@akanjs/devkit 3.1.0-rc.3 → 3.1.0-rc.5

package/frontendBuild/routeClientBuilder.ts

@@ -244,7 +244,7 @@ export class RouteClientBuilder {
   //? a probe export and only the ones the parser reports as exports are declarations.
   static #declaredNamedDefaultFunctions(source: string, filePath?: string) {
     const candidates = [
-      ...source.matchAll(/(^|\n)(\s*)export\s+default\s+(async\s+)?function\s+([A-Za-z_$][\w$]*)(?=\s*(?:<|\())/g),
+      ...source.matchAll(/(^|\n)([^\S\n]*)export\s+default\s+(async\s+)?function\s+([A-Za-z_$][\w$]*)(?=\s*(?:<|\())/g),
     ].map((match) => ({
       index: match.index,
       text: match[0],

package/frontendBuild/sourceMtimeIndex.test.ts

@@ -50,7 +50,7 @@ describe("SourceMtimeIndex", () => {
 
     for (const [i, abs] of files.entries()) await rewrite(abs, `${i}00`);
 
-    expect((await index.collectChanges()).sort()).toEqual([...files].sort());
+    expect((await index.collectChanges()).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))).toEqual([...files].sort());
   });
 
   test("reports a change once, then stops reporting it", async () => {

package/frontendBuild/themeValidator.test.ts

@@ -37,6 +37,67 @@ describe("ThemeValidator.parseThemeTokens", () => {
     const tokens = ThemeValidator.parseThemeTokens(css);
     expect(Object.keys(tokens)).toEqual([":root"]);
   });
+
+  test("reads every block, not every other one", () => {
+    const css = `.a {} :root { --background: #fff; } .b {} [data-theme='light'] { --background: #eee; } [data-theme="dark"] { --background: #111; }`;
+    expect(ThemeValidator.parseThemeTokens(css)).toEqual({
+      ":root": { background: "#fff" },
+      '[data-theme="light"]': { background: "#eee" },
+      '[data-theme="dark"]': { background: "#111" },
+    });
+  });
+
+  test("reads the first block after @source and @import lines", () => {
+    const css = [
+      `@source "./**/*";`,
+      `@import "tailwindcss";`,
+      `@plugin "tailwind-scrollbar";`,
+      `:root { --background: #ffffff; --foreground: #0a0a0a; }`,
+      `[data-theme="dark"] { --background: #0a0a0a; --foreground: #fafafa; }`,
+      `[data-theme="light"] { --background: #fafafa; --foreground: #171717; }`,
+    ].join("\n");
+    expect(Object.keys(ThemeValidator.parseThemeTokens(css))).toEqual([
+      ":root",
+      '[data-theme="dark"]',
+      '[data-theme="light"]',
+    ]);
+  });
+
+  test("keeps a block's own declarations, skipping comments and nested rules", () => {
+    const css = `:root { /* --background: #000; */ --background: #fff; .x { --foreground: #000; } --foreground: #111 }`;
+    expect(ThemeValidator.parseThemeTokens(css)).toEqual({ ":root": { background: "#fff", foreground: "#111" } });
+  });
+
+  test("merges a scope declared twice, the later value winning", () => {
+    const css = `:root { --background: #fff; --foreground: #000; } :root { --foreground: #111; }`;
+    expect(ThemeValidator.parseThemeTokens(css)).toEqual({ ":root": { background: "#fff", foreground: "#111" } });
+  });
+
+  test("reads through @layer and keys a conditional scope by its condition", () => {
+    const css = [
+      `@layer base { :root { --background: #fff; --foreground: #000; } }`,
+      `@media (prefers-color-scheme: dark) { :root { --background: #000; } }`,
+    ].join("\n");
+    expect(ThemeValidator.parseThemeTokens(css)).toEqual({
+      ":root": { background: "#fff", foreground: "#000" },
+      "@media (prefers-color-scheme: dark) :root": { background: "#000" },
+    });
+  });
+
+  test("adversarial input finishes well under a second", () => {
+    for (const css of [
+      " ".repeat(100_000),
+      `}${" ".repeat(100_000)}`,
+      `:root{${"--".repeat(100_000)}`,
+      `:root{---:${" ".repeat(100_000)}`,
+      ":root{--background:#fff}".repeat(100_000),
+      `${"@media x{".repeat(100_000)}:root{--background:#fff}`,
+    ]) {
+      const started = performance.now();
+      ThemeValidator.parseThemeTokens(css);
+      expect(performance.now() - started).toBeLessThan(1000);
+    }
+  });
 });
 
 describe("ThemeValidator.validate", () => {
@@ -58,12 +119,32 @@ describe("ThemeValidator.validate", () => {
     const css = `:root { --primary: var(--brand); --primary-foreground: #000000; }`;
     expect(validator.validate(css)).toHaveLength(0);
   });
+
+  test("checks a conditional scope over the scope it overrides", () => {
+    const css = [
+      `:root { --background: #ffffff; --foreground: #000000; }`,
+      `@media (prefers-color-scheme: dark) { :root { --background: #111111; } }`,
+    ].join("\n");
+    const violations = validator.validate(css);
+    expect(violations.map(({ scope, pair }) => [scope, pair])).toEqual([
+      ["@media (prefers-color-scheme: dark) :root", "background / foreground"],
+    ]);
+  });
 });
 
 describe("shipped framework palette", () => {
+  const css = readFileSync(path.resolve(import.meta.dir, "../../../akanjs/ui/styles.css"), "utf8");
+
+  test("pkgs/akanjs/ui/styles.css parses :root, dark and light", () => {
+    const tokens = ThemeValidator.parseThemeTokens(css);
+    expect(Object.keys(tokens)).toEqual([":root", '[data-theme="dark"]', '[data-theme="light"]']);
+    expect(tokens[":root"].background).toBe("#0a0a0a");
+    expect(tokens['[data-theme="dark"]'].background).toBe("#0a0a0a");
+    expect(tokens['[data-theme="light"]'].background).toBe("#ffffff");
+    for (const scopeTokens of Object.values(tokens)) expect(Object.keys(scopeTokens).length).toBeGreaterThanOrEqual(26);
+  });
+
   test("pkgs/akanjs/ui/styles.css passes WCAG contrast for all scopes", () => {
-    const stylesPath = path.resolve(import.meta.dir, "../../../akanjs/ui/styles.css");
-    const css = readFileSync(stylesPath, "utf8");
     const violations = validator.validate(css);
     expect(violations).toEqual([]);
   });

package/frontendBuild/themeValidator.ts

@@ -1,4 +1,5 @@
 // No akanjs runtime import: this runs inside the lint path.
+import { type CssBlock, CssBlockParser } from "./cssBlockParser";
 
 export interface ThemeContrastViolation {
   scope: string;
@@ -34,6 +35,7 @@ const PAIRS: PairDef[] = [
 ];
 
 const THEME_SCOPES = new Set([":root", '[data-theme="dark"]', '[data-theme="light"]']);
+const CONDITIONAL_AT_RULES = new Set(["@media", "@supports", "@container"]);
 
 export type ThemeTokensByScope = Record<string, Record<string, string>>;
 
@@ -42,8 +44,9 @@ export class ThemeValidator {
     const tokensByScope = ThemeValidator.parseThemeTokens(css);
     const violations: ThemeContrastViolation[] = [];
     for (const [scope, tokens] of Object.entries(tokensByScope)) {
-      if (!THEME_SCOPES.has(scope)) continue;
-      violations.push(...this.validateScope(tokens, scope));
+      const underlying = THEME_SCOPES.has(scope) ? null : [...THEME_SCOPES].find((name) => scope.endsWith(` ${name}`));
+      const effective = underlying ? ThemeValidator.#overlayPairs(tokensByScope[underlying] ?? {}, tokens) : tokens;
+      violations.push(...this.validateScope(effective, scope));
     }
     return violations;
   }
@@ -75,23 +78,42 @@ export class ThemeValidator {
   /** A scope declared twice keeps the later value, so pass the framework css before the app's. */
   static parseThemeTokens(css: string): ThemeTokensByScope {
     const result: ThemeTokensByScope = {};
-    const blockRe = /(?:^|})\s*([^{}@]+?)\s*\{([^{}]*)\}/g;
-    for (const block of css.matchAll(blockRe)) {
-      const selectors = block[1].split(",").map((s) => s.trim());
-      const relevant = selectors.filter((s) => THEME_SCOPES.has(ThemeValidator.#normalizeScope(s)));
-      if (relevant.length === 0) continue;
-      const decls: Record<string, string> = {};
-      for (const decl of block[2].matchAll(/--([\w-]+)\s*:\s*([^;]+?)\s*(?:;|$)/g)) {
-        decls[decl[1]] = decl[2].trim();
+    CssBlockParser.walk(CssBlockParser.parse(css), "", (node, condition) => {
+      if (node.kind !== "block") return null;
+      if (node.atRule === "@layer") return condition;
+      if (node.atRule) return CONDITIONAL_AT_RULES.has(node.atRule) ? node.prelude.replace(/\s+/g, " ") : null;
+      const scopes = node.prelude
+        .split(",")
+        .map((selector) => ThemeValidator.#normalizeScope(selector))
+        .filter((scope) => THEME_SCOPES.has(scope));
+      if (scopes.length === 0) return null;
+      const tokens = ThemeValidator.#customProperties(node);
+      for (const scope of scopes) {
+        const key = condition ? `${condition} ${scope}` : scope;
+        result[key] = Object.assign(result[key] ?? {}, tokens);
       }
-      for (const selector of relevant) {
-        const scope = ThemeValidator.#normalizeScope(selector);
-        result[scope] = { ...(result[scope] ?? {}), ...decls };
-      }
-    }
+      return null;
+    });
     return result;
   }
 
+  static #customProperties(block: CssBlock): Record<string, string> {
+    const tokens: Record<string, string> = {};
+    for (const node of block.nodes) {
+      if (node.kind === "declaration" && node.property.startsWith("--")) tokens[node.property.slice(2)] = node.value;
+    }
+    return tokens;
+  }
+
+  static #overlayPairs(underlying: Record<string, string>, tokens: Record<string, string>): Record<string, string> {
+    const effective: Record<string, string> = {};
+    for (const name of PAIRS.flatMap(({ base, fg }) => [base, fg])) {
+      const value = tokens[name] ?? underlying[name];
+      if (value) effective[name] = value;
+    }
+    return effective;
+  }
+
   static #normalizeScope(selector: string): string {
     return selector.replace(/\[data-theme=['"]?([\w-]+)['"]?\]/g, '[data-theme="$1"]').trim();
   }

package/getRelatedCnsts.ts

@@ -1,4 +1,5 @@
 import { readFileSync, realpathSync } from "node:fs";
+import { dirname } from "node:path";
 import ora from "ora";
 import * as ts from "typescript";
 
@@ -45,7 +46,7 @@ export const parseTsConfig = (tsConfigPath: string = "./tsconfig.json") => {
     return ts.sys.readFile(path);
   });
 
-  return ts.parseJsonConfigFileContent(configFile.config, ts.sys, realpathSync(tsConfigPath).replace(/[^/\\]+$/, ""));
+  return ts.parseJsonConfigFileContent(configFile.config, ts.sys, dirname(realpathSync(tsConfigPath)));
 };
 
 const collectFiles = (constantFilePath: string, parsedConfig: ts.ParsedCommandLine, includeExports: boolean) => {

package/integration/devStabilityHarness.ts

@@ -772,9 +772,11 @@ export const dictionary = serviceDictionary(["en", "ko"])
   }
 
   static async #psRowsOrThrow(): Promise<Array<{ pid: number; ppid: number; rssKb: number; cmd: string }>> {
-    const rows = (await DevStabilityHarness.#psRows()) ?? (await DevStabilityHarness.#psRows());
-    if (!rows) throw new Error("ps did not answer twice in a row; cannot measure the process tree");
-    return rows;
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      const rows = await DevStabilityHarness.#psRows();
+      if (rows) return rows;
+    }
+    throw new Error("ps did not answer twice in a row; cannot measure the process tree");
   }
 
   static #collectDescendants(rows: Array<{ pid: number; ppid: number }>, rootPid: number): Set<number> {

package/lint/__fixtures__/no-deep-internal-import/bad.tsx

@@ -1,3 +1,4 @@
 import { userConstant } from "@libs/shared/lib/user/user.constant"; // @flag
 import { helper } from "../../common/helper"; // @flag
 import * as cnst from "../cnst"; // @flag
+export { cnst, helper, userConstant };

package/lint/__fixtures__/no-deep-internal-import/good.tsx

@@ -1,3 +1,4 @@
 import { cnst, st } from "@apps/demo/client"; // @ok
 import { Task } from "./task.constant"; // @ok
 import { env } from "@apps/demo/env/env.client"; // @ok
+export { cnst, env, st, Task };

package/lint/__fixtures__/no-import-client-functions/bad.tsx

@@ -1,2 +1,3 @@
 import { useState } from "react"; // @flag
 import { st } from "../st"; // @flag
+export { st, useState };

package/lint/__fixtures__/no-import-client-functions/good.tsx

@@ -2,3 +2,4 @@ import type { ReactNode } from "react"; // @ok
 import { cnst } from "@libs/shared/client"; // @ok
 import { usePage } from "akanjs/client"; // @ok
 export const Card = ({ children }: { children: ReactNode }) => <div>{children}</div>; // @ok
+export { cnst, usePage };

package/lint/__fixtures__/no-import-client-in-server/bad.tsx

@@ -4,3 +4,4 @@ import { Button } from "@libs/shared/ui"; // @flag
 import { useSpeech } from "@libs/util/webkit"; // @flag
 import { cn } from "akanjs/client"; // @flag
 import { st } from "../st"; // @flag
+export { Button, Card, cn, st, TaskStore, useSpeech };

package/lint/__fixtures__/no-import-client-in-server/good.tsx

@@ -3,3 +3,4 @@ import * as cnst from "../cnst"; // @ok
 import * as db from "../db"; // @ok
 import { Err } from "../dict"; // @ok
 import { Admin } from "@libs/shared/srvkit"; // @ok
+export { Admin, cnst, db, Err };

package/lint/__fixtures__/no-import-external-library/bad.tsx

@@ -2,3 +2,4 @@ import dayjs from "dayjs"; // @flag
 import { z } from "zod"; // @flag
 import fs from "node:fs"; // @flag
 import { clsx } from "clsx"; // @flag
+export { clsx, dayjs, fs, z };

package/lint/__fixtures__/no-import-external-library/good.tsx

@@ -3,3 +3,4 @@ import { cnst } from "@libs/shared/client"; // @ok
 import { field } from "akanjs/constant"; // @ok
 import { useState } from "react"; // @ok
 import { test } from "bun:test"; // @ok
+export { cnst, field, test, Ticket, useState };

package/lint/__fixtures__/no-import-external-library-in-test/bad.tsx

@@ -4,3 +4,4 @@ import fs from "node:fs"; // @ok
 import { Database } from "bun:sqlite"; // @ok
 import { describe } from "bun:test"; // @ok
 import { cnst } from "../cnst"; // @ok
+export { cnst, Database, dayjs, describe, fs, z };

package/lint/__fixtures__/no-import-external-library-in-test/good.tsx

@@ -4,3 +4,4 @@ import { tmpdir } from "node:os"; // @ok
 import { Database } from "bun:sqlite"; // @ok
 import { describe, expect, test } from "bun:test"; // @ok
 import { fetch } from "../sig"; // @ok
+export { createServer, Database, describe, expect, fetch, mkdtemp, test, tmpdir };

package/lint/__fixtures__/no-import-server-in-client/bad.tsx

@@ -4,3 +4,4 @@ import { Admin } from "@libs/shared/srvkit"; // @flag
 import { AkanServer } from "akanjs/server"; // @flag
 import * as db from "../db"; // @flag
 import { Err } from "../dict"; // @flag
+export { AkanServer, Admin, db, Err, TaskModel, TaskService };

package/lint/__fixtures__/no-import-server-in-client/good.tsx

@@ -2,3 +2,4 @@ import type { TaskService } from "./task.service"; // @ok
 import * as cnst from "../cnst"; // @ok
 import { st } from "../st"; // @ok
 import { Err, Task } from "@libs/shared/client"; // @ok
+export { cnst, Err, st, Task };

package/lint/__fixtures__/no-init-fetch-in-client/store-file/bad.ts

@@ -1 +1 @@
-export class TaskStore { async reload(orgId: string) { const snapshot = await fetch.initTaskInOrg(orgId); } } // @flag
+export class TaskStore { async reload(orgId: string) { await fetch.initTaskInOrg(orgId); } } // @flag

package/lint/__fixtures__/no-static-in-object-light-model/bad.ts

@@ -1,4 +1,4 @@
-import { enumOf, ID, Int } from "akanjs/base";
+import { ID, Int } from "akanjs/base";
 import { via } from "akanjs/constant";
 
 export class QuizInput extends via((field) => ({
@@ -12,7 +12,7 @@ export class QuizObject extends via(QuizInput, (field) => ({
   static readonly minNum = 1; // @flag
   private static secretNum = 2; // @flag
   static { // @flag
-    QuizObject.maxNum = 5;
+    QuizObject.maxNum += 1;
   }
 }
 

package/mobile/mobileTarget.ts

@@ -1,4 +1,5 @@
 import type { AkanNativeAppId } from "akanjs";
+import { trimSlashes } from "akanjs/common";
 import type { AkanAppConfig, AkanNativeTarget, NativeEnv } from "../akanConfig";
 import type { App } from "../commandDecorators";
 
@@ -14,8 +15,6 @@ export interface ResolvedMobileTarget {
 
 export const MOBILE_ENVS = ["local", "debug", "develop", "main"] as const satisfies readonly NativeEnv[];
 
-const trimSlashes = (value: string) => value.replace(/^\/+|\/+$/g, "");
-
 export const getMobileTargets = async (app: App): Promise<ResolvedMobileTarget[]> => {
   const config = await app.getConfig();
   return Object.entries(config.native.targets).map(([name, target]) => ({ name, config: target }));

package/mobile/nativeApp.test.ts

@@ -151,7 +151,7 @@ describe("NativeApp", () => {
 
   describe("the public env a build inlined, recorded in its bundle.json", () => {
     const publicEnv = { AKAN_PUBLIC_ENV: "main", AKAN_PUBLIC_SERVE_DOMAIN: "akamir.com" };
-    const building = async (inlined: Record<string, string>, updates: object | undefined) => {
+    const building = async (inlined: Record<string, string>, updates: AkanNativeTarget["updates"]) => {
       const root = await makeTempRoot();
       const warned: string[] = [];
       const app = {

package/mobile/nativeConfig.test.ts

@@ -489,6 +489,9 @@ describe("NativeConfig.build", () => {
     expect(NativeConfig.fileNameOf("minimal")).toBe("minimal");
     expect(NativeConfig.fileNameOf("my app!")).toBe("my-app");
     expect(NativeConfig.fileNameOf("...")).toBe("app");
+    expect(NativeConfig.fileNameOf(".-my app!-.")).toBe("my-app");
+    expect(NativeConfig.fileNameOf("-a-")).toBe("a");
+    expect(NativeConfig.fileNameOf(`a${"-".repeat(50_000)}b`)).toHaveLength(50_002);
   });
 });
 

package/mobile/nativeConfig.ts

@@ -9,6 +9,7 @@ import type {
   NativeEnv,
   NativePermission,
 } from "akanjs";
+import { trimSlashes } from "akanjs/common";
 import type { DesktopServerBundle } from "./desktopServerStage";
 import { type NativePlatform, resolveAppId } from "./mobileTarget";
 import type { NativePluginFolder } from "./nativePluginFolders";
@@ -271,7 +272,7 @@ export class NativeConfig {
 
   /** Letters, digits, `.`, `_` and `-` only; the folder name of an akan app already is one almost always. */
   static fileNameOf(name: string) {
-    return name.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[-.]+|[-.]+$/g, "") || "app";
+    return /[^-.](?:.*[^-.])?/.exec(name.replace(/[^A-Za-z0-9._-]/g, "-"))?.[0] ?? "app";
   }
 
   //? A permission names a plugin by its id, and a plugin given by folder is named in its manifest; a spec the runtime
@@ -311,7 +312,7 @@ export class NativeConfig {
 
   //* Every route sits under /:lang, so an app link limited to a basePath lists it once per locale.
   static #deepLinks(target: AkanNativeTarget, locales: readonly string[]) {
-    const basePath = target.basePath?.replace(/^\/+|\/+$/g, "");
+    const basePath = target.basePath ? trimSlashes(target.basePath) : "";
     const pathPrefixes = basePath ? locales.map((locale) => `/${locale}/${basePath}`) : undefined;
     return {
       ...(target.deepLinks?.schemes?.length ? { schemes: target.deepLinks.schemes } : {}),

package/mobile/nativeWebDir.ts

@@ -1,6 +1,7 @@
 import { cp, mkdir, rm, stat } from "node:fs/promises";
 import path from "node:path";
 import type { AkanNativeTarget } from "akanjs";
+import { trimSlashes } from "akanjs/common";
 
 export interface NativeWebDirSources {
   /** The target's CSR bundle: one HTML file with its scripts and styles inlined. */
@@ -21,13 +22,13 @@ export class NativeWebDir {
   //* it goes first in <head>, ahead of every script, because the page reads it as it boots.
   static injectTarget(html: string, target: Pick<AkanNativeTarget, "name" | "basePath" | "indexPath">) {
     if (html.includes(NativeWebDir.#targetTag)) return html;
-    const basePath = target.basePath?.replace(/^\/+|\/+$/g, "") ?? "";
+    const basePath = target.basePath ? trimSlashes(target.basePath) : "";
     const script = `${NativeWebDir.#targetTag}${JSON.stringify({
       name: target.name,
       basePath,
       indexPath: target.indexPath,
     })};</script>`;
-    const head = /<head(?:\s[^>]*)?>/i.exec(html);
+    const head = /<head(?:\s[^<>]*)?>/i.exec(html);
     if (!head) return `${script}\n${html}`;
     const at = head.index + head[0].length;
     return `${html.slice(0, at)}\n${script}${html.slice(at)}`;

package/mobile/updateUploader.test.ts

@@ -45,6 +45,7 @@ describe("UpdateUploader", () => {
       prefix: "acme/kiosk",
     });
     expect(UpdateUploader.parseTarget("s3://releases")).toEqual({ bucket: "releases", prefix: "" });
+    expect(UpdateUploader.parseTarget("s3://releases//acme//")).toEqual({ bucket: "releases", prefix: "/acme" });
     expect(() => UpdateUploader.parseTarget("https://releases.example/acme")).toThrow("s3://<bucket>/<prefix>");
   });
 

package/mobile/updateUploader.ts

@@ -1,7 +1,7 @@
 import { readdir } from "node:fs/promises";
 import path from "node:path";
 import type { UpdateEnvelope, UpdateManifest } from "@akanjs/native/api";
-import { isRecord } from "akanjs/common";
+import { isRecord, trimTrailingSlashes } from "akanjs/common";
 import { UpdatePackFolder } from "./updatePackFolder";
 
 /** What the uploader needs of an S3 client; Bun.S3Client is one. */
@@ -32,9 +32,9 @@ export class UpdateUploader {
 
   /** `s3://bucket/prefix`: the credentials and endpoint come from S3_* (or AWS_*) in the environment. */
   static parseTarget(target: string): { bucket: string; prefix: string } {
-    const match = /^s3:\/\/([^/]+)\/?(.*)$/.exec(target.trim());
+    const match = /^s3:\/\/([^/]+)(?:\/(.*))?$/.exec(target.trim());
     if (!match?.[1]) throw new Error(`--upload takes s3://<bucket>/<prefix>, not ${JSON.stringify(target)}.`);
-    return { bucket: match[1], prefix: (match[2] ?? "").replace(/\/+$/, "") };
+    return { bucket: match[1], prefix: trimTrailingSlashes(match[2] ?? "") };
   }
 
   static order(files: string[]): { releases: string[]; manifests: string[] } {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akanjs/devkit",
-  "version": "3.1.0-rc.3",
+  "version": "3.1.0-rc.5",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -48,7 +48,7 @@
     "@earendil-works/pi-tui": "0.86.1",
     "@inquirer/prompts": "^8.4.3",
     "@tailwindcss/node": "^4.3.0",
-    "akanjs": "3.1.0-rc.3",
+    "akanjs": "3.1.0-rc.5",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "dayjs": "^1.11.20",

package/platformTest/LinuxDockerTarget.ts

@@ -19,9 +19,10 @@ export class LinuxDockerTarget extends PlatformTestTarget {
   }
 
   //* No compiler in the image: with one, ssh2 builds its native addon and Bun panics loading it (oven-sh/bun#18546).
+  //* apt goes over https: a captive portal answers plain http with its splash page, which apt reports as unsigned.
   static readonly dockerfile = [
     `FROM oven/bun:${Bun.version}-slim`,
-    "RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates procps lsof && rm -rf /var/lib/apt/lists/*",
+    "RUN sed -i 's|http://|https://|g' /etc/apt/sources.list.d/debian.sources && apt-get update && apt-get install -y --no-install-recommends git ca-certificates procps lsof && rm -rf /var/lib/apt/lists/*",
   ].join("\n");
 
   get image() {

package/platformTest/PlatformTestTarget.ts

@@ -108,14 +108,16 @@ export abstract class PlatformTestTarget {
     const logPath = this.#logPath(context, "install");
     const install = await this.exec("bun install --frozen-lockfile", logPath, PlatformTestTarget.installIdleMs);
     if (install.exitCode === 0) return;
-    const failedScripts = [...install.output.matchAll(/(?:pre|post)?install script from "([^"]+)" exited/g)].map(
-      (match) => match[1] ?? "",
-    );
+    const failedPackages = [
+      ...install.output.matchAll(
+        /(?:pre|post)?install script from "([^"]+)" exited|failed to link binaries for package: (@?[^@\s]+)@/g,
+      ),
+    ].map((match) => match[1] ?? match[2] ?? "");
     const tolerable =
-      failedScripts.length > 0 && failedScripts.every((pkg) => this.tolerateScriptFailures.includes(pkg));
+      failedPackages.length > 0 && failedPackages.every((pkg) => this.tolerateScriptFailures.includes(pkg));
     if (!tolerable) throw new Error(`bun install failed — see ${logPath}`);
     //* A failed lifecycle script makes bun skip linking the root `.bin`; a second pass without scripts links it.
-    envWarnings.push(`install script failed for ${failedScripts.join(", ")} — tolerated on ${this.platform}`);
+    envWarnings.push(`install failed for ${failedPackages.join(", ")} — tolerated on ${this.platform}`);
     const relink = await this.exec(
       "bun install --frozen-lockfile --ignore-scripts",
       this.#logPath(context, "install-relink"),

package/platformTest/WindowsSshTarget.ts

@@ -9,7 +9,8 @@ export class WindowsSshTarget extends PlatformTestTarget {
   static readonly utmctlPath = "/Applications/UTM.app/Contents/MacOS/utmctl";
   static readonly defaultWorkRoot = "C:\\akan-test";
   //* arm64 has neither a sharp@0.32 prebuilt nor a Chrome for puppeteer's postinstall; x64 users get both.
-  static readonly defaultTolerateScriptFailures = ["sharp", "puppeteer"];
+  //* Nor a msgpackr-extract prebuilt: bun deletes it when node-gyp fails, racing the link of msgpackr's bins.
+  static readonly defaultTolerateScriptFailures = ["sharp", "puppeteer", "msgpackr"];
   static readonly #runDirPattern = "^\\d{8}-\\d{6}$";
   static readonly #keptRuns = 2;
 

package/qualityScanner.ts

@@ -215,7 +215,7 @@ export class AkanQualityScanner {
       if (!(await isDirectory(absoluteTargetRoot))) continue;
       await this.#walkTargetFiles(workspaceRoot, absoluteTargetRoot, ignoreFilter, files);
     }
-    return files.sort();
+    return files.sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
   }
 
   async #readGitIgnore(workspaceRoot: string) {

package/recipeScanner.test.ts

@@ -48,7 +48,10 @@ export default function Page() {
 describe("scanRecipes", () => {
   test("detects framework recipes with full variant surface", () => {
     const recipes = scanRecipes([{ path: "recipe.ts", content: FRAMEWORK, importFrom: "akanjs/ui" }]);
-    expect(recipes.map((r) => r.name).sort()).toEqual(["badgeRecipe", "buttonRecipe"]);
+    expect(recipes.map((r) => r.name).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))).toEqual([
+      "badgeRecipe",
+      "buttonRecipe",
+    ]);
 
     const button = byName(recipes, "buttonRecipe");
     expect(button?.importFrom).toBe("akanjs/ui");
@@ -91,7 +94,10 @@ describe("scanRecipes", () => {
       { path: "a.ts", content: src, importFrom: "@a" },
       { path: "b.ts", content: `export const other = recipe(tv({ base: "c" }));`, importFrom: "@b" },
     ]);
-    expect(recipes.map((r) => `${r.name}@${r.importFrom}`).sort()).toEqual(["other@@b", "shown@@a"]);
+    expect(recipes.map((r) => `${r.name}@${r.importFrom}`).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))).toEqual([
+      "other@@b",
+      "shown@@a",
+    ]);
   });
 });
 
@@ -154,7 +160,7 @@ describe("collectRecipeSources", () => {
     expect(
       scanRecipes(sources)
         .map((r) => r.name)
-        .sort(),
+        .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)),
     ).toEqual(["appBox", "appCard"]);
   });
 

package/scanInfo.ts

@@ -113,7 +113,7 @@ async function assertScanConvention(exec: AppExecutor | LibExecutor, libRoot: {
   if (violations.length > 0) {
     throw new Error(
       `[scan-convention]\n${violations
-        .sort()
+        .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
         .map((violation) => `- ${violation}`)
         .join("\n")}`,
     );

package/subspaceClone.ts

@@ -221,19 +221,20 @@ export class SubspaceClone {
 
   // An allowlist, not a filter, so no secret can reach a customer's clone; `AKAN_PUBLIC_*` ships in every bundle anyway.
   #localEnv() {
-    const { serveDomain } = WorkspaceExecutor.getBaseDevEnv();
+    const { serveDomain, defaulted = [] } = WorkspaceExecutor.getBaseDevEnv();
     return {
       AKAN_WORKSPACE_ID: "local",
       AKAN_PUBLIC_REPO_NAME: this.#declaration.name,
-      AKAN_PUBLIC_SERVE_DOMAIN: serveDomain,
+      //? Written down, the local default would read as chosen and pass the clone's build check for a real environment.
+      ...(defaulted.includes("AKAN_PUBLIC_SERVE_DOMAIN") ? {} : { AKAN_PUBLIC_SERVE_DOMAIN: serveDomain }),
       AKAN_PUBLIC_ENV: "local",
       AKAN_PUBLIC_OPERATION_MODE: "local",
       AKAN_PUBLIC_LOG_LEVEL: "warn",
     };
   }
 
-  // The CLI needs a `.env` to recognise a workspace root and none arrives with the slice. Excluded through
-  // `.git/info/exclude`, not the copied `.gitignore`, so it can never be committed to the customer's repo.
+  // No `.env` arrives with the slice, and the clone runs under the customer's repo name in a local env. Excluded
+  // through `.git/info/exclude`, not the copied `.gitignore`, so it can never be committed to the customer's repo.
   async #writeLocalEnv() {
     const excludePath = path.join(this.#clonePath, ".git/info/exclude");
     const exclude = (await FileSys.fileExists(excludePath)) ? await FileSys.readText(excludePath) : "";

package/testHelpers.ts

@@ -80,6 +80,8 @@ export const createFakeExecutor = <Extra extends object = object>(
 export const makeCliTempWorkspace = async (parentDir = os.tmpdir()) => {
   await mkdir(parentDir, { recursive: true });
   const root = await mkdtemp(path.join(parentDir, "akan-cli-"));
+  //? The CLI recognises a workspace root by an apps/, libs/ or pkgs/ folder beside package.json and tsconfig.json.
+  await mkdir(path.join(root, "apps"));
   await writeText(path.join(root, ".gitignore"), "");
   await writeText(
     path.join(root, ".env"),

package/transforms/barrelImportsPlugin.ts

@@ -195,7 +195,7 @@ const resolvePackageExport = (exportsMap: Record<string, ExportValue> | undefine
     if (!subpath.startsWith(prefix) || !subpath.endsWith(suffix)) continue;
     const wildcard = subpath.slice(prefix.length, subpath.length - suffix.length);
     const resolved = resolveExportValue(value);
-    if (resolved) return resolved.replace("*", wildcard);
+    if (resolved) return resolved.split("*").join(wildcard);
   }
 
   return null;