@akanjs/cli 3.0.0-beta.27 → 3.0.0-beta.29

package/{index-0n9q1f23.js → index-r8gp8zk3.js}

@@ -516,7 +516,7 @@ import {
   stat as stat2,
   symlink
 } from "fs/promises";
-import path8 from "path";
+import path9 from "path";
 import { pathToFileURL } from "url";
 import {
   capitalize,
@@ -668,17 +668,83 @@ var renderScopeClaudeMd = (scope) => `# ${scope.name} \u2014 Claude Code Guide
 ${CLAUDE_COMMENT_RULE}
 `;
 
-// pkgs/@akanjs/devkit/akanConfig/akanConfig.ts
-import fs2 from "fs";
+// pkgs/@akanjs/devkit/akanConfig/akanBin.ts
 import path4 from "path";
-import { fileURLToPath } from "url";
-import { DatabaseModes, normalizeRoutePrefix } from "akanjs/base";
-import { resolveAkanI18nConfig } from "akanjs/common";
 
 // pkgs/@akanjs/devkit/akanConfig/types.ts
-import { archs } from "akanjs";
+import { archs, binPlatforms } from "akanjs";
 
+// pkgs/@akanjs/devkit/akanConfig/akanBin.ts
+class AkanBin {
+  static archive = /\.(zip|tar\.gz|tgz|tar\.xz|txz|tar\.bz2|tbz2|tar)$/i;
+  static fileName = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+  static parse(declared, owner, baseDir) {
+    if (declared === undefined)
+      return {};
+    if (!declared || typeof declared !== "object" || Array.isArray(declared))
+      throw new Error(`${owner}: bin maps each executable's name to its platforms`);
+    return Object.fromEntries(Object.entries(declared).map(([name, platforms]) => [name, AkanBin.#platforms(name, platforms, owner, baseDir)]));
+  }
+  static isArchive(source) {
+    return AkanBin.archive.test("url" in source ? new URL(source.url).pathname : source.path);
+  }
+  static #platforms(name, platforms, owner, baseDir) {
+    if (!AkanBin.fileName.test(name))
+      throw new Error(`${owner}: bin.${name} is not a file name`);
+    if (!platforms || typeof platforms !== "object" || Array.isArray(platforms))
+      throw new Error(`${owner}: bin.${name} maps platforms (${binPlatforms.join(", ")}) to where the file comes from`);
+    const resolved = {};
+    for (const [platform, source] of Object.entries(platforms)) {
+      if (!binPlatforms.includes(platform))
+        throw new Error(`${owner}: bin.${name}.${platform} is not one of ${binPlatforms.join(", ")}`);
+      resolved[platform] = AkanBin.#source(`${owner}: bin.${name}.${platform}`, source, baseDir);
+    }
+    return resolved;
+  }
+  static #source(at, source, baseDir) {
+    if (!source || typeof source !== "object" || Array.isArray(source))
+      throw new Error(`${at} must be { url, sha256 } or { path }`);
+    const { url, sha256, path: localPath, file, ...rest } = source;
+    const extra = Object.keys(rest);
+    if (extra.length)
+      throw new Error(`${at}: unknown key ${extra.join(", ")}`);
+    if (url === undefined === (localPath === undefined))
+      throw new Error(`${at} takes either url and sha256, or path`);
+    const resolved = url !== undefined ? AkanBin.#urlSource(at, url, sha256) : AkanBin.#pathSource(at, localPath, sha256, baseDir);
+    const archive = AkanBin.isArchive(resolved);
+    if (file === undefined) {
+      if (archive)
+        throw new Error(`${at} names an archive: file picks the executable inside it`);
+      return resolved;
+    }
+    if (!archive)
+      throw new Error(`${at}: file picks the executable out of an archive, and this source is none`);
+    const parts = typeof file === "string" ? file.split(/[\\/]/).filter((part) => part && part !== ".") : [];
+    if (!parts.length || path4.isAbsolute(file) || parts.includes(".."))
+      throw new Error(`${at}: file must be a path inside the archive (got ${JSON.stringify(file)})`);
+    return { ...resolved, file: parts.join("/") };
+  }
+  static #urlSource(at, url, sha256) {
+    if (typeof url !== "string" || !URL.canParse(url) || !/^https?:$/.test(new URL(url).protocol))
+      throw new Error(`${at}: url must be an http(s) address`);
+    if (typeof sha256 !== "string" || !/^[0-9a-f]{64}$/i.test(sha256))
+      throw new Error(`${at}: sha256 must be the downloaded file's 64-digit hex digest`);
+    return { url, sha256: sha256.toLowerCase() };
+  }
+  static #pathSource(at, localPath, sha256, baseDir) {
+    if (typeof localPath !== "string" || !localPath)
+      throw new Error(`${at}: path must name a file`);
+    if (sha256 !== undefined)
+      throw new Error(`${at}: sha256 checks a download, and a path source downloads nothing`);
+    return { path: path4.resolve(baseDir, localPath) };
+  }
+}
 // pkgs/@akanjs/devkit/akanConfig/akanConfig.ts
+import fs2 from "fs";
+import path5 from "path";
+import { fileURLToPath } from "url";
+import { DatabaseModes, normalizeRoutePrefix } from "akanjs/base";
+import { resolveAkanI18nConfig } from "akanjs/common";
 var DEFAULT_BARREL_IMPORTS = ["akanjs/webkit", "akanjs/common", "akanjs/ui", "akanjs/server"];
 var DEFAULT_OPTIMIZE_IMPORTS = [
   "lucide-react date-fns lodash-es ramda antd react-bootstrap ahooks @ant-design/icons @headlessui/react",
@@ -750,9 +816,18 @@ var normalizeDeepLinks = (deepLinks) => {
 };
 var emptyLibContributions = () => ({
   externalLibs: [],
+  trustedDependencies: [],
+  bin: [],
   docker: { preRuns: [], postRuns: [] },
   keepFonts: []
 });
+var normalizePackageNames = (names, owner) => {
+  if (names === undefined)
+    return [];
+  if (!Array.isArray(names) || names.some((name) => typeof name !== "string" || !name.trim()))
+    throw new Error(`${owner}: trustedDependencies lists package names`);
+  return [...new Set(names.map((name) => name.trim()))];
+};
 var normalizeKeepFonts = (keepFonts) => [
   ...new Set((keepFonts ?? []).map((glob) => glob.trim().replace(/^\/+/, "")).filter(Boolean))
 ];
@@ -771,6 +846,9 @@ class AkanAppConfig {
   database;
   web;
   externalLibs;
+  trustedDependencies;
+  bin;
+  libBins;
   barrelImports;
   optimizeImports;
   images;
@@ -798,6 +876,15 @@ class AkanAppConfig {
     this.#applyRoutes(config?.routes);
     this.database = AkanAppConfig.#database(app, config);
     this.externalLibs = [...new Set([...config?.externalLibs ?? [], ...libContributions.externalLibs])];
+    const owner = `apps/${app.name}/akan.config.ts`;
+    this.trustedDependencies = [
+      ...new Set([
+        ...normalizePackageNames(config?.trustedDependencies, owner),
+        ...libContributions.trustedDependencies ?? []
+      ])
+    ];
+    this.bin = AkanBin.parse(config?.bin, owner, app.cwdPath);
+    this.libBins = libContributions.bin ?? [];
     this.barrelImports = [
       ...DEFAULT_BARREL_IMPORTS,
       ...WORKSPACE_BARREL_FACETS.map((facet) => `@apps/${app.name}/${facet}`),
@@ -851,6 +938,7 @@ class AkanAppConfig {
     const buildNum = rawMobile.buildNum ?? 1;
     const files = AkanAppConfig.#resolveMobileFiles(rawMobile.files, "mobile", configPath);
     const native = rawMobile.native;
+    const updates = rawMobile.updates;
     const defaultTargetName = this.#defaultMobileTargetName(rawTargets);
     const targetEntries = Object.entries(rawTargets ?? {
       [defaultTargetName]: {}
@@ -868,6 +956,9 @@ class AkanAppConfig {
       }
       const targetFiles = AkanAppConfig.#resolveMobileFiles(target.files, where, configPath);
       const fileName = target.fileName ?? rawMobile.fileName;
+      const targetUpdates = updates || target.updates ? { ...updates, ...target.updates } : undefined;
+      if (targetUpdates && (!targetUpdates.url || !targetUpdates.publicKey))
+        throw new Error(`${where}.updates in ${configPath} has no url or publicKey; give them in mobile.updates or the target's own.`);
       const resolved = {
         name,
         basePath,
@@ -881,7 +972,8 @@ class AkanAppConfig {
         ...target.assets ? { assets: target.assets } : {},
         ...target.permissions ? { permissions: target.permissions } : {},
         ...files || targetFiles ? { files: { ...files, ...targetFiles } } : {},
-        ...native || target.native ? { native: AkanAppConfig.#mergeNative(native, target.native) } : {}
+        ...native || target.native ? { native: AkanAppConfig.#mergeNative(native, target.native) } : {},
+        ...targetUpdates ? { updates: targetUpdates } : {}
       };
       return [name, resolved];
     }));
@@ -893,10 +985,11 @@ class AkanAppConfig {
       buildNum,
       ...files ? { files } : {},
       ...native ? { native } : {},
+      ...updates ? { updates } : {},
       targets
     };
   }
-  static #mobileKeys = ["appName", "appId", "fileName", "version", "buildNum", "files", "native"];
+  static #mobileKeys = ["appName", "appId", "fileName", "version", "buildNum", "files", "native", "updates"];
   static #targetKeys = [
     "basePath",
     "indexPath",
@@ -909,7 +1002,8 @@ class AkanAppConfig {
     "permissions",
     "deepLinks",
     "files",
-    "native"
+    "native",
+    "updates"
   ];
   static #assertMobileKeys(section, known, where, configPath) {
     for (const key of Object.keys(section)) {
@@ -946,10 +1040,21 @@ class AkanAppConfig {
       else
         delete android[key];
     }
+    const pushAndroid = { ...base?.push?.android, ...override?.push?.android };
+    const privacy = { ...base?.privacy, ...override?.privacy };
+    const window = { ...base?.desktop?.window, ...override?.desktop?.window };
+    const desktop = {
+      ...base?.desktop,
+      ...override?.desktop,
+      ...Object.keys(window).length ? { window } : {}
+    };
     return {
       ...plugins.length ? { plugins } : {},
       ...Object.keys(ios).length ? { ios } : {},
-      ...Object.keys(android).length ? { android } : {}
+      ...Object.keys(android).length ? { android } : {},
+      ...Object.keys(pushAndroid).length ? { push: { android: pushAndroid } } : {},
+      ...Object.keys(privacy).length ? { privacy } : {},
+      ...Object.keys(desktop).length ? { desktop } : {}
     };
   }
   #defaultMobileTargetName(rawTargets) {
@@ -1004,18 +1109,37 @@ class AkanAppConfig {
       command: docker?.command ?? ["bun", "main.js"]
     };
   }
-  #makeDockerfile() {
+  getProductionEnv(environment = this.baseDevEnv.env) {
+    return {
+      PORT: "8282",
+      NODE_ENV: "production",
+      AKAN_PUBLIC_REPO_NAME: this.baseDevEnv.repoName,
+      AKAN_PUBLIC_SERVE_DOMAIN: this.baseDevEnv.serveDomain,
+      AKAN_PUBLIC_APP_NAME: this.app.name,
+      AKAN_PUBLIC_ENV: environment,
+      ...this.basePaths.size ? { AKAN_PUBLIC_BASE_PATHS: [...this.basePaths].join(",") } : {},
+      AKAN_PUBLIC_DEFAULT_LOCALE: this.i18n.defaultLocale,
+      AKAN_PUBLIC_LOCALES: this.i18n.locales.join(","),
+      AKAN_PUBLIC_API_PREFIX: this.api.prefix,
+      AKAN_PUBLIC_WS_PREFIX: this.api.websocketPrefix,
+      AKAN_PUBLIC_OPERATION_MODE: "cloud",
+      AKAN_DATABASE_MODES: this.database.modes.join(","),
+      AKAN_LOG_TO_FILE: "0",
+      ...this.web.ssr ? {} : { AKAN_SSR: "false" },
+      ...this.web.csr ? {} : { AKAN_CSR: "false" }
+    };
+  }
+  dockerfileFor(environment) {
+    return this.#makeDockerfile(environment);
+  }
+  #makeDockerfile(environment) {
     if (typeof this.docker === "string")
       return this.docker;
     const { image, preRuns, postRuns, command } = this.docker;
     const preRunScripts = this.#getDockerRunScripts(preRuns);
     const postRunScripts = this.#getDockerRunScripts(postRuns);
     const imageScript = this.#getDockerImageScript(image, DEFAULT_DOCKER_IMAGE);
-    const webEnvLines = [
-      ...this.web.ssr ? [] : ["ENV AKAN_SSR=false"],
-      ...this.web.csr ? [] : ["ENV AKAN_CSR=false"]
-    ].join(`
-`);
+    const envLines = Object.entries(this.getProductionEnv(environment)).map(([key, value]) => `ENV ${key}=${value}`);
     return `${imageScript}
 RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends ca-certificates tzdata && rm -rf /var/lib/apt/lists/*
 RUN ln -sf /usr/share/zoneinfo/Asia/Seoul /etc/localtime
@@ -1029,21 +1153,8 @@ RUN bun install --production
 ${postRunScripts.join(`
 `)}
 COPY . .
-ENV PORT=8282
-ENV NODE_ENV=production
-ENV AKAN_PUBLIC_REPO_NAME=${this.baseDevEnv.repoName}
-ENV AKAN_PUBLIC_SERVE_DOMAIN=${this.baseDevEnv.serveDomain}
-ENV AKAN_PUBLIC_APP_NAME=${this.app.name}
-ENV AKAN_PUBLIC_ENV=${this.baseDevEnv.env}
-${this.basePaths.size ? `ENV AKAN_PUBLIC_BASE_PATHS=${[...this.basePaths].join(",")}` : ""}
-ENV AKAN_PUBLIC_DEFAULT_LOCALE=${this.i18n.defaultLocale}
-ENV AKAN_PUBLIC_LOCALES=${this.i18n.locales.join(",")}
-ENV AKAN_PUBLIC_API_PREFIX=${this.api.prefix}
-ENV AKAN_PUBLIC_WS_PREFIX=${this.api.websocketPrefix}
-ENV AKAN_PUBLIC_OPERATION_MODE=cloud
-ENV AKAN_DATABASE_MODES=${this.database.modes.join(",")}
-ENV AKAN_LOG_TO_FILE=0
-${webEnvLines}
+${envLines.join(`
+`)}
 CMD [${command.map((c) => `"${c}"`).join(",")}]`;
   }
   static #importGeneration = 0;
@@ -1055,7 +1166,7 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
   static async from(app, { bustImportCache = false } = {}) {
     const [configImp, baseDevEnv, libs, rootPackageJson] = await Promise.all([
       AkanAppConfig.importConfigModule(app.cwdPath, { bustImportCache }),
-      WorkspaceExecutor.getBaseDevEnv(path4.join(app.workspace.workspaceRoot, ".env")),
+      WorkspaceExecutor.getBaseDevEnv(path5.join(app.workspace.workspaceRoot, ".env")),
       app.workspace.getLibs(),
       app.workspace.getPackageJson()
     ]);
@@ -1071,6 +1182,8 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
     })));
     return {
       externalLibs: libConfigs.flatMap((libConfig) => libConfig?.externalLibs ?? []),
+      trustedDependencies: libConfigs.flatMap((libConfig) => libConfig?.trustedDependencies ?? []),
+      bin: libConfigs.flatMap((libConfig) => libConfig && Object.keys(libConfig.bin).length ? [{ lib: libConfig.lib.name, bin: libConfig.bin }] : []),
       docker: {
         preRuns: libConfigs.flatMap((libConfig) => libConfig?.docker.preRuns ?? []),
         postRuns: libConfigs.flatMap((libConfig) => libConfig?.docker.postRuns ?? [])
@@ -1133,6 +1246,7 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
         lib,
         this.#resolveProductionDependencyVersion(lib)
       ])),
+      ...this.trustedDependencies.length ? { trustedDependencies: this.trustedDependencies } : {},
       ...data
     };
   }
@@ -1141,11 +1255,11 @@ var akanPackageJson = null;
 function getAkanPackageJson() {
   if (akanPackageJson)
     return akanPackageJson;
-  const sourceDir = path4.dirname(fileURLToPath(import.meta.url));
+  const sourceDir = path5.dirname(fileURLToPath(import.meta.url));
   const packageJsonPaths = [
-    path4.join(sourceDir, "../../../akanjs/package.json"),
-    path4.join(process.cwd(), "pkgs/akanjs/package.json"),
-    path4.join(path4.dirname(Bun.main), "node_modules/akanjs/package.json")
+    path5.join(sourceDir, "../../../akanjs/package.json"),
+    path5.join(process.cwd(), "pkgs/akanjs/package.json"),
+    path5.join(path5.dirname(Bun.main), "node_modules/akanjs/package.json")
   ];
   try {
     packageJsonPaths.unshift(Bun.resolveSync("akanjs/package.json", sourceDir));
@@ -1180,12 +1294,17 @@ function mergeImageConfig(config = {}) {
 class AkanLibConfig {
   lib;
   externalLibs;
+  trustedDependencies;
+  bin;
   docker;
   assets;
   plugins;
   constructor(lib, config, plugins = []) {
     this.lib = lib;
     this.externalLibs = config?.externalLibs ?? [];
+    const owner = `libs/${lib.name}/akan.config.ts`;
+    this.trustedDependencies = normalizePackageNames(config?.trustedDependencies, owner);
+    this.bin = AkanBin.parse(config?.bin, owner, lib.cwdPath);
     this.docker = { preRuns: config?.docker?.preRuns ?? [], postRuns: config?.docker?.postRuns ?? [] };
     this.assets = { keepFonts: normalizeKeepFonts(config?.assets?.keepFonts) };
     this.plugins = plugins;
@@ -1200,7 +1319,7 @@ class AkanLibConfig {
 //! need to refactor
 var shiftBuildNum = async (app, delta) => {
   const { buildNum } = (await AkanAppConfig.from(app)).mobile;
-  const akanConfigPath = path4.join(app.cwdPath, "akan.config.ts");
+  const akanConfigPath = path5.join(app.cwdPath, "akan.config.ts");
   const akanConfig = fs2.readFileSync(akanConfigPath, "utf8");
   fs2.writeFileSync(akanConfigPath, akanConfig.replace(`buildNum: ${buildNum}`, `buildNum: ${buildNum + delta}`));
 };
@@ -1209,7 +1328,7 @@ var decreaseBuildNum = async (app) => await shiftBuildNum(app, -1);
 // pkgs/@akanjs/devkit/linter.ts
 import { spawn } from "child_process";
 import { existsSync, readFileSync } from "fs";
-import path5 from "path";
+import path6 from "path";
 import chalk from "chalk";
 var parseBiomeReport = (output) => {
   for (let start = output.indexOf("{");start !== -1; start = output.indexOf("{", start + 1)) {
@@ -1275,13 +1394,13 @@ class Linter {
   #biomeBin;
   constructor(cwdPath) {
     this.lintRoot = this.#findBiomeRootPath(cwdPath);
-    this.configPath = Linter.#configPathIn(this.lintRoot) ?? path5.join(this.lintRoot, "biome.json");
-    const localBiomeBin = path5.join(this.lintRoot, "node_modules", ".bin", Linter.biomeBinName);
+    this.configPath = Linter.#configPathIn(this.lintRoot) ?? path6.join(this.lintRoot, "biome.json");
+    const localBiomeBin = path6.join(this.lintRoot, "node_modules", ".bin", Linter.biomeBinName);
     this.#biomeBin = existsSync(localBiomeBin) ? localBiomeBin : "biome";
   }
   static #configPathIn(dir) {
     for (const fileName of BIOME_CONFIG_FILES) {
-      const configPath = path5.join(dir, fileName);
+      const configPath = path6.join(dir, fileName);
       if (existsSync(configPath))
         return configPath;
     }
@@ -1290,19 +1409,19 @@ class Linter {
   #findBiomeRootPath(dir) {
     if (Linter.#configPathIn(dir))
       return dir;
-    const parentDir = path5.dirname(dir);
+    const parentDir = path6.dirname(dir);
     if (parentDir === dir)
       throw new Error(`biome.json not found from ${dir}`);
     return this.#findBiomeRootPath(parentDir);
   }
   #toBiomePath(filePath) {
-    const relativePath = path5.relative(this.lintRoot, filePath);
-    if (!relativePath.startsWith("..") && !path5.isAbsolute(relativePath))
+    const relativePath = path6.relative(this.lintRoot, filePath);
+    if (!relativePath.startsWith("..") && !path6.isAbsolute(relativePath))
       return relativePath;
     return filePath;
   }
   #resolveFilePath(filePath) {
-    return path5.isAbsolute(filePath) ? filePath : path5.join(this.lintRoot, filePath);
+    return path6.isAbsolute(filePath) ? filePath : path6.join(this.lintRoot, filePath);
   }
   async#runBiome(args, input) {
     return await new Promise((resolve, reject) => {
@@ -1327,7 +1446,7 @@ class Linter {
     const diagnosticPath = diagnostic.location?.path;
     if (!diagnosticPath)
       return fallbackFilePath;
-    return path5.isAbsolute(diagnosticPath) ? diagnosticPath : path5.join(this.lintRoot, diagnosticPath);
+    return path6.isAbsolute(diagnosticPath) ? diagnosticPath : path6.join(this.lintRoot, diagnosticPath);
   }
   #createLintMessage(diagnostic) {
     const start = diagnostic.location?.start;
@@ -1535,7 +1654,7 @@ ${errorText}, ${warningText} found`];
 
 // pkgs/@akanjs/devkit/repoIdentity.ts
 import { execFileSync } from "child_process";
-import path6 from "path";
+import path7 from "path";
 var resolved = new Map;
 var readRemoteName = (workspaceRoot) => {
   try {
@@ -1553,13 +1672,13 @@ var resolveRepoName = (workspaceRoot) => {
   const cached = resolved.get(workspaceRoot);
   if (cached)
     return cached;
-  const repoName = readRemoteName(workspaceRoot) ?? path6.basename(workspaceRoot);
+  const repoName = readRemoteName(workspaceRoot) ?? path7.basename(workspaceRoot);
   resolved.set(workspaceRoot, repoName);
   return repoName;
 };
 
 // pkgs/@akanjs/devkit/scanInfo.ts
-import path7 from "path";
+import path8 from "path";
 
 // pkgs/@akanjs/devkit/workspaceLayout.ts
 var appRootAllowedFiles = new Set([
@@ -1579,6 +1698,7 @@ var appRootAllowedDirs = new Set([
   "common",
   "env",
   "lib",
+  "native",
   "page",
   "plugin",
   "private",
@@ -1607,6 +1727,7 @@ var libRootAllowedDirs = new Set([
   "common",
   "env",
   "lib",
+  "native",
   "page",
   "plugin",
   "private",
@@ -1668,9 +1789,9 @@ var moduleUiFileTypes = {
   scalar: new Set(["Template", "Unit"])
 };
 var createDependencyScanner = async (exec) => (await import("./dependencyScanner-06z2dmrr.js")).TypeScriptDependencyScanner.from(exec);
-var getScanPath = (exec, relativePath) => path7.posix.join(`${exec.type}s`, exec.name, relativePath.split(path7.sep).join("/"));
+var getScanPath = (exec, relativePath) => path8.posix.join(`${exec.type}s`, exec.name, relativePath.split(path8.sep).join("/"));
 var getModuleNameFromPath = (kind, modulePath) => {
-  const dirname = path7.basename(modulePath);
+  const dirname = path8.basename(modulePath);
   return kind === "service" ? dirname.replace(/^_+/, "") : dirname;
 };
 async function assertScanConvention(exec, libRoot) {
@@ -1692,17 +1813,17 @@ async function assertScanConvention(exec, libRoot) {
       addViolation(relativePath, reason);
   for (const filename of libRoot.files)
     if (!isAllowedLibFacetRootFile(filename))
-      addViolation(path7.join("lib", filename), "unsupported lib facet root file");
+      addViolation(path8.join("lib", filename), "unsupported lib facet root file");
   for (const dirname of libRoot.dirs)
     if (dirname.startsWith("__") && !internalLibDirs.has(dirname))
-      addViolation(path7.join("lib", dirname), "unsupported internal lib folder");
+      addViolation(path8.join("lib", dirname), "unsupported internal lib folder");
   const databaseDirs = libRoot.dirs.filter((dirname) => !dirname.startsWith("_"));
   const serviceDirs = libRoot.dirs.filter((dirname) => dirname.startsWith("_") && !dirname.startsWith("__"));
   const scalarDirs = await exec.readdir("lib/__scalar");
   await Promise.all([
-    ...databaseDirs.map((dirname) => validateModuleFiles(exec, violations, "database", path7.join("lib", dirname))),
-    ...serviceDirs.map((dirname) => validateModuleFiles(exec, violations, "service", path7.join("lib", dirname))),
-    ...scalarDirs.map((dirname) => validateModuleFiles(exec, violations, "scalar", path7.join("lib/__scalar", dirname)))
+    ...databaseDirs.map((dirname) => validateModuleFiles(exec, violations, "database", path8.join("lib", dirname))),
+    ...serviceDirs.map((dirname) => validateModuleFiles(exec, violations, "service", path8.join("lib", dirname))),
+    ...scalarDirs.map((dirname) => validateModuleFiles(exec, violations, "scalar", path8.join("lib/__scalar", dirname)))
   ]);
   if (violations.length > 0) {
     throw new Error(`[scan-convention]
@@ -1714,11 +1835,11 @@ async function validateModuleFiles(exec, violations, kind, modulePath) {
   const { files, dirs } = await exec.getFilesAndDirs(modulePath);
   const moduleName = getModuleNameFromPath(kind, modulePath);
   dirs.forEach((dirname) => {
-    violations.push(`${getScanPath(exec, path7.join(modulePath, dirname))}: unsupported module folder`);
+    violations.push(`${getScanPath(exec, path8.join(modulePath, dirname))}: unsupported module folder`);
   });
   const uiModuleName = moduleName[0].toUpperCase() + moduleName.slice(1);
   for (const filename of files) {
-    const scanPath = getScanPath(exec, path7.join(modulePath, filename));
+    const scanPath = getScanPath(exec, path8.join(modulePath, filename));
     if (filename === "index.ts" || filename === "index.tsx" || /\.(test|spec)\.(ts|tsx)$/.test(filename))
       continue;
     if (filename === `${moduleName}.abstract.md`)
@@ -1791,16 +1912,16 @@ class ScanInfo {
       }
     };
     await Promise.all([
-      ...databaseDirs.map((name) => collect(path7.join("lib", name), name, "databases")),
-      ...serviceDirs.map((dirname) => collect(path7.join("lib", dirname), dirname.slice(1), "services")),
-      ...scalarDirs.map((name) => collect(path7.join("lib/__scalar", name), name, "scalars"))
+      ...databaseDirs.map((name) => collect(path8.join("lib", name), name, "databases")),
+      ...serviceDirs.map((dirname) => collect(path8.join("lib", dirname), dirname.slice(1), "services")),
+      ...scalarDirs.map((name) => collect(path8.join("lib/__scalar", name), name, "scalars"))
     ]);
     const routes = exec.type === "lib" ? [] : await exec.getPageKeys();
     const common = {
       name: exec.name,
       type: exec.type,
       repoName: exec.workspace.repoName,
-      serveDomain: WorkspaceExecutor.getBaseDevEnv(path7.join(exec.workspace.workspaceRoot, ".env")).serveDomain,
+      serveDomain: WorkspaceExecutor.getBaseDevEnv(path8.join(exec.workspace.workspaceRoot, ".env")).serveDomain,
       files,
       libDeps,
       pkgDeps,
@@ -2182,10 +2303,10 @@ class Executor {
     return this.#settle(proc, target, { redStderr: true }).then(({ code, signal }) => ({ code, signal }));
   }
   getPath(filePath) {
-    if (path8.isAbsolute(filePath))
+    if (path9.isAbsolute(filePath))
       return filePath;
     if (filePath.startsWith("."))
-      return path8.join(this.cwdPath, filePath);
+      return path9.join(this.cwdPath, filePath);
     const baseParts = this.cwdPath.split(/[\\/]/).filter(Boolean);
     const targetParts = filePath.split(/[\\/]/).filter(Boolean);
     let overlapLength = 0;
@@ -2199,7 +2320,7 @@ class Executor {
       if (isOverlap)
         overlapLength = i;
     }
-    return path8.join(this.cwdPath, ...targetParts.slice(overlapLength));
+    return path9.join(this.cwdPath, ...targetParts.slice(overlapLength));
   }
   async mkdir(dirPath) {
     const writePath = this.getPath(dirPath);
@@ -2240,7 +2361,7 @@ class Executor {
     return this;
   }
   async removeDir(dirPath) {
-    const readPath = path8.join(this.getPath(dirPath), ".");
+    const readPath = path9.join(this.getPath(dirPath), ".");
     if (await FileSys2.entryExists(readPath))
       await rm3(readPath, { recursive: true, force: true });
     this.logger.verbose(`Remove directory ${readPath}`);
@@ -2248,7 +2369,7 @@ class Executor {
   }
   async writeFile(filePath, content, { overwrite = true, silent = false } = {}) {
     const writePath = this.getPath(filePath);
-    const dir = path8.dirname(writePath);
+    const dir = path9.dirname(writePath);
     if (!await FileSys2.dirExists(dir))
       await mkdir2(dir, { recursive: true });
     let contentStr = typeof content === "string" ? content : `${JSON.stringify(content, null, 2)}
@@ -2274,7 +2395,7 @@ class Executor {
     await this.writeFile(filePath, content);
   }
   async getLocalFile(targetPath) {
-    const filePath = path8.isAbsolute(targetPath) ? targetPath : targetPath.replace(this.cwdPath, "");
+    const filePath = path9.isAbsolute(targetPath) ? targetPath : targetPath.replace(this.cwdPath, "");
     const content = await this.readFile(filePath);
     return { filePath, content };
   }
@@ -2361,9 +2482,9 @@ class Executor {
       const result = await getContent.default(scanInfo ?? null, dict, options);
       if (result === null)
         return null;
-      const filename = typeof result === "object" ? result.filename : path8.basename(targetPath).replace(".js", ".ts");
+      const filename = typeof result === "object" ? result.filename : path9.basename(targetPath).replace(".js", ".ts");
       const content = typeof result === "object" ? result.content : result;
-      const convertedTargetPath = convertPath(`${path8.dirname(targetPath)}/${filename}`);
+      const convertedTargetPath = convertPath(`${path9.dirname(targetPath)}/${filename}`);
       this.logger.verbose(`Apply template ${templatePath} to ${convertedTargetPath}`);
       return this.writeFile(convertedTargetPath, content, { overwrite });
     } else if (targetPath.endsWith(".template")) {
@@ -2372,10 +2493,10 @@ class Executor {
       const convertedContent = Object.entries(dict).reduce((data, [key, value]) => data.replace(new RegExp(`<%= ${key} %>`, "g"), value), content);
       this.logger.verbose(`Apply template ${templatePath} to ${convertedTargetPath}`);
       return this.writeFile(convertedTargetPath, convertedContent, { overwrite });
-    } else if (staticTemplateFileExtensions.has(path8.extname(targetPath).toLowerCase())) {
+    } else if (staticTemplateFileExtensions.has(path9.extname(targetPath).toLowerCase())) {
       const convertedTargetPath = convertPath(targetPath);
       const writePath = this.getPath(convertedTargetPath);
-      const dirname = path8.dirname(writePath);
+      const dirname = path9.dirname(writePath);
       if (!await FileSys2.dirExists(dirname))
         await mkdir2(dirname, { recursive: true });
       await copyFile(templatePath, writePath);
@@ -2397,7 +2518,7 @@ class Executor {
     if ((await stat2(templatePath)).isFile()) {
       const fileContent = await this.#applyTemplateFile({
         templatePath,
-        targetPath: path8.join(basePath, path8.basename(templatePath)),
+        targetPath: path9.join(basePath, path9.basename(templatePath)),
         scanInfo,
         overwrite
       }, dict, options);
@@ -2405,19 +2526,19 @@ class Executor {
     } else {
       const subdirs = await readDirEntries(templatePath);
       const fileContents = (await Promise.all(subdirs.map(async (subdir) => {
-        const subpath = path8.join(templatePath, subdir);
+        const subpath = path9.join(templatePath, subdir);
         if ((await stat2(subpath)).isFile()) {
           const fileContent = await this.#applyTemplateFile({
             templatePath: subpath,
-            targetPath: path8.join(basePath, subdir),
+            targetPath: path9.join(basePath, subdir),
             scanInfo,
             overwrite
           }, dict, options);
           return fileContent ? [fileContent] : [];
         } else
           return await this._applyTemplate({
-            basePath: path8.join(basePath, subdir),
-            template: path8.join(template, subdir),
+            basePath: path9.join(basePath, subdir),
+            template: path9.join(template, subdir),
             scanInfo,
             dict,
             overwrite,
@@ -2429,8 +2550,8 @@ class Executor {
   }
   async#resolveTemplateRoot() {
     const candidates = [
-      path8.resolve(getDirname2(import.meta.url), "templates"),
-      path8.resolve(getDirname2(import.meta.url), "../cli/templates")
+      path9.resolve(getDirname2(import.meta.url), "templates"),
+      path9.resolve(getDirname2(import.meta.url), "../cli/templates")
     ];
     for (const candidate of candidates) {
       if (await FileSys2.dirExists(candidate))
@@ -2498,11 +2619,11 @@ class Executor {
   async#resolveTypecheckWorkerEntry() {
     const dirname = getDirname2(import.meta.url);
     const candidates = [
-      path8.join(process.cwd(), "pkgs/@akanjs/devkit/typecheck/typecheck.proc.ts"),
-      path8.join(process.cwd(), "node_modules/@akanjs/devkit/typecheck/typecheck.proc.ts"),
-      path8.join(dirname, "typecheck/typecheck.proc.ts"),
-      path8.join(dirname, "typecheck.proc.js"),
-      path8.join(dirname, "typecheck.proc.ts")
+      path9.join(process.cwd(), "pkgs/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path9.join(process.cwd(), "node_modules/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path9.join(dirname, "typecheck/typecheck.proc.ts"),
+      path9.join(dirname, "typecheck.proc.js"),
+      path9.join(dirname, "typecheck.proc.ts")
     ];
     for (const candidate of candidates)
       if (await Bun.file(candidate).exists())
@@ -2622,7 +2743,7 @@ class WorkspaceExecutor extends Executor {
       await Promise.all(dirs.map(async (dir) => {
         if (dir.includes("_") || AVOID_DIRS.includes(dir))
           return;
-        const dirPath = path8.join(dirname, dir);
+        const dirPath = path9.join(dirname, dir);
         if ((await stat2(dirPath)).isDirectory()) {
           results.push(`${prefix}${dir}`);
           if (maxDepth > 0)
@@ -2653,15 +2774,15 @@ class WorkspaceExecutor extends Executor {
   async#getDirHasFile(basePath, targetFilename) {
     if (!await FileSys2.dirExists(basePath))
       return [];
-    const AVOID_DIRS = ["node_modules", "dist", "public", "webkit"];
+    const AVOID_DIRS = ["node_modules", "dist", "public", "webkit", "local"];
     const getDirs = async (dirname, maxDepth = 3, results = [], prefix = "") => {
       const dirs = await this.readdir(dirname);
       await Promise.all(dirs.map(async (dir) => {
         if (AVOID_DIRS.includes(dir))
           return;
-        const dirPath = path8.join(dirname, dir);
+        const dirPath = path9.join(dirname, dir);
         if (await FileSys2.dirExists(dirPath)) {
-          const hasTargetFile = await FileSys2.fileExists(path8.join(dirPath, targetFilename));
+          const hasTargetFile = await FileSys2.fileExists(path9.join(dirPath, targetFilename));
           if (hasTargetFile)
             results.push(`${prefix}${dir}`);
           if (maxDepth > 0)
@@ -2721,7 +2842,7 @@ class SysExecutor extends Executor {
       return [];
     const violations = [];
     for (const entry of await this.getAllFiles("**/*", { cwd: this.getPath("page") })) {
-      const relativePath = entry.split(path8.sep).join("/");
+      const relativePath = entry.split(path9.sep).join("/");
       const reason = getPageSourceFileViolation(relativePath);
       if (reason)
         violations.push({ relativePath: `page/${relativePath}`, reason });
@@ -2818,7 +2939,7 @@ class SysExecutor extends Executor {
     await this.setPackageJson(libPkgJsonWithDeps);
   }
   async getLocalFile(targetPath) {
-    const filePath = path8.isAbsolute(targetPath) ? targetPath : `${this.type}s/${this.name}/${targetPath}`;
+    const filePath = path9.isAbsolute(targetPath) ? targetPath : `${this.type}s/${this.name}/${targetPath}`;
     const content = await this.workspace.readFile(filePath);
     return { filePath, content };
   }
@@ -2906,6 +3027,18 @@ class AppExecutor extends SysExecutor {
   static from(executor, name) {
     return new AppExecutor({ workspace: executor instanceof WorkspaceExecutor ? executor : executor.workspace, name });
   }
+  static #keptOnStart = [path9.join(".akan", "mobile"), path9.join(".akan", "cache", "bin")];
+  async#removeDevOutput(dir = ".akan") {
+    const entries = await readDirEntries(this.getPath(dir)).catch(() => []);
+    await Promise.all(entries.map(async (name) => {
+      const entry = path9.join(dir, name);
+      if (AppExecutor.#keptOnStart.includes(entry))
+        return;
+      if (AppExecutor.#keptOnStart.some((kept) => kept.startsWith(`${entry}${path9.sep}`)))
+        return await this.#removeDevOutput(entry);
+      await this.removeDir(entry);
+    }));
+  }
   getEnv() {
     return WorkspaceExecutor.getBaseDevEnv().env;
   }
@@ -2959,7 +3092,7 @@ class AppExecutor extends SysExecutor {
         ...akanConfig.web.ssr ? [this.cp("public", `${this.dist.cwdPath}/public`, { dereference: true })] : []
       ]);
     } else {
-      await this.removeDir(".akan");
+      await this.#removeDevOutput();
       if (!akanConfig.web.ssr || !akanConfig.web.csr)
         this.logger.verbose(`akan.config.ts disables web.${!akanConfig.web.ssr ? "ssr" : "csr"}; \`akan start\` still serves it, \`akan build\` will not`);
     }
@@ -3025,13 +3158,13 @@ class AppExecutor extends SysExecutor {
         absolute: false,
         onlyFiles: true
       })) {
-        const segments = rel.split(path8.sep);
+        const segments = rel.split(path9.sep);
         if (segments.some((s) => s === "node_modules"))
           continue;
         const posix = `${root.keyPrefix}${segments.join("/")}`;
         if (!root.keyPrefix && libKeyPrefixes.some((prefix) => posix.startsWith(prefix)))
           continue;
-        const absPath = path8.join(root.dir, ...segments);
+        const absPath = path9.join(root.dir, ...segments);
         validatePageSourceFile(posix, { filePath: absPath });
         if (!isRouteSourceFile(posix))
           continue;
@@ -3172,7 +3305,7 @@ class AppExecutor extends SysExecutor {
   static async#linkLibAsset(targetPath, linkPath) {
     const isWindows = process.platform === "win32";
     try {
-      const target = isWindows ? targetPath : path8.relative(path8.dirname(linkPath), targetPath);
+      const target = isWindows ? targetPath : path9.relative(path9.dirname(linkPath), targetPath);
       await symlink(target, linkPath, isWindows ? "junction" : "dir");
     } catch (error) {
       if (!isWindows)
@@ -3215,7 +3348,7 @@ class AppExecutor extends SysExecutor {
         await this.writeFile(rel, content, opts);
       },
       readEnvClient: async () => {
-        const envClientPath = path8.join(this.cwdPath, "env", "env.client.ts");
+        const envClientPath = path9.join(this.cwdPath, "env", "env.client.ts");
         if (!await FileSys2.fileExists(envClientPath))
           return null;
         try {
@@ -3309,7 +3442,7 @@ class PkgExecutor extends Executor {
       return overrideVersion;
     try {
       const packageJsonPath = `pkgs/${dep}/package.json`;
-      if (!await Bun.file(path8.join(this.workspace.workspaceRoot, packageJsonPath)).exists())
+      if (!await Bun.file(path9.join(this.workspace.workspaceRoot, packageJsonPath)).exists())
         return;
       const packageJson = await this.workspace.readJson(packageJsonPath);
       if (packageJson.name === dep)
@@ -3402,4 +3535,4 @@ class ModuleExecutor extends Executor {
   }
 }
 
-export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, CLAUDE_COMMENT_RULE, AsyncDefaultExportDetector, resolveSsrPageEntriesForApp, CodegenLock, Linter, rootAllowedFiles, rootAllowedDirs, isAllowedLibFacetRootFile, rootEntryHintOf, isScannedRootEntry, AppInfo, Spinner, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };
+export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, CLAUDE_COMMENT_RULE, binPlatforms, AsyncDefaultExportDetector, resolveSsrPageEntriesForApp, CodegenLock, Linter, rootAllowedFiles, rootAllowedDirs, isAllowedLibFacetRootFile, rootEntryHintOf, isScannedRootEntry, AppInfo, Spinner, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };