akanjs 3.0.0-beta.30 → 3.0.0-beta.32

package/types/vendor/@akanjs/native/packages/cli/src/platforms/desktop.d.ts

@@ -1,6 +1,7 @@
 import type { ParsedArgs } from "../lib/args.ts";
 import { type Launched, type LaunchOptions } from "../lib/launch.ts";
 import type { BuildContext } from "../lib/prepare.ts";
+import { type DesktopArch } from "../lib/updates.ts";
 export declare const NATIVE_DIR: string;
 export type DesktopOs = "macos" | "windows" | "linux";
 /** The cdylib cargo builds, per OS. */
@@ -17,14 +18,19 @@ export declare function resourcesOf(os: DesktopOs, artifact: string): string;
  */
 export declare function cargoTargetDir(): string;
 /** Builds (incrementally) the Rust cdylib and returns its path. */
-export declare function buildNativeLibrary(os: DesktopOs, release: boolean): Promise<string>;
+export declare function buildNativeLibrary(os: DesktopOs, release: boolean, arch?: DesktopArch): Promise<string>;
 /**
  * The app never reads a .env or bunfig.toml from the folder it is started in: Bun's standalone
  * executables do by default, which would let a file next to the app set its environment and
  * runtime options.
  */
 export declare const COMPILE_FLAGS: string[];
-/** bun build --compile of the main thread entry and the plugin host Worker into `outfile`. */
+/** The CPU a desktop build makes code for. */
+export declare function targetArch(ctx: Pick<BuildContext, "arch">): DesktopArch;
+/**
+ * bun build --compile of the main thread entry and the plugin host Worker into `outfile`, for the build's CPU: another
+ * CPU's Bun is a cross-compilation target Bun downloads once.
+ */
 export declare function compileExecutable(ctx: BuildContext, outfile: string, extra?: string[]): Promise<void>;
 /** The resources folder every desktop app reads (see the top of this file). */
 export declare function writeDesktopResources(ctx: BuildContext, resources: string, os: DesktopOs, shellExtra?: Record<string, unknown>): void;

package/types/vendor/@akanjs/native/packages/cli/src/platforms/linux-appimage.d.ts

@@ -0,0 +1,11 @@
+import type { BuildContext } from "../lib/prepare.ts";
+/** The launcher entry (freedesktop Desktop Entry): what a menu shows and which link schemes open the app. */
+export declare function desktopEntry(input: {
+    name: string;
+    fileName: string;
+    schemes: string[];
+}): string;
+/** AppRun: the runtime starts it from the mounted image; it starts the app from beside itself. */
+export declare function appRun(exe: string): string;
+/** Writes the AppImage beside the app folder and answers its path. */
+export declare function buildAppImage(ctx: BuildContext, folder: string): Promise<string>;

package/types/vendor/@akanjs/native/packages/cli/src/platforms/windows-installer.d.ts

@@ -27,6 +27,8 @@ export interface InstallerInput {
     bootstrapper: string;
     stopScript: string;
     outFile: string;
+    /** A command that signs the uninstaller makensis writes into the setup program, `%1` its path. */
+    signUninstaller?: string;
 }
 export declare function installerScript(input: InstallerInput): string;
 /**

package/ui/System/Client.tsx

@@ -282,27 +282,20 @@ export const ClientBridge = ({ env, lang, theme, prefix, wsConnect = true }: Cli
 Client.Bridge = ClientBridge;
 
 function restoreDocumentTheme(layoutTheme: AkanTheme | undefined): void {
-  const cookieTheme = getCookie("theme");
   
-  if (cookieTheme) {
-    document.documentElement.setAttribute("data-theme", cookieTheme);
-    st.do.setTheme(cookieTheme);
-    return;
-  }
-  applyThemePolicy(layoutTheme ?? "system");
-}
-
-function applyThemePolicy(theme: AkanTheme): void {
-  if (theme === "css") {
+  const theme = getCookie("theme") ?? resolveThemePolicy(layoutTheme ?? "system");
+  if (theme === null) {
     document.documentElement.removeAttribute("data-theme");
     return;
   }
-  if (theme === "system") {
-    const dark = window.matchMedia("(prefers-color-scheme: dark)").matches;
-    document.documentElement.setAttribute("data-theme", dark ? "dark" : "light");
-    return;
-  }
   document.documentElement.setAttribute("data-theme", theme);
+  st.do.setTheme(theme);
+}
+
+function resolveThemePolicy(theme: AkanTheme): string | null {
+  if (theme === "css") return null;
+  if (theme === "system") return window.matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light";
+  return theme;
 }
 
 function buildSearchParams(entries: Iterable<[string, string]>): Record<string, string | string[]> {

package/ui/System/SSR.tsx

@@ -51,7 +51,7 @@ const SSRProvider = ({
 
   if (allDictionary) for (const [lng, dict] of Object.entries(allDictionary)) Translator.replace(lng, dict);
 
-  const activeDictionary = allDictionary?.[activeLocale] ?? dictionary;
+  const activeDictionary = (allDictionary && Translator.withDefaultLocale(allDictionary, activeLocale)) ?? dictionary;
   const pageState = getRequestFrameState<PageState>() ?? defaultPageState;
 
   return (

package/vendor/@akanjs/native/packages/cli/src/api.ts

@@ -10,6 +10,12 @@ import { CancelledError, withSignal } from "./lib/exec.ts";
 import { type HmrContext, lanAddress, resolveDevEntry, startHmrServer } from "./lib/hmr.ts";
 import type { Device, DeviceSelector, Launched } from "./lib/launch.ts";
 import { CliError, type LogEvent, type LogSink, log, ToolchainError, ToolError, withLogSink } from "./lib/log.ts";
+import {
+  type MacosBuild,
+  type MacosNotarization,
+  type MacosSigning,
+  macosDistributionFromEnv,
+} from "./lib/macossigning.ts";
 import {
   type AndroidSigning,
   type BuildContext,
@@ -18,6 +24,7 @@ import {
   type IosBuild,
   type IosSigning,
   type IosSigningResult,
+  type LinuxBuild,
   prepare,
   SigningError,
   WebBuildError,
@@ -28,12 +35,14 @@ import { ConfigError, type Project, projectFromConfig } from "./lib/project.ts";
 import { assertServerOfChannel, assertSigningKey, publishRelease } from "./lib/publish.ts";
 import {
   assertChannel,
+  type DesktopArch,
   generateUpdateKey,
   type UpdateManifest,
   updateKeyPath,
   webManifest,
   writeWebBundle,
 } from "./lib/updates.ts";
+import { type WindowsSigning, windowsSigningFromEnv } from "./lib/windowssigning.ts";
 import { androidDevices, launchAndroid } from "./platforms/android.ts";
 import { PLATFORM_TARGETS, type TargetPlatform } from "./platforms/index.ts";
 import { iosDevices, physicalIosDevice } from "./platforms/ios.ts";
@@ -41,19 +50,31 @@ import { iosDevices, physicalIosDevice } from "./platforms/ios.ts";
 export type {
   AkanNativeConfig,
   AndroidSigning,
+  DesktopArch,
   Device,
   DeviceSelector,
   DoctorCheck,
   IosBuild,
   IosSigning,
   IosSigningResult,
+  LinuxBuild,
   LogEvent,
+  MacosBuild,
+  MacosNotarization,
+  MacosSigning,
   TargetPlatform,
   WindowsBuild,
+  WindowsSigning,
 };
+/**
+ * The macOS signing and notarization the AKAN_NATIVE_MACOS_* variables name, for a caller that keeps them in its
+ * environment (the API itself reads no variable): pass the result as `macos`.
+ */
+/** The Authenticode settings the AKAN_NATIVE_WINDOWS_* variables name: pass the result as `windows.signing`. */
+export { macosDistributionFromEnv, windowsSigningFromEnv };
 
 /** semver of this API. A caller checks the major before it relies on anything here. */
-export const API_VERSION = "0.9.0";
+export const API_VERSION = "0.10.0";
 
 export type AkanNativeErrorCode =
   | "CONFIG_INVALID"
@@ -156,7 +177,15 @@ export function validateConfig(config: AkanNativeConfig, options: { appDir: stri
 
 /** Builds the app. Default profile release (like `akan-native build`). `ios.device`: an iPhone build (signed; release adds an .ipa). */
 export function build(
-  options: TaskOptions & { profile?: BuildProfile; ios?: IosBuild; windows?: WindowsBuild },
+  options: TaskOptions & {
+    profile?: BuildProfile;
+    ios?: IosBuild;
+    windows?: WindowsBuild;
+    macos?: MacosBuild;
+    linux?: LinuxBuild;
+    /** Desktop: the CPU the app runs on, of the same OS; a macOS app is arm64 only. Default this computer's. */
+    arch?: DesktopArch;
+  },
 ): Promise<BuildResult> {
   return task(
     options,
@@ -165,6 +194,9 @@ export function build(
         await buildIn(options, options.profile ?? "release", options.mode ?? "production", warnings, {
           ...(options.ios ? { ios: options.ios } : {}),
           ...(options.windows ? { windows: options.windows } : {}),
+          ...(options.macos ? { macos: options.macos } : {}),
+          ...(options.linux ? { linux: options.linux } : {}),
+          ...(options.arch ? { arch: options.arch } : {}),
         })
       ).result,
   );
@@ -289,11 +321,22 @@ export function checkPublishUpdate(options: PublishCheckOptions): { channel: str
  * its files under `out` (default <appDir>/.akan/native/updates), signed with the key updateKeygen() made.
  */
 export function publishUpdate(
-  options: TaskOptions & { platform: Exclude<TargetPlatform, "web">; channel?: string; out?: string },
+  options: TaskOptions & {
+    platform: Exclude<TargetPlatform, "web">;
+    channel?: string;
+    out?: string;
+    /** The signature a macOS release carries: the installed app's own, or the updater refuses it. No dmg is made. */
+    macos?: Pick<MacosBuild, "signing" | "notarize">;
+    /** Authenticode for a Windows release's files. No setup program is made. */
+    windows?: Pick<WindowsBuild, "signing">;
+  },
 ): Promise<PublishResult> {
   return task(options, async (warnings) => {
     const { channel, out } = checkPublishUpdate(options);
-    const { ctx, artifact, result } = await buildIn(options, "release", options.mode ?? "production", warnings);
+    const { ctx, artifact, result } = await buildIn(options, "release", options.mode ?? "production", warnings, {
+      ...(options.macos ? { macos: { ...options.macos, dmg: false } } : {}),
+      ...(options.windows?.signing ? { windows: { signing: options.windows.signing } } : {}),
+    });
     const { dir, manifest } = await publishRelease(ctx, options.platform, artifact, out, channel).catch((error) => {
       throw toAkanNativeError(error, "CONFIG_INVALID");
     });
@@ -633,7 +676,10 @@ async function buildIn(
   profile: BuildProfile,
   mode: string,
   warnings: string[],
-  extra: Pick<BuildOptions, "android" | "ios" | "windows" | "devServer" | "startPath"> = {},
+  extra: Pick<
+    BuildOptions,
+    "android" | "ios" | "windows" | "macos" | "linux" | "arch" | "devServer" | "startPath"
+  > = {},
 ): Promise<{ ctx: BuildContext; artifact: string; result: BuildResult }> {
   const started = performance.now();
   const appDir = resolve(options.appDir);
@@ -693,10 +739,10 @@ function describe(platform: TargetPlatform, path: string, ctx: BuildContext): Ar
     case "web":
       return { kind: "web", path, signing: "none" };
     case "macos":
-      return { kind: "app", path, signing: "adhoc" };
+      return { kind: "app", path, signing: ctx.signedAs ?? "adhoc" };
     case "windows":
     case "linux":
-      return { kind: "folder", path, signing: "none" };
+      return { kind: "folder", path, signing: ctx.signedAs ?? "none" };
     case "ios":
       return ctx.ios?.device
         ? { kind: "app", path, signing: ctx.signedAs ?? "development", device: "device" }

package/vendor/@akanjs/native/packages/cli/src/commands/build.ts

@@ -3,19 +3,33 @@
 import { relative } from "node:path";
 import { checkFlags, type ParsedArgs, parseArgs, stringFlag } from "../lib/args.ts";
 import { bold, CliError, dim, log } from "../lib/log.ts";
+import { macosDistributionFromEnv } from "../lib/macossigning.ts";
 import { type BuildContext, type BuildProfile, prepare } from "../lib/prepare.ts";
 import { findAppDir, loadProject } from "../lib/project.ts";
+import type { DesktopArch } from "../lib/updates.ts";
+import { windowsSigningFromEnv } from "../lib/windowssigning.ts";
 import { PLATFORM_TARGETS, TARGETS, type TargetPlatform } from "../platforms/index.ts";
 import { physicalIosDevice } from "../platforms/ios.ts";
 
 export const BOOLEAN_FLAGS = ["skip-web-build", "open", "release", "debug", "headless", "aab", "installer"];
 
 /** Flags of every build: the app, the env mode (.env.<mode>), the profile, the web build. */
-export const BUILD_FLAGS = ["app", "mode", "release", "debug", "skip-web-build", "aab", "installer", "device", "build"];
+export const BUILD_FLAGS = [
+  "app",
+  "mode",
+  "release",
+  "debug",
+  "skip-web-build",
+  "aab",
+  "installer",
+  "device",
+  "build",
+  "arch",
+];
 /** Flags of launching a build (web server, simulators, emulators). */
 export const LAUNCH_FLAGS = ["port", "host", "open", "headless", "device", "avd"];
 
-export const BUILD_USAGE = `akan-native build <${TARGETS.join("|")}> [--app <dir>] [--mode <mode>] [--debug] [--skip-web-build] [--aab] [--installer] [--device] [--build <n>]`;
+export const BUILD_USAGE = `akan-native build <${TARGETS.join("|")}> [--app <dir>] [--mode <mode>] [--debug] [--skip-web-build] [--aab] [--installer] [--device] [--build <n>] [--arch <arm64|x64>]`;
 export const RUN_USAGE = `akan-native run <${TARGETS.join("|")}> [--app <dir>] [--mode <mode>] [--release] [--skip-web-build] [--port <n>] [--open] [--headless] [--device <name>] [--avd <name>] [--start <path>]`;
 
 export interface BuildDefaults {
@@ -57,7 +71,8 @@ export async function buildFromArgs(
   if (project.plugins.length) log.info(dim(`plugins: ${project.plugins.map((p) => p.manifest.id).join(", ")}`));
 
   if (args.flags.aab === true && platform !== "android") throw new CliError("--aab is for android", 2);
-  if (args.flags.installer === true && platform !== "windows") throw new CliError("--installer is for windows", 2);
+  if (args.flags.installer === true && platform !== "windows" && platform !== "macos" && platform !== "linux")
+    throw new CliError("--installer is for windows (a setup program), macos (a dmg) and linux (an AppImage)", 2);
   
   const device = args.flags.device;
   const iphone = platform === "ios" && typeof device === "string" ? await physicalIosDevice(device) : null;
@@ -70,7 +85,26 @@ export async function buildFromArgs(
     startPath: extra.startPath,
     
     ...(args.flags.aab === true ? { android: { bundle: true } } : {}),
-    ...(args.flags.installer === true ? { windows: { installer: true } } : {}),
+    ...(platform === "windows"
+      ? {
+          windows: {
+            ...(args.flags.installer === true ? { installer: true } : {}),
+            
+            ...(profile === "release" ? { signing: windowsSigningFromEnv() } : {}),
+          },
+        }
+      : {}),
+    
+    ...(platform === "macos"
+      ? {
+          macos: {
+            ...(profile === "release" ? macosDistributionFromEnv() : {}),
+            ...(args.flags.installer === true ? { dmg: true } : {}),
+          },
+        }
+      : {}),
+    ...(platform === "linux" && args.flags.installer === true ? { linux: { appImage: true } } : {}),
+    ...(stringFlag(args, "arch") ? { arch: stringFlag(args, "arch") as DesktopArch } : {}),
 
     ...(iosDevice
       ? { ios: { device: true, ...(iphone ? { target: { udid: iphone.udid, name: iphone.name } } : {}) } }

package/vendor/@akanjs/native/packages/cli/src/config.ts

@@ -140,6 +140,13 @@ export interface AkanNativeConfig {
       /** Entitlements (e.g. keychain-access-groups). associated-domains comes from deepLinks.domains. */
       entitlements?: Record<string, NativeValue>;
     };
+    macos?: {
+      /**
+       * Entitlements of the main executable, over the hardened runtime's (allow-jit, allow-unsigned-executable-memory)
+       * and those the usage texts ask for (the camera's, the microphone's). Read when the app is signed with a team.
+       */
+      entitlements?: Record<string, NativeValue>;
+    };
     android?: {
       /** XML at the <manifest> level (uses-permission, queries, …). ${applicationId} is replaced. */
       manifest?: string[];

package/vendor/@akanjs/native/packages/cli/src/lib/addons.ts

@@ -0,0 +1,217 @@
+
+
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative, sep } from "node:path";
+
+export type AddonOs = "macos" | "windows" | "linux";
+export type AddonArch = "arm64" | "x64";
+
+export interface BinaryInfo {
+  format: "mach-o" | "elf" | "pe";
+  /** Every architecture the file holds (a fat Mach-O holds several). */
+  archs: (AddonArch | "other")[];
+  /** Libraries it loads by an absolute path, and the absolute search paths it names (rpath, runpath). */
+  absoluteLinks: string[];
+}
+
+export interface AddonReport {
+  problems: string[];
+  warnings: string[];
+}
+
+const FORMAT: Record<AddonOs, BinaryInfo["format"]> = { macos: "mach-o", windows: "pe", linux: "elf" };
+
+/** What a desktop build refuses and what it warns about in `serverDir`'s `.node` files, by package. */
+export function addonReport(serverDir: string, os: AddonOs, arch: AddonArch): AddonReport {
+  const problems: string[] = [];
+  const warnings: string[] = [];
+  const byPackage = new Map<string, string[]>();
+  const files = listFiles(serverDir);
+  for (const file of files.filter((f) => f.endsWith(".node"))) {
+    const root = packageRoot(serverDir, file);
+    byPackage.set(root, [...(byPackage.get(root) ?? []), file]);
+  }
+  
+  for (const gyp of files.filter((f) => f.endsWith(`${sep}binding.gyp`))) {
+    const root = dirname(gyp);
+    if (packageRoot(serverDir, gyp) !== root || byPackage.has(root)) continue;
+    problems.push(
+      `${shown(serverDir, root)}: a native addon (binding.gyp) with no compiled binary; its install script did not run (add it to trustedDependencies) or it cannot build here`,
+    );
+  }
+  for (const [root, files] of [...byPackage].sort(([a], [b]) => a.localeCompare(b))) {
+    const name = shown(serverDir, root);
+    const loadable = files.flatMap((file) => {
+      const info = binaryInfo(readFileSync(file));
+      return info && info.format === FORMAT[os] && info.archs.includes(arch) ? [{ file, info }] : [];
+    });
+    if (!loadable.length) {
+      const found = files.map((file) => describeBinary(binaryInfo(readFileSync(file)))).join(", ");
+      problems.push(`${name}: no ${os}-${arch} binary (has ${found}); install it for that platform or drop it`);
+      continue;
+    }
+    for (const { file, info } of loadable)
+      for (const link of info.absoluteLinks.filter((l) => !systemPath(os, l)))
+        problems.push(
+          `${shown(serverDir, file)} links ${link}, which a user's computer does not have: bundle the library or drop the addon`,
+        );
+    const compiled = existsSync(join(root, "binding.gyp")) && loadable.every(({ file }) => isBuildOutput(root, file));
+    if (compiled)
+      warnings.push(
+        `${name} was compiled on this computer at install (binding.gyp, no prebuilt binary): check that it runs on a computer with nothing else installed`,
+      );
+  }
+  return { problems: problems.sort(), warnings: warnings.sort() };
+}
+
+/** A path inside the server as the report names it: relative, `/`-separated on every OS. */
+const shown = (base: string, path: string) => relative(base, path).split(sep).join("/") || ".";
+
+function listFiles(dir: string): string[] {
+  if (!existsSync(dir)) return [];
+  return (readdirSync(dir, { recursive: true }) as string[])
+    .map((file) => join(dir, file))
+    .filter((file) => statSync(file).isFile());
+}
+
+/** The folder of the package a file belongs to: the deepest node_modules/<name> (or <@scope>/<name>) above it. */
+export function packageRoot(base: string, file: string): string {
+  const parts = relative(base, file).split(sep);
+  const at = parts.lastIndexOf("node_modules");
+  if (at < 0) return base;
+  const width = parts[at + 1]?.startsWith("@") ? 3 : 2;
+  return join(base, ...parts.slice(0, at + width));
+}
+
+function isBuildOutput(root: string, file: string): boolean {
+  return relative(root, file).split(sep)[0] === "build";
+}
+
+function systemPath(os: AddonOs, path: string): boolean {
+  if (os === "macos") return path.startsWith("/usr/lib/") || path.startsWith("/System/Library/");
+  return /^\/(usr\/)?lib(64)?(\/|$)/.test(path);
+}
+
+function describeBinary(info: BinaryInfo | null): string {
+  if (!info) return "an unknown file";
+  const os = info.format === "mach-o" ? "macos" : info.format === "elf" ? "linux" : "windows";
+  return `${os}-${info.archs.join("+")}`;
+}
+
+/** The format, CPUs and absolute links of a Mach-O, ELF or PE file; null for anything else. */
+export function binaryInfo(bytes: Buffer): BinaryInfo | null {
+  if (bytes.length < 64) return null;
+  if (bytes.readUInt32BE(0) === 0x7f454c46) return elfInfo(bytes);
+  if (bytes.readUInt16LE(0) === 0x5a4d) return peInfo(bytes);
+  const magic = bytes.readUInt32LE(0);
+  if (magic === 0xfeedfacf || magic === 0xfeedface) return machoInfo([machoSlice(bytes, 0)]);
+  if (bytes.readUInt32BE(0) === 0xcafebabe) {
+    const count = bytes.readUInt32BE(4);
+    
+    if (count === 0 || count >= 45) return null;
+    const slices = Array.from({ length: count }, (_, i) => {
+      const at = 8 + i * 20;
+      return machoSlice(
+        bytes.subarray(bytes.readUInt32BE(at + 8), bytes.readUInt32BE(at + 8) + bytes.readUInt32BE(at + 12)),
+        0,
+      );
+    });
+    return machoInfo(slices);
+  }
+  return null;
+}
+
+const MACHO_CPU: Record<number, AddonArch> = { 16777223: "x64", 16777228: "arm64" };
+const LC_LOAD_DYLIB = 0xc;
+const LC_LOAD_WEAK_DYLIB = 0x80000018;
+const LC_REEXPORT_DYLIB = 0x8000001f;
+const LC_RPATH = 0x8000001c;
+
+interface MachoSlice {
+  arch: AddonArch | "other";
+  links: string[];
+}
+
+function machoSlice(bytes: Buffer, at: number): MachoSlice {
+  const is64 = bytes.readUInt32LE(at) === 0xfeedfacf;
+  const arch = MACHO_CPU[bytes.readUInt32LE(at + 4)] ?? "other";
+  const count = bytes.readUInt32LE(at + 16);
+  let offset = at + (is64 ? 32 : 28);
+  const links: string[] = [];
+  for (let i = 0; i < count && offset + 8 <= bytes.length; i++) {
+    const cmd = bytes.readUInt32LE(offset);
+    const size = bytes.readUInt32LE(offset + 4);
+    if (size < 8) break;
+    if (cmd === LC_LOAD_DYLIB || cmd === LC_LOAD_WEAK_DYLIB || cmd === LC_REEXPORT_DYLIB || cmd === LC_RPATH) {
+      const name = cString(bytes, offset + bytes.readUInt32LE(offset + 8), offset + size);
+      if (name.startsWith("/")) links.push(name);
+    }
+    offset += size;
+  }
+  return { arch, links };
+}
+
+function machoInfo(slices: MachoSlice[]): BinaryInfo {
+  return {
+    format: "mach-o",
+    archs: slices.map((s) => s.arch),
+    absoluteLinks: [...new Set(slices.flatMap((s) => s.links))],
+  };
+}
+
+const ELF_MACHINE: Record<number, AddonArch> = { 62: "x64", 183: "arm64" };
+const PT_LOAD = 1;
+const PT_DYNAMIC = 2;
+const DT_STRTAB = 5;
+const DT_RPATH = 15;
+const DT_RUNPATH = 29;
+
+function elfInfo(bytes: Buffer): BinaryInfo {
+  const arch = ELF_MACHINE[bytes.readUInt16LE(18)] ?? "other";
+  
+  if (bytes[4] !== 2 || bytes[5] !== 1) return { format: "elf", archs: [arch], absoluteLinks: [] };
+  const phoff = Number(bytes.readBigUInt64LE(32));
+  const phentsize = bytes.readUInt16LE(54);
+  const phnum = bytes.readUInt16LE(56);
+  const loads: { vaddr: number; offset: number; size: number }[] = [];
+  let dynamic: { offset: number; size: number } | null = null;
+  for (let i = 0; i < phnum; i++) {
+    const at = phoff + i * phentsize;
+    if (at + 56 > bytes.length) break;
+    const type = bytes.readUInt32LE(at);
+    const offset = Number(bytes.readBigUInt64LE(at + 8));
+    const vaddr = Number(bytes.readBigUInt64LE(at + 16));
+    const size = Number(bytes.readBigUInt64LE(at + 32));
+    if (type === PT_LOAD) loads.push({ vaddr, offset, size });
+    if (type === PT_DYNAMIC) dynamic = { offset, size };
+  }
+  if (!dynamic) return { format: "elf", archs: [arch], absoluteLinks: [] };
+  const entries: { tag: number; value: number }[] = [];
+  for (let at = dynamic.offset; at + 16 <= dynamic.offset + dynamic.size && at + 16 <= bytes.length; at += 16) {
+    const tag = Number(bytes.readBigInt64LE(at));
+    if (tag === 0) break;
+    entries.push({ tag, value: Number(bytes.readBigUInt64LE(at + 8)) });
+  }
+  const strtab = entries.find((e) => e.tag === DT_STRTAB)?.value;
+  const load = strtab === undefined ? undefined : loads.find((l) => strtab >= l.vaddr && strtab < l.vaddr + l.size);
+  if (strtab === undefined || !load) return { format: "elf", archs: [arch], absoluteLinks: [] };
+  const base = strtab - load.vaddr + load.offset;
+  const paths = entries
+    .filter((e) => e.tag === DT_RPATH || e.tag === DT_RUNPATH)
+    .flatMap((e) => cString(bytes, base + e.value, bytes.length).split(":"))
+    .filter((p) => p.startsWith("/"));
+  return { format: "elf", archs: [arch], absoluteLinks: [...new Set(paths)] };
+}
+
+const PE_MACHINE: Record<number, AddonArch> = { 34404: "x64", 43620: "arm64" };
+
+function peInfo(bytes: Buffer): BinaryInfo | null {
+  const at = bytes.readUInt32LE(0x3c);
+  if (at + 6 > bytes.length || bytes.readUInt32BE(at) !== 0x50450000) return null;
+  return { format: "pe", archs: [PE_MACHINE[bytes.readUInt16LE(at + 4)] ?? "other"], absoluteLinks: [] };
+}
+
+function cString(bytes: Buffer, start: number, end: number): string {
+  const stop = bytes.indexOf(0, start);
+  return bytes.toString("utf8", start, stop < 0 || stop > end ? end : stop);
+}

package/vendor/@akanjs/native/packages/cli/src/lib/configkeys.ts

@@ -24,6 +24,7 @@ const KNOWN: Shape = {
   deepLinks: { schemes: true, domains: { "[]": { host: true, pathPrefixes: true } } },
   native: {
     ios: { infoPlist: true, entitlements: true },
+    macos: { entitlements: true },
     android: { manifest: true, application: true, activity: true },
     resources: { "[]": { from: true, to: true } },
   },