@akanjs/cli 3.0.0-beta.30 → 3.0.0-beta.32

package/.build-stamp

@@ -1 +1 @@
-0e7a5dcd028f8a43952646d4bbd60e5a0917f2ef29d8a7e26e3125a4fe291e06
+77b0a64e9eb50e1874e7999dae93ff4b583b816ed3d996834a3ee44fd9ec81ad

package/{CodeAgent-xnfyyz8h.js → CodeAgent-2vmp9qe0.js}

@@ -1,8 +1,8 @@
 // @bun
 import {
   CodeAgent2
-} from "./index-mk3b9rk1.js";
-import"./index-8tv7356t.js";
+} from "./index-0wpybxtr.js";
+import"./index-tqm7jjcn.js";
 import"./index-7md2g9vw.js";
 export {
   CodeAgent2 as CodeAgent

package/{CodeTui-h66xb1fh.js → CodeTui-5ed6bg2a.js}

@@ -4,7 +4,7 @@ import {
   McpServerConfig,
   McpTokenStore,
   McpSignIn
-} from "./index-8tv7356t.js";
+} from "./index-tqm7jjcn.js";
 import {
   CodeTuiLines2,
   CodeTuiAgents2,

package/{agent.command-c4v7kjff.js → agent.command-gn73rhe7.js}

@@ -2,16 +2,16 @@
 import {
   Workspace,
   command
-} from "./index-xb7qhxa8.js";
+} from "./index-vpj42xwt.js";
 import"./index-52w0fvh8.js";
-import"./index-n3jk2501.js";
+import"./index-3w94e7n3.js";
 import"./index-hj6w4ka1.js";
-import"./index-hmdq5pqm.js";
-import"./index-tzc1gtrg.js";
+import"./index-y3mphr1m.js";
+import"./index-9z771ptz.js";
 import"./index-zzvvc845.js";
 import {
   AgentScript
-} from "./index-bxmejydw.js";
+} from "./index-wprnsjms.js";
 
 // pkgs/@akanjs/cli/agent/agent.command.ts
 class AgentCommand extends command("agent", [AgentScript], ({ public: target }) => ({

package/akanCode.js

@@ -28,7 +28,7 @@ import {
   CodeMailbox2,
   CodeSessionFork2,
   CodeAgent2
-} from "./index-mk3b9rk1.js";
+} from "./index-0wpybxtr.js";
 import {
   akanCodeDefaultModel2,
   akanCodeModel2,
@@ -39,7 +39,7 @@ import {
 import {
   SubagentPool2,
   akanCodePaths2
-} from "./index-8tv7356t.js";
+} from "./index-tqm7jjcn.js";
 import"./index-7md2g9vw.js";
 import {
   CodeAgentRpcHost2

package/{application.command-yzsswrz6.js → application.command-e968t0hw.js}

@@ -6,19 +6,19 @@ import {
   Exec,
   Workspace,
   command
-} from "./index-xb7qhxa8.js";
+} from "./index-vpj42xwt.js";
 import"./index-52w0fvh8.js";
-import"./index-n3jk2501.js";
+import"./index-3w94e7n3.js";
 import {
   getMobileTargetChoices
-} from "./index-kb16nzyt.js";
+} from "./index-gbggbqcp.js";
 import"./index-48k96p55.js";
-import"./index-gxamdf18.js";
+import"./index-mgxpx3f2.js";
 import {
   ApplicationScript
-} from "./index-3rh7thcx.js";
+} from "./index-p993efkq.js";
 import"./index-7md2g9vw.js";
-import"./index-35mmm9ca.js";
+import"./index-jmrn54tt.js";
 
 // pkgs/@akanjs/cli/application/application.command.ts
 var mobileTargetOption = {
@@ -109,15 +109,20 @@ class ApplicationCommand extends command("application", [ApplicationScript], ({
     await this.applicationScript.buildAndroid(app, { target, env, profile: debug ? "debug" : "release", write });
   }),
   buildDesktop: target({ short: true, desc: "Build the desktop app for this computer (macOS, Windows or Linux)" }).with(App).option("target", String, mobileTargetOption).option("env", String, buildEnvOption).option("debug", Boolean, { desc: "debug build instead of release", default: false }).option("installer", Boolean, {
-    desc: "Windows: also an NSIS setup program (per user, /S for a silent install)",
+    desc: "also what a person downloads: a Windows setup program (NSIS, /S for silent), a macOS dmg, a Linux AppImage",
     default: false
-  }).option("write", Boolean, { desc: "write code generation", default: true }).exec(async function(app, target, env, debug, installer, write) {
+  }).option("arch", String, {
+    desc: "the CPU the app runs on, arm64 or x64 of this OS (default this computer's); a macOS app is arm64 only",
+    enum: ["arm64", "x64"],
+    nullable: true
+  }).option("write", Boolean, { desc: "write code generation", default: true }).exec(async function(app, target, env, debug, installer, arch, write) {
     await this.applicationScript.buildDesktop(app, {
       target,
       env,
       profile: debug ? "debug" : "release",
       installer,
-      write
+      write,
+      ...arch ? { arch } : {}
     });
   }),
   start: target({ short: true, desc: "Start development server(s) (frontend SSR + backend)" }).with(Apps).option("plain", Boolean, { desc: "print prefixed lines instead of the full-screen view", default: false }).option("kill", Boolean, { flag: "k", desc: "free the dev ports first, whoever is holding them", default: false }).option("concurrency", Number, {

package/{applicationBuildRunner-qkt6spd5.js → applicationBuildRunner-64taxseg.js}

@@ -1,15 +1,15 @@
 // @bun
 import {
   Spinner
-} from "./index-n3jk2501.js";
-import"./index-6x9p8dpb.js";
+} from "./index-3w94e7n3.js";
+import"./index-6he6gvfg.js";
 import {
   AllRoutesBuilder,
   CsrArtifactBuilder,
   FontPruner,
   precompressArtifacts,
   SsrBaseArtifactBuilder
-} from "./index-376gpdds.js";
+} from "./index-kcdj1z5v.js";
 import"./index-52w0fvh8.js";
 import"./index-n68jx79w.js";
 

package/buildBatch.proc.js

@@ -6,7 +6,7 @@ import {
   resolveSsrPageEntriesForApp,
   WorkspaceExecutor,
   AppExecutor
-} from "./index-n3jk2501.js";
+} from "./index-3w94e7n3.js";
 import {
   computeRouteSeedIndex,
   saveRouteSeedIndex,
@@ -14,14 +14,14 @@ import {
   PagesBundleBuilder,
   CsrDevBundler,
   SsrDevBundler
-} from "./index-6x9p8dpb.js";
+} from "./index-6he6gvfg.js";
 import"./index-52w0fvh8.js";
 import {
   CsrArtifactBuilder,
   CssCompiler,
   FontOptimizer,
   SsrBaseArtifactBuilder
-} from "./index-376gpdds.js";
+} from "./index-kcdj1z5v.js";
 import"./index-n68jx79w.js";
 
 // pkgs/@akanjs/devkit/incrementalBuilder/buildBatch.proc.ts

package/{cloud.command-v8h688jc.js → cloud.command-0jm301rr.js}

@@ -6,22 +6,22 @@ import {
 import {
   Workspace,
   command
-} from "./index-xb7qhxa8.js";
-import"./index-n3jk2501.js";
+} from "./index-vpj42xwt.js";
+import"./index-3w94e7n3.js";
 import {
   PlatformTestRun
-} from "./index-5rp0h6na.js";
+} from "./index-drehwpdt.js";
 import"./index-48k96p55.js";
-import"./index-kb16nzyt.js";
-import"./index-gxamdf18.js";
-import"./index-3rh7thcx.js";
+import"./index-gbggbqcp.js";
+import"./index-mgxpx3f2.js";
+import"./index-p993efkq.js";
 import"./index-7md2g9vw.js";
 import"./index-2ahj896a.js";
-import"./index-a4s954kq.js";
+import"./index-by9pxkr0.js";
 import {
   CloudScript2
-} from "./index-qcejqgts.js";
-import"./index-35mmm9ca.js";
+} from "./index-pmhqttv3.js";
+import"./index-jmrn54tt.js";
 
 // pkgs/@akanjs/cli/cloud/cloud.command.ts
 var localRegistryUrl = () => process.env.AKAN_NPM_REGISTRY ?? "http://127.0.0.1:4873";

package/cloud.script-nemnzjpv.js

@@ -0,0 +1,20 @@
+// @bun
+import {
+  CloudScript2
+} from "./index-pmhqttv3.js";
+import"./index-drehwpdt.js";
+import"./index-by9pxkr0.js";
+import"./index-p993efkq.js";
+import"./index-jmrn54tt.js";
+import"./index-mgxpx3f2.js";
+import"./index-gbggbqcp.js";
+import"./index-94s080qm.js";
+import"./index-vpj42xwt.js";
+import"./index-7md2g9vw.js";
+import"./index-48k96p55.js";
+import"./index-3w94e7n3.js";
+import"./index-2ahj896a.js";
+import"./index-52w0fvh8.js";
+export {
+  CloudScript2 as CloudScript
+};

package/{code.command-jff3tw7y.js → code.command-18kcm7hq.js}

@@ -4,9 +4,9 @@ import {
   runner,
   script,
   command
-} from "./index-xb7qhxa8.js";
+} from "./index-vpj42xwt.js";
 import"./index-52w0fvh8.js";
-import"./index-n3jk2501.js";
+import"./index-3w94e7n3.js";
 import {
   akanCodeDefaultModel2,
   CodeAgentStreamPrinter2
@@ -19,7 +19,7 @@ class CodeRunner extends runner("code") {
   async serve(options, listen) {
     await import("./consoleToStderr-h5bryj94.js");
     const [{ CodeAgent }, { CodeAgentRpcHost }, { CodeAgentRpcListener }] = await Promise.all([
-      import("./CodeAgent-xnfyyz8h.js"),
+      import("./CodeAgent-2vmp9qe0.js"),
       import("./CodeAgentRpcHost-p7h6n2hp.js"),
       import("./CodeAgentRpcListener-7p7z5dd7.js")
     ]);
@@ -34,8 +34,8 @@ class CodeRunner extends runner("code") {
   }
   async tui(options, seed) {
     const [{ CodeAgent }, { CodeTui }] = await Promise.all([
-      import("./CodeAgent-xnfyyz8h.js"),
-      import("./CodeTui-h66xb1fh.js")
+      import("./CodeAgent-2vmp9qe0.js"),
+      import("./CodeTui-5ed6bg2a.js")
     ]);
     const agentOptions = await CodeRunner.#agentOptions(options, false);
     let resume = options.resume;
@@ -60,7 +60,7 @@ class CodeRunner extends runner("code") {
     }
   }
   async run(prompt, options) {
-    const { CodeAgent } = await import("./CodeAgent-xnfyyz8h.js");
+    const { CodeAgent } = await import("./CodeAgent-2vmp9qe0.js");
     const agent = await CodeAgent.create(await CodeRunner.#agentOptions(options, false));
     const printer = new CodeAgentStreamPrinter2({ json: options.json, thinking: options.thinking });
     agent.on((event) => printer.print(event));

package/{context.command-y5sevk3c.js → context.command-trd9bn18.js}

@@ -2,24 +2,24 @@
 import {
   Workspace,
   command
-} from "./index-xb7qhxa8.js";
+} from "./index-vpj42xwt.js";
 import"./index-52w0fvh8.js";
-import"./index-n3jk2501.js";
+import"./index-3w94e7n3.js";
 import"./index-hj6w4ka1.js";
-import"./index-hmdq5pqm.js";
-import"./index-tzc1gtrg.js";
-import"./index-hqd0h1pb.js";
-import"./index-kb16nzyt.js";
+import"./index-y3mphr1m.js";
+import"./index-9z771ptz.js";
+import"./index-abxpehf8.js";
+import"./index-gbggbqcp.js";
 import"./index-zzvvc845.js";
-import"./index-0ncc0mbk.js";
-import"./index-se643zvp.js";
-import"./index-wfwgcnyc.js";
-import"./index-hf6f4xnb.js";
-import"./index-tsb0f8ya.js";
-import"./index-rtwhw4aq.js";
+import"./index-93j60em0.js";
+import"./index-mbxbhay5.js";
+import"./index-4npz05nm.js";
+import"./index-kqabytj7.js";
+import"./index-hsmtysz4.js";
+import"./index-f3c78nd6.js";
 import {
   ContextScript
-} from "./index-167c77aq.js";
+} from "./index-yg7jhz8x.js";
 
 // pkgs/@akanjs/cli/context/context.command.ts
 class ContextCommand extends command("context", [ContextScript], ({ public: target }) => ({

package/context.runner-y5hwh673.js

@@ -0,0 +1,21 @@
+// @bun
+import {
+  ContextRunner2
+} from "./index-abxpehf8.js";
+import"./index-f3c78nd6.js";
+import"./index-hsmtysz4.js";
+import"./index-kqabytj7.js";
+import"./index-93j60em0.js";
+import"./index-4npz05nm.js";
+import"./index-mbxbhay5.js";
+import"./index-gbggbqcp.js";
+import"./index-9z771ptz.js";
+import"./index-y3mphr1m.js";
+import"./index-zzvvc845.js";
+import"./index-vpj42xwt.js";
+import"./index-3w94e7n3.js";
+import"./index-hj6w4ka1.js";
+import"./index-52w0fvh8.js";
+export {
+  ContextRunner2 as ContextRunner
+};

package/{guideline.command-11cndccb.js → guideline.command-bdmdn2de.js}

@@ -2,9 +2,9 @@
 import {
   script,
   command
-} from "./index-xb7qhxa8.js";
+} from "./index-vpj42xwt.js";
 import"./index-52w0fvh8.js";
-import"./index-n3jk2501.js";
+import"./index-3w94e7n3.js";
 import {
   Prompter2
 } from "./index-zzvvc845.js";

package/guidelines/conventions/conventions.instruction.md

@@ -352,16 +352,19 @@ Full contract: `get_guideline` with `runtimeRule`, or `akan guideline show runti
   declares the steps its own runtime needs and every mounting app inherits them.
 - **Native apps are the `native` section** — iOS, Android and a desktop app (macOS, Windows, Linux), each shipping
   the CSR bundle on the native runtime. Shared fields (`appName`, `appId`, `version`, `indexPath`, `permissions`,
-  `plugins`, `deepLinks`, `updates`, …) sit beside one section per platform: `ios`, `android`, `desktop`. Without
+  `plugins`, `deepLinks`, `updates`, …) sit beside one section per platform: `ios`, `android`, `desktop`, and a
+  platform section's own `indexPath` wins on that platform (`desktop: { indexPath: "/" }`). Without
   `targets` the app has one target, `default`, and an app with no basePaths leaves `basePath` out; a target takes
   the same shape and overrides the section field by field — objects merge key by key, a list or any other value
   replaces the section's. `akan start-ios` / `start-android` / `start-desktop` run a dev build that loads its pages
   from `akan start`; `build-ios` / `build-android` / `build-desktop` write
-  `apps/<app>/.akan/native/<target>/build/<platform>`, a desktop app only for the computer that builds it
-  (`--installer true` adds a Windows setup). With `updates: { url, publicKey }` an installed app takes the signed
+  `apps/<app>/.akan/native/<target>/build/<platform>`, a desktop app only for the OS that builds it — `--arch` picks
+  a Windows or Linux app's CPU, and a macOS app is Apple silicon only. `--installer true` adds a Windows setup, a
+  macOS dmg or a Linux AppImage; `AKAN_NATIVE_MACOS_*` signs with a Developer ID and notarizes,
+  `AKAN_NATIVE_WINDOWS_*` signs with Authenticode. With `updates: { url, publicKey }` an installed app takes the signed
   releases `akan publish-update` makes; `akan update-keygen` makes the key and prints its `publicKey`.
 - **A desktop app that carries its server (`desktop: { server: true }` in `native`, or in one target) gets nothing
-  from `docker`.** That server is API-only, runs in database mode `single`, and listens on a loopback port any
+  from `docker`** — and `server: { omit: [...] }` leaves out packages only the image needs. That server is API-only, runs in database mode `single`, and listens on a loopback port any
   program on the computer can call, so guard its endpoints as a network server's. An executable the app spawns
   goes in `bin` — per platform, a download checked against its `sha256` or a file beside the config, put first on
   the app's PATH so the server's `spawn("ffmpeg")` finds it, and in `ctx.binDir` for a native plugin — and a package

package/guidelines/runtimeRule/runtimeRule.instruction.md

@@ -228,6 +228,9 @@ const config: AppConfig = {
   },
   ```
 
+- **A platform section may name its own `indexPath`**, which wins on that platform: `indexPath: "/mobile"` with
+  `desktop: { indexPath: "/" }` opens the phones on `/mobile` and the desktop app on `/`, from one target, so no
+  command needs `--target`. It moves the dev build's first page and the `indexPath` its bundle carries alike.
 - **`basePath` is the client a target opens.** An app with no basePaths leaves it out. Without `targets`, the one
   target opens the basePath named like the app when there is one; in an app with basePaths, a target that names
   none is a template, and `--target <basePath>` builds that client from it.
@@ -240,10 +243,27 @@ const config: AppConfig = {
 - **`start-ios` / `start-android` / `start-desktop` run a dev build that loads its pages from `akan start`.** It has
   to be running — except for a desktop app that carries its server, which starts it when none of this checkout
   answers. `--release true` runs a release build of the app's own bundle instead.
-- **A desktop app builds only for the computer that builds it** — a `.app` on macOS, signed ad hoc or with the
-  development identity, and an unsigned folder on Windows and Linux. `build-desktop --installer true` adds a
-  per-user NSIS setup on Windows (`/S` installs silently). Distribution signing and notarization are not akan
-  commands yet.
+- **A desktop app builds only for the computer that builds it** — a `.app` on macOS, and an unsigned folder on
+  Windows and Linux. `build-desktop --installer true` adds what a person downloads: a per-user NSIS setup on Windows
+  (`/S` installs silently), a dmg on macOS, an AppImage on Linux (it needs `mksquashfs`; an AppImage cannot update
+  itself, so a release with `updates` ships a new one). `--arch arm64|x64` builds a Windows or Linux app for the
+  other CPU of that OS: the Rust library, Bun's executable, the server's `bun install --cpu` and each `bin` file
+  follow it, and a server addon with no binary for that CPU stops the build. A macOS app is Apple silicon only —
+  Intel Macs are not a target, so `--arch x64` on macOS is refused.
+- **A macOS release for download is signed with a Developer ID and notarized, from the environment.**
+  `AKAN_NATIVE_MACOS_IDENTITY` names a keychain identity, or `AKAN_NATIVE_MACOS_CERTIFICATE` +
+  `_CERTIFICATE_PASSWORD` a `.p12` the build imports into a keychain of its own (a CI runner);
+  `AKAN_NATIVE_MACOS_NOTARY_KEY` + `_KEY_ID` + `_ISSUER` (an App Store Connect API key) or `_NOTARY_PROFILE` turn on
+  notarization and stapling of the app and the dmg. Every Mach-O file — the server's addons and `bin` included — is
+  signed inside out with the hardened runtime and a timestamp; the executable gets Bun's JIT entitlements and the
+  camera's or microphone's when a usage text asks for them, and `desktop.entitlements` adds the app's own.
+  `publish-update` signs with the same identity, since the updater checks the installed app's signature. Without a
+  Developer ID the build warns, because Gatekeeper blocks a downloaded copy.
+- **A Windows release is signed with Authenticode, from the environment.** `AKAN_NATIVE_WINDOWS_CERTIFICATE` +
+  `_CERTIFICATE_PASSWORD` (a `.pfx`), `AKAN_NATIVE_WINDOWS_THUMBPRINT` (a certificate in the store, a token's or an
+  HSM's), or `AKAN_NATIVE_WINDOWS_SIGN_COMMAND` (a JSON array run per file with `{file}`, e.g. signtool with Azure
+  Trusted Signing's dlib) signs every PE file of the app — the server's `.node` and `bin` included — the setup program
+  and the uninstaller it writes, SHA-256 with a timestamp (`AKAN_NATIVE_WINDOWS_TIMESTAMP_URL`).
 - **`updates: { url, publicKey }` lets an installed app update itself** — the whole app on a desktop, the web
   bundle on a phone. `akan update-keygen <app>` makes the signing key once
   (`~/.akan/native/keys/<app id>.update.key`, or the path `AKAN_NATIVE_UPDATE_KEY` names) and prints the
@@ -266,8 +286,11 @@ packages first with `bun install --production --prefer-offline`, before `akan bu
 `--release` starts `akan start` beside the app when no dev server of this checkout answers. The setting is the
 app's backend, so it does not change under an installed app: an update whose release carries a server when the app
 has none, or none when it has one, is refused, and switching means a reinstall.
-A desktop app builds only for the computer it is built on, so every native addon's prebuild matches the one it runs
-on. It runs as an API-only edge server on SQLite, on a loopback port the launcher picks — the last session's when
+`desktop: { server: { omit: ["rclnodejs"] } }` carries the server without packages only the image needs — an addon
+tied to the image's system, code only a process the app never starts loads — and whatever only they pull in; the
+image keeps them, and the server's own bundle must not import them. A package another dependency still installs
+stops the build, naming who needs it. So does a native addon that would not load on a user's computer: no binary
+for the app's OS and CPU, a link outside the system, or a `binding.gyp` its install never compiled. It runs as an API-only edge server on SQLite, on a loopback port the launcher picks — the last session's when
 it is free, which is not a guarantee, so a provider that needs an exact redirect URI signs in through a cloud
 server's adapter. It refuses a `Host` other than its own, but any program on the computer can still call that port:
 guard its endpoints as a network server's. It runs in one process, so a `main.ts` or an env asking for replicas (`replica`,

package/incrementalBuilder.proc.js

@@ -8,7 +8,7 @@ import {
   CodegenLock,
   WorkspaceExecutor,
   AppExecutor
-} from "./index-n3jk2501.js";
+} from "./index-3w94e7n3.js";
 import"./index-52w0fvh8.js";
 import {
   GraphClientEntryDiscovery,
@@ -20,7 +20,7 @@ import {
   DevChangePlanner,
   DevGeneratedIndexSync,
   SsrDevBundler
-} from "./index-6x9p8dpb.js";
+} from "./index-6he6gvfg.js";
 import {
   prepareDevWatchBatch
 } from "./index-a5vmm6x4.js";

package/{index-mk3b9rk1.js → index-0wpybxtr.js}

@@ -4,7 +4,7 @@ import {
   akanCodePaths2,
   McpServerConfig,
   McpSignIn
-} from "./index-8tv7356t.js";
+} from "./index-tqm7jjcn.js";
 import {
   stripAnsi
 } from "./index-7md2g9vw.js";
@@ -511,7 +511,7 @@ class AkanToolPack2 {
     return { name: "akan-tools", factory: async (pi) => await this.#register(pi) };
   }
   async names() {
-    const { ContextRunner } = await import("./context.runner-90hsmacr.js");
+    const { ContextRunner } = await import("./context.runner-y5hwh673.js");
     return [
       ...new ContextRunner().listMcpTools(this.#options.mode).map((tool) => tool.name),
       AkanToolPack2.verifyToolName
@@ -519,7 +519,7 @@ class AkanToolPack2 {
   }
   static verifyToolName = "akan_verify";
   async#register(pi) {
-    const { ContextRunner } = await import("./context.runner-90hsmacr.js");
+    const { ContextRunner } = await import("./context.runner-y5hwh673.js");
     const runner = new ContextRunner;
     const guidelineNames = await AkanToolPack2.#guidelineNames();
     for (const tool of runner.listMcpTools(this.#options.mode, { guidelineNames })) {

package/{index-n3jk2501.js → index-3w94e7n3.js}

@@ -949,9 +949,9 @@ class AkanAppConfig {
       } = merged;
       const indexPath = normalizeIndexPath(rawIndexPath);
       const deepLinks = normalizeDeepLinks(rawDeepLinks);
-      const { teamId: rawTeamId, ...iosRest } = merged.ios ?? {};
+      const { teamId: rawTeamId, ...iosRest } = AkanAppConfig.#platformIndexPath(merged.ios ?? {});
       const teamId = rawTeamId?.trim();
-      const { sha256CertFingerprints: rawFingerprints, ...androidRest } = merged.android ?? {};
+      const { sha256CertFingerprints: rawFingerprints, ...androidRest } = AkanAppConfig.#platformIndexPath(merged.android ?? {});
       const fingerprints = normalizeStringList(rawFingerprints);
       const target = {
         ...rest,
@@ -961,6 +961,9 @@ class AkanAppConfig {
         ...deepLinks ? { deepLinks } : {},
         ...merged.ios ? { ios: { ...iosRest, ...teamId ? { teamId } : {} } } : {},
         ...merged.android ? { android: { ...androidRest, ...fingerprints ? { sha256CertFingerprints: fingerprints } : {} } } : {},
+        ...merged.desktop ? {
+          desktop: AkanAppConfig.#desktopServer(AkanAppConfig.#platformIndexPath(merged.desktop), `${where}.desktop.server`, configPath)
+        } : {},
         appName: merged.appName ?? this.app.name,
         appId: merged.appId ?? appId,
         version: merged.version ?? version,
@@ -971,6 +974,23 @@ class AkanAppConfig {
     }));
     return { appName, appId, ...root.fileName ? { fileName: root.fileName } : {}, version, buildNum, targets };
   }
+  static #desktopServer(desktop, where, configPath) {
+    const { server } = desktop;
+    if (server === undefined || typeof server === "boolean")
+      return desktop;
+    if (!AkanAppConfig.#isPlainObject(server))
+      throw new Error(`${where} in ${configPath} must be true or { omit: string[] }.`);
+    const omit = server.omit;
+    if (omit !== undefined && (!Array.isArray(omit) || omit.some((name) => typeof name !== "string" || !name.trim())))
+      throw new Error(`${where}.omit in ${configPath} must be a list of package names.`);
+    const names = [...new Set((omit ?? []).map((name) => name.trim()))].sort();
+    return { ...desktop, server: { omit: names } };
+  }
+  static #platformIndexPath(section) {
+    const { indexPath: rawIndexPath, ...rest } = section;
+    const indexPath = normalizeIndexPath(rawIndexPath);
+    return { ...rest, ...indexPath ? { indexPath } : {} };
+  }
   static #overlay(base, own) {
     const merge = (kept, value, top, key) => {
       if (!AkanAppConfig.#isPlainObject(kept) || !AkanAppConfig.#isPlainObject(value))
@@ -1011,8 +1031,9 @@ class AkanAppConfig {
       "android",
       "desktop"
     ],
-    ios: ["teamId", "infoPlist", "entitlements", "privacy", "files"],
+    ios: ["indexPath", "teamId", "infoPlist", "entitlements", "privacy", "files"],
     android: [
+      "indexPath",
       "sha256CertFingerprints",
       "googleServices",
       "push",
@@ -1022,7 +1043,8 @@ class AkanAppConfig {
       "activity",
       "files"
     ],
-    desktop: ["server", "recovery", "window", "screenCapture"],
+    desktop: ["indexPath", "server", "recovery", "window", "screenCapture", "entitlements"],
+    desktopServer: ["omit"],
     deepLinks: ["schemes", "domains"]
   };
   static #movedKeys = {
@@ -1050,6 +1072,7 @@ class AkanAppConfig {
     check(settings.ios, AkanAppConfig.#nativeKeys.ios, `${where}.ios`, "ios");
     check(settings.android, AkanAppConfig.#nativeKeys.android, `${where}.android`, "android");
     check(settings.desktop, AkanAppConfig.#nativeKeys.desktop, `${where}.desktop`, "desktop");
+    check(settings.desktop?.server, AkanAppConfig.#nativeKeys.desktopServer, `${where}.desktop.server`, "desktopServer");
     check(settings.deepLinks, AkanAppConfig.#nativeKeys.deepLinks, `${where}.deepLinks`, "deepLinks");
   }
   static #androidFilePattern = /^(?:res\/[^/]+\/[^/]+|assets\/.+)$/;

package/{index-wfwgcnyc.js → index-4npz05nm.js}

@@ -2,10 +2,10 @@
 import {
   runner,
   script
-} from "./index-xb7qhxa8.js";
+} from "./index-vpj42xwt.js";
 import {
   ModuleExecutor
-} from "./index-n3jk2501.js";
+} from "./index-3w94e7n3.js";
 import {
   sourceFile,
   moduleSourcePaths,
@@ -13,10 +13,10 @@ import {
   createPassedPrimitiveReport,
   bilingualLabelForField,
   bilingualDescriptionForField
-} from "./index-hmdq5pqm.js";
+} from "./index-y3mphr1m.js";
 import {
   PageScript
-} from "./index-se643zvp.js";
+} from "./index-mbxbhay5.js";
 import {
   pluralizeName
 } from "./index-nz8prx9g.js";

package/{index-6x9p8dpb.js → index-6he6gvfg.js}

@@ -9,7 +9,7 @@ import {
 import {
   AsyncDefaultExportDetector,
   resolveSsrPageEntriesForApp
-} from "./index-n3jk2501.js";
+} from "./index-3w94e7n3.js";
 
 // pkgs/@akanjs/devkit/artifact/routeSeedIndex.ts
 import path from "path";

package/{index-0ncc0mbk.js → index-93j60em0.js}

@@ -5,13 +5,13 @@ import {
   writeGeneratedSyncState,
   createRepairReport,
   renderRepairReport
-} from "./index-hmdq5pqm.js";
+} from "./index-y3mphr1m.js";
 import {
   AkanContextAnalyzer
-} from "./index-tzc1gtrg.js";
+} from "./index-9z771ptz.js";
 import {
   runner
-} from "./index-xb7qhxa8.js";
+} from "./index-vpj42xwt.js";
 
 // pkgs/@akanjs/cli/repair/repair.runner.ts
 var spawnShell = async (workspace, command) => await workspace.spawn("bash", ["-lc", command.startsWith("akan ") ? `bun run ${command}` : command], {

package/{index-tzc1gtrg.js → index-9z771ptz.js}

@@ -8,7 +8,7 @@ import {
   isScannedRootEntry,
   AppExecutor,
   LibExecutor
-} from "./index-n3jk2501.js";
+} from "./index-3w94e7n3.js";
 import {
   FileSys2
 } from "./index-52w0fvh8.js";
@@ -21,7 +21,7 @@ import {
   workflowPathsForPlan,
   workflowRunArtifactPath,
   workflowSyncDir
-} from "./index-hmdq5pqm.js";
+} from "./index-y3mphr1m.js";
 
 // pkgs/@akanjs/devkit/akanContext.ts
 import { readdir } from "fs/promises";