@akanjs/cli 3.0.0-beta.17 → 3.0.0-beta.18

package/{index-2sq06vv0.js → index-jwexzh42.js}

@@ -2,8 +2,9 @@
 import {
   SubagentPool2,
   akanCodePaths2,
-  McpServerConfig
-} from "./index-qt8dqgnf.js";
+  McpServerConfig,
+  McpSignIn
+} from "./index-jd01kj5r.js";
 import {
   stripAnsi
 } from "./index-7md2g9vw.js";
@@ -513,7 +514,7 @@ class AkanToolPack2 {
     return { name: "akan-tools", factory: async (pi) => await this.#register(pi) };
   }
   async names() {
-    const { ContextRunner } = await import("./context.runner-bys6ykcp.js");
+    const { ContextRunner } = await import("./context.runner-z0rrcz7b.js");
     return [
       ...new ContextRunner().listMcpTools(this.#options.mode).map((tool) => tool.name),
       AkanToolPack2.verifyToolName
@@ -521,7 +522,7 @@ class AkanToolPack2 {
   }
   static verifyToolName = "akan_verify";
   async#register(pi) {
-    const { ContextRunner } = await import("./context.runner-bys6ykcp.js");
+    const { ContextRunner } = await import("./context.runner-z0rrcz7b.js");
     const runner = new ContextRunner;
     const guidelineNames = await AkanToolPack2.#guidelineNames();
     for (const tool of runner.listMcpTools(this.#options.mode, { guidelineNames })) {
@@ -563,7 +564,7 @@ class AkanToolPack2 {
   }
   static async#guidelineNames() {
     try {
-      const { Prompter } = await import("./prompter-9mn3kp36.js");
+      const { Prompter } = await import("./prompter-1f8d9pcc.js");
       return await Prompter.listGuidelines();
     } catch {
       return [];
@@ -576,9 +577,78 @@ class AkanToolPack2 {
   }
 }
 
-// pkgs/@akanjs/devkit/codeAgent/tools/MailToolPack.ts
+// pkgs/@akanjs/devkit/codeAgent/tools/AskToolPack.ts
 import { Type as Type2 } from "typebox";
 
+class AskToolPack {
+  static toolName = "ask_user";
+  static maxQuestions = 4;
+  #options;
+  constructor(options) {
+    this.#options = options;
+  }
+  names() {
+    return this.#options.profile.ui.canPrompt ? [AskToolPack.toolName] : [];
+  }
+  extension() {
+    if (!this.#options.profile.ui.canPrompt)
+      return;
+    return { name: "akan-ask", factory: (pi) => this.#register(pi) };
+  }
+  #register(pi) {
+    pi.registerTool({
+      name: AskToolPack.toolName,
+      label: "Ask",
+      description: "Ask the user to decide something you cannot decide from the code or the request. Use it when two readings of the task would lead to materially different work, not for choices with an obvious default \u2014 and never to ask permission for work you were already asked to do. Offer concrete options whenever you can name them; mark one recommended when you have a view.",
+      promptSnippet: "ask_user: put a decision the user owns back to them, with options",
+      parameters: Type2.Object({
+        questions: Type2.Array(Type2.Object({
+          question: Type2.String({ description: "The whole question, as one sentence ending in a question mark." }),
+          header: Type2.Optional(Type2.String({ description: "Two or three words naming what is being chosen, e.g. 'Auth method'." })),
+          options: Type2.Optional(Type2.Array(Type2.Object({
+            label: Type2.String({ description: "The choice, in one to five words." }),
+            detail: Type2.Optional(Type2.String({ description: "What picking it means, or the trade-off it carries." })),
+            recommended: Type2.Optional(Type2.Boolean({ description: "Mark at most one. It is offered first and labelled as such." }))
+          }), { description: "Two to four distinct choices. Leave it out to ask for an answer in prose." })),
+          multiSelect: Type2.Optional(Type2.Boolean({ description: "Several options may be chosen together, rather than exactly one." })),
+          freeText: Type2.Optional(Type2.Boolean({
+            description: "Offer a further choice that lets the user type an answer of their own. Default true."
+          }))
+        }), { description: `One to ${AskToolPack.maxQuestions} questions, asked in order.` })
+      }),
+      execute: async (_id, params) => {
+        const questions = (params.questions ?? []).slice(0, AskToolPack.maxQuestions);
+        if (!questions.length)
+          return { content: [{ type: "text", text: "No question was asked." }], details: undefined, isError: true };
+        const answers = [];
+        for (const entry of questions) {
+          const options = (entry.options ?? []).map((option, at) => ({
+            key: `${at}`,
+            label: option.label,
+            ...option.detail ? { detail: option.detail } : {},
+            ...option.recommended ? { recommended: true } : {}
+          }));
+          const answer = await this.#options.ask({
+            prompt: entry.header ? `${entry.header} \u2014 ${entry.question}` : entry.question,
+            kind: options.length ? "select" : "text",
+            ...options.length ? { options } : {},
+            ...entry.multiSelect ? { multiSelect: true } : {},
+            freeText: entry.freeText ?? true
+          });
+          answers.push(`${entry.question}
+\u2192 ${answer ?? "(skipped \u2014 decide this yourself and say what you chose)"}`);
+        }
+        return { content: [{ type: "text", text: answers.join(`
+
+`) }], details: undefined };
+      }
+    });
+  }
+}
+
+// pkgs/@akanjs/devkit/codeAgent/tools/MailToolPack.ts
+import { Type as Type3 } from "typebox";
+
 class MailToolPack2 {
   static toolNames = ["list_peers", "send_peer_message"];
   #options;
@@ -599,7 +669,7 @@ class MailToolPack2 {
       label: "List peer sessions",
       description: "List the other akan code sessions running in this workspace right now, with their name and working directory. Call it before send_peer_message so you name a session that is actually there.",
       promptSnippet: "list_peers: the other akan code sessions running here",
-      parameters: Type2.Object({}),
+      parameters: Type3.Object({}),
       execute: async () => ({
         content: [{ type: "text", text: MailToolPack2.#render(this.#options.mailbox()?.peers() ?? []) }],
         details: undefined
@@ -610,9 +680,9 @@ class MailToolPack2 {
       label: "Message a peer session",
       description: "Hand a message to another akan code session in this workspace. It arrives there as a prompt, so it costs that session a turn \u2014 use it to hand over a piece of work or to warn it about a change you made, not to chat. Say what you want done and what you already did.",
       promptSnippet: "send_peer_message: hand work to another akan code session",
-      parameters: Type2.Object({
-        to: Type2.String({ description: "The peer's name, or the front of its id, from list_peers." }),
-        message: Type2.String({ description: "What that session should know or do." })
+      parameters: Type3.Object({
+        to: Type3.String({ description: "The peer's name, or the front of its id, from list_peers." }),
+        message: Type3.String({ description: "What that session should know or do." })
       }),
       execute: async (_id, params) => {
         const mailbox = this.#options.mailbox();
@@ -645,20 +715,32 @@ import {
   codeAgentClip,
   codeAgentOutputChars
 } from "akanjs/common";
-import { Type as Type3 } from "typebox";
+import { Type as Type4 } from "typebox";
 
 // pkgs/@akanjs/devkit/codeAgent/tools/McpClient.ts
 var protocolVersion = "2025-06-18";
 
+class McpUnauthorized2 extends Error {
+  challenge;
+  constructor(name, challenge) {
+    super(`MCP server "${name}" requires authentication`);
+    this.name = "McpUnauthorized";
+    this.challenge = challenge;
+  }
+}
+
 class McpClient2 {
+  static maxToolPages = 50;
   ref;
   #proc;
   #nextId = 0;
   #buffer = "";
   #pending = new Map;
   #sessionId;
-  constructor(ref) {
+  #token;
+  constructor(ref, token) {
     this.ref = ref;
+    this.#token = token;
   }
   async connect() {
     if (this.ref.transport === "stdio")
@@ -674,10 +756,19 @@ class McpClient2 {
     return this;
   }
   async listTools() {
-    const response = await this.#call("tools/list", {});
-    if (response.error)
-      throw new Error(response.error.message);
-    return response.result?.tools ?? [];
+    const tools = [];
+    let cursor;
+    for (let page = 0;page < McpClient2.maxToolPages; page += 1) {
+      const response = await this.#call("tools/list", cursor ? { cursor } : {});
+      if (response.error)
+        throw new Error(response.error.message);
+      tools.push(...response.result?.tools ?? []);
+      const next = response.result?.nextCursor;
+      if (!next || next === cursor)
+        return tools;
+      cursor = next;
+    }
+    return tools;
   }
   async callTool(name, args) {
     const response = await this.#call("tools/call", { name, arguments: args });
@@ -761,11 +852,16 @@ class McpClient2 {
       headers: {
         "content-type": "application/json",
         accept: "application/json, text/event-stream",
+        "mcp-protocol-version": protocolVersion,
+        ...this.ref.headers,
+        ...this.#token ? { authorization: `Bearer ${this.#token}` } : {},
         ...this.#sessionId ? { "mcp-session-id": this.#sessionId } : {}
       },
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(30000)
     });
+    if (response.status === 401)
+      throw new McpUnauthorized2(this.ref.name, response.headers.get("www-authenticate") ?? "");
     this.#sessionId = response.headers.get("mcp-session-id") ?? this.#sessionId;
     const text = await response.text();
     if (!text.trim())
@@ -797,12 +893,22 @@ class McpToolPack2 {
     const pack = new McpToolPack2;
     for (const ref of refs) {
       const base = { name: ref.name, transport: ref.transport, target: McpServerConfig.targetOf(ref) };
+      const token = ref.transport === "http" ? await McpSignIn.token(ref, options.onNotice) : undefined;
       try {
-        const client = await new McpClient2(ref).connect();
+        const client = await new McpClient2(ref, token).connect();
         const tools = await client.listTools();
         pack.#clients.push({ client, tools });
-        pack.#status.push({ ...base, tools: tools.map((tool) => McpToolPack2.#nameOf(ref.name, tool.name)) });
+        pack.#status.push({
+          ...base,
+          tools: tools.map((tool) => McpToolPack2.#nameOf(ref.name, tool.name)),
+          auth: token ? "authorized" : "none"
+        });
       } catch (error) {
+        if (error instanceof McpUnauthorized2) {
+          options.onNotice?.(`MCP server "${ref.name}" needs signing in \u2014 /mcp login ${ref.name}`);
+          pack.#status.push({ ...base, tools: [], auth: "required" });
+          continue;
+        }
         options.onNotice?.(`MCP server "${ref.name}" is unavailable: ${String(error)}`);
         pack.#status.push({ ...base, tools: [], error: String(error) });
       }
@@ -832,7 +938,7 @@ class McpToolPack2 {
           label: `${client.ref.name}: ${tool.name}`,
           description,
           promptSnippet: `${name}: ${description.split(".")[0] ?? description}`,
-          parameters: Type3.Unsafe(tool.inputSchema),
+          parameters: Type4.Unsafe(tool.inputSchema),
           execute: async (_id, params) => {
             const result = await client.callTool(tool.name, params ?? {});
             return {
@@ -858,7 +964,7 @@ class McpToolPack2 {
 // pkgs/@akanjs/devkit/codeAgent/tools/SessionToolPack.ts
 import { SessionManager } from "@earendil-works/pi-coding-agent";
 import { codeAgentClip as codeAgentClip2, codeAgentOutputChars as codeAgentOutputChars2 } from "akanjs/common";
-import { Type as Type4 } from "typebox";
+import { Type as Type5 } from "typebox";
 var snippetChars = 240;
 
 class SessionToolPack2 {
@@ -881,9 +987,9 @@ class SessionToolPack2 {
       label: "Search sessions",
       description: "Search earlier coding-agent conversations in this workspace for a phrase, and get back the matching sessions with a snippet. Use it when the user refers to something decided before, or when you suspect this problem has been solved here already.",
       promptSnippet: "session_search: find earlier conversations in this workspace by phrase",
-      parameters: Type4.Object({
-        query: Type4.String({ description: "A phrase to look for, matched case-insensitively." }),
-        limit: Type4.Optional(Type4.Number({ description: "How many sessions to return, default 5." }))
+      parameters: Type5.Object({
+        query: Type5.String({ description: "A phrase to look for, matched case-insensitively." }),
+        limit: Type5.Optional(Type5.Number({ description: "How many sessions to return, default 5." }))
       }),
       execute: async (_id, params) => {
         const matches = await this.#search(params.query, params.limit ?? 5);
@@ -895,7 +1001,7 @@ class SessionToolPack2 {
       label: "Read session",
       description: "Read one earlier conversation, found with session_search, as plain text.",
       promptSnippet: "session_read: read one earlier conversation by id",
-      parameters: Type4.Object({ sessionId: Type4.String() }),
+      parameters: Type5.Object({ sessionId: Type5.String() }),
       execute: async (_id, params) => {
         const text = await this.#read(params.sessionId);
         return { content: [{ type: "text", text }], details: undefined, isError: text.startsWith("No session") };
@@ -928,7 +1034,7 @@ class SessionToolPack2 {
 
 // pkgs/@akanjs/devkit/codeAgent/tools/WebToolPack.ts
 import { codeAgentClip as codeAgentClip3, codeAgentOutputChars as codeAgentOutputChars3 } from "akanjs/common";
-import { Type as Type5 } from "typebox";
+import { Type as Type6 } from "typebox";
 
 class WebToolPack2 {
   #options;
@@ -993,7 +1099,7 @@ class WebToolPack2 {
       label: "Fetch",
       description: "Fetch a URL and return its readable text. HTML is stripped to text; the result is truncated.",
       promptSnippet: "web_fetch: fetch a URL and return its readable text",
-      parameters: Type5.Object({ url: Type5.String({ description: "Absolute http(s) URL." }) }),
+      parameters: Type6.Object({ url: Type6.String({ description: "Absolute http(s) URL." }) }),
       execute: async (_id, params) => {
         const refusal = WebToolPack2.#refuseHost(params.url, allowHosts);
         if (refusal)
@@ -1018,9 +1124,9 @@ ${codeAgentClip3(text, codeAgentOutputChars3)}` }
       label: "Search",
       description: `Search the web (${provider.name}) and return the top results as title, url and snippet.`,
       promptSnippet: "web_search: search the web and return titles, urls and snippets",
-      parameters: Type5.Object({
-        query: Type5.String(),
-        count: Type5.Optional(Type5.Number({ description: "How many results, default 5." }))
+      parameters: Type6.Object({
+        query: Type6.String(),
+        count: Type6.Optional(Type6.Number({ description: "How many results, default 5." }))
       }),
       execute: async (_id, params) => {
         const key = process.env[provider.envKey] ?? "";
@@ -1076,10 +1182,19 @@ class AkanCodePlugins2 {
     const sessionExtension = sessions.extension();
     const mail = new MailToolPack2({ profile: options.profile, mailbox: options.mailbox });
     const mailExtension = mail.extension();
+    const onAsk = options.onAsk;
+    const ask = onAsk ? new AskToolPack({ profile: options.profile, ask: onAsk }) : undefined;
+    const askExtension = ask?.extension();
     if (!options.profile.tools.akan)
       return {
-        extensions: [mcp?.extension(), webExtension, sessionExtension, mailExtension].filter((entry) => !!entry),
-        toolNames: [...mcp?.toolNames ?? [], ...web.names(), ...sessions.names(), ...mail.names()],
+        extensions: [mcp?.extension(), webExtension, sessionExtension, mailExtension, askExtension].filter((entry) => !!entry),
+        toolNames: [
+          ...mcp?.toolNames ?? [],
+          ...web.names(),
+          ...sessions.names(),
+          ...mail.names(),
+          ...ask?.names() ?? []
+        ],
         mcp: mcpStatus,
         dispose
       };
@@ -1114,6 +1229,8 @@ class AkanCodePlugins2 {
       extensions.push(sessionExtension);
     if (mailExtension)
       extensions.push(mailExtension);
+    if (askExtension)
+      extensions.push(askExtension);
     return {
       extensions,
       toolNames: [
@@ -1122,7 +1239,8 @@ class AkanCodePlugins2 {
         ...mcp?.toolNames ?? [],
         ...web.names(),
         ...sessions.names(),
-        ...mail.names()
+        ...mail.names(),
+        ...ask?.names() ?? []
       ],
       mcp: mcpStatus,
       dispose
@@ -1281,6 +1399,7 @@ var akanSystemPrompt2 = (profile) => {
     "- Prefer an akan workflow to a direct source edit. `list_workflows` / `explain_workflow` / `plan_workflow`, then `apply_workflow({ planPath })`. Editing source by hand is the fallback, not the default.",
     "- Read context with `inspect_akan_context` before reading source bodies; it answers most structural questions without spending the file.",
     "- Fetch the guideline for an area before a deep pass on it: `get_guideline`.",
+    "- A question about `akan code` itself \u2014 its slash commands, MCP servers, sessions, models, keys, or where its files live \u2014 is answered by the `akan-code` skill. Read it rather than describing the tool from memory.",
     "- Never hand-edit a generated file (`lib/cnst.ts`, `db.ts`, `st.ts`, any `*/index.ts` barrel). Fix the owning source and run `repair_generated` or `akan sync`."
   ];
   if (profile.tools.builtin.includes("write"))
@@ -1289,6 +1408,8 @@ var akanSystemPrompt2 = (profile) => {
     lines.push("- This session is read-only: there is no write, edit or bash tool. Report what should change instead of changing it.");
   if (profile.tools.subagent)
     lines.push('- Hand a self-contained search or read to `task` \u2014 `type: "explore"` reads and reports, `type: "code"` makes the change. Only its answer comes back, so give it everything it needs and ask for exactly what you want returned. Do it yourself when the reading is short or when you need the files in front of you.');
+  if (profile.ui.canPrompt)
+    lines.push("- Ask with `ask_user` when two readings of the request would lead to materially different work, and offer the options you can name. Do not ask for a choice that has an obvious default, and do not ask permission for work you were already asked to do \u2014 make the call, say the assumption, and carry on.");
   if (profile.approval !== "never")
     lines.push(`- Some tool calls need the user's approval (policy: ${profile.approval}). A refusal is an answer; do not retry it a different way.`);
   lines.push("- Secrets are refused at the tool boundary. If you need a value from `.env`, ask the user for it rather than looking for another way to read the file.", "", "## How to answer", "", "- Answer in as few words as carry the answer. A short question gets one sentence with no heading.", "- Do not open with what you are about to do, and do not close with a summary of what you did. The tool calls are already on the user's screen.", "- Skip headings, bold labels and bullet lists unless the answer is genuinely a list. Prose is shorter.", "- State a file as `path:line`. Do not paste a file back that the user can open.", "- Say what you could not do, and why, in one line. Do not offer alternatives nobody asked for.");
@@ -1403,8 +1524,12 @@ class AkanCodeServices2 {
   static #skillPaths(profile, workspaceRoot) {
     if (!profile.context.skills)
       return [];
-    const workspace = akanCodePaths2.skillsDir(workspaceRoot);
-    return [akanCodePaths2.builtinSkillsDir(), existsSync7(workspace) ? workspace : undefined].filter((dir) => !!dir);
+    const dirs = [
+      akanCodePaths2.builtinSkillsDir(),
+      akanCodePaths2.globalSkillsDir(),
+      akanCodePaths2.skillsDir(workspaceRoot)
+    ];
+    return dirs.filter((dir) => !!dir && existsSync7(dir));
   }
   static resourceOptions(options) {
     const present = (dir) => existsSync7(dir) ? [dir] : [];
@@ -2041,7 +2166,8 @@ class CodeAgent2 {
       currentSessionId: () => agent.sessionId,
       mailbox: () => agent.#mailbox,
       onNotice: (message) => agent.#emit({ type: "notice", level: "warning", message }),
-      onAgents: (agents) => agent.#emit({ type: "subagent", agents })
+      onAgents: (agents) => agent.#emit({ type: "subagent", agents }),
+      onAsk: (question) => agent.ask(question)
     });
     const resourceLoader = new DefaultResourceLoader({
       cwd,
@@ -2160,6 +2286,7 @@ ${mail.text}`).catch((error) => this.#emit({ type: "notice", level: "error", mes
       if (text)
         this.#emit({ type: "message", turnId, role: message.role, text });
     }
+    this.#emitContextNow();
   }
   static #textOf(content) {
     if (typeof content === "string")
@@ -2249,6 +2376,23 @@ Continue the task.`);
     session.setThinkingLevel(effort);
     this.#emit({ type: "session", info: this.info });
   }
+  catalogue() {
+    const runtime = this.#session?.modelRuntime;
+    if (!runtime)
+      return [];
+    const current = this.#session?.model;
+    return runtime.getProviders().map((provider) => ({
+      id: provider.id,
+      name: provider.name ?? provider.id,
+      authorized: runtime.hasConfiguredAuth(provider.id),
+      models: (runtime.getModels(provider.id) ?? []).map((model) => ({
+        id: model.id,
+        name: model.name,
+        ...model.contextWindow ? { contextWindow: model.contextWindow } : {},
+        current: model.provider === current?.provider && model.id === current?.id
+      }))
+    })).sort((a, b) => a.id.localeCompare(b.id));
+  }
   async setModel(ref) {
     const session = this.#require();
     const model = await akanCodeModel2(session.modelRuntime, ref);
@@ -2301,6 +2445,9 @@ Continue the task.`);
   #emitContextUsage(eventType) {
     if (eventType !== "agent_end" && eventType !== "compaction_end")
       return;
+    this.#emitContextNow();
+  }
+  #emitContextNow() {
     const usage = this.#session?.getContextUsage();
     if (usage?.tokens == null)
       return;
@@ -2376,29 +2523,28 @@ Continue the task.`);
     }
     return await this.#asks.openApproval(approvalId);
   }
+  async ask(spec) {
+    if (!this.#profile.ui.canPrompt)
+      return;
+    const question = { questionId: this.#asks.nextId("q"), ...spec };
+    this.#emit({ type: "question", question });
+    if (this.#profile.interaction.question === "suspend") {
+      this.#mapper.noteOutcome("awaiting");
+      return;
+    }
+    return await this.#asks.openQuestion(question) || undefined;
+  }
   #ui() {
     return new CodeAgentUi2({
-      ask: async (prompt, kind, choices) => {
-        if (!this.#profile.ui.canPrompt)
-          return;
-        const questionId = this.#asks.nextId("q");
-        const question = {
-          questionId,
-          prompt,
-          kind,
-          ...choices ? { options: choices.map((label) => ({ key: label, label })) } : {},
-          freeText: kind === "text"
-        };
-        this.#emit({ type: "question", question });
-        if (this.#profile.interaction.question === "suspend") {
-          this.#mapper.noteOutcome("awaiting");
-          return;
-        }
-        return await this.#asks.openQuestion(question) || undefined;
-      },
+      ask: async (prompt, kind, choices) => await this.ask({
+        prompt,
+        kind,
+        ...choices ? { options: choices.map((label) => ({ key: label, label })) } : {},
+        freeText: kind === "text"
+      }),
       notify: (level, message) => this.#emit({ type: "notice", level, message })
     });
   }
 }
 
-export { AkanEditScope2, DevLogFeedback2, PreviewChrome2, PreviewView2, PreviewFeedback2, TurnFeedback2, AkanCli2, AkanVerifier2, VerifyFeedback2, AkanToolPack2, MailToolPack2, McpClient2, McpToolPack2, SessionToolPack2, WebToolPack2, AkanCodePlugins2, AkanEnvKeys2, akanSystemPrompt2, CodeSessionIndex2, AkanCodeServices2, CodeAgentAsks2, CodeAgentEventMapper2, CodeAgentGate2, CodeAgentUi2, CodeMailbox2, CodeSessionFork2, CodeAgent2 };
+export { AkanEditScope2, DevLogFeedback2, PreviewChrome2, PreviewView2, PreviewFeedback2, TurnFeedback2, AkanCli2, AkanVerifier2, VerifyFeedback2, AkanToolPack2, MailToolPack2, McpUnauthorized2, McpClient2, McpToolPack2, SessionToolPack2, WebToolPack2, AkanCodePlugins2, AkanEnvKeys2, akanSystemPrompt2, CodeSessionIndex2, AkanCodeServices2, CodeAgentAsks2, CodeAgentEventMapper2, CodeAgentGate2, CodeAgentUi2, CodeMailbox2, CodeSessionFork2, CodeAgent2 };

package/{index-kvzjda3v.js → index-m41ptvat.js}

@@ -2,7 +2,7 @@
 import {
   runner,
   script
-} from "./index-6na0sd2b.js";
+} from "./index-ycy302an.js";
 import {
   AGENT_BLOCK_START,
   AGENT_BLOCK_END,
@@ -13,17 +13,17 @@ import {
   CLAUDE_COMMENT_RULE,
   AppExecutor,
   LibExecutor
-} from "./index-p4p9t45x.js";
+} from "./index-bwxpk2cj.js";
 import {
   collectRecipeSources2,
   scanRecipes2
 } from "./index-by5gpp8x.js";
 import {
   AkanContextAnalyzer
-} from "./index-v17gj504.js";
+} from "./index-rpgxs245.js";
 import {
   Prompter2
-} from "./index-twq9p2sp.js";
+} from "./index-s5rhm04y.js";
 
 // pkgs/@akanjs/cli/agent/agent.script.ts
 import { Logger as Logger2 } from "akanjs/common";
@@ -148,7 +148,7 @@ If generated output is stale or broken, update the owning source file and run \`
 ${recipeIndex}## MCP Workflow Policy
 
 - **Prefer an Akan workflow to a direct source edit.** A direct edit is denied when an allowlisted workflow or repair tool can make the change.
-- Inspect with \`akan mcp --mode plan\` (\`list_workflows\`, \`explain_workflow\`, \`plan_workflow\`); apply with \`akan mcp --mode apply\`, which allowlists \`apply_workflow\`, \`run_validation\`, and the repair tools.
+- Inspect with \`akan mcp --mode plan\` (\`list_workflows\`, \`explain_workflow\`, \`plan_workflow\`); apply with \`akan mcp --mode apply\`, which allowlists \`apply_workflow\`, \`run_validation\`, and three of the five repair tools \u2014 \`repair_generated\`, \`repair_imports\` and \`repair_module_shape\`. \`akan repair format\` and \`akan repair dictionary\` are CLI-only.
 - If \`plan_workflow\` returns \`planPath\` or \`next.tool=apply_workflow\`, call \`apply_workflow({ planPath })\` before editing source. Then run \`run_validation\` with \`validationTarget\` when present, otherwise \`applyReportPath\`.
 - Split a compound request into workflows and apply each \`planPath\` in order, such as \`create-module\` followed by \`add-field\`.
 - When no workflow exists, or apply reports unsupported/no-op/failed diagnostics needing manual action, keep edits scoped to owning source files and never patch generated files directly.

package/{index-qh7brn20.js → index-mt2154s2.js}

@@ -2,7 +2,7 @@
 import {
   runner,
   script
-} from "./index-6na0sd2b.js";
+} from "./index-ycy302an.js";
 
 // pkgs/@akanjs/cli/page/page.runner.ts
 class PageRunner extends runner("page") {
@@ -10,7 +10,11 @@ class PageRunner extends runner("page") {
     await app.applyTemplate({
       basePath: basePath ?? `page/(${app.name})/(public)/${module.name}`,
       template: single ? "crudSinglePage" : "crudPages",
-      dict: { model: module.name, appName: module.sys.name }
+      dict: {
+        model: module.name,
+        appName: module.sys.name,
+        clientPath: `@${module.sys.type}s/${module.sys.name}/client`
+      }
     });
   }
 }

package/{index-xjc7gg65.js → index-pn8mhpps.js}

@@ -2,10 +2,10 @@
 import {
   runner,
   script
-} from "./index-6na0sd2b.js";
+} from "./index-ycy302an.js";
 import {
   ModuleExecutor
-} from "./index-p4p9t45x.js";
+} from "./index-bwxpk2cj.js";
 import {
   sourceFile,
   moduleSourcePaths,
@@ -13,10 +13,10 @@ import {
   createPassedPrimitiveReport,
   bilingualLabelForField,
   bilingualDescriptionForField
-} from "./index-qhtj9y6j.js";
+} from "./index-yw6g3bbv.js";
 import {
   PageScript
-} from "./index-qh7brn20.js";
+} from "./index-mt2154s2.js";
 import {
   pluralizeName
 } from "./index-nz8prx9g.js";
@@ -31,37 +31,17 @@ var purposeByModule = {
   project: "Project represents a project workspace or business initiative managed by the app.",
   task: "Task represents work items that move through the app workflow."
 };
-var moduleAbstractContent = (moduleName) => {
+var moduleAbstractContent = (moduleName, sharedGuards) => {
   const title = capitalize(moduleName);
-  const label = bilingualLabelForField(moduleName);
-  const purpose = purposeByModule[moduleName] ?? `${title} represents ${label.en.toLowerCase()} records managed by the app.`;
-  return `# ${title} Module Abstract
-
-## Purpose
-
+  const noun = bilingualLabelForField(moduleName).en.toLowerCase();
+  const purpose = purposeByModule[moduleName] ?? `${title} represents ${noun} records managed by the app.`;
+  const writeRule = sharedGuards ? `Anyone may read a ${noun}; only an admin creates, updates or removes one.` : `Anyone may read a ${noun}; nobody creates, updates or removes one until the slice names a guard.`;
+  return `# ${moduleName} Abstract
 ${purpose}
 
-## Domain Rules
-
-- Keep ${label.en.toLowerCase()} data consistent with user-facing dictionary labels.
-
-## Data Meaning
-
-${label.en} (${label.ko}) is the primary business concept for this module.
-
-## Workflows
-
-No lifecycle workflow yet.
-
-## Agent Notes
-
-- Read this abstract before changing the module.
-- Update this file when business invariants, workflows, or public behavior change.
-- Do not update this file for formatting-only, import-only, or style-only changes.
-
-## Related Modules
-
-- None yet.
+## Rules
+- ${writeRule}
+- Removal is soft: a removed ${noun} keeps its row with \`removedAt\` set.
 `;
 };
 var localModuleFilename = (moduleName, pathKey) => moduleSourcePaths(moduleName)[pathKey].replace(`lib/${moduleName}/`, "");
@@ -92,6 +72,14 @@ class ModuleRunner extends runner("module") {
   async removeModule(module) {
     await module.sys.removeDir(`lib/${module.name}`);
   }
+  async#hasSharedGuards(module) {
+    const { sys } = module;
+    if (sys.type === "lib" && sys.name === "shared")
+      return true;
+    if (!await sys.exists("lib/srv.ts"))
+      return false;
+    return (await sys.readFile("lib/srv.ts")).includes('"@libs/shared/lib/srv"');
+  }
   async createComponentTemplate(module, type) {
     await module.sys.applyTemplate({
       basePath: `./lib/${module.name}`,
@@ -122,9 +110,11 @@ class ModuleRunner extends runner("module") {
       zone: localModuleFilename(module.name, "zone"),
       util: localModuleFilename(module.name, "util")
     };
+    const sharedGuards = await this.#hasSharedGuards(module);
     await module.applyTemplate({
       basePath: `.`,
       template: "module",
+      options: { sharedGuards },
       dict: {
         model: module.name,
         models: names,
@@ -136,7 +126,7 @@ class ModuleRunner extends runner("module") {
         modelDescKo: modelDescription.ko
       }
     });
-    await module.writeFile(filenames.abstract, moduleAbstractContent(module.name));
+    await module.writeFile(filenames.abstract, moduleAbstractContent(module.name, sharedGuards));
     const [
       abstractContent,
       constantContent,

package/{index-vpx68e4x.js → index-q9c3c0hy.js}

@@ -2,12 +2,12 @@
 import {
   runner,
   script
-} from "./index-6na0sd2b.js";
+} from "./index-ycy302an.js";
 import {
   generatedFilesForSync,
   createPassedPrimitiveReport,
   scalarChangedFiles
-} from "./index-qhtj9y6j.js";
+} from "./index-yw6g3bbv.js";
 import {
   pluralizeName
 } from "./index-nz8prx9g.js";