@akanjs/cli 3.0.0-beta.18 → 3.0.0-beta.19

package/{dependencyScanner-shs82ynp.js → dependencyScanner-0z2h2tks.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   TypeScriptDependencyScanner2
-} from "./index-kcxmv48c.js";
+} from "./index-bhtmj233.js";
 import"./index-q0y2jq9j.js";
 export {
   TypeScriptDependencyScanner2 as TypeScriptDependencyScanner

package/{guideline.command-3w2g20x4.js → guideline.command-vhw13pqr.js}

@@ -2,9 +2,9 @@
 import {
   script,
   command
-} from "./index-ycy302an.js";
+} from "./index-qdgzsnhg.js";
 import"./index-q0y2jq9j.js";
-import"./index-bwxpk2cj.js";
+import"./index-crmeqnmf.js";
 import"./index-6wwzs1bc.js";
 import {
   Prompter2

package/guidelines/agentRule/agentRule.instruction.md

@@ -96,15 +96,21 @@ apps and libs never import it directly (`no-import-external-library`) — everyt
   nothing about, and it stays text-only until `option.setLlm({ accepts })` says otherwise — handing bytes to a
   model that cannot decode them kills the whole turn on a 400, where text-only degrades them to a note the model
   can repeat back.
-- **A refusal is one key, `agent.error.llmRequestFailed`, and it names the host.** The provider's own sentence
-  rides in `reason` and the hostname in `provider`, so an adaptor an app wrote reports through the same
-  translated channel the shipped ones do rather than needing a key in the framework's dictionary it cannot
-  add.
+- **A refusal is `agent.error.llmRequestFailed`, and it names the host** — unless the prompt did not fit. The
+  provider's own sentence rides in `reason` and the hostname in `provider`. `LlmOverflow.refusal(host, status,
+  reason)` builds it, and reads the one refusal a chat can undo — a prompt past the window, recognized from each
+  provider's own sentence — as `agent.error.contextOverflow` with the `limit` it named, which the relay flags so
+  the chat compacts and asks again. An adaptor an app wrote throws through the same function, so its refusals
+  translate and recover the way the shipped ones do without a key in the framework's dictionary it cannot add.
 - **`accepts` is answered per model, through `option.setLlm({ accepts })`.** An adaptor answers for an API and one
   API serves models that differ, so the override rides beside the `model` it is a fact about. It is not a table
   the framework keeps: a table is a claim about models that ship after it, and getting this wrong is the worst
   failure available — a provider handed bytes it cannot decode either refuses the turn or accepts it having seen
   nothing, and the model then answers confidently about a file it never read.
+- **`contextWindow` is declared the same way: `option.setLlm({ contextWindow })`.** Every turn relays it with the
+  answer ceiling the adaptor actually sends (`LlmAdaptor.limits` — `AnthropicLlm` always sends one, `OpenaiLlm`
+  none), and the chat guards its window with it. It is not a table either; a model id is retired or renamed long
+  before a table notices.
 - **An adaptor answers `null` for "not configured" and *throws* for a refusal it can explain.** The two are
   different things to be told: collapsing both into `null`, the way the adapter convention otherwise reads, left a
   user reading `llmUnavailable` — "no model is configured" — about a conversation that had merely outgrown the
@@ -539,18 +545,29 @@ apps and libs never import it directly (`no-import-external-library`) — everyt
 - **A long conversation summarizes itself, because nothing else is keeping it inside the model's window.** The
   loop runs in the browser and the relay holds no session, so an uncompacted chat grows until the provider
   refuses the whole request — a refusal, never a shorter answer, which is why compaction runs *before* the turn
-  that would have overflowed rather than as a recovery after it. Past `compact.at` estimated tokens (four
-  characters to a token, over the JSON the turn posts; 24k by default, well under the smallest window a provider
-  is likely to have, since the tools and the screen context ride on top of it and neither compacts) the history above the last `keep` messages
-  becomes one message standing in for it, flagged `summary` on the wire — `<Agent.Chat compact={{ at, keep }} />`
-  tunes it per provider and `{ at: 0 }` turns it off, and `/compact` does the same on demand keeping nothing.
+  that would have overflowed. **Two triggers, each before every assistant turn.** `compact.at` is a ceiling on
+  cost: past that many estimated transcript tokens (four characters to a token, over the JSON the turn posts —
+  except an inlined picture, counted at the ~1,600 tokens a provider bills for its pixels rather than its base64;
+  24k by default) the history compacts, because the relay resends the whole transcript every turn and the app
+  pays for each one. The **window guard** compacts once the prompt nears the window the server reports —
+  `window − answer ceiling (8,192 when unreported) − compact.buffer (13,000, the margin Claude Code leaves)` —
+  measured by the provider's own count of the last turn (`done.usage`, kept on that assistant message) plus the
+  four-character estimate for what arrived since, so a Korean transcript the character rule reads as small is
+  still caught. The window comes from `option.setLlm({ contextWindow })` or from the first refusal that names it;
+  with neither, only the ceiling runs. **A refusal for length is answered once**: a relay flags it `overflow` on
+  the wire, and the session compacts and sends the same turn again, and a second refusal in the same send fails
+  with `agent.error.contextOverflow`. Either way the history above the last `keep` messages
+  becomes one message standing in for it, flagged `summary` on the wire — `<Agent.Chat compact={{ at, keep, buffer }} />`
+  tunes it, `{ at: Infinity }` leaves only the window guard, `{ at: 0 }` turns off the ceiling, the guard and the recovery alike, and `/compact` does
+  the same on demand keeping nothing. The header draws the estimate against whichever trigger is nearer.
   **The cut never lands on a `tool` message**: the kept half may not open with a result whose call was summarized
   away, a shape every provider dialect rejects. A user message is preferred where the tail holds one — everything
   above it is settled — but one assistant turn that ran ten tools has none, and that is the transcript that
   outgrows the window, so a cut there opens on the assistant message instead. The summarizing
   turn carries no tools and no screen context — it summarizes the conversation, it does not act on it — and it is
   fed a *bounded* digest rather than the transcript itself, since the transcript being summarized is the one that
-  no longer fits. A summary that cannot be produced leaves the transcript alone, the turn goes out as it would
+  no longer fits. The previous summary is the exception: it rides the digest whole, under its own label and outside
+  the bound, because it is the only record of what was compacted before it. A summary that cannot be produced leaves the transcript alone, the turn goes out as it would
   have, and the next one asks again — a summarizer that was momentarily unreachable says nothing about whether
   this transcript can shrink. One that *landed* and shrank nothing does, so that one is not retried until another
   threshold's worth has been added. On the

package/guidelines/conventions/conventions.instruction.md

@@ -28,7 +28,7 @@ you fetch on demand — `get_guideline` with the name, or `akan guideline show <
 | name | covers |
 |---|---|
 | `ssrRule` | server-share targets, the `akan.ssr.*` warnings, the client-boundary playbook |
-| `runtimeRule` | `web` / `csr` surfaces, gateway vs solo processes, logging, the generated image, shipped assets |
+| `runtimeRule` | `web` / `csr` surfaces, gateway vs solo processes, logging, the generated image, shipped assets, database modes |
 | `queryRule` | slices and hydration, the generated filter methods, full-text search, cascade removal |
 | `transportRule` | guards across HTTP and websocket, socket identity and cleanup, binary pubsub, mutation verbs |
 | `mcpRule` | MCP configuration, wire behaviour, resource URIs, OAuth metadata, protocol revisions |
@@ -337,6 +337,14 @@ Full contract: `get_guideline` with `runtimeRule`, or `akan guideline show runti
 - **`assets: { pruneFonts, keepFonts }`** trims from the `dist` copy of `public/` the fonts nothing reads; source
   trees are never touched. A font with `optimize` on is a build input, not a runtime asset. `keepFonts` belongs to
   the `akan.config.ts` that owns the font, written against that scope's own `public/`.
+- **Database modes are `database: { modes: [...] }`** — `single` (SQLite + Solid), `multiple` (one SQLite file on
+  a host volume + Redis), `cluster` (Postgres + Redis). The build carries the drivers of every declared mode and a
+  deployment picks one with `AKAN_DATABASE_MODE` — a declared one, named whenever the build declares several.
+  Where the data lives (`POSTGRES_URL`, `REDIS_URI`, `SQLITE_DATABASE_PATH`) is the deployment's env, ahead of
+  `env.server.ts`. `q.raw` is written in the dialect's own SQL, so an app running in two modes avoids it.
+- **Backups run through the image's own `main.js`**: `bun main.js ops snapshot` / `ops restore` (offline), and
+  `/_akan/ops/*` for a control plane, mounted only when `AKAN_OPS_PUBLIC_KEY` is set and authenticated by a short
+  EdDSA token that key verifies. `GET /_akan/app/info` is public. `operationMode` gates none of it.
 
 ## React Components And Styling (`**/*.tsx`)
 
@@ -359,7 +367,7 @@ Full contract: `get_guideline` with `runtimeRule`, or `akan guideline show runti
   nothing — they covered five control types, keyed on the translated label, and restored over server data.
 - Static class strings stay plain strings. Reach for `cn` only for a conditional or to merge an incoming `className`, and merge the caller last: `cn("base classes", cond && "extra", className)`. `cn` comes from `akanjs/client` (token-aware tailwind-merge) and is the only class-combining function — no `clsx` (removed), no raw `twMerge` imports, no object syntax (`{ x: cond }` → `cond && "x"`).
 - Multi-slot components take extra named props (`wrapperClassName`, `bodyClassName`), never a `classNames` object.
-- Hoist enum→class lookups to a module-scope `as const` map typed `{ [key in cnst.XStatus["value"]]: string }`. Do not use `Record<...>`. Escalate the map to `webkit/` when a second module needs it.
+- Hoist enum→class lookups to a module-scope `as const` map typed `{ [key in cnst.XStatus["value"]]: string }`. Do not use `Record<...>`. When a second module needs it, the classes become a variant axis of a recipe in `ui/Recipe/`; only a map from the enum to another recipe's variant name (`BadgeVariants["variant"]`) moves to `webkit/`.
 - Use `<Link>` from `akanjs/ui` for internal navigation; `<a>` only for `mailto:` and external links.
 
 ## Naming And Language
@@ -793,7 +801,8 @@ Full contract — the trigger-maintained mirror, tokenizer changes, `AKAN_SEARCH
   backstop, including for a `text` field *underneath* one of those. Do not work around either.
 - The role works on a relation (`image: field(File, { text: "thumb" })`) and on an array; an array of objects
   indexes by leaf key. A field inside a `Map` indexes nothing — there is no fixed path to extract it from.
-- Search runs on sqlite/libsql only. `q.search()` against Postgres throws, loudly, rather than returning every row.
+- Search runs in every database mode — fts5 on SQLite/libSQL, a weighted `tsvector` (`pg_trgm` for `trigram`) on
+  Postgres. The same text matches the same documents; only the order may differ on Postgres.
 
 ### Image & File Fields
 
@@ -918,10 +927,13 @@ export default page()
 | `common/` | pure, isomorphic, zero-dependency; may import only sibling `common/*` and `akanjs/base`. Cannot import `Err`, so keep throwing code out of it. | camelCase file, filename equals the single export |
 | `webkit/` | touches `window` / `navigator` / Capacitor, or is a React hook | `use<Thing>.tsx` — `.tsx` even with no JSX |
 | `srvkit/` | touches `node:*`, `Bun`, `process.env`, a secret, or a server SDK | camelCase file, PascalCase class |
-| `ui/` | renders JSX and is not bound to one model | PascalCase component, camelCase sidecar (`swipeCard.util.ts`) |
+| `ui/` | renders JSX, or defines a look (a recipe in `Recipe/`, a lib's `tokens.css`), and is not bound to one model | PascalCase component, camelCase sidecar (`swipeCard.util.ts`), `Recipe/<name>.ts` |
 | `plugin/` | build- or CLI-time `AkanPlugin` | `<name>.plugin.ts`, registered in `akan.config.ts` |
 
 - Hooks return a named object of async closures, never a tuple.
+- `ui/` is the presentation layer — markup and the looks it is built from — so a recipe lives there although it is
+  neither a component nor a hook. Not `webkit/`: its hooks are `"use client"`, the opposite signal for a function
+  server components call. Not `common/`: it cannot import `akanjs/ui`, where `recipe` / `tv` come from.
 - `libs/<lib>/ui/tokens.css` is the one CSS file a lib owns: plain `:root` custom properties for colors that must **not** follow the theme (a vendor brand color, a fixed surface). Every app whose pages reach that lib compiles it automatically, ahead of the app's own stylesheets, so nothing is imported by hand and no app can forget it. Reference them as `bg-[var(--kakao)]`; `@theme` extensions stay in the app stylesheet, because the color vocabulary is closed per stylesheet. Theme-following colors are the app's, not the lib's.
 - A layer-root `index.ts` is generated, but a `ui/<Folder>/index.tsx` that builds a namespace is hand-written source. The distinguishing test is that a generated barrel contains nothing but `export * from "./X";` lines.
 - `ui/<Folder>/index_.tsx` (trailing underscore) is the `"use client"` + `lazy()` boundary, with a server-safe `index.tsx` beside it. Collapsing the pair into one file breaks RSC.

package/guidelines/queryRule/queryRule.instruction.md

@@ -90,14 +90,15 @@ with it. `conventions` carries the invariants — this is the full contract behi
 - **A slice endpoint never reaches "unspecified".** The resolver fills `latest` before the query is built, so a
   client asking for the score order has to name `relevance`; leaving `sort` off gets `latest`, not relevance.
 - Scope a search with `columns` (`q.search(text, { columns: ["title"] })`) and re-weight with `weights`, a tuple of
-  finite numbers positional over `["title", "desc", "tag", "filter"]`.
+  finite, non-negative numbers positional over `["title", "desc", "tag", "filter"]` — Postgres ranks by weight
+  class and has no reading for a negative one.
 
 
 ## Text Search Fields — the `text` role
 
 - A field joins the full-text index by declaring one of five roles: `field(String, { text: "title" })`, and likewise
   `"desc"`, `"tag"`, `"thumb"`, `"filter"`. Nothing else opts a field in, and there is no per-model switch.
-- Pick the role by what the value *is*, because `bm25` weights them positionally (`title` 10, `tag` 3, `desc` 1,
+- Pick the role by what the value *is*, because the rank weights them positionally (`title` 10, `tag` 3, `desc` 1,
   `filter` 0): `title` is the one line a human scans for, `desc` is prose, `tag` is a keyword list, `filter` is a
   scoping value (status, owner, role) that must be matchable but must never outrank a real title hit.
 - `thumb` is mirrored for rendering a hit and is **not** indexed — never expect it to match.
@@ -114,15 +115,24 @@ with it. `conventions` carries the invariants — this is the full contract behi
 - Declaring roles is all the wiring there is. Mirror rows are maintained by SQL triggers — not document hooks —
   because `updateOneByQuery` and friends fire no hooks, and most searchable-field mutations go through exactly that
   path.
-- Search runs on sqlite/libsql only. `q.search()` against Postgres throws, loudly, rather than returning every row.
+- Search runs in every database mode: fts5 on SQLite/libSQL, a weighted `tsvector` under a GIN index on Postgres.
+  For the same text the same documents match — punctuation splits words the way unicode61 does, and a phrase never
+  runs from one column into the next — but the order may differ, since Postgres ranks without document frequency.
+  Assert on the match set, never on a Postgres order the weights alone do not decide.
+- Postgres reads `AKAN_SEARCH_TOKENIZER` as `unicode61 [remove_diacritics 0|1|2]` (`simple`, with `unaccent` unless
+  `0`) or `trigram [case_sensitive 0|1]` (`pg_trgm`); any other spelling is refused. The extension is created when
+  the role may, otherwise a role that may runs `CREATE EXTENSION`. It indexes the first 20,000 characters of
+  `title`, `tag` and `filter` and 200,000 of `desc` — a tsvector refuses more than 1MB, and the refusal would fail
+  the model write. A database whose `LC_CTYPE` is `C` keeps non-ASCII case apart; use a UTF-8 ctype.
 - `AKAN_SEARCH_ENABLED=0` switches the index off process-wide; unset means on. It never deletes mirror data, and
   re-enabling reconciles every ref. **Give every process the same value** — a process cannot drop triggers for models
   it does not mount, so a mixed fleet leaves stale triggers behind.
 - The tokenizer is `AKAN_SEARCH_TOKENIZER` (or `database.search.tokenizer`, which wins), defaulting to
   `unicode61 remove_diacritics 2`. Changing it rebuilds the index from the mirror on the next boot — the model
-  tables are never re-read — so it is a safe knob, unlike a `text` role change, which re-reads every row. The
-  rebuild takes no cross-process claim, so a fleet restarted at once repeats it in every process; stagger the
-  restart when the mirror is large.
+  tables are never re-read — so it is a safe knob, unlike a `text` role change, which re-reads every row. The schema
+  is ensured in one write turn — a SQLite write transaction, a Postgres schema lock — so of a fleet restarted at
+  once the first rebuilds and the rest find it current. A SQLite process waits for that turn up to its
+  `busy_timeout`, so stagger the restart when the mirror is large.
 
 ## Cascade Remove — the `cascade` option
 

package/guidelines/runtimeRule/runtimeRule.instruction.md

@@ -184,6 +184,80 @@ const config: AppConfig = { docker: "FROM oven/bun:1-slim\n…" }; // verbatim,
 - `AkanAppConfig.docker` is the resolved declaration; `AkanAppConfig.dockerfile` is the text `akan build` writes
   to `dist/apps/<app>/Dockerfile`.
 
+## Database Modes — `database` In `akan.config.ts`
+
+| mode | database | cache · queue · pubsub | runs as |
+|---|---|---|---|
+| `single` | SQLite file | SQLite files (Solid) | one container |
+| `multiple` | one SQLite file (WAL) on a host volume every container on that host opens | Redis | containers on one host |
+| `cluster` | Postgres | Redis | pods on several servers |
+
+- **`database: { modes: ["single", "cluster"] }` is what the build can run in**; the first is what `akan start`
+  runs. `akan build` carries the drivers of every declared mode (`multiple` → `bullmq`, `ioredis`; `cluster` adds
+  `postgres`).
+- **A deployment names its mode with `AKAN_DATABASE_MODE`**, and only a declared one. With one declared mode it may
+  leave it out; with several it must name one — the fallback would be a SQLite file inside each pod. `akan start`,
+  `build`, `script` and `console` resolve it the same way from the shell. One image can serve an edge site in
+  `single` and a cloud cluster in `cluster`: declare both.
+- **Where the data lives is the deployment's env, ahead of `env.server.ts`**: `SQLITE_DATABASE_PATH`,
+  `AKAN_SOLID_DB_PATH`, `POSTGRES_URL` (or `POSTGRES_HOST`/`PORT`/`DATABASE`/`USER`/`PASSWORD`),
+  `POSTGRES_INSIGHT_URL`, `LIBSQL_URL`. `REDIS_URI` is required outside local development. Pool size, SSL and
+  prepared statements ride the Postgres URL (`?max=20&ssl=require`, `prepare=false` behind PgBouncer).
+- **Uploads**: a deployed `multiple`/`cluster` app uses object storage, or a volume every instance mounts with
+  `AKAN_STORAGE_SHARED=true`.
+- **`runAdminSql` on Postgres reads as its own login role** holding base-column `SELECT` and nothing else:
+  `CREATE ROLE <name> LOGIN PASSWORD '…'` with no other role granted, `POSTGRES_INSIGHT_URL` logging in as it, and
+  `GRANT USAGE ON SCHEMA` from the DBA when the app does not own its schema. Every model table grants the role its
+  base columns at boot. Without it the console refuses on Postgres; `_doc` is never readable either way.
+- **`akan dbup`** starts what the workspace's apps declare (`--mode multiple` is Redis, `cluster` adds Postgres).
+  **`akan db-export <app>` / `akan db-import <app>`** move every model table as stored rows through NDJSON files
+  (`--dir`, default `local/transfer`) between whatever the shell's `AKAN_DATABASE_MODE` points at; a rerun
+  replaces rows, search is rebuilt after, and sessions, queued jobs and uploaded files do not move.
+- **`q.raw(sql)` is the dialect's own SQL** — `json_extract("_doc", '$.f')` on SQLite, `("_doc" #>> '{f}')` on
+  Postgres. An app that runs in both modes avoids it.
+
+## Operations — Snapshots, Restore And The `/_akan/ops` Channel
+
+`GET /_akan/app/info` answers `{ appName, repoName, environment, operationMode }` on every deployment — the same
+`AKAN_PUBLIC_*` values the client bundle already carries — so a control plane can check which app a host is
+serving without a key. Everything else is behind the ops channel.
+
+| surface | what it does |
+|---|---|
+| `bun main.js ops snapshot [--id] [--out] [--include-solid] [--json]` | `VACUUM INTO` a consistent copy, `integrity_check`, sha256, gzip, optional age encryption, `manifest.json` |
+| `bun main.js ops restore <manifest.json> [--identity <file>]` | offline only: verify, stage, keep the old file as `<db>.pre-restore-<ts>` (its `-wal`/`-shm` beside it), swap |
+| `GET /_akan/ops/info` | the public info plus `akanVersion`, `buildId`, `serverMode`, `databaseMode`, `solo`, `startedAt`, `replicaIdx` |
+| `POST /_akan/ops/snapshot` `{ id, includeSolid?, uploadUrls: { main, solid?, manifest } }` | 202; a child process snapshots, then PUTs each file and the manifest **last** |
+| `GET /_akan/ops/snapshot/:id` | `running` → `uploading` → `done` \| `failed`; kept in memory, so a restart answers 404 |
+
+- **The entry is the image's own `main.js`** — a production image carries no `akan` CLI. `AkanApp.start()` hands
+  `argv[2] === "ops"` to the command before it boots anything. It reads the container's env — the `AKAN_PUBLIC_*`
+  identity and the database paths — so run it with that env (`docker compose exec`), never a bare shell's.
+- **Restore refuses while an app answers `/_akan/app/health` on `PORT`** and names it by its `/_akan/app/info`;
+  `--force` is for a port some other app holds.
+- **The channel exists only when `AKAN_OPS_PUBLIC_KEY` is set** (Ed25519: PEM, JWK, base64 SPKI or raw 32 bytes).
+  The control plane signs a short EdDSA JWS — `aud`, `iat`, `exp` at most 300s after `iat`, a `jti` the process
+  refuses twice — and the host holds only the public half, so a machine someone carries off mints nothing.
+  `aud` is `<appName>/<environment>`, or `<appName>/<environment>/<AKAN_OPS_INSTANCE>` when that is set, and then
+  only that: a token minted for the app as a whole would replay across every host sharing the name. 30 calls a
+  minute per process; every refusal is the same 401. A malformed key leaves the app serving with the channel off.
+- **The app holds no storage credential.** It PUTs to the presigned URLs it was handed (`application/octet-stream`,
+  the manifest `application/json`), plain http only to loopback. The manifest landing is the commit marker.
+- **Snapshots cover the SQLite modes only.** `single` copies the main file and, with `includeSolid`, the Solid file;
+  `multiple` copies the main file; `cluster` is refused. Paths follow the adaptors' env precedence
+  (`SQLITE_DATABASE_PATH`, `AKAN_SOLID_DB_PATH`, `AKAN_SQLITE_DIR`); a solo process uses the path its adaptor
+  actually opened, so a gateway deployment that moved the file in `env.server.ts` names it in the env too.
+- **`AKAN_BACKUP_RECIPIENT=age1…[,age1…]` encrypts before upload** — age v1 X25519, so `age -d -i key.txt` opens
+  it. Restore takes `--identity` / `AKAN_BACKUP_IDENTITY_FILE`, or a file an operator already decrypted with
+  `age -d -o <name without .age>`.
+- **The host keeps the newest `AKAN_OPS_SNAPSHOT_KEEP` (default 2) snapshots** under `AKAN_OPS_SNAPSHOT_DIR`
+  (default `<db dir>/snapshots/<id>/`) — the copy an edge still has while its uplink or the bucket is down.
+- **`buildId` is `AKAN_BUILD_ID` when the deployment sets it**, else the git sha `akan build` wrote into
+  `akan.build.json` beside `main.js` (`-dirty` when the tree was).
+- **`operationMode` does not gate any of this** — the key does. `edge` means a production host outside the
+  cluster: the console refuses it like `cloud`, and `init` / `interval` / `cron` take `operationMode: ["edge"]` to
+  run only there. Everything else behaves as `cloud`; `local` is a developer machine.
+
 ## Shipped Assets — `assets` In `akan.config.ts`
 
 `akan build` copies the whole `public/` tree into `dist`, lib assets dereferenced, and that copy is the image.

package/incrementalBuilder.proc.js

@@ -3,7 +3,7 @@ import {
   CodegenLock,
   WorkspaceExecutor,
   AppExecutor
-} from "./index-bwxpk2cj.js";
+} from "./index-crmeqnmf.js";
 import"./index-q0y2jq9j.js";
 import"./index-6wwzs1bc.js";
 import {
@@ -12,7 +12,7 @@ import {
   AutoImportSync,
   DevChangePlanner,
   DevGeneratedIndexSync
-} from "./index-w8kmx1b6.js";
+} from "./index-89hy31kf.js";
 import {
   HmrWatcher,
   WatchRootResolver
@@ -173,6 +173,7 @@ class IncrementalBuilder {
         app: this.#app,
         routeId: msg.routeId,
         seeds: msg.seeds,
+        graphSeeds: msg.graphSeeds,
         artifact: this.#artifact,
         knownEntries: new Set(msg.knownEntries),
         discovery: this.#discovery

package/{index-dw943k93.js → index-10dkrrww.js}

@@ -1,16 +1,16 @@
 // @bun
 import {
   jsonText
-} from "./index-yw6g3bbv.js";
+} from "./index-2446k7b4.js";
 import {
   akanMcpInstallTargets
-} from "./index-rpgxs245.js";
+} from "./index-18zybgkc.js";
 import {
   script
-} from "./index-ycy302an.js";
+} from "./index-qdgzsnhg.js";
 import {
   ContextRunner2
-} from "./index-cjw1sj1x.js";
+} from "./index-3jrp517k.js";
 
 // pkgs/@akanjs/cli/context/context.script.ts
 import { Logger } from "akanjs/common";

package/{index-rpgxs245.js → index-18zybgkc.js}

@@ -7,7 +7,7 @@ import {
   isScannedRootEntry,
   AppExecutor,
   LibExecutor
-} from "./index-bwxpk2cj.js";
+} from "./index-crmeqnmf.js";
 import {
   FileSys
 } from "./index-q0y2jq9j.js";
@@ -19,7 +19,7 @@ import {
 import {
   workflowRunArtifactPath,
   workflowSyncDir
-} from "./index-yw6g3bbv.js";
+} from "./index-2446k7b4.js";
 
 // pkgs/@akanjs/devkit/akanContext.ts
 import { readdir } from "fs/promises";

package/{index-mt2154s2.js → index-22xtgmhn.js}

@@ -2,7 +2,7 @@
 import {
   runner,
   script
-} from "./index-ycy302an.js";
+} from "./index-qdgzsnhg.js";
 
 // pkgs/@akanjs/cli/page/page.runner.ts
 class PageRunner extends runner("page") {

package/{index-yw6g3bbv.js → index-2446k7b4.js}

@@ -2,7 +2,7 @@
 import {
   AppExecutor,
   LibExecutor
-} from "./index-bwxpk2cj.js";
+} from "./index-crmeqnmf.js";
 
 // pkgs/@akanjs/devkit/workflow/utils.ts
 var jsonText = (value, { trailingNewline = true } = {}) => `${JSON.stringify(value, null, 2)}${trailingNewline ? `

package/{index-cjw1sj1x.js → index-3jrp517k.js}

@@ -1,14 +1,14 @@
 // @bun
 import {
   AppExecutor
-} from "./index-bwxpk2cj.js";
+} from "./index-crmeqnmf.js";
 import {
   jsonText,
   createWorkflowBaselineSummary,
   buildAkanModuleContextIndex,
   createWorkflowStepRegistry,
   toolingRolloutGate
-} from "./index-yw6g3bbv.js";
+} from "./index-2446k7b4.js";
 import {
   buildResourceList,
   codexMcpConfigPath,
@@ -18,32 +18,32 @@ import {
   upsertCodexMcpServerBlock,
   renderDoctorText,
   AkanContextAnalyzer
-} from "./index-rpgxs245.js";
+} from "./index-18zybgkc.js";
 import {
   isPlaceholderAppId2
-} from "./index-erfc1x40.js";
+} from "./index-vqx8bdxz.js";
 import {
   CommandContainer,
   runner
-} from "./index-ycy302an.js";
+} from "./index-qdgzsnhg.js";
 import {
   Prompter2
 } from "./index-s5rhm04y.js";
 import {
   RepairRunner
-} from "./index-ef228gzf.js";
+} from "./index-53176s7j.js";
 import {
   WorkflowRunner
-} from "./index-zmj143x7.js";
+} from "./index-txr7dj2g.js";
 import {
   ModuleScript
-} from "./index-pn8mhpps.js";
+} from "./index-esk82rvk.js";
 import {
   PrimitiveScript
-} from "./index-d9fjz06h.js";
+} from "./index-zqgj2rt2.js";
 import {
   ScalarScript
-} from "./index-q9c3c0hy.js";
+} from "./index-4m929vvn.js";
 import {
   getMobileTargets
 } from "./index-47pj3aee.js";

package/{index-q9c3c0hy.js → index-4m929vvn.js}

@@ -2,12 +2,12 @@
 import {
   runner,
   script
-} from "./index-ycy302an.js";
+} from "./index-qdgzsnhg.js";
 import {
   generatedFilesForSync,
   createPassedPrimitiveReport,
   scalarChangedFiles
-} from "./index-yw6g3bbv.js";
+} from "./index-2446k7b4.js";
 import {
   pluralizeName
 } from "./index-nz8prx9g.js";

package/{index-ef228gzf.js → index-53176s7j.js}

@@ -5,13 +5,13 @@ import {
   writeGeneratedSyncState,
   createRepairReport,
   renderRepairReport
-} from "./index-yw6g3bbv.js";
+} from "./index-2446k7b4.js";
 import {
   AkanContextAnalyzer
-} from "./index-rpgxs245.js";
+} from "./index-18zybgkc.js";
 import {
   runner
-} from "./index-ycy302an.js";
+} from "./index-qdgzsnhg.js";
 
 // pkgs/@akanjs/cli/repair/repair.runner.ts
 var commandForShell = (command) => command.startsWith("akan ") ? `bun run ${command}` : command;

package/{index-jwrpsrg3.js → index-667w0yah.js}

@@ -1,6 +1,6 @@
 // @bun
 // pkgs/@akanjs/devkit/codeAgent/agent/akanCodeModel.ts
-var akanCodeDefaultModel2 = { provider: "deepseek", id: "deepseek-v4-flash" };
+var akanCodeDefaultModel2 = { provider: "deepseek", id: "deepseek-flash" };
 var catalogueMissesImages = new Set(["deepseek/deepseek-v4-flash"]);
 var correctInputs = (model) => {
   if (!model || model.input.includes("image"))

package/{index-6q589y9t.js → index-7ep8qtvp.js}

@@ -2,10 +2,10 @@
 import {
   runner,
   script
-} from "./index-ycy302an.js";
+} from "./index-qdgzsnhg.js";
 import {
   LibExecutor
-} from "./index-bwxpk2cj.js";
+} from "./index-crmeqnmf.js";
 import {
   LibSource,
   formatLibStatuses

package/{index-w8kmx1b6.js → index-89hy31kf.js}

@@ -1147,6 +1147,7 @@ var SSR_CLIENT_ALIAS_EXTERNALS = [
 class RouteClientBuilder {
   #app;
   #seeds;
+  #graphSeeds;
   #knownEntries;
   #command;
   #discovery;
@@ -1154,20 +1155,22 @@ class RouteClientBuilder {
   constructor(options) {
     this.#app = options.app;
     this.#seeds = options.seeds;
+    this.#graphSeeds = options.graphSeeds;
     this.#knownEntries = options.knownEntries ?? new Set;
     this.#command = options.command ?? "start";
     this.#discovery = options.discovery;
     this.#entries = options.entries;
   }
   async build() {
-    const discovered = this.#entries ?? await (this.#discovery ?? await GraphClientEntryDiscovery.create(this.#app)).discover(this.#seeds);
-    const entries = discovered.filter((e) => !this.#knownEntries.has(e));
-    if (entries.length === 0)
+    const discovered = this.#entries ?? await (await this.#getDiscovery()).discover(this.#seeds);
+    if (discovered.every((e) => this.#knownEntries.has(e)))
       return this.#emptyResult(discovered);
+    const entries = this.#graphSeeds ? [...new Set([...discovered, ...await (await this.#getDiscovery()).discover(this.#graphSeeds)])].sort() : discovered.filter((e) => !this.#knownEntries.has(e));
     const bootstrapEntries = await this.#createBootstrapEntries(entries);
     const browserBundle = await this.#buildBrowserBundle(bootstrapEntries);
     const ssrBundle = await this.#buildSsrBundle(bootstrapEntries);
     const acceptedEntries = new Set(entries);
+    const routeEntries = new Set(discovered);
     const manifestDelta = {};
     const ssrModuleMap = {};
     const clientDeps = new Set;
@@ -1195,18 +1198,23 @@ class RouteClientBuilder {
         deps.add(path6.resolve(dep));
       const sortedDeps = [...deps].sort();
       clientDepsByEntry[originalEntry] = sortedDeps;
-      for (const dep of sortedDeps)
-        clientDeps.add(dep);
+      if (routeEntries.has(originalEntry))
+        for (const dep of sortedDeps)
+          clientDeps.add(dep);
     }
     return {
       manifestDelta,
       ssrManifestDelta: { moduleLoading: null, moduleMap: ssrModuleMap },
-      newEntries: entries,
+      newEntries: entries.filter((e) => !this.#knownEntries.has(e)),
       discoveredEntries: discovered,
       clientDeps: [...clientDeps].sort(),
       clientDepsByEntry
     };
   }
+  async#getDiscovery() {
+    this.#discovery ??= await GraphClientEntryDiscovery.create(this.#app);
+    return this.#discovery;
+  }
   #emptyResult(discoveredEntries = []) {
     return {
       manifestDelta: {},
@@ -1440,6 +1448,7 @@ var LIB_BARRELS = {
   cnst: { barrel: "cnst", kind: "namespace" },
   srv: { barrel: "srv", kind: "namespace" }
 };
+var GLOBAL_NAMES = new Set(["fetch"]);
 var DOMAIN_DENYLIST = new Set([
   "Map",
   "Set",
@@ -1642,10 +1651,11 @@ var transformSource = (source, fileName, ctx, resolveExtra) => {
   const sf = ts2.createSourceFile(fileName, source, ts2.ScriptTarget.Latest, true, scriptKindFor(fileName));
   const bound = collectBoundNames(sf);
   const used = collectUsedReferences(sf);
+  const bareGlobals = collectBareGlobalReferences(sf);
   const namedBySpecifier = new Map;
   const namespaceImports = [];
   for (const name of used) {
-    if (bound.has(name))
+    if (bound.has(name) || bareGlobals.has(name))
       continue;
     const target = targetFor(name, ctx) ?? resolveExtra?.(name) ?? null;
     if (!target)
@@ -1743,6 +1753,19 @@ var collectUsedReferences = (sf) => {
   ts2.forEachChild(sf, visit);
   return used;
 };
+var collectBareGlobalReferences = (sf) => {
+  const bare = new Set;
+  const visit = (node) => {
+    if (ts2.isIdentifier(node) && GLOBAL_NAMES.has(node.text) && isReferencePosition(node)) {
+      const parent = node.parent;
+      if (!(parent && ts2.isPropertyAccessExpression(parent) && parent.expression === node))
+        bare.add(node.text);
+    }
+    ts2.forEachChild(node, visit);
+  };
+  ts2.forEachChild(sf, visit);
+  return bare;
+};
 var isReferencePosition = (node) => {
   const parent = node.parent;
   if (!parent)

package/{index-jd01kj5r.js → index-9d6nvkz2.js}

@@ -112,7 +112,7 @@ class SubagentPool2 {
     }
   }
   async#run(id, kind, prompt, signal) {
-    const { CodeAgent } = await import("./CodeAgent-0035exh3.js");
+    const { CodeAgent } = await import("./CodeAgent-6cm97kay.js");
     const budget = this.#options.parent.tools.subagent;
     const child = SubagentPool2.childOf(this.#options.parent, kind);
     const agent = await CodeAgent.create({

package/{index-zq0mr3hh.js → index-a1w6934z.js}

@@ -2,7 +2,7 @@
 import {
   AsyncDefaultExportDetector,
   resolveSsrPageEntriesForApp
-} from "./index-bwxpk2cj.js";
+} from "./index-crmeqnmf.js";
 import {
   BarrelAnalyzer,
   createBarrelImportsPlugin,
@@ -13,7 +13,7 @@ import {
   ClientEntriesBundler,
   VENDOR_SPECIFIERS,
   RouteClientBuilder
-} from "./index-w8kmx1b6.js";
+} from "./index-89hy31kf.js";
 var __require = import.meta.require;
 
 // pkgs/@akanjs/devkit/frontendBuild/allRoutesBuilder.ts
@@ -419,7 +419,7 @@ class CssImportResolver {
   }
   async#firstExisting(basePath) {
     for (const suffix of CSS_IMPORT_EXTS) {
-      const candidate = `${basePath}${suffix}`;
+      const candidate = path4.normalize(`${basePath}${suffix}`);
       if (await Bun.file(candidate).exists())
         return candidate;
     }