-signAlg",
+        "SHA256withECDSA",
+        "-appCertFile",
+        path16.join(signaturesDir, certBasename),
+        "-profileFile",
+        path16.join(signaturesDir, "app1-profile.p7b"),
+        "-inFile",
+        hapPath,
+        "-outFile",
+        tmpPath,
+        "-keystoreFile",
+        path16.join(signaturesDir, "OpenHarmony.p12"),
+        "-keyPwd",
+        passwords.key,
+        "-keystorePwd",
+        passwords.store
+      ];
+      try {
+        execFileSync2("java", args, { stdio: "inherit" });
+      } catch (e) {
+        throw new OniroError(
+          `hap-sign-tool failed to sign ${hapPath}. Ensure a JDK (with java) is on PATH. Underlying error: ${e.message}`,
+          e
+        );
+      }
+    });
+  } finally {
+    fs15.rmSync(signaturesDir, { recursive: true, force: true });
+  }
+  logger.info(`[sign] Wrote ${outPath}.`);
+  return { bundleName: info.bundleName, outPath, sdkApi: sdk.api, kind };
+}
+
+// src/emulator/install.ts
+import * as fs16 from "fs";
+import * as path17 from "path";
 async function installEmulator(opts) {
   const { config, progress, abortSignal } = opts;
   const logger = opts.logger ?? noopLogger;
@@ -1656,20 +1843,20 @@ async function installEmulator(opts) {
   const { dir: tmpDir, root: tmpRoot } = createInstallTempDir({
     config,
     override: opts.tmpDir,
-    installRoot: path15.dirname(emulatorDir),
+    installRoot: path17.dirname(emulatorDir),
     prefix: "oniro-emulator-",
     logger
   });
-  const tmpZip = path15.join(tmpDir, "oniro_emulator.zip");
+  const tmpZip = path17.join(tmpDir, "oniro_emulator.zip");
   try {
-    fs14.mkdirSync(emulatorDir, { recursive: true });
+    fs16.mkdirSync(emulatorDir, { recursive: true });
     progress?.report({ message: "Downloading emulator...", increment: 0 });
     await downloadFile({ url, dest: tmpZip, progress, abortSignal, start: 0, range: 50, what, tmpRoot });
     progress?.report({ message: "Extracting emulator...", increment: 0 });
     await extractZipWithProgress({ zipPath: tmpZip, dest: emulatorDir, progress, start: 50, range: 45, logger });
-    const runSh = path15.join(emulatorDir, "images", "run.sh");
-    if (fs14.existsSync(runSh)) {
-      fs14.chmodSync(runSh, 493);
+    const runSh = path17.join(emulatorDir, "images", "run.sh");
+    if (fs16.existsSync(runSh)) {
+      fs16.chmodSync(runSh, 493);
     }
     progress?.report({ message: "Finalizing installation...", increment: 5 });
   } catch (err) {
@@ -1679,24 +1866,24 @@ async function installEmulator(opts) {
   }
 }
 function isEmulatorInstalled(config) {
-  const imagesDir = path15.join(getEmulatorDir(config), "images");
-  return fs14.existsSync(path15.join(imagesDir, "run.sh")) || fs14.existsSync(path15.join(imagesDir, "run.bat"));
+  const imagesDir = path17.join(getEmulatorDir(config), "images");
+  return fs16.existsSync(path17.join(imagesDir, "run.sh")) || fs16.existsSync(path17.join(imagesDir, "run.bat"));
 }
 function removeEmulator(config) {
   const emulatorDir = getEmulatorDir(config);
-  if (fs14.existsSync(emulatorDir)) {
-    fs14.rmSync(emulatorDir, { recursive: true, force: true });
+  if (fs16.existsSync(emulatorDir)) {
+    fs16.rmSync(emulatorDir, { recursive: true, force: true });
   }
 }
 
 // src/emulator/lifecycle.ts
-import * as fs16 from "fs";
-import * as os8 from "os";
-import * as path16 from "path";
+import * as fs18 from "fs";
+import * as os9 from "os";
+import * as path18 from "path";
 import { spawn as spawn2 } from "child_process";
 
 // src/hdc/exec.ts
-import * as fs15 from "fs";
+import * as fs17 from "fs";
 import { StringDecoder } from "string_decoder";
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
@@ -1705,12 +1892,12 @@ function runProcess(opts) {
   const { command, args, cwd, env, onOutput } = opts;
   const timeoutMs = opts.timeoutMs ?? 6e4;
   const { abortSignal } = opts;
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     if (abortSignal?.aborted) {
       reject(new CancelledError(`Command aborted before start: ${command}`));
       return;
     }
-    if (needsCmdWrapper(command) && !fs15.existsSync(command)) {
+    if (needsCmdWrapper(command) && !fs17.existsSync(command)) {
       reject(new OniroError(`Failed to spawn ${command}: ENOENT (no such file)`));
       return;
     }
@@ -1778,7 +1965,7 @@ ${stderr.trim()}` : "")
         );
         return;
       }
-      resolve7({ code: code ?? -1, stdout, stderr });
+      resolve9({ code: code ?? -1, stdout, stderr });
     });
   });
 }
@@ -1851,7 +2038,7 @@ function ensureRemoteOk(result, command) {
 }
 
 // src/emulator/lifecycle.ts
-var PID_FILE = path16.join(os8.tmpdir(), "oniro_emulator.pid");
+var PID_FILE = path18.join(os9.tmpdir(), "oniro_emulator.pid");
 async function attemptHdcConnection(config, address = "127.0.0.1:55555", logger = noopLogger) {
   try {
     await hdcExec({ config, args: ["start", "-r"], logger });
@@ -1864,24 +2051,24 @@ async function attemptHdcConnection(config, address = "127.0.0.1:55555", logger
   }
 }
 function resolveLauncher(imagesPath, headless, connect) {
-  const runSh = path16.join(imagesPath, "run.sh");
-  const runBat = path16.join(imagesPath, "run.bat");
+  const runSh = path18.join(imagesPath, "run.sh");
+  const runBat = path18.join(imagesPath, "run.bat");
   const extra = [];
   if (headless) extra.push("--headless");
   if (connect) extra.push("--connect", connect);
-  if (os8.platform() === "win32") {
-    if (fs16.existsSync(runBat)) {
+  if (os9.platform() === "win32") {
+    if (fs18.existsSync(runBat)) {
       return { command: "cmd.exe", args: ["/c", runBat, ...extra], cwd: imagesPath };
     }
-    if (fs16.existsSync(runSh)) {
+    if (fs18.existsSync(runSh)) {
       return { command: "bash", args: [runSh, ...extra], cwd: imagesPath };
     }
     throw new OniroError(`No emulator launcher (run.bat or run.sh) found in ${imagesPath}.`);
   }
-  if (fs16.existsSync(runSh)) {
+  if (fs18.existsSync(runSh)) {
     return { command: "bash", args: [runSh, ...extra], cwd: imagesPath };
   }
-  if (fs16.existsSync(runBat)) {
+  if (fs18.existsSync(runBat)) {
     return { command: "bash", args: [runBat, ...extra], cwd: imagesPath };
   }
   throw new OniroError(`No emulator launcher (run.sh or run.bat) found in ${imagesPath}.`);
@@ -1889,9 +2076,9 @@ function resolveLauncher(imagesPath, headless, connect) {
 async function startEmulator(opts) {
   const { config } = opts;
   const logger = opts.logger ?? noopLogger;
-  if (os8.platform() !== "win32" && fs16.existsSync(PID_FILE)) {
+  if (os9.platform() !== "win32" && fs18.existsSync(PID_FILE)) {
     try {
-      const pid = Number(fs16.readFileSync(PID_FILE, "utf8").trim());
+      const pid = Number(fs18.readFileSync(PID_FILE, "utf8").trim());
       if (Number.isFinite(pid) && pid > 0) {
         try {
           process.kill(pid, 0);
@@ -1907,13 +2094,13 @@ async function startEmulator(opts) {
       logger.warn(`Could not read PID file: ${err.message}`);
     }
   }
-  const imagesPath = path16.join(getEmulatorDir(config), "images");
-  if (!fs16.existsSync(imagesPath)) {
+  const imagesPath = path18.join(getEmulatorDir(config), "images");
+  if (!fs18.existsSync(imagesPath)) {
     throw new OniroError(`Emulator images directory not found at ${imagesPath}. Run \`oniro-app emulator install\` first.`);
   }
   const launcher = resolveLauncher(imagesPath, opts.headless === true, opts.connect);
-  const logPath = opts.logFile ?? (os8.platform() === "win32" ? "NUL" : "/dev/null");
-  const logFd = fs16.openSync(logPath, "a");
+  const logPath = opts.logFile ?? (os9.platform() === "win32" ? "NUL" : "/dev/null");
+  const logFd = fs18.openSync(logPath, "a");
   let child;
   try {
     child = spawn2(launcher.command, [...launcher.args], {
@@ -1923,19 +2110,19 @@ async function startEmulator(opts) {
       windowsHide: true
     });
   } finally {
-    fs16.closeSync(logFd);
+    fs18.closeSync(logFd);
   }
   if (!child.pid) {
     throw new OniroError(`Failed to spawn launcher (${launcher.command} ${launcher.args.join(" ")}).`);
   }
-  fs16.writeFileSync(PID_FILE, String(child.pid));
+  fs18.writeFileSync(PID_FILE, String(child.pid));
   child.unref();
   logger.info(`Emulator launched (PID ${child.pid}). Logs: ${logPath}`);
-  const earlyExit = new Promise((resolve7) => {
-    child.once("exit", (code) => resolve7(code));
-    child.once("error", () => resolve7(-1));
+  const earlyExit = new Promise((resolve9) => {
+    child.once("exit", (code) => resolve9(code));
+    child.once("error", () => resolve9(-1));
   });
-  const liveness = new Promise((resolve7) => setTimeout(() => resolve7("alive"), 2e3));
+  const liveness = new Promise((resolve9) => setTimeout(() => resolve9("alive"), 2e3));
   const outcome = await Promise.race([earlyExit, liveness]);
   if (outcome !== "alive") {
     const tail = readTail(logPath, 4e3);
@@ -1975,24 +2162,24 @@ ${tail}` : ""}`);
 }
 function readTail(filePath, bytes) {
   try {
-    const stat = fs16.statSync(filePath);
+    const stat = fs18.statSync(filePath);
     const start = Math.max(0, stat.size - bytes);
-    const fd = fs16.openSync(filePath, "r");
+    const fd = fs18.openSync(filePath, "r");
     try {
       const buf = Buffer.alloc(stat.size - start);
-      fs16.readSync(fd, buf, 0, buf.length, start);
+      fs18.readSync(fd, buf, 0, buf.length, start);
       return buf.toString("utf8");
     } finally {
-      fs16.closeSync(fd);
+      fs18.closeSync(fd);
     }
   } catch {
     return "";
   }
 }
 async function stopEmulator(logger = noopLogger) {
-  if (fs16.existsSync(PID_FILE)) {
+  if (fs18.existsSync(PID_FILE)) {
     try {
-      const pid = Number(fs16.readFileSync(PID_FILE, "utf8").trim());
+      const pid = Number(fs18.readFileSync(PID_FILE, "utf8").trim());
       if (Number.isFinite(pid) && pid > 0) {
         try {
           process.kill(pid, "SIGTERM");
@@ -2005,20 +2192,20 @@ async function stopEmulator(logger = noopLogger) {
       logger.warn(`Could not read PID file: ${err.message}`);
     }
   }
-  const [killCmd, ...killArgs] = os8.platform() === "win32" ? ["taskkill", "/IM", "qemu-system-x86_64.exe", "/F"] : ["pkill", "-f", "qemu-system-x86_64"];
+  const [killCmd, ...killArgs] = os9.platform() === "win32" ? ["taskkill", "/IM", "qemu-system-x86_64.exe", "/F"] : ["pkill", "-f", "qemu-system-x86_64"];
   try {
     await runProcess({ command: killCmd, args: killArgs, logger });
   } catch (err) {
     logger.warn(`[emulator] could not run ${killCmd}: ${err.message}`);
   }
-  fs16.rm(PID_FILE, { force: true }, (err) => {
+  fs18.rm(PID_FILE, { force: true }, (err) => {
     if (err) logger.warn(`Could not remove PID file: ${err.message}`);
   });
 }
 async function isQemuRunning(logger) {
-  if (os8.platform() !== "win32") {
+  if (os9.platform() !== "win32") {
     try {
-      const pid = Number(fs16.readFileSync(PID_FILE, "utf8").trim());
+      const pid = Number(fs18.readFileSync(PID_FILE, "utf8").trim());
       if (Number.isFinite(pid) && pid > 0) {
         process.kill(pid, 0);
         return true;
@@ -2026,10 +2213,10 @@ async function isQemuRunning(logger) {
     } catch {
     }
   }
-  const [cmd, ...args] = os8.platform() === "win32" ? ["tasklist", "/FI", "IMAGENAME eq qemu-system-x86_64.exe", "/NH"] : ["pgrep", "-f", "qemu-system-x86_64"];
+  const [cmd, ...args] = os9.platform() === "win32" ? ["tasklist", "/FI", "IMAGENAME eq qemu-system-x86_64.exe", "/NH"] : ["pgrep", "-f", "qemu-system-x86_64"];
   try {
     const res = await runProcess({ command: cmd, args, timeoutMs: 1e4, logger });
-    return os8.platform() === "win32" ? /qemu-system-x86_64/i.test(res.stdout) : res.code === 0;
+    return os9.platform() === "win32" ? /qemu-system-x86_64/i.test(res.stdout) : res.code === 0;
   } catch {
     return false;
   }
@@ -2154,11 +2341,11 @@ async function paramSet(config, key, value, opts = {}) {
 }
 
 // src/hdc/files.ts
-import * as path17 from "path";
+import * as path19 from "path";
 function normaliseLocalPath(local) {
-  const abs = path17.resolve(local);
+  const abs = path19.resolve(local);
   const long = toLongPath(abs);
-  return long !== abs ? long : path17.join(toLongPath(path17.dirname(abs)), path17.basename(abs));
+  return long !== abs ? long : path19.join(toLongPath(path19.dirname(abs)), path19.basename(abs));
 }
 function assertDevicePath(remote) {
   if (/^[A-Za-z]:[\\/]/.test(remote)) {
@@ -2177,13 +2364,13 @@ async function sendFile(opts) {
   assertDevicePath(opts.remote);
   const local = normaliseLocalPath(opts.local);
   const sandbox = opts.bundle ? appSandboxDir(opts.bundle) : void 0;
-  const remote = sandbox && !opts.remote.startsWith("/") ? path17.posix.join(sandbox, opts.remote) : opts.remote;
+  const remote = sandbox && !opts.remote.startsWith("/") ? path19.posix.join(sandbox, opts.remote) : opts.remote;
   if (sandbox && !remote.startsWith(`${sandbox}/`)) {
     throw new OniroError(`${remote} is outside the sandbox of ${opts.bundle} (${sandbox}).`);
   }
   const device = { config: opts.config, deviceSerial: opts.deviceSerial, logger: opts.logger };
   if (sandbox) {
-    const mkdir = `mkdir -p ${shQuote(path17.posix.dirname(remote))}`;
+    const mkdir = `mkdir -p ${shQuote(path19.posix.dirname(remote))}`;
     ensureRemoteOk(await shellChecked({ ...device, command: mkdir }), `hdc shell ${mkdir}`);
   }
   const res = await hdcExec({
@@ -2195,7 +2382,7 @@ async function sendFile(opts) {
   });
   ensureOk(res, `hdc file send ${local} ${remote}`);
   if (sandbox) {
-    const top = path17.posix.join(sandbox, path17.posix.relative(sandbox, remote).split("/")[0]);
+    const top = path19.posix.join(sandbox, path19.posix.relative(sandbox, remote).split("/")[0]);
     const chown = `chown -R "$(stat -c %u:%g ${shQuote(sandbox)})" ${shQuote(top)}`;
     ensureRemoteOk(await shellChecked({ ...device, command: chown }), `hdc shell ${chown}`);
   }
@@ -2233,7 +2420,7 @@ async function getDisplaySize(config, opts = {}) {
 
 // src/hdc/wait.ts
 function delay(ms, signal) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     if (signal?.aborted) {
       reject(new CancelledError("Wait cancelled."));
       return;
@@ -2248,7 +2435,7 @@ function delay(ms, signal) {
     };
     const timer = setTimeout(() => {
       cleanup();
-      resolve7();
+      resolve9();
     }, ms);
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -2277,18 +2464,18 @@ async function waitForCondition(opts) {
 }
 
 // src/hdc/app.ts
-import * as fs19 from "fs";
-import * as path20 from "path";
+import * as fs21 from "fs";
+import * as path22 from "path";
 
 // src/build/discoverHaps.ts
-import * as fs17 from "fs";
-import * as path18 from "path";
+import * as fs19 from "fs";
+import * as path20 from "path";
 function moduleOfHap(hapFileName) {
   const dash = hapFileName.indexOf("-");
   return dash > 0 ? hapFileName.slice(0, dash) : hapFileName.replace(/\.hap$/i, "");
 }
 function isAppProjectRoot(dir) {
-  return fs17.existsSync(path18.join(dir, "AppScope", "app.json5"));
+  return fs19.existsSync(path20.join(dir, "AppScope", "app.json5"));
 }
 async function discoverHaps(opts) {
   const { projectDir } = opts;
@@ -2297,9 +2484,9 @@ async function discoverHaps(opts) {
   const result = {};
   const walk = async (dir, depth) => {
     if (depth > maxDepth) return;
-    const entries = await fs17.promises.readdir(dir, { withFileTypes: true }).catch(() => []);
+    const entries = await fs19.promises.readdir(dir, { withFileTypes: true }).catch(() => []);
     for (const e of entries) {
-      const full = path18.join(dir, e.name);
+      const full = path20.join(dir, e.name);
       if (e.isDirectory()) {
         if (e.name === "node_modules" || e.name === "oh_modules" || e.name === ".git") continue;
         if (skipNestedProjects && isAppProjectRoot(full)) continue;
@@ -2313,7 +2500,7 @@ async function discoverHaps(opts) {
     }
   };
   await walk(projectDir, 0);
-  const mtime = (p) => fs17.statSync(p).mtimeMs;
+  const mtime = (p) => fs19.statSync(p).mtimeMs;
   for (const bucket of Object.values(result)) {
     bucket.signed.sort((a, b) => mtime(b) - mtime(a));
     bucket.unsigned.sort((a, b) => mtime(b) - mtime(a));
@@ -2339,16 +2526,16 @@ function pickHap(haps, module) {
 }
 
 // src/hdc/project.ts
-import * as fs18 from "fs";
-import * as path19 from "path";
+import * as fs20 from "fs";
+import * as path21 from "path";
 import JSON53 from "json5";
 function readJson5(filePath) {
-  const content = fs18.readFileSync(filePath, "utf-8");
+  const content = fs20.readFileSync(filePath, "utf-8");
   return JSON53.parse(content);
 }
 function getBundleName(projectDir) {
-  const appJsonPath = path19.join(projectDir, "AppScope", "app.json5");
-  if (!fs18.existsSync(appJsonPath)) {
+  const appJsonPath = path21.join(projectDir, "AppScope", "app.json5");
+  if (!fs20.existsSync(appJsonPath)) {
     throw new OniroError(`Could not find app.json5 at ${appJsonPath}`);
   }
   const appJson = readJson5(appJsonPath);
@@ -2358,8 +2545,8 @@ function getBundleName(projectDir) {
   return appJson.app.bundleName;
 }
 function getMainAbility(projectDir, moduleName = "entry", abilityName) {
-  const moduleJsonPath = path19.join(projectDir, moduleName, "src", "main", "module.json5");
-  if (!fs18.existsSync(moduleJsonPath)) {
+  const moduleJsonPath = path21.join(projectDir, moduleName, "src", "main", "module.json5");
+  if (!fs20.existsSync(moduleJsonPath)) {
     throw new OniroError(`Could not find module.json5 at ${moduleJsonPath}`);
   }
   const moduleJson = readJson5(moduleJsonPath);
@@ -2383,7 +2570,7 @@ function detectInstallFailure(output) {
   return /\[Fail\]|msg:\s*error|error:\s*failed to install|code:\s*95\d{5}/i.test(output) ? output.trim() : null;
 }
 function isUnsignedHap(hapPath) {
-  return path20.basename(hapPath).includes("unsigned");
+  return path22.basename(hapPath).includes("unsigned");
 }
 function installFailureReason(output) {
   const code = /code:\s*(\d+)/i.exec(output);
@@ -2392,7 +2579,7 @@ function installFailureReason(output) {
   return message ? `code ${code[1]}: ${message}` : `code ${code[1]}`;
 }
 function unsignedHapRejection(output, hap) {
-  const name = path20.basename(hap.path);
+  const name = path22.basename(hap.path);
   const reason = installFailureReason(output);
   const what = hap.fallback ? `No signed HAP was found, so the unsigned ${name} was tried, and the target rejected it (${reason}).` : `The target rejected the unsigned ${name} (${reason}).`;
   if (!/9568320|signature|pkcs7/i.test(reason)) return what;
@@ -2410,24 +2597,24 @@ ${result.stderr}`;
   return result;
 }
 function existingHapOrUnsigned(hapPath) {
-  if (fs19.existsSync(hapPath)) return { path: hapPath };
+  if (fs21.existsSync(hapPath)) return { path: hapPath };
   const sibling = hapPath.replace(/-signed\.hap$/i, "-unsigned.hap");
-  return sibling !== hapPath && fs19.existsSync(sibling) ? { path: sibling, fallback: true } : void 0;
+  return sibling !== hapPath && fs21.existsSync(sibling) ? { path: sibling, fallback: true } : void 0;
 }
 async function resolveInstallHap(opts, logger) {
   const warnIfFallback = (hap) => {
-    if (hap.fallback) logger.warn(`No signed HAP found; installing the unsigned ${path20.basename(hap.path)}.`);
+    if (hap.fallback) logger.warn(`No signed HAP found; installing the unsigned ${path22.basename(hap.path)}.`);
     return hap;
   };
   const configured = opts.hapPath ?? opts.config.get("hapPath", "");
   const relative3 = configured || defaultPaths.hapPath;
-  const hapPath = path20.isAbsolute(relative3) ? relative3 : path20.join(opts.projectDir, relative3);
+  const hapPath = path22.isAbsolute(relative3) ? relative3 : path22.join(opts.projectDir, relative3);
   if (configured) {
     const hap = existingHapOrUnsigned(hapPath);
     if (!hap) throw new OniroError(`HAP file not found at: ${hapPath}. Build the app first.`);
     return warnIfFallback(hap);
   }
-  if (fs19.existsSync(hapPath)) return { path: hapPath };
+  if (fs21.existsSync(hapPath)) return { path: hapPath };
   const haps = await discoverHaps({ projectDir: opts.projectDir });
   const anySigned = Object.values(haps).some((m) => m.signed.length > 0);
   const entryUnsigned = anySigned ? void 0 : existingHapOrUnsigned(hapPath);
@@ -2538,7 +2725,7 @@ function listRunningProcesses(config, options = {}) {
   const logger = options.logger ?? noopLogger;
   const timeoutMs = options.timeoutMs ?? 1e3;
   const hdc = getHdcPath(config);
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     let proc;
     try {
       proc = spawnCompat(hdc, [...hdcTargetArgs(options.deviceSerial), "track-jpid"]);
@@ -2558,7 +2745,7 @@ function listRunningProcesses(config, options = {}) {
         if (options.targetProcessName && name === options.targetProcessName && !resolved) {
           resolved = true;
           killProcessTree(proc);
-          resolve7(pid);
+          resolve9(pid);
           return;
         }
       }
@@ -2579,7 +2766,7 @@ function listRunningProcesses(config, options = {}) {
       if (options.targetProcessName) {
         reject(new OniroError(`Could not find process for bundle: ${options.targetProcessName}`));
       } else {
-        resolve7(processes);
+        resolve9(processes);
       }
     }, timeoutMs);
     proc.on("close", () => {
@@ -2589,7 +2776,7 @@ function listRunningProcesses(config, options = {}) {
       if (options.targetProcessName) {
         reject(new OniroError(`Could not find process for bundle: ${options.targetProcessName}`));
       } else {
-        resolve7(processes);
+        resolve9(processes);
       }
     });
   });
@@ -2758,12 +2945,12 @@ async function reboot(opts) {
 }
 
 // src/hdc/screen.ts
-import * as fs20 from "fs";
-import * as os9 from "os";
-import * as path21 from "path";
-import { randomBytes as randomBytes2 } from "crypto";
+import * as fs22 from "fs";
+import * as os10 from "os";
+import * as path23 from "path";
+import { randomBytes as randomBytes3 } from "crypto";
 function tmpName(ext) {
-  return path21.join(os9.tmpdir(), `oniro_screen_${randomBytes2(6).toString("hex")}.${ext}`);
+  return path23.join(os10.tmpdir(), `oniro_screen_${randomBytes3(6).toString("hex")}.${ext}`);
 }
 async function takeScreenshot(opts) {
   const remote = "/data/local/tmp/oniro_screenshot.jpeg";
@@ -2773,11 +2960,11 @@ async function takeScreenshot(opts) {
   const local = tmpName("jpeg");
   try {
     await recvFile({ config: opts.config, remote, local, deviceSerial: opts.deviceSerial, timeoutMs });
-    const pixels = await fs20.promises.readFile(local);
+    const pixels = await fs22.promises.readFile(local);
     const size = await getDisplaySize(opts.config, { deviceSerial: opts.deviceSerial }) ?? { width: 0, height: 0 };
     return { pixels, width: size.width, height: size.height };
   } finally {
-    fs20.promises.unlink(local).catch(() => {
+    fs22.promises.unlink(local).catch(() => {
     });
     void shell({ config: opts.config, command: `rm -f ${remote}`, deviceSerial: opts.deviceSerial }).catch(() => {
     });
@@ -2785,7 +2972,7 @@ async function takeScreenshot(opts) {
 }
 async function captureBurst(opts) {
   const count = Math.max(1, Math.floor(opts.count));
-  const remoteDir = `/data/local/tmp/oniro_burst_${randomBytes2(6).toString("hex")}`;
+  const remoteDir = `/data/local/tmp/oniro_burst_${randomBytes3(6).toString("hex")}`;
   const sleepSec = opts.intervalMs > 0 ? (opts.intervalMs / 1e3).toFixed(3) : "0";
   const loop = `mkdir -p ${remoteDir}; i=0; while [ $i -lt ${count} ]; do snapshot_display -f ${remoteDir}/f$i.jpeg; [ ${count} -gt 1 ] && sleep ${sleepSec}; i=$((i+1)); done`;
   const cap = await shell({ config: opts.config, command: loop, deviceSerial: opts.deviceSerial, timeoutMs: opts.timeoutMs ?? 12e4 });
@@ -2796,9 +2983,9 @@ async function captureBurst(opts) {
       const local = tmpName(`burst_${i}.jpeg`);
       try {
         await recvFile({ config: opts.config, remote: `${remoteDir}/f${i}.jpeg`, local, deviceSerial: opts.deviceSerial });
-        frames.push(await fs20.promises.readFile(local));
+        frames.push(await fs22.promises.readFile(local));
       } finally {
-        fs20.promises.unlink(local).catch(() => {
+        fs22.promises.unlink(local).catch(() => {
         });
       }
     }
@@ -2973,10 +3160,10 @@ async function sendRawTouch(opts) {
 }
 
 // src/hdc/dump.ts
-import * as fs21 from "fs";
-import * as os10 from "os";
-import * as path22 from "path";
-import { randomBytes as randomBytes3 } from "crypto";
+import * as fs23 from "fs";
+import * as os11 from "os";
+import * as path24 from "path";
+import { randomBytes as randomBytes4 } from "crypto";
 
 // src/hdc/ime.ts
 var INPUT_METHOD_SA_ID = 3703;
@@ -3238,10 +3425,10 @@ async function dumpLayout(opts) {
   if (!m) throw new OniroError(`Could not parse dumpLayout output:
 ${dump.stdout}`);
   const remote = m[1];
-  const local = path22.join(os10.tmpdir(), `oniro_layout_${randomBytes3(6).toString("hex")}.json`);
+  const local = path24.join(os11.tmpdir(), `oniro_layout_${randomBytes4(6).toString("hex")}.json`);
   try {
     await recvFile({ config: opts.config, remote, local, deviceSerial: opts.deviceSerial, timeoutMs });
-    const parsed = JSON.parse(await fs21.promises.readFile(local, "utf8"));
+    const parsed = JSON.parse(await fs23.promises.readFile(local, "utf8"));
     const display = await getDisplaySize(opts.config, { deviceSerial: opts.deviceSerial });
     if (opts.prune === false) {
       return { display, tree: parsed };
@@ -3254,7 +3441,7 @@ ${dump.stdout}`);
     const keyboard = kb ? { shown: true, bundle: kb.bundle, ...kb.b ? { b: kb.b } : {} } : { shown: false };
     return { display, tree, keyboard };
   } finally {
-    fs21.promises.unlink(local).catch(() => {
+    fs23.promises.unlink(local).catch(() => {
     });
     void shell({ config: opts.config, command: `rm -f ${remote}`, deviceSerial: opts.deviceSerial }).catch(() => {
     });
@@ -3264,7 +3451,7 @@ ${dump.stdout}`);
 // src/hdc/uiActions.ts
 var FOCUS_SETTLE_MS = 400;
 var KEYBOARD_SETTLE_MS = 400;
-var sleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var sleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
 function targetTree(layout) {
   const kb = layout.keyboard;
   return kb?.shown && kb.bundle ? withoutWindow(layout.tree, kb.bundle) : layout.tree;
@@ -3417,11 +3604,11 @@ async function waitForTarget(opts) {
 }
 
 // src/hdc/hilog.ts
-import * as fs22 from "fs";
+import * as fs24 from "fs";
 function setHilogLevel(opts) {
   const logger = opts.logger ?? noopLogger;
   const hdc = getHdcPath(opts.config);
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     let child;
     try {
       child = spawnCompat(hdc, [...hdcTargetArgs(opts.deviceSerial), "shell", "hilog", "-b", opts.level]);
@@ -3441,7 +3628,7 @@ function setHilogLevel(opts) {
     });
     child.once("close", (code) => {
       if (code === 0) {
-        resolve7();
+        resolve9();
       } else {
         const msg = stderr.trim() || `hdc shell hilog -b ${opts.level} exited with code ${code}`;
         logger.error(`[hilog] ${msg}`);
@@ -3543,7 +3730,7 @@ async function recentEntryFilter(opts) {
   };
 }
 function waitForLog(opts) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     const deadline = Date.now() + opts.timeoutMs;
     let settled = false;
     let child = null;
@@ -3564,7 +3751,7 @@ function waitForLog(opts) {
       if (settled) return;
       settled = true;
       cleanup();
-      resolve7(entry);
+      resolve9(entry);
     };
     const fail = (err) => {
       if (settled) return;
@@ -3619,7 +3806,7 @@ function waitForLog(opts) {
   });
 }
 function watchLog(opts) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     const matches = [];
     let settled = false;
     let child = null;
@@ -3638,7 +3825,7 @@ function watchLog(opts) {
       if (settled) return;
       settled = true;
       cleanup();
-      resolve7(opts.dedup === false ? matches : dedupEntries(matches));
+      resolve9(opts.dedup === false ? matches : dedupEntries(matches));
     };
     const onAbort = () => {
       if (settled) return;
@@ -3683,11 +3870,11 @@ async function captureLog(opts) {
     const res = await shell({ config: opts.config, command: "hilog -r", deviceSerial: opts.deviceSerial, timeoutMs: 1e4, logger });
     ensureOk(res, "hdc shell hilog -r");
   }
-  const fd = fs22.openSync(opts.file, "a");
+  const fd = fs24.openSync(opts.file, "a");
   let lines = 0;
   let reconnects = 0;
   try {
-    await new Promise((resolve7, reject) => {
+    await new Promise((resolve9, reject) => {
       const deadline = opts.durationMs !== void 0 ? Date.now() + opts.durationMs : Infinity;
       let settled = false;
       let child = null;
@@ -3696,7 +3883,7 @@ async function captureLog(opts) {
       let open = true;
       const write = (line) => {
         if (!open || opts.pattern && !opts.pattern.test(line)) return;
-        fs22.writeSync(fd, `${line}
+        fs24.writeSync(fd, `${line}
 `);
         lines++;
       };
@@ -3717,7 +3904,7 @@ async function captureLog(opts) {
         if (settled) return;
         settled = true;
         cleanup();
-        resolve7();
+        resolve9();
       }
       const fail = (err) => {
         if (settled) return;
@@ -3761,7 +3948,7 @@ async function captureLog(opts) {
       spawnStream();
     });
   } finally {
-    fs22.closeSync(fd);
+    fs24.closeSync(fd);
   }
   return { file: opts.file, lines, reconnects };
 }
@@ -3789,17 +3976,17 @@ async function dumpLog(opts) {
 }
 
 // src/build/runHvigorw.ts
-import * as fs24 from "fs";
-import * as path24 from "path";
+import * as fs26 from "fs";
+import * as path26 from "path";
 
 // src/harmonyos/target.ts
-import * as fs23 from "fs";
-import * as path23 from "path";
+import * as fs25 from "fs";
+import * as path25 from "path";
 import JSON54 from "json5";
 function detectRuntimeOs(projectDir, productName) {
   let products = [];
   try {
-    const parsed = JSON54.parse(fs23.readFileSync(path23.join(projectDir, "build-profile.json5"), "utf-8"));
+    const parsed = JSON54.parse(fs25.readFileSync(path25.join(projectDir, "build-profile.json5"), "utf-8"));
     if (Array.isArray(parsed.app?.products)) products = parsed.app.products;
   } catch {
     return "OpenHarmony";
@@ -3840,7 +4027,7 @@ function runHvigorw(opts) {
   const { config } = opts;
   const projectDir = toLongPath(opts.projectDir);
   const logger = opts.logger ?? noopLogger;
-  if (!fs24.existsSync(path24.join(projectDir, "build-profile.json5"))) {
+  if (!fs26.existsSync(path26.join(projectDir, "build-profile.json5"))) {
     throw new OniroError(`Not an OpenHarmony project: ${projectDir} (build-profile.json5 not found).`);
   }
   let hvigorw;
@@ -3852,24 +4039,24 @@ function runHvigorw(opts) {
     hvigorw = resolved.startsWith(projectDir) ? resolved : findHarmonyOsTool(sdk, "hvigorw") ?? resolved;
     logger.info(`[build] Building for HarmonyOS against the SDK at ${sdk.sdkPath}.`);
   } else {
-    if (!fs24.existsSync(getCmdToolsPath(config))) {
+    if (!fs26.existsSync(getCmdToolsPath(config))) {
       throw new CmdToolsNotInstalledError(getCmdToolsPath(config));
     }
     sdkEnv = { OHOS_BASE_SDK_HOME: getOhosBaseSdkHome(config) };
     hvigorw = getHvigorwPath(config, projectDir);
   }
-  if (!fs24.existsSync(hvigorw)) {
+  if (!fs26.existsSync(hvigorw)) {
     throw new OniroError(`hvigorw wrapper not found at ${hvigorw}.`);
   }
   const args = buildHvigorwArgs(opts);
   if (process.platform !== "win32") {
     try {
-      fs24.chmodSync(hvigorw, 493);
+      fs26.chmodSync(hvigorw, 493);
     } catch {
     }
   }
   const env = { ...process.env, ...sdkEnv };
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     if (opts.abortSignal?.aborted) {
       reject(new CancelledError("hvigorw build cancelled."));
       return;
@@ -3913,15 +4100,15 @@ function runHvigorw(opts) {
       settled = true;
       cleanup();
       const exitCode = code ?? 1;
-      if (exitCode === 0) resolve7({ exitCode });
+      if (exitCode === 0) resolve9({ exitCode });
       else reject(new OniroError(`hvigorw exited with code ${exitCode}`));
     });
   });
 }
 
 // src/build/ohpm.ts
-import * as fs25 from "fs";
-import * as path25 from "path";
+import * as fs27 from "fs";
+import * as path27 from "path";
 function runOhpm(opts) {
   return runProcess({
     command: opts.ohpmPath ?? getOhpmPath(opts.config),
@@ -3934,7 +4121,7 @@ function runOhpm(opts) {
   });
 }
 async function ensureOhModules(opts) {
-  if (fs25.existsSync(path25.join(opts.projectDir, "oh_modules"))) {
+  if (fs27.existsSync(path27.join(opts.projectDir, "oh_modules"))) {
     return { installed: false };
   }
   const res = await runOhpm({
@@ -3951,8 +4138,8 @@ async function ensureOhModules(opts) {
 }
 
 // src/build/codelinter.ts
-import * as fs26 from "fs";
-import * as path26 from "path";
+import * as fs28 from "fs";
+import * as path28 from "path";
 var FINDING_RE = /^(.*?):(\d+):(?:(\d+):)?\s*(error|warning|warn|suggestion|info)\b[:\s-]*(.*)$/i;
 var TRAILING_CODE_RE = /[([]([\w@/.\-]+)[)\]]\s*$/;
 var FILE_HEADER_RE = /^(.+\.\w+)\((\d+)\)$/;
@@ -4042,10 +4229,10 @@ function parseCodelinterFindings(output) {
 var PROJECT_ROOT_FILES = [
   ["build-profile.json5"],
   ["hvigorfile.ts", "hvigorfile.js"],
-  [path26.join("hvigor", "hvigor-config.json5")]
+  [path28.join("hvigor", "hvigor-config.json5")]
 ];
 function missingProjectRootFiles(projectDir) {
-  return PROJECT_ROOT_FILES.filter((names) => !names.some((f) => fs26.existsSync(path26.join(projectDir, f)))).map(
+  return PROJECT_ROOT_FILES.filter((names) => !names.some((f) => fs28.existsSync(path28.join(projectDir, f)))).map(
     (names) => names[0]
   );
 }
@@ -4127,32 +4314,22 @@ ${hint}`, err);
   return { exitCode, durationMs: Date.now() - start, discoveredHaps, warnings };
 }
 
-// src/project/validators.ts
-function isValidProjectName(name) {
-  if (!name) return false;
-  if (name.includes("/") || name.includes("\\")) return false;
-  return /^[A-Za-z0-9._-]+$/.test(name);
-}
-function isValidBundleName(bundleName) {
-  return /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/.test(bundleName);
-}
-
 // src/project/templates.ts
-import * as fs27 from "fs";
-import * as path27 from "path";
+import * as fs29 from "fs";
+import * as path29 from "path";
 function toHumanTemplateName(folderName) {
   return folderName.replace(/([a-z])([A-Z])/g, "$1 $2");
 }
 function listTemplates(templateRoot) {
-  if (!fs27.existsSync(templateRoot)) return [];
-  const entries = fs27.readdirSync(templateRoot, { withFileTypes: true });
+  if (!fs29.existsSync(templateRoot)) return [];
+  const entries = fs29.readdirSync(templateRoot, { withFileTypes: true });
   return entries.filter((e) => e.isDirectory()).map((e) => {
-    const dir = path27.join(templateRoot, e.name);
-    const metaPath = path27.join(dir, "template.json");
+    const dir = path29.join(templateRoot, e.name);
+    const metaPath = path29.join(dir, "template.json");
     let meta = {};
-    if (fs27.existsSync(metaPath)) {
+    if (fs29.existsSync(metaPath)) {
       try {
-        meta = JSON.parse(fs27.readFileSync(metaPath, "utf8"));
+        meta = JSON.parse(fs29.readFileSync(metaPath, "utf8"));
       } catch {
       }
     }
@@ -4167,57 +4344,57 @@ function listTemplates(templateRoot) {
 function validateTemplateLayout(templateDir, defaultModuleName) {
   const required = [
     "build-profile.json5",
-    path27.join("AppScope", "app.json5"),
-    path27.join(defaultModuleName, "src", "main", "module.json5"),
-    path27.join(defaultModuleName, "oh-package.json5"),
+    path29.join("AppScope", "app.json5"),
+    path29.join(defaultModuleName, "src", "main", "module.json5"),
+    path29.join(defaultModuleName, "oh-package.json5"),
     "hvigorfile.ts"
   ];
-  return required.filter((rel) => !fs27.existsSync(path27.join(templateDir, rel)));
+  return required.filter((rel) => !fs29.existsSync(path29.join(templateDir, rel)));
 }
 
 // src/project/createScaffold.ts
-import * as fs29 from "fs";
-import * as path28 from "path";
+import * as fs31 from "fs";
+import * as path30 from "path";
 
 // src/project/jsonHelpers.ts
-import * as fs28 from "fs";
+import * as fs30 from "fs";
 import JSON55 from "json5";
 function readJson5File(filePath) {
-  return JSON55.parse(fs28.readFileSync(filePath, "utf8"));
+  return JSON55.parse(fs30.readFileSync(filePath, "utf8"));
 }
 function writeJson5File(filePath, value) {
-  fs28.writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", "utf8");
+  fs30.writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", "utf8");
 }
 function readJsonFile(filePath) {
-  return JSON.parse(fs28.readFileSync(filePath, "utf8"));
+  return JSON.parse(fs30.readFileSync(filePath, "utf8"));
 }
 function writeJsonFile(filePath, value) {
-  fs28.writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", "utf8");
+  fs30.writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", "utf8");
 }
 
 // src/project/createScaffold.ts
 var IGNORED_DIRS = /* @__PURE__ */ new Set(["oh_modules", "node_modules", "build", ".hvigor"]);
 async function pathExists(p) {
   try {
-    await fs29.promises.access(p);
+    await fs31.promises.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function copyDirRecursive(srcDir, destDir) {
-  await fs29.promises.mkdir(destDir, { recursive: true });
-  const entries = await fs29.promises.readdir(srcDir, { withFileTypes: true });
+  await fs31.promises.mkdir(destDir, { recursive: true });
+  const entries = await fs31.promises.readdir(srcDir, { withFileTypes: true });
   for (const entry of entries) {
-    const src = path28.join(srcDir, entry.name);
-    const dest = path28.join(destDir, entry.name);
+    const src = path30.join(srcDir, entry.name);
+    const dest = path30.join(destDir, entry.name);
     if (entry.isDirectory()) {
       await copyDirRecursive(src, dest);
     } else if (entry.isSymbolicLink()) {
       continue;
     } else if (entry.isFile()) {
       if (entry.name === "template.json") continue;
-      await fs29.promises.copyFile(src, dest);
+      await fs31.promises.copyFile(src, dest);
     }
   }
 }
@@ -4225,9 +4402,9 @@ async function normalizeJson5ToJson(projectDir, logger) {
   const stack = [projectDir];
   while (stack.length > 0) {
     const currentDir = stack.pop();
-    const entries = await fs29.promises.readdir(currentDir, { withFileTypes: true });
+    const entries = await fs31.promises.readdir(currentDir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path28.join(currentDir, entry.name);
+      const fullPath = path30.join(currentDir, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
         stack.push(fullPath);
@@ -4249,23 +4426,23 @@ function toJavaPropertiesPath(p) {
 function createOrUpdateLocalProperties(projectDir, sdkDir) {
   const content = `sdk.dir=${toJavaPropertiesPath(sdkDir)}
 `;
-  fs29.writeFileSync(path28.join(projectDir, "local.properties"), content, "utf8");
+  fs31.writeFileSync(path30.join(projectDir, "local.properties"), content, "utf8");
 }
 function renameIfExists(fromPath, toPath) {
-  if (fs29.existsSync(fromPath) && fromPath !== toPath) {
-    fs29.renameSync(fromPath, toPath);
+  if (fs31.existsSync(fromPath) && fromPath !== toPath) {
+    fs31.renameSync(fromPath, toPath);
   }
 }
 function updateTemplateConfigs(projectDir, args, sdkBaseDir) {
-  const appJsonPath = path28.join(projectDir, "AppScope", "app.json5");
-  if (fs29.existsSync(appJsonPath)) {
+  const appJsonPath = path30.join(projectDir, "AppScope", "app.json5");
+  if (fs31.existsSync(appJsonPath)) {
     const appJson = readJson5File(appJsonPath);
     appJson.app = appJson.app ?? {};
     appJson.app.bundleName = args.bundleName;
     writeJson5File(appJsonPath, appJson);
   }
-  const stringsPath = path28.join(projectDir, "AppScope", "resources", "base", "element", "string.json");
-  if (fs29.existsSync(stringsPath)) {
+  const stringsPath = path30.join(projectDir, "AppScope", "resources", "base", "element", "string.json");
+  if (fs31.existsSync(stringsPath)) {
     const strings = readJsonFile(stringsPath);
     if (Array.isArray(strings.string)) {
       const appName = strings.string.find((s) => s.name === "app_name");
@@ -4273,8 +4450,8 @@ function updateTemplateConfigs(projectDir, args, sdkBaseDir) {
     }
     writeJsonFile(stringsPath, strings);
   }
-  const buildProfilePath = path28.join(projectDir, "build-profile.json5");
-  if (fs29.existsSync(buildProfilePath)) {
+  const buildProfilePath = path30.join(projectDir, "build-profile.json5");
+  if (fs31.existsSync(buildProfilePath)) {
     const buildProfile = readJson5File(buildProfilePath);
     buildProfile.app = buildProfile.app ?? {};
     if (Array.isArray(buildProfile.app.products) && buildProfile.app.products.length > 0) {
@@ -4287,23 +4464,23 @@ function updateTemplateConfigs(projectDir, args, sdkBaseDir) {
     }
     writeJson5File(buildProfilePath, buildProfile);
   }
-  const moduleJsonPath = path28.join(projectDir, args.moduleName, "src", "main", "module.json5");
-  if (fs29.existsSync(moduleJsonPath)) {
+  const moduleJsonPath = path30.join(projectDir, args.moduleName, "src", "main", "module.json5");
+  if (fs31.existsSync(moduleJsonPath)) {
     const moduleJson = readJson5File(moduleJsonPath);
     moduleJson.module = moduleJson.module ?? {};
     moduleJson.module.name = args.moduleName;
     writeJson5File(moduleJsonPath, moduleJson);
   }
-  const moduleOhPackagePath = path28.join(projectDir, args.moduleName, "oh-package.json5");
-  if (fs29.existsSync(moduleOhPackagePath)) {
+  const moduleOhPackagePath = path30.join(projectDir, args.moduleName, "oh-package.json5");
+  if (fs31.existsSync(moduleOhPackagePath)) {
     const pkg = readJson5File(moduleOhPackagePath);
     pkg.name = args.moduleName;
     writeJson5File(moduleOhPackagePath, pkg);
   }
-  const vscodeDir = path28.join(projectDir, ".vscode");
-  fs29.mkdirSync(vscodeDir, { recursive: true });
+  const vscodeDir = path30.join(projectDir, ".vscode");
+  fs31.mkdirSync(vscodeDir, { recursive: true });
   const hapPath = `${args.moduleName}/build/default/outputs/default/${args.moduleName}-default-signed.hap`;
-  writeJsonFile(path28.join(vscodeDir, "settings.json"), {
+  writeJsonFile(path30.join(vscodeDir, "settings.json"), {
     "oniro.hapPath": hapPath,
     "files.associations": { "*.json5": "jsonc" }
   });
@@ -4320,7 +4497,7 @@ async function createScaffold(opts) {
   if (!opts.location || !await pathExists(opts.location)) {
     throw new OniroError(`Location does not exist: ${opts.location}`);
   }
-  const templateDir = path28.join(opts.templateRoot, opts.templateId);
+  const templateDir = path30.join(opts.templateRoot, opts.templateId);
   if (!await pathExists(templateDir)) {
     throw new OniroError(`Template not found: ${templateDir}`);
   }
@@ -4355,17 +4532,17 @@ async function createScaffold(opts) {
       }
     }
   }
-  const projectDir = path28.join(opts.location, opts.projectName);
+  const projectDir = path30.join(opts.location, opts.projectName);
   if (await pathExists(projectDir)) {
     if (!opts.overwrite) {
       throw new OniroError(`Destination already exists: ${projectDir}. Pass overwrite: true to replace it.`);
     }
-    await fs29.promises.rm(projectDir, { recursive: true, force: true });
+    await fs31.promises.rm(projectDir, { recursive: true, force: true });
   }
   logger.info(`[create] Scaffolding ${opts.templateId} at ${projectDir}`);
   await copyDirRecursive(templateDir, projectDir);
   if (moduleName !== defaultModuleName) {
-    renameIfExists(path28.join(projectDir, defaultModuleName), path28.join(projectDir, moduleName));
+    renameIfExists(path30.join(projectDir, defaultModuleName), path30.join(projectDir, moduleName));
   }
   updateTemplateConfigs(
     projectDir,
@@ -4382,11 +4559,11 @@ async function createScaffold(opts) {
 }
 
 // src/project/listModules.ts
-import * as fs30 from "fs";
-import * as path29 from "path";
+import * as fs32 from "fs";
+import * as path31 from "path";
 function listModules(opts) {
-  const buildProfile = path29.join(opts.projectDir, "build-profile.json5");
-  if (!fs30.existsSync(buildProfile)) {
+  const buildProfile = path31.join(opts.projectDir, "build-profile.json5");
+  if (!fs32.existsSync(buildProfile)) {
     throw new OniroError(`build-profile.json5 not found at ${buildProfile}`);
   }
   const parsed = readJson5File(buildProfile);
@@ -4398,12 +4575,12 @@ function listModules(opts) {
 }
 
 // src/project/abilities.ts
-import * as fs31 from "fs";
-import * as path30 from "path";
+import * as fs33 from "fs";
+import * as path32 from "path";
 function listAbilities(opts) {
   const moduleName = opts.moduleName ?? "entry";
-  const moduleJsonPath = path30.join(opts.projectDir, moduleName, "src", "main", "module.json5");
-  if (!fs31.existsSync(moduleJsonPath)) {
+  const moduleJsonPath = path32.join(opts.projectDir, moduleName, "src", "main", "module.json5");
+  if (!fs33.existsSync(moduleJsonPath)) {
     throw new OniroError(`Could not find module.json5 at ${moduleJsonPath}`);
   }
   const parsed = readJson5File(moduleJsonPath);
@@ -4411,12 +4588,12 @@ function listAbilities(opts) {
 }
 
 // src/project/prepareSigning.ts
-import * as fs32 from "fs";
-import * as path31 from "path";
+import * as fs34 from "fs";
+import * as path33 from "path";
 function hasSigningArtifacts(dir) {
-  if (!fs32.existsSync(path31.join(dir, "signatures"))) return false;
-  const buildProfile = path31.join(dir, "build-profile.json5");
-  if (!fs32.existsSync(buildProfile)) return false;
+  if (!fs34.existsSync(path33.join(dir, "signatures"))) return false;
+  const buildProfile = path33.join(dir, "build-profile.json5");
+  if (!fs34.existsSync(buildProfile)) return false;
   try {
     const parsed = readJson5File(buildProfile);
     return Array.isArray(parsed.app?.signingConfigs) && parsed.app.signingConfigs.length > 0;
@@ -4495,7 +4672,6 @@ async function getDeviceInfo(opts) {
 }
 
 // src/install/diffHapAssets.ts
-import StreamZip2 from "node-stream-zip";
 function diffEntryNames(installed, next) {
   const installedSet = new Set(installed);
   const nextSet = new Set(next);
@@ -4504,14 +4680,11 @@ function diffEntryNames(installed, next) {
     removedAssetPaths: [...installedSet].filter((n) => !nextSet.has(n)).sort()
   };
 }
-async function listFileEntries(hapPath) {
-  const zip = new StreamZip2.async({ file: hapPath });
-  try {
-    const entries = await zip.entries();
-    return Object.values(entries).filter((e) => !e.isDirectory).map((e) => e.name);
-  } finally {
-    await zip.close();
-  }
+function listFileEntries(hapPath) {
+  return withHapZip(
+    hapPath,
+    (zip) => Object.values(zip.entries()).filter((e) => !e.isDirectory).map((e) => e.name)
+  );
 }
 async function diffHapAssets(opts) {
   const [installed, next] = await Promise.all([listFileEntries(opts.installedHap), listFileEntries(opts.newHap)]);
@@ -4519,8 +4692,8 @@ async function diffHapAssets(opts) {
 }
 
 // src/install/apply.ts
-import * as fs33 from "fs";
-import * as path32 from "path";
+import * as fs35 from "fs";
+import * as path34 from "path";
 
 // src/install/hapBundleName.ts
 function bundleNameFromHapConfig(text) {
@@ -4558,7 +4731,7 @@ async function pidOf(config, bundle, deviceSerial) {
 async function resolveHap(opts, logger) {
   let hap;
   if (opts.hapPath) {
-    const hapPath = !path32.isAbsolute(opts.hapPath) && opts.projectDir ? path32.join(opts.projectDir, opts.hapPath) : opts.hapPath;
+    const hapPath = !path34.isAbsolute(opts.hapPath) && opts.projectDir ? path34.join(opts.projectDir, opts.hapPath) : opts.hapPath;
     hap = existingHapOrUnsigned(hapPath);
     if (!hap) throw new OniroError(`HAP not found at ${hapPath}.`);
   } else {
@@ -4567,7 +4740,7 @@ async function resolveHap(opts, logger) {
     if (!picked) throw new OniroError(`No HAP found${opts.module ? ` for module ${opts.module}` : ""}. Build first.`);
     hap = { path: picked.path, fallback: !picked.signed };
   }
-  if (hap.fallback) logger.warn(`No signed HAP found; installing the unsigned ${path32.basename(hap.path)}.`);
+  if (hap.fallback) logger.warn(`No signed HAP found; installing the unsigned ${path34.basename(hap.path)}.`);
   return hap;
 }
 async function applyChanges(opts) {
@@ -4583,12 +4756,12 @@ async function applyChanges(opts) {
   });
   if (hapBundle && hapBundle !== bundle) {
     throw new OniroError(
-      `${path32.basename(hapPath)} (${hapPath}) is bundle ${hapBundle}, not ${bundle}, so installing it would not update ${bundle}. Choose the HAP explicitly, or name ${hapBundle} as the bundle if it is the app to update.`
+      `${path34.basename(hapPath)} (${hapPath}) is bundle ${hapBundle}, not ${bundle}, so installing it would not update ${bundle}. Choose the HAP explicitly, or name ${hapBundle} as the bundle if it is the app to update.`
     );
   }
   logger.info(`installing ${hapPath}`);
   let assetsChanged = false;
-  if (opts.installedHapPath && fs33.existsSync(opts.installedHapPath)) {
+  if (opts.installedHapPath && fs35.existsSync(opts.installedHapPath)) {
     try {
       const diff = await diffHapAssets({ installedHap: opts.installedHapPath, newHap: hapPath });
       assetsChanged = diff.addedAssetPaths.length > 0 || diff.removedAssetPaths.length > 0;
@@ -4621,7 +4794,7 @@ async function applyChanges(opts) {
   }
   if (!await isBundleInstalled({ config, bundle, deviceSerial })) {
     throw new OniroError(
-      `hdc reported ${path32.basename(hapPath)} as installed, but bm dump does not list ${bundle}. Check that the HAP was built from this project (its bundleName must match).`
+      `hdc reported ${path34.basename(hapPath)} as installed, but bm dump does not list ${bundle}. Check that the HAP was built from this project (its bundleName must match).`
     );
   }
   let postInstallPid = await pidOf(config, bundle, deviceSerial);
@@ -4698,10 +4871,10 @@ var AUTH_PATHS = {
 };
 
 // src/harmonyos/auth/tokenStore.ts
-import * as fs34 from "fs";
-import * as os11 from "os";
-import * as path33 from "path";
-import * as crypto3 from "crypto";
+import * as fs36 from "fs";
+import * as os12 from "os";
+import * as path35 from "path";
+import * as crypto4 from "crypto";
 var ALGORITHM = "aes-256-gcm";
 var KEY_LENGTH = 32;
 var IV_LENGTH = 12;
@@ -4710,8 +4883,8 @@ var KEY_FILE = "kek.bin";
 var DIR_MODE = 448;
 var FILE_MODE = 384;
 function encrypt2(key, plaintext) {
-  const iv = crypto3.randomBytes(IV_LENGTH);
-  const cipher = crypto3.createCipheriv(ALGORITHM, key, iv);
+  const iv = crypto4.randomBytes(IV_LENGTH);
+  const cipher = crypto4.createCipheriv(ALGORITHM, key, iv);
   const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   return {
     version: 1,
@@ -4722,7 +4895,7 @@ function encrypt2(key, plaintext) {
   };
 }
 function decrypt2(key, blob) {
-  const decipher = crypto3.createDecipheriv(ALGORITHM, key, Buffer.from(blob.iv, "base64"));
+  const decipher = crypto4.createDecipheriv(ALGORITHM, key, Buffer.from(blob.iv, "base64"));
   decipher.setAuthTag(Buffer.from(blob.authTag, "base64"));
   return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "base64")), decipher.final()]);
 }
@@ -4736,7 +4909,7 @@ function permissionHint(dir) {
 }
 function ensureDir(dir) {
   try {
-    fs34.mkdirSync(dir, { recursive: true, mode: DIR_MODE });
+    fs36.mkdirSync(dir, { recursive: true, mode: DIR_MODE });
   } catch (err) {
     if (err.code === "EACCES") {
       throw new OniroError(permissionHint(dir), err);
@@ -4747,17 +4920,17 @@ function ensureDir(dir) {
 function createTokenStore(opts) {
   const logger = opts.logger ?? noopLogger;
   const authDir = opts.config.get("harmonyosAuthDir", defaultPaths.harmonyosAuthDir());
-  const tokenPath = path33.join(authDir, TOKEN_FILE);
-  const keyPath = path33.join(os11.homedir(), ".local", "share", "oniro-app", "keys", KEY_FILE);
+  const tokenPath = path35.join(authDir, TOKEN_FILE);
+  const keyPath = path35.join(os12.homedir(), ".local", "share", "oniro-app", "keys", KEY_FILE);
   function loadOrCreateKey() {
-    if (fs34.existsSync(keyPath)) {
-      const existing = fs34.readFileSync(keyPath);
+    if (fs36.existsSync(keyPath)) {
+      const existing = fs36.readFileSync(keyPath);
       if (existing.length === KEY_LENGTH) return existing;
       logger.warn("[harmonyos] The token key file was malformed; regenerating (you will need to log in again).");
     }
-    ensureDir(path33.dirname(keyPath));
-    const key = crypto3.randomBytes(KEY_LENGTH);
-    fs34.writeFileSync(keyPath, key, { mode: FILE_MODE });
+    ensureDir(path35.dirname(keyPath));
+    const key = crypto4.randomBytes(KEY_LENGTH);
+    fs36.writeFileSync(keyPath, key, { mode: FILE_MODE });
     return key;
   }
   return {
@@ -4767,12 +4940,12 @@ function createTokenStore(opts) {
       const payload = Buffer.from(JSON.stringify(session), "utf8");
       const blob = encrypt2(loadOrCreateKey(), payload);
       ensureDir(authDir);
-      fs34.writeFileSync(tokenPath, JSON.stringify(blob, null, 2), { mode: FILE_MODE });
+      fs36.writeFileSync(tokenPath, JSON.stringify(blob, null, 2), { mode: FILE_MODE });
     },
     load() {
-      if (!fs34.existsSync(tokenPath)) return null;
+      if (!fs36.existsSync(tokenPath)) return null;
       try {
-        const blob = JSON.parse(fs34.readFileSync(tokenPath, "utf8"));
+        const blob = JSON.parse(fs36.readFileSync(tokenPath, "utf8"));
         if (!isEncryptedBlob(blob)) return null;
         const { jwtToken, siteId } = JSON.parse(decrypt2(loadOrCreateKey(), blob).toString("utf8"));
         return typeof jwtToken === "string" && jwtToken && typeof siteId === "string" ? { jwtToken, siteId } : null;
@@ -4784,7 +4957,7 @@ function createTokenStore(opts) {
         }
         logger.debug(`[harmonyos] Discarding unreadable token at ${tokenPath}.`);
         try {
-          fs34.rmSync(tokenPath, { force: true });
+          fs36.rmSync(tokenPath, { force: true });
         } catch {
         }
         return null;
@@ -4792,7 +4965,7 @@ function createTokenStore(opts) {
     },
     clear() {
       try {
-        fs34.rmSync(tokenPath, { force: true });
+        fs36.rmSync(tokenPath, { force: true });
       } catch (err) {
         throw new OniroError(`Failed to remove ${tokenPath}.`, err);
       }
@@ -4801,7 +4974,7 @@ function createTokenStore(opts) {
 }
 
 // src/harmonyos/auth/session.ts
-import * as crypto5 from "crypto";
+import * as crypto6 from "crypto";
 
 // src/harmonyos/http.ts
 import { EnvHttpProxyAgent, fetch } from "undici";
@@ -4892,13 +5065,13 @@ function createHttpClient(opts = {}) {
 
 // src/harmonyos/auth/callbackServer.ts
 import * as http2 from "http";
-import * as crypto4 from "crypto";
+import * as crypto5 from "crypto";
 var CALLBACK_PATH = "/callback";
 var MAX_BODY_BYTES = 65536;
 function codeMatches(code, secret) {
   const a = Buffer.from(code ?? "", "utf8");
   const b = Buffer.from(secret, "utf8");
-  return a.length === b.length && crypto4.timingSafeEqual(a, b);
+  return a.length === b.length && crypto5.timingSafeEqual(a, b);
 }
 function isQuit(quit) {
   return quit === "true" || quit === "access_denied" || quit === "quit";
@@ -4906,8 +5079,8 @@ function isQuit(quit) {
 async function startCallbackServer(opts) {
   let resolveCallback;
   let rejectCallback;
-  const callback = new Promise((resolve7, reject) => {
-    resolveCallback = resolve7;
+  const callback = new Promise((resolve9, reject) => {
+    resolveCallback = resolve9;
     rejectCallback = reject;
   });
   callback.catch(() => {
@@ -4966,9 +5139,9 @@ async function startCallbackServer(opts) {
     }
   });
   server.keepAliveTimeout = 1;
-  await new Promise((resolve7, reject) => {
+  await new Promise((resolve9, reject) => {
     server.once("error", (err) => reject(new OniroError("Failed to start the local login callback server.", err)));
-    server.listen(0, "127.0.0.1", resolve7);
+    server.listen(0, "127.0.0.1", resolve9);
   });
   const port = server.address().port;
   return {
@@ -4984,12 +5157,12 @@ async function startCallbackServer(opts) {
       return Promise.race([callback, timeout]).finally(() => clearTimeout(timer));
     },
     stop() {
-      return new Promise((resolve7) => {
+      return new Promise((resolve9) => {
         server.closeAllConnections?.();
-        const timer = setTimeout(resolve7, 100);
+        const timer = setTimeout(resolve9, 100);
         server.close(() => {
           clearTimeout(timer);
-          resolve7();
+          resolve9();
         });
       });
     }
@@ -5021,11 +5194,11 @@ function openBrowser(url) {
     windowsHide: true
   });
   child.unref();
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     child.on("error", (err) => reject(new OniroError(`Failed to open a browser (${command}).`, err)));
     child.on(
       "exit",
-      (code) => code === 0 ? resolve7() : reject(new OniroError(`Browser launcher '${command}' exited with code ${code}.`))
+      (code) => code === 0 ? resolve9() : reject(new OniroError(`Browser launcher '${command}' exited with code ${code}.`))
     );
   });
 }
@@ -5107,7 +5280,7 @@ function createHarmonyOsSession(opts) {
     getDeveloperAgreement,
     async login(o = {}) {
       const start = HUAWEI_SITES.CN.loginUrl;
-      const clientSecret = crypto5.randomUUID().replace(/-/g, "");
+      const clientSecret = crypto6.randomUUID().replace(/-/g, "");
       const server = await startCallbackServer({
         clientSecret,
         baseUrl: start,
@@ -5273,7 +5446,7 @@ function mapAgcError(operation, statusCode, reasonPhrase, body) {
 }
 
 // src/harmonyos/signing/profile.ts
-import * as fs35 from "fs";
+import * as fs37 from "fs";
 import { X509Certificate } from "crypto";
 import forge from "node-forge";
 function extractProfileJson(buffer) {
@@ -5305,7 +5478,7 @@ function extractProfileJson(buffer) {
 function readProvisionProfile(profilePath) {
   let raw;
   try {
-    const json = extractProfileJson(fs35.readFileSync(profilePath));
+    const json = extractProfileJson(fs37.readFileSync(profilePath));
     if (!json) return null;
     raw = JSON.parse(json);
   } catch {
@@ -5334,7 +5507,7 @@ function parseCertificate(pem) {
 }
 function keystoreHoldsKey(p12Path, keyAlias, keyPwd, certificate) {
   try {
-    const der = forge.util.createBuffer(fs35.readFileSync(p12Path).toString("binary"));
+    const der = forge.util.createBuffer(fs37.readFileSync(p12Path).toString("binary"));
     const p12 = forge.pkcs12.pkcs12FromAsn1(forge.asn1.fromDer(der), keyPwd);
     const certBag = forge.pki.oids.certBag ?? "1.2.840.113549.1.12.10.1.3";
     const wanted = certificate.publicKey.export({ type: "spki", format: "der" });
@@ -5350,7 +5523,7 @@ function keystoreHoldsKey(p12Path, keyAlias, keyPwd, certificate) {
   }
 }
 function verifySigningMaterial(opts) {
-  const pems = fs35.readFileSync(opts.cerPath, "utf8").match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+  const pems = fs37.readFileSync(opts.cerPath, "utf8").match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
   const chain = (pems ?? []).map(parseCertificate);
   const leaf = chain.find((c) => !c.ca) ?? chain.at(-1);
   if (!leaf) throw new AgcError(SIGNING_ERRORS.CERT_INVALID);
@@ -5368,15 +5541,15 @@ function verifySigningMaterial(opts) {
 }
 
 // src/harmonyos/signing/autoSign.ts
-import * as crypto9 from "crypto";
-import * as fs40 from "fs";
-import * as path39 from "path";
+import * as crypto10 from "crypto";
+import * as fs42 from "fs";
+import * as path41 from "path";
 import JSON57 from "json5";
 
 // src/harmonyos/signing/agc.ts
-import * as crypto6 from "crypto";
-import * as fs36 from "fs";
-import * as path34 from "path";
+import * as crypto7 from "crypto";
+import * as fs38 from "fs";
+import * as path36 from "path";
 var ENDPOINTS = {
   CERT_LIST: "/api/cps/harmony-cert-manage/v1/cert/list",
   CERT_ADD: "/api/cps/harmony-cert-manage/v1/cert/add",
@@ -5424,7 +5597,7 @@ function createAgcClient(http3, auth) {
       }
     },
     async addDevice(udid, deviceKind) {
-      const deviceName = `oniro_app_device_${crypto6.randomBytes(4).toString("hex")}`;
+      const deviceName = `oniro_app_device_${crypto7.randomBytes(4).toString("hex")}`;
       await call("device", "post", ENDPOINTS.DEVICE_ADD, {
         body: { deviceName, udid, deviceType: String(DEVICE_TYPE_CODES[deviceKind] ?? DEVICE_TYPE_CODES.phone) }
       });
@@ -5458,12 +5631,12 @@ function createAgcClient(http3, auth) {
       const target = urlsInfo?.[0];
       if (!target) throw mapAgcError(operation, 200, "", "");
       const buffer = await http3.getBinary(target.newUrl, { timeoutMs: 6e4 });
-      const actual = crypto6.createHash("sha256").update(buffer).digest("hex");
+      const actual = crypto7.createHash("sha256").update(buffer).digest("hex");
       if (target.sha256 && actual !== target.sha256.toLowerCase()) {
         throw new ChecksumMismatchError(target.sha256, actual);
       }
-      fs36.mkdirSync(path34.dirname(dest), { recursive: true, mode: 448 });
-      fs36.writeFileSync(dest, buffer, { mode: 384 });
+      fs38.mkdirSync(path36.dirname(dest), { recursive: true, mode: 448 });
+      fs38.writeFileSync(dest, buffer, { mode: 384 });
     }
   };
 }
@@ -5518,23 +5691,23 @@ async function registerDevices(agc, connected, logger) {
 }
 
 // src/harmonyos/signing/keystore.ts
-import * as crypto7 from "crypto";
-import * as fs38 from "fs";
-import * as path36 from "path";
+import * as crypto8 from "crypto";
+import * as fs40 from "fs";
+import * as path38 from "path";
 
 // src/harmonyos/java.ts
-import * as fs37 from "fs";
-import * as path35 from "path";
+import * as fs39 from "fs";
+import * as path37 from "path";
 var JAVA_BIN = process.platform === "win32" ? "java.exe" : "java";
 function findJava(sdk, env = process.env) {
   const candidates = [
-    env.JAVA_HOME && path35.join(env.JAVA_HOME, "bin", JAVA_BIN),
-    sdk && path35.join(sdk.installRoot, "jbr", "bin", JAVA_BIN),
+    env.JAVA_HOME && path37.join(env.JAVA_HOME, "bin", JAVA_BIN),
+    sdk && path37.join(sdk.installRoot, "jbr", "bin", JAVA_BIN),
     // macOS: the JBR is itself a bundle inside Studio's Contents.
-    sdk && path35.join(sdk.installRoot, "jbr", "Contents", "Home", "bin", JAVA_BIN),
-    ...(env.PATH ?? "").split(path35.delimiter).map((dir) => dir && path35.join(dir, JAVA_BIN))
+    sdk && path37.join(sdk.installRoot, "jbr", "Contents", "Home", "bin", JAVA_BIN),
+    ...(env.PATH ?? "").split(path37.delimiter).map((dir) => dir && path37.join(dir, JAVA_BIN))
   ];
-  const found = candidates.find((c) => !!c && fs37.existsSync(c));
+  const found = candidates.find((c) => !!c && fs39.existsSync(c));
   if (found) return found;
   throw new OniroError(
     "No Java runtime found. HarmonyOS signing runs the SDK's hap-sign-tool.jar, which needs one: install a JDK and set JAVA_HOME, or install DevEco Studio, whose bundled runtime is used automatically."
@@ -5547,49 +5720,77 @@ var SIGN_ALG = "SHA256withECDSA";
 function redactArgs(args) {
   return args.map((arg, i) => args[i - 1] === "-keyPwd" || args[i - 1] === "-keystorePwd" ? "******" : arg);
 }
-async function generateKeystoreAndCsr(opts) {
-  const jar = path36.join(opts.sdk.sdkPath, "default", "openharmony", "toolchains", "lib", "hap-sign-tool.jar");
-  if (!fs38.existsSync(jar)) {
+function hapSignToolJar(sdk) {
+  const jar = path38.join(sdk.sdkPath, "default", "openharmony", "toolchains", "lib", "hap-sign-tool.jar");
+  if (!fs40.existsSync(jar)) {
     throw new OniroError(`hap-sign-tool.jar not found at ${jar}; the HarmonyOS SDK looks incomplete.`);
   }
+  return jar;
+}
+async function runHapSignTool(opts) {
+  const jar = hapSignToolJar(opts.sdk);
   const java = findJava(opts.sdk);
-  const keyPwd = crypto7.randomBytes(12).toString("base64url").replaceAll(/[-_]/g, "");
-  fs38.mkdirSync(path36.dirname(opts.p12Path), { recursive: true, mode: 448 });
-  const run = async (what, args) => {
-    const argv = ["-jar", jar, ...args, "-keyAlias", KEY_ALIAS, "-keystoreFile", opts.p12Path, "-keystorePwd", keyPwd, "-keyPwd", keyPwd];
-    opts.logger.debug(`[harmonyos] ${java} ${redactArgs(argv).join(" ")}`);
-    const result = await runProcess({ command: java, args: argv, timeoutMs: 12e4, logger: opts.logger });
-    if (result.code !== 0) {
-      const detail = (result.stderr || result.stdout || "").trim();
-      throw new OniroError(`hap-sign-tool failed to ${what} (exit ${result.code}).${detail ? `
+  const argv = ["-jar", jar, ...opts.args, "-keyAlias", KEY_ALIAS, "-keystoreFile", opts.p12Path, "-keystorePwd", opts.keyPwd, "-keyPwd", opts.keyPwd];
+  opts.logger.debug(`[harmonyos] ${java} ${redactArgs(argv).join(" ")}`);
+  const result = await runProcess({ command: java, args: argv, timeoutMs: 12e4, logger: opts.logger });
+  if (result.code !== 0) {
+    const detail = (result.stderr || result.stdout || "").trim();
+    throw new OniroError(`hap-sign-tool failed to ${opts.what} (exit ${result.code}).${detail ? `
 ${detail}` : ""}`);
-    }
-  };
+  }
+}
+async function generateKeystoreAndCsr(opts) {
+  hapSignToolJar(opts.sdk);
+  findJava(opts.sdk);
+  const keyPwd = crypto8.randomBytes(12).toString("base64url").replaceAll(/[-_]/g, "");
+  fs40.mkdirSync(path38.dirname(opts.p12Path), { recursive: true, mode: 448 });
+  const run = (what, args) => runHapSignTool({ ...opts, what, args, keyPwd });
   opts.logger.info("[harmonyos] Generating the local keystore and certificate signing request...");
   await run("generate the key pair", ["generate-keypair", "-keyAlg", "ECC", "-keySize", "NIST-P-256"]);
   await run("generate the CSR", ["generate-csr", "-subject", "CN=DebugKey", "-signAlg", SIGN_ALG, "-outFile", opts.csrPath]);
-  return { keyPwd, csr: fs38.readFileSync(opts.csrPath, "utf8") };
+  return { keyPwd, csr: fs40.readFileSync(opts.csrPath, "utf8") };
+}
+async function signHapFile(opts) {
+  await runHapSignTool({
+    ...opts,
+    what: `sign ${opts.inFile}`,
+    args: [
+      "sign-app",
+      "-mode",
+      "localSign",
+      "-signAlg",
+      SIGN_ALG,
+      "-appCertFile",
+      opts.cerPath,
+      "-profileFile",
+      opts.profilePath,
+      "-inFile",
+      opts.inFile,
+      "-outFile",
+      opts.outFile
+    ]
+  });
 }
 
 // src/harmonyos/signing/paths.ts
-import * as crypto8 from "crypto";
-import * as path37 from "path";
+import * as crypto9 from "crypto";
+import * as path39 from "path";
 function sanitizeNamePart(raw) {
   const safe = (raw?.trim() ?? "").replace(/[\\/:*?"<>|=.-]+/g, "_");
   return safe.slice(0, 64) || "default";
 }
 function resolveSigningMaterialPaths(config, productName, projectRoot) {
-  const hash = crypto8.createHash("sha256").update(projectRoot, "utf8").digest("base64url").replaceAll(/[-_]/g, "");
-  const base = path37.join(
+  const hash = crypto9.createHash("sha256").update(projectRoot, "utf8").digest("base64url").replaceAll(/[-_]/g, "");
+  const base = path39.join(
     config.get("harmonyosSigningDir", defaultPaths.harmonyosSigningDir()),
-    `${sanitizeNamePart(productName)}_${path37.basename(projectRoot)}_${hash}=`
+    `${sanitizeNamePart(productName)}_${path39.basename(projectRoot)}_${hash}=`
   );
   return { p12Path: `${base}.p12`, csrPath: `${base}.csr`, cerPath: `${base}.cer`, profilePath: `${base}.p7b` };
 }
 
 // src/harmonyos/signing/project.ts
-import * as fs39 from "fs";
-import * as path38 from "path";
+import * as fs41 from "fs";
+import * as path40 from "path";
 import JSON56 from "json5";
 
 // src/harmonyos/signing/aclPermissionList.ts
@@ -5657,9 +5858,9 @@ var ACL_PERMISSIONS = /* @__PURE__ */ new Set([
 
 // src/harmonyos/signing/project.ts
 function readRequestedPermissions(moduleConfigPath) {
-  if (!fs39.existsSync(moduleConfigPath)) return [];
+  if (!fs41.existsSync(moduleConfigPath)) return [];
   try {
-    const parsed = JSON56.parse(fs39.readFileSync(moduleConfigPath, "utf-8"));
+    const parsed = JSON56.parse(fs41.readFileSync(moduleConfigPath, "utf-8"));
     return (parsed.module?.requestPermissions ?? []).map((p) => p?.name).filter((n) => typeof n === "string" && n.length > 0);
   } catch {
     return [];
@@ -5668,32 +5869,38 @@ function readRequestedPermissions(moduleConfigPath) {
 function collectAclPermissions(projectDir, logger = noopLogger) {
   const requested = /* @__PURE__ */ new Set();
   for (const module of listModules({ projectDir })) {
-    const moduleRoot = path38.resolve(projectDir, module.srcPath);
+    const moduleRoot = path40.resolve(projectDir, module.srcPath);
     for (const sourceSet of ["main", "ohosTest"]) {
       for (const name of readRequestedPermissions(
-        path38.join(moduleRoot, "src", sourceSet, "module.json5")
+        path40.join(moduleRoot, "src", sourceSet, "module.json5")
       )) {
         requested.add(name);
       }
     }
   }
-  const acls = [...requested].filter((p) => ACL_PERMISSIONS.has(p)).sort();
+  const acls = aclPermissionsAmong(requested);
   if (acls.length > 0) {
     logger.info(`[harmonyos] Project requests ${acls.length} ACL permission(s): ${acls.join(", ")}`);
   }
   return acls;
 }
+function aclPermissionsAmong(names) {
+  return [...new Set(names)].filter((p) => ACL_PERMISSIONS.has(p)).sort();
+}
 
 // src/harmonyos/signing/autoSign.ts
 function shouldRegenerate(input) {
   if (input.force) return "--force was passed";
-  const missing = Object.values(input.paths).find((file) => !fs40.existsSync(file));
+  const missing = Object.values(input.paths).find((file) => !fs42.existsSync(file));
   if (missing) return `${missing} is missing`;
   const config = input.buildProfile.app?.signingConfigs?.find((c) => c.name === input.productName);
   if (config?.type !== "HarmonyOS" || config.material?.profile !== input.paths.profilePath) {
     return "build-profile.json5 has no signingConfig for this material";
   }
-  const profile = readProvisionProfile(input.paths.profilePath);
+  return profileProblem({ ...input, profilePath: input.paths.profilePath });
+}
+function profileProblem(input) {
+  const profile = readProvisionProfile(input.profilePath);
   if (!profile) return "the provisioning profile could not be read";
   if (profile.bundleName !== input.bundleName) return `the profile is for bundle '${profile.bundleName}'`;
   if (profile.developerId && profile.developerId !== input.teamId) {
@@ -5726,25 +5933,23 @@ function writeSigningConfig(opts) {
   for (const product of app.products ?? []) {
     if (product.name === opts.productName) product.signingConfig = opts.productName;
   }
-  fs40.writeFileSync(opts.buildProfilePath, JSON.stringify(opts.buildProfile, null, 2));
+  fs42.writeFileSync(opts.buildProfilePath, JSON.stringify(opts.buildProfile, null, 2));
 }
 async function harmonyOsAutoSign(opts) {
   const logger = opts.logger ?? noopLogger;
   const productName = opts.productName ?? "default";
-  const projectDir = path39.resolve(opts.projectDir);
-  const buildProfilePath = path39.join(projectDir, "build-profile.json5");
+  const projectDir = path41.resolve(opts.projectDir);
+  const buildProfilePath = path41.join(projectDir, "build-profile.json5");
   let buildProfile;
   try {
-    buildProfile = JSON57.parse(fs40.readFileSync(buildProfilePath, "utf-8"));
+    buildProfile = JSON57.parse(fs42.readFileSync(buildProfilePath, "utf-8"));
   } catch (err) {
     throw new OniroError(`Could not read ${buildProfilePath}: ${err.message}`, err);
   }
   const product = buildProfile.app?.products?.find((p) => p.name === productName);
   if (!product) throw new OniroError(`${buildProfilePath} declares no product named '${productName}'.`);
   const bundleName = product.bundleName || getBundleName(projectDir);
-  if (!isValidBundleName(bundleName) || bundleName.split(".").length < 3 || bundleName.length < 7 || bundleName.length > 128) {
-    throw new AgcError(SIGNING_ERRORS.BUNDLE_NAME_INVALID);
-  }
+  assertAgcBundleName(bundleName);
   const sdk = requireHarmonyOsSdk({ config: opts.config, logger });
   const auth = await opts.session.resolveAgcAuth({ teamId: opts.teamId });
   const aclPermissions = collectAclPermissions(projectDir, logger);
@@ -5773,14 +5978,47 @@ async function harmonyOsAutoSign(opts) {
     return result(false);
   }
   logger.info(`[harmonyos] Regenerating signing material: ${reason}.`);
-  const agc = createAgcClient(opts.http ?? createHttpClient({ logger }), auth);
+  const keyPwd = await issueSigningMaterial({
+    agc: createAgcClient(opts.http ?? createHttpClient({ logger }), auth),
+    local,
+    sdk,
+    paths,
+    bundleName,
+    aclPermissions,
+    teamId: auth.teamId,
+    logger
+  });
+  const encryptedPassword = encryptPwd(keyPwd, sharedMaterialDir(paths));
+  writeSigningConfig({ buildProfilePath, buildProfile, productName, paths, encryptedPassword });
+  logger.info(`[harmonyos] Wrote signingConfigs['${productName}'] to ${buildProfilePath}.`);
+  return result(true);
+}
+function assertAgcBundleName(bundleName) {
+  if (!isValidBundleName(bundleName) || bundleName.split(".").length < 3 || bundleName.length < 7 || bundleName.length > 128) {
+    throw new AgcError(SIGNING_ERRORS.BUNDLE_NAME_INVALID);
+  }
+}
+function materialDirFor(paths) {
+  return path41.join(path41.dirname(paths.p12Path), "material");
+}
+function sharedMaterialDir(paths) {
+  const materialDir = materialDirFor(paths);
+  try {
+    getKey(materialDir);
+  } catch {
+    createMaterial(materialDir);
+  }
+  return materialDir;
+}
+async function issueSigningMaterial(opts) {
+  const { agc, local, sdk, paths, logger } = opts;
   const deviceIds = await registerDevices(agc, local.devices, logger);
   if (local.devices.length === 0) {
     const cause = local.skipped.length > 0 ? "No connected device could be registered" : "No device is connected";
     logger.warn(`[harmonyos] ${cause}; the profile will name the ${deviceIds.length} device(s) already registered to this team.`);
   }
-  for (const file of Object.values(paths)) fs40.rmSync(file, { force: true });
-  const certName = `oniro_debug_${auth.teamId.replace(/[\\/.:]/g, "")}.cer`;
+  for (const file of Object.values(paths)) fs42.rmSync(file, { force: true });
+  const certName = `oniro_debug_${opts.teamId.replace(/[\\/.:]/g, "")}.cer`;
   const stale = (await agc.listCertificates()).find((c) => c.certName === certName);
   if (stale) {
     logger.info(`[harmonyos] Replacing the previous '${certName}' certificate in AppGallery Connect...`);
@@ -5794,11 +6032,11 @@ async function harmonyOsAutoSign(opts) {
   await agc.download("cert", cert.certObjectId, paths.cerPath);
   logger.info("[harmonyos] Issuing the debug provisioning profile...");
   const profile = await agc.addDebugProfile({
-    provisionName: `oniro_${crypto9.randomBytes(6).toString("hex")}`,
-    bundleName,
+    provisionName: `oniro_${crypto10.randomBytes(6).toString("hex")}`,
+    bundleName: opts.bundleName,
     certId: cert.id,
     deviceIds,
-    aclPermissions
+    aclPermissions: opts.aclPermissions
   });
   try {
     await agc.download("profile", profile.provisionFileUrl, paths.profilePath);
@@ -5810,22 +6048,86 @@ async function harmonyOsAutoSign(opts) {
   try {
     verifySigningMaterial({ ...paths, keyAlias: KEY_ALIAS, keyPwd });
   } catch (err) {
-    fs40.rmSync(paths.profilePath, { force: true });
+    fs42.rmSync(paths.profilePath, { force: true });
     throw err;
   }
-  const materialDir = path39.join(path39.dirname(paths.p12Path), "material");
+  return keyPwd;
+}
+
+// src/harmonyos/signing/signHap.ts
+import * as fs43 from "fs";
+import * as path42 from "path";
+function resolveHapSigningMaterialPaths(config, bundleName) {
+  const paths = resolveSigningMaterialPaths(config, "hap", bundleName);
+  return { ...paths, pwdPath: paths.p12Path.replace(/\.p12$/, ".pwd") };
+}
+function readStoredPassword(paths) {
   try {
-    getKey(materialDir);
+    return decryptPwd(fs43.readFileSync(paths.pwdPath, "utf8").trim(), materialDirFor(paths));
   } catch {
-    createMaterial(materialDir);
+    return null;
   }
-  writeSigningConfig({ buildProfilePath, buildProfile, productName, paths, encryptedPassword: encryptPwd(keyPwd, materialDir) });
-  logger.info(`[harmonyos] Wrote signingConfigs['${productName}'] to ${buildProfilePath}.`);
-  return result(true);
+}
+async function harmonyOsSignHap(opts) {
+  const logger = opts.logger ?? noopLogger;
+  const hapPath = path42.resolve(opts.hapPath);
+  const outPath = path42.resolve(opts.outPath ?? defaultSignedHapPath(hapPath));
+  const info = await readHapSigningInfo(hapPath);
+  const { bundleName } = info;
+  if (info.compileSdkType === "OpenHarmony") {
+    throw new OniroError(
+      `${hapPath} was built for OpenHarmony, so a HarmonyOS device would not run it; sign it without --harmonyos.`
+    );
+  }
+  assertAgcBundleName(bundleName);
+  const aclPermissions = aclPermissionsAmong(info.requestedPermissions);
+  if (aclPermissions.length > 0) {
+    logger.info(`[harmonyos] HAP requests ${aclPermissions.length} ACL permission(s): ${aclPermissions.join(", ")}`);
+  }
+  const sdk = requireHarmonyOsSdk({ config: opts.config, logger });
+  const auth = await opts.session.resolveAgcAuth({ teamId: opts.teamId });
+  const paths = resolveHapSigningMaterialPaths(opts.config, bundleName);
+  const { pwdPath, ...material } = paths;
+  logger.info(`[harmonyos] Signing ${path42.basename(hapPath)} as ${bundleName} (team ${auth.teamId}).`);
+  const local = await collectLocalDevices(opts.config, logger);
+  let keyPwd = opts.force ? null : readStoredPassword(paths);
+  const missing = Object.values(material).find((file) => !fs43.existsSync(file));
+  const reason = opts.force ? "--force was passed" : missing ? `${missing} is missing` : keyPwd === null ? "the stored keystore password could not be read" : profileProblem({
+    profilePath: material.profilePath,
+    bundleName,
+    teamId: auth.teamId,
+    connectedUdids: local.devices.map((d) => d.udid),
+    aclPermissions
+  });
+  if (!reason && keyPwd !== null) {
+    logger.info("[harmonyos] Reusing the existing signing material, which is still valid.");
+  } else {
+    logger.info(`[harmonyos] Regenerating signing material: ${reason}.`);
+    fs43.rmSync(pwdPath, { force: true });
+    keyPwd = await issueSigningMaterial({
+      agc: createAgcClient(opts.http ?? createHttpClient({ logger }), auth),
+      local,
+      sdk,
+      paths: material,
+      bundleName,
+      aclPermissions,
+      teamId: auth.teamId,
+      logger
+    });
+    fs43.writeFileSync(pwdPath, encryptPwd(keyPwd, sharedMaterialDir(material)), { mode: 384 });
+  }
+  const password = keyPwd;
+  await writeHapAtomically(
+    outPath,
+    (tmpPath) => signHapFile({ sdk, inFile: hapPath, outFile: tmpPath, ...material, keyPwd: password, logger })
+  );
+  const deviceIds = readProvisionProfile(material.profilePath)?.deviceIds ?? [];
+  logger.info(`[harmonyos] Wrote ${outPath}.`);
+  return { bundleName, teamId: auth.teamId, paths: material, regenerated: !!reason, deviceIds, outPath };
 }
 
 // src/index.ts
-var VERSION = "0.15.1";
+var VERSION = "0.16.0";
 export {
   ALL_SDKS,
   APL_VALUES,
@@ -5842,6 +6144,7 @@ export {
   OHOS_DAILY_BUILDS_URL,
   OHOS_URL_BASE,
   OniroError,
+  SIGNED_HAP_CHUNK_SIZE,
   SIGNING_ERRORS,
   SdkNotInstalledError,
   TMP_DIR_HINT,
@@ -5877,6 +6180,7 @@ export {
   dedupEntries,
   defaultContext,
   defaultPaths,
+  defaultSignedHapPath,
   describeLayoutNode,
   detectAaStartFailure,
   detectCmdToolsFlavour,
@@ -5943,6 +6247,7 @@ export {
   getSupportedSdksForUi,
   harmonyOsAutoSign,
   harmonyOsSdkLabelForApi,
+  harmonyOsSignHap,
   hdcClientFailure,
   hdcExec,
   hdcTargetArgs,
@@ -5996,6 +6301,7 @@ export {
   prepareSigning,
   pruneLayout,
   readHapBundleName,
+  readHapSigningInfo,
   readJson5File,
   readJsonFile,
   readProvisionProfile,
@@ -6023,6 +6329,7 @@ export {
   setHilogLevel,
   shell,
   shellChecked,
+  signOpenHarmonyHap,
   spawnCompat,
   startEmulator,
   staticConfig,
@@ -6042,6 +6349,7 @@ export {
   waitForTarget,
   watchLog,
   waypointsToRawEvents,
+  withHapZip,
   withoutWindow,
   writeJson5File,
   writeJsonFile