akanjs 3.0.0-beta.31 → 3.0.0-beta.33

package/client/translator.ts

@@ -34,6 +34,7 @@ const getTranslatorState = (): TranslatorState => {
 };
 
 export class Translator {
+  static readonly #filledDicts = new WeakMap<AllDictionary, Map<string, Dictionary>>();
   constructor(dictionary: Record<string, Record<string, Record<string, unknown>>>) {
     Object.entries(dictionary).forEach(([lang, dict]) => {
       Translator.seed(lang, dict as Dictionary);
@@ -75,6 +76,31 @@ export class Translator {
     return defaultLocale === lang ? undefined : Translator.#lookup(defaultLocale, key);
   }
   
+  static withDefaultLocale(allDictionary: AllDictionary, lang: string): Dictionary | undefined {
+    const { defaultLocale } = parseAkanI18nEnv();
+    const fallback = allDictionary[defaultLocale];
+    if (lang === defaultLocale || !fallback) return allDictionary[lang];
+    const filledByLocale = Translator.#filledDicts.get(allDictionary) ?? new Map<string, Dictionary>();
+    Translator.#filledDicts.set(allDictionary, filledByLocale);
+    const filled =
+      filledByLocale.get(lang) ?? (Translator.#fillGaps(allDictionary[lang] ?? {}, fallback) as Dictionary);
+    filledByLocale.set(lang, filled);
+    return filled;
+  }
+  static #fillGaps(own: Record<string, unknown>, fallback: Record<string, unknown>): Record<string, unknown> {
+    const filled = { ...own };
+    for (const [key, value] of Object.entries(fallback)) {
+      const ownValue = filled[key];
+      if (ownValue === undefined) filled[key] = value;
+      else if (Translator.#isNode(ownValue) && Translator.#isNode(value))
+        filled[key] = Translator.#fillGaps(ownValue, value);
+    }
+    return filled;
+  }
+  static #isNode(value: unknown): value is Record<string, unknown> {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+  }
+  
   static seed(lang: string, dict: Dictionary | undefined) {
     if (!dict) return;
     const state = getTranslatorState();

package/index.ts

@@ -175,15 +175,25 @@ export interface AkanNativeAndroidConfig {
   files?: Record<string, string>;
 }
 
+export interface AkanNativeDesktopServerConfig {
+  /**
+   * Packages the image installs and the desktop app's server goes without, along with what only they pull in: an
+   * addon that needs the image's system (a ROS install), code only a process the desktop app never starts loads.
+   * The server's own bundle must not import them. The image is unchanged.
+   */
+  omit?: string[];
+}
+
 export interface AkanNativeDesktopConfig {
   /** Where the desktop app starts, over the section's `indexPath`. */
   indexPath?: string;
   /**
    * The desktop app carries the app's server (API only, database mode single, on loopback) and its pages call
-   * nothing else. `build-desktop`, `start-desktop` and `publish-update` all read it, and an installed app refuses
-   * a release that carries a server when it has none, or none when it has one.
+   * nothing else: `true`, or `{ omit }` to carry it without some of the image's packages. `build-desktop`,
+   * `start-desktop` and `publish-update` all read it, and an installed app refuses a release that carries a server
+   * when it has none, or none when it has one.
    */
-  server?: boolean;
+  server?: boolean | AkanNativeDesktopServerConfig;
   /**
    * `"reload"`: a window whose page's process ends (a crash, a hang) loads it again every time, waiting
    * longer after each end in a row, and the app relaunches when the webview's browser process ends — for an
@@ -197,6 +207,12 @@ export interface AkanNativeDesktopConfig {
    * support on an unattended screen; it covers every media request, so not for an app that asks for a camera.
    */
   screenCapture?: "picker" | "auto";
+  /**
+   * macOS: entitlements of the app's executable beyond what it gets by itself — the JIT's under the hardened runtime and
+   * the camera's or microphone's when a usage text asks for it — e.g. `com.apple.security.cs.disable-library-validation`
+   * for a native addon signed by another team. Read when the app is signed with a team (a Developer ID).
+   */
+  entitlements?: Record<string, AkanNativeValue>;
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akanjs",
-  "version": "3.0.0-beta.31",
+  "version": "3.0.0-beta.33",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {

package/server/rscWorker.tsx

@@ -9,6 +9,7 @@ import type {
 } from "akanjs/client";
 import { type AkanI18nConfig, DEFAULT_AKAN_I18N, getBasePathFromPathname, Logger } from "akanjs/common";
 import {
+  type AkanTheme,
   getRequestDynamicUsage,
   getRequestFrameState,
   getRequestPolicy,
@@ -860,6 +861,7 @@ export class RscRenderer {
     let sentChunk = false;
     let lateControlSent = false;
     const chunks: Uint8Array[] = [];
+    let reportedTheme: AkanTheme | undefined;
     const sendMeta = () => {
       if (!options.requestId || sentMeta) return;
       sentMeta = true;
@@ -867,14 +869,22 @@ export class RscRenderer {
         const trace = getCurrentTrace();
         if (trace) trace.status = options.status;
       }
+      reportedTheme = getRequestTheme();
       this.#send({
         type: "meta",
         requestId: options.requestId,
-        theme: getRequestTheme(),
+        theme: reportedTheme,
         status: options.status,
         trace: options.trace,
       });
     };
+
+    const sendLateTheme = () => {
+      const theme = getRequestTheme();
+      if (!options.requestId || !sentMeta || theme === reportedTheme) return;
+      reportedTheme = theme;
+      this.#send({ type: "theme", requestId: options.requestId, theme });
+    };
     const sendLateRedirect = () => {
       if (!options.requestId || lateControlSent || controlRef.current?.type !== "redirect") return;
       
@@ -906,6 +916,7 @@ export class RscRenderer {
         if (options.collectChunks) chunks.push(chunk);
         if (options.requestId) {
           sendMeta();
+          sendLateTheme();
           this.#send({ type: "chunk", requestId: options.requestId, data: chunk });
           sentChunk = true;
         }

package/server/rscWorkerHost.ts

@@ -19,6 +19,7 @@ export interface RscPending {
   onEnd: () => void;
   onError: (message: string) => void;
   onMeta?: (meta: { theme?: AkanTheme; status?: number; trace?: RscTraceMetadata }) => void;
+  onTheme?: (theme: AkanTheme | undefined) => void;
   onCacheState?: (state: RouteCacheRenderState) => void;
   onRedirect?: (location: string, method: RscRedirectMethod, status: RscRedirectStatus) => void;
   onLateRedirect?: (location: string, method: RscRedirectMethod, status: RscRedirectStatus) => void;
@@ -209,7 +210,18 @@ export function createRscHostRenderStream(input: {
         const settleStream = () => {
           if (settled) return;
           settled = true;
-          resolve({ type: "stream", stream, theme, status, trace, lateControl, cacheState, cancel: cancelRender });
+          resolve({
+            type: "stream",
+            stream,
+            get theme() {
+              return theme;
+            },
+            status,
+            trace,
+            lateControl,
+            cacheState,
+            cancel: cancelRender,
+          });
         };
         input.setPending({
           onMeta: (meta) => {
@@ -218,6 +230,9 @@ export function createRscHostRenderStream(input: {
             trace = meta.trace;
             settleStream();
           },
+          onTheme: (next) => {
+            theme = next;
+          },
           onChunk: (data) => {
             settleStream();
             pendingChunks = nextRscHostPendingChunkCount(pendingChunks, controller.desiredSize);
@@ -299,6 +314,7 @@ type RscInMsg =
   | { type: "ready" }
   | { type: "reloaded"; buildId: number; reloadId?: number; pagesBundlePath?: string }
   | { type: "meta"; requestId: string; theme?: AkanTheme; status?: number; trace?: RscTraceMetadata }
+  | { type: "theme"; requestId: string; theme?: AkanTheme }
   | { type: "cache-state"; requestId: string; state: RouteCacheRenderState }
   | { type: "chunk"; requestId: string; data: Uint8Array }
   | { type: "end"; requestId: string }
@@ -773,6 +789,9 @@ export class RscWorker {
           .get(message.requestId)
           ?.onMeta?.({ theme: message.theme, status: message.status, trace: message.trace });
         return;
+      case "theme":
+        this.#pending.get(message.requestId)?.onTheme?.(message.theme);
+        return;
       case "end":
         this.#resolvePending(message.requestId, (p) => p.onEnd());
         return;

package/server/webRouter.ts

@@ -637,7 +637,10 @@ export class WebRouter {
             bootstrapModules: [this.#artifact.rscClientUrl],
             extraBootstrapInline: extraBootstrapInline || undefined,
             importmap: this.#artifact.vendorMap,
-            theme: cookieTheme ?? rscResult.theme ?? "system",
+            
+            get theme() {
+              return cookieTheme ?? rscResult.theme ?? "system";
+            },
             lateControl: rscResult.lateControl,
             waitForAllReady: rscResult.trace?.ssrBlocking ?? false,
             onCancel: (reason: unknown) => {

package/types/client/translator.d.ts

@@ -16,6 +16,7 @@ export declare class Translator {
     static getActivePath(): string | undefined;
     static markHydrated(): void;
     static translateByLocale(lang: string, key: string, param?: Record<string, string | number>): string;
+    static withDefaultLocale(allDictionary: AllDictionary, lang: string): Dictionary | undefined;
     static seed(lang: string, dict: Dictionary | undefined): void;
     static replace(lang: string, dict: Dictionary | undefined): void;
     translate(lang: string, key: string, param?: Record<string, string | number>): string;

package/types/index.d.ts

@@ -158,15 +158,24 @@ export interface AkanNativeAndroidConfig {
     /** Files copied into the app, keyed `res/<type>/<file>` or `assets/<path>`; the value is the source. */
     files?: Record<string, string>;
 }
+export interface AkanNativeDesktopServerConfig {
+    /**
+     * Packages the image installs and the desktop app's server goes without, along with what only they pull in: an
+     * addon that needs the image's system (a ROS install), code only a process the desktop app never starts loads.
+     * The server's own bundle must not import them. The image is unchanged.
+     */
+    omit?: string[];
+}
 export interface AkanNativeDesktopConfig {
     /** Where the desktop app starts, over the section's `indexPath`. */
     indexPath?: string;
     /**
      * The desktop app carries the app's server (API only, database mode single, on loopback) and its pages call
-     * nothing else. `build-desktop`, `start-desktop` and `publish-update` all read it, and an installed app refuses
-     * a release that carries a server when it has none, or none when it has one.
+     * nothing else: `true`, or `{ omit }` to carry it without some of the image's packages. `build-desktop`,
+     * `start-desktop` and `publish-update` all read it, and an installed app refuses a release that carries a server
+     * when it has none, or none when it has one.
      */
-    server?: boolean;
+    server?: boolean | AkanNativeDesktopServerConfig;
     /**
      * `"reload"`: a window whose page's process ends (a crash, a hang) loads it again every time, waiting
      * longer after each end in a row, and the app relaunches when the webview's browser process ends — for an
@@ -183,6 +192,12 @@ export interface AkanNativeDesktopConfig {
      * support on an unattended screen; it covers every media request, so not for an app that asks for a camera.
      */
     screenCapture?: "picker" | "auto";
+    /**
+     * macOS: entitlements of the app's executable beyond what it gets by itself — the JIT's under the hardened runtime and
+     * the camera's or microphone's when a usage text asks for it — e.g. `com.apple.security.cs.disable-library-validation`
+     * for a native addon signed by another team. Read when the app is signed with a team (a Developer ID).
+     */
+    entitlements?: Record<string, AkanNativeValue>;
 }
 /**
  * What a native app (iOS, Android, desktop) is: the app's `native` section and each of its targets have this shape. A

package/types/server/rscWorkerHost.d.ts

@@ -15,6 +15,7 @@ export interface RscPending {
         status?: number;
         trace?: RscTraceMetadata;
     }) => void;
+    onTheme?: (theme: AkanTheme | undefined) => void;
     onCacheState?: (state: RouteCacheRenderState) => void;
     onRedirect?: (location: string, method: RscRedirectMethod, status: RscRedirectStatus) => void;
     onLateRedirect?: (location: string, method: RscRedirectMethod, status: RscRedirectStatus) => void;

package/types/vendor/@akanjs/native/packages/cli/src/api.d.ts

@@ -2,12 +2,20 @@ import { type DoctorCheck } from "./commands/doctor.ts";
 import type { AkanNativeConfig } from "./config.ts";
 import type { Device, DeviceSelector } from "./lib/launch.ts";
 import { type LogEvent, type LogSink } from "./lib/log.ts";
-import { type AndroidSigning, type BuildProfile, type IosBuild, type IosSigning, type IosSigningResult, type WindowsBuild } from "./lib/prepare.ts";
-import { type UpdateManifest } from "./lib/updates.ts";
+import { type MacosBuild, type MacosNotarization, type MacosSigning, macosDistributionFromEnv } from "./lib/macossigning.ts";
+import { type AndroidSigning, type BuildProfile, type IosBuild, type IosSigning, type IosSigningResult, type LinuxBuild, type WindowsBuild } from "./lib/prepare.ts";
+import { type DesktopArch, type UpdateManifest } from "./lib/updates.ts";
+import { type WindowsSigning, windowsSigningFromEnv } from "./lib/windowssigning.ts";
 import { type TargetPlatform } from "./platforms/index.ts";
-export type { AkanNativeConfig, AndroidSigning, Device, DeviceSelector, DoctorCheck, IosBuild, IosSigning, IosSigningResult, LogEvent, TargetPlatform, WindowsBuild, };
+export type { AkanNativeConfig, AndroidSigning, DesktopArch, Device, DeviceSelector, DoctorCheck, IosBuild, IosSigning, IosSigningResult, LinuxBuild, LogEvent, MacosBuild, MacosNotarization, MacosSigning, TargetPlatform, WindowsBuild, WindowsSigning, };
+/**
+ * The macOS signing and notarization the AKAN_NATIVE_MACOS_* variables name, for a caller that keeps them in its
+ * environment (the API itself reads no variable): pass the result as `macos`.
+ */
+/** The Authenticode settings the AKAN_NATIVE_WINDOWS_* variables name: pass the result as `windows.signing`. */
+export { macosDistributionFromEnv, windowsSigningFromEnv };
 /** semver of this API. A caller checks the major before it relies on anything here. */
-export declare const API_VERSION = "0.9.0";
+export declare const API_VERSION = "0.10.0";
 export type AkanNativeErrorCode = "CONFIG_INVALID" | "TOOLCHAIN_MISSING" | "WEB_INPUT_INVALID" | "WEB_BUILD_FAILED" | "NATIVE_BUILD_FAILED" | "SIGNING_FAILED" | "DEVICE_FAILED" | "CANCELLED" | "INTERNAL";
 export declare class AkanNativeError extends Error {
     readonly code: AkanNativeErrorCode;
@@ -89,6 +97,10 @@ export declare function build(options: TaskOptions & {
     profile?: BuildProfile;
     ios?: IosBuild;
     windows?: WindowsBuild;
+    macos?: MacosBuild;
+    linux?: LinuxBuild;
+    /** Desktop: the CPU the app runs on, of the same OS; a macOS app is arm64 only. Default this computer's. */
+    arch?: DesktopArch;
 }): Promise<BuildResult>;
 /**
  * Store files: a release build signed for distribution. Android: the .aab (and, with formats, the
@@ -150,6 +162,10 @@ export declare function publishUpdate(options: TaskOptions & {
     platform: Exclude<TargetPlatform, "web">;
     channel?: string;
     out?: string;
+    /** The signature a macOS release carries: the installed app's own, or the updater refuses it. No dmg is made. */
+    macos?: Pick<MacosBuild, "signing" | "notarize">;
+    /** Authenticode for a Windows release's files. No setup program is made. */
+    windows?: Pick<WindowsBuild, "signing">;
 }): Promise<PublishResult>;
 /**
  * Whether a web bundle can run in the binary a store release shipped (UP-3): `shipped` is that build's bundle.json,

package/types/vendor/@akanjs/native/packages/cli/src/config.d.ts

@@ -148,6 +148,13 @@ export interface AkanNativeConfig {
             /** Entitlements (e.g. keychain-access-groups). associated-domains comes from deepLinks.domains. */
             entitlements?: Record<string, NativeValue>;
         };
+        macos?: {
+            /**
+             * Entitlements of the main executable, over the hardened runtime's (allow-jit, allow-unsigned-executable-memory)
+             * and those the usage texts ask for (the camera's, the microphone's). Read when the app is signed with a team.
+             */
+            entitlements?: Record<string, NativeValue>;
+        };
         android?: {
             /** XML at the <manifest> level (uses-permission, queries, …). ${applicationId} is replaced. */
             manifest?: string[];

package/types/vendor/@akanjs/native/packages/cli/src/lib/addons.d.ts

@@ -0,0 +1,19 @@
+export type AddonOs = "macos" | "windows" | "linux";
+export type AddonArch = "arm64" | "x64";
+export interface BinaryInfo {
+    format: "mach-o" | "elf" | "pe";
+    /** Every architecture the file holds (a fat Mach-O holds several). */
+    archs: (AddonArch | "other")[];
+    /** Libraries it loads by an absolute path, and the absolute search paths it names (rpath, runpath). */
+    absoluteLinks: string[];
+}
+export interface AddonReport {
+    problems: string[];
+    warnings: string[];
+}
+/** What a desktop build refuses and what it warns about in `serverDir`'s `.node` files, by package. */
+export declare function addonReport(serverDir: string, os: AddonOs, arch: AddonArch): AddonReport;
+/** The folder of the package a file belongs to: the deepest node_modules/<name> (or <@scope>/<name>) above it. */
+export declare function packageRoot(base: string, file: string): string;
+/** The format, CPUs and absolute links of a Mach-O, ELF or PE file; null for anything else. */
+export declare function binaryInfo(bytes: Buffer): BinaryInfo | null;

package/types/vendor/@akanjs/native/packages/cli/src/lib/macossigning.d.ts

@@ -0,0 +1,95 @@
+import { type PlistValue } from "./plist.ts";
+import { type SigningIdentity } from "./signing.ts";
+export interface MacosSigning {
+    /** A certificate name ("Developer ID Application: Name (TEAMID)") or its SHA-1, in a keychain already. */
+    identity?: string;
+    /** A .p12 holding the identity: imported into a keychain of its own for the build, then removed. */
+    certificate?: {
+        path: string;
+        password: string;
+    };
+}
+/** App Store Connect API key (key, keyId, issuer), or a profile `xcrun notarytool store-credentials` saved. */
+export interface MacosNotarization {
+    /** The AuthKey_<id>.p8 file. */
+    key?: string;
+    keyId?: string;
+    /** The issuer id; left out for an individual API key. */
+    issuer?: string;
+    profile?: string;
+}
+export interface MacosBuild {
+    signing?: MacosSigning;
+    /** Release builds signed with a Developer ID only. */
+    notarize?: MacosNotarization;
+    /** A .dmg beside the app, with an Applications link; signed and notarized as the app is. */
+    dmg?: boolean;
+}
+export type MacosSignature = "adhoc" | "identity" | "development" | "distribution";
+export interface ResolvedMacosIdentity {
+    /** The certificate's SHA-1, or "-" for ad hoc. */
+    sign: string;
+    name: string;
+    kind: MacosSignature;
+    teamId?: string;
+    /** Set when the identity lives in a keychain made for this build. */
+    keychain?: string;
+}
+/**
+ * Entitlements the hardened runtime needs for the app's own code: Bun's JavaScriptCore writes JIT code, and the
+ * TCC resources the Info.plist asks for are refused to a hardened app that does not claim them.
+ */
+export declare const RUNTIME_ENTITLEMENTS: Record<string, PlistValue>;
+/** The main executable's entitlements: the runtime's, those of the usage texts in `infoPlist`, then the app's own. */
+export declare function appEntitlements(infoPlist: Record<string, PlistValue>, extra?: Record<string, PlistValue>): Record<string, PlistValue>;
+/**
+ * The kind of a certificate by its name. A Developer ID's parentheses hold the team id; an Apple Development
+ * certificate's hold the member's own id, so its team is not read from the name.
+ */
+export declare function identityKind(name: string): {
+    kind: MacosSignature;
+    teamId?: string;
+};
+/** The identity `wanted` names (a name or a SHA-1) among `identities`. */
+export declare function pickMacosIdentity(identities: SigningIdentity[], wanted: string): SigningIdentity;
+/**
+ * Runs `fn` with the identity `signing` names, or ad hoc without one. A certificate file goes into a keychain made for
+ * this build (on the user's search list meanwhile, so codesign finds its chain), deleted afterwards.
+ */
+export declare function withMacosIdentity<T>(signing: MacosSigning | undefined, fn: (identity: ResolvedMacosIdentity) => Promise<T>, fallback: () => Promise<ResolvedMacosIdentity>): Promise<T>;
+export interface CodesignOptions {
+    /** The hardened runtime and a secure timestamp, what notarization requires of every Mach-O file. */
+    hardened: boolean;
+    /** A secure timestamp without the runtime (a disk image). Default: `hardened`. */
+    timestamp?: boolean;
+    entitlements?: string;
+}
+/** codesign arguments for one file. Apple's timestamp server only stamps certificates Apple issued. */
+export declare function codesignArgs(identity: ResolvedMacosIdentity, file: string, options: CodesignOptions): string[];
+export declare function codesign(identity: ResolvedMacosIdentity, file: string, options: CodesignOptions): Promise<void>;
+export declare function writeEntitlements(dir: string, entitlements: Record<string, PlistValue>): string;
+export declare function notarytoolAuth(notarization: MacosNotarization): string[];
+interface NotarySubmission {
+    id?: string;
+    status?: string;
+    message?: string;
+}
+/** Submits `file` (a .zip, .dmg or .pkg), waits for Apple's verdict and refuses anything but Accepted. */
+export declare function notarize(file: string, notarization: MacosNotarization): Promise<string>;
+export declare function parseSubmission(stdout: string): NotarySubmission;
+/** One line per issue of a notarytool log: the file and Apple's message. */
+export declare function notaryLogIssues(stdout: string): string[];
+export declare function staple(file: string): Promise<void>;
+/** The .app as notarytool takes it: a zip that keeps the bundle's symlinks and signature. */
+export declare function zipForNotary(appPath: string, zip: string): Promise<void>;
+/** A compressed disk image of the app beside a link to /Applications, the window people drag it into. */
+export declare function buildDmg(appPath: string, dmgPath: string, volumeName: string, workDir: string): Promise<void>;
+/** What Gatekeeper says of a notarized app or disk image, as a downloaded copy would be judged. */
+export declare function assessGatekeeper(file: string, type: "execute" | "open"): Promise<void>;
+/**
+ * Settings from the environment for the command line (the API takes them as options only):
+ * AKAN_NATIVE_MACOS_IDENTITY, AKAN_NATIVE_MACOS_CERTIFICATE + _PASSWORD, and AKAN_NATIVE_MACOS_NOTARY_KEY +
+ * _KEY_ID + _ISSUER or AKAN_NATIVE_MACOS_NOTARY_PROFILE.
+ */
+export declare function macosDistributionFromEnv(env?: Record<string, string | undefined>): Pick<MacosBuild, "signing" | "notarize">;
+export {};

package/types/vendor/@akanjs/native/packages/cli/src/lib/prepare.d.ts

@@ -1,6 +1,9 @@
 import type { Platform } from "../../../core/src/index.ts";
 import { CliError } from "./log.ts";
+import type { MacosBuild } from "./macossigning.ts";
 import { type Project } from "./project.ts";
+import { type DesktopArch } from "./updates.ts";
+import type { WindowsSigning } from "./windowssigning.ts";
 /**
  * debug: inspectable webview, dev signing, runtime env overrides, the dev server (akan-native run, dev,
  * test). release: none of that (akan-native build, update publish). Independent of `mode`, which only
@@ -9,6 +12,8 @@ import { type Project } from "./project.ts";
 export type BuildProfile = "debug" | "release";
 export interface WindowsBuild {
     installer?: boolean;
+    /** Authenticode for every PE file, the setup program and its uninstaller (lib/windowssigning.ts). */
+    signing?: WindowsSigning;
 }
 export interface BuildOptions {
     mode: string;
@@ -43,6 +48,15 @@ export interface BuildOptions {
     ios?: IosBuild;
     /** Windows: an NSIS setup program next to the app folder (platforms/windows-installer.ts). */
     windows?: WindowsBuild;
+    /** macOS: Developer ID signing, notarization and a dmg (lib/macossigning.ts). */
+    macos?: MacosBuild;
+    /** Linux: an AppImage beside the app folder (platforms/linux-appimage.ts). */
+    linux?: LinuxBuild;
+    /** Desktop builds: the CPU the app runs on, of the same OS; a macOS app is arm64 only. Default this computer's. */
+    arch?: DesktopArch;
+}
+export interface LinuxBuild {
+    appImage?: boolean;
 }
 /** Which identity and profile an iOS device build signs with; unset: found in the keychain and Xcode's profiles. */
 export interface IosSigning {
@@ -117,13 +131,17 @@ export interface BuildContext {
     android?: AndroidRelease;
     ios?: IosBuild;
     windows?: WindowsBuild;
+    macos?: MacosBuild;
+    linux?: LinuxBuild;
+    /** Desktop builds: see BuildOptions.arch, resolved. */
+    arch?: DesktopArch;
     /** Artifacts besides the one the builder returns (an .aab next to the .apk, a Windows setup program). */
     artifacts: {
         kind: "aab" | "ipa" | "installer";
         path: string;
     }[];
     /** What the builder signed with, when it signs (Android: the app's release key or the debug key). */
-    signedAs?: "debug" | "development" | "distribution";
+    signedAs?: "adhoc" | "debug" | "development" | "distribution";
     /** Called through the API (BuildOptions.api). */
     api: boolean;
     /** Android builds with pinned libraries: the license notices file written next to the app (BuildResult.licenses). */
@@ -140,5 +158,7 @@ export declare class WebBuildError extends CliError {
 export declare class WebInputError extends CliError {
 }
 export declare function prepare(project: Project, platform: Platform, options: BuildOptions): Promise<BuildContext>;
+/** The arch a build makes: the one asked for, checked against the platform, else this computer's for a desktop. */
+export declare function desktopArch(platform: Platform, arch: DesktopArch | undefined): DesktopArch | undefined;
 /** https, or http to this machine (a local test server, `akan-native update serve`). */
 export declare function secureUpdateUrl(url: string): boolean;

package/types/vendor/@akanjs/native/packages/cli/src/lib/signing.d.ts

@@ -4,8 +4,8 @@ export interface SigningIdentity {
     name: string;
 }
 export declare const identityName: () => string;
-/** Valid (trusted) code-signing identities in the keychains. */
-export declare function validIdentities(): Promise<SigningIdentity[]>;
+/** Valid (trusted) code-signing identities in the keychains, or in `keychain` only. */
+export declare function validIdentities(keychain?: string): Promise<SigningIdentity[]>;
 /** The identity `akan-native signing setup` made, if it is still valid; null means ad-hoc signing. */
 export declare function devIdentity(env?: NodeJS.ProcessEnv): Promise<SigningIdentity | null>;
 export declare function setupSigning(): Promise<{

package/types/vendor/@akanjs/native/packages/cli/src/lib/toolchains.d.ts

@@ -40,6 +40,15 @@ export declare const TOOLCHAIN: {
             root: string;
         };
     };
+    /**
+     * The AppImage type 2 runtime (CLI-9), the ELF a Linux AppImage starts with: it mounts the squashfs appended to it
+     * and runs its AppRun. A dated release, since `continuous` moves; the digests are the ones GitHub publishes.
+     */
+    readonly appimageRuntime: {
+        readonly version: "20251108";
+        readonly license: "MIT";
+        readonly downloads: Record<string, Download>;
+    };
     readonly android: {
         readonly buildTools: "37.0.0";
         /** Older build-tools still work (with a warning); below this they do not. */

package/types/vendor/@akanjs/native/packages/cli/src/lib/windowssigning.d.ts

@@ -0,0 +1,30 @@
+export interface WindowsSigning {
+    /** A .pfx holding the code-signing certificate and its key. */
+    certificate?: {
+        path: string;
+        password: string;
+    };
+    /** A certificate in the user's or the machine's store, by its SHA-1 thumbprint (a token or an HSM keeps its key there). */
+    thumbprint?: string;
+    /** Any other signer, run once per file with `{file}` replaced, e.g. signtool with Azure Trusted Signing's dlib. */
+    command?: string[];
+    /** RFC 3161 timestamp server. Default http://timestamp.digicert.com. */
+    timestampUrl?: string;
+}
+export declare const DEFAULT_TIMESTAMP_URL = "http://timestamp.digicert.com";
+/** signtool: AKAN_NATIVE_SIGNTOOL, PATH, then the newest Windows 10/11 SDK's for this CPU. */
+export declare function findSigntool(env?: Record<string, string | undefined>): string | null;
+/** signtool's arguments after the executable, for `files` in one call. */
+export declare function signtoolArgs(signing: WindowsSigning, files: string[], description: string): string[];
+/** The command a `command` signer runs for one file. */
+export declare function signerCommand(command: string[], file: string): string[];
+/** Signs `files` (Authenticode, SHA-256, timestamped), then verifies each against the system's trusted roots. */
+export declare function signWindowsFiles(signing: WindowsSigning, files: string[], description: string): Promise<void>;
+/** Every PE file under `dir` (programs, DLLs, native addons), whatever its name. */
+export declare function peFiles(dir: string): string[];
+/**
+ * Settings from the environment (the API takes them as options only): AKAN_NATIVE_WINDOWS_CERTIFICATE + _PASSWORD,
+ * AKAN_NATIVE_WINDOWS_THUMBPRINT, or AKAN_NATIVE_WINDOWS_SIGN_COMMAND (a JSON array of arguments, `{file}` replaced),
+ * and AKAN_NATIVE_WINDOWS_TIMESTAMP_URL.
+ */
+export declare function windowsSigningFromEnv(env?: Record<string, string | undefined>): WindowsSigning | undefined;

package/types/vendor/@akanjs/native/packages/cli/src/platforms/desktop.d.ts

@@ -1,6 +1,7 @@
 import type { ParsedArgs } from "../lib/args.ts";
 import { type Launched, type LaunchOptions } from "../lib/launch.ts";
 import type { BuildContext } from "../lib/prepare.ts";
+import { type DesktopArch } from "../lib/updates.ts";
 export declare const NATIVE_DIR: string;
 export type DesktopOs = "macos" | "windows" | "linux";
 /** The cdylib cargo builds, per OS. */
@@ -17,14 +18,19 @@ export declare function resourcesOf(os: DesktopOs, artifact: string): string;
  */
 export declare function cargoTargetDir(): string;
 /** Builds (incrementally) the Rust cdylib and returns its path. */
-export declare function buildNativeLibrary(os: DesktopOs, release: boolean): Promise<string>;
+export declare function buildNativeLibrary(os: DesktopOs, release: boolean, arch?: DesktopArch): Promise<string>;
 /**
  * The app never reads a .env or bunfig.toml from the folder it is started in: Bun's standalone
  * executables do by default, which would let a file next to the app set its environment and
  * runtime options.
  */
 export declare const COMPILE_FLAGS: string[];
-/** bun build --compile of the main thread entry and the plugin host Worker into `outfile`. */
+/** The CPU a desktop build makes code for. */
+export declare function targetArch(ctx: Pick<BuildContext, "arch">): DesktopArch;
+/**
+ * bun build --compile of the main thread entry and the plugin host Worker into `outfile`, for the build's CPU: another
+ * CPU's Bun is a cross-compilation target Bun downloads once.
+ */
 export declare function compileExecutable(ctx: BuildContext, outfile: string, extra?: string[]): Promise<void>;
 /** The resources folder every desktop app reads (see the top of this file). */
 export declare function writeDesktopResources(ctx: BuildContext, resources: string, os: DesktopOs, shellExtra?: Record<string, unknown>): void;

package/types/vendor/@akanjs/native/packages/cli/src/platforms/linux-appimage.d.ts

@@ -0,0 +1,11 @@
+import type { BuildContext } from "../lib/prepare.ts";
+/** The launcher entry (freedesktop Desktop Entry): what a menu shows and which link schemes open the app. */
+export declare function desktopEntry(input: {
+    name: string;
+    fileName: string;
+    schemes: string[];
+}): string;
+/** AppRun: the runtime starts it from the mounted image; it starts the app from beside itself. */
+export declare function appRun(exe: string): string;
+/** Writes the AppImage beside the app folder and answers its path. */
+export declare function buildAppImage(ctx: BuildContext, folder: string): Promise<string>;

package/types/vendor/@akanjs/native/packages/cli/src/platforms/windows-installer.d.ts

@@ -27,6 +27,8 @@ export interface InstallerInput {
     bootstrapper: string;
     stopScript: string;
     outFile: string;
+    /** A command that signs the uninstaller makensis writes into the setup program, `%1` its path. */
+    signUninstaller?: string;
 }
 export declare function installerScript(input: InstallerInput): string;
 /**