akanjs 3.0.0-beta.20 → 3.0.0-beta.21

package/vendor/@akanjs/native/packages/cli/src/lib/iossigning.ts

@@ -0,0 +1,295 @@
+
+
+import { createHash } from "node:crypto";
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import { exec, execOrThrow } from "./exec.ts";
+import { type PlistValue, parsePlist } from "./plist.ts";
+import { SigningError } from "./prepare.ts";
+
+export interface SigningIdentity {
+  /** The certificate's SHA-1, which codesign takes without ambiguity. */
+  sha1: string;
+  /** e.g. "Apple Development: Jane Doe (ABCDE12345)". */
+  name: string;
+}
+
+export type ProfileKind = "development" | "ad-hoc" | "app-store" | "enterprise";
+
+export interface ProvisioningProfile {
+  path: string;
+  name: string;
+  uuid: string;
+  teamId: string;
+  /** application-identifier, e.g. "TEAMID.com.akanjs.sample" or "TEAMID.*". */
+  appId: string;
+  entitlements: Record<string, PlistValue>;
+  expires: Date;
+  kind: ProfileKind;
+  /** Device UDIDs (development and ad-hoc). */
+  devices: string[];
+  /** SHA-1 of the certificates the profile allows to sign. */
+  certificates: string[];
+}
+
+/** Valid code signing identities (`security find-identity -v`: revoked and expired ones are left out). */
+export async function signingIdentities(): Promise<SigningIdentity[]> {
+  const out = (await exec(["security", "find-identity", "-v", "-p", "codesigning"], { echo: false })).stdout;
+  return parseIdentities(out);
+}
+
+export function parseIdentities(out: string): SigningIdentity[] {
+  return [...out.matchAll(/^\s*\d+\)\s+([0-9A-F]{40})\s+"([^"]+)"\s*$/gm)].map((m) => ({ sha1: m[1]!, name: m[2]! }));
+}
+
+/**
+ * The identity to sign with: `wanted` as a SHA-1 or a name (a name two valid certificates share is an
+ * error), else the only valid "Apple Development" (development) or "Apple Distribution" identity.
+ */
+export function pickIdentity(
+  identities: SigningIdentity[],
+  kind: "development" | "distribution",
+  wanted?: string,
+): SigningIdentity {
+  if (wanted) {
+    const matches = identities.filter(
+      (i) => i.sha1 === wanted.toUpperCase() || i.name === wanted || i.name.startsWith(`${wanted} (`),
+    );
+    if (matches.length === 1) return matches[0]!;
+    if (matches.length > 1)
+      throw new SigningError(
+        `several valid identities are called ${JSON.stringify(wanted)}; give its SHA-1 instead (security find-identity -v -p codesigning)`,
+      );
+    throw new SigningError(`no valid code signing identity ${JSON.stringify(wanted)} in the keychain`);
+  }
+  const prefix =
+    kind === "development" ? /^(Apple Development|iPhone Developer):/ : /^(Apple Distribution|iPhone Distribution):/;
+  const candidates = identities.filter((i) => prefix.test(i.name));
+  if (candidates.length === 1) return candidates[0]!;
+  if (candidates.length === 0) {
+    throw new SigningError(
+      `no valid ${kind === "development" ? "Apple Development" : "Apple Distribution"} identity in the keychain: create one in Xcode (Settings → Accounts → Manage Certificates)`,
+    );
+  }
+  throw new SigningError(
+    `several ${kind} identities: choose one (AKAN_NATIVE_IOS_IDENTITY or signing.identity): ${candidates.map((c) => c.name).join(", ")}`,
+  );
+}
+
+/** The folders Xcode and older tools keep provisioning profiles in. */
+export function profileFolders(home = homedir()): string[] {
+  return [
+    join(home, "Library", "Developer", "Xcode", "UserData", "Provisioning Profiles"),
+    join(home, "Library", "MobileDevice", "Provisioning Profiles"),
+  ];
+}
+
+/** Decodes a .mobileprovision (a CMS-signed plist). */
+export async function readProfile(path: string): Promise<ProvisioningProfile> {
+  const dir = mkdtempSync(join(tmpdir(), "akan-native-profile-"));
+  try {
+    const plist = join(dir, "profile.plist");
+    await execOrThrow(["security", "cms", "-D", "-i", path, "-o", plist], { echo: false });
+    
+    return profileFromPlist(path, parsePlist(readFileSync(plist, "utf8")) as Record<string, unknown>);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/** A profile from its decoded plist (parsePlist: data as base64, dates as Date). */
+export function profileFromPlist(path: string, p: Record<string, unknown>): ProvisioningProfile {
+  const entitlements = (p.Entitlements ?? {}) as Record<string, PlistValue>;
+  const devices = (p.ProvisionedDevices as string[] | undefined) ?? [];
+  const kind: ProfileKind =
+    p.ProvisionsAllDevices === true
+      ? "enterprise"
+      : entitlements["get-task-allow"] === true
+        ? "development"
+        : devices.length
+          ? "ad-hoc"
+          : "app-store";
+  return {
+    path,
+    name: String(p.Name ?? ""),
+    uuid: String(p.UUID ?? ""),
+    teamId: String((p.TeamIdentifier as string[] | undefined)?.[0] ?? ""),
+    appId: String(entitlements["application-identifier"] ?? ""),
+    entitlements,
+    expires: p.ExpirationDate instanceof Date ? p.ExpirationDate : new Date(String(p.ExpirationDate ?? 0)),
+    kind,
+    devices,
+    certificates: ((p.DeveloperCertificates as string[] | undefined) ?? []).map((der) =>
+      createHash("sha1").update(Buffer.from(der, "base64")).digest("hex").toUpperCase(),
+    ),
+  };
+}
+
+/** Whether a profile's application-identifier covers the bundle id (exactly, or a wildcard like TEAM.* or TEAM.com.akanjs.*). */
+export function profileCovers(profile: ProvisioningProfile, bundleId: string): "exact" | "wildcard" | null {
+  const id = profile.appId.slice(profile.teamId.length + 1);
+  if (id === bundleId) return "exact";
+  if (id.endsWith("*") && bundleId.startsWith(id.slice(0, -1))) return "wildcard";
+  return null;
+}
+
+/** The profiles in Xcode's folders; unreadable ones are left out. */
+export async function localProfiles(): Promise<ProvisioningProfile[]> {
+  const profiles: ProvisioningProfile[] = [];
+  for (const dir of profileFolders()) {
+    if (!existsSync(dir)) continue;
+    for (const name of readdirSync(dir)) {
+      if (!name.endsWith(".mobileprovision")) continue;
+      const profile = await readProfile(join(dir, name)).catch(() => null);
+      if (profile) profiles.push(profile);
+    }
+  }
+  return profiles;
+}
+
+export interface SigningQuery {
+  bundleId: string;
+  /** development for run and dev; app-store for release, ad-hoc only when asked for. */
+  kinds: ProfileKind[];
+  identityKind: "development" | "distribution";
+  /** Only this team's profiles. */
+  teamId?: string;
+  /** A certificate name or SHA-1: only it. */
+  identity?: string;
+  /** The iPhone the build goes on: development and ad hoc profiles must list it. */
+  device?: { udid: string; name?: string };
+  /** The entitlements the app asks for, as signing with this profile would request them. */
+  entitlementsFor(profile: ProvisioningProfile): Record<string, PlistValue>;
+  now?: Date;
+}
+
+export interface SigningChoice {
+  identity: SigningIdentity;
+  profile: ProvisioningProfile;
+}
+
+const describe = (p: ProvisioningProfile) =>
+  `"${p.name}" (team ${p.teamId}, ${p.kind}, until ${p.expires.toISOString().slice(0, 10)})`;
+
+/**
+ * The identity and profile an iPhone build signs with (D7 step 1: what Xcode made on this Mac;
+ * docs/api.md §3 "Finding the signing"). A profile fits when it covers the bundle id (a wildcard
+ * only when the app asks for neither push nor associated domains), is of the wanted kind, has not
+ * expired, belongs to `teamId` when one is given, lists `device` when it is a development or ad hoc
+ * profile, allows every entitlement the app asks for, and one of its certificates is a valid identity
+ * in the keychain (or the chosen one). Of the fitting ones,
+ * exact bundle ids beat wildcards; then several teams, or several certificates, are not decided
+ * here: the error lists the candidates. One team and one certificate: the profile that expires last
+ * (Xcode makes a new one when it renews).
+ */
+export function chooseSigning(
+  identities: SigningIdentity[],
+  profiles: ProvisioningProfile[],
+  q: SigningQuery,
+): SigningChoice {
+  const now = q.now ?? new Date();
+  const pool = q.identity
+    ? [pickIdentity(identities, q.identityKind, q.identity)]
+    : identities.filter((i) =>
+        (q.identityKind === "development"
+          ? /^(Apple Development|iPhone Developer):/
+          : /^(Apple Distribution|iPhone Distribution):/
+        ).test(i.name),
+      );
+  if (!pool.length) pickIdentity(identities, q.identityKind); 
+  const skipped: string[] = [];
+  const candidates: (SigningChoice & { exact: boolean })[] = [];
+  const device = q.device && `device ${q.device.name ? `"${q.device.name}" ` : ""}(${q.device.udid})`;
+  let onlyDevice = false; 
+  for (const profile of profiles) {
+    const cover = profileCovers(profile, q.bundleId);
+    if (!cover) continue;
+    const why: string[] = [];
+    if (!q.kinds.includes(profile.kind))
+      why.push(`${profile.kind === "development" ? "a" : "an"} ${profile.kind} profile, not ${q.kinds.join(" or ")}`);
+    if (profile.expires.getTime() <= now.getTime()) why.push("expired");
+    if (q.teamId && profile.teamId !== q.teamId) why.push(`team ${profile.teamId}, not ${q.teamId}`);
+    const missesDevice =
+      !!q.device &&
+      (profile.kind === "development" || profile.kind === "ad-hoc") &&
+      !profile.devices.includes(q.device.udid);
+    if (missesDevice) why.push(`it does not include ${device}`);
+    const requested = q.entitlementsFor(profile);
+    if (
+      cover === "wildcard" &&
+      (requested["aps-environment"] !== undefined || requested["com.apple.developer.associated-domains"] !== undefined)
+    ) {
+      why.push("a wildcard profile cannot carry push or associated domains");
+    } else why.push(...entitlementProblems(requested, profile));
+    const allowed = pool.filter((i) => profile.certificates.includes(i.sha1));
+    if (!allowed.length)
+      why.push(
+        q.identity
+          ? `it does not include the certificate of "${pool[0]!.name}"`
+          : "none of its certificates is a valid identity in this keychain",
+      );
+    if (why.length) {
+      if (missesDevice && why.length === 1) onlyDevice = true;
+      skipped.push(`${describe(profile)}: ${why.join("; ")}`);
+      continue;
+    }
+    for (const identity of allowed) candidates.push({ identity, profile, exact: cover === "exact" });
+  }
+  if (!candidates.length) {
+    throw new SigningError(
+      `no ${q.kinds.join(" or ")} provisioning profile fits ${q.bundleId}` +
+        (skipped.length ? "" : " (none on this Mac covers it)") +
+        (onlyDevice
+          ? `. The ${device} is not in the profile: register it (build once for this device in Xcode, or add it on the developer site), then get the profile again.`
+          : `. Create one with Xcode (a project with this bundle id and your team, built once for the device), or pass signing.provisioningProfile.`),
+      skipped,
+    );
+  }
+  const best = candidates.some((c) => c.exact) ? candidates.filter((c) => c.exact) : candidates;
+  const list = () => best.map((c) => `${describe(c.profile)} with ${c.identity.name}`);
+  if (new Set(best.map((c) => c.profile.teamId)).size > 1)
+    throw new SigningError(`profiles of several teams fit ${q.bundleId}: choose one with signing.teamId`, list());
+  if (new Set(best.map((c) => c.identity.sha1)).size > 1)
+    throw new SigningError(
+      `several certificates can sign with the profile for ${q.bundleId}: choose one with signing.identity`,
+      list(),
+    );
+  best.sort((a, b) => b.profile.expires.getTime() - a.profile.expires.getTime());
+  return { identity: best[0]!.identity, profile: best[0]!.profile };
+}
+
+/**
+ * Entitlements the app asks for that the profile does not allow (App Store Connect and the device
+ * refuse such a signature). A profile lists what the App ID has: an array value there is a set of
+ * allowed values, where "*" or "TEAM.*" allows any.
+ */
+export function entitlementProblems(requested: Record<string, PlistValue>, profile: ProvisioningProfile): string[] {
+  const allowed = profile.entitlements;
+  const problems: string[] = [];
+  const matches = (value: PlistValue, pattern: PlistValue) =>
+    pattern === "*" ||
+    value === pattern ||
+    (typeof pattern === "string" &&
+      pattern.endsWith(".*") &&
+      typeof value === "string" &&
+      value.startsWith(pattern.slice(0, -1)));
+  for (const [key, value] of Object.entries(requested)) {
+    if (key === "application-identifier" || key === "com.apple.developer.team-identifier" || key === "get-task-allow")
+      continue;
+    const has = allowed[key];
+    if (has === undefined) {
+      problems.push(`${key}: the profile's App ID does not have this capability`);
+      continue;
+    }
+    if (Array.isArray(value)) {
+      const patterns = Array.isArray(has) ? has : [has];
+      for (const v of value)
+        if (!patterns.some((p) => matches(v, p)))
+          problems.push(`${key}: ${JSON.stringify(v)} is not allowed by the profile (${JSON.stringify(has)})`);
+    } else if (!matches(value, has) && !(typeof has === "boolean" && has === true && value === true)) {
+      problems.push(`${key}: the app asks for ${JSON.stringify(value)}, the profile has ${JSON.stringify(has)}`);
+    }
+  }
+  return problems;
+}

package/vendor/@akanjs/native/packages/cli/src/lib/launch.ts

@@ -0,0 +1,98 @@
+
+
+export interface LaunchOptions {
+  /** Runtime env overrides (dev builds), e.g. { AKAN_NATIVE_PUBLIC_SELFTEST: "1" }. */
+  env: Record<string, string>;
+  /** Do not open windows or steal focus where the platform allows it. */
+  headless: boolean;
+  /** Receives every log line. Default: print it. */
+  onLine?: (line: string) => void;
+}
+
+/** A simulator, emulator or device an app can run on (docs/api.md devices). */
+export interface Device {
+  platform: "ios" | "android";
+  /** A simulator's UDID, a paired iPhone's devicectl id, an adb serial, or the name of an AVD that is not running. */
+  id: string;
+  name: string;
+  kind: "simulator" | "emulator" | "device";
+  /** "26.5" on iOS; "Android 17 (API 37)" for a running Android device, "API 37" for an AVD that is not. */
+  os: string;
+  /**
+   * booted / shutdown (simulators, AVDs), connected (a paired iPhone, an adb device), unavailable (a
+   * paired iPhone out of reach), unpaired (an iPhone this Mac is not paired with), unauthorized (an
+   * Android device that has not allowed USB debugging), offline.
+   */
+  state: "booted" | "shutdown" | "connected" | "unavailable" | "unpaired" | "unauthorized" | "offline";
+}
+
+/** Which device: a name or id as text, or one of these. `{ kind }` takes the first one of the kind, running ones first. */
+export type DeviceSelector = string | { id: string } | { name: string } | { kind: Device["kind"] };
+
+export interface Launched {
+  /** Resolves with the exit code once the app (or log stream) ends. */
+  exited: Promise<number>;
+  stop(): void;
+  /** Where the app runs (iOS and Android). */
+  device?: Device;
+}
+
+/** Splits a byte stream into lines and hands each to `onLine`. */
+export async function pipeLines(
+  stream: ReadableStream<Uint8Array> | null | undefined,
+  onLine: (line: string) => void,
+): Promise<void> {
+  if (!stream) return;
+  const decoder = new TextDecoder();
+  let rest = "";
+  for await (const chunk of stream) {
+    rest += decoder.decode(chunk, { stream: true });
+    let nl = rest.indexOf("\n");
+    while (nl >= 0) {
+      onLine(rest.slice(0, nl).replace(/\r$/, ""));
+      rest = rest.slice(nl + 1);
+      nl = rest.indexOf("\n");
+    }
+  }
+  if (rest) onLine(rest);
+}
+
+export const printLine = (line: string) => console.info(line);
+
+/** AKAN_NATIVE_PUBLIC_* variables of the CLI's own environment. */
+export function envFromProcess(): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (key.startsWith("AKAN_NATIVE_PUBLIC_") && value !== undefined) out[key] = value;
+  }
+  return out;
+}
+
+const STOP_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"] as const;
+
+/**
+ * Calls `handler` once on Ctrl+C, kill or a closed terminal and returns a function that unregisters it.
+ * Spawned children (the app, logcat, simctl log stream, Chrome) outlive a CLI that dies of a signal.
+ */
+export function onStopSignal(handler: () => void): () => void {
+  let fired = false;
+  const once = () => {
+    if (fired) return;
+    fired = true;
+    handler();
+  };
+  for (const signal of STOP_SIGNALS) process.on(signal, once);
+  return () => {
+    for (const signal of STOP_SIGNALS) process.off(signal, once);
+  };
+}
+
+/** Waits for a launched app and stops it when the CLI is interrupted. */
+export async function follow(app: Launched): Promise<number> {
+  const off = onStopSignal(() => app.stop());
+  try {
+    return await app.exited;
+  } finally {
+    off();
+  }
+}

package/vendor/@akanjs/native/packages/cli/src/lib/log.ts

@@ -0,0 +1,105 @@
+
+
+import { AsyncLocalStorage } from "node:async_hooks";
+
+export type LogLevel = "step" | "info" | "ok" | "warn" | "error" | "tool";
+
+export interface LogEvent {
+  level: LogLevel;
+  message: string;
+  /** For "tool": whose output the line is ("web-build", "swiftc", "kotlinc", "cargo" …). */
+  tool?: string;
+  time: number;
+}
+
+export type LogSink = (event: LogEvent) => void;
+
+const sinks = new AsyncLocalStorage<LogSink>();
+
+/** Runs `fn` with its log going to `sink` (none: dropped) instead of the terminal. */
+export function withLogSink<T>(sink: LogSink | undefined, fn: () => T): T {
+  return sinks.run(sink ?? (() => {}), fn);
+}
+
+/** Whether output goes to the terminal (the CLI), not to an API caller's sink. */
+export function isTerminal(): boolean {
+  return sinks.getStore() === undefined;
+}
+
+const color = process.stdout.isTTY && !process.env.NO_COLOR;
+const paint = (code: string) => (text: string) => (color && isTerminal() ? `\x1b[${code}m${text}\x1b[0m` : text);
+
+export const dim = paint("2");
+export const bold = paint("1");
+export const green = paint("32");
+export const yellow = paint("33");
+export const red = paint("31");
+export const cyan = paint("36");
+
+function emit(level: LogLevel, message: string, tool?: string): void {
+  const sink = sinks.getStore();
+  if (sink) {
+    sink({ level, message, ...(tool ? { tool } : {}), time: Date.now() });
+    return;
+  }
+  switch (level) {
+    case "step":
+      console.info(`${cyan("›")} ${message}`);
+      return;
+    case "info":
+      console.info(`  ${message}`);
+      return;
+    case "ok":
+      console.info(`${green("✓")} ${message}`);
+      return;
+    case "warn":
+      console.warn(`${yellow("!")} ${message}`);
+      return;
+    case "error":
+      console.error(`${red("✗")} ${message}`);
+      return;
+    case "tool":
+      console.info(message);
+      return;
+  }
+}
+
+export const log = {
+  step: (text: string) => emit("step", text),
+  info: (text: string) => emit("info", text),
+  ok: (text: string) => emit("ok", text),
+  warn: (text: string) => emit("warn", text),
+  error: (text: string) => emit("error", text),
+  /** A line of a child process's output (web build, compilers) that the terminal would show as is. */
+  tool: (tool: string, line: string) => emit("tool", line, tool),
+};
+
+/** An error whose message is shown to the user without a stack trace. */
+export class CliError extends Error {
+  constructor(
+    message: string,
+    readonly exitCode = 1,
+  ) {
+    super(message);
+    this.name = "CliError";
+  }
+}
+
+/** A required toolchain (SDK, JDK, kotlinc, simulator runtime) is missing (AkanNativeError TOOLCHAIN_MISSING). */
+export class ToolchainError extends CliError {
+  constructor(message: string) {
+    super(message);
+    this.name = "ToolchainError";
+  }
+}
+
+/** A command that failed: its last output lines travel with the error (AkanNativeError.logTail). */
+export class ToolError extends CliError {
+  constructor(
+    message: string,
+    readonly tail: string[],
+  ) {
+    super(message);
+    this.name = "ToolError";
+  }
+}

package/vendor/@akanjs/native/packages/cli/src/lib/manifestmerge.ts

@@ -0,0 +1,107 @@
+
+
+import { attr, parseXml, serializeXml, type XmlElement } from "./xml.ts";
+
+export interface LibraryManifest {
+  /** For messages. */
+  from: string;
+  xml: string;
+}
+
+export interface MergedManifest {
+  /** uses-permission names. */
+  permissions: string[];
+  /** XML at the <manifest> level: permission definitions and one <queries>. */
+  manifestXml: string[];
+  /** XML inside <application>: components and meta-data. */
+  applicationXml: string[];
+  /** Attributes for <application>, e.g. android:appComponentFactory. */
+  applicationAttrs: [string, string][];
+  /** Component classes, for R8 keep rules. */
+  components: string[];
+}
+
+const COMPONENTS = new Set(["activity", "activity-alias", "service", "receiver", "provider"]);
+const KEPT_APPLICATION_ATTRS = ["android:appComponentFactory"];
+
+/** Replaces ${applicationId} and drops tools: attributes, in place, through the whole tree. */
+function clean(element: XmlElement, applicationId: string): XmlElement {
+  element.attrs = element.attrs
+    .filter(([n]) => !n.startsWith("tools:") && n !== "xmlns:tools")
+    .map(([n, v]) => [n, v.replaceAll("${applicationId}", applicationId)]);
+  for (const c of element.children) clean(c, applicationId);
+  return element;
+}
+
+const key = (e: XmlElement) => serializeXml(e);
+
+/** Adds `extra`'s attributes that `target` lacks and its children under the merge rules. */
+function mergeInto(target: XmlElement, extra: XmlElement): void {
+  for (const [n, v] of extra.attrs) if (attr(target, n) === undefined) target.attrs.push([n, v]);
+  for (const child of extra.children) {
+    const name = attr(child, "android:name");
+    const same = target.children.find(
+      (c) =>
+        c.name === child.name &&
+        (child.name === "meta-data" ? attr(c, "android:name") === name : key(c) === key(child)),
+    );
+    if (!same) target.children.push(child);
+  }
+}
+
+export function mergeLibraryManifests(manifests: LibraryManifest[], applicationId: string): MergedManifest {
+  const permissions: string[] = [];
+  const permissionDefs = new Map<string, XmlElement>();
+  const queries: XmlElement = { name: "queries", attrs: [], children: [] };
+  const components = new Map<string, XmlElement>();
+  const metaData = new Map<string, XmlElement>();
+  const other = new Map<string, XmlElement>();
+  const applicationAttrs: [string, string][] = [];
+
+  for (const { from, xml } of manifests) {
+    let root: XmlElement;
+    try {
+      root = clean(parseXml(xml), applicationId);
+    } catch (error) {
+      throw new Error(`${from}: ${(error as Error).message}`);
+    }
+    for (const child of root.children) {
+      const name = attr(child, "android:name");
+      if (child.name === "uses-permission" || child.name === "uses-permission-sdk-23") {
+        if (name && !permissions.includes(name)) permissions.push(name);
+      } else if (child.name === "permission") {
+        if (name && !permissionDefs.has(name)) permissionDefs.set(name, child);
+      } else if (child.name === "queries") {
+        mergeInto(queries, child);
+      } else if (child.name === "application") {
+        for (const a of KEPT_APPLICATION_ATTRS) {
+          const value = attr(child, a);
+          if (value && !applicationAttrs.some(([n]) => n === a)) applicationAttrs.push([a, value]);
+        }
+        for (const item of child.children) {
+          const itemName = attr(item, "android:name");
+          if (COMPONENTS.has(item.name) && itemName) {
+            const id = `${item.name} ${itemName}`;
+            const existing = components.get(id);
+            if (existing) mergeInto(existing, item);
+            else components.set(id, item);
+          } else if (item.name === "meta-data" && itemName) {
+            if (!metaData.has(itemName)) metaData.set(itemName, item);
+          } else if (!other.has(key(item))) other.set(key(item), item);
+        }
+      }
+    }
+  }
+
+  const indent = (e: XmlElement, depth: string) => serializeXml(e, "").replaceAll("\n", `\n${depth}`);
+  return {
+    permissions,
+    manifestXml: [
+      ...[...permissionDefs.values()].map((e) => indent(e, "    ")),
+      ...(queries.children.length ? [indent(queries, "    ")] : []),
+    ],
+    applicationXml: [...components.values(), ...metaData.values(), ...other.values()].map((e) => indent(e, "        ")),
+    applicationAttrs,
+    components: [...components.values()].map((e) => attr(e, "android:name")!).filter((n) => n.includes(".")),
+  };
+}