@akanjs/cli 3.0.0-alpha.14 → 3.0.0-alpha.16

package/.build-stamp

@@ -1 +1 @@
-fb0a2ca4e955b9ab881769c470d38f1a6acf70d56c2b60751e3447b9ff639a4f
+de2c79f1b77d3ad7b42a84df41633392b3eba192d3d15335be7a976440157d1f

package/{agent.command-zxaxy577.js → agent.command-h6tc0pzh.js}

@@ -1,15 +1,15 @@
 // @bun
 import {
   AgentScript
-} from "./index-xv5jv1fe.js";
-import"./index-znxjcx1p.js";
-import"./index-nz9ceqgp.js";
+} from "./index-7ecpft60.js";
+import"./index-djh5gpb7.js";
+import"./index-9s991k9v.js";
 import"./index-j37qq1f2.js";
 import {
   Workspace,
   command
-} from "./index-9p2edf9w.js";
-import"./index-3tqjdv03.js";
+} from "./index-bkwnr08k.js";
+import"./index-1twehz1x.js";
 import"./index-mxvakhsm.js";
 import"./index-xys926f2.js";
 import"./index-1577bej2.js";

package/{application.command-an05acvc.js → application.command-kphnfwyg.js}

@@ -4,8 +4,8 @@ import {
 } from "./index-0wae5ebk.js";
 import {
   ApplicationScript
-} from "./index-v2r1wrzb.js";
-import"./index-nkzfkq0j.js";
+} from "./index-rv16ck4r.js";
+import"./index-p42te6qb.js";
 import {
   getMobileTargetChoices
 } from "./index-76rn3g2c.js";
@@ -15,10 +15,10 @@ import {
   Sys,
   Workspace,
   command
-} from "./index-9p2edf9w.js";
+} from "./index-bkwnr08k.js";
 import"./index-fgc8r6dj.js";
 import"./index-bjpxzr6s.js";
-import"./index-3tqjdv03.js";
+import"./index-1twehz1x.js";
 import"./index-mxvakhsm.js";
 import"./index-1577bej2.js";
 import"./index-67546d0j.js";

package/buildBatch.proc.js

@@ -12,7 +12,7 @@ import"./index-bjpxzr6s.js";
 import {
   AppExecutor,
   WorkspaceExecutor
-} from "./index-3tqjdv03.js";
+} from "./index-1twehz1x.js";
 import"./index-mxvakhsm.js";
 import"./index-1577bej2.js";
 import"./index-67546d0j.js";

package/{capacitorApp-5q8ytkqw.js → capacitorApp-9ejk3k7q.js}

@@ -25,9 +25,9 @@ import {
   selectLocalDevHost,
   sortIosRunTargets,
   writeRootCapacitorConfig
-} from "./index-pdj7r8fa.js";
+} from "./index-gz91pc3p.js";
 import"./index-76rn3g2c.js";
-import"./index-3tqjdv03.js";
+import"./index-1twehz1x.js";
 import"./index-mxvakhsm.js";
 import"./index-1577bej2.js";
 import"./index-67546d0j.js";

package/{cloud.command-yfd3pwr1.js → cloud.command-zn6mfscb.js}

@@ -1,22 +1,22 @@
 // @bun
 import {
   CloudScript
-} from "./index-pgs252a3.js";
-import"./index-hz5x5zdp.js";
-import"./index-9jwc3ew8.js";
+} from "./index-g3brq942.js";
+import"./index-96vpa123.js";
+import"./index-xwfkgss0.js";
 import {
   GlobalConfig
 } from "./index-0cj2zxbm.js";
-import"./index-v2r1wrzb.js";
-import"./index-nkzfkq0j.js";
+import"./index-rv16ck4r.js";
+import"./index-p42te6qb.js";
 import"./index-76rn3g2c.js";
 import {
   Workspace,
   command
-} from "./index-9p2edf9w.js";
+} from "./index-bkwnr08k.js";
 import"./index-fgc8r6dj.js";
 import"./index-bjpxzr6s.js";
-import"./index-3tqjdv03.js";
+import"./index-1twehz1x.js";
 import"./index-mxvakhsm.js";
 import"./index-1577bej2.js";
 import"./index-46tjzh6s.js";

package/{context.command-03b3jgab.js → context.command-pkbccyys.js}

@@ -1,25 +1,25 @@
 // @bun
 import {
   ContextScript
-} from "./index-0hk3frny.js";
-import"./index-37mwgmp7.js";
-import"./index-w7jphpt6.js";
-import"./index-6xh65612.js";
-import"./index-jwvs48kc.js";
-import"./index-nmfen65g.js";
+} from "./index-b9m84bjp.js";
+import"./index-4agbdds8.js";
+import"./index-w7farjxd.js";
+import"./index-8d9r0df5.js";
+import"./index-4v0wvt37.js";
+import"./index-aak9cctp.js";
 import"./index-ss469dec.js";
-import"./index-tk2e3m3y.js";
-import"./index-pdj7r8fa.js";
+import"./index-gyvrhtpm.js";
+import"./index-gz91pc3p.js";
 import"./index-0cj2zxbm.js";
-import"./index-znxjcx1p.js";
-import"./index-nz9ceqgp.js";
+import"./index-djh5gpb7.js";
+import"./index-9s991k9v.js";
 import"./index-j37qq1f2.js";
 import"./index-76rn3g2c.js";
 import {
   Workspace,
   command
-} from "./index-9p2edf9w.js";
-import"./index-3tqjdv03.js";
+} from "./index-bkwnr08k.js";
+import"./index-1twehz1x.js";
 import"./index-mxvakhsm.js";
 import"./index-xys926f2.js";
 import"./index-1577bej2.js";

package/{guideline.command-5qnjcgmk.js → guideline.command-0jj2k77g.js}

@@ -10,8 +10,8 @@ import {
   command,
   runner,
   script
-} from "./index-9p2edf9w.js";
-import"./index-3tqjdv03.js";
+} from "./index-bkwnr08k.js";
+import"./index-1twehz1x.js";
 import"./index-mxvakhsm.js";
 import {
   getDirname

package/guidelines/conventions/conventions.instruction.md

@@ -344,10 +344,6 @@ than returning it (`no-return-in-store-action.grit`); a bare `return;` guard sta
 `.of() → .model() → .insight() → .query() → .sort() → .enum() → .slice() → .endpoint() → .error() → .translate()`.
 Name every argument in `.arg()`, including framework-supplied `skip` / `limit` / `sort`. Use `modelDictionary`,
 `scalarDictionary`, or `serviceDictionary` to match the module kind.
-**`.store()` sits between `.endpoint()` and `.error()` and is the one optional stage** — omit it entirely rather
-than writing it empty. It names custom store actions (labels and `.desc()` only, no `.arg()`), and it is only
-needed where inheriting would be wrong: an action named after the endpoint it calls already reads as that
-endpoint's `.desc()`, which is most of them. `akan.agent.missing-store-description` names the rest.
 
 **`<module>.abstract.md`** — a title line, one declarative sentence naming what the module owns, a `## Rules` list of
 two to five invariants the code cannot show, and an optional workflow arrow chain
@@ -374,8 +370,10 @@ workflow changes.
 
 - **Every `slice()` takes an explicit `{ guards: {…} }` second argument, and `root:` is always `Admin`.**
 - **Every custom `mutation` / `query` / `message` names its own `guards: [...]` array.** Never rely on the slice default. `Public` belongs on a slice `get:`, never on a mutation.
+- **The guards are also the MCP exposure decision** — see MCP Exposure. An endpoint that names none is not published to agents at all, and a mutation whose only guard is `Public` is refused, so a missing `guards` array now costs visibility as well as authorization.
 - Resource guards are `Can<Verb><Model>` classes in `srvkit/guards.ts` that `implements Guard` with an `async canPass(context)`. They **fail closed**: no resource named ⇒ `false`; a load that throws ⇒ `logger.warn` then `false`. Admin bypass goes first.
 - Keep `static name = "User";` on guard classes. `fetch` serializes guard names and the API explorer filters on them; it looks like dead code, and deleting it breaks the UI. Comment it so the next reader knows.
+- **Every guard class also declares `static scope: GuardScope`, and it is required with no default.** `"account"` means the verdict reads the caller and nothing about the call, so it can be evaluated with no arguments — which is what lets an MCP listing hide what this caller certainly cannot use. `"resource"` means it needs the call's arguments (`context.getArg()`) and fails closed without them, so it is never evaluated for a listing: the entry stays visible and is stopped at call time. Getting it wrong is not a type error, so the marker is mandatory rather than defaulted — `SignedIn` / `Admin` / role checks are `"account"`, and every `Can<Verb><Model>` is `"resource"`.
 - The acting user arrives via `.with(Self)` / `.with(CurrentUserId)` / `.with(Me)`. Never trust a client-supplied id.
 - Guards ship with the library that owns the model and are imported by its own signals through the package path, so a mounting app inherits authorization and cannot forget it.
 - Services re-check ownership even when a guard already gated the call — two independent gates.
@@ -477,8 +475,15 @@ Conventions that hold for both shapes:
 
 ### MCP Exposure
 
-Any signal can be served to AI agents as an MCP server on `POST /mcp`, and **nothing is exposed until it says so**.
-Turn it on in the app's `main.ts` — `new AkanApp("./server", { mcp: { … } })` — which takes `enabled`, `readOnly`,
+Every signal is served to AI agents as an MCP server on `POST /mcp`. **`/mcp` is mounted by default and exposure
+follows an endpoint's guards — there is no per-endpoint opt-in, and nothing to write in a signal file.** An endpoint
+that declares a real guard is published; one that declares none is refused, and so is a mutation whose only guard is
+`Public`. `AKAN_MCP=false` takes the whole surface off. The reasoning is that the guards are already the
+authorization decision and `filterForAccount` re-reads them per caller on every listing, so a second per-endpoint
+switch says nothing the guards do not — while guaranteeing that every endpoint added later is invisible to agents
+until somebody remembers it.
+
+Settings live in the app's `main.ts` — `new AkanApp("./server", { mcp: { … } })` — which takes `enabled`, `readOnly`,
 `path`, `version`, `instructions`, `allowedOrigins`, `pageSize`, `language`, and `auth`. That is the only
 app-authored place for it: `server.ts` is generated and takes no options, and the gateway configures a child
 through its environment — so each field also has an env spelling (`AKAN_MCP`, `AKAN_MCP_READONLY`,
@@ -490,26 +495,26 @@ has, and a value written in code wins over the env of the same name — an expli
 concatenation.
 
 ```typescript
-// <model>.signal.ts — a tool, a resource-backed slice, and a slash-command prompt
+// <model>.signal.ts — every one of these is an MCP tool or prompt, with no `mcp:` option anywhere
 export class TaskSlice extends slice(
   srv.task,
-  // generated CRUD per verb; `list` is the model's own unfiltered list, which `slice()` generates itself
-  { guards: { root: Admin, get: SignedIn, cru: SignedIn }, mcp: { get: true, list: true } },
+  { guards: { root: Admin, get: SignedIn, cru: SignedIn } },
   (init) => ({
-    // its own guards: the map above reaches base CRUD and the root slice, never a named slice
-    inTodo: init({ guards: [SignedIn], mcp: { expose: true } }).exec(function () {
+    // its own guards: the map above reaches base CRUD and the root slice, never a named slice — so a named slice
+    // that names none is refused rather than published, which is the one shape to watch for.
+    inTodo: init({ guards: [SignedIn] }).exec(function () {
       return this.taskService.queryByStatuses(["todo"]);
     }),
   }),
 ) {}
 
 export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => ({
-  startTask: mutation(cnst.Task, { guards: [SignedIn], mcp: { expose: true } })
+  startTask: mutation(cnst.Task, { guards: [SignedIn] })
     .param("taskId", ID)
     .exec(async function (taskId) {
       return await this.taskService.startTask(taskId);
     }),
-  reviewTask: prompt({ guards: [SignedIn], mcp: { expose: true } })
+  reviewTask: prompt({ guards: [SignedIn] })
     .param("taskId", ID)
     .exec(async function (taskId) {
       const task = await this.taskService.getTask(taskId);
@@ -518,24 +523,21 @@ export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => (
 })) {}
 ```
 
-- **The refusals are fail-closed and survive opting in**: `pubsub` and `message` (their internal args read a socket
-  an MCP request does not have), an `Any` or `Upload` return, a file upload, **a mutation with no real `guards`**
-  (`[Public]` is having none, spelled out — it answers true unconditionally), and **an argument typed `Any` that
-  must be filled**.
+- **The refusals are fail-closed**: **an endpoint that declares no `guards` at all** (nobody decided who may reach
+  it), **a mutation with no real `guards`** (`[Public]` is having none, spelled out — it answers true
+  unconditionally), `pubsub` and `message` (their internal args read a socket an MCP request does not have), an
+  `Any` or `Upload` return, a file upload, and **an argument typed `Any` that must be filled**.
   A `prompt` refuses two more, because its `arguments` is one string per name with no schema beside it: a **list
   argument**, which could never carry a second value, and **any `Any` argument** — a tool leaves that out of its
-  schema, and a prompt has no schema to leave it out of. `resource: true` is refused there too: only a read
-  publishes a resource template.
-- **Every refusal is named in the boot log**, and so is every published entry that declares no `guards` at all —
-  the access is what `[Public]` grants, but only one of the two is a decision you made. One `warn` per endpoint
-  plus a `MCP catalogue: tools=… prompts=…` count. Read that line first when a tool you exposed is missing —
-  fail-closed is right, and a silent fail-closed leaves you nothing to read. `akan quality scan` covers the two
-  shapes visible in source, `akan.mcp.missing-description` and `akan.mcp.unguarded-exposure`; the API explorer
-  badges the per-endpoint rules (`MCP` / `MCP refused`) from the same rule the catalogue runs.
+  schema, and a prompt has no schema to leave it out of.
+- **Every refusal is named in the boot log**: one `warn` per endpoint plus a `MCP catalogue: tools=… prompts=…`
+  count. Read that line first when a tool you expected is missing — and it is the *only* place the answer exists,
+  because there is no absent opt-in to notice. The API explorer badges the same rule per endpoint (`MCP` /
+  `MCP refused`), from the same shared implementation the catalogue runs.
 - **An `Any` argument is left out of the published schema** rather than described as `{}` — it tells a model
   nothing — and a value sent for one is refused by name, so the endpoint reads it as omitted. That is what happens
   to the root list's raw `query` descriptor: read as sent, it would be an arbitrary filter over every model you
-  exposed through `mcp: { list: true }`. Expose a named filter slice when an agent should narrow a list.
+  publish. Declare a named filter slice when an agent should narrow a list.
 - **A nullable model return publishes no `outputSchema`**, and its empty answer ships as the text `null` with no
   `structuredContent`. That field is an object by definition, so `null` cannot ride in it any more than an array
   can — a list is wrapped as `{ items: … }` for the same reason — and a declared schema obliges every result to
@@ -544,13 +546,13 @@ export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => (
 - **An `outputSchema` names no `hidden` or `secret` field.** Every response has both stripped, so publishing them
   promises a property no answer can carry — and on a model like `user` the names are the leak. Your *input* schema
   keeps them: they are legal to send, and the same model describes a request body.
-- An endpoint that did not opt in answers the *same* "unknown tool" as one that does not exist. Never make that
+- A refused endpoint answers the *same* "unknown tool" as one that does not exist. Never make that
   message more helpful — the difference is what enumerates your private surface. A guard's refusal is generalized
   the same way: the caller reads `You are not permitted to perform this action.`, never `Access denied by guard:
   Admin`, which names your authorization structure to the one caller barred from it. A domain `Err` resolves
   through the dictionary first and keeps its own words.
-- `mcp: { readOnly, destructive, idempotent }` only override the hints a client renders. Clients are told to
-  distrust hints; they are never a gate.
+- The `readOnly` / `destructive` / `idempotent` hints a client renders are derived from the endpoint type and key
+  and are not configurable. Clients are told to distrust hints; they are never a gate.
 - **`AKAN_MCP_READONLY=true` is the read-only-deployment valve, not the exposure switch.** It drops every mutation
   whatever it declared, and reports each one in the boot log like any other refusal.
 - OAuth resource metadata is published at `/.well-known/oauth-protected-resource` (and at that path plus the mount
@@ -558,12 +560,12 @@ export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => (
   configure it; `insufficient_scope` is enforced only once `AKAN_MCP_SCOPES` is set. A token carrying no `aud` at
   all is refused once `AKAN_MCP_AUTH_SERVERS` names an issuer — that issuer mints tokens for its other resources
   too — and accepted while none is named, because a first-party Akan token is bound by app and environment.
-- `akan quality scan` warns **`akan.mcp.missing-description`** for anything exposed without a dictionary `.desc()`.
-  An agent picks a tool by its description, so a missing one is a broken tool. What the framework generates is
-  exempt and borrows the model's own text, having none of its own: `mcp: { list: true }` reads the `.of()` label,
-  and the base CRUD tools append the model's `.desc()` to their generated `Get X`. Write that model `.desc()` — it
-  is the only text those entries can carry. The scan is not the whole answer either, because it reads source: **the
-  boot log names every published entry with no description**, generated ones included.
+- **The boot log names every published entry with no dictionary `.desc()`.** An agent picks a tool by its
+  description, so a missing one is a broken tool. What the framework generates has no text of its own and borrows
+  the model's: the generated list reads the `.of()` label, and the base CRUD tools append the model's `.desc()` to
+  their generated `Get X`. Write that model `.desc()` — it is the only text those entries can carry. There is no
+  `akan quality scan` rule for this any more: a source scanner found the exposure only as an `mcp:` literal, and
+  with exposure derived from the guards the resolved catalogue is the only place that can answer.
 - A browser-hosted client needs `allowedOrigins` **and** the CORS answer the server sends back for those origins.
   Every other MCP client sends no `Origin` at all, and the one that does is matched against the forwarded host so
   a proxy does not turn each call into a 403 — which is only as trustworthy as an edge that *overwrites* that
@@ -588,9 +590,8 @@ export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => (
   token signed wrong, like an opaque one, still degrades to an anonymous caller.
 - **Resource URIs**: `akan://<model>/{id}`, `akan://<model>/light/{id}`, `akan://<model>/list` for the model's own
   list, and `akan://<model>/list/<sliceKey>` for a slice's. The root list takes no third segment on purpose — any
-  token there is one a slice could also be named. **Those four are the whole set**, so `mcp: { resource: true }`
-  is honoured only on the generated reads: a custom endpoint keeps its tool, gets no resource template, and is
-  named in the boot log saying so.
+  token there is one a slice could also be named. **Those four are the whole set**, so only the generated reads are
+  addressable: a custom endpoint keeps its tool and gets no resource template.
 - **The catalogue is one language**, `en` unless `language` says otherwise: it is built once at boot and cached by
   clients, so there is no `Accept-Language` negotiation.
 

package/guidelines/workspaceOnboarding/workspaceOnboarding.instruction.md

@@ -459,9 +459,7 @@ is convention that keeps hand-written code reading like generated code.
   generated. Never `import type { RootStore } from "../st"` — it crashes `akan build` with a Bun SSR segfault.
 - **`dictionary.ts`** — fixed chain with empty stages still written:
   `.of() → .model() → .insight() → .query() → .sort() → .enum() → .slice() → .endpoint() → .error() → .translate()`.
-  Every label is `t(["English", "한국어"])`, and nearly every one also carries `.desc([en, ko])`. One optional stage,
-  `.store()`, sits between `.endpoint()` and `.error()` for custom store actions whose name differs from the
-  endpoint they call — omit it rather than writing it empty.
+  Every label is `t(["English", "한국어"])`, and nearly every one also carries `.desc([en, ko])`.
 - **`srvkit/` adapters** — an injected singleton is an `adapt("name" as const, ({ use, env, plug, memory }) => ({…}))`
   class, injected with `plug(TheClass)`. It self-registers, so do not add it to `lib/option.ts`. `this.logger` is
   provided; lifecycle work goes in `override async onInit()`. A per-use value object stays a plain class you `new` at

package/incrementalBuilder.proc.js

@@ -16,7 +16,7 @@ import {
 import {
   AppExecutor,
   WorkspaceExecutor
-} from "./index-3tqjdv03.js";
+} from "./index-1twehz1x.js";
 import"./index-mxvakhsm.js";
 import"./index-1577bej2.js";
 import"./index-67546d0j.js";

package/{index-3tqjdv03.js → index-1twehz1x.js}

@@ -155,9 +155,29 @@ ${AGENT_BLOCK_START}
 ${block}
 ${AGENT_BLOCK_END}
 `;
+var CLAUDE_COMMENT_RULE = `## Comments \u2014 Overrides Your Default
+
+Write **no comments** unless the comment passes the test below. This is the rule agents break most often here, so it
+is repeated outside the guide: a diff that adds a comment the test rejects is a diff to redo.
+
+Before typing \`//\`, \`/*\`, or a doc block, ask \u2014 **does this sentence carry a fact that is nowhere in the code?**
+
+- Restates the identifier, the signature, or the line under it \u2192 delete it.
+- Labels a section (\`// helpers\`, \`// state\`) or narrates a step (\`// fetch the user\`, \`// then save\`) \u2192 delete it.
+- JSDoc on an ordinary function, or a why/how preamble on ordinary logic \u2192 delete it.
+- Explains the edit you just made, for whoever reads the diff \u2192 say it in your reply, not in the file.
+- Names a vendor or protocol quirk, an infrastructure constraint, a library gotcha, security reasoning, a math
+  derivation, a domain field's business meaning, a state transition, or why an obvious alternative was rejected \u2192
+  keep it, one line.
+
+That keep-list is exact \u2014 \`Comments\` in the guide is the full version. "It aids readability" and "this logic is
+subtle" are not on it: rename or split the code instead. When you edit an existing file, match its density; if the
+surrounding code carries none, your diff carries none.`;
 var renderScopeClaudeMd = (scope) => `# ${scope.name} \u2014 Claude Code Guide
 
 @AGENTS.md
+
+${CLAUDE_COMMENT_RULE}
 `;
 
 // pkgs/@akanjs/devkit/akanConfig/akanConfig.ts
@@ -1675,7 +1695,7 @@ class Executor {
         }));
       });
       proc.on("exit", (code, signal) => {
-        if (!!code || signal)
+        if (code || signal)
           reject(new CommandExecutionError({
             command,
             cwd,
@@ -1773,7 +1793,7 @@ class Executor {
         }));
       });
       proc.on("exit", (code, signal) => {
-        if (!!code || signal)
+        if (code || signal)
           reject(new CommandExecutionError({
             command: modulePath,
             args,
@@ -3052,4 +3072,4 @@ class ModuleExecutor extends Executor {
   }
 }
 
-export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, appRootAllowedFiles, appRootAllowedDirs, libFacetRootAllowedFiles, isScannedAppRootEntry, CommandExecutionError, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };
+export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, CLAUDE_COMMENT_RULE, appRootAllowedFiles, appRootAllowedDirs, libFacetRootAllowedFiles, isScannedAppRootEntry, CommandExecutionError, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };

package/{index-37mwgmp7.js → index-4agbdds8.js}

@@ -1,17 +1,17 @@
 // @bun
 import {
   AkanContextAnalyzer
-} from "./index-znxjcx1p.js";
+} from "./index-djh5gpb7.js";
 import {
   createRepairReport,
   generatedFilePathsForTarget,
   renderRepairReport,
   writeGeneratedSyncState,
   writeWorkflowRunArtifact
-} from "./index-nz9ceqgp.js";
+} from "./index-9s991k9v.js";
 import {
   runner
-} from "./index-9p2edf9w.js";
+} from "./index-bkwnr08k.js";
 
 // pkgs/@akanjs/cli/repair/repair.runner.ts
 var commandForShell = (command) => command.startsWith("akan ") ? `bun run ${command}` : command;

package/{index-jwvs48kc.js → index-4v0wvt37.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   ModuleScript
-} from "./index-nmfen65g.js";
+} from "./index-aak9cctp.js";
 import {
   addFieldUiPolicyForType,
   coerceFieldDefault,
@@ -34,15 +34,15 @@ import {
   sourceFile,
   validationCommandsForTarget,
   viaBuilderParameterName
-} from "./index-nz9ceqgp.js";
+} from "./index-9s991k9v.js";
 import {
   script
-} from "./index-9p2edf9w.js";
+} from "./index-bkwnr08k.js";
 import {
   AppExecutor,
   LibExecutor,
   ModuleExecutor
-} from "./index-3tqjdv03.js";
+} from "./index-1twehz1x.js";
 
 // pkgs/@akanjs/cli/primitive/primitive.script.ts
 import { capitalize } from "akanjs/common";

package/{index-xv5jv1fe.js → index-7ecpft60.js}

@@ -1,24 +1,25 @@
 // @bun
 import {
   AkanContextAnalyzer
-} from "./index-znxjcx1p.js";
+} from "./index-djh5gpb7.js";
 import {
   Prompter
 } from "./index-j37qq1f2.js";
 import {
   runner,
   script
-} from "./index-9p2edf9w.js";
+} from "./index-bkwnr08k.js";
 import {
   AGENT_BLOCK_END,
   AGENT_BLOCK_START,
   AppExecutor,
+  CLAUDE_COMMENT_RULE,
   LibExecutor,
   readDevkitVersion,
   renderRecipeEntries,
   stampBlockVersion,
   upsertAgentBlock
-} from "./index-3tqjdv03.js";
+} from "./index-1twehz1x.js";
 import {
   collectRecipeSources,
   scanRecipes
@@ -199,6 +200,8 @@ var renderClaudeMd = async (workspace) => {
   return `# ${context.repoName} \u2014 Claude Code Guide
 
 @AGENTS.md
+
+${CLAUDE_COMMENT_RULE}
 `;
 };
 var renderCursorRule = () => `---

package/{index-6xh65612.js → index-8d9r0df5.js}

@@ -9,14 +9,14 @@ import {
   createPassedPrimitiveReport,
   generatedFilesForSync,
   scalarChangedFiles
-} from "./index-nz9ceqgp.js";
+} from "./index-9s991k9v.js";
 import {
   Prompter
 } from "./index-j37qq1f2.js";
 import {
   runner,
   script
-} from "./index-9p2edf9w.js";
+} from "./index-bkwnr08k.js";
 
 // pkgs/@akanjs/cli/scalar/scalar.prompt.ts
 import { input } from "@inquirer/prompts";

package/{index-hz5x5zdp.js → index-96vpa123.js}

@@ -7,14 +7,14 @@ import {
 } from "./index-0cj2zxbm.js";
 import {
   openBrowser
-} from "./index-v2r1wrzb.js";
+} from "./index-rv16ck4r.js";
 import {
   runner
-} from "./index-9p2edf9w.js";
+} from "./index-bkwnr08k.js";
 import {
   AppExecutor,
   WorkspaceExecutor
-} from "./index-3tqjdv03.js";
+} from "./index-1twehz1x.js";
 
 // pkgs/@akanjs/cli/npmRegistry.ts
 var defaultNpmRegistry = "https://registry.npmjs.org";

package/{index-nz9ceqgp.js → index-9s991k9v.js}

@@ -2,7 +2,7 @@
 import {
   AppExecutor,
   LibExecutor
-} from "./index-3tqjdv03.js";
+} from "./index-1twehz1x.js";
 
 // pkgs/@akanjs/devkit/workflow/utils.ts
 var jsonText = (value, { trailingNewline = true } = {}) => `${JSON.stringify(value, null, 2)}${trailingNewline ? `

package/{index-nmfen65g.js → index-aak9cctp.js}

@@ -4,7 +4,7 @@ import {
 } from "./index-ss469dec.js";
 import {
   PageScript
-} from "./index-tk2e3m3y.js";
+} from "./index-gyvrhtpm.js";
 import {
   AiSession
 } from "./index-0cj2zxbm.js";
@@ -15,17 +15,17 @@ import {
   generatedFilesForSync,
   moduleSourcePaths,
   sourceFile
-} from "./index-nz9ceqgp.js";
+} from "./index-9s991k9v.js";
 import {
   Prompter
 } from "./index-j37qq1f2.js";
 import {
   runner,
   script
-} from "./index-9p2edf9w.js";
+} from "./index-bkwnr08k.js";
 import {
   ModuleExecutor
-} from "./index-3tqjdv03.js";
+} from "./index-1twehz1x.js";
 import {
   FileSys
 } from "./index-67546d0j.js";

package/{index-0hk3frny.js → index-b9m84bjp.js}

@@ -1,22 +1,22 @@
 // @bun
 import {
   RepairRunner
-} from "./index-37mwgmp7.js";
+} from "./index-4agbdds8.js";
 import {
   WorkflowRunner
-} from "./index-w7jphpt6.js";
+} from "./index-w7farjxd.js";
 import {
   ScalarScript
-} from "./index-6xh65612.js";
+} from "./index-8d9r0df5.js";
 import {
   PrimitiveScript
-} from "./index-jwvs48kc.js";
+} from "./index-4v0wvt37.js";
 import {
   ModuleScript
-} from "./index-nmfen65g.js";
+} from "./index-aak9cctp.js";
 import {
   isPlaceholderAppId
-} from "./index-pdj7r8fa.js";
+} from "./index-gz91pc3p.js";
 import {
   AkanContextAnalyzer,
   akanMcpInstallConfigPaths,
@@ -27,14 +27,14 @@ import {
   renderDoctorText,
   resourceList,
   upsertCodexMcpServerBlock
-} from "./index-znxjcx1p.js";
+} from "./index-djh5gpb7.js";
 import {
   buildAkanModuleContextIndex,
   createWorkflowBaselineSummary,
   createWorkflowStepRegistry,
   jsonText,
   toolingRolloutGate
-} from "./index-nz9ceqgp.js";
+} from "./index-9s991k9v.js";
 import {
   Prompter
 } from "./index-j37qq1f2.js";
@@ -45,10 +45,10 @@ import {
   CommandContainer,
   runner,
   script
-} from "./index-9p2edf9w.js";
+} from "./index-bkwnr08k.js";
 import {
   AppExecutor
-} from "./index-3tqjdv03.js";
+} from "./index-1twehz1x.js";
 
 // pkgs/@akanjs/cli/context/context.script.ts
 import { Logger } from "akanjs/common";

package/{index-9p2edf9w.js → index-bkwnr08k.js}

@@ -6,7 +6,7 @@ import {
   ModuleExecutor,
   PkgExecutor,
   WorkspaceExecutor
-} from "./index-3tqjdv03.js";
+} from "./index-1twehz1x.js";
 import {
   getDirname
 } from "./index-1577bej2.js";