akanjs 3.0.0-beta.9 → 3.0.1

package/types/vendor/@akanjs/native/packages/cli/src/lib/csp.d.ts

@@ -0,0 +1,51 @@
+export type CspDirectives = Record<string, string | string[]>;
+/** "strict" is akan-native's recommended policy; a string or a directive map is used as given. */
+export type CspConfig = "strict" | string | CspDirectives;
+/**
+ * Everything an akan-native app needs and nothing else: the page, init.js, the bridge (desktop fetch to
+ * /__akan_native/ipc, Android /__akan_native/hello + MessagePort; iOS messageHandlers are outside CSP), FileRefs
+ * (/__akan_native/file/*), blob:/data: images and media (camera, file-picker, filesystem on the web), dev
+ * live reload (same-origin EventSource), fetch() of blob:/data: URLs (web FileRefs). Remote APIs,
+ * CDNs and fonts must be added by the app.
+ */
+export declare const STRICT_CSP: Record<string, string[]>;
+export declare function parseCsp(text: string): Map<string, string[]>;
+export declare function serializeCsp(map: Map<string, string[]>): string;
+/** The HTML parser turns CRLF and lone CR into LF before a script's text is hashed. */
+export declare function normalizeForHash(text: string): string;
+export declare function cspHash(text: string): string;
+/**
+ * Inline <script> (without src) and <style> contents of a document. Like the HTML tokenizer, a
+ * script or style ends at the first `</script` / `</style`, so text in the bundle that merely
+ * mentions a tag does not start a new element (bundlers escape `</script` inside JS).
+ */
+export declare function inlineBlocks(html: string): {
+    scripts: string[];
+    styles: string[];
+};
+/**
+ * The policy for this index.html: the configured directives plus hashes of its inline scripts
+ * and styles. A directive the app left out is derived from default-src first, so adding hashes
+ * never drops sources the app allowed. A directive with 'unsafe-inline' stays as it is: hashes
+ * would switch 'unsafe-inline' off (CSP2) and break inline styles the app relies on.
+ */
+export declare function buildCsp(config: CspConfig, html: string): {
+    policy: string;
+    scripts: number;
+    styles: number;
+    warnings: string[];
+};
+export declare function validateCsp(raw: unknown): CspConfig | undefined;
+/**
+ * Inserts the policy near the top of <head>: right after `<meta charset>` when there is one (so
+ * the charset stays in the first 1024 bytes a browser scans), else first. Either way it comes
+ * before the inlined styles and the bundle; only init.js may precede it, which 'self' allows.
+ */
+export declare function injectCspMeta(html: string, policy: string): string;
+/** True when the source index.html brings its own policy (left alone when security.csp is unset). */
+export declare function hasCspMeta(html: string): boolean;
+/**
+ * security.shell.externalSchemes (L0): lowercase URL schemes the shell may also hand to the OS.
+ * Schemes that reach local files, run script or name the app itself can never be added.
+ */
+export declare function validateExternalSchemes(raw: unknown): string[];

package/types/vendor/@akanjs/native/packages/cli/src/lib/desktop-server.d.ts

@@ -0,0 +1,8 @@
+import type { AkanNativeConfig } from "../config.ts";
+export interface DesktopServerConfig {
+    /** Absolute. */
+    dir: string;
+    entry: string;
+    env: Record<string, string>;
+}
+export declare function validateDesktopServer(desktop: AkanNativeConfig["desktop"], appDir: string, problems: string[]): DesktopServerConfig | null;

package/types/vendor/@akanjs/native/packages/cli/src/lib/env.d.ts

@@ -0,0 +1,44 @@
+import type { Platform } from "../../../core/src/index.ts";
+export declare const PUBLIC_PREFIX = "PUBLIC_";
+/** Parses a dotenv file: KEY=value, `export KEY=value`, # comments, '' literal and "" escaped values. */
+export declare function parseDotenv(text: string): Record<string, string>;
+/** App config `env` (ENV-1, ENV-6). */
+export interface EnvConfig {
+    defaults: Record<string, string>;
+    platforms: Partial<Record<Platform, Record<string, string>>>;
+}
+export interface EnvResult {
+    env: Record<string, string>;
+    /** Sources that had values, lowest precedence first ("akan-native.config", ".env", "akan-native.config (android)", ...). */
+    files: string[];
+    /** Keys dropped because they lack the PUBLIC_ prefix. */
+    dropped: string[];
+    /** Every source that set each kept key, lowest precedence first (for the generated types). */
+    sources: Record<string, string[]>;
+}
+/**
+ * The build-time layers for one mode and platform, lowest precedence first: the shared chain,
+ * then the same chain for the platform, so a platform value wins over every shared one (the way
+ * Tauri merges tauri.<platform>.conf.json over tauri.conf.json, tauri-utils config/parse.rs:50-66).
+ *
+ *   env.defaults < .env < .env.<mode> < env.platforms.<p> < .env.<p> < .env.<mode>.<p>
+ */
+export interface EnvLoadOptions {
+    /** false: skip the .env files (docs/api.md envFiles). Default true. */
+    files?: boolean;
+    /** Values above every other layer (docs/api.md env), shown as the source "api". */
+    overrides?: Record<string, string>;
+}
+export declare function loadEnv(appDir: string, mode: string, platform: Platform, config: EnvConfig, options?: EnvLoadOptions): EnvResult;
+/** Checks `env` in akan-native.config.ts. */
+export declare function validateEnvConfig(raw: unknown, problems: string[]): EnvConfig;
+export declare const ENV_TYPES_FILE = "akan-native-env.d.ts";
+/**
+ * akan-native-env.d.ts (ENV-7): the PUBLIC_ keys the build can give the app, over every mode and build
+ * target. A key all of them get is `string`, the rest are optional. Only key names go in the file.
+ * Keys that exist only at run time (AKAN_NATIVE_PUBLIC_*, a replaced env.runtime.json) still read as
+ * the index signature on `env` in @akanjs/native/core.
+ */
+export declare function envTypes(appDir: string, config: EnvConfig): string;
+/** Writes akan-native-env.d.ts next to akan-native.config.ts when it changed. Returns whether it wrote. */
+export declare function writeEnvTypes(appDir: string, config: EnvConfig): boolean;

package/types/vendor/@akanjs/native/packages/cli/src/lib/exec.d.ts

@@ -0,0 +1,31 @@
+import { CliError } from "./log.ts";
+export interface ExecOptions {
+    cwd?: string;
+    env?: Record<string, string | undefined>;
+    /** Print the command before running it. Default true. */
+    echo?: boolean;
+    /** Stream output to the terminal instead of capturing it (to the log sink inside an API call). */
+    inherit?: boolean;
+    /** The tool name on streamed lines. Default the command's file name. */
+    tool?: string;
+}
+export interface ExecResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+/** Runs `fn` with every command it starts killed when `signal` aborts (docs/api.md `signal`). */
+export declare function withSignal<T>(signal: AbortSignal | undefined, fn: () => T): T;
+/** The abort signal of the API call this runs in, if any. */
+export declare function currentSignal(): AbortSignal | undefined;
+/** A command killed because the API call was cancelled. */
+export declare class CancelledError extends CliError {
+    constructor();
+}
+/** Throws CancelledError once the current API call was cancelled. */
+export declare function throwIfCancelled(): void;
+export declare function formatCommand(cmd: string[]): string;
+/** Runs a command and returns its output. Does not throw on a non-zero exit. */
+export declare function exec(cmd: string[], options?: ExecOptions): Promise<ExecResult>;
+/** Runs a command and throws a ToolError with its output when it fails. */
+export declare function execOrThrow(cmd: string[], options?: ExecOptions): Promise<ExecResult>;

package/types/vendor/@akanjs/native/packages/cli/src/lib/googleservices.d.ts

@@ -0,0 +1,2 @@
+/** res/values/google_services.xml for `packageName` (and `fallbackPackage` when it has no client). */
+export declare function googleServicesXml(json: string, packageName: string, fallbackPackage?: string): string;

package/types/vendor/@akanjs/native/packages/cli/src/lib/hmr.d.ts

@@ -0,0 +1,120 @@
+import type { Platform } from "../../../core/src/index.ts";
+import { type CspConfig } from "./csp.ts";
+import type { Project } from "./project.ts";
+export declare const HMR_PATH = "/_bun/hmr";
+/** The app's source HTML for Bun's dev server: web.devEntry, else index.html in the app folder. */
+export declare function resolveDevEntry(project: Project): string;
+/**
+ * Inline classic script in the dev page. It runs while the document is parsed, so before Bun's
+ * client (a module script, deferred).
+ * - Bun's error overlay host gets its style with setAttribute("style"), which a hash-based policy
+ *   refuses (style-src-attr); the same text through CSSOM (style.cssText) is allowed. Only that
+ *   element: the app's own style attributes meet the policy as in a build.
+ * - `socket` (native hosts): WebSockets the page opens on its own origin to the HMR path (or one of
+ *   `paths`, the app's own sockets relayed by the gateway) go to the gateway's origin instead, and
+ *   `window.__AKAN_NATIVE_DEV__.gateway` tells the app its page came through the gateway.
+ * - `socket.relayBodies` (Android): fetch and XMLHttpRequest calls on the page's origin with a method
+ *   other than GET or HEAD go to the gateway's http origin instead. shouldInterceptRequest hands the
+ *   shell no request body, so the host cannot carry them; http://localhost is a trustworthy origin
+ *   there, so the call is not mixed content, and the dev server answers the app origin's CORS.
+ */
+export declare function devShim(socket?: {
+    origin: string;
+    path?: string;
+    paths?: string[];
+    relayBodies?: boolean;
+}): string;
+/**
+ * What Bun's dev client needs on top of the app's policy: its updates run as blob: scripts, and
+ * its socket goes to ws://localhost:<port> (neither is covered by 'self' from app://). A directive
+ * that is absent and has no default-src is unrestricted and stays absent.
+ */
+export declare function devCspSources(policy: string, wsOrigin: string): string;
+export interface DevHtmlOptions {
+    platform: Platform;
+    /** The gateway's port. */
+    port: number;
+    /** Where the page's HMR socket goes (native hosts). Default ws://localhost:<port>. */
+    wsOrigin?: string;
+    /** The HMR socket path the page opens. Default Bun's /_bun/hmr. */
+    hmrPath?: string;
+    /** The app's own socket paths the gateway relays too (W4). */
+    wsPaths?: string[];
+    /** security.csp; the policy is built from the rewritten page, as `akan-native build` does (SEC-4). */
+    csp?: CspConfig;
+}
+/**
+ * Bun's page → the page a host serves: the init.js tag first in <head> (IN-3), the dev shim right
+ * before Bun's client script, then the CSP <meta> with the hashes of the final inline scripts
+ * (Bun's own and the shim included) plus devCspSources.
+ */
+export declare function rewriteDevHtml(html: string, opts: DevHtmlOptions): {
+    html: string;
+    warnings: string[];
+};
+export type DevRoute = {
+    kind: "hmr";
+} | {
+    kind: "bun";
+} | {
+    kind: "init";
+} | {
+    kind: "page";
+}
+/** Absolute path of a public file. */
+ | {
+    kind: "file";
+    path: string;
+} | {
+    kind: "not-found";
+};
+/**
+ * The gateway's decision for a path, on top of the host routing rules (lib/routes.ts): Bun's own
+ * paths go to Bun, index.html and SPA routes are the rewritten page, public files come from
+ * `publicDirs` (first match wins; index.html is always the page).
+ */
+export declare function routeDevRequest(pathname: string, publicDirs: string[], hmrPath?: string): DevRoute;
+/** .akan/native/dev/server.ts: Bun's dev server for the entry, reporting its port on stdout. */
+export declare function bunDevServerScript(entry: string): string;
+export interface HmrContext {
+    project: Project;
+    /** web: the /__akan_native/init.js text. Native hosts serve their own. */
+    initScript?: () => string;
+}
+export interface HmrOptions {
+    platform: Platform;
+    /** The app's source HTML for Bun's dev server; unused with `upstream`. */
+    entry?: string;
+    /** An external dev server's origin (akanjs readiness O4-1), proxied instead of Bun's dev server. */
+    upstream?: string;
+    /** The HMR socket path the page opens (O4-2). Default Bun's /_bun/hmr. */
+    hmrPath?: string;
+    /**
+     * The app's own WebSocket paths (W4), e.g. ["/ws"]: a socket the page opens on its origin to one of
+     * them goes through the gateway to the dev server (`upstream`), so a real iPhone reaches the Mac's
+     * server as it does the pages.
+     */
+    wsPaths?: string[];
+    /** The host the app reaches the gateway at: a LAN address for a real iPhone (O4-3). Default the loopback name. */
+    publicHost?: string;
+    /** 0 = any free port. */
+    port: number;
+    hostname: string;
+    /** Read on every request: akan-native dev replaces the project and init.js after a config change. */
+    context: HmrContext;
+    /** Bun's dev server output. */
+    onLine: (line: string) => void;
+    /** Gateway problems (each text once). */
+    onWarning: (text: string) => void;
+}
+export interface HmrServer {
+    /** The gateway, e.g. http://127.0.0.1:52011 */
+    url: string;
+    port: number;
+    /** Rejects when Bun's dev server ends on its own. */
+    exited: Promise<number>;
+    stop(): void;
+}
+export declare function startHmrServer(opts: HmrOptions): Promise<HmrServer>;
+/** The Mac's private IPv4 address on a network (Wi-Fi or Ethernet), for a real iPhone (O4-3). */
+export declare function lanAddress(interfaces?: NodeJS.Dict<import("node:os").NetworkInterfaceInfo[]>): string | undefined;

package/types/vendor/@akanjs/native/packages/cli/src/lib/html.d.ts

@@ -0,0 +1,20 @@
+export declare const INIT_SCRIPT_PATH = "__akan_native/init.js";
+/**
+ * Inserts `<script src="/__akan_native/init.js">` as the first element of <head> (IN-3).
+ * A classic, non-async script runs before the inlined module bundle, so the
+ * boot data is ready synchronously.
+ */
+export declare function injectInitScript(html: string, base?: string): string;
+/**
+ * Dev builds (architecture review stage 5, an always-on error path; RN JsErrorHandler): errors of the
+ * page before @akanjs/native/core runs (a bundle that fails to parse or throws at the top) would reach no log.
+ * This collects them in `__AKAN_NATIVE__.early`; core sends them to the host log when it loads
+ * (runtime.ts flushEarlyErrors). If core never loads, the page reports them itself after 5 s: to the
+ * desktop host over /__akan_native/ipc, to iOS over the message handler, and on Android to logcat (the
+ * WebView's console already goes there). The first error keeps its stack; later ones their message.
+ */
+export declare const EARLY_ERRORS_SCRIPT: string;
+/** Puts the early error collector right after the init.js tag (dev builds). */
+export declare function injectEarlyErrors(html: string): string;
+/** External `<script src>` (other than init.js) break the single-file rule (IN-2). */
+export declare function findExternalScripts(html: string): string[];

package/types/vendor/@akanjs/native/packages/cli/src/lib/icons.d.ts

@@ -0,0 +1,44 @@
+import { type Rgba } from "./image.ts";
+import { type Image } from "./png.ts";
+import type { ResolvedConfig } from "./project.ts";
+/** Splash image box on iOS (points) and Android (dp): a square that fits the 192dp splash circle. */
+export declare const SPLASH_BOX = 136;
+export declare function readPng(path: string, what: string): Image;
+export interface IconArt {
+    /** 1024×1024 RGBA. */
+    master: Image;
+    /** Fills transparent areas where a platform needs an opaque icon (iOS, Android adaptive background). */
+    background: Rgba;
+}
+export declare function iconArt(config: ResolvedConfig): IconArt | null;
+export declare function splashArt(config: ResolvedConfig): Image | null;
+/**
+ * Full-bleed (opaque) sources get the macOS icon grid: an 824px rounded square with a 185px
+ * radius centered in 1024px, as in Apple's Big Sur template. Transparent sources are used as is.
+ */
+export declare function macosIconImage(art: IconArt): Image;
+export declare function icns(image: Image): Uint8Array;
+/** An .ico with PNG entries (Windows Vista and later read PNG-compressed icon images). */
+export declare function ico(image: Image): Uint8Array;
+/**
+ * The window icon for Windows and Linux (tao's Icon::from_rgba), read by native/desktop at
+ * startup: [u32 width LE][u32 height LE][RGBA pixels]. No image decoder in the shell this way.
+ */
+export declare function windowIcon(image: Image, size?: number): Uint8Array;
+/**
+ * Writes Assets.xcassets for actool: AppIcon (one 1024 universal image; actool derives the rest),
+ * AkanNativeSplashBackground (light/dark) and AkanNativeSplash (the splash image at 1x/2x/3x) for UILaunchScreen.
+ * Returns the asset names the Info.plist may refer to.
+ */
+export declare function writeIosAssets(dir: string, config: ResolvedConfig): {
+    appIcon: boolean;
+    splashImage: boolean;
+};
+/**
+ * Writes res/ for aapt2 compile: the theme (window and splash background, splash icon), the
+ * adaptive launcher icon and colors with a night variant. Only xxxhdpi bitmaps: the system
+ * scales them down for lower densities.
+ */
+export declare function writeAndroidRes(dir: string, config: ResolvedConfig): {
+    icon: boolean;
+};

package/types/vendor/@akanjs/native/packages/cli/src/lib/image.d.ts

@@ -0,0 +1,21 @@
+import type { Image } from "./png.ts";
+export type Rgba = [number, number, number, number];
+/** "#rrggbb" or "#rrggbbaa" → [r, g, b, a], or null. */
+export declare function parseColor(text: string): Rgba | null;
+export declare function toHex([r, g, b]: Rgba): string;
+export declare function blank(width: number, height: number, color?: Rgba): Image;
+export declare function isOpaque(image: Image): boolean;
+/** Top-left pixel: the background of a full-bleed icon. */
+export declare function cornerColor(image: Image): Rgba;
+export declare function resize(image: Image, width: number, height: number): Image;
+/** Draws `top` over `bottom` at (x, y), source-over. */
+export declare function drawOver(bottom: Image, top: Image, x: number, y: number): Image;
+/** A size×size transparent canvas with the image scaled to fit a box×box square in its center. */
+export declare function contain(image: Image, size: number, box: number): Image;
+/** The image composited on an opaque color (iOS app icons must not be transparent). */
+export declare function flatten(image: Image, color: Rgba): Image;
+/**
+ * Keeps only a centered rounded rectangle (inset from each edge, corner radius in pixels),
+ * anti-aliased with a signed distance per pixel.
+ */
+export declare function roundedMask(image: Image, inset: number, radius: number): Image;

package/types/vendor/@akanjs/native/packages/cli/src/lib/iossigning.d.ts

@@ -0,0 +1,81 @@
+import { type PlistValue } from "./plist.ts";
+export interface SigningIdentity {
+    /** The certificate's SHA-1, which codesign takes without ambiguity. */
+    sha1: string;
+    /** e.g. "Apple Development: Jane Doe (ABCDE12345)". */
+    name: string;
+}
+export type ProfileKind = "development" | "ad-hoc" | "app-store" | "enterprise";
+export interface ProvisioningProfile {
+    path: string;
+    name: string;
+    uuid: string;
+    teamId: string;
+    /** application-identifier, e.g. "TEAMID.com.akanjs.sample" or "TEAMID.*". */
+    appId: string;
+    entitlements: Record<string, PlistValue>;
+    expires: Date;
+    kind: ProfileKind;
+    /** Device UDIDs (development and ad-hoc). */
+    devices: string[];
+    /** SHA-1 of the certificates the profile allows to sign. */
+    certificates: string[];
+}
+/** Valid code signing identities (`security find-identity -v`: revoked and expired ones are left out). */
+export declare function signingIdentities(): Promise<SigningIdentity[]>;
+export declare function parseIdentities(out: string): SigningIdentity[];
+/**
+ * The identity to sign with: `wanted` as a SHA-1 or a name (a name two valid certificates share is an
+ * error), else the only valid "Apple Development" (development) or "Apple Distribution" identity.
+ */
+export declare function pickIdentity(identities: SigningIdentity[], kind: "development" | "distribution", wanted?: string): SigningIdentity;
+/** The folders Xcode and older tools keep provisioning profiles in. */
+export declare function profileFolders(home?: string): string[];
+/** Decodes a .mobileprovision (a CMS-signed plist). */
+export declare function readProfile(path: string): Promise<ProvisioningProfile>;
+/** A profile from its decoded plist (parsePlist: data as base64, dates as Date). */
+export declare function profileFromPlist(path: string, p: Record<string, unknown>): ProvisioningProfile;
+/** Whether a profile's application-identifier covers the bundle id (exactly, or a wildcard like TEAM.* or TEAM.com.akanjs.*). */
+export declare function profileCovers(profile: ProvisioningProfile, bundleId: string): "exact" | "wildcard" | null;
+/** The profiles in Xcode's folders; unreadable ones are left out. */
+export declare function localProfiles(): Promise<ProvisioningProfile[]>;
+export interface SigningQuery {
+    bundleId: string;
+    /** development for run and dev; app-store for release, ad-hoc only when asked for. */
+    kinds: ProfileKind[];
+    identityKind: "development" | "distribution";
+    /** Only this team's profiles. */
+    teamId?: string;
+    /** A certificate name or SHA-1: only it. */
+    identity?: string;
+    /** The iPhone the build goes on: development and ad hoc profiles must list it. */
+    device?: {
+        udid: string;
+        name?: string;
+    };
+    /** The entitlements the app asks for, as signing with this profile would request them. */
+    entitlementsFor(profile: ProvisioningProfile): Record<string, PlistValue>;
+    now?: Date;
+}
+export interface SigningChoice {
+    identity: SigningIdentity;
+    profile: ProvisioningProfile;
+}
+/**
+ * The identity and profile an iPhone build signs with (D7 step 1: what Xcode made on this Mac;
+ * docs/api.md §3 "Finding the signing"). A profile fits when it covers the bundle id (a wildcard
+ * only when the app asks for neither push nor associated domains), is of the wanted kind, has not
+ * expired, belongs to `teamId` when one is given, lists `device` when it is a development or ad hoc
+ * profile, allows every entitlement the app asks for, and one of its certificates is a valid identity
+ * in the keychain (or the chosen one). Of the fitting ones,
+ * exact bundle ids beat wildcards; then several teams, or several certificates, are not decided
+ * here: the error lists the candidates. One team and one certificate: the profile that expires last
+ * (Xcode makes a new one when it renews).
+ */
+export declare function chooseSigning(identities: SigningIdentity[], profiles: ProvisioningProfile[], q: SigningQuery): SigningChoice;
+/**
+ * Entitlements the app asks for that the profile does not allow (App Store Connect and the device
+ * refuse such a signature). A profile lists what the App ID has: an array value there is a set of
+ * allowed values, where "*" or "TEAM.*" allows any.
+ */
+export declare function entitlementProblems(requested: Record<string, PlistValue>, profile: ProvisioningProfile): string[];

package/types/vendor/@akanjs/native/packages/cli/src/lib/launch.d.ts

@@ -0,0 +1,51 @@
+export interface LaunchOptions {
+    /** Runtime env overrides (dev builds), e.g. { AKAN_NATIVE_PUBLIC_SELFTEST: "1" }. */
+    env: Record<string, string>;
+    /** Do not open windows or steal focus where the platform allows it. */
+    headless: boolean;
+    /** Receives every log line. Default: print it. */
+    onLine?: (line: string) => void;
+}
+/** A simulator, emulator or device an app can run on (docs/api.md devices). */
+export interface Device {
+    platform: "ios" | "android";
+    /** A simulator's UDID, a paired iPhone's devicectl id, an adb serial, or the name of an AVD that is not running. */
+    id: string;
+    name: string;
+    kind: "simulator" | "emulator" | "device";
+    /** "26.5" on iOS; "Android 17 (API 37)" for a running Android device, "API 37" for an AVD that is not. */
+    os: string;
+    /**
+     * booted / shutdown (simulators, AVDs), connected (a paired iPhone, an adb device), unavailable (a
+     * paired iPhone out of reach), unpaired (an iPhone this Mac is not paired with), unauthorized (an
+     * Android device that has not allowed USB debugging), offline.
+     */
+    state: "booted" | "shutdown" | "connected" | "unavailable" | "unpaired" | "unauthorized" | "offline";
+}
+/** Which device: a name or id as text, or one of these. `{ kind }` takes the first one of the kind, running ones first. */
+export type DeviceSelector = string | {
+    id: string;
+} | {
+    name: string;
+} | {
+    kind: Device["kind"];
+};
+export interface Launched {
+    /** Resolves with the exit code once the app (or log stream) ends. */
+    exited: Promise<number>;
+    stop(): void;
+    /** Where the app runs (iOS and Android). */
+    device?: Device;
+}
+/** Splits a byte stream into lines and hands each to `onLine`. */
+export declare function pipeLines(stream: ReadableStream<Uint8Array> | null | undefined, onLine: (line: string) => void): Promise<void>;
+export declare const printLine: (line: string) => void;
+/** AKAN_NATIVE_PUBLIC_* variables of the CLI's own environment. */
+export declare function envFromProcess(): Record<string, string>;
+/**
+ * Calls `handler` once on Ctrl+C, kill or a closed terminal and returns a function that unregisters it.
+ * Spawned children (the app, logcat, simctl log stream, Chrome) outlive a CLI that dies of a signal.
+ */
+export declare function onStopSignal(handler: () => void): () => void;
+/** Waits for a launched app and stops it when the CLI is interrupted. */
+export declare function follow(app: Launched): Promise<number>;

package/types/vendor/@akanjs/native/packages/cli/src/lib/log.d.ts

@@ -0,0 +1,42 @@
+export type LogLevel = "step" | "info" | "ok" | "warn" | "error" | "tool";
+export interface LogEvent {
+    level: LogLevel;
+    message: string;
+    /** For "tool": whose output the line is ("web-build", "swiftc", "kotlinc", "cargo" …). */
+    tool?: string;
+    time: number;
+}
+export type LogSink = (event: LogEvent) => void;
+/** Runs `fn` with its log going to `sink` (none: dropped) instead of the terminal. */
+export declare function withLogSink<T>(sink: LogSink | undefined, fn: () => T): T;
+/** Whether output goes to the terminal (the CLI), not to an API caller's sink. */
+export declare function isTerminal(): boolean;
+export declare const dim: (text: string) => string;
+export declare const bold: (text: string) => string;
+export declare const green: (text: string) => string;
+export declare const yellow: (text: string) => string;
+export declare const red: (text: string) => string;
+export declare const cyan: (text: string) => string;
+export declare const log: {
+    step: (text: string) => void;
+    info: (text: string) => void;
+    ok: (text: string) => void;
+    warn: (text: string) => void;
+    error: (text: string) => void;
+    /** A line of a child process's output (web build, compilers) that the terminal would show as is. */
+    tool: (tool: string, line: string) => void;
+};
+/** An error whose message is shown to the user without a stack trace. */
+export declare class CliError extends Error {
+    readonly exitCode: number;
+    constructor(message: string, exitCode?: number);
+}
+/** A required toolchain (SDK, JDK, kotlinc, simulator runtime) is missing (AkanNativeError TOOLCHAIN_MISSING). */
+export declare class ToolchainError extends CliError {
+    constructor(message: string);
+}
+/** A command that failed: its last output lines travel with the error (AkanNativeError.logTail). */
+export declare class ToolError extends CliError {
+    readonly tail: string[];
+    constructor(message: string, tail: string[]);
+}

package/types/vendor/@akanjs/native/packages/cli/src/lib/macossigning.d.ts

@@ -0,0 +1,95 @@
+import { type PlistValue } from "./plist.ts";
+import { type SigningIdentity } from "./signing.ts";
+export interface MacosSigning {
+    /** A certificate name ("Developer ID Application: Name (TEAMID)") or its SHA-1, in a keychain already. */
+    identity?: string;
+    /** A .p12 holding the identity: imported into a keychain of its own for the build, then removed. */
+    certificate?: {
+        path: string;
+        password: string;
+    };
+}
+/** App Store Connect API key (key, keyId, issuer), or a profile `xcrun notarytool store-credentials` saved. */
+export interface MacosNotarization {
+    /** The AuthKey_<id>.p8 file. */
+    key?: string;
+    keyId?: string;
+    /** The issuer id; left out for an individual API key. */
+    issuer?: string;
+    profile?: string;
+}
+export interface MacosBuild {
+    signing?: MacosSigning;
+    /** Release builds signed with a Developer ID only. */
+    notarize?: MacosNotarization;
+    /** A .dmg beside the app, with an Applications link; signed and notarized as the app is. */
+    dmg?: boolean;
+}
+export type MacosSignature = "adhoc" | "identity" | "development" | "distribution";
+export interface ResolvedMacosIdentity {
+    /** The certificate's SHA-1, or "-" for ad hoc. */
+    sign: string;
+    name: string;
+    kind: MacosSignature;
+    teamId?: string;
+    /** Set when the identity lives in a keychain made for this build. */
+    keychain?: string;
+}
+/**
+ * Entitlements the hardened runtime needs for the app's own code: Bun's JavaScriptCore writes JIT code, and the
+ * TCC resources the Info.plist asks for are refused to a hardened app that does not claim them.
+ */
+export declare const RUNTIME_ENTITLEMENTS: Record<string, PlistValue>;
+/** The main executable's entitlements: the runtime's, those of the usage texts in `infoPlist`, then the app's own. */
+export declare function appEntitlements(infoPlist: Record<string, PlistValue>, extra?: Record<string, PlistValue>): Record<string, PlistValue>;
+/**
+ * The kind of a certificate by its name. A Developer ID's parentheses hold the team id; an Apple Development
+ * certificate's hold the member's own id, so its team is not read from the name.
+ */
+export declare function identityKind(name: string): {
+    kind: MacosSignature;
+    teamId?: string;
+};
+/** The identity `wanted` names (a name or a SHA-1) among `identities`. */
+export declare function pickMacosIdentity(identities: SigningIdentity[], wanted: string): SigningIdentity;
+/**
+ * Runs `fn` with the identity `signing` names, or ad hoc without one. A certificate file goes into a keychain made for
+ * this build (on the user's search list meanwhile, so codesign finds its chain), deleted afterwards.
+ */
+export declare function withMacosIdentity<T>(signing: MacosSigning | undefined, fn: (identity: ResolvedMacosIdentity) => Promise<T>, fallback: () => Promise<ResolvedMacosIdentity>): Promise<T>;
+export interface CodesignOptions {
+    /** The hardened runtime and a secure timestamp, what notarization requires of every Mach-O file. */
+    hardened: boolean;
+    /** A secure timestamp without the runtime (a disk image). Default: `hardened`. */
+    timestamp?: boolean;
+    entitlements?: string;
+}
+/** codesign arguments for one file. Apple's timestamp server only stamps certificates Apple issued. */
+export declare function codesignArgs(identity: ResolvedMacosIdentity, file: string, options: CodesignOptions): string[];
+export declare function codesign(identity: ResolvedMacosIdentity, file: string, options: CodesignOptions): Promise<void>;
+export declare function writeEntitlements(dir: string, entitlements: Record<string, PlistValue>): string;
+export declare function notarytoolAuth(notarization: MacosNotarization): string[];
+interface NotarySubmission {
+    id?: string;
+    status?: string;
+    message?: string;
+}
+/** Submits `file` (a .zip, .dmg or .pkg), waits for Apple's verdict and refuses anything but Accepted. */
+export declare function notarize(file: string, notarization: MacosNotarization): Promise<string>;
+export declare function parseSubmission(stdout: string): NotarySubmission;
+/** One line per issue of a notarytool log: the file and Apple's message. */
+export declare function notaryLogIssues(stdout: string): string[];
+export declare function staple(file: string): Promise<void>;
+/** The .app as notarytool takes it: a zip that keeps the bundle's symlinks and signature. */
+export declare function zipForNotary(appPath: string, zip: string): Promise<void>;
+/** A compressed disk image of the app beside a link to /Applications, the window people drag it into. */
+export declare function buildDmg(appPath: string, dmgPath: string, volumeName: string, workDir: string): Promise<void>;
+/** What Gatekeeper says of a notarized app or disk image, as a downloaded copy would be judged. */
+export declare function assessGatekeeper(file: string, type: "execute" | "open"): Promise<void>;
+/**
+ * Settings from the environment for the command line (the API takes them as options only):
+ * AKAN_NATIVE_MACOS_IDENTITY, AKAN_NATIVE_MACOS_CERTIFICATE + _PASSWORD, and AKAN_NATIVE_MACOS_NOTARY_KEY +
+ * _KEY_ID + _ISSUER or AKAN_NATIVE_MACOS_NOTARY_PROFILE.
+ */
+export declare function macosDistributionFromEnv(env?: Record<string, string | undefined>): Pick<MacosBuild, "signing" | "notarize">;
+export {};

package/types/vendor/@akanjs/native/packages/cli/src/lib/manifestmerge.d.ts

@@ -0,0 +1,18 @@
+export interface LibraryManifest {
+    /** For messages. */
+    from: string;
+    xml: string;
+}
+export interface MergedManifest {
+    /** uses-permission names. */
+    permissions: string[];
+    /** XML at the <manifest> level: permission definitions and one <queries>. */
+    manifestXml: string[];
+    /** XML inside <application>: components and meta-data. */
+    applicationXml: string[];
+    /** Attributes for <application>, e.g. android:appComponentFactory. */
+    applicationAttrs: [string, string][];
+    /** Component classes, for R8 keep rules. */
+    components: string[];
+}
+export declare function mergeLibraryManifests(manifests: LibraryManifest[], applicationId: string): MergedManifest;