akanjs 3.0.0-beta.26 → 3.0.0-beta.28

package/types/common/index.d.ts

@@ -29,6 +29,7 @@ export { isMcpDescribableArg, type McpExposureEndpoint, type McpExposureOption,
 export { deepObjectify, objectify, plainFieldsOf } from "./objectify.d.ts";
 export { pathGet, pathGetLoose, pathSet, toPathSegments } from "./objectPath.d.ts";
 export { formatPhone, isPhoneNumber } from "./phone.d.ts";
+export { type RouteLayer, RouteLayering } from "./RouteLayering.d.ts";
 export { randomPick, randomPicks } from "./randomPick.d.ts";
 export { hostFromRequest, isJsonContentType, originFromRequest } from "./requestOrigin.d.ts";
 export { RestClient, type RestClientOptions, type RestRequestOptions } from "./restClient.d.ts";

package/types/index.d.ts

@@ -1,3 +1,4 @@
+import type { AkanNativeConfig } from "./vendor/@akanjs/native/packages/cli/src/config.d.ts";
 import type { AkanI18nConfig } from "akanjs/common";
 import type { AkanImageConfig } from "akanjs/server";
 export declare const archs: readonly ["amd64", "arm64"];
@@ -24,6 +25,31 @@ export interface LibDockerConfig {
     preRuns: DockerRun[];
     postRuns: DockerRun[];
 }
+/** `${process.platform}-${process.arch}` of the computer a desktop app is built on, which is the one it runs on. */
+export declare const binPlatforms: readonly ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
+export type BinPlatform = (typeof binPlatforms)[number];
+/** Downloaded when the desktop app is built; the file must hash to `sha256`, so plain http is as safe as https. */
+export interface AkanBinUrlSource {
+    url: string;
+    sha256: string;
+    /** The executable inside the archive `url` names (.zip, .tar.gz, .tgz, .tar.xz, .tar.bz2, .tar). */
+    file?: string;
+}
+/** A file on the building computer, relative to the `akan.config.ts` that declares it. */
+export interface AkanBinPathSource {
+    path: string;
+    /** The executable inside the archive `path` names. */
+    file?: string;
+}
+export type AkanBinSource = AkanBinUrlSource | AkanBinPathSource;
+/**
+ * Executables a desktop app carries, by the name its code spawns and then by platform. Their folder comes first on
+ * the app's PATH, so the carried server's `spawn("ffmpeg")` runs the carried file; a native plugin finds it in
+ * `ctx.binDir`.
+ */
+export type AkanBinConfig = Record<string, {
+    [platform in BinPlatform]?: AkanBinSource;
+}>;
 export interface AkanRouteDomains {
     main?: string[];
     develop?: string[];
@@ -59,8 +85,13 @@ export type DatabaseMode = "single" | "multiple" | "cluster";
 export type MobileEnv = "local" | "debug" | "develop" | "main";
 export type MobilePermission = "camera" | "contacts" | "location" | "push" | "speech";
 export interface AkanMobileTargetAssets {
-    icon?: string;
-    splash?: string;
+    /** A square PNG, relative to the app folder, or it with the color behind its transparent areas. */
+    icon?: string | {
+        image: string;
+        backgroundColor?: string;
+    };
+    /** A PNG shown centered at launch, or the launch screen's color, image and when it hides. */
+    splash?: string | NonNullable<AkanNativeConfig["splash"]>;
 }
 export interface AkanMobileTargetDeepLinks {
     schemes?: string[];
@@ -96,14 +127,77 @@ export interface AkanMobileNativeConfig {
         activity?: string[];
         /** The Firebase project's google-services.json, relative to the app folder, for FCM push on Android. */
         googleServices?: string;
+        /** Media plays with sound without a tap first, as it does on iOS and the desktop: a signage screen. */
+        autoplay?: boolean;
+    };
+    /** Android's notification channel, status bar icon (relative to the app folder) and accent color. */
+    push?: AkanNativeConfig["push"];
+    /** The app's part of the iOS privacy manifest (PrivacyInfo.xcprivacy), which an App Store upload requires. */
+    privacy?: AkanNativeConfig["privacy"];
+    desktop?: {
+        /**
+         * The desktop app carries the app's server (API only, database mode single, on loopback) and its pages call
+         * nothing else. `build-desktop`, `start-desktop` and `publish-update` all read it, and an installed app refuses
+         * a release that carries a server when it has none, or none when it has one.
+         */
+        server?: boolean;
+        /**
+         * `"reload"`: a window whose page's process ends (a crash, a hang) loads it again every time, waiting
+         * longer after each end in a row, and the app relaunches when the webview's browser process ends — for an
+         * app nobody attends. `"errorPage"` (default): one reload, then an error page, and a quit for the browser.
+         */
+        recovery?: "errorPage" | "reload";
+        /** The main window from its first frame: borderless fullscreen, and no taskbar button (Windows, Linux). */
+        window?: {
+            fullscreen?: boolean;
+            skipTaskbar?: boolean;
+        };
+        /**
+         * Windows: `"auto"` answers getDisplayMedia() with the first screen at once, no picker or gesture — remote
+         * support on an unattended screen; it covers every media request, so not for an app that asks for a camera.
+         */
+        screenCapture?: "picker" | "auto";
     };
 }
+/**
+ * Where an installed app looks for newer releases of itself (the native runtime's updates plugin): the whole app on a
+ * desktop, the web bundle on a phone. `akan publish-update` writes and signs a release with a key on this machine;
+ * `akan pack-update` writes an unsigned phone bundle for whoever holds the key to sign.
+ */
+export interface AkanMobileUpdatesConfig {
+    /**
+     * A static base URL, https in a release build: `<url>/<os>-<arch>/<channel>.json` (desktop) or `<url>/<platform>/…`
+     * (a phone's web bundle).
+     */
+    url: string;
+    /** The update key's public half, the raw 32-byte Ed25519 key in base64 (`akan update-keygen` prints it). */
+    publicKey: string;
+    /**
+     * The manifest the app follows, e.g. a "pilot" target's "pilot". Default: the backend env the app is built for
+     * (`main`, `develop`, `debug`, `local`).
+     */
+    channel?: string;
+    /** How long a newly applied release has to call notifyReady() before it is rolled back, ms. Default 10000. */
+    readyTimeout?: number;
+}
+/**
+ * One bundle id, or one per platform, for an app whose store listings already carry different ids. A platform without
+ * its own takes `default`.
+ */
+export type AkanMobileAppId = string | {
+    default?: string;
+    ios?: string;
+    android?: string;
+    macos?: string;
+    windows?: string;
+    linux?: string;
+};
 export interface AkanMobileTargetConfig {
     name: string;
     basePath?: string;
     indexPath?: string;
     appName: string;
-    appId: string;
+    appId: AkanMobileAppId;
     /** Executables, archives and the Swift module; letters, digits, `.`, `_` and `-`. Default: the app's folder name. */
     fileName?: string;
     version: string;
@@ -113,15 +207,18 @@ export interface AkanMobileTargetConfig {
     deepLinks?: AkanMobileTargetDeepLinks;
     files?: AkanMobileTargetFiles;
     native?: AkanMobileNativeConfig;
+    /** Over mobile.updates, field by field: a pilot target names its own channel. */
+    updates?: Partial<AkanMobileUpdatesConfig>;
 }
 export interface AkanMobileConfig {
     appName: string;
-    appId: string;
+    appId: AkanMobileAppId;
     fileName?: string;
     version: string;
     buildNum: number;
     files?: AkanMobileTargetFiles;
     native?: AkanMobileNativeConfig;
+    updates?: AkanMobileUpdatesConfig;
     targets: Record<string, AkanMobileTargetConfig>;
 }
 export interface AkanScanInfo {
@@ -219,6 +316,10 @@ export interface AppConfigResult {
      */
     syncPageLibs?: string[] | boolean;
     externalLibs: string[];
+    /** Dependencies whose install scripts `bun install --production` runs, in the image and in a desktop app's server. */
+    trustedDependencies: string[];
+    /** Every desktop build, run and dev session carries these, server or not; the image installs through `docker`. */
+    bin: AkanBinConfig;
     barrelImports: string[];
     optimizeImports: string[];
     images: AkanImageConfig;
@@ -230,6 +331,9 @@ export interface AppConfigResult {
 }
 export interface LibConfigResult {
     externalLibs: string[];
+    trustedDependencies: string[];
+    /** Carried by the desktop app of every app that depends on this lib; an app's own entry of the same name wins. */
+    bin: AkanBinConfig;
     /** Image steps every app that mounts this lib inherits, unless that app declares a whole Dockerfile. */
     docker: LibDockerConfig;
     /** Which of this lib's own public fonts every app that mounts it must keep. */
@@ -246,12 +350,14 @@ export interface LibConfigContext {
     readonly name: string;
     readonly type: "lib";
 }
-export type AppConfigInput = Omit<DeepPartial<AppConfigResult>, "docker" | "web"> & {
+export type AppConfigInput = Omit<DeepPartial<AppConfigResult>, "docker" | "web" | "bin"> & {
     docker?: DockerOption;
     web?: AkanWebOption;
+    bin?: AkanBinConfig;
     plugins?: AkanPlugin[];
 };
-export type LibConfigInput = DeepPartial<LibConfigResult> & {
+export type LibConfigInput = Omit<DeepPartial<LibConfigResult>, "bin"> & {
+    bin?: AkanBinConfig;
     plugins?: AkanPlugin[];
 };
 export interface SubspaceDeclaration {

package/types/native/desktop.d.ts

@@ -0,0 +1,3 @@
+export { AkanNativeError, mimeFor } from "../vendor/@akanjs/native/packages/core/src/index.d.ts";
+export type { DesktopContext, DesktopPlugin, NativeEvent } from "../vendor/@akanjs/native/packages/desktop/src/plugin.d.ts";
+export { createPageVeto, defineDesktopPlugin, externalOpenAllowed } from "../vendor/@akanjs/native/packages/desktop/src/plugin.d.ts";

package/types/server/akanAppHeaders.d.ts

@@ -1,3 +1,5 @@
+/** The Host every request the gateway hands a replica carries; a browser never sends it to a replica's port. */
+export declare const AKAN_CHILD_HOST = "akan-child";
 export interface ProxyClientPeer {
     address: string;
     port: number;

package/types/server/index.d.ts

@@ -7,6 +7,7 @@ export * from "./console.d.ts";
 export * from "./decorators.d.ts";
 export * from "./devtools.d.ts";
 export type { ChangeBatch, ChangeKind } from "./hmr/wsHub.d.ts";
+export * from "./nativeFile.d.ts";
 export * from "./oauth.d.ts";
 export * from "./processMetricsCollector.d.ts";
 export * from "./proxy.d.ts";

package/types/server/lifecycle/orphanGroup.d.ts

@@ -0,0 +1,7 @@
+export declare class OrphanGroup {
+    #private;
+    static exit(code: number, { leads, graceMs }?: {
+        leads?: boolean | undefined;
+        graceMs?: number | undefined;
+    }): void;
+}

package/types/server/nativeFile.d.ts

@@ -0,0 +1,10 @@
+export type NativeFileMode = "read" | "write" | "folder";
+export declare class NativeFile {
+    #private;
+    static timeoutMs: number;
+    static operationMode: () => string;
+    /** The path behind `grant`, which the user must have given for `mode`. */
+    static resolve(grant: string, mode: NativeFileMode): Promise<string>;
+    /** A path inside a folder grant; one that climbs out of the folder is refused. */
+    static resolveIn(grant: string, relative: string): Promise<string>;
+}

package/types/server/routing/apiRouter.d.ts

@@ -4,6 +4,7 @@ import type { HmrWsHub } from "../hmr/wsHub.d.ts";
 import { type WebProxyRunner } from "../proxy.d.ts";
 import type { HttpRoutes, SignalRouteOptions, WebsocketRoutes } from "../types.d.ts";
 import { AppWsData } from "./appWsData.d.ts";
+import type { HostAllowlist } from "./hostAllowlist.d.ts";
 export interface HmrStateSource {
     readonly state: {
         buildId: number;
@@ -32,6 +33,7 @@ export interface ApiRouteInputs {
     renderEnvRoutes: HttpRoutes;
     upgradeAppWs: (req: Request, data: AppWsData) => boolean;
     webProxyRunner?: WebProxyRunner | null;
+    hostAllowlist?: HostAllowlist | null;
 }
 export interface WebsocketHandlersInputs {
     wsRoutes: WebsocketRoutes;
@@ -47,7 +49,7 @@ type WsTaggedData = {
 };
 export declare class ApiRouter {
     #private;
-    static buildRoutes({ prefix, websocketPrefix, routes, builtinRoutes, routeOptions, renderEnvRoutes, upgradeAppWs, webProxyRunner, }: ApiRouteInputs): NonNullHttpRoutes;
+    static buildRoutes({ prefix, websocketPrefix, routes, builtinRoutes, routeOptions, renderEnvRoutes, upgradeAppWs, webProxyRunner, hostAllowlist, }: ApiRouteInputs): NonNullHttpRoutes;
     static buildWebsocketHandlers({ wsRoutes, registry, live, hmrHub, hmrState, logger, onDrain, }: WebsocketHandlersInputs): Bun.WebSocketHandler<WsTaggedData>;
     static applyGlobalPrefix(prefix: string, path: string, options?: SignalRouteOptions): string;
     static joinRoutePath(prefix: string, path: string): string;

package/types/server/routing/hostAllowlist.d.ts

@@ -0,0 +1,8 @@
+export declare class HostAllowlist {
+    #private;
+    constructor(hosts: Iterable<string>);
+    /** `AKAN_ALLOWED_HOSTS`: comma-separated `host:port` entries; unset or blank serves every Host. */
+    static fromEnv(env?: Record<string, string | undefined>): HostAllowlist | null;
+    allows(req: Request): boolean;
+    refuse(): Response;
+}

package/types/server/selfExec.d.ts

@@ -0,0 +1,8 @@
+export declare class SelfExec {
+    #private;
+    static adopt(): void;
+    /** A desktop app's carried server: only its shell starts the app executable as Bun. */
+    static get carried(): boolean;
+    static env(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+    static command(script: string, ...args: string[]): string[];
+}

package/types/server/types.d.ts

@@ -72,7 +72,9 @@ export declare const resolveWebConfig: (web: Partial<AkanWebConfig> | undefined)
 export declare const getWebConfigFromEnv: () => AkanWebConfig;
 export interface MobileDeepLinkAssociation {
     targetName: string;
-    appId: string;
+    /** Null when the target names no id for the platform; that platform then gets no association. */
+    iosAppId: string | null;
+    androidAppId: string | null;
     domains: string[];
     iosTeamId?: string;
     androidSha256CertFingerprints?: string[];

package/types/service/ipcTypes.d.ts

@@ -155,6 +155,10 @@ export type AkanIpcMessage = {
         type: "tcp";
     }>;
     healthPath?: string;
+    crossSite?: {
+        allowedOrigins: string[];
+        enabled: boolean;
+    };
 } | {
     type: "backend-ready";
     pid: number;
@@ -233,6 +237,18 @@ export type AkanIpcMessage = {
 } | {
     type: "shutdown";
     signal?: string;
+}
+/** Desktop server → the shell that started it: the path behind a file picker grant (forServer). */
+ | {
+    type: "file.resolve";
+    id: string;
+    grant: string;
+} | {
+    type: "file.resolved";
+    id: string;
+    path?: string;
+    mode?: "read" | "write" | "folder";
+    error?: string;
 } | {
     type: "error";
     message: string;

package/types/signal/CrossSiteGuard.d.ts

@@ -13,6 +13,7 @@ export declare class CrossSiteGuard {
     static readonly nativeOrigins: readonly ["app://localhost", "https://app.localhost"];
     /** Applied at boot from the mounting app's `option.ts`; the native shells stay allowed unless disabled. */
     static configure({ allowedOrigins, enabled }: CrossSiteOption): void;
+    static option(): Required<CrossSiteOption>;
     static reset(): void;
     /** Call only where a JSON body is read: a multipart upload relies on `assertOrigin` alone. */
     static assertJsonBody(contentType: string | null): void;

package/types/ui/recipe/buttonRecipe.d.ts

@@ -2,7 +2,7 @@
 export declare const buttonRecipe: (variants?: Omit<({
     size?: "lg" | "md" | "sm" | "xs" | "icon" | undefined;
     outline?: boolean | undefined;
-    variant?: "link" | "default" | "info" | "warning" | "success" | "primary" | "secondary" | "accent" | "destructive" | "neutral" | "outline" | "ghost" | undefined;
+    variant?: "default" | "link" | "info" | "warning" | "success" | "primary" | "secondary" | "accent" | "destructive" | "neutral" | "outline" | "ghost" | undefined;
     shape?: "default" | "circle" | "square" | undefined;
 } & {
     class?: import("tailwind-variants").ClassValue;
@@ -10,7 +10,7 @@ export declare const buttonRecipe: (variants?: Omit<({
 }) | ({
     size?: "lg" | "md" | "sm" | "xs" | "icon" | undefined;
     outline?: boolean | undefined;
-    variant?: "link" | "default" | "info" | "warning" | "success" | "primary" | "secondary" | "accent" | "destructive" | "neutral" | "outline" | "ghost" | undefined;
+    variant?: "default" | "link" | "info" | "warning" | "success" | "primary" | "secondary" | "accent" | "destructive" | "neutral" | "outline" | "ghost" | undefined;
     shape?: "default" | "circle" | "square" | undefined;
 } & {
     class?: never;

package/types/vendor/@akanjs/native/packages/cli/src/api.d.ts

@@ -2,11 +2,12 @@ import { type DoctorCheck } from "./commands/doctor.ts";
 import type { AkanNativeConfig } from "./config.ts";
 import type { Device, DeviceSelector } from "./lib/launch.ts";
 import { type LogEvent, type LogSink } from "./lib/log.ts";
-import { type AndroidSigning, type BuildProfile, type IosBuild, type IosSigning, type IosSigningResult } from "./lib/prepare.ts";
+import { type AndroidSigning, type BuildProfile, type IosBuild, type IosSigning, type IosSigningResult, type WindowsBuild } from "./lib/prepare.ts";
+import { type UpdateManifest } from "./lib/updates.ts";
 import { type TargetPlatform } from "./platforms/index.ts";
-export type { AkanNativeConfig, AndroidSigning, Device, DeviceSelector, DoctorCheck, IosBuild, IosSigning, IosSigningResult, LogEvent, TargetPlatform, };
+export type { AkanNativeConfig, AndroidSigning, Device, DeviceSelector, DoctorCheck, IosBuild, IosSigning, IosSigningResult, LogEvent, TargetPlatform, WindowsBuild, };
 /** semver of this API. A caller checks the major before it relies on anything here. */
-export declare const API_VERSION = "0.1.0";
+export declare const API_VERSION = "0.8.0";
 export type AkanNativeErrorCode = "CONFIG_INVALID" | "TOOLCHAIN_MISSING" | "WEB_INPUT_INVALID" | "WEB_BUILD_FAILED" | "NATIVE_BUILD_FAILED" | "SIGNING_FAILED" | "DEVICE_FAILED" | "CANCELLED" | "INTERNAL";
 export declare class AkanNativeError extends Error {
     readonly code: AkanNativeErrorCode;
@@ -50,7 +51,7 @@ export interface TaskOptions {
     signal?: AbortSignal;
 }
 export interface Artifact {
-    kind: "app" | "apk" | "aab" | "ipa" | "folder" | "web";
+    kind: "app" | "apk" | "aab" | "ipa" | "folder" | "web" | "installer";
     path: string;
     signing: "none" | "adhoc" | "debug" | "development" | "distribution";
     device?: "simulator" | "device";
@@ -87,6 +88,7 @@ export declare function validateConfig(config: AkanNativeConfig, options: {
 export declare function build(options: TaskOptions & {
     profile?: BuildProfile;
     ios?: IosBuild;
+    windows?: WindowsBuild;
 }): Promise<BuildResult>;
 /**
  * Store files: a release build signed for distribution. Android: the .aab (and, with formats, the
@@ -101,6 +103,57 @@ export declare function release(options: TaskOptions & ({
     platform: "ios";
     signing?: IosSigning;
 })): Promise<BuildResult>;
+/**
+ * An unsigned web bundle update (UP-2), for a signer that keeps the key off the build machine. Writes
+ * `<out>/files/<sha256>`, `<out>/manifest.template.json` (the manifest with `channel`, `sequence` and `bundle` left
+ * empty for the signer) and `<out>/bundle.json` (the native API the bundle needs, UP-3). Prepares the web bundle as a
+ * release build does, without building the native app.
+ */
+export declare function packUpdate(options: TaskOptions & {
+    platform: "ios" | "android";
+    out: string;
+}): Promise<{
+    manifest: UpdateManifest;
+    out: string;
+}>;
+export interface PublishResult {
+    build: BuildResult;
+    /** `<out>/<os>-<arch>` (desktop) or `<out>/<platform>` (a phone's web bundle): what to upload under updates.url. */
+    dir: string;
+    bundle: string;
+    channel: string;
+    files: number;
+    /** Bytes of the files the manifest names. */
+    size: number;
+}
+/**
+ * A signed release for the updates plugin (UP-1, UP-2): a release build, then `<channel>.json`, its signature and
+ * its files under `out` (default <appDir>/.akan/native/updates), signed with the key updateKeygen() made.
+ */
+export declare function publishUpdate(options: TaskOptions & {
+    platform: Exclude<TargetPlatform, "web">;
+    channel?: string;
+    out?: string;
+}): Promise<PublishResult>;
+/**
+ * Whether a web bundle can run in the binary a store release shipped (UP-3): `shipped` is that build's bundle.json,
+ * `bundle` the one `packUpdate` wrote. Anything in `problems` means a new binary.
+ */
+export declare function compareBundles(shipped: string, bundle: string): {
+    compatible: boolean;
+    problems: string[];
+};
+/**
+ * The app's update signing key: made once (AKAN_NATIVE_UPDATE_KEY, else ~/.akan/native/keys/<app id>.update.key),
+ * then read. `publicKey` goes into the config's `updates.publicKey`; the key file never leaves the machine.
+ */
+export declare function updateKeygen(options: {
+    config: AkanNativeConfig;
+}): {
+    publicKey: string;
+    keyPath: string;
+    created: boolean;
+};
 /** Builds (default profile debug) and launches the app on a simulator, emulator, desktop or browser. */
 export declare function run(options: TaskOptions & {
     profile?: BuildProfile;

package/types/vendor/@akanjs/native/packages/cli/src/config.d.ts

@@ -192,6 +192,11 @@ export interface AkanNativeConfig {
          * or APIs the bundle uses. Android 10+ devices with Google Play update WebView themselves.
          */
         minWebViewVersion?: number;
+        /**
+         * Media plays with sound without a tap first, as it does on iOS and the desktop (WebView's
+         * mediaPlaybackRequiresUserGesture off): an app nobody taps, such as a signage screen. Default false.
+         */
+        autoplay?: boolean;
         /**
          * Appended to app.id in debug builds (e.g. ".debug"), so a debug build installs next to the
          * release app. Deep links and app links must list the suffixed id for debug builds.
@@ -245,6 +250,49 @@ export interface AkanNativeConfig {
          * hides the window: the app keeps running, a Dock click shows it again, Cmd+Q quits. Default true.
          */
         quitOnLastWindowClosed?: boolean;
+        /**
+         * What a window does when its page's web process ends: a crash, a hang, out of memory. "errorPage"
+         * (default) loads the page again once and shows an error page when it ends again within a minute, so a
+         * page that crashes on load does not loop; the app quits when the webview's browser process ends
+         * (Windows). "reload" loads it again every time, waiting longer after each end in a row (1 s, doubling
+         * to a minute), and relaunches the app when the browser process ends: an app nobody attends, such as a
+         * kiosk or a signage screen. iOS and Android always start the page over.
+         */
+        recovery?: "errorPage" | "reload";
+        /**
+         * The main window from its first frame: `fullscreen` (borderless, on the display the window opens on)
+         * and `skipTaskbar` (no taskbar button; Windows and Linux). A plugin's launch phase may still decide
+         * otherwise (DesktopContext.launch.setWindow). Default false for both.
+         */
+        window?: {
+            fullscreen?: boolean;
+            skipTaskbar?: boolean;
+        };
+        /**
+         * Windows: "auto" answers the page's getDisplayMedia() with the first screen at once, without the picker or a
+         * user gesture: a remote-support session on an unattended screen. It is Chromium's switch for automated media
+         * tests (--use-fake-ui-for-media-stream), made for every media request, so keep it to an app whose pages ask
+         * for no camera or microphone. Default "picker". WebView2's choice by title follows the UI language, so none is
+         * offered. macOS and Linux ignore it.
+         */
+        screenCapture?: "picker" | "auto";
+        /**
+         * A server the app starts beside its window (akanjs `native.desktop.server`). `dir` is copied to
+         * the app's resources (`server/`), and `entry` there runs on the app's own Bun with `env`, bound to
+         * a loopback port picked at launch; the page reads its URL as PUBLIC_AKAN_SERVER_URL. The launcher
+         * sets PORT, JWT_SECRET, the data folders (`<app local data>/server`) and the listen host itself.
+         */
+        server?: {
+            dir: string;
+            entry: string;
+            env?: Record<string, string>;
+        };
+        /**
+         * A folder of executables the app carries (akanjs `bin`): copied to the app's resources (`bin/`) and put
+         * first on the app's PATH at launch, so its plugins and its server find them by name before the computer's.
+         * macOS builds sign every Mach-O file in it.
+         */
+        bin?: string;
     };
     /**
      * App icon for every platform, generated from one square PNG, ideally 1024×1024 (CLI-8).

package/types/vendor/@akanjs/native/packages/cli/src/lib/desktop-server.d.ts

@@ -0,0 +1,8 @@
+import type { AkanNativeConfig } from "../config.ts";
+export interface DesktopServerConfig {
+    /** Absolute. */
+    dir: string;
+    entry: string;
+    env: Record<string, string>;
+}
+export declare function validateDesktopServer(desktop: AkanNativeConfig["desktop"], appDir: string, problems: string[]): DesktopServerConfig | null;

package/types/vendor/@akanjs/native/packages/cli/src/lib/prepare.d.ts

@@ -7,6 +7,9 @@ import { type Project } from "./project.ts";
  * picks the .env files, so a staging build is still a release build.
  */
 export type BuildProfile = "debug" | "release";
+export interface WindowsBuild {
+    installer?: boolean;
+}
 export interface BuildOptions {
     mode: string;
     profile: BuildProfile;
@@ -38,6 +41,8 @@ export interface BuildOptions {
     android?: AndroidRelease;
     /** iOS devices (akanjs readiness O1-2, O1-3). */
     ios?: IosBuild;
+    /** Windows: an NSIS setup program next to the app folder (platforms/windows-installer.ts). */
+    windows?: WindowsBuild;
 }
 /** Which identity and profile an iOS device build signs with; unset: found in the keychain and Xcode's profiles. */
 export interface IosSigning {
@@ -111,9 +116,10 @@ export interface BuildContext {
     startPath?: string;
     android?: AndroidRelease;
     ios?: IosBuild;
-    /** Artifacts besides the one the builder returns (an .aab next to the .apk). */
+    windows?: WindowsBuild;
+    /** Artifacts besides the one the builder returns (an .aab next to the .apk, a Windows setup program). */
     artifacts: {
-        kind: "aab" | "ipa";
+        kind: "aab" | "ipa" | "installer";
         path: string;
     }[];
     /** What the builder signed with, when it signs (Android: the app's release key or the debug key). */

package/types/vendor/@akanjs/native/packages/cli/src/lib/project.d.ts

@@ -1,5 +1,6 @@
 import type { AkanNativeConfig } from "../config.ts";
 import { type PermissionSet } from "./acl.ts";
+import { type DesktopServerConfig } from "./desktop-server.ts";
 import { type EnvConfig } from "./env.ts";
 import { CliError } from "./log.ts";
 import { type PermissionsConfig } from "./permissions.ts";
@@ -28,6 +29,15 @@ export interface ResolvedConfig extends Omit<AkanNativeConfig, "icon" | "splash"
     };
     desktop: {
         quitOnLastWindowClosed: boolean;
+        recovery: "errorPage" | "reload";
+        window: {
+            fullscreen: boolean;
+            skipTaskbar: boolean;
+        };
+        screenCapture: "picker" | "auto";
+        server?: DesktopServerConfig;
+        /** Absolute. */
+        bin?: string;
     };
     updates: UpdatesConfig | null;
     /** Absolute image path. */

package/types/vendor/@akanjs/native/packages/cli/src/lib/publish.d.ts

@@ -0,0 +1,24 @@
+import type { BuildContext } from "./prepare.ts";
+import { type UpdateManifest } from "./updates.ts";
+export type ReleasePlatform = "macos" | "windows" | "linux" | "ios" | "android";
+export interface PublishedRelease {
+    /** `<out>/<os>-<arch>` for a desktop app, `<out>/<platform>` for a phone's web bundle. */
+    dir: string;
+    manifest: UpdateManifest;
+}
+/**
+ * The publish time in seconds, and past the release `<channel>.json` in `dir` already names: apps take only a larger
+ * sequence, so a clock behind the last publisher's would make this release look older to every one of them.
+ */
+export declare function nextSequence(dir: string, channel: string, now?: number): number;
+/** Refuses before the build a release that could not be signed: no key on this machine, or another app's. */
+export declare function assertSigningKey(config: {
+    app: {
+        id: string;
+    };
+    updates?: {
+        publicKey: string;
+    } | null;
+}): void;
+/** Writes the release of `artifact` (the app a release build made) and its signed `<channel>.json` under `out`. */
+export declare function publishRelease(ctx: BuildContext, platform: ReleasePlatform, artifact: string, out: string, channel: string): Promise<PublishedRelease>;

package/types/vendor/@akanjs/native/packages/cli/src/lib/updates.d.ts

@@ -53,6 +53,28 @@ export interface UpdateManifest {
         size: number;
     }[];
 }
+/** Every file of a web bundle as the app serves it: index.html with the init script and CSP, public/, env.runtime.json. */
+export declare function webFiles(webDir: string, html: string, env: Record<string, string>): {
+    path: string;
+    data: Uint8Array;
+}[];
+/** Writes a web bundle's files under `<out>/files/<sha256>` (content-addressed, so releases share them) and lists them. */
+export declare function writeWebBundle(out: string, webDir: string, html: string, env: Record<string, string>): UpdateFile[];
+/** A web bundle's manifest (UP-2), keys in the order `update publish` has always written them. */
+export declare function webManifest(release: {
+    app: {
+        id: string;
+        version: string;
+    };
+    platform: Platform;
+    channel: string;
+    nativeApi: string;
+    sequence: number;
+    bundle: string;
+    files: UpdateFile[];
+}): UpdateManifest;
+/** Refuses a channel no app could be configured for: it would be written but never taken. */
+export declare function assertChannel(channel: string): void;
 export declare function validateUpdates(raw: unknown, problems: string[]): UpdatesConfig | null;
 /** Where the signing key of an app lives: AKAN_NATIVE_UPDATE_KEY (a file path), else ~/.akan/native/keys/<app id>.update.key. */
 export declare function updateKeyPath(appId: string, env?: Record<string, string | undefined>): string;
@@ -61,6 +83,8 @@ export declare function generateUpdateKey(path: string): {
     publicKey: string;
     created: boolean;
 };
+/** The key at `keyPath`, refused unless it is the one whose public half the apps were built with. */
+export declare function signingKey(keyPath: string, expectedPublicKey: string): import("node:crypto").KeyObject;
 export declare function signManifest(bytes: Uint8Array, keyPath: string, expectedPublicKey: string): string;
 /** Verifies like the apps do: raw public key, base64 signature over the exact manifest bytes. */
 export declare function verifyManifest(bytes: Uint8Array, signature: string, publicKey: string): boolean;

package/types/vendor/@akanjs/native/packages/cli/src/platforms/desktop-update.d.ts

@@ -1,4 +1,7 @@
 import type { BuildContext } from "../lib/prepare.ts";
 import { type UpdateManifest } from "../lib/updates.ts";
 import { type DesktopOs } from "./desktop.ts";
-export declare function publishAppUpdate(ctx: BuildContext, os: DesktopOs, app: string, out: string, channel: string, sequence: number): Promise<UpdateManifest>;
+export declare function publishAppUpdate(ctx: BuildContext, os: DesktopOs, app: string, out: string, channel: string, sequence: number): Promise<{
+    manifest: UpdateManifest;
+    superseded: string | null;
+}>;