@akanjs/cli 3.0.0-beta.29 → 3.0.0-beta.30

package/.build-stamp

@@ -1 +1 @@
-17c8586a89cd04b60d3d62ff58838eecd420ba14c959958abb0d7baf5bd6628c
+0e7a5dcd028f8a43952646d4bbd60e5a0917f2ef29d8a7e26e3125a4fe291e06

package/{CodeAgent-86q8d13j.js → CodeAgent-xnfyyz8h.js}

@@ -1,8 +1,8 @@
 // @bun
 import {
   CodeAgent2
-} from "./index-krwz9ek9.js";
-import"./index-8ej6r02m.js";
+} from "./index-mk3b9rk1.js";
+import"./index-8tv7356t.js";
 import"./index-7md2g9vw.js";
 export {
   CodeAgent2 as CodeAgent

package/{CodeTui-r8tgxsyb.js → CodeTui-h66xb1fh.js}

@@ -4,7 +4,7 @@ import {
   McpServerConfig,
   McpTokenStore,
   McpSignIn
-} from "./index-8ej6r02m.js";
+} from "./index-8tv7356t.js";
 import {
   CodeTuiLines2,
   CodeTuiAgents2,

package/README.ko.md

@@ -0,0 +1,72 @@
+# @akanjs/cli
+
+[문서](https://akanjs.com/docs) | [npm](https://www.npmjs.com/package/@akanjs/cli) | [런타임](https://www.npmjs.com/package/akanjs)
+
+Akan.js 워크스페이스를 위한 command-line tooling입니다.
+
+`@akanjs/cli`는 Akan 애플리케이션, 라이브러리, 프레임워크 패키지를 생성, 빌드, 테스트, 린트,
+릴리즈, 유지보수하는 데 사용하는 `akan` 실행 파일을 제공합니다. Bun-first CLI 패키지이며 Akan
+개발 tooling을 내부에 번들링하므로, 애플리케이션 런타임은 더 작은 `akanjs` 패키지에만 의존할 수
+있습니다.
+
+## 설치
+
+새 워크스페이스를 바로 만들 수 있습니다.
+
+```bash
+bunx create-akan-workspace@latest
+```
+
+또는 CLI를 전역으로 설치할 수 있습니다.
+
+```bash
+bun install -g @akanjs/cli@latest
+akan --help
+```
+
+## 자주 쓰는 명령
+
+```bash
+akan create-workspace <workspace-name>
+akan start <app-name>
+akan build <app-name>
+akan test <app-or-lib-or-pkg>
+akan lint <app-or-lib-or-pkg>
+akan create-application <app-name>
+akan create-library <lib-name>
+akan create-module <module-name>
+akan create-scalar <scalar-name>
+```
+
+패키지 유지보수 명령도 같은 실행 파일에서 제공합니다.
+
+```bash
+akan build-package akanjs
+akan build-package @akanjs/cli
+akan build-package @akanjs/devkit
+akan build-package create-akan-workspace
+akan verify-akan-publish-packages
+akan smoke-registry --test=true --tag=rc
+```
+
+Akan framework 패키지는 반드시 `dist/pkgs/*` 산출물 기준으로 publish합니다. `verify-akan-publish-packages`는
+빌드된 패키지에 `npm pack --dry-run --json`을 실행하고, `deploy-akan` 또는 local registry smoke 전에 필요한
+metadata를 검증합니다.
+저장소 릴리즈에서는 root `akan` bootstrap script가 CLI dist를 덮어쓰지 않도록
+`bun run release:build-packages && bun run release:verify-packages`를 우선 사용합니다.
+
+## 패키지 경계
+
+- 애플리케이션과 런타임 코드는 `akanjs`를 사용합니다.
+- 사용자-facing 실행 패키지는 `@akanjs/cli`입니다.
+- `@akanjs/devkit`은 published CLI 사용을 위해 CLI 안에 번들링됩니다. 일반 CLI 사용자가 별도의
+  runtime dependency로 설치할 필요는 없습니다.
+
+## 요구사항
+
+- [Bun](https://bun.sh) `>=1.4.0`
+- TypeScript 기반 Akan 워크스페이스
+
+## 라이선스
+
+MIT

package/README.md

@@ -0,0 +1,88 @@
+# @akanjs/cli
+
+[Docs](https://akanjs.com/docs) | [npm](https://www.npmjs.com/package/@akanjs/cli) | [Runtime](https://www.npmjs.com/package/akanjs)
+
+Command-line tooling for Akan.js workspaces.
+
+`@akanjs/cli` provides the `akan` executable used to create, build, test, lint, release, and maintain Akan
+applications, libraries, and framework packages. It is a Bun-first CLI package and bundles Akan development
+tooling internally so application runtimes can depend on the smaller `akanjs` package.
+
+## Install
+
+Create a new workspace:
+
+```bash
+bunx create-akan-workspace@latest
+```
+
+Or install the CLI globally:
+
+```bash
+bun install -g @akanjs/cli@latest
+akan --help
+```
+
+## Common Commands
+
+```bash
+akan create-workspace <workspace-name>
+akan start <app-name>
+akan build <app-name>
+akan test <app-or-lib-or-pkg>
+akan lint <app-or-lib-or-pkg>
+akan create-application <app-name>
+akan create-library <lib-name>
+akan create-module <module-name>
+akan create-scalar <scalar-name>
+```
+
+## Agent And MCP Commands
+
+```bash
+akan context --format markdown
+akan context --format json --module <module-name>
+akan doctor --format json
+akan guideline list
+akan guideline show framework
+akan agent install cursor
+akan mcp
+```
+
+These commands expose Akan workspace structure, module abstracts, diagnostics, and guideline instructions for
+coding agents. The MCP server is read-only and is intended to provide context rather than edit files directly.
+
+Package maintenance commands are also exposed through the same executable:
+
+```bash
+akan build-package akanjs
+akan build-package @akanjs/cli
+akan build-package @akanjs/devkit
+akan build-package create-akan-workspace
+akan verify-akan-publish-packages
+akan smoke-registry --test=true --tag=rc
+```
+
+Publish Akan framework packages from `dist/pkgs/*` only. `verify-akan-publish-packages` runs `npm pack --dry-run --json`
+against the built packages and checks metadata that must be correct before `deploy-akan` or local registry smoke.
+For repository releases, prefer `bun run release:build-packages && bun run release:verify-packages` so the CLI package
+artifact is built last and is not overwritten by the root `akan` bootstrap script.
+
+## Package Boundary
+
+- Use `akanjs` from application and runtime code.
+- Use `@akanjs/cli` as the user-facing executable package.
+- `@akanjs/devkit` is bundled into the CLI for published CLI usage; it is not required as a separate
+  runtime dependency for ordinary CLI users.
+- The `akan code` agent follows that same split: its engine, tools and skills are a devkit facet
+  (`@akanjs/devkit/codeAgent`), and `@akanjs/cli/code` is the terminal host plus the SDK entry that
+  re-exports both.
+
+## Requirements
+
+- [Bun](https://bun.sh) `>=1.4.0`
+- A TypeScript Akan workspace
+
+## License
+
+MIT

package/{agent.command-q9bmqrag.js → agent.command-c4v7kjff.js}

@@ -2,16 +2,16 @@
 import {
   Workspace,
   command
-} from "./index-b68zfsvz.js";
+} from "./index-xb7qhxa8.js";
 import"./index-52w0fvh8.js";
-import"./index-r8gp8zk3.js";
+import"./index-n3jk2501.js";
 import"./index-hj6w4ka1.js";
-import"./index-2s2e5qnd.js";
-import"./index-0pqzrbpr.js";
+import"./index-hmdq5pqm.js";
+import"./index-tzc1gtrg.js";
 import"./index-zzvvc845.js";
 import {
   AgentScript
-} from "./index-rbeahw6j.js";
+} from "./index-bxmejydw.js";
 
 // pkgs/@akanjs/cli/agent/agent.command.ts
 class AgentCommand extends command("agent", [AgentScript], ({ public: target }) => ({

package/akanCode.js

@@ -28,7 +28,7 @@ import {
   CodeMailbox2,
   CodeSessionFork2,
   CodeAgent2
-} from "./index-krwz9ek9.js";
+} from "./index-mk3b9rk1.js";
 import {
   akanCodeDefaultModel2,
   akanCodeModel2,
@@ -39,7 +39,7 @@ import {
 import {
   SubagentPool2,
   akanCodePaths2
-} from "./index-8ej6r02m.js";
+} from "./index-8tv7356t.js";
 import"./index-7md2g9vw.js";
 import {
   CodeAgentRpcHost2

package/{application.command-712jd2z8.js → application.command-yzsswrz6.js}

@@ -6,24 +6,24 @@ import {
   Exec,
   Workspace,
   command
-} from "./index-b68zfsvz.js";
+} from "./index-xb7qhxa8.js";
 import"./index-52w0fvh8.js";
-import"./index-r8gp8zk3.js";
+import"./index-n3jk2501.js";
 import {
   getMobileTargetChoices
-} from "./index-1hs6jrys.js";
+} from "./index-kb16nzyt.js";
 import"./index-48k96p55.js";
-import"./index-qtz88kh0.js";
+import"./index-gxamdf18.js";
 import {
   ApplicationScript
-} from "./index-n9gxx7bp.js";
+} from "./index-3rh7thcx.js";
 import"./index-7md2g9vw.js";
-import"./index-nbg9bfnr.js";
+import"./index-35mmm9ca.js";
 
 // pkgs/@akanjs/cli/application/application.command.ts
 var mobileTargetOption = {
-  desc: "mobile target name or all",
-  ask: "Select mobile target",
+  desc: "native target name (a key of native.targets) or all",
+  ask: "Select native target",
   enum: async ({ app }) => await getMobileTargetChoices(app)
 };
 var deviceOption = {
@@ -180,7 +180,7 @@ class ApplicationCommand extends command("application", [ApplicationScript], ({
   packUpdate: target({
     desc: "Pack an unsigned over-the-air update of the mobile web bundle, for the signer to publish"
   }).with(App).option("platform", String, { enum: ["ios", "android"], desc: "the app it updates" }).option("target", String, mobileTargetOption).option("env", String, releaseEnvOption).option("out", String, {
-    desc: "output folder (default: .akan/mobile/<target>/updates/<platform>)",
+    desc: "output folder (default: .akan/native/<target>/updates/<platform>)",
     nullable: true
   }).option("against", String, {
     desc: "bundle.json of the store build it must run in; fails when it needs a new one",

package/{applicationBuildRunner-ez37p161.js → applicationBuildRunner-qkt6spd5.js}

@@ -1,15 +1,15 @@
 // @bun
 import {
   Spinner
-} from "./index-r8gp8zk3.js";
-import"./index-ttn00pr3.js";
+} from "./index-n3jk2501.js";
+import"./index-6x9p8dpb.js";
 import {
   AllRoutesBuilder,
   CsrArtifactBuilder,
   FontPruner,
   precompressArtifacts,
   SsrBaseArtifactBuilder
-} from "./index-fy42hyb9.js";
+} from "./index-376gpdds.js";
 import"./index-52w0fvh8.js";
 import"./index-n68jx79w.js";
 

package/buildBatch.proc.js

@@ -6,7 +6,7 @@ import {
   resolveSsrPageEntriesForApp,
   WorkspaceExecutor,
   AppExecutor
-} from "./index-r8gp8zk3.js";
+} from "./index-n3jk2501.js";
 import {
   computeRouteSeedIndex,
   saveRouteSeedIndex,
@@ -14,14 +14,14 @@ import {
   PagesBundleBuilder,
   CsrDevBundler,
   SsrDevBundler
-} from "./index-ttn00pr3.js";
+} from "./index-6x9p8dpb.js";
 import"./index-52w0fvh8.js";
 import {
   CsrArtifactBuilder,
   CssCompiler,
   FontOptimizer,
   SsrBaseArtifactBuilder
-} from "./index-fy42hyb9.js";
+} from "./index-376gpdds.js";
 import"./index-n68jx79w.js";
 
 // pkgs/@akanjs/devkit/incrementalBuilder/buildBatch.proc.ts

package/{cloud.command-8eegwcsc.js → cloud.command-v8h688jc.js}

@@ -6,22 +6,22 @@ import {
 import {
   Workspace,
   command
-} from "./index-b68zfsvz.js";
-import"./index-r8gp8zk3.js";
+} from "./index-xb7qhxa8.js";
+import"./index-n3jk2501.js";
 import {
   PlatformTestRun
-} from "./index-rrt9pnb4.js";
+} from "./index-5rp0h6na.js";
 import"./index-48k96p55.js";
-import"./index-1hs6jrys.js";
-import"./index-qtz88kh0.js";
-import"./index-n9gxx7bp.js";
+import"./index-kb16nzyt.js";
+import"./index-gxamdf18.js";
+import"./index-3rh7thcx.js";
 import"./index-7md2g9vw.js";
 import"./index-2ahj896a.js";
-import"./index-k7809wmg.js";
+import"./index-a4s954kq.js";
 import {
   CloudScript2
-} from "./index-g44da4r2.js";
-import"./index-nbg9bfnr.js";
+} from "./index-qcejqgts.js";
+import"./index-35mmm9ca.js";
 
 // pkgs/@akanjs/cli/cloud/cloud.command.ts
 var localRegistryUrl = () => process.env.AKAN_NPM_REGISTRY ?? "http://127.0.0.1:4873";

package/cloud.script-yct1sk4k.js

@@ -0,0 +1,20 @@
+// @bun
+import {
+  CloudScript2
+} from "./index-qcejqgts.js";
+import"./index-5rp0h6na.js";
+import"./index-a4s954kq.js";
+import"./index-3rh7thcx.js";
+import"./index-35mmm9ca.js";
+import"./index-gxamdf18.js";
+import"./index-kb16nzyt.js";
+import"./index-94s080qm.js";
+import"./index-xb7qhxa8.js";
+import"./index-7md2g9vw.js";
+import"./index-48k96p55.js";
+import"./index-n3jk2501.js";
+import"./index-2ahj896a.js";
+import"./index-52w0fvh8.js";
+export {
+  CloudScript2 as CloudScript
+};

package/{code.command-n0c2tyzx.js → code.command-jff3tw7y.js}

@@ -4,9 +4,9 @@ import {
   runner,
   script,
   command
-} from "./index-b68zfsvz.js";
+} from "./index-xb7qhxa8.js";
 import"./index-52w0fvh8.js";
-import"./index-r8gp8zk3.js";
+import"./index-n3jk2501.js";
 import {
   akanCodeDefaultModel2,
   CodeAgentStreamPrinter2
@@ -19,7 +19,7 @@ class CodeRunner extends runner("code") {
   async serve(options, listen) {
     await import("./consoleToStderr-h5bryj94.js");
     const [{ CodeAgent }, { CodeAgentRpcHost }, { CodeAgentRpcListener }] = await Promise.all([
-      import("./CodeAgent-86q8d13j.js"),
+      import("./CodeAgent-xnfyyz8h.js"),
       import("./CodeAgentRpcHost-p7h6n2hp.js"),
       import("./CodeAgentRpcListener-7p7z5dd7.js")
     ]);
@@ -34,8 +34,8 @@ class CodeRunner extends runner("code") {
   }
   async tui(options, seed) {
     const [{ CodeAgent }, { CodeTui }] = await Promise.all([
-      import("./CodeAgent-86q8d13j.js"),
-      import("./CodeTui-r8tgxsyb.js")
+      import("./CodeAgent-xnfyyz8h.js"),
+      import("./CodeTui-h66xb1fh.js")
     ]);
     const agentOptions = await CodeRunner.#agentOptions(options, false);
     let resume = options.resume;
@@ -60,7 +60,7 @@ class CodeRunner extends runner("code") {
     }
   }
   async run(prompt, options) {
-    const { CodeAgent } = await import("./CodeAgent-86q8d13j.js");
+    const { CodeAgent } = await import("./CodeAgent-xnfyyz8h.js");
     const agent = await CodeAgent.create(await CodeRunner.#agentOptions(options, false));
     const printer = new CodeAgentStreamPrinter2({ json: options.json, thinking: options.thinking });
     agent.on((event) => printer.print(event));

package/{context.command-vxf6d7q2.js → context.command-y5sevk3c.js}

@@ -2,24 +2,24 @@
 import {
   Workspace,
   command
-} from "./index-b68zfsvz.js";
+} from "./index-xb7qhxa8.js";
 import"./index-52w0fvh8.js";
-import"./index-r8gp8zk3.js";
+import"./index-n3jk2501.js";
 import"./index-hj6w4ka1.js";
-import"./index-2s2e5qnd.js";
-import"./index-0pqzrbpr.js";
-import"./index-16k7m3cs.js";
-import"./index-1hs6jrys.js";
+import"./index-hmdq5pqm.js";
+import"./index-tzc1gtrg.js";
+import"./index-hqd0h1pb.js";
+import"./index-kb16nzyt.js";
 import"./index-zzvvc845.js";
-import"./index-2z30v4k5.js";
-import"./index-ss828r32.js";
-import"./index-genegfnt.js";
-import"./index-20r2g1t3.js";
-import"./index-2ctqegdm.js";
-import"./index-h9ed99ax.js";
+import"./index-0ncc0mbk.js";
+import"./index-se643zvp.js";
+import"./index-wfwgcnyc.js";
+import"./index-hf6f4xnb.js";
+import"./index-tsb0f8ya.js";
+import"./index-rtwhw4aq.js";
 import {
   ContextScript
-} from "./index-2yvy9ztj.js";
+} from "./index-167c77aq.js";
 
 // pkgs/@akanjs/cli/context/context.command.ts
 class ContextCommand extends command("context", [ContextScript], ({ public: target }) => ({
@@ -27,7 +27,7 @@ class ContextCommand extends command("context", [ContextScript], ({ public: targ
     await this.contextScript.context(workspace, { format, app, module });
   }),
   doctor: target({ desc: "Report Akan workspace convention diagnostics" }).option("format", String, { desc: "output format", default: "text", enum: ["text", "json"] }).option("strict", Boolean, { desc: "treat recommended conventions as errors", default: false }).option("ios", Boolean, {
-    desc: "report iOS/mobile config diagnostics (placeholder bundle ids, etc.)",
+    desc: "report iOS/native config diagnostics (placeholder bundle ids, etc.)",
     default: false
   }).with(Workspace).exec(async function(format, strict, ios, workspace) {
     await this.contextScript.doctor(workspace, { format, strict, ios });

package/context.runner-90hsmacr.js

@@ -0,0 +1,21 @@
+// @bun
+import {
+  ContextRunner2
+} from "./index-hqd0h1pb.js";
+import"./index-rtwhw4aq.js";
+import"./index-tsb0f8ya.js";
+import"./index-hf6f4xnb.js";
+import"./index-0ncc0mbk.js";
+import"./index-wfwgcnyc.js";
+import"./index-se643zvp.js";
+import"./index-kb16nzyt.js";
+import"./index-tzc1gtrg.js";
+import"./index-hmdq5pqm.js";
+import"./index-zzvvc845.js";
+import"./index-xb7qhxa8.js";
+import"./index-n3jk2501.js";
+import"./index-hj6w4ka1.js";
+import"./index-52w0fvh8.js";
+export {
+  ContextRunner2 as ContextRunner
+};

package/{guideline.command-ene55fkr.js → guideline.command-11cndccb.js}

@@ -2,9 +2,9 @@
 import {
   script,
   command
-} from "./index-b68zfsvz.js";
+} from "./index-xb7qhxa8.js";
 import"./index-52w0fvh8.js";
-import"./index-r8gp8zk3.js";
+import"./index-n3jk2501.js";
 import {
   Prompter2
 } from "./index-zzvvc845.js";

package/guidelines/conventions/conventions.instruction.md

@@ -28,7 +28,7 @@ you fetch on demand — `get_guideline` with the name, or `akan guideline show <
 | name | covers |
 |---|---|
 | `ssrRule` | server-share targets, the `akan.ssr.*` warnings, the client-boundary playbook |
-| `runtimeRule` | `web` / `csr` surfaces, gateway vs solo processes, logging, the generated image, a desktop app's server, shipped assets, database modes |
+| `runtimeRule` | `web` / `csr` surfaces, gateway vs solo processes, logging, the generated image, native apps and a desktop app's server, shipped assets, database modes |
 | `queryRule` | slices and hydration, the generated filter methods, full-text search, cascade removal |
 | `transportRule` | guards across HTTP and websocket, socket identity and cleanup, binary pubsub, mutation verbs |
 | `mcpRule` | MCP configuration, wire behaviour, resource URIs, OAuth metadata, protocol revisions |
@@ -309,11 +309,11 @@ What an app serves, how many processes it runs, where its logs go, and what ship
 declared in `akan.config.ts` and narrowed — never widened — by an env at boot. Domain code reaches none of it.
 Full contract: `get_guideline` with `runtimeRule`, or `akan guideline show runtimeRule`.
 
-- **Web surfaces are `web: true | false | { csr: boolean }`.** `{ csr: false }` drops the mobile/CSR bundle,
-  `false` is an API-only build that serves nothing under `page/`. There is no CSR-without-SSR option, by type —
-  the CSR bundle inlines the stylesheet the SSR base artifact compiles. `AKAN_SSR` / `AKAN_CSR` narrow further at
-  runtime and can never switch a surface the build left out back on. `akan start` ignores `web` and keeps the
-  whole dev surface.
+- **Web surfaces are `web: true | false | { csr: boolean }`.** `{ csr: false }` drops the CSR bundle the native
+  apps ship, `false` is an API-only build that serves nothing under `page/`. There is no CSR-without-SSR option, by
+  type — the CSR bundle inlines the stylesheet the SSR base artifact compiles. `AKAN_SSR` / `AKAN_CSR` narrow
+  further at runtime and can never switch a surface the build left out back on. `akan start` ignores `web` and
+  keeps the whole dev surface.
 - **One traffic replica runs in the container's only process.** `AKAN_REPLICA=0,0,1` — the default everywhere —
   has nothing to balance, so there is no gateway and no unix-socket proxy hop. Two or more replicas, a batch-only
   replica, `AKAN_SOLO=false`, passing `replica` to `new AkanApp(...)`, or `akan start` all bring the gateway back.
@@ -350,15 +350,28 @@ Full contract: `get_guideline` with `runtimeRule`, or `akan guideline show runti
   assembles one from; the string form takes no contributions. The generated image installs `ca-certificates` and
   `tzdata` and nothing else, so an app needing `ffmpeg` or Chromium declares it in `preRuns` / `postRuns`. A lib
   declares the steps its own runtime needs and every mounting app inherits them.
-- **A desktop app's server (`native.desktop.server: true` on its target) gets nothing from `docker`.** An executable the app spawns
+- **Native apps are the `native` section** — iOS, Android and a desktop app (macOS, Windows, Linux), each shipping
+  the CSR bundle on the native runtime. Shared fields (`appName`, `appId`, `version`, `indexPath`, `permissions`,
+  `plugins`, `deepLinks`, `updates`, …) sit beside one section per platform: `ios`, `android`, `desktop`. Without
+  `targets` the app has one target, `default`, and an app with no basePaths leaves `basePath` out; a target takes
+  the same shape and overrides the section field by field — objects merge key by key, a list or any other value
+  replaces the section's. `akan start-ios` / `start-android` / `start-desktop` run a dev build that loads its pages
+  from `akan start`; `build-ios` / `build-android` / `build-desktop` write
+  `apps/<app>/.akan/native/<target>/build/<platform>`, a desktop app only for the computer that builds it
+  (`--installer true` adds a Windows setup). With `updates: { url, publicKey }` an installed app takes the signed
+  releases `akan publish-update` makes; `akan update-keygen` makes the key and prints its `publicKey`.
+- **A desktop app that carries its server (`desktop: { server: true }` in `native`, or in one target) gets nothing
+  from `docker`.** That server is API-only, runs in database mode `single`, and listens on a loopback port any
+  program on the computer can call, so guard its endpoints as a network server's. An executable the app spawns
   goes in `bin` — per platform, a download checked against its `sha256` or a file beside the config, put first on
   the app's PATH so the server's `spawn("ffmpeg")` finds it, and in `ctx.binDir` for a native plugin — and a package
-  that builds itself at install goes in `trustedDependencies`, which the image honours too. Carry a static LGPL ffmpeg: a `--enable-nonfree` build may
-  not be redistributed. A file the user picks with `filePicker.pickFiles({ forServer: true })` reaches it as a
-  grant, never a copy or a path: `NativeFile.resolve(grant, "read")` in `akanjs/server` asks the shell for it.
-  What it carries is readable on the user's computer — `private/` (each lib's too, under `private/libs/<lib>`), the
-  one `env.server.<env>.ts` of its `--env` and its libs' server env defaults (`env.server.testing.ts`) — and it has
-  no `public/`: read runtime files from `AKAN_APP_DIR`, never `process.cwd()`.
+  that builds itself at install goes in `trustedDependencies`, which the image honours too. Carry a static LGPL
+  ffmpeg: a `--enable-nonfree` build may not be redistributed. A file the user picks with
+  `filePicker.pickFiles({ forServer: true })` reaches it as a grant, never a copy or a path:
+  `NativeFile.resolve(grant, "read")` in `akanjs/server` asks the shell for it. What it carries is readable on the
+  user's computer — `private/` (each lib's too, under `private/libs/<lib>`), the one `env.server.<env>.ts` of its
+  `--env` and its libs' server env defaults (`env.server.testing.ts`) — and it has no `public/`: read runtime files
+  from `AKAN_APP_DIR`, never `process.cwd()`.
 - **`assets: { pruneFonts, keepFonts }`** trims from the `dist` copy of `public/` the fonts nothing reads; source
   trees are never touched. A font with `optimize` on is a build input, not a runtime asset. `keepFonts` belongs to
   the `akan.config.ts` that owns the font, written against that scope's own `public/`.
@@ -934,7 +947,7 @@ export default page()
 - `apps/<appName>` root may only contain these files: `AGENTS.md`, `CLAUDE.md`, `akan.app.json`, `akan.config.ts`, `client.ts`, `main.ts`, `package.json`, `server.ts`, `tsconfig.json`, `tsconfig.tsbuildinfo`.
 - `apps/<appName>` root may only contain these folders: `.akan`, `common`, `env`, `lib`, `native`, `page`, `plugin`, `private`, `public`, `script`, `secrets`, `srvkit`, `ui`, `webkit`.
 - `libs/<libName>` root may only contain these files: `AGENTS.md`, `CLAUDE.md`, `README.md`, `akan.config.ts`, `akan.lib.json`, `client.ts`, `index.ts`, `package.json`, `server.ts`, `tsconfig.json`, `tsconfig.spec.json`, `tsconfig.tsbuildinfo`.
-- `libs/<libName>` root may only contain these folders: `common`, `env`, `lib`, `native`, `page`, `plugin`, `private`, `public`, `srvkit`, `ui`, `webkit`. A library is never booted or packaged as an app, so the run and mobile entries an app carries (`main.ts`, `.akan`, `script`, `secrets`) are rejected there. A Capacitor-era `ios` / `android` / `mobile` folder or `capacitor.config.*` is refused in an app root too, named as a leftover: the native runtime generates its projects under `.akan/mobile/<target>`.
+- `libs/<libName>` root may only contain these folders: `common`, `env`, `lib`, `native`, `page`, `plugin`, `private`, `public`, `srvkit`, `ui`, `webkit`. A library is never booted or packaged as an app, so the run and mobile entries an app carries (`main.ts`, `.akan`, `script`, `secrets`) are rejected there. A Capacitor-era `ios` / `android` / `mobile` folder or `capacitor.config.*` is refused in an app root too, named as a leftover: the native runtime generates its projects under `.akan/native/<target>`.
 - Both allowlists have one source — `pkgs/@akanjs/devkit/workspaceLayout.ts`. `akan sync` (error), `akan doctor`
   (diagnostic), and `akan quality scan` (warning) all read it, so add a new root entry there and mirror it into this
   list, never into one of the three call sites.