@akanjs/cli 3.0.0-alpha.100 → 3.0.0-alpha.101

package/.build-stamp

@@ -1 +1 @@
-660f8be823b788bf2ecd02a3c5e6ddf5f69299e441b1cb0dd9dbe76b49fbf618
+5ffeff9d981fb5e862b8dfe8607caec6785dc791950ba23d8338166ad32d1f62

package/guidelines/conventions/conventions.instruction.md

@@ -621,9 +621,18 @@ it.
   21-field model costs 12.6KB over eight entries; `mcp: { cru: false }` takes it to 4.7KB. `MCP catalogue: … ·
   listing 214KB` plus a per-signal `MCP catalogue cost:` line says where it went.
 - Settings live in the app's `lib/option.ts` — `option.setMcp({ enabled, readOnly, path, version, instructions,
-  allowedOrigins, pageSize, language, auth })`, **not `main.ts`**. Each field has an `AKAN_MCP_*` env spelling.
-  `AKAN_MCP_READONLY=true` is the read-only-deployment valve, not the exposure switch; `AKAN_MCP=false` takes the
-  whole surface off.
+  allowedOrigins, pageSize, language, auth })`, or `setMcp((env) => …)` for one derived from the server env, **not
+  `main.ts`**. Each field has an `AKAN_MCP_*` env spelling. `AKAN_MCP_READONLY=true` is the read-only-deployment
+  valve, not the exposure switch; `AKAN_MCP=false` takes the whole surface off.
+- **Authentication is the same server.** An app mounting `libs/shared` serves the OAuth 2.1 authorization server
+  beside `/mcp` — `/.well-known/oauth-authorization-server`, `/oauth/authorize`, `/oauth/token`, `/oauth/register`
+  (RFC 7591; Cursor's `cursor://` redirect admitted) plus the consent page `libs/shared/page/oauth/consent` — and
+  names itself as the issuer, so `/mcp` demands a bearer token, verifies its signature, and refuses one carrying no
+  `aud`. A token is the app's own access JWT plus `aud`/`iss`/`client_id`, so `AccountMiddleware` and the guards
+  judge it unchanged; there is no scope. Per-app knobs live in `env.server.*` under `oauth` (`consentPath` and
+  `signinPath` with the basePath, `clients`, `dynamicRegistration`, `allowedRedirectSchemes`, `enabled`). `/mcp`
+  reads the `Authorization` header only — a cookie is dropped at the door — and `JWT_SECRET` is mandatory outside
+  `local`, because the derived fallback is forgeable from three public names.
 - **The refusals are fail-closed**: a declared `mcp: false`, an endpoint with no `guards`, a mutation with no real
   guard, `pubsub` and `message`, an `Any` or `Upload` return, a file upload, a required `Any` argument, and the
   generated `light<Model>` read. A `prompt` also refuses a list argument and any `Any` argument. **Every refusal
@@ -746,10 +755,11 @@ shape, so `cascade` never means "related" — it means one of exactly these:
   forms: a relation, an id with `ref`, or a polymorphic id with `refPath`. An array, a Map, `ref` together with
   `refPath`, and a field naming no owner each fail the class build.
 - **A `refPath` must name an `enumOf` field** — a free-form owner type is unknowable at build time. The one
-  exception is opt-in and priced: `polymorphic: "any"` alongside `cascade: "removeWith"` takes a free-form
-  `String` type field holding the owner's refName, and sweeps for children on **every** model's removal. The
-  sweep is one indexed probe, but a single wildcard edge turns every cascade in the app back to one document at
-  a time; the boot log names the edges in one `info` line.
+  exception is opt-in and priced: `cascade: "removeWithAny"` takes a free-form `String` type field holding the
+  owner's refName, and sweeps for children on **every** model's removal. The sweep is one indexed probe, but a
+  single wildcard edge turns every cascade in the app back to one document at a time; the boot log names the
+  edges in one `info` line. The action carries its own `refPath` in the option type, so the widening cannot be
+  declared apart from the direction it widens.
 - **A cascade goes through the target's service, never its model** — that path is what runs the target's
   `_postRemove`, where a module puts the side effect the removal has to carry.
 - **Nothing checks whether another document still references the same target.** `File` in particular is deduped by

package/guidelines/mcpRule/mcpRule.generate.json

@@ -14,7 +14,17 @@
   ],
   "update": {
     "filePath": "./mcpRule.instruction.md",
-    "contents": ["exposure rule", "configuration", "declaring endpoints", "refusals and wire behaviour", "prompts"],
+    "contents": [
+      "exposure rule",
+      "configuration",
+      "declaring endpoints",
+      "refusals and wire behaviour",
+      "prompts",
+      "rolling out to an app",
+      "choosing what to open",
+      "writing instructions",
+      "verifying an app"
+    ],
     "rules": [
       "Use current Akan APIs only",
       "State the rule before the reason, and keep the reason to one clause",

package/guidelines/mcpRule/mcpRule.instruction.md

@@ -1,7 +1,8 @@
 # Akan MCP Exposure Guideline
 
 ## Purpose
-Use this when writing a `*.signal.ts`, configuring `option.setMcp(...)`, or debugging a tool an agent cannot see.
+Use this when writing a `*.signal.ts`, configuring `option.setMcp(...)`, debugging a tool an agent cannot see, or
+opening an app's service to agents end to end — the rollout checklist and the exposure design rules are at the end.
 The always-loaded convention set carries the short version; this is the full contract.
 
 ## Exposure Rule
@@ -143,19 +144,23 @@ export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => (
   clients read the structured half. A scalar return is unaffected: it has no structured half to point at, so it
   ships as the value itself either way.
 - A refused endpoint answers the *same* "unknown tool" as one that does not exist. Never make that
-  message more helpful — the difference is what enumerates your private surface. A guard's refusal is generalized
-  the same way: the caller reads `You are not permitted to perform this action.`, never `Access denied by guard:
-  Admin`, which names your authorization structure to the one caller barred from it. A domain `Err` resolves
-  through the dictionary first and keeps its own words.
+  message more helpful — the difference is what enumerates your private surface. Every 401 and 403 is generalized
+  the same way, the framework's `Access denied by guard: Admin` and an app's `No authentication with roles: admin`
+  alike: the caller reads `You are not permitted to perform this action.`, because either sentence names your
+  authorization structure to the one caller barred from it. A domain `Err` at any other status resolves through
+  the dictionary and keeps its own words, placeholders filled.
 - The `readOnly` / `destructive` / `idempotent` hints a client renders are derived from the endpoint type and key
   and are not configurable. Clients are told to distrust hints; they are never a gate.
 - **`AKAN_MCP_READONLY=true` is the read-only-deployment valve, not the exposure switch.** It drops every mutation
   whatever it declared, and reports each one in the boot log like any other refusal.
 - OAuth resource metadata is published at `/.well-known/oauth-protected-resource` (and at that path plus the mount
-  path, the spelling most clients try first). `AKAN_MCP_AUTH_SERVERS`, `AKAN_MCP_SCOPES`, and `AKAN_MCP_RESOURCE`
-  configure it; `insufficient_scope` is enforced only once `AKAN_MCP_SCOPES` is set. A token carrying no `aud` at
-  all is refused once `AKAN_MCP_AUTH_SERVERS` names an issuer — that issuer mints tokens for its other resources
-  too — and accepted while none is named, because a first-party Akan token is bound by app and environment.
+  path, the spelling most clients try first). `auth.authorizationServers` / `AKAN_MCP_AUTH_SERVERS`,
+  `auth.scopes` / `AKAN_MCP_SCOPES`, `auth.resource` / `AKAN_MCP_RESOURCE` and `auth.verify` configure it;
+  `insufficient_scope` is enforced only once scopes are declared. Naming an issuer changes three things at once: a
+  request with no credential is answered 401 from `initialize` on (an MCP client starts its OAuth flow on nothing
+  else), a token carrying no `aud` is refused (that issuer mints for its other resources too), and the challenge
+  carries no `error` code (RFC 6750 §3.1 reserves it for a credential that was presented). A server naming no
+  issuer keeps anonymous access and accepts a first-party token, which is bound by app and environment instead.
 - **The boot log names every published entry with no dictionary `.desc()`.** An agent picks a tool by its
   description, so a missing one is a broken tool. What the framework generates has no text of its own and borrows
   the model's: the generated list reads the `.of()` label, and the base CRUD tools append the model's `.desc()` to
@@ -181,9 +186,13 @@ export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => (
   body names one), and one that leaves a mirror out is refused just like one that contradicts the body: a gateway
   rule keyed on a header never fires for the request that omitted it. Legacy requests are not checked. Capabilities
   are derived from the catalogue, so a server with no prompts does not advertise `prompts`.
-- **An expired or wrongly-audienced bearer token is refused up front**, so an agent is told to authenticate rather
-  than that the tool does not exist. Its **signature is not checked** — that needs your app's own secret — so a
-  token signed wrong, like an opaque one, still degrades to an anonymous caller.
+- **An expired, wrongly-audienced or unverifiable bearer token is refused up front**, so an agent is told to
+  authenticate rather than that the tool does not exist. The signature is checked through `auth.verify`, which the
+  module that mints the tokens supplies (`libs/shared` does, from the app's signing secret); without a verifier the
+  claims are read unverified and a token signed wrong, like an opaque one, degrades to an anonymous caller.
+- **`/mcp` reads the `Authorization` header and nothing else.** The `cookie` header is deleted from the request
+  before the account middleware runs, so a same-site page cannot drive `tools/call` on the visitor's ambient session
+  — the request class `CrossSiteGuard` shields every mutation from, which this route never passes through.
 - **Resource URIs**: `akan://<model>/{id}`, `akan://<model>/list` for the model's own list, and
   `akan://<model>/list/<sliceKey>` for a slice's. The root list takes no third segment on purpose — any token
   there is one a slice could also be named. **Those three are the whole set**, so only the generated reads that
@@ -192,6 +201,47 @@ export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => (
 - **The catalogue is one language**, `en` unless `language` says otherwise: it is built once at boot and cached by
   clients, so there is no `Accept-Language` negotiation.
 
+## Authentication — The Authorization Server Is The Same Process
+
+`libs/shared/lib/_oauth` is an OAuth 2.1 authorization server (RFC 8414 metadata, PKCE `S256` only, RFC 7591
+registration, Client ID Metadata Documents, RFC 9207 `iss`) served by the app that serves `/mcp`. Its `option.ts`
+names the issuer and hands `McpAuth` a verifier, so mounting the lib is all an app does; the protocol engine it
+delegates to lives in `akanjs/server` (`OAuthAuthorize`, `OAuthToken`, `OAuthRegistration`, `OAuthClientIdMetadata`,
+`OAuthPkce`, `OAuthRedirect`, `OAuthMetadata`, `OAuthErrors`) and is unit-tested without a container.
+
+- **Endpoints, at the origin's root:** `GET /.well-known/oauth-authorization-server`, `GET /oauth/authorize`,
+  `POST /oauth/token` (form-encoded), `POST /oauth/register`. The consent step is `libs/shared/page/oauth/consent`
+  — a server-rendered page whose two forms post to `/api/approveOAuthConsent/<requestId>` and
+  `/api/denyOAuthConsent/<requestId>` and follow the 302 back to the client. All of it is `mcp: false`.
+- **The flow:** `POST /mcp` with no token → 401 with `resource_metadata` → the client reads the PRM, then the AS
+  metadata, registers (or uses a pre-registered / URL `client_id`), opens `/oauth/authorize` in a browser → the
+  server parks the request and redirects to the consent page (via `signinPath?redirect=` when anonymous) → the user
+  allows → `redirect_uri?code&state&iss` → the client posts the code and its PKCE verifier to `/oauth/token` → an
+  access token (1h, `aud` = the MCP resource, `iss`, `client_id`, `sub`, and the account's `self`/`me`) plus a
+  rotating refresh token (30d; reuse revokes the family). The token is the app's own access JWT, so
+  `AccountMiddleware` and every guard read it exactly as a browser session; nothing is scoped.
+- **Invariants:** an authorization request lives ten minutes, binds to the first signed-in account that opens it,
+  and is decided once; a code lives sixty seconds and is consumed on first exchange even if that exchange fails; a
+  redirect URI must be registered and match exactly, loopback ports excepted (RFC 8252 §7.3); a refresh token is
+  bound to the client it was issued to. A `client_id` that is an HTTPS URL with a path is fetched as a metadata
+  document, never from the server's own network.
+- **Per-app configuration** goes in `env.server.*` under `oauth`: `consentPath` and `signinPath` (with the basePath
+  when the app has one — `/office/oauth/consent`), `clients` (pre-registered, with an optional `clientSecret`),
+  `dynamicRegistration` (on by default: Claude Code and claude.ai register themselves), `allowedRedirectSchemes`
+  (`["cursor"]` by default, for Cursor's desktop callback), `accessTokenSeconds` (3600), `issuer` and `resource` (only when a tunnel or an edge
+  makes the derived origin wrong), `enabled: false` to take the server and the `/mcp` credential requirement away
+  together. The signin page must honour `?redirect=` to return the user to the consent page.
+- **Clients:** Claude Code — `claude mcp add --transport http <name> <origin>/mcp` and nothing else; it registers,
+  opens the browser to `http://localhost:<port>/callback`, refreshes on 401. claude.ai — a custom connector by URL
+  (needs public HTTPS; DCR or the Advanced-settings client id/secret; callback
+  `https://claude.ai/api/mcp/auth_callback`). Cursor — the URL alone (DCR with a `cursor://` redirect), or a
+  pre-registered client in `mcp.json` `auth` with `http://localhost:8787/callback` /
+  `https://www.cursor.com/agents/mcp/oauth/callback` registered. A first-party browser token no longer opens `/mcp`
+  once the issuer is named; `--header "Authorization: Bearer …"` needs a token minted with `aud`.
+- **`JWT_SECRET`** (or `security.jwtSecret`) is required outside `local`; the boot refuses without it, because the
+  derived fallback is seeded from the app, environment and repo names and forges an admin token for anyone who
+  knows them. `AKAN_ALLOW_DERIVED_JWT_SECRET=1` accepts that risk explicitly.
+
 ## `prompt()`
 **`prompt()`** is invoked by the *user* — a client renders it as a slash command — not chosen by the model. `exec`
 returns `PromptMessage[]`, or a bare string that is wrapped into one user message; build them with `Msg.user` /
@@ -215,3 +265,102 @@ over the ask.
 frames down included, and is a no-op when nobody is streaming — so the same code runs unchanged over HTTP, a
 websocket, and in tests. `McpProgress.streaming` says whether anyone is reading, for a report whose message
 costs something to assemble.
+
+## Rolling MCP Out To An App
+
+The goal of exposing a service over MCP is that a person uses it through an agent instead of through the page:
+one browser consent (the app's own sign-in included), then an hour-long access token and a thirty-day rotating
+refresh token stand in for every later sign-in. The token is the app's own access JWT, so what an agent may do is
+exactly what that person may do over HTTP — nothing is widened and nothing is scoped. Do these in order; steps 2
+and 3 are the ones whose omission shows up as a 404 or a doubled basePath on the consent page.
+
+1. **Mount the lib that carries the authorization server** (`libs/shared`) and confirm `lib/_oauth`,
+   `page/oauth/consent` and `srvkit/oauthServer.ts` are present. Its `option.ts` declares `auth` for `setMcp`, and
+   `setMcp` merges field by field in mount order with the app last — the app never restates `auth`.
+2. **`akan.config.ts`: `syncPageLibs: true`** (or the lib's name in an array). `akan sync <app>` links the consent
+   route under every basePath the app declares; the link folder is generated and never committed.
+3. **`env.server.*` → `oauth`.** `consentPath` / `signinPath` carry the basePath the browser sees
+   (`/office/oauth/consent`, `/office/signin`) and are omitted for an app without one. The server hands the
+   sign-in page `?redirect=` as the app's router names the route — basePath removed — because `router.push` puts
+   the locale and basePath back; the app adds nothing. `issuer` (`AKAN_MCP_AUTH_SERVERS` for the resource side)
+   only behind a tunnel or an edge that renames the host, `resource` (`AKAN_MCP_RESOURCE`) only when `path` moved
+   off `/mcp`, `clients` + `dynamicRegistration: false` only for a deployment that closes registration.
+4. **The sign-in page honours `?redirect=`** by passing it unchanged to the password and SSO controls — a
+   router-space path, never prefixed by hand. Accepting it needs only `startsWith("/") && !startsWith("//")`.
+5. **`lib/option.ts`: `option.setMcp({ instructions, legacyTextBlock: false })`** (`AKAN_MCP_INSTRUCTIONS`,
+   `AKAN_MCP_LEGACY_TEXT`). Leave `readOnly` (`AKAN_MCP_READONLY`) off when the point is to let people *use* the
+   service; it is the valve for a deployment that must not write, not the way to curate.
+6. **`JWT_SECRET`** (or `security.jwtSecret`) in every deployment outside `local`; the boot refuses without it.
+7. **Read the boot log** — `MCP catalogue: tools=… · listing …KB`, the `MCP catalogue cost:` line, one `warn` per
+   refusal, and the list of published entries with no `.desc()`. A tool missing from it is missing everywhere.
+8. **Connect once per app** — `claude mcp add --transport http <name> <issuer>/mcp`; a second entry for the same
+   server with a pre-registered client tests a registration mode, it does not add anything a user needs.
+
+## Choosing What To Open
+
+One rule: **an endpoint is open to an agent when the same person could do the same thing from the page, under
+the same guards.** What stays closed is closed because no agent has a reason to call it, not because of who may
+— and that is the only thing `mcp: false` says.
+
+| Endpoint | Decision |
+|---|---|
+| Domain read slices (`inOrg`, `inProject`, `inSelf`, `byStatuses`) | Open. A named slice publishes only when it declares its **own** `guards`; the `slice()` map reaches the root slice and the generated CRUD, never a named slice. A search slice only on data that may be enumerated. |
+| The root slice and generated CRUD | Published by default; `root:` is `Admin`, so a user token never lists it. Take the cost line first: `mcp: { cru: false }` keeps the reads and drops the writes of a model whose write entries are most of its bytes; `mcp: false` for an internal or sensitive model. |
+| Domain mutations (`startTask`, `completeTicket`) | Open when a person would ask an agent to do it for them; a resource guard is mandatory. An act that cannot be undone — signing, paying, sending, removing — either stays off or says so in its `.desc()`: MCP has no approval card. |
+| Steps of a UI state machine (`requestPhoneCodeForSignin`, `setPasswordInPrepareUser`, a prepare-user flow) | `mcp: false`. Perfectly guarded, and only ever called by mistake. |
+| Authentication, SSO, and the OAuth protocol endpoints | Already `mcp: false` where they are declared. |
+| File upload, an `Any` / `Upload` return, a required `Any` argument, `pubsub` / `message`, `light<Model>` | Refused by the framework; nothing to write. |
+| Admin-only endpoints | Leave the `Admin` guard; an account-scope guard hides the entry from every caller it refuses. |
+
+- **Scope is what makes hiding possible.** `static scope: "account"` (a role check) is evaluated with no arguments
+  and filters the listing per caller; `"resource"` (`Can<Verb><Model>`, ownership) needs `context.getArg()`, stays
+  listed, and stops the call. Marking a resource guard `"account"` would make the listing lie — the marker has no
+  default for that reason.
+- **Identity comes from the internal args** (`.with(Self)`, `.with(Account)`, `.with(Me)`), never from an id the
+  client sent, and the service re-checks ownership behind the guard.
+- **An admin who signs in on the consent page mints an admin token.** A connector created under an admin account
+  passes `Admin` guards; treat that as an operational decision, and read the request's subject type when in doubt.
+- **Return what answers the question.** A count-or-summary endpoint taking an id beats a document; a nullable model
+  return publishes no `outputSchema`, so prefer a non-null return plus an `Err`. Bulky page-only fields are
+  `field.visual`. Narrow a list with a named filter slice, never with the root list's raw `query`.
+
+## Writing `instructions`
+
+`*.abstract.md` and `<Agent.Guide>` never reach an MCP client. Exactly three texts do: `instructions`, every
+published entry's `.desc()`, and a `prompt()`. All three are English, whatever the users speak — the reader is a
+model, and the catalogue is built once in one `language` and cached by clients.
+
+- **`instructions` is the workflow.** Five to eight sentences, in this order: what the app is and what its nouns
+  mean; **which tool to call first** and which ids the rest take; how a name becomes an id; what a write confirms
+  before it runs and which writes cannot be undone; what this server does *not* do and where that is done instead.
+
+  ```ts
+  instructions: [
+    "Operations tools for a back-office that runs consulting projects.",
+    "An org is one company; a project belongs to an org; a ticket is one unit of work on a project.",
+    "Start from orgInSelf, then projectInOrg and ticketInProject; every other tool takes the ids those return.",
+    "Prefer ticketStatusInProject for 'how is it going' and ticketInProject only when the user asks for detail.",
+    "createTicket, startTicket and completeTicket write on the caller's behalf: confirm the project and title first.",
+    "Nothing here signs, invoices or uploads a file; those are deliberate acts on the record's own page.",
+  ].join(" "),
+  ```
+- **`.desc()` is the reason to pick one tool** — what it returns and when to use it, two clauses. An id argument's
+  `.desc()` names the tool that returns it (`From projectInOrg`). The generated CRUD borrows the model's `.of()`
+  label and `.desc()`, which is the only text those entries can carry.
+- **`prompt()` is a workflow the user invokes** as a slash command, not one the model chooses — a weekly report,
+  an onboarding check. Put the ask in `Msg.user` at a high `priority` and the attachments in `Msg.resource` masked
+  by their `Light` model at a low one.
+
+## Verifying An App
+
+- `akan lint <app>`, `akan typecheck <app>`, `akan sync <app>`, then the boot log above.
+- The lib's own suites run wherever it is mounted: the OAuth signal test (metadata, registration, both `authorize`
+  redirects, code exchange, `/mcp` with the minted token and the refusal of a first-party or forged one, refresh
+  rotation) and the refresh-session and option unit tests.
+- **One exposure test per app**, in a `lib/<model>.signal.test.ts`: list `tools/list` with a user token and pin the
+  names with `toEqual`, and assert the curated and admin-only ones with `not.toContain`. Exposure is derived from
+  the guards, so a guard change fails this test first — which is the point. The framework's own pattern is
+  `pkgs/akanjs/server/mcp/mcp.integration.test.ts`.
+- Live: connect a client, consent, call a tool, `claude mcp logout`, authenticate again. `AKAN_PUBLIC_LOG_LEVEL=debug`
+  prints one `OAuth token request grant_type=… client_id=…` line per token call; two refreshes in the same second
+  both answering 200 is the grace window working, not a fault.

package/guidelines/queryRule/queryRule.instruction.md

@@ -133,11 +133,13 @@ shape, so `cascade` never means "related" — it means one of exactly these:
   `refPath`. An array, a Map, `ref` together with `refPath`, and a field naming no owner each fail the class build.
 - **A `refPath` must name an `enumOf` field** — a free-form owner type is unknowable at build time, so every
   model's removal would have to sweep the polymorphic table on the chance it is the owner.
-- **`polymorphic: "any"` buys that sweep on purpose**, for the one shape an enum cannot express: a child whose
-  owner is any model in the app, named by a free-form `String` holding the owner's refName.
+- **`cascade: "removeWithAny"` buys that sweep on purpose**, for the one shape an enum cannot express: a child
+  whose owner is any model in the app, named by a free-form `String` holding the owner's refName. It is a third
+  action rather than a flag beside `removeWith`, because the widening and the direction are one decision — the
+  option type pairs the action with the `refPath` it reads the owner off, so neither can be declared alone.
 
   ```ts
-  parent: field(ID, { refPath: "parentType", cascade: "removeWith", polymorphic: "any" }),
+  parent: field(ID, { refPath: "parentType", cascade: "removeWithAny" }),
   parentType: field(String),   // holds the owner's refName
   ```
 
@@ -148,11 +150,12 @@ shape, so `cascade` never means "related" — it means one of exactly these:
   `info` line naming the edges — that line is the answer to "why does this app remove everything per document".
   The opt-in is what keeps an app that declared none on the fast path.
 
-  Refused at the class build: `polymorphic: "any"` on a `refPath` that already names an `enumOf` (the enum names
-  the candidates and indexes better — keep one), a `typeKey` that is not a `String` (the sweep matches a refName
-  against that column, and a column that cannot hold one silently finds nothing), and the option anywhere other
-  than a `cascade: "removeWith"` field with a `refPath`. A wildcard owner is also exempt from the mount check
-  that a monomorphic owner fails at boot — it names no module to mount.
+  Refused at the class build: `removeWithAny` on a `refPath` that already names an `enumOf` (the enum names the
+  candidates and indexes better — use `removeWith`), a `typeKey` that is not a `String` (the sweep matches a
+  refName against that column, and a column that cannot hold one silently finds nothing), and the action with no
+  `refPath` at all — that last one is a typecheck error at the call site, and the class build keeps the same
+  refusal for the macro and bundled paths that reach it untyped. A wildcard owner is also exempt from the mount
+  check that a monomorphic owner fails at boot — it names no module to mount.
 - **A cascade goes through the target's service, never its model** — that path is what runs the target's
   `_postRemove`, where a module puts the side effect the removal has to carry.
 - **Bulk is decided at boot, per target model, for both directions.** A target with no `remove` schema hook, no

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akanjs/cli",
-  "version": "3.0.0-alpha.100",
+  "version": "3.0.0-alpha.101",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -33,7 +33,7 @@
     "@langchain/openai": "^1.4.6",
     "@tailwindcss/node": "^4.3.0",
     "@trapezedev/project": "^7.1.4",
-    "akanjs": "3.0.0-alpha.100",
+    "akanjs": "3.0.0-alpha.101",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "dayjs": "^1.11.20",