@akanjs/cli 3.1.0-rc.2 → 3.1.0-rc.21

package/{index-0909wckt.js → index-35m6bzm7.js}

@@ -4,206 +4,21 @@ import {
   ServerEnvProfile,
   Executor,
   WorkspaceExecutor
-} from "./index-2etqq75t.js";
+} from "./index-g6ax17x4.js";
 import {
   resolveAppId,
   targetHtmlFilename
-} from "./index-q958tqqg.js";
+} from "./index-m9jj544v.js";
 import {
   ExitCodeError
-} from "./index-31ce9vhg.js";
+} from "./index-vkb9m4z7.js";
 import {
   CsrArtifactBuilder
-} from "./index-kc8z134d.js";
-
-// pkgs/@akanjs/devkit/mobile/nativePublicEnv.ts
-import { createHash } from "crypto";
-class NativePublicEnv {
-  static derivedKeys = [
-    "AKAN_PUBLIC_APP_NAME",
-    "AKAN_PUBLIC_BASE_PATHS",
-    "AKAN_PUBLIC_API_PREFIX",
-    "AKAN_PUBLIC_WS_PREFIX",
-    "AKAN_PUBLIC_RENDER_ENV",
-    "AKAN_PUBLIC_DEFAULT_LOCALE",
-    "AKAN_PUBLIC_LOCALES"
-  ];
-  static #keyPattern = /^AKAN_PUBLIC_[A-Z0-9_]{1,128}$/;
-  static #secretWords = ["SECRET", "TOKEN", "PASSWORD", "PRIVATE", "CREDENTIAL"];
-  static #maxKeys = 256;
-  static #maxBytes = 64 * 1024;
-  static of(env) {
-    return Object.fromEntries(Object.keys(env).filter((key) => key.startsWith("AKAN_PUBLIC_") && !NativePublicEnv.derivedKeys.includes(key)).sort().map((key) => [key, String(env[key])]));
-  }
-  static hash(publicEnv) {
-    return createHash("sha256").update(JSON.stringify(NativePublicEnv.of(publicEnv))).digest("hex");
-  }
-  static problems(publicEnv) {
-    const keys = Object.keys(publicEnv);
-    const problems = keys.flatMap((key) => {
-      const value = publicEnv[key];
-      if (!NativePublicEnv.#keyPattern.test(key))
-        return [`${key} is not an AKAN_PUBLIC_[A-Z0-9_] name`];
-      const word = NativePublicEnv.#secretWords.find((secret) => key.includes(secret));
-      if (word)
-        return [`${key} names a ${word.toLowerCase()}, which a page bundle must not carry`];
-      if (typeof value !== "string")
-        return [`${key} is not a string`];
-      if (/[\u0000-\u001f\u007f]/.test(value))
-        return [`${key} holds a control character`];
-      return [];
-    });
-    if (keys.length > NativePublicEnv.#maxKeys)
-      problems.push(`${keys.length} keys, more than ${NativePublicEnv.#maxKeys}`);
-    const bytes = Buffer.byteLength(JSON.stringify(publicEnv));
-    if (bytes > NativePublicEnv.#maxBytes)
-      problems.push(`${bytes} bytes, more than ${NativePublicEnv.#maxBytes}`);
-    return problems;
-  }
-  static diff(a, b) {
-    return [...new Set([...Object.keys(a), ...Object.keys(b)])].filter((key) => a[key] !== b[key]).sort((x, y) => x < y ? -1 : x > y ? 1 : 0);
-  }
-  static async built(app) {
-    const file = Bun.file(CsrArtifactBuilder.publicEnvPath(app));
-    if (!await file.exists())
-      return null;
-    return NativePublicEnv.of(await file.json());
-  }
-  static async recordedIn(bundleFile) {
-    const file = Bun.file(bundleFile);
-    if (!await file.exists())
-      return null;
-    const bundle = await file.json();
-    return bundle.web?.publicEnv ?? null;
-  }
-  static async load(file) {
-    const source = Bun.file(file);
-    if (!await source.exists())
-      throw new Error(`--public-env ${file} does not exist.`);
-    const json = await source.json().catch(() => null);
-    if (!json || typeof json !== "object" || Array.isArray(json))
-      throw new Error(`--public-env ${file} is not a JSON object of AKAN_PUBLIC_* values or a bundle.json.`);
-    const isBundle = json.schema === 1 && typeof json.web === "object";
-    const map = isBundle ? json.web.publicEnv : json;
-    if (!map)
-      throw new Error(`--public-env ${file} is a bundle.json from a build that recorded no public env.`);
-    const derived = Object.keys(map).filter((key) => NativePublicEnv.derivedKeys.includes(key));
-    if (derived.length)
-      throw new Error(`--public-env ${file} sets ${derived.join(", ")}, which akan.config.ts decides.`);
-    const problems = NativePublicEnv.problems(map);
-    if (problems.length)
-      throw new Error(`--public-env ${file} is refused:
-- ${problems.join(`
-- `)}`);
-    return NativePublicEnv.of(map);
-  }
-  static pin(publicEnv) {
-    for (const key of Object.keys(process.env))
-      if (key.startsWith("AKAN_PUBLIC_") && !NativePublicEnv.derivedKeys.includes(key))
-        delete process.env[key];
-    Object.assign(process.env, publicEnv);
-    WorkspaceExecutor.publicEnvPin = publicEnv;
-  }
-  static async problemAgainst(shipped, bundle) {
-    const [before, now] = await Promise.all([NativePublicEnv.recordedIn(shipped), NativePublicEnv.recordedIn(bundle)]);
-    if (!before)
-      return null;
-    const differs = NativePublicEnv.diff(before, now ?? {});
-    if (!differs.length)
-      return null;
-    return `public env ${differs.join(", ")} differs from the store build's (pass --public-env ${shipped} to repeat it)`;
-  }
-}
-
-// pkgs/@akanjs/devkit/mobile/updatePackFolder.ts
-import { mkdtemp, rm } from "fs/promises";
-import os from "os";
-import path from "path";
-class UpdatePackFolder {
-  static packFile = "pack.json";
-  static compatFile = "compat.json";
-  static bundleFile = "bundle.json";
-  static templateFile = "manifest.template.json";
-  static filesDir = "files";
-  static #records = [
-    UpdatePackFolder.templateFile,
-    UpdatePackFolder.bundleFile,
-    UpdatePackFolder.packFile,
-    UpdatePackFolder.compatFile
-  ];
-  static #sha256 = /^[0-9a-f]{64}$/;
-  static async clear(dir) {
-    await Promise.all([UpdatePackFolder.packFile, UpdatePackFolder.compatFile].map((name) => rm(path.join(dir, name), { force: true })));
-  }
-  static async read(dir) {
-    const file = Bun.file(path.join(dir, UpdatePackFolder.packFile));
-    if (!await file.exists())
-      throw new Error(`${dir} holds no ${UpdatePackFolder.packFile}: give the folder \`akan pack-update\` wrote.`);
-    const pack = await file.json();
-    if (pack.schema !== 1)
-      throw new Error(`${dir}/${UpdatePackFolder.packFile} is schema ${pack.schema}, and this akan reads schema 1.`);
-    return { ...pack, out: path.resolve(dir) };
-  }
-  static async write({ out, ...record }) {
-    await Bun.write(path.join(out, UpdatePackFolder.packFile), `${JSON.stringify(record, null, 2)}
-`);
-  }
-  static async writeCompat(pack, compat) {
-    pack.compat = compat;
-    await Bun.write(path.join(pack.out, UpdatePackFolder.compatFile), `${JSON.stringify(compat, null, 2)}
-`);
-  }
-  static async readBundle(file) {
-    return await Bun.file(file).json();
-  }
-  static storeBuildVerdict({ out, compat }, then) {
-    if (!compat || compat.compatible)
-      return null;
-    return new ExitCodeError(`The pack in ${out} needs a new store build; it differs from the one ${compat.against} came from:
-- ${compat.problems.join(`
-- `)}${then ? `
-${then}` : ""}`, 2);
-  }
-  static async withArchive(pack, use) {
-    const { templateFile, filesDir } = UpdatePackFolder;
-    const template = Bun.file(path.join(pack.out, templateFile));
-    if (!await template.exists())
-      throw new Error(`${pack.out} holds no ${templateFile}: give the folder \`akan pack-update\` wrote.`);
-    const { files = [] } = await template.json();
-    const hashes = [...new Set(files.map((file) => file.sha256))];
-    if (!hashes.every((hash) => typeof hash === "string" && UpdatePackFolder.#sha256.test(hash)))
-      throw new Error(`${pack.out}/${templateFile} lists a file whose sha256 is not 64 hex digits.`);
-    const present = await Promise.all(UpdatePackFolder.#records.map((name) => Bun.file(path.join(pack.out, name)).exists()));
-    const entries = [
-      ...UpdatePackFolder.#records.filter((_, idx) => present[idx]),
-      ...hashes.map((hash) => `${filesDir}/${hash}`)
-    ];
-    const dir = await mkdtemp(path.join(os.tmpdir(), "akan-pack-"));
-    try {
-      const tar = Bun.spawn(["tar", "-czf", "pack.tgz", "-C", pack.out, "-T", "-"], {
-        cwd: dir,
-        stdin: new Blob([entries.map((entry) => `./${entry}
-`).join("")]),
-        stdout: "ignore",
-        stderr: "pipe"
-      });
-      const [code, stderr] = await Promise.all([tar.exited, new Response(tar.stderr).text()]);
-      if (code !== 0)
-        throw new Error(`tar of ${pack.out} failed: ${stderr.trim()}`);
-      return await use(path.join(dir, "pack.tgz"));
-    } finally {
-      await rm(dir, { recursive: true, force: true });
-    }
-  }
-}
-
-// pkgs/@akanjs/devkit/mobile/nativeApp.ts
-import path8 from "path";
-import { toError } from "akanjs/common";
+} from "./index-nx64dz92.js";
 
 // pkgs/@akanjs/devkit/mobile/desktopBin.ts
-import { chmod, mkdir, rename, rm as rm2, writeFile } from "fs/promises";
-import path2 from "path";
+import { chmod, mkdir, rename, rm, writeFile } from "fs/promises";
+import path from "path";
 class DesktopBin {
   app;
   config;
@@ -236,23 +51,23 @@ class DesktopBin {
   static fileName(name, executable, platform = process.platform) {
     if (platform !== "win32" || /\.(exe|cmd|bat|com)$/i.test(name))
       return name;
-    return `${name}${path2.extname(executable).toLowerCase() || ".exe"}`;
+    return `${name}${path.extname(executable).toLowerCase() || ".exe"}`;
   }
   static downloadName(url) {
-    const extension = /(?:\.tar)?\.[A-Za-z0-9]{1,8}$/.exec(path2.posix.basename(new URL(url).pathname))?.[0] ?? "";
+    const extension = /(?:\.tar)?\.[A-Za-z0-9]{1,8}$/.exec(path.posix.basename(new URL(url).pathname))?.[0] ?? "";
     return `download${extension.toLowerCase()}`;
   }
   static extractCommand(archive, dir, platform = process.platform) {
     if (platform === "linux" && /\.zip$/i.test(archive))
       return ["unzip", "-q", "-o", archive, "-d", dir];
-    const tar = platform === "win32" ? path2.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe") : "tar";
+    const tar = platform === "win32" ? path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe") : "tar";
     return [tar, "-xf", archive, "-C", dir];
   }
   static async sha256(file) {
     return new Bun.CryptoHasher("sha256").update(await Bun.file(file).arrayBuffer()).digest("hex");
   }
   get #cacheDir() {
-    return path2.join(this.app.cwdPath, ".akan", "cache", "bin");
+    return path.join(this.app.cwdPath, ".akan", "cache", "bin");
   }
   async stage(dir, arch = process.arch) {
     const scanInfo = this.app.getScanInfo({ allowEmpty: true }) ?? await this.app.scan({ write: false });
@@ -262,14 +77,14 @@ class DesktopBin {
     const platform = DesktopBin.platform(arch);
     if (!platform)
       throw new Error(`bin: this desktop app is for ${process.platform}-${arch}, and a bin names only ${binPlatforms.join(", ")}.`);
-    await rm2(dir, { recursive: true, force: true });
+    await rm(dir, { recursive: true, force: true });
     await mkdir(dir, { recursive: true });
     for (const [name, { owner, platforms }] of chosen) {
       const source = platforms[platform];
       if (!source)
         throw new Error(`${owner}: bin.${name} names no ${platform} file, the platform this desktop app is built for (it names ${Object.keys(platforms).join(", ") || "none"}).`);
       const executable = await this.#executable(`${owner}: bin.${name}.${platform}`, source);
-      const target = path2.join(dir, DesktopBin.fileName(name, executable));
+      const target = path.join(dir, DesktopBin.fileName(name, executable));
       await Bun.write(target, Bun.file(executable));
       await chmod(target, 493);
       this.app.logger.info(`The desktop app carries ${name} from ${"url" in source ? source.url : source.path}`);
@@ -283,14 +98,14 @@ class DesktopBin {
     if (!source.file)
       return file;
     const key = "url" in source ? source.sha256 : await DesktopBin.sha256(file);
-    const executable = path2.join(await this.#extract(file, key), ...source.file.split("/"));
+    const executable = path.join(await this.#extract(file, key), ...source.file.split("/"));
     if (!await Bun.file(executable).exists())
       throw new Error(`${at}: the archive holds no ${source.file}`);
     return executable;
   }
   async#download(at, { url, sha256 }) {
-    const dir = path2.join(this.#cacheDir, sha256);
-    const file = path2.join(dir, DesktopBin.downloadName(url));
+    const dir = path.join(this.#cacheDir, sha256);
+    const file = path.join(dir, DesktopBin.downloadName(url));
     if (await Bun.file(file).exists())
       return file;
     await mkdir(dir, { recursive: true });
@@ -307,10 +122,10 @@ class DesktopBin {
     return file;
   }
   async#extract(archive, key) {
-    const dir = path2.join(this.#cacheDir, key, "extracted");
+    const dir = path.join(this.#cacheDir, key, "extracted");
     if (await Bun.file(`${dir}.done`).exists())
       return dir;
-    await rm2(dir, { recursive: true, force: true });
+    await rm(dir, { recursive: true, force: true });
     await mkdir(dir, { recursive: true });
     const [command = "tar", ...args] = DesktopBin.extractCommand(archive, dir);
     if (command === "unzip" && !Bun.which("unzip"))
@@ -322,7 +137,7 @@ class DesktopBin {
 }
 
 // pkgs/@akanjs/devkit/mobile/nativeApi.ts
-import path3 from "path";
+import path2 from "path";
 
 class NativeApi {
   static supportedMajor = 0;
@@ -334,7 +149,7 @@ class NativeApi {
     const akanjsPackage = NativeApi.#resolve("akanjs/package.json", appDir);
     if (!akanjsPackage)
       throw new Error(`akanjs is not installed for ${appDir}; the native build ships inside it.`);
-    return path3.join(path3.dirname(akanjsPackage), "vendor", "@akanjs", "native", "packages", "cli", "src", "api.ts");
+    return path2.join(path2.dirname(akanjsPackage), "vendor", "@akanjs", "native", "packages", "cli", "src", "api.ts");
   }
   static async load(appDir) {
     const entry = NativeApi.entryOf(appDir);
@@ -355,6 +170,10 @@ class NativeApi {
   }
 }
 
+// pkgs/@akanjs/devkit/mobile/nativeApp.ts
+import path8 from "path";
+import { toError } from "akanjs/common";
+
 // pkgs/@akanjs/devkit/mobile/nativeAppLine.ts
 class NativeAppLine {
   static #page = /^\[page(\+)?(?:#(\d+))? (trace|verbose|debug|log|info|warn|error)\] ?(.*)$/;
@@ -412,7 +231,8 @@ class NativeAppLine {
 
 // pkgs/@akanjs/devkit/mobile/nativeConfig.ts
 import { readFileSync } from "fs";
-import path4 from "path";
+import path3 from "path";
+import { trimSlashes } from "akanjs/common";
 
 // pkgs/@akanjs/devkit/mobile/usageDescriptions.ts
 import { capitalize } from "akanjs/common";
@@ -494,11 +314,11 @@ class NativeConfig {
         warnings.push(`Permission '${permission}' has no native plugin yet; the app ships without it.`);
       return used;
     });
-    const abs = (relative) => path4.resolve(appPath, relative);
+    const abs = (relative) => path3.resolve(appPath, relative);
     const updates = NativeConfig.#updates(target, env);
-    const folders = new Set(nativePlugins.map((plugin) => path4.resolve(plugin.dir)));
+    const folders = new Set(nativePlugins.map((plugin) => path3.resolve(plugin.dir)));
     const folderIds = new Set(nativePlugins.map((plugin) => plugin.id));
-    const listed = (target.plugins ?? []).filter((spec) => NativeConfig.#isId(spec) ? !folderIds.has(spec) : !folders.has(path4.resolve(appPath, spec)));
+    const listed = (target.plugins ?? []).filter((spec) => NativeConfig.#isId(spec) ? !folderIds.has(spec) : !folders.has(path3.resolve(appPath, spec)));
     const plugins = [
       ...new Set([
         ...NativeConfig.basePlugins,
@@ -554,7 +374,7 @@ class NativeConfig {
       app: {
         id: resolveAppId(target.appId, platform),
         name: target.appName,
-        fileName: target.fileName ?? NativeConfig.fileNameOf(path4.basename(appPath)),
+        fileName: target.fileName ?? NativeConfig.fileNameOf(path3.basename(appPath)),
         version: target.version,
         build: target.buildNum
       },
@@ -614,20 +434,20 @@ class NativeConfig {
     return url && keys ? { ...rest, url, ...keys, ...channel ? { channel } : {} } : undefined;
   }
   static fileNameOf(name) {
-    return name.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[-.]+|[-.]+$/g, "") || "app";
+    return /[^-.](?:.*[^-.])?/.exec(name.replace(/[^A-Za-z0-9._-]/g, "-"))?.[0] ?? "app";
   }
   static #pluginId(appPath, spec) {
     if (NativeConfig.#isId(spec))
       return spec;
     try {
-      const { id } = JSON.parse(readFileSync(path4.join(path4.resolve(appPath, spec), "native-plugin.json"), "utf8"));
+      const { id } = JSON.parse(readFileSync(path3.join(path3.resolve(appPath, spec), "native-plugin.json"), "utf8"));
       return typeof id === "string" ? id : spec;
     } catch {
       return spec;
     }
   }
   static #isId(spec) {
-    return !spec.startsWith(".") && !path4.isAbsolute(spec);
+    return !spec.startsWith(".") && !path3.isAbsolute(spec);
   }
   static #compact(value) {
     const kept = Object.entries(value).filter(([, entry]) => Array.isArray(entry) ? entry.length > 0 : entry && typeof entry === "object" ? Object.keys(entry).length > 0 : entry !== undefined);
@@ -637,7 +457,7 @@ class NativeConfig {
     return Object.assign({}, ...contributed, own);
   }
   static #deepLinks(target, locales) {
-    const basePath = target.basePath?.replace(/^\/+|\/+$/g, "");
+    const basePath = target.basePath ? trimSlashes(target.basePath) : "";
     const pathPrefixes = basePath ? locales.map((locale) => `/${locale}/${basePath}`) : undefined;
     return {
       ...target.deepLinks?.schemes?.length ? { schemes: target.deepLinks.schemes } : {},
@@ -648,23 +468,23 @@ class NativeConfig {
 
 // pkgs/@akanjs/devkit/mobile/nativePluginFolders.ts
 import { readdir } from "fs/promises";
-import path5 from "path";
+import path4 from "path";
 
 class NativePluginFolders {
   static folder = "native";
   static async in(root, owner) {
-    const base = path5.join(root, NativePluginFolders.folder);
+    const base = path4.join(root, NativePluginFolders.folder);
     const entries = await readdir(base, { withFileTypes: true }).catch(() => []);
     const folders = entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name);
     return await Promise.all(folders.sort().map(async (name) => {
       const where = `${owner}/${NativePluginFolders.folder}/${name}`;
-      const manifest = Bun.file(path5.join(base, name, "native-plugin.json"));
+      const manifest = Bun.file(path4.join(base, name, "native-plugin.json"));
       if (!await manifest.exists())
         throw new Error(`${where} has no native-plugin.json; a folder in native/ is one native plugin.`);
       const { id } = await manifest.json();
       if (id !== name)
         throw new Error(`${where}/native-plugin.json has id ${JSON.stringify(id)}; name the folder after its id.`);
-      return { id, dir: path5.join(base, name), owner };
+      return { id, dir: path4.join(base, name), owner };
     }));
   }
   static select(own, fromLibs) {
@@ -683,15 +503,115 @@ class NativePluginFolders {
     const root = app.workspace.workspaceRoot;
     const [own, ...fromLibs] = await Promise.all([
       NativePluginFolders.in(app.cwdPath, `apps/${app.name}`),
-      ...scanInfo.getLibs().map((lib) => NativePluginFolders.in(path5.join(root, "libs", lib), `libs/${lib}`))
+      ...scanInfo.getLibs().map((lib) => NativePluginFolders.in(path4.join(root, "libs", lib), `libs/${lib}`))
     ]);
     return NativePluginFolders.select(own ?? [], fromLibs.flat());
   }
 }
 
+// pkgs/@akanjs/devkit/mobile/nativePublicEnv.ts
+import { createHash } from "crypto";
+class NativePublicEnv {
+  static derivedKeys = [
+    "AKAN_PUBLIC_APP_NAME",
+    "AKAN_PUBLIC_BASE_PATHS",
+    "AKAN_PUBLIC_API_PREFIX",
+    "AKAN_PUBLIC_WS_PREFIX",
+    "AKAN_PUBLIC_RENDER_ENV",
+    "AKAN_PUBLIC_DEFAULT_LOCALE",
+    "AKAN_PUBLIC_LOCALES"
+  ];
+  static #keyPattern = /^AKAN_PUBLIC_[A-Z0-9_]{1,128}$/;
+  static #secretWords = ["SECRET", "TOKEN", "PASSWORD", "PRIVATE", "CREDENTIAL"];
+  static #maxKeys = 256;
+  static #maxBytes = 64 * 1024;
+  static of(env) {
+    return Object.fromEntries(Object.keys(env).filter((key) => key.startsWith("AKAN_PUBLIC_") && !NativePublicEnv.derivedKeys.includes(key)).sort().map((key) => [key, String(env[key])]));
+  }
+  static hash(publicEnv) {
+    return createHash("sha256").update(JSON.stringify(NativePublicEnv.of(publicEnv))).digest("hex");
+  }
+  static problems(publicEnv) {
+    const keys = Object.keys(publicEnv);
+    const problems = keys.flatMap((key) => {
+      const value = publicEnv[key];
+      if (!NativePublicEnv.#keyPattern.test(key))
+        return [`${key} is not an AKAN_PUBLIC_[A-Z0-9_] name`];
+      const word = NativePublicEnv.#secretWords.find((secret) => key.includes(secret));
+      if (word)
+        return [`${key} names a ${word.toLowerCase()}, which a page bundle must not carry`];
+      if (typeof value !== "string")
+        return [`${key} is not a string`];
+      if (/[\u0000-\u001f\u007f]/.test(value))
+        return [`${key} holds a control character`];
+      return [];
+    });
+    if (keys.length > NativePublicEnv.#maxKeys)
+      problems.push(`${keys.length} keys, more than ${NativePublicEnv.#maxKeys}`);
+    const bytes = Buffer.byteLength(JSON.stringify(publicEnv));
+    if (bytes > NativePublicEnv.#maxBytes)
+      problems.push(`${bytes} bytes, more than ${NativePublicEnv.#maxBytes}`);
+    return problems;
+  }
+  static diff(a, b) {
+    return [...new Set([...Object.keys(a), ...Object.keys(b)])].filter((key) => a[key] !== b[key]).sort((x, y) => x < y ? -1 : x > y ? 1 : 0);
+  }
+  static async built(app) {
+    const file = Bun.file(CsrArtifactBuilder.publicEnvPath(app));
+    if (!await file.exists())
+      return null;
+    return NativePublicEnv.of(await file.json());
+  }
+  static async recordedIn(bundleFile) {
+    const file = Bun.file(bundleFile);
+    if (!await file.exists())
+      return null;
+    const bundle = await file.json();
+    return bundle.web?.publicEnv ?? null;
+  }
+  static async load(file) {
+    const source = Bun.file(file);
+    if (!await source.exists())
+      throw new Error(`--public-env ${file} does not exist.`);
+    const json = await source.json().catch(() => null);
+    if (!json || typeof json !== "object" || Array.isArray(json))
+      throw new Error(`--public-env ${file} is not a JSON object of AKAN_PUBLIC_* values or a bundle.json.`);
+    const isBundle = json.schema === 1 && typeof json.web === "object";
+    const map = isBundle ? json.web.publicEnv : json;
+    if (!map)
+      throw new Error(`--public-env ${file} is a bundle.json from a build that recorded no public env.`);
+    const derived = Object.keys(map).filter((key) => NativePublicEnv.derivedKeys.includes(key));
+    if (derived.length)
+      throw new Error(`--public-env ${file} sets ${derived.join(", ")}, which akan.config.ts decides.`);
+    const problems = NativePublicEnv.problems(map);
+    if (problems.length)
+      throw new Error(`--public-env ${file} is refused:
+- ${problems.join(`
+- `)}`);
+    return NativePublicEnv.of(map);
+  }
+  static pin(publicEnv) {
+    for (const key of Object.keys(process.env))
+      if (key.startsWith("AKAN_PUBLIC_") && !NativePublicEnv.derivedKeys.includes(key))
+        delete process.env[key];
+    Object.assign(process.env, publicEnv);
+    WorkspaceExecutor.publicEnvPin = publicEnv;
+  }
+  static async problemAgainst(shipped, bundle) {
+    const [before, now] = await Promise.all([NativePublicEnv.recordedIn(shipped), NativePublicEnv.recordedIn(bundle)]);
+    if (!before)
+      return null;
+    const differs = NativePublicEnv.diff(before, now ?? {});
+    if (!differs.length)
+      return null;
+    return `public env ${differs.join(", ")} differs from the store build's (pass --public-env ${shipped} to repeat it)`;
+  }
+}
+
 // pkgs/@akanjs/devkit/mobile/nativeWebDir.ts
-import { cp, mkdir as mkdir2, rm as rm3, stat } from "fs/promises";
-import path6 from "path";
+import { cp, mkdir as mkdir2, rm as rm2, stat } from "fs/promises";
+import path5 from "path";
+import { trimSlashes as trimSlashes2 } from "akanjs/common";
 
 class NativeWebDir {
   dir;
@@ -702,13 +622,13 @@ class NativeWebDir {
   static injectTarget(html, target) {
     if (html.includes(NativeWebDir.#targetTag))
       return html;
-    const basePath = target.basePath?.replace(/^\/+|\/+$/g, "") ?? "";
+    const basePath = target.basePath ? trimSlashes2(target.basePath) : "";
     const script = `${NativeWebDir.#targetTag}${JSON.stringify({
       name: target.name,
       basePath,
       indexPath: target.indexPath
     })};</script>`;
-    const head = /<head(?:\s[^>]*)?>/i.exec(html);
+    const head = /<head(?:\s[^<>]*)?>/i.exec(html);
     if (!head)
       return `${script}
 ${html}`;
@@ -718,7 +638,7 @@ ${script}${html.slice(at)}`;
   }
   static #targetTag = "<script>window.__AKAN_MOBILE_TARGET__=";
   async clear() {
-    await rm3(this.dir, { recursive: true, force: true });
+    await rm2(this.dir, { recursive: true, force: true });
     await mkdir2(this.dir, { recursive: true });
   }
   async assemble(target, { html, publicDir, fontsDir }) {
@@ -728,12 +648,12 @@ ${script}${html.slice(at)}`;
     if (publicDir && await NativeWebDir.#isDir(publicDir))
       await cp(publicDir, this.dir, { recursive: true });
     if (fontsDir && await NativeWebDir.#isDir(fontsDir))
-      await cp(fontsDir, path6.join(this.dir, "_akan", "fonts"), { recursive: true });
-    if (await NativeWebDir.#isDir(path6.join(this.dir, NativeWebDir.reservedEntry)))
+      await cp(fontsDir, path5.join(this.dir, "_akan", "fonts"), { recursive: true });
+    if (await NativeWebDir.#isDir(path5.join(this.dir, NativeWebDir.reservedEntry)))
       throw new Error(`public/${NativeWebDir.reservedEntry} is reserved for the native runtime.`);
-    await Bun.write(path6.join(this.dir, "index.html"), NativeWebDir.injectTarget(await Bun.file(html).text(), target));
+    await Bun.write(path5.join(this.dir, "index.html"), NativeWebDir.injectTarget(await Bun.file(html).text(), target));
     const files = await Array.fromAsync(new Bun.Glob("**/*").scan({ cwd: this.dir, onlyFiles: true, dot: true }));
-    return files.map((file) => file.split(path6.sep).join("/")).sort();
+    return files.map((file) => file.split(path5.sep).join("/")).sort();
   }
   static async#isDir(dir) {
     try {
@@ -746,7 +666,7 @@ ${script}${html.slice(at)}`;
 
 // pkgs/@akanjs/devkit/mobile/serverBundleSecrets.ts
 import { readdir as readdir2, readFile, stat as stat2 } from "fs/promises";
-import path7 from "path";
+import path6 from "path";
 class ServerBundleSecrets {
   workspaceRoot;
   appDir;
@@ -758,8 +678,8 @@ class ServerBundleSecrets {
     this.appDir = appDir;
   }
   async envFiles() {
-    const dirs = [path7.join(this.appDir, "env"), ...(await this.#libDirs()).map((lib) => path7.join(lib, "env"))];
-    const files = await Promise.all(dirs.map(async (dir) => (await readdir2(dir).catch(() => [])).filter((name) => /^env\.server\.[A-Za-z0-9.-]+\.ts$/.test(name) && !/\.(type|example)\.ts$/.test(name)).map((name) => path7.join(dir, name))));
+    const dirs = [path6.join(this.appDir, "env"), ...(await this.#libDirs()).map((lib) => path6.join(lib, "env"))];
+    const files = await Promise.all(dirs.map(async (dir) => (await readdir2(dir).catch(() => [])).filter((name) => /^env\.server\.[A-Za-z0-9.-]+\.ts$/.test(name) && !/\.(type|example)\.ts$/.test(name)).map((name) => path6.join(dir, name))));
     return files.flat();
   }
   async assertClean(bundleDir) {
@@ -767,7 +687,7 @@ class ServerBundleSecrets {
     const secrets = [];
     for (const file of await this.envFiles()) {
       try {
-        const value = await ServerEnvProfile.evaluate(file, path7.dirname(path7.dirname(file)));
+        const value = await ServerEnvProfile.evaluate(file, path6.dirname(path6.dirname(file)));
         secrets.push(...ServerEnvProfile.secretValues(value).map((secret) => ({ file, ...secret })));
       } catch {
         unread.push(ServerBundleSecrets.#relative(this.workspaceRoot, file));
@@ -807,8 +727,8 @@ Build its server with a profile (native.desktop.server.profile), whose bundle le
     return coded;
   }
   async#libDirs() {
-    const libsDir = path7.join(this.workspaceRoot, "libs");
-    return (await readdir2(libsDir).catch(() => [])).map((lib) => path7.join(libsDir, lib));
+    const libsDir = path6.join(this.workspaceRoot, "libs");
+    return (await readdir2(libsDir).catch(() => [])).map((lib) => path6.join(libsDir, lib));
   }
   static #needles(value) {
     const escaped = JSON.stringify(value).slice(1, -1);
@@ -821,12 +741,12 @@ Build its server with a profile (native.desktop.server.profile), whose bundle le
     return /^export default (["'`])([\s\S]*)\1;?\s*$/.exec(code)?.[2] ?? value;
   }
   static #relative(from, to) {
-    return path7.relative(from, to).split(path7.sep).join("/");
+    return path6.relative(from, to).split(path6.sep).join("/");
   }
   static async#files(dir) {
     const files = [];
     for (const entry of await readdir2(dir, { withFileTypes: true })) {
-      const file = path7.join(dir, entry.name);
+      const file = path6.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name !== "node_modules")
           files.push(...await ServerBundleSecrets.#files(file));
@@ -840,7 +760,7 @@ Build its server with a profile (native.desktop.server.profile), whose bundle le
     for (const entry of await readdir2(dir, { withFileTypes: true }).catch(() => [])) {
       if (entry.name.startsWith("."))
         continue;
-      const file = path7.join(dir, entry.name);
+      const file = path6.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (!ServerBundleSecrets.#notSource.has(entry.name))
           files.push(...await ServerBundleSecrets.#sources(file));
@@ -851,6 +771,88 @@ Build its server with a profile (native.desktop.server.profile), whose bundle le
   }
 }
 
+// pkgs/@akanjs/devkit/mobile/updatePackFolder.ts
+import { mkdtemp, rm as rm3 } from "fs/promises";
+import os from "os";
+import path7 from "path";
+class UpdatePackFolder {
+  static packFile = "pack.json";
+  static compatFile = "compat.json";
+  static bundleFile = "bundle.json";
+  static templateFile = "manifest.template.json";
+  static filesDir = "files";
+  static #records = [
+    UpdatePackFolder.templateFile,
+    UpdatePackFolder.bundleFile,
+    UpdatePackFolder.packFile,
+    UpdatePackFolder.compatFile
+  ];
+  static #sha256 = /^[0-9a-f]{64}$/;
+  static async clear(dir) {
+    await Promise.all([UpdatePackFolder.packFile, UpdatePackFolder.compatFile].map((name) => rm3(path7.join(dir, name), { force: true })));
+  }
+  static async read(dir) {
+    const file = Bun.file(path7.join(dir, UpdatePackFolder.packFile));
+    if (!await file.exists())
+      throw new Error(`${dir} holds no ${UpdatePackFolder.packFile}: give the folder \`akan pack-update\` wrote.`);
+    const pack = await file.json();
+    if (pack.schema !== 1)
+      throw new Error(`${dir}/${UpdatePackFolder.packFile} is schema ${pack.schema}, and this akan reads schema 1.`);
+    return { ...pack, out: path7.resolve(dir) };
+  }
+  static async write({ out, ...record }) {
+    await Bun.write(path7.join(out, UpdatePackFolder.packFile), `${JSON.stringify(record, null, 2)}
+`);
+  }
+  static async writeCompat(pack, compat) {
+    pack.compat = compat;
+    await Bun.write(path7.join(pack.out, UpdatePackFolder.compatFile), `${JSON.stringify(compat, null, 2)}
+`);
+  }
+  static async readBundle(file) {
+    return await Bun.file(file).json();
+  }
+  static storeBuildVerdict({ out, compat }, then) {
+    if (!compat || compat.compatible)
+      return null;
+    return new ExitCodeError(`The pack in ${out} needs a new store build; it differs from the one ${compat.against} came from:
+- ${compat.problems.join(`
+- `)}${then ? `
+${then}` : ""}`, 2);
+  }
+  static async withArchive(pack, use) {
+    const { templateFile, filesDir } = UpdatePackFolder;
+    const template = Bun.file(path7.join(pack.out, templateFile));
+    if (!await template.exists())
+      throw new Error(`${pack.out} holds no ${templateFile}: give the folder \`akan pack-update\` wrote.`);
+    const { files = [] } = await template.json();
+    const hashes = [...new Set(files.map((file) => file.sha256))];
+    if (!hashes.every((hash) => typeof hash === "string" && UpdatePackFolder.#sha256.test(hash)))
+      throw new Error(`${pack.out}/${templateFile} lists a file whose sha256 is not 64 hex digits.`);
+    const present = await Promise.all(UpdatePackFolder.#records.map((name) => Bun.file(path7.join(pack.out, name)).exists()));
+    const entries = [
+      ...UpdatePackFolder.#records.filter((_, idx) => present[idx]),
+      ...hashes.map((hash) => `${filesDir}/${hash}`)
+    ];
+    const dir = await mkdtemp(path7.join(os.tmpdir(), "akan-pack-"));
+    try {
+      const tar = Bun.spawn(["tar", "-czf", "pack.tgz", "-C", pack.out, "-T", "-"], {
+        cwd: dir,
+        stdin: new Blob([entries.map((entry) => `./${entry}
+`).join("")]),
+        stdout: "ignore",
+        stderr: "pipe"
+      });
+      const [code, stderr] = await Promise.all([tar.exited, new Response(tar.stderr).text()]);
+      if (code !== 0)
+        throw new Error(`tar of ${pack.out} failed: ${stderr.trim()}`);
+      return await use(path7.join(dir, "pack.tgz"));
+    } finally {
+      await rm3(dir, { recursive: true, force: true });
+    }
+  }
+}
+
 // pkgs/@akanjs/devkit/mobile/nativeApp.ts
 class NativeApp {
   app;