@akanjs/cli 3.1.0-rc.1 → 3.1.0-rc.3

package/guidelines/runtimeRule/runtimeRule.instruction.md

@@ -257,9 +257,10 @@ const config: AppConfig = {
   Intel Macs are not a target, so `--arch x64` on macOS is refused.
 - **A release is signed only with `--sign` and notarized only with `--notarize`** (`build-desktop`,
   `publish-update`); the environment names the identity and never decides to use it, so a shell exporting a Developer
-  ID signs and uploads nothing unasked. Before either, the server the app carries is searched for every secret value
-  of the workspace's server env files and refused with the paths, and one line names the identity and the service
-  the app goes to.
+  ID signs and uploads nothing unasked. Every release build and every `publish-update` of a target that carries a
+  server, signed or not, first searches that server for every secret value of the workspace's server env files and
+  refuses with the paths; an env file it cannot evaluate stops the release too, and a debug build is not searched.
+  One line then names the identity and the service the app goes to.
 - **A macOS release for download is signed with a Developer ID and notarized.**
   `AKAN_NATIVE_MACOS_IDENTITY` names a keychain identity, or `AKAN_NATIVE_MACOS_CERTIFICATE` +
   `_CERTIFICATE_PASSWORD` a `.p12` the build imports into a keychain of its own (a CI runner);
@@ -280,12 +281,15 @@ const config: AppConfig = {
   key. List the online signing key first and offline spares after it (up to three): a phone binary trusts all of
   them, and a key may revoke only the keys listed before it, so a leaked key cannot lock out its spares. A desktop
   app trusts the first; `publicKey` is the one-key form. `akan publish-update <app>` builds and signs a release
-  into `updates/`: upload that folder to `url`, the manifests last, or let `--upload s3://<bucket>/<prefix>` do it
-  (credentials and endpoint from `S3_*` or `AWS_*`; a release file the bucket holds is skipped). A phone reads only
-  `<url>/<platform>/<channel>/<nativeApi>.json`, so each store generation on a channel takes its own fixes.
+  into `updates/`: upload that release's files to `url` and its manifest last, or let
+  `--upload s3://<bucket>/<prefix>` do it (credentials and endpoint from `S3_*` or `AWS_*`; a release file the bucket
+  holds is skipped), which sends that release alone, and nothing when it is missing or fails a check. Never upload the
+  folder whole: a phone's is also where `pack-update` writes by default.
+  A phone reads only `<url>/<platform>/<channel>/<nativeApi>.json`, so each store generation on a channel takes its
+  own fixes.
   `akan pack-update` writes an unsigned phone bundle for whoever holds the key to sign and records it in
   `<out>/pack.json`, exiting 2 when `--against` says it needs a new store build; `akan push-update` packs and uploads to
-  an akasys project that holds the key, and `akan register-binary` registers a store build after `release-*`. A
+  the Akan Cloud project that holds the key, and `akan register-binary` registers a store build after `release-*`. A
   release that hangs is rolled back while the app runs, and `report: { url }` has a phone post what became of each
   release (applied, confirmed, rolled back and why) at its next launch, so rollback rates are visible. `devtools: true`
   opens the web inspector of a release build for an internal test target. The channel is the backend env the binary was built for unless `channel` names one;
@@ -307,10 +311,11 @@ const config: AppConfig = {
   their page paints, so a dark board never flashes white, and `desktop.publisher` names who publishes a Windows app in
   Apps & features and its executable's company (the app name when unset, never Bun's own).
 - **A third-party page shown first-party** — a scoreboard, a menu board — is the `external-view` plugin, listed in
-  `native.plugins`: a webview over the window with a browser profile of its own, held to the origins it was opened
-  for, with an init script, `evaluate`, a trusted `sendKey`, `capture`, and `loadFailed` / `gone` (it reloads, or is
-  rebuilt, by itself) / `consoleMessage` events. Every method on Windows; macOS 14+ lacks `sendKey`, `setMuted` and
-  `capture`.
+  `native.plugins`: a webview over the window with a browser profile of its own, its top level held to the origins it
+  was opened for while its frames load web content from anywhere, with an init script that runs in the top document
+  only, `evaluate`, a trusted `sendKey`, `capture`, and `loadFailed` / `gone` (it reloads, or is rebuilt, by itself;
+  the reason is `terminated` on macOS, and `rebuildFailed` when a rebuild failed and the view is closed, to be opened
+  again) / `consoleMessage` events. Every method on Windows; macOS 14+ lacks `sendKey`, `setMuted` and `capture`.
 
 ## A Desktop App's Server — `bin` And `trustedDependencies`
 
@@ -416,10 +421,14 @@ in those alone, and `modules: ["@edge"]` (or `AKAN_MODULES=@edge`) names every m
 inject, cascade to and hold a relation to. `desktop: { server: { profile: "edge", modules: ["@edge"] } }` builds the
 carried server that way: `env/env.server.<env>.edge.ts` is bundled in place of `env/env.server.<env>.ts`, which never
 enters it, and the build evaluates the profile file with no app env and refuses one whose secret-named keys hold a
-value — a `process.env.X ?? "literal"` counts as the literal. Each lib's env defaults (`env.server.testing.ts`) are
+value — a `process.env.X ?? "literal"` counts as the literal. Signing, encryption, master and session keys, `pwd`, a
+`…dsn` and a connection string are secret-named, and a URL holding a password or a secret-named query parameter is a
+secret under any key. The profile may spread `libEnv`, and the lib defaults it reaches are checked as the bundle
+carries them; a profile that imports the file it replaces is refused. Each lib's env defaults (`env.server.testing.ts`) are
 swapped the same way: for the lib's `env/env.server.testing.edge.ts`, held to the same check, or for the defaults with
-every secret-named value left out, which the build names in a warning. `akan build <app> --profile edge` does the
-same for an image. A module listing only edge does not mount under `akan start` (local): list `local` too to develop
+every secret-named value left out, which the build names in a warning — and a default a JSON snapshot cannot carry (a
+function, Map, Set, Date, class instance, bigint or non-finite number) is refused unless the lib has its profile file.
+`akan build <app> --profile edge` does the same for an image. A module listing only edge does not mount under `akan start` (local): list `local` too to develop
 it there.
 
 **A file the user picks reaches the server as a grant, never as a copy or a path.** With `"file-picker"` in
@@ -556,7 +565,7 @@ const config: AppConfig = { assets: { pruneFonts: false } }; // emergency valve,
 
 Akan Cloud builds and deploys each app as `build` → `docker` → `deploy`, and `ota` after them when asked. **An app's own stages go in
 `apps/<app>/akan.config.ts` under `pipeline`; stages around every app go in the workspace root's
-`akan.config.ts`**, typed `WorkspaceConfig` (`before`, `after`, `post`, `env`, `timeout`). Both are `import type`
+`akan.config.ts`**, typed `WorkspaceConfig`, under its own `pipeline` (`before`, `after`, `post`, `env`, `timeout`). Both are `import type`
 objects (or `(ctx) => …`), and `akan pipeline dry-run | validate | plan` turns them into the plan Akan Cloud runs —
 locally, running nothing.
 

package/guidelines/transportRule/transportRule.instruction.md

@@ -47,14 +47,17 @@ mutation is mounted under. `conventions` carries the invariants — this is the
   change revokes it, `disconnect` when the socket closes while still subscribed — so a room already left runs
   neither again, and cleanup that must happen either way registers for both. From a `message` handler it belongs to
   the socket and runs at close. A handler that throws is logged and never blocks the rest of the teardown.
+- **A subscribe the client leaves before it finishes joins nothing.** When an `unsubscribe` for the room, or the
+  socket's close, arrives while the subscribe is still running, the subscribe answers `subscribe: false` and runs its
+  `unsubscribe` cleanup (and its `disconnect` one when the socket closed) instead of joining the room.
 
 ## Request Deadlines
 
 - **`{ timeout: <ms> }` in an endpoint's signal option is the whole configuration surface**, and it reaches both
   ends of the call. Server side, the `Timeout` middleware races the handler against it and answers
   `base.error.gatewayTimeout` (504) once it is spent. Client side, `FetchSerializer` ships the value on the
-  serialized endpoint and `fetch.<endpoint>()` uses it as that request's `AbortSignal.timeout` budget, so the
-  browser does not abandon a call the server is still allowed to be working on.
+  serialized endpoint and `fetch.<endpoint>()` uses it as that call's deadline — every retry of the call and every
+  wait between them included — so the browser does not abandon a call the server is still allowed to be working on.
 - **The middleware is registered by default and has no default of its own.** An endpoint that declares no
   `timeout` is passed straight through — a default here would put a deadline on every endpoint in the app that
   nobody asked for, which is why the middleware used to be opt-in and, being opt-in, made the declared value
@@ -92,6 +95,11 @@ mutation is mounted under. `conventions` carries the invariants — this is the
 - **The entry is the handler's result, not the response.** The lookup wraps the handler only, so `resolveReturn`
   still runs per call on the cached value — field masking, `hidden`/`secret` stripping and relation resolution are
   never cached, and a relation still costs its own load. The cache saves the handler, not the serialization.
+- **A hit hands `resolveReturn` an instance of the declared return model**, rebuilt from an entry that keeps its
+  `Map`s, bytes and dates, so a `resolveField` reads the same methods and `Dayjs` values on a hit as on a miss. It is
+  the declared model, not the service's document: a method only the document has is not there on a hit, and a return
+  declared as a `Light` model shows `resolveField` its light fields only. The entry still holds `hidden` and `secret`
+  values for its TTL, as the handler returned them.
 - **A cache backend that is down does not take the endpoint down.** A failed read is warned and the call runs
   uncached; a failed write is warned and dropped.
 - The default middleware chain is `Logging → Timeout → <lib middlewares>`, and the call inside it runs an
@@ -99,6 +107,21 @@ mutation is mounted under. `conventions` carries the invariants — this is the
   handler: a hung cache backend is bounded by the same deadline as the handler it stands in for. **`Retry` was removed** — an automatic re-run of an endpoint
   whose failure it cannot classify replays whatever the first attempt already did.
 
+## Repeated Mutations
+
+- **A mutation sent again under the same `Idempotency-Key` header runs once.** The key is checked after the
+  resource guards and the internal arguments, and it is scoped to the endpoint, the caller and a digest of the
+  arguments, so one caller's key never hands another caller its answer. A repeat while the first run is still going
+  answers 409 `base.error.idempotencyInFlight`.
+- **A repeat answers the first response as it was sent** — resolved, masked and serialized — for 24 hours. What
+  is kept is that wire form, never the handler's result, so no `hidden` or `secret` field reaches the cache.
+- A handler that throws frees the key, so a repeat runs it again. A failure after the handler returned is kept and
+  replayed instead, for the same 24 hours and a transient one (a relation read during a database blip) included:
+  the handler's writes stand, so running it again would repeat them.
+- **Only an HTTP call is deduplicated.** A signed-out call, one whose handler returns a `Response` (whose headers,
+  such as a session's `Set-Cookie`, cannot be replayed), a websocket call, and a call through MCP all run every
+  time.
+
 ## Rate Limits
 
 - **`{ rateLimit: { calls, windowMs?, by? } }` in an endpoint's signal option** counts calls per caller per window
@@ -107,9 +130,9 @@ mutation is mounted under. `conventions` carries the invariants — this is the
   checked after the middlewares and before the guards, keyed by `accountKey(account)`; a caller it names nothing
   for — an anonymous one — is counted by address. Leaving a pubsub room is never counted.
 - **The answer is 429 `base.error.tooManyRequests` with `data: { seconds }`** and a `Retry-After` header; a WS
-  call gets the same payload as its error frame, and the HTTP client restores a proxy's own non-JSON 429 under the
-  same key (seconds from its `Retry-After`, else 60). The first refusal per endpoint per process is warned once;
-  later ones log at `debug`, so a flood does not become a log flood.
+  call gets the same payload as its error frame, and the HTTP client restores a proxy's own 429 — a page, or JSON
+  naming no error key of ours — under the same key (seconds from its `Retry-After`, `0` included, else 60). The first
+  refusal per endpoint per process is warned once; later ones log at `debug`, so a flood does not become a log flood.
 - **Keys and addresses.** The address is `context.getClientIp()` — the trusted-proxy answer, never a raw header
   from an untrusted peer. Callers whose address is unknown share one `unknown` budget (fail closed), and the first
   such call is warned about, since it usually means the proxy in front records no `X-Real-IP`/`X-Forwarded-For`

package/incrementalBuilder.proc.js

@@ -8,19 +8,21 @@ import {
   CodegenLock,
   WorkspaceExecutor,
   AppExecutor
-} from "./index-55mynnqs.js";
+} from "./index-bv210r6t.js";
 import"./index-52w0fvh8.js";
 import {
   GraphClientEntryDiscovery,
   RouteClientBuilder,
   AutoImportSync,
-  ServerGraphFile,
   CsrDevPatcher,
   CsrDevBundler,
   DevChangePlanner,
   DevGeneratedIndexSync,
   SsrDevBundler
-} from "./index-aprt7pkz.js";
+} from "./index-fvn6f5wx.js";
+import {
+  ServerGraphFile
+} from "./index-ec080x99.js";
 import {
   prepareDevWatchBatch
 } from "./index-a5vmm6x4.js";
@@ -235,7 +237,7 @@ class IncrementalBuilder {
   #autoImportSync;
   #watcher = null;
   #generation = 0;
-  #shellGeneration = null;
+  #shellKey = null;
   #discoveredThrough = 0;
   #csrActive = IncrementalBuilder.#csrArmedByEnv();
   #csrBundler;
@@ -948,13 +950,14 @@ class IncrementalBuilder {
   async#buildShell(msg) {
     await this.#workQueue.enqueue("build-shell", async () => {
       const generation = this.#generation;
+      const shellKey = `${generation}:${JSON.stringify(this.#artifact.cssAssets)}`;
       let error;
-      if (this.#shellGeneration !== generation)
+      if (this.#shellKey !== shellKey)
         try {
           const result = await this.#batchRunner.run(await this.#batchRequest({ generation, needs: ["shell"], changedFiles: [] }));
           error = result.errors.shell;
           if (!error)
-            this.#shellGeneration = generation;
+            this.#shellKey = shellKey;
         } catch (err) {
           error = ApplicationBuildReporter.formatError(err, this.#app.workspace.workspaceRoot);
         }

package/{index-2etcv0sc.js → index-00seamy5.js}

@@ -2,7 +2,7 @@
 import {
   runner,
   script
-} from "./index-6jjtnhkw.js";
+} from "./index-3x7yeecy.js";
 
 // pkgs/@akanjs/cli/page/page.runner.ts
 class PageRunner extends runner("page") {

package/{index-jx4bzvwg.js → index-1a7nhq56.js}

@@ -38,40 +38,45 @@ import {
 } from "./index-k9rrten6.js";
 import {
   runner,
-  script
-} from "./index-6jjtnhkw.js";
+  script,
+  assertPromptable
+} from "./index-3x7yeecy.js";
 import {
   WorkspaceExecutor,
   AppExecutor,
   LibExecutor,
   PkgExecutor
-} from "./index-55mynnqs.js";
+} from "./index-bv210r6t.js";
 import {
   DesktopServerStage,
-  NativeApp,
   UpdateUploader
-} from "./index-1w2qaee2.js";
+} from "./index-kmamh5bv.js";
+import {
+  NativePublicEnv,
+  UpdatePackFolder,
+  NativeApp
+} from "./index-qf8g88j9.js";
 import {
   LibraryScript
-} from "./index-c1x0be5j.js";
+} from "./index-dmsvd2rv.js";
 import {
   stripAnsi
 } from "./index-7md2g9vw.js";
 import {
   SlicePlanner,
   formatSlicePlan
-} from "./index-qt22xstj.js";
+} from "./index-c9zjb3tw.js";
+import {
+  openBrowser
+} from "./index-9dp031by.js";
 import {
   resolveMobileTargets,
   resolveAppId
 } from "./index-q958tqqg.js";
-import {
-  openBrowser
-} from "./index-9dp031by.js";
 
 // pkgs/@akanjs/cli/application/application.script.ts
 import { confirm } from "@inquirer/prompts";
-import { Logger as Logger6 } from "akanjs/common";
+import { Logger as Logger6, toError as toError2 } from "akanjs/common";
 
 // pkgs/@akanjs/cli/application/application.runner.ts
 import { realpathSync } from "fs";
@@ -1888,8 +1893,8 @@ ${uniqueCandidates.map((candidate) => `  - ${candidate}`).join(`
 }
 
 // pkgs/@akanjs/cli/application/application.runner.ts
-import { Logger as Logger3 } from "akanjs/common";
-var loadBuildRunner = async () => (await import("./applicationBuildRunner-1yaqsrdq.js")).ApplicationBuildRunner;
+import { Logger as Logger3, toError } from "akanjs/common";
+var loadBuildRunner = async () => (await import("./applicationBuildRunner-8573zr2w.js")).ApplicationBuildRunner;
 var loadPrompts = async () => await import("@inquirer/prompts");
 
 class ApplicationRunner extends runner("application") {
@@ -1914,6 +1919,9 @@ class ApplicationRunner extends runner("application") {
       throw new Error(`No script files found. make a script file in apps/${app.name}/script folder`);
     }
     const scriptFiles = (await app.readdir("script")).filter((file) => file.endsWith(".ts"));
+    assertPromptable("Missing argument 'filename'", {
+      choices: scriptFiles.map((file) => file.replace(".ts", ""))
+    });
     const scriptFile = await (await loadPrompts()).select({
       message: "Select script to run",
       choices: scriptFiles.map((file) => ({ name: file, value: file.replace(".ts", "") }))
@@ -2047,7 +2055,7 @@ try {
     await new (await loadBuildRunner())(app).typecheck(options);
   }
   async typecheckLibrary(lib, options = {}) {
-    const { ProjectTypecheck } = await import("./projectTypecheck-cvtkrzp2.js");
+    const { ProjectTypecheck } = await import("./projectTypecheck-7djd4z50.js");
     const root = lib.workspace.workspaceRoot;
     await new ProjectTypecheck(lib.cwdPath, root, { ...process.env, AKAN_WORKSPACE_ROOT: root }).run([
       "../../server.ts",
@@ -2078,9 +2086,9 @@ try {
     fast = false,
     reporter,
     spinner = false,
-    profile
+    envProfile
   } = {}) {
-    return new (await loadBuildRunner())(app, { fast, reporter, profile }).build({ spinner });
+    return new (await loadBuildRunner())(app, { fast, reporter, profile: envProfile }).build({ spinner });
   }
   async start(app, {
     open = false,
@@ -2189,44 +2197,46 @@ try {
     };
     return canonical(reported) === canonical(own);
   }
-  async releaseIos(app, { target, env = "main", teamId, adHoc = false } = {}) {
+  async releaseIos(app, { target, env = "main", teamId, adHoc = false, publicEnv } = {}) {
     const targets = await resolveMobileTargets(app, target);
-    await this.#buildMobileCsr(app, env);
+    await this.#buildMobileCsr(app, env, undefined, publicEnv ? await NativePublicEnv.load(publicEnv) : null);
     for (const mobileTarget of targets)
       this.#reportBuild(app, mobileTarget, await new NativeApp(app, mobileTarget, env).releaseIos({ teamId, adHoc }));
   }
-  async releaseAndroid(app, format, { target, env = "main" } = {}) {
+  async releaseAndroid(app, format, { target, env = "main", publicEnv } = {}) {
     const targets = await resolveMobileTargets(app, target);
     NativeApp.androidSigning();
-    await this.#buildMobileCsr(app, env);
+    await this.#buildMobileCsr(app, env, undefined, publicEnv ? await NativePublicEnv.load(publicEnv) : null);
     for (const mobileTarget of targets)
       this.#reportBuild(app, mobileTarget, await new NativeApp(app, mobileTarget, env).releaseAndroid({ formats: [format] }));
   }
-  async packUpdate(app, platform, { target, env = "main", out, against }) {
+  async packUpdate(app, platform, { target, env = "main", out, against, publicEnv }) {
     const targets = await resolveMobileTargets(app, target);
     const [mobileTarget] = targets;
     if (!mobileTarget || targets.length > 1)
       throw new Error("pack-update packs one native target at a time; pass --target <name>.");
-    await this.#buildMobileCsr(app, env);
-    const { pack } = await new NativeApp(app, mobileTarget, env).packUpdate(platform, { out });
+    const nativeApp = new NativeApp(app, mobileTarget, env);
+    await UpdatePackFolder.clear(path5.resolve(out ?? path5.join(nativeApp.updatesDir, platform)));
+    const pinned = publicEnv ? await NativePublicEnv.load(publicEnv) : against ? await NativePublicEnv.recordedIn(against) : null;
+    await this.#buildMobileCsr(app, env, undefined, pinned);
+    const { pack } = await nativeApp.packUpdate(platform, { out });
     app.logger.info(`packed ${mobileTarget.name} ${platform} for channel '${pack.channel}' to ${pack.out}: ${pack.files} files, ${(pack.size / 1024).toFixed(0)} KiB, native API ${pack.nativeApi}`);
     if (against) {
-      const compat = await NativeApp.compareBundles(app.cwdPath, against, path5.join(pack.out, "bundle.json"));
-      pack.compat = { against, ...compat };
-      await Bun.write(path5.join(pack.out, "compat.json"), `${JSON.stringify(pack.compat, null, 2)}
-`);
+      const bundle = path5.join(pack.out, UpdatePackFolder.bundleFile);
+      const compat = await NativeApp.compareBundles(app.cwdPath, against, bundle);
+      const envProblem = await NativePublicEnv.problemAgainst(against, bundle);
+      await UpdatePackFolder.writeCompat(pack, {
+        against,
+        compatible: compat.compatible && !envProblem,
+        problems: [...compat.problems, ...envProblem ? [envProblem] : []]
+      });
     }
-    await NativeApp.writePack(pack);
-    if (!pack.compat)
-      return pack;
-    if (pack.compat.compatible) {
+    await UpdatePackFolder.write(pack);
+    const verdict = UpdatePackFolder.storeBuildVerdict(pack);
+    if (verdict)
+      throw verdict;
+    if (pack.compat)
       app.logger.info(`runs in the store build of ${against}`);
-      return pack;
-    }
-    app.logger.error(`This bundle needs a new store build; it differs from the one ${against} came from:
-- ${pack.compat.problems.join(`
-- `)}`);
-    process.exitCode = 2;
     return pack;
   }
   async updateKeygen(app, platform, target) {
@@ -2237,16 +2247,27 @@ try {
       if (seen.has(appId))
         continue;
       seen.add(appId);
-      const { publicKey, keyPath, created } = await new NativeApp(app, mobileTarget).updateKeygen(nativePlatform);
+      const { publicKey, keyId, keyPath, created } = await new NativeApp(app, mobileTarget).updateKeygen(nativePlatform);
       app.log(`${appId}: ${created ? "made" : "read"} ${keyPath}${created ? " (keep it private and backed up: without it, installed apps take no more updates)" : ""}`);
       app.log(`  native: { updates: { url: "https://\u2026/${app.name}", publicKeys: [${JSON.stringify(publicKey)}] } }`);
+      app.log(`  keyId ${keyId}: what publish-update --revoke and updates.revokedKeys name this key by`);
       const { publicKey: one, publicKeys } = mobileTarget.config.updates ?? {};
       const declared = publicKeys ?? (one ? [one] : null);
       if (declared && !declared.includes(publicKey))
         app.logger.warn(`native.targets.${mobileTarget.name}.updates.publicKeys does not hold this key; releases it signs would not verify.`);
     }
   }
-  async publishUpdate(app, platform, { target, env = "main", channel, upload, arch, sign = false, notarize = false } = {}) {
+  async publishUpdate(app, platform, {
+    target,
+    env = "main",
+    channel,
+    upload,
+    arch,
+    sign = false,
+    notarize = false,
+    revoke,
+    resetSequence
+  } = {}) {
     if (arch && platform !== "desktop")
       throw new Error(`--arch picks a desktop release's CPU; ${platform} publishes its web bundle.`);
     const targets = await resolveMobileTargets(app, target);
@@ -2260,7 +2281,9 @@ try {
       await new NativeApp(app, mobileTarget, env).assertPublishable(nativePlatform, {
         server: ApplicationRunner.carriesServer(mobileTarget, nativePlatform),
         ...channel ? { channel } : {},
-        ...arch ? { arch } : {}
+        ...arch ? { arch } : {},
+        revoke,
+        resetSequence
       });
     const carried = await this.#stageMobile(app, nativePlatform, targets, env, arch);
     for (const mobileTarget of targets) {
@@ -2270,15 +2293,17 @@ try {
         ...arch ? { arch } : {},
         sign,
         notarize,
+        revoke,
+        resetSequence,
         ...carried && ApplicationRunner.carriesServer(mobileTarget, nativePlatform) ? { server: carried } : {}
       });
       this.#reportBuild(app, mobileTarget, published.build);
       app.log(`${app.name}/${mobileTarget.name} ${published.bundle}: ${published.dir}/${published.channel}.json, ${published.files} files, ${Math.round(published.size / 1024)} KiB`);
       if (!uploader) {
-        app.log(`Upload ${nativeApp.updatesDir} to ${mobileTarget.config.updates?.url}, the manifests last.`);
+        app.log(`Upload ${nativeApp.updatesDir} to ${mobileTarget.config.updates?.url}, the manifests last, without pack-update's records (pack.json, compat.json, manifest.template.json, bundle.json); --upload s3://\u2026 sends just this release.`);
         continue;
       }
-      const { uploaded, skipped } = await uploader.upload(nativeApp.updatesDir);
+      const { uploaded, skipped } = await uploader.upload(nativeApp.updatesDir, published);
       app.log(`Uploaded ${uploaded} file(s) to ${upload}, the manifests last; ${skipped} the bucket already held. Installed apps read ${mobileTarget.config.updates?.url}.`);
     }
   }
@@ -2300,13 +2325,14 @@ try {
       if (typeof server !== "object")
         return { omit: [], modules: [] };
       const { omit = [], modules = [], profile, env, restart, watchdog } = server;
+      const { intervalMs, failures } = typeof watchdog === "object" ? watchdog : {};
       return {
         omit,
         modules,
         ...profile ? { profile } : {},
         ...env ? { env } : {},
         ...restart !== undefined ? { restart } : {},
-        ...typeof watchdog === "object" ? { watchdog } : {}
+        ...intervalMs && failures ? { watchdog: { intervalMs, failures } } : {}
       };
     });
     const [first = { omit: [], modules: [] }, ...rest] = servers;
@@ -2318,7 +2344,7 @@ try {
     agree("omit different packages", ({ omit }) => omit.join(", "));
     agree("name different env profiles", ({ profile }) => profile ?? "");
     agree("mount different modules", ({ modules }) => modules.join(", "));
-    agree("set a different env", ({ env }) => env ? JSON.stringify(env) : "");
+    agree("set a different env", ({ env }) => env ? JSON.stringify(env, Object.keys(env).sort()) : "");
     agree("restart differently", ({ restart }) => String(restart ?? ""));
     agree("watch it differently", ({ watchdog }) => watchdog ? JSON.stringify(watchdog) : "");
     return first;
@@ -2331,7 +2357,11 @@ try {
     const { modules, env: serverEnv, restart, watchdog } = server;
     return await stage?.prepare(env, { modules, env: serverEnv, restart, watchdog });
   }
-  async#buildMobileCsr(app, env, profile) {
+  async#buildMobileCsr(app, env, envProfile, publicEnv = null) {
+    if (publicEnv?.AKAN_PUBLIC_ENV !== undefined && publicEnv.AKAN_PUBLIC_ENV !== env)
+      throw new Error(`--env ${env} differs from the public env's AKAN_PUBLIC_ENV ${publicEnv.AKAN_PUBLIC_ENV}.`);
+    if (publicEnv)
+      NativePublicEnv.pin(publicEnv);
     const prevEnv = {
       AKAN_PUBLIC_ENV: process.env.AKAN_PUBLIC_ENV,
       AKAN_PUBLIC_OPERATION_MODE: process.env.AKAN_PUBLIC_OPERATION_MODE,
@@ -2343,7 +2373,7 @@ try {
       APP_OPERATION_MODE: "release"
     });
     try {
-      await new (await loadBuildRunner())(app, { environment: env, profile }).build({ spinner: true });
+      await new (await loadBuildRunner())(app, { environment: env, profile: envProfile }).build({ spinner: true });
     } finally {
       for (const [key, value] of Object.entries(prevEnv)) {
         if (value === undefined)
@@ -2352,6 +2382,11 @@ try {
           process.env[key] = value;
       }
     }
+    if (!publicEnv)
+      return;
+    const differs = NativePublicEnv.diff(publicEnv, await NativePublicEnv.built(app) ?? {});
+    if (differs.length)
+      throw new Error(`The web build inlined other values than --public-env gave for ${differs.join(", ")}.`);
   }
   async#runMobileTargets(targets, task) {
     const results = [];
@@ -2367,7 +2402,7 @@ try {
     if (failures.length === 0)
       return;
     for (const failure of failures) {
-      const message = failure.error instanceof Error ? failure.error.message : String(failure.error);
+      const message = toError(failure.error).message;
       Logger3.rawLog(`Native target ${failure.target} failed: ${message}`, undefined, "error");
     }
     throw new Error(`${failures.length}/${results.length} native targets failed`);
@@ -3240,6 +3275,9 @@ class ApplicationScript extends script("application", [ApplicationRunner, Librar
   static devServerReadyTimeoutMs = DevSupervisor.bootTimeoutMs;
   #interrupt = new InterruptTeardown;
   async confirmDatabaseModeDependencyInstall(databaseMode, installSpecs) {
+    assertPromptable(`Database mode '${databaseMode}' requires missing dependencies: ${installSpecs.join(", ")}`, {
+      remedy: `install them first with \`bun add ${installSpecs.join(" ")}\``
+    });
     return await confirm({
       message: `Database mode '${databaseMode}' requires missing dependencies: ${installSpecs.join(", ")}. Install them now?`,
       default: true
@@ -3312,7 +3350,7 @@ class ApplicationScript extends script("application", [ApplicationRunner, Librar
     if (!quiet)
       Logger6.rawLog(`Creating an optimized production build for ${app.name}...`);
     try {
-      const result = await this.applicationRunner.build(app, { fast, spinner: !quiet, profile });
+      const result = await this.applicationRunner.build(app, { fast, spinner: !quiet, envProfile: profile });
       Logger6.rawLog(`${app.name} built in dist/apps/${app.name}`);
       if (!quiet)
         ApplicationBuildReporter.printSummary(result);
@@ -3325,10 +3363,12 @@ class ApplicationScript extends script("application", [ApplicationRunner, Librar
   async typecheck(exec, { write = true, clean = false, incremental = true, tests = false } = {}) {
     if (!(exec instanceof AppExecutor) && !(exec instanceof LibExecutor))
       throw new Error(`akan typecheck takes an app or a library; ${exec.name} is a package, checked by its own tsconfig.`);
-    if (exec instanceof LibExecutor)
+    if (exec instanceof AppExecutor)
+      await exec.scanSync({ write });
+    else if (write)
       await this.libraryScript.syncLibrary(exec);
     else
-      await exec.scanSync({ write });
+      await exec.scan({ write: false });
     const spinner = exec.spinning(`Typechecking ${exec.name}${tests ? " with its tests" : ""}...`);
     try {
       if (exec instanceof LibExecutor)
@@ -3593,13 +3633,13 @@ class ApplicationScript extends script("application", [ApplicationRunner, Librar
       await Promise.all(shares.map(async (share) => await share.close()));
     }, "Abandoning the tunnel release; the shares expire on their own.");
     await Promise.all(apps.map(async (app) => {
-      const { TunnelShare } = await import("./TunnelShare-q4jq08qg.js");
+      const { TunnelShare } = await import("./TunnelShare-rj74jd6x.js");
       const share = await TunnelShare.open(app, { workspace: app.workspace });
       shares.push(share);
       urls.set(app.name, share.url);
       Logger6.rawLog(`${app.name} is shared at ${share.url}`);
     })).catch((error) => {
-      Logger6.rawLog(`Could not open the tunnel: ${error instanceof Error ? error.message : String(error)}`, undefined, "error");
+      Logger6.rawLog(`Could not open the tunnel: ${toError2(error).message}`, undefined, "error");
     });
     return urls;
   }

package/{index-e0cvze1s.js → index-1nyxvz8j.js}

@@ -2,10 +2,10 @@
 import {
   runner,
   script
-} from "./index-6jjtnhkw.js";
+} from "./index-3x7yeecy.js";
 import {
   ModuleExecutor
-} from "./index-55mynnqs.js";
+} from "./index-bv210r6t.js";
 import {
   sourceFile,
   moduleSourcePaths,
@@ -13,10 +13,10 @@ import {
   createPassedPrimitiveReport,
   bilingualLabelForField,
   bilingualDescriptionForField
-} from "./index-05g3jayg.js";
+} from "./index-wdze51wz.js";
 import {
   PageScript
-} from "./index-2etcv0sc.js";
+} from "./index-00seamy5.js";
 import {
   pluralizeName
 } from "./index-nz8prx9g.js";