@akanjs/cli 3.0.0-beta.16 → 3.0.0-beta.18

package/akanCode.js

@@ -11,14 +11,13 @@ import {
   VerifyFeedback2,
   AkanToolPack2,
   MailToolPack2,
-  akanCodePaths2,
+  McpUnauthorized2,
   McpClient2,
   McpToolPack2,
   SessionToolPack2,
   WebToolPack2,
   AkanCodePlugins2,
   AkanEnvKeys2,
-  AkanAuthStorageBackend2,
   akanSystemPrompt2,
   CodeSessionIndex2,
   AkanCodeServices2,
@@ -29,32 +28,33 @@ import {
   CodeMailbox2,
   CodeSessionFork2,
   CodeAgent2
-} from "./index-5405kc0x.js";
+} from "./index-jwexzh42.js";
 import {
   akanCodeDefaultModel2,
   akanCodeModel2,
   akanCodeModelSupportsImages2,
   akanCodeModelWarnings2,
   CodeAgentStreamPrinter2
-} from "./index-wfwknnje.js";
+} from "./index-jwrpsrg3.js";
 import {
-  SubagentPool2
-} from "./index-jgrnpt6y.js";
+  SubagentPool2,
+  akanCodePaths2
+} from "./index-jd01kj5r.js";
 import"./index-7md2g9vw.js";
 import {
   CodeAgentRpcHost2
 } from "./index-8k16atqy.js";
 import {
+  CodeTuiLines2,
+  CodeTuiAgents2,
   CodeTuiClipboard2,
   CodeTuiCommands2,
-  CodeTuiLines2,
   CodeTuiEditor2,
   CodeTuiFiles2,
   CodeTuiMarkdown2,
   CodeTuiParts2
-} from "./index-sxg87a8f.js";
+} from "./index-14zrtgfa.js";
 export {
-  AkanAuthStorageBackend2 as AkanAuthStorageBackend,
   AkanCli2 as AkanCli,
   AkanCodePlugins2 as AkanCodePlugins,
   AkanCodeServices2 as AkanCodeServices,
@@ -72,6 +72,7 @@ export {
   CodeMailbox2 as CodeMailbox,
   CodeSessionFork2 as CodeSessionFork,
   CodeSessionIndex2 as CodeSessionIndex,
+  CodeTuiAgents2 as CodeTuiAgents,
   CodeTuiClipboard2 as CodeTuiClipboard,
   CodeTuiCommands2 as CodeTuiCommands,
   CodeTuiEditor2 as CodeTuiEditor,
@@ -83,6 +84,7 @@ export {
   MailToolPack2 as MailToolPack,
   McpClient2 as McpClient,
   McpToolPack2 as McpToolPack,
+  McpUnauthorized2 as McpUnauthorized,
   PreviewChrome2 as PreviewChrome,
   PreviewFeedback2 as PreviewFeedback,
   PreviewView2 as PreviewView,

package/{application.command-t5542jte.js → application.command-2wcj5da3.js}

@@ -6,17 +6,17 @@ import {
   Exec,
   Workspace,
   command
-} from "./index-6na0sd2b.js";
+} from "./index-ycy302an.js";
 import"./index-q0y2jq9j.js";
-import"./index-p4p9t45x.js";
+import"./index-bwxpk2cj.js";
 import"./index-6wwzs1bc.js";
 import {
   ApplicationScript
-} from "./index-ns128c4q.js";
-import"./index-3mg4h788.js";
+} from "./index-h94faz96.js";
+import"./index-6q589y9t.js";
 import"./index-hwkygn9s.js";
 import"./index-7md2g9vw.js";
-import"./index-sn7dnzq4.js";
+import"./index-4r42ext5.js";
 import {
   getMobileTargetChoices
 } from "./index-47pj3aee.js";
@@ -51,7 +51,14 @@ class ApplicationCommand extends command("application", [ApplicationScript], ({
   logs: target({ desc: "Tail the running application's logs, filtered (attaches to akan-control.sock)" }).with(App).option("level", String, { desc: "minimum level: trace, verbose, debug, info, warn, error", nullable: true }).option("grep", String, { desc: "substring the message must contain", nullable: true }).option("endpoint", String, {
     desc: "endpoint glob(s), comma-separated: mutation:*, query:userList",
     nullable: true
-  }).option("trace", String, { desc: "one request's traceId", nullable: true }).option("child", String, { desc: "replica index(es), comma-separated", nullable: true }).option("role", String, { flag: "R", desc: "process role(s): gateway, all, batch, rsc-worker", nullable: true }).option("origin", String, { desc: "call origin(s): http, websocket, mcp, internal, page", nullable: true }).option("since", String, { desc: "only records newer than this: 5m, 30s, or epoch ms", nullable: true }).option("replay", Number, { flag: "n", desc: "records to replay from the buffer before following", default: 0 }).option("json", Boolean, { desc: "print NDJSON records instead of rendered lines", default: false }).option("follow", Boolean, { desc: "keep streaming; pass --follow false for history only", default: true }).option("runtimeDir", String, {
+  }).option("trace", String, { desc: "one request's traceId", nullable: true }).option("child", String, { desc: "replica index(es), comma-separated", nullable: true }).option("role", String, {
+    flag: "R",
+    desc: "process role(s): gateway, federation, batch, all, rsc-worker",
+    nullable: true
+  }).option("origin", String, { desc: "call origin(s): http, websocket, mcp, internal, page", nullable: true }).option("since", String, {
+    desc: "only records newer than this: a duration ago in ms, s, m, h or d (30s, 5m, 2h), or an epoch-ms timestamp",
+    nullable: true
+  }).option("replay", Number, { flag: "n", desc: "records to replay from the buffer before following", default: 0 }).option("json", Boolean, { desc: "print NDJSON records instead of rendered lines", default: false }).option("follow", Boolean, { desc: "keep streaming; pass --follow false for history only", default: true }).option("runtimeDir", String, {
     flag: "d",
     desc: "runtime dir holding akan-control.sock (default: local/apps/<app>/runtime)",
     nullable: true
@@ -104,13 +111,13 @@ class ApplicationCommand extends command("application", [ApplicationScript], ({
     enum: ["local", "debug", "develop", "main"],
     desc: "backend environment",
     default: "local"
-  }).option("open", Boolean, { desc: "open ios simulator", default: false }).option("release", Boolean, { desc: "release mode", default: false }).option("write", Boolean, { desc: "write code generation", default: true }).option("regenerate", Boolean, { flag: "g", desc: "delete and regenerate native project", default: false }).option("noAllowProvisioningUpdates", Boolean, {
-    desc: "disable automatic iOS provisioning updates for physical devices",
-    default: false
+  }).option("open", Boolean, { desc: "open ios simulator", default: false }).option("release", Boolean, { desc: "release mode", default: false }).option("write", Boolean, { desc: "write code generation", default: true }).option("regenerate", Boolean, { flag: "g", desc: "delete and regenerate native project", default: false }).option("allowProvisioningUpdates", Boolean, {
+    desc: "let Xcode create or update provisioning profiles for a physical device",
+    default: true
   }).option("device", String, {
     desc: "run target to select non-interactively: udid, device name, or runtime (e.g. 'iPhone 16' or 'iOS 18')",
     default: ""
-  }).exec(async function(app, target, env, open, release, write, regenerate, noAllowProvisioningUpdates, device) {
+  }).exec(async function(app, target, env, open, release, write, regenerate, allowProvisioningUpdates, device) {
     await this.applicationScript.startIos(app, {
       target,
       env,
@@ -118,7 +125,7 @@ class ApplicationCommand extends command("application", [ApplicationScript], ({
       operation: release ? "release" : "local",
       write,
       regenerate,
-      noAllowProvisioningUpdates,
+      noAllowProvisioningUpdates: !allowProvisioningUpdates,
       device: device || undefined
     });
   }),

package/{applicationBuildRunner-x4gbfn7y.js → applicationBuildRunner-m0hhgwsx.js}

@@ -1,14 +1,14 @@
 // @bun
 import {
   Spinner
-} from "./index-p4p9t45x.js";
+} from "./index-bwxpk2cj.js";
 import {
   AllRoutesBuilder,
   CsrArtifactBuilder,
   FontPruner,
   precompressArtifacts,
   SsrBaseArtifactBuilder
-} from "./index-zn8qgeqx.js";
+} from "./index-zq0mr3hh.js";
 import"./index-w8kmx1b6.js";
 import"./index-q0y2jq9j.js";
 import"./index-hwkygn9s.js";
@@ -159,11 +159,12 @@ class ApplicationBuildRunner {
     };
   }
   async#writeConsoleShim() {
-    await Bun.write(path.join(this.#app.dist.cwdPath, "console.js"), `import { cnst, db, dict, option, server, sig, srv } from "./server.js";
-import { assertAkanConsoleAllowed, startAkanConsole } from "./console-runtime.js";
+    await Bun.write(path.join(this.#app.dist.cwdPath, "console.js"), `process.env.AKAN_COMMAND_TYPE = "console";
+const { cnst, db, dict, option, server, sig, srv } = await import("./server.js");
+const { assertAkanConsoleAllowed, startAkanConsole } = await import("./console-runtime.js");
 
 const run = async () => {
-  assertAkanConsoleAllowed(server.env);
+  assertAkanConsoleAllowed();
   await server.start({ listen: false, web: false });
   try {
     await startAkanConsole(server, { globals: { cnst, db, dict, option, sig, srv } });

package/{applicationReleasePackager-z61ep017.js → applicationReleasePackager-vykfzgx3.js}

@@ -4,7 +4,7 @@ import {
 } from "./index-q0y2jq9j.js";
 import {
   Spinner
-} from "./index-p4p9t45x.js";
+} from "./index-bwxpk2cj.js";
 
 // pkgs/@akanjs/devkit/applicationReleasePackager.ts
 import { cp, mkdir, rm } from "fs/promises";

package/buildBatch.proc.js

@@ -2,7 +2,7 @@
 import {
   WorkspaceExecutor,
   AppExecutor
-} from "./index-p4p9t45x.js";
+} from "./index-bwxpk2cj.js";
 import"./index-q0y2jq9j.js";
 import"./index-6wwzs1bc.js";
 import {
@@ -11,7 +11,7 @@ import {
   CsrArtifactBuilder,
   FontOptimizer,
   SsrBaseArtifactBuilder
-} from "./index-zn8qgeqx.js";
+} from "./index-zq0mr3hh.js";
 import"./index-w8kmx1b6.js";
 import"./index-hwkygn9s.js";
 import"./index-n68jx79w.js";

package/{capacitorApp-shv3ajh5.js → capacitorApp-2daqhb5h.js}

@@ -2,8 +2,8 @@
 import {
   isPlaceholderAppId2,
   CapacitorApp2
-} from "./index-3cymrzsb.js";
-import"./index-p4p9t45x.js";
+} from "./index-erfc1x40.js";
+import"./index-bwxpk2cj.js";
 import"./index-6wwzs1bc.js";
 import"./index-q0y2jq9j.js";
 export {

package/{cloud.command-4x35k1z6.js → cloud.command-960bgbf4.js}

@@ -6,20 +6,20 @@ import {
 import {
   Workspace,
   command
-} from "./index-6na0sd2b.js";
-import"./index-p4p9t45x.js";
+} from "./index-ycy302an.js";
+import"./index-bwxpk2cj.js";
 import"./index-6wwzs1bc.js";
-import"./index-ns128c4q.js";
-import"./index-3mg4h788.js";
+import"./index-h94faz96.js";
+import"./index-6q589y9t.js";
 import"./index-hwkygn9s.js";
 import"./index-7md2g9vw.js";
 import"./index-kcxmv48c.js";
-import"./index-018dszb3.js";
-import"./index-57p9p179.js";
+import"./index-sbfk9daf.js";
+import"./index-3hpxeys1.js";
 import {
   CloudScript2
-} from "./index-zg0v1zte.js";
-import"./index-sn7dnzq4.js";
+} from "./index-wcg582a8.js";
+import"./index-4r42ext5.js";
 
 // pkgs/@akanjs/cli/cloud/cloud.command.ts
 var localRegistryUrl = () => process.env.AKAN_NPM_REGISTRY ?? "http://127.0.0.1:4873";

package/{cloud.script-3k8nbbpn.js → cloud.script-qhcnqt1n.js}

@@ -1,17 +1,17 @@
 // @bun
 import {
   CloudScript2
-} from "./index-zg0v1zte.js";
-import"./index-57p9p179.js";
-import"./index-ns128c4q.js";
-import"./index-sn7dnzq4.js";
-import"./index-3mg4h788.js";
-import"./index-018dszb3.js";
+} from "./index-wcg582a8.js";
+import"./index-3hpxeys1.js";
+import"./index-h94faz96.js";
+import"./index-4r42ext5.js";
+import"./index-6q589y9t.js";
+import"./index-sbfk9daf.js";
 import"./index-myj01w9r.js";
-import"./index-6na0sd2b.js";
+import"./index-ycy302an.js";
 import"./index-7md2g9vw.js";
 import"./index-hwkygn9s.js";
-import"./index-p4p9t45x.js";
+import"./index-bwxpk2cj.js";
 import"./index-6wwzs1bc.js";
 import"./index-kcxmv48c.js";
 import"./index-q0y2jq9j.js";

package/{code.command-mrfb7a1g.js → code.command-4feh3ef7.js}

@@ -4,14 +4,14 @@ import {
   runner,
   script,
   command
-} from "./index-6na0sd2b.js";
+} from "./index-ycy302an.js";
 import"./index-q0y2jq9j.js";
-import"./index-p4p9t45x.js";
+import"./index-bwxpk2cj.js";
 import"./index-6wwzs1bc.js";
 import {
   akanCodeDefaultModel2,
   CodeAgentStreamPrinter2
-} from "./index-wfwknnje.js";
+} from "./index-jwrpsrg3.js";
 
 // pkgs/@akanjs/cli/code/code.runner.ts
 import { codeAgentPresets, isCodeAgentPresetName } from "akanjs/common";
@@ -20,7 +20,7 @@ class CodeRunner extends runner("code") {
   async serve(options) {
     await import("./consoleToStderr-h5bryj94.js");
     const [{ CodeAgent }, { CodeAgentRpcHost }] = await Promise.all([
-      import("./CodeAgent-zgccwajm.js"),
+      import("./CodeAgent-0035exh3.js"),
       import("./CodeAgentRpcHost-qvwfv0n9.js")
     ]);
     const profile = CodeRunner.profileOf(options);
@@ -36,8 +36,8 @@ class CodeRunner extends runner("code") {
   }
   async tui(options, seed) {
     const [{ CodeAgent }, { CodeTui }] = await Promise.all([
-      import("./CodeAgent-zgccwajm.js"),
-      import("./CodeTui-993tx7gf.js")
+      import("./CodeAgent-0035exh3.js"),
+      import("./CodeTui-eweg1hep.js")
     ]);
     const profile = CodeRunner.profileOf(options);
     const apps = options.app ? [options.app] : await options.workspace.getApps();
@@ -71,7 +71,7 @@ class CodeRunner extends runner("code") {
     }
   }
   async run(prompt, options) {
-    const { CodeAgent } = await import("./CodeAgent-zgccwajm.js");
+    const { CodeAgent } = await import("./CodeAgent-0035exh3.js");
     const profile = CodeRunner.profileOf(options);
     const agent = await CodeAgent.create({
       workspace: options.workspace,

package/{context.command-pqsm5jrk.js → context.command-kzehkx48.js}

@@ -2,25 +2,25 @@
 import {
   Workspace,
   command
-} from "./index-6na0sd2b.js";
+} from "./index-ycy302an.js";
 import"./index-q0y2jq9j.js";
-import"./index-p4p9t45x.js";
+import"./index-bwxpk2cj.js";
 import"./index-6wwzs1bc.js";
 import"./index-by5gpp8x.js";
-import"./index-qhtj9y6j.js";
-import"./index-v17gj504.js";
-import"./index-g9zghs4h.js";
-import"./index-3cymrzsb.js";
-import"./index-twq9p2sp.js";
-import"./index-4cvpzkq6.js";
-import"./index-2pm1j01n.js";
-import"./index-qh7brn20.js";
-import"./index-xjc7gg65.js";
-import"./index-te0y1c0m.js";
-import"./index-vpx68e4x.js";
+import"./index-yw6g3bbv.js";
+import"./index-rpgxs245.js";
+import"./index-cjw1sj1x.js";
+import"./index-erfc1x40.js";
+import"./index-s5rhm04y.js";
+import"./index-ef228gzf.js";
+import"./index-zmj143x7.js";
+import"./index-mt2154s2.js";
+import"./index-pn8mhpps.js";
+import"./index-d9fjz06h.js";
+import"./index-q9c3c0hy.js";
 import {
   ContextScript
-} from "./index-4n4821gp.js";
+} from "./index-dw943k93.js";
 
 // pkgs/@akanjs/cli/context/context.command.ts
 class ContextCommand extends command("context", [ContextScript], ({ public: target }) => ({

package/context.runner-z0rrcz7b.js

@@ -0,0 +1,22 @@
+// @bun
+import {
+  ContextRunner2
+} from "./index-cjw1sj1x.js";
+import"./index-zmj143x7.js";
+import"./index-q9c3c0hy.js";
+import"./index-d9fjz06h.js";
+import"./index-ef228gzf.js";
+import"./index-pn8mhpps.js";
+import"./index-mt2154s2.js";
+import"./index-rpgxs245.js";
+import"./index-yw6g3bbv.js";
+import"./index-s5rhm04y.js";
+import"./index-erfc1x40.js";
+import"./index-ycy302an.js";
+import"./index-bwxpk2cj.js";
+import"./index-by5gpp8x.js";
+import"./index-6wwzs1bc.js";
+import"./index-q0y2jq9j.js";
+export {
+  ContextRunner2 as ContextRunner
+};

package/{devTui-gy6mendg.js → devTui-ffjsarqa.js}

@@ -2,12 +2,12 @@
 import {
   stripAnsi
 } from "./index-7md2g9vw.js";
-import {
-  openBrowser
-} from "./index-ns128c4q.js";
 import {
   writeClipboard
 } from "./index-p6pbz9n5.js";
+import {
+  openBrowser
+} from "./index-9dp031by.js";
 
 // pkgs/@akanjs/cli/application/devTui.tsx
 import { render } from "ink";

package/{devTuiView-y1548wy6.js → devTuiView-1q1mdgrv.js}

@@ -1,7 +1,7 @@
 // @bun
 // pkgs/@akanjs/cli/application/devTuiView.ts
 var createDevTuiView = async (supervisor) => {
-  const { DevTui } = await import("./devTui-gy6mendg.js");
+  const { DevTui } = await import("./devTui-ffjsarqa.js");
   return new DevTui(supervisor);
 };
 export {

package/{guideline.command-rpc2emw8.js → guideline.command-3w2g20x4.js}

@@ -2,30 +2,29 @@
 import {
   script,
   command
-} from "./index-6na0sd2b.js";
+} from "./index-ycy302an.js";
 import"./index-q0y2jq9j.js";
-import"./index-p4p9t45x.js";
+import"./index-bwxpk2cj.js";
 import"./index-6wwzs1bc.js";
 import {
   Prompter2
-} from "./index-twq9p2sp.js";
+} from "./index-s5rhm04y.js";
 
 // pkgs/@akanjs/cli/guideline/guideline.script.ts
 import { Logger } from "akanjs/common";
 
 class GuidelineScript extends script("guideline") {
-  async guideline(action, name = null, format = "markdown") {
+  async guideline(action, name = null) {
     if (action === "list") {
       const guidelines = await Prompter2.listGuidelines();
-      Logger.rawLog(format === "json" ? JSON.stringify({ guidelines }, null, 2) : guidelines.join(`
+      Logger.rawLog(guidelines.join(`
 `));
       return;
     }
     if (action === "show") {
       if (!name)
         throw new Error("Guideline name is required. Example: akan guideline show framework");
-      const [instruction, guideJson] = await Promise.all([Prompter2.getInstruction(name), Prompter2.getGuideJson(name)]);
-      Logger.rawLog(format === "json" ? JSON.stringify({ name, instruction, guideJson }, null, 2) : instruction);
+      Logger.rawLog(await Prompter2.getInstruction(name));
       return;
     }
     throw new Error(`Unknown guideline action: ${action}. Use "list" or "show".`);
@@ -34,12 +33,8 @@ class GuidelineScript extends script("guideline") {
 
 // pkgs/@akanjs/cli/guideline/guideline.command.ts
 class GuidelineCommand extends command("guideline", [GuidelineScript], ({ public: target }) => ({
-  guideline: target({ desc: "List or show Akan AI guideline instructions" }).arg("action", String, { desc: "list or show" }).arg("name", String, { desc: "guideline name for show", nullable: true }).option("format", String, {
-    desc: "output format",
-    default: "markdown",
-    enum: ["markdown", "json"]
-  }).exec(async function(action, name, format) {
-    await this.guidelineScript.guideline(action, name, format);
+  guideline: target({ desc: "List or show Akan AI guideline instructions" }).arg("action", String, { desc: "list or show" }).arg("name", String, { desc: "guideline name for show", nullable: true }).exec(async function(action, name) {
+    await this.guidelineScript.guideline(action, name);
   })
 })) {
 }

package/guidelines/conventions/conventions.instruction.md

@@ -273,8 +273,10 @@ are, because those are the ones the server could have done.
    SEO snapshots, prerendering and pre-hydration E2E read, so await what the page needs immediately and stream
    the rest. `xListInY` / `xInsightInY` hold hydrated model instances that React Flight refuses as client props:
    consume them in a server component, never as a `Zone` prop.
-6. **Use named `ReactNode` slots, not just `children`** — `Layout.Navbar` takes `title`, `back`, `left`, `right`,
-   and `children`, so a client shell composes server content in five places instead of absorbing it.
+6. **Use named `ReactNode` slots, not just `children`** — a client shell that takes one slot per region lets a
+   server component supply each of them, instead of absorbing the whole subtree into the bundle. `Layout.Navbar`
+   declares `title` / `left` / `right` alongside `back` and `children`, but renders only the last two today, so
+   copy the shape rather than the component.
 7. **Let the server do the derived work.** Display and predicate logic belongs on `Light<Model>`; enum→class
    lookups belong in a module-scope `as const` map.
 8. **Gate auth on the server** — `getSelf({ unauthorize: "/signin" })` in `_layout.tsx`, before any HTML is sent.
@@ -421,8 +423,11 @@ stores need none, because state and CRUD actions are generated. The body is thre
 `this.setX(...)` → toast. The optimistic shape is mutate the client model, `void fetch.*`, then commit. Use
 `this.pick(...)` when the value must exist, `this.get()` when it may not, and `this.set({...})` to write. Mutate lists
 through the collection API (`this.set({ xList: xList.set(x).save() })`), not array spread. **An action returns
-nothing** (`no-return-in-store-action.grit`). **Never `import type { RootStore } from "../st"`** — it crashes
-`akan build` with a Bun SSR segfault.
+nothing** (`no-return-in-store-action.grit`). **Reach another store through `this`:**
+`import type { RootStore } from "../st"`, then `(this as unknown as RootStore).logout()` to call its action or
+`(this as unknown as RootStore).set({ … })` / `.get()` to write or read its state. Every store is mixed into one root
+at runtime, so the cast only tells the type what `this` already is. Keep it `import type` — `st.ts` imports every
+store, so a value import is a cycle.
 
 **`<model>.dictionary.ts`** — fixed chain, with empty stages still written:
 `.of() → .model() → .insight() → .query() → .sort() → .enum() → .slice() → .endpoint() → .error() → .translate()`.
@@ -475,13 +480,14 @@ Full contract — credential handshake, room revalidation, socket cleanup scopin
   never bounded. **Losing the race does not cancel the work**: the handler runs to completion with nobody
   holding its result, so a deadline is an answer to the caller, not an undo.
 - **A cached answer is the endpoint's `{ cache: <ms> }`, and only a `query` taking no internal argument may have
-  one.** The `Cache` middleware is registered by default and stands aside for every endpoint that declares
-  nothing. Internal arguments are how a call learns who is asking (`.with(Self)`), so an endpoint that has them
-  answers per caller and one shared entry would be one caller's answer handed to the next — that endpoint and
-  every `mutation` are named in the log and left uncached. Guards run on every hit; what is cached is the
-  handler's result, so `resolveReturn` still masks fields and resolves relations per call; a cache backend that
-  is down is warned about and the call runs uncached. The default chain is `Logging → Timeout → Cache → handler`,
-  and there is no `Retry` middleware.
+  one.** It is a step of the call, not a middleware, and stands aside for every endpoint that declares nothing.
+  Internal arguments are how a call learns who is asking (`.with(Self)`), so an endpoint that has them answers
+  per caller and one shared entry would be one caller's answer handed to the next — that endpoint and every
+  `mutation` are named in the log and left uncached. The lookup runs after the guards, so a hit reaches only a
+  caller they admitted; what is cached is the handler's result, so `resolveReturn` still masks fields and resolves
+  relations per call; a cache backend that is down is warned about and the call runs uncached. The default
+  middleware chain is `Logging → Timeout → <lib middlewares>`, then guards → internal arguments → cache →
+  handler, and there is no `Retry` middleware.
 
 ### Authorization Defaults
 
@@ -548,8 +554,11 @@ Full contract — filter-arg `ref` pickers, `getQueryMeta` summary counters, `la
   first "more". `isCumulativeOf<Model>` is the mode.
 - **"Is there more" is `hasMoreOf<Model>`, never `count > page * limit`.** It comes from the length of the batch
   the server returned, so it survives `{ insight: false }` and cannot drift from a count a live event moved.
-- **Hydrated vs raw:** server queries return hydrated `cnst.<Model>` instances (with `set`/`save`/`refresh`);
-  client fetch results are raw `GetStateObject` plain data, functions stripped.
+- **Hydrated vs raw:** server queries return hydrated `cnst.<Model>` instances (with `set`/`save`/`refresh`),
+  and so do client fetch results — `FetchClient` parses every return with `crystalize` defaulting to **true**
+  (`pkgs/akanjs/fetch/client/fetchClient.ts`). The raw `GetStateObject` shape is what the `<ref>Obj` /
+  `<ref>ObjList` / `<ref>ObjInsight` handles carry, because those pass `crystalize: false` on purpose so the
+  value can cross the RSC boundary as a client prop.
 - Every filter generates fourteen methods: `list` · `listIds` · `find` · `findId` · `pick` · `pickId` · `exists` ·
   `count` · `insight` · `query` · **`remove`** · **`removeOne`** · **`update`** · **`updateOne`**. The last four
   are query-level writes — one atomic UPDATE, **no hooks**, and therefore no `_postRemove` and no cascade. Use
@@ -587,7 +596,7 @@ Full contract — relevance ordering, `columns` / `weights`: `get_guideline` wit
 - Injected dependencies resolve by field-name convention: a field named `<refName>Service` resolves to the service registered under `<refName>`, and `<refName>Signal` likewise (`pkgs/akanjs/service/injectInfo.ts`).
 - The `Service`/`Signal` suffix is required — the injector strips it to derive the registry lookup key. Name the field after the target refName plus the suffix, not arbitrarily.
 - Preference order inside a service: `service<srv.XService>()` for another module's service · `plug(AdapterClass)` or `plug(StorageAdaptorRole)` for an adapter · `use<T>()` only to reach an `option.ts`-registered legacy singleton · `env(...)` for config.
-- **`memory(...)` takes a scalar or model class, not only a primitive** — `memory(Map, { of: CallStateInput })` serializes through the constant and travels as JSON text, so the Redis and sqlite-backed caches round-trip the same declaration. Never hand-encode JSON into a `String` memory.
+- **`memory(...)` takes a scalar or model class, not only a primitive** — `memory(Map, { of: CallStateInput })` serializes through the constant and travels as JSON text, so the Redis and sqlite-backed caches round-trip the same declaration. Never hand-encode JSON into a `String` memory. A memory is scoped to the service or adaptor that declares it; `ttl` (milliseconds) sets how long each write lives unless the `set` call names its own `expireAt`, and a `Map` entry expires on its own.
 
 ### Adapters — `adapt()` And `plug()`
 
@@ -663,9 +672,11 @@ it.
   names itself as the issuer, so `/mcp` demands a bearer token, verifies its signature, and refuses one carrying no
   `aud`. A token is the app's own access JWT plus `aud`/`iss`/`client_id`, so `AccountMiddleware` and the guards
   judge it unchanged; there is no scope. Per-app knobs live in `env.server.*` under `oauth` (`consentPath` and
-  `signinPath` with the basePath, `clients`, `dynamicRegistration`, `allowedRedirectSchemes`, `clientIdMetadata`,
-  `enabled`). `/mcp` reads the `Authorization` header only — a cookie is dropped at the door — and `JWT_SECRET` is
-  mandatory outside `local`, because the derived fallback is forgeable from three public names. A grant is revoked
+  `signinPath` with the basePath, `clients`, `dynamicRegistration`, `allowedRedirectSchemes`, `accessTokenSeconds`,
+  `clientIdMetadata`, `enabled`, plus `issuer` / `resource` — set those when a tunnel or an edge makes the derived
+  origin wrong, because an MCP client compares the issuer byte for byte). `/mcp` reads the `Authorization` header only — a cookie is dropped at the door — and `JWT_SECRET` (or
+  `security.jwtSecret`) is mandatory whenever `operationMode` is not `local`, because the derived fallback is
+  forgeable from three public names; `AKAN_ALLOW_DERIVED_JWT_SECRET=1` accepts that risk explicitly. A grant is revoked
   whole — `POST /oauth/revoke` (RFC 7009) by the client, `fetch.revokeOAuthConnection(sessionId)` by the account's
   owner, `fetch.listOAuthConnections()` to see them — and a revoked access token is refused at its next call.
 - **A person may, a model may not.** An agent's token names its `client_id` and `aud`; a browser session has
@@ -831,10 +842,11 @@ shape, so `cascade` never means "related" — it means one of exactly these:
 - Dynamic segments use `[id]`; route groups use directories like `(user)`, `(public)`, `(tab)`, or `(detail)`.
 - **A route file exports one thing**: `export default page()…render(…)` for a page, `layout()…render(…)` for a
   `_layout.tsx`, `rootLayout()…render(…)` for the app's (or a basePath's) root `_layout.tsx`. Every route setting
-  is a stage of the chain — `.param()`, `.search()`, `.config()`, `.head()` / `.metadata()`, `.loading()`;
-  `.notFound()` / `.error()` on a layout; `.fonts()` / `.theme()` / `.manifest()` / `.reconnect()` / `.wsConnect()`
-  / `.layoutStyle()` / `.gaTrackingId()` on the root layout; `.prompt()` on a page. A named export beside the chain,
-  or `page()` in a `_layout.tsx`, fails the build.
+  is a stage of the chain — `.param()`, `.search()`, `.config()`, `.head()`, `.loading()`; `.notFound()` /
+  `.error()` on a layout; `.fonts()` / `.theme()` / `.manifest()` / `.reconnect()` / `.wsConnect()` /
+  `.layoutStyle()` on the root layout; `.prompt()` on a page. A named export beside the chain, or `page()` in a
+  `_layout.tsx`, fails the build. `.head()` takes JSX — `<title>`, `<meta>`, `<link>` — or a function of the
+  route's args returning it; there is no metadata object, and analytics is the app's own script, not a stage.
 - **A page names every `[x]` segment of its path with `.param("x", Type)`** and reads a query key only through
   `.search("k", Type)`. Values arrive typed — `ID`/`String` → string, `Int`/`Float` → number, `Boolean`, `Date` →
   Dayjs, an `enumOf` class → its union, `[T]` → array — a path value the type refuses answers not-found, and a
@@ -922,12 +934,15 @@ when two shapes disagree.
 - `children: any` — newer files use `children: ReactNode`.
 - Hard-coded API keys or secrets in source; they belong in `option.ts` or env.
 - Large blocks of commented-out code left in place.
-- Cross-store writes through a `RootStore` cast — it collides with the Bun SSR-bundler segfault.
 - Stale `// TODO: Implement …` comments above implemented methods.
 - `{cond && <X/>}` in JSX, hard-coded Korean bypassing `l()`, and `window.alert(...)` for user feedback.
 - Bare `/* eslint-disable */` blocks — use `// biome-ignore lint/<rule>: <why>`.
 - Raw palette grays such as `text-gray-400` instead of the semantic tokens (`text-foreground/70`).
 
+A store calling `(this as unknown as RootStore).<action>()` or `.set({ … })` over
+`import type { RootStore } from "../st"` is **not** one of these — it is the sanctioned way to reach another store's
+actions and state (see `<model>.store.ts` above).
+
 ## Secrets And Env Safety (`.env`, `infra/**`, `*secret*`, `*credential*`)
 
 - Never print, summarize, commit, or expose real secret values, credentials, tokens, private keys, or `.env` contents.

package/guidelines/queryRule/queryRule.instruction.md

@@ -49,7 +49,7 @@ with it. `conventions` carries the invariants — this is the full contract behi
   `findBy<Filter>(...args, { select: { secretField: true } })` takes it inside the option object. The shapes do not
   swap: `{ select: … }` handed to the facade projects a field named `select`, which no model has, and the read comes
   back empty with no error. This is the only way to read a `field.secret(...)` value, which is otherwise stripped.
-- **Hydrated vs raw:** server queries return hydrated `cnst.<Model>` instances (with `set`/`save`/`refresh`); client fetch results are raw `GetStateObject` plain data (functions stripped, `pkgs/akanjs/base/types.ts`).
+- **Hydrated vs raw:** server queries return hydrated `cnst.<Model>` instances (with `set`/`save`/`refresh`), and so do client fetch results — `FetchClient` parses every return with `crystalize` defaulting to **true** (`pkgs/akanjs/fetch/client/fetchClient.ts`). The raw `GetStateObject` shape (functions stripped, `pkgs/akanjs/base/types.ts`) is what the `<ref>Obj` / `<ref>ObjList` / `<ref>ObjInsight` handles carry, because those pass `crystalize: false` on purpose so the value can cross the RSC boundary as a client prop.
 - Every filter generates fourteen methods: `list` · `listIds` · `find` · `findId` · `pick` · `pickId` · `exists` ·
   `count` · `insight` · `query` · **`remove`** · **`removeOne`** · **`update`** · **`updateOne`**. The last four are
   query-level writes — one atomic UPDATE, **no hooks**, and therefore no `_postRemove` and no cascade. Use them on a

package/guidelines/ssrRule/ssrRule.instruction.md

@@ -129,8 +129,10 @@ eight queries threw; per-section boundaries put each rejection at its own bounda
 soft-redirect script, so `getSelf({ unauthorize: "/signin" })` stays in `_layout.tsx` or the page body — never
 inside a streamed section.
 
-**⑥ Use named `ReactNode` slots, not just `children`.** `Layout.Navbar` accepts `title`, `back`, `left`, `right`,
-and `children`, so a client shell composes server-rendered content in five places instead of absorbing it.
+**⑥ Use named `ReactNode` slots, not just `children`.** A client shell that takes one slot per region lets a
+server component supply each of them, instead of absorbing the whole subtree into the bundle. `Layout.Navbar`
+declares `title` / `left` / `right` alongside `back` and `children`, but its render body uses only `back` and
+`children` — copy the shape, not that component.
 
 **⑦ Let the server do the derived work.** Display and predicate logic belongs on `Light<Model>` (`isNew()`,
 `canWrite(user?)`, `formatTimes()`), and enum→class lookups belong in a module-scope `as const` map. Both sides call