@akanjs/cli 3.0.2 → 3.1.0-rc.1

package/{index-50wb2a26.js → index-55mynnqs.js}

@@ -4,13 +4,94 @@ import {
   FileSys2
 } from "./index-52w0fvh8.js";
 
+// pkgs/@akanjs/devkit/transforms/serverEnvProfile.ts
+import path from "path";
+var secretKey = /password|passwd|passphrase|^pass$|token|jwt|authorization|cookie|secret|api[-_]?key|private[-_]?key|access[-_]?key|auth[-_]?key|hash[-_]?key|webhook|cred|iap[-_]?verify|service[-_]?account/i;
+
+class ServerEnvProfile {
+  static namePattern = /^[a-z][a-zA-Z0-9-]*$/;
+  static fileName(environment, profile) {
+    return `env.server.${environment}.${profile}.ts`;
+  }
+  static profileFileOf(file, profile) {
+    return file.replace(/\.ts$/, `.${profile}.ts`);
+  }
+  static strip(value, at = "", underSecret = false) {
+    if (typeof value === "string")
+      return underSecret && value.trim() ? { value: undefined, stripped: [at] } : { value, stripped: [] };
+    if (!value || typeof value !== "object")
+      return { value, stripped: [] };
+    const stripped = [];
+    const strip = (key, child) => {
+      const result = ServerEnvProfile.strip(child, at ? `${at}.${key}` : key, underSecret || secretKey.test(key));
+      stripped.push(...result.stripped);
+      return result.value;
+    };
+    if (Array.isArray(value))
+      return { value: value.map((child, idx) => strip(String(idx), child)), stripped };
+    const kept = Object.fromEntries(Object.entries(value).map(([key, child]) => [key, strip(key, child)]).filter(([, child]) => child !== undefined));
+    return { value: kept, stripped };
+  }
+  static secretValues(value, at = "", underSecret = false) {
+    if (typeof value === "string") {
+      const named = secretKey.test(at.split(".").at(-1) ?? "");
+      const distinct = value.length >= 16 && !/^https?:\/\//.test(value) && !/^[a-z]+(?:[._-][a-z]+)*$/.test(value);
+      return underSecret && value.length >= 8 && (named || distinct) ? [{ path: at, value }] : [];
+    }
+    if (!value || typeof value !== "object")
+      return [];
+    return Object.entries(value).flatMap(([key, child]) => ServerEnvProfile.secretValues(child, at ? `${at}.${key}` : key, underSecret || secretKey.test(key)));
+  }
+  static secretPaths(value, at = "", underSecret = false) {
+    if (typeof value === "string")
+      return underSecret && value.trim() ? [at] : [];
+    if (!value || typeof value !== "object")
+      return [];
+    return Object.entries(value).flatMap(([key, child]) => ServerEnvProfile.secretPaths(child, at ? `${at}.${key}` : key, underSecret || secretKey.test(key)));
+  }
+  static async evaluate(file, cwd) {
+    const script = [
+      "const { env } = await import(process.env.AKAN_PROFILE_ENV_FILE);",
+      'const plain = (_, value) => (typeof value === "function" || typeof value === "symbol" ? undefined : typeof value === "bigint" ? String(value) : value);',
+      "process.stdout.write(JSON.stringify(env ?? null, plain));"
+    ].join(`
+`);
+    const child = Bun.spawn([process.execPath, "--eval", script], {
+      cwd,
+      env: { PATH: process.env.PATH ?? "", HOME: process.env.HOME ?? "", AKAN_PROFILE_ENV_FILE: file },
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited
+    ]);
+    if (exitCode !== 0)
+      throw new Error(`${path.basename(file)} could not be evaluated to check it for secrets:
+${stderr.trim()}`);
+    return JSON.parse(stdout || "null");
+  }
+  static async assertShippable({ envDir, environment, profile }) {
+    if (!ServerEnvProfile.namePattern.test(profile))
+      throw new Error(`The server env profile "${profile}" must be a lowercase-first name of letters, digits and dashes.`);
+    const name = ServerEnvProfile.fileName(environment, profile);
+    const file = path.join(envDir, name);
+    if (!await Bun.file(file).exists())
+      throw new Error(`The server env profile "${profile}" bundles env/${name} in place of env/env.server.${environment}.ts, and there is no such file.`);
+    const secrets = ServerEnvProfile.secretPaths(await ServerEnvProfile.evaluate(file, path.dirname(envDir)));
+    if (secrets.length)
+      throw new Error(`env/${name} holds secret-named values, which a profile's bundle carries to every computer it runs on: ${secrets.join(", ")}. Leave them out, or read them from the process env of the server that needs them.`);
+  }
+}
+
 // pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
 import { readdir, rm } from "fs/promises";
-import path2 from "path";
+import path3 from "path";
 
 // pkgs/@akanjs/devkit/transforms/asyncDefaultExportDetector.ts
 import fs from "fs";
-import path from "path";
+import path2 from "path";
 
 class AsyncDefaultExportDetector {
   static #typescriptLoad;
@@ -21,7 +102,7 @@ class AsyncDefaultExportDetector {
   static async detect(moduleAbsPath) {
     try {
       const typescript = await AsyncDefaultExportDetector.#loadTypescript();
-      const source = fs.readFileSync(path.resolve(moduleAbsPath), "utf8");
+      const source = fs.readFileSync(path2.resolve(moduleAbsPath), "utf8");
       const sourceFile = typescript.createSourceFile(moduleAbsPath, source, typescript.ScriptTarget.Latest, true, /\.[tj]sx$/.test(moduleAbsPath) ? typescript.ScriptKind.TSX : typescript.ScriptKind.TS);
       return new AsyncDefaultExportDetector(typescript).detectInSourceFile(sourceFile);
     } catch {
@@ -85,17 +166,17 @@ class AsyncDefaultExportDetector {
 
 // pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
 var LAYOUT_KEY_RE = /^\.\/(.+\/)?_layout\.(tsx|ts|jsx|js)$/;
-var IMPLICIT_LAYOUT_DIR = path2.join(".akan", "generated", "root-layouts");
-var IMPLICIT_DICT_DIR = path2.join(".akan", "generated", "dict");
-var IMPLICIT_OVERRIDES_DIR = path2.join(".akan", "generated", "overrides");
+var IMPLICIT_LAYOUT_DIR = path3.join(".akan", "generated", "root-layouts");
+var IMPLICIT_DICT_DIR = path3.join(".akan", "generated", "dict");
+var IMPLICIT_OVERRIDES_DIR = path3.join(".akan", "generated", "overrides");
 var OVERRIDES_KEY_RE = /^\.\/(.+\/)?_overrides\.(tsx|ts|jsx|js)$/;
 var importSpecifier = (fromAbsPath, toAbsPath) => {
-  const rel = path2.relative(path2.dirname(fromAbsPath), toAbsPath).split(path2.sep).join("/");
+  const rel = path3.relative(path3.dirname(fromAbsPath), toAbsPath).split(path3.sep).join("/");
   return rel.startsWith(".") ? rel : `./${rel}`;
 };
 async function writeGeneratedOverridesLayoutFile(opts) {
   const filename = `${opts.key.replace(/^\.\//, "").replace(/[^a-zA-Z0-9]+/g, "_")}.tsx`;
-  const absPath = path2.join(path2.resolve(opts.appCwdPath), IMPLICIT_OVERRIDES_DIR, filename);
+  const absPath = path3.join(path3.resolve(opts.appCwdPath), IMPLICIT_OVERRIDES_DIR, filename);
   const source = `"use client";
 import { UiOverrideProvider } from "akanjs/ui";
 import { createElement, type ReactNode } from "react";
@@ -111,7 +192,7 @@ export default function AkanUiOverridesLayout({ children }: { children?: ReactNo
 async function pruneGeneratedFiles(dirAbsPath, keepAbsPaths) {
   const keep = new Set(keepAbsPaths);
   const names = await readdir(dirAbsPath).catch(() => []);
-  await Promise.all(names.map((name) => path2.join(dirAbsPath, name)).filter((absPath) => !keep.has(absPath)).map((absPath) => rm(absPath, { force: true })));
+  await Promise.all(names.map((name) => path3.join(dirAbsPath, name)).filter((absPath) => !keep.has(absPath)).map((absPath) => rm(absPath, { force: true })));
 }
 function getRootBoundarySegments(key) {
   const match = LAYOUT_KEY_RE.exec(key);
@@ -127,7 +208,7 @@ function implicitRootLayoutKey(segments) {
 }
 function implicitRootLayoutAbsPath(appCwdPath, segments) {
   const filename = segments.length ? `${segments.join("__")}__root_layout.tsx` : "__root_layout.tsx";
-  return path2.join(path2.resolve(appCwdPath), IMPLICIT_LAYOUT_DIR, filename);
+  return path3.join(path3.resolve(appCwdPath), IMPLICIT_LAYOUT_DIR, filename);
 }
 function isRootBoundarySegments(segments, basePaths) {
   const firstVisibleIndex = segments.findIndex((segment) => !/^\(.+\)$/.test(segment));
@@ -150,7 +231,7 @@ function findRootBoundaries(pageKeys, appCwdPath, basePaths) {
     const id = segments.join("/");
     boundaries.set(id, {
       sourceKey: key,
-      sourceAbsPath: path2.resolve(appCwdPath, "page", key.replace(/^\.\//, "")),
+      sourceAbsPath: path3.resolve(appCwdPath, "page", key.replace(/^\.\//, "")),
       segments
     });
   }
@@ -166,16 +247,16 @@ function findExplicitRootLayoutAbsPath(pageKeys, appCwdPath) {
     const segments = getRootBoundarySegments(key);
     return segments !== null && segments.length === 0;
   });
-  return rootLayoutKey ? path2.resolve(appCwdPath, "page", rootLayoutKey.replace(/^\.\//, "")) : null;
+  return rootLayoutKey ? path3.resolve(appCwdPath, "page", rootLayoutKey.replace(/^\.\//, "")) : null;
 }
 async function assertEnvClientConvention(appCwdPath, appName) {
-  const envPath = path2.join(appCwdPath, "env", "env.client.ts");
+  const envPath = path3.join(appCwdPath, "env", "env.client.ts");
   if (!await Bun.file(envPath).exists()) {
     throw new Error(`[route-convention] app "${appName}" must provide env/env.client.ts exporting "env" for generated System.Provider`);
   }
 }
 async function writeGeneratedDictionaryMacroFile(appCwdPath, appName) {
-  const absPath = path2.join(path2.resolve(appCwdPath), IMPLICIT_DICT_DIR, "useDict.ts");
+  const absPath = path3.join(path3.resolve(appCwdPath), IMPLICIT_DICT_DIR, "useDict.ts");
   await Bun.write(absPath, `import { getAllDictionary } from "@apps/${appName}/lib/dict" with { type: "macro" };
 
 export const allDictionary = getAllDictionary();
@@ -194,13 +275,13 @@ async function writeGeneratedRootLayoutFile(opts) {
 void st;
 ` : `import "@apps/${opts.appName}/client";
 `;
-  const inheritedLabel = inheritedSourceAbsPath ? path2.relative(opts.appCwdPath, inheritedSourceAbsPath) : "";
+  const inheritedLabel = inheritedSourceAbsPath ? path3.relative(opts.appCwdPath, inheritedSourceAbsPath) : "";
   const inheritedImport = inheritedSourceSpecifier ? `import * as inheritedModule from ${JSON.stringify(inheritedSourceSpecifier)};
 const inheritedLayout = resolveRouteModule(inheritedModule as never, ${JSON.stringify(inheritedLabel)}).module as LayoutModule;
 ` : `const inheritedLayout: LayoutModule = {};
 `;
   const prefix = opts.boundary.segments.find((segment) => !/^\(.+\)$/.test(segment)) ?? null;
-  const userLabel = opts.boundary.sourceAbsPath ? path2.relative(opts.appCwdPath, opts.boundary.sourceAbsPath) : "";
+  const userLabel = opts.boundary.sourceAbsPath ? path3.relative(opts.appCwdPath, opts.boundary.sourceAbsPath) : "";
   const userImport = sourceSpecifier ? `import * as userModule from ${JSON.stringify(sourceSpecifier)};
 const userLayout = resolveRouteModule(userModule as never, ${JSON.stringify(userLabel)}).module as LayoutModule;
 const UserLayout = userLayout.default as (props: LayoutProps) => ReactNode | Promise<ReactNode>;
@@ -217,11 +298,12 @@ const userLayout: LayoutModule = {};
 ` : "";
   const layoutChild = isAsyncUserLayout ? "{layout}" : userLayoutElement;
   const layoutReturn = isAsyncUserLayout ? "layout" : userLayoutElement;
+  const headLayouts = opts.includeSystemProvider ? "[inheritedLayout, userLayout]" : "[userLayout]";
   const layoutExports = `export async function generateHead(props: PageProps) {
-  if (userLayout.generateHead) return userLayout.generateHead(props);
-  if (userLayout.head !== undefined) return userLayout.head;
-  if (inheritedLayout.generateHead) return inheritedLayout.generateHead(props);
-  return inheritedLayout.head;
+  const heads = await Promise.all(
+    ${headLayouts}.map((layout) => (layout.generateHead ? layout.generateHead(props) : layout.head)),
+  );
+  return RouteHead.mergeNodes(heads);
 }
 
 export const NotFound = userLayout.NotFound ?? inheritedLayout.NotFound;
@@ -231,7 +313,7 @@ export const pageConfig = userLayout.pageConfig ?? inheritedLayout.pageConfig;
 ${layoutSignature}({ children, params, searchParams }: LayoutProps) {
 ${layoutBinding}  return `;
   const source = opts.includeSystemProvider ? `import type { LayoutModule, LayoutProps, PageProps } from "akanjs/client";
-import { loadFonts, resolveRouteModule } from "akanjs/client";
+import { loadFonts, resolveRouteModule, RouteHead } from "akanjs/client";
 import type { ReactNode } from "react";
 import { System } from "akanjs/ui";
 import { env } from "@apps/${opts.appName}/env/env.client";
@@ -243,6 +325,8 @@ if (defaultFonts.length > 1) throw new Error("[route-convention] only one defaul
 const defaultFont = defaultFonts[0];
 const defaultFontClassName = defaultFont ? (defaultFont.className ?? \`font-\${defaultFont.name}\`) : undefined;
 export const theme = userLayout.theme ?? inheritedLayout.theme;
+export const viewport = userLayout.viewport ?? inheritedLayout.viewport;
+export const manifest = userLayout.manifest ?? inheritedLayout.manifest;
 
 ${layoutExports}(
     <System.Provider
@@ -250,9 +334,10 @@ ${layoutExports}(
       appName=${JSON.stringify(opts.appName)}
       ${prefix ? `prefix=${JSON.stringify(prefix)}
       ` : ""}params={params}
-      manifest={userLayout.manifest ?? inheritedLayout.manifest}
+      manifest={manifest}
       env={env}
       theme={theme}
+      viewport={viewport}
       fonts={loadFonts(userFonts)}
       className={defaultFontClassName}
       layoutStyle={userLayout.layoutStyle ?? inheritedLayout.layoutStyle}
@@ -265,7 +350,7 @@ ${layoutExports}(
   );
 }
 ` : `import type { LayoutModule, LayoutProps, PageProps } from "akanjs/client";
-import { resolveRouteModule } from "akanjs/client";
+import { resolveRouteModule, RouteHead } from "akanjs/client";
 import type { ReactNode } from "react";
 ${inheritedImport}${userImport}
 ${layoutExports}${layoutReturn};
@@ -275,8 +360,8 @@ ${layoutExports}${layoutReturn};
   return absPath;
 }
 async function resolveSsrPageEntries(opts) {
-  const absPageDir = path2.resolve(opts.appCwdPath, "page");
-  const hasSt = await Bun.file(path2.join(opts.appCwdPath, "lib", "st.ts")).exists();
+  const absPageDir = path3.resolve(opts.appCwdPath, "page");
+  const hasSt = await Bun.file(path3.join(opts.appCwdPath, "lib", "st.ts")).exists();
   const basePaths = opts.basePaths ?? [];
   const rootSourceAbsPath = findExplicitRootLayoutAbsPath(opts.pageKeys, opts.appCwdPath);
   const rootBoundaries = findRootBoundaries(opts.pageKeys, opts.appCwdPath, basePaths);
@@ -285,7 +370,7 @@ async function resolveSsrPageEntries(opts) {
     return segments !== null && isRootBoundarySegments(segments, basePaths);
   }));
   const base = await Promise.all(opts.pageKeys.filter((key) => !rootLayoutKeys.has(key)).map(async (key) => {
-    const userAbsPath = path2.resolve(absPageDir, key);
+    const userAbsPath = path3.resolve(absPageDir, key);
     if (OVERRIDES_KEY_RE.test(key)) {
       const moduleAbsPath = await writeGeneratedOverridesLayoutFile({
         appCwdPath: opts.appCwdPath,
@@ -308,10 +393,10 @@ async function resolveSsrPageEntries(opts) {
     }),
     seedAbsPaths: [...new Set([boundary.sourceAbsPath, rootSourceAbsPath].filter((absPath) => absPath !== null))]
   })));
-  const appCwdAbsPath = path2.resolve(opts.appCwdPath);
+  const appCwdAbsPath = path3.resolve(opts.appCwdPath);
   await Promise.all([
-    pruneGeneratedFiles(path2.join(appCwdAbsPath, IMPLICIT_OVERRIDES_DIR), base.filter(({ key }) => OVERRIDES_KEY_RE.test(key)).map(({ moduleAbsPath }) => moduleAbsPath)),
-    pruneGeneratedFiles(path2.join(appCwdAbsPath, IMPLICIT_LAYOUT_DIR), generated.map(({ moduleAbsPath }) => moduleAbsPath))
+    pruneGeneratedFiles(path3.join(appCwdAbsPath, IMPLICIT_OVERRIDES_DIR), base.filter(({ key }) => OVERRIDES_KEY_RE.test(key)).map(({ moduleAbsPath }) => moduleAbsPath)),
+    pruneGeneratedFiles(path3.join(appCwdAbsPath, IMPLICIT_LAYOUT_DIR), generated.map(({ moduleAbsPath }) => moduleAbsPath))
   ]);
   return [...base, ...generated].sort((a, b) => a.key.localeCompare(b.key));
 }
@@ -322,7 +407,7 @@ async function resolveSsrPageEntriesForApp(app, pageKeys) {
 
 // pkgs/@akanjs/devkit/codegenLock.ts
 import { mkdir, open, readFile, rm as rm2, stat } from "fs/promises";
-import path3 from "path";
+import path4 from "path";
 import { Logger } from "akanjs/common";
 
 class CodegenLock {
@@ -333,7 +418,7 @@ class CodegenLock {
   static #logger = new Logger("CodegenLock");
   static #queue = Promise.resolve();
   static pathIn(workspaceRoot) {
-    return path3.join(workspaceRoot, "local", ".akan", CodegenLock.fileName);
+    return path4.join(workspaceRoot, "local", ".akan", CodegenLock.fileName);
   }
   static async run(workspaceRoot, label, fn) {
     const ahead = CodegenLock.#queue;
@@ -363,7 +448,7 @@ class CodegenLock {
   }
   static async#withFileLock(workspaceRoot, label, fn) {
     const lockPath = CodegenLock.pathIn(workspaceRoot);
-    await mkdir(path3.dirname(lockPath), { recursive: true }).catch(() => {
+    await mkdir(path4.dirname(lockPath), { recursive: true }).catch(() => {
       return;
     });
     const held = await CodegenLock.#acquire(lockPath, label);
@@ -517,7 +602,7 @@ import {
   stat as stat2,
   symlink
 } from "fs/promises";
-import path10 from "path";
+import path12 from "path";
 import { pathToFileURL } from "url";
 import {
   capitalize,
@@ -670,10 +755,10 @@ ${CLAUDE_COMMENT_RULE}
 `;
 
 // pkgs/@akanjs/devkit/akanConfig/akanBin.ts
-import path4 from "path";
+import path5 from "path";
 
 // pkgs/@akanjs/devkit/akanConfig/types.ts
-import { archs, binPlatforms } from "akanjs";
+import { archs, binPlatforms, defaultAppPipeline } from "akanjs";
 
 // pkgs/@akanjs/devkit/akanConfig/akanBin.ts
 class AkanBin {
@@ -721,7 +806,7 @@ class AkanBin {
     if (!archive)
       throw new Error(`${at}: file picks the executable out of an archive, and this source is none`);
     const parts = typeof file === "string" ? file.split(/[\\/]/).filter((part) => part && part !== ".") : [];
-    if (!parts.length || path4.isAbsolute(file) || parts.includes(".."))
+    if (!parts.length || path5.isAbsolute(file) || parts.includes(".."))
       throw new Error(`${at}: file must be a path inside the archive (got ${JSON.stringify(file)})`);
     return { ...resolved, file: parts.join("/") };
   }
@@ -737,12 +822,12 @@ class AkanBin {
       throw new Error(`${at}: path must name a file`);
     if (sha256 !== undefined)
       throw new Error(`${at}: sha256 checks a download, and a path source downloads nothing`);
-    return { path: path4.resolve(baseDir, localPath) };
+    return { path: path5.resolve(baseDir, localPath) };
   }
 }
 // pkgs/@akanjs/devkit/akanConfig/akanConfig.ts
 import fs2 from "fs";
-import path5 from "path";
+import path6 from "path";
 import { fileURLToPath } from "url";
 import { DatabaseModes, normalizeRoutePrefix } from "akanjs/base";
 import { resolveAkanI18nConfig } from "akanjs/common";
@@ -938,8 +1023,8 @@ class AkanAppConfig {
       if (basePath && !this.basePaths.has(basePath))
         throw new Error(`Native target '${name}' uses unknown basePath '${basePath}' in ${configPath}`);
       const { updates } = merged;
-      if (updates && (!updates.url || !updates.publicKey))
-        throw new Error(`${where}.updates in ${configPath} has no url or publicKey${named ? "; give them in native.updates or the target's own" : ""}.`);
+      if (updates && (!updates.url || !(updates.publicKey || updates.publicKeys?.length)))
+        throw new Error(`${where}.updates in ${configPath} has no url or publicKeys${named ? "; give them in native.updates or the target's own" : ""}.`);
       AkanAppConfig.#assertFiles(own ?? {}, where, configPath);
       const {
         basePath: _basePath,
@@ -980,12 +1065,64 @@ class AkanAppConfig {
     if (server === undefined || typeof server === "boolean")
       return desktop;
     if (!AkanAppConfig.#isPlainObject(server))
-      throw new Error(`${where} in ${configPath} must be true or { omit: string[] }.`);
-    const omit = server.omit;
-    if (omit !== undefined && (!Array.isArray(omit) || omit.some((name) => typeof name !== "string" || !name.trim())))
-      throw new Error(`${where}.omit in ${configPath} must be a list of package names.`);
-    const names = [...new Set((omit ?? []).map((name) => name.trim()))].sort();
-    return { ...desktop, server: { omit: names } };
+      throw new Error(`${where} in ${configPath} must be true or { omit, profile, modules }.`);
+    const names = (list, key, what) => {
+      if (list === undefined)
+        return [];
+      if (!Array.isArray(list) || list.some((name) => typeof name !== "string" || !name.trim()))
+        throw new Error(`${where}.${key} in ${configPath} must be a list of ${what}.`);
+      return [...new Set(list.map((name) => name.trim()))].sort();
+    };
+    const { profile } = server;
+    if (profile !== undefined && (typeof profile !== "string" || !ServerEnvProfile.namePattern.test(profile)))
+      throw new Error(`${where}.profile in ${configPath} names env/env.server.<env>.<profile>.ts: a lowercase-first name of letters, digits and dashes.`);
+    const modules = names(server.modules, "modules", "module names or @<operationMode> selectors");
+    const env = AkanAppConfig.#desktopServerEnv(server.env, where, configPath);
+    const { restart } = server;
+    if (restart !== undefined && restart !== "forever" && !(Number.isInteger(restart) && restart > 0))
+      throw new Error(`${where}.restart in ${configPath} must be "forever" or a count of crashes in a row from 1.`);
+    const watchdog = AkanAppConfig.#desktopServerWatchdog(server.watchdog, where, configPath);
+    return {
+      ...desktop,
+      server: {
+        omit: names(server.omit, "omit", "package names"),
+        ...profile ? { profile } : {},
+        ...modules.length ? { modules } : {},
+        ...Object.keys(env).length ? { env } : {},
+        ...restart !== undefined ? { restart } : {},
+        ...watchdog ? { watchdog } : {}
+      }
+    };
+  }
+  static #stagedServerEnv = new Set([
+    "AKAN_PUBLIC_OPERATION_MODE",
+    "AKAN_DATABASE_MODE",
+    "AKAN_DATABASE_MODES",
+    "AKAN_SSR",
+    "AKAN_CSR",
+    "AKAN_MODULES"
+  ]);
+  static #desktopServerEnv(env, where, configPath) {
+    if (env === undefined)
+      return {};
+    if (!AkanAppConfig.#isPlainObject(env) || Object.values(env).some((value) => typeof value !== "string"))
+      throw new Error(`${where}.env in ${configPath} must be an object of strings.`);
+    const staged = Object.keys(env).filter((key) => AkanAppConfig.#stagedServerEnv.has(key.toUpperCase()));
+    if (staged.length)
+      throw new Error(`${where}.env in ${configPath} sets ${staged.join(", ")}, which the carried server's stage owns (modules: desktop.server.modules).`);
+    const secrets = ServerEnvProfile.secretPaths(env);
+    if (secrets.length)
+      throw new Error(`${where}.env in ${configPath} holds secret-named values (${secrets.join(", ")}), and the app carries its env where anyone on the computer reads it. Leave them out.`);
+    return env;
+  }
+  static #desktopServerWatchdog(watchdog, where, configPath) {
+    if (watchdog === undefined || watchdog === false)
+      return null;
+    const { intervalMs = 1e4, failures = 3 } = watchdog === true ? {} : watchdog;
+    const whole = (value) => Number.isInteger(value) && value > 0;
+    if (watchdog !== true && !AkanAppConfig.#isPlainObject(watchdog) || !whole(intervalMs) || !whole(failures))
+      throw new Error(`${where}.watchdog in ${configPath} must be true or { intervalMs, failures }, whole numbers from 1.`);
+    return { intervalMs, failures };
   }
   static #platformIndexPath(section) {
     const { indexPath: rawIndexPath, ...rest } = section;
@@ -996,7 +1133,7 @@ class AkanAppConfig {
     const merge = (kept, value, top, key) => {
       if (!AkanAppConfig.#isPlainObject(kept) || !AkanAppConfig.#isPlainObject(value))
         return value;
-      if (top && (key === "icon" || key === "splash"))
+      if (top && (key === "icon" || key === "splash" || key === "backgroundColor"))
         return value;
       const out = { ...kept };
       for (const [inner, next] of Object.entries(value))
@@ -1024,10 +1161,12 @@ class AkanAppConfig {
       "buildNum",
       "icon",
       "splash",
+      "backgroundColor",
       "permissions",
       "plugins",
       "deepLinks",
       "updates",
+      "devtools",
       "ios",
       "android",
       "desktop"
@@ -1044,8 +1183,18 @@ class AkanAppConfig {
       "activity",
       "files"
     ],
-    desktop: ["indexPath", "server", "recovery", "window", "screenCapture", "entitlements", "dmg"],
-    desktopServer: ["omit"],
+    desktop: [
+      "indexPath",
+      "server",
+      "recovery",
+      "window",
+      "screenCapture",
+      "webview2",
+      "publisher",
+      "entitlements",
+      "dmg"
+    ],
+    desktopServer: ["omit", "profile", "modules", "env", "restart", "watchdog"],
     dmg: ["background", "background2x", "window", "iconSize", "textSize", "app", "applications"],
     deepLinks: ["schemes", "domains"]
   };
@@ -1195,12 +1344,18 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
   static async from(app, { bustImportCache = false } = {}) {
     const [configImp, baseDevEnv, libs, rootPackageJson] = await Promise.all([
       AkanAppConfig.importConfigModule(app.cwdPath, { bustImportCache }),
-      WorkspaceExecutor.getBaseDevEnv(path5.join(app.workspace.workspaceRoot, ".env")),
+      WorkspaceExecutor.getBaseDevEnv(path6.join(app.workspace.workspaceRoot, ".env")),
       app.workspace.getLibs(),
       app.workspace.getPackageJson()
     ]);
     const resolved = typeof configImp === "function" ? configImp(app) : configImp;
-    const { plugins, ...config } = resolved ?? {};
+    const {
+      plugins,
+      pipeline: _pipeline,
+      ...config
+    } = resolved ?? {};
+    if ("subspace" in config)
+      throw new Error(`apps/${app.name}/akan.config.ts declares \`subspace\`, a workspace setting: it belongs in the workspace root akan.config.ts.`);
     const libContributions = await AkanAppConfig.#collectLibContributions(app, libs, bustImportCache);
     return new AkanAppConfig(app, libs, rootPackageJson, config, baseDevEnv, plugins ?? [], libContributions);
   }
@@ -1263,6 +1418,9 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
     return libs.filter((lib) => !rootDependencies[lib]).map((lib) => `${lib}@${this.#resolveProductionDependencyVersion(lib)}`);
   }
   get akanVersion() {
+    return AkanAppConfig.akanVersion;
+  }
+  static get akanVersion() {
     return getAkanPackageJson().version;
   }
   getProductionPackageJson(data = {}) {
@@ -1284,11 +1442,11 @@ var akanPackageJson = null;
 function getAkanPackageJson() {
   if (akanPackageJson)
     return akanPackageJson;
-  const sourceDir = path5.dirname(fileURLToPath(import.meta.url));
+  const sourceDir = path6.dirname(fileURLToPath(import.meta.url));
   const packageJsonPaths = [
-    path5.join(sourceDir, "../../../akanjs/package.json"),
-    path5.join(process.cwd(), "pkgs/akanjs/package.json"),
-    path5.join(path5.dirname(Bun.main), "node_modules/akanjs/package.json")
+    path6.join(sourceDir, "../../../akanjs/package.json"),
+    path6.join(process.cwd(), "pkgs/akanjs/package.json"),
+    path6.join(path6.dirname(Bun.main), "node_modules/akanjs/package.json")
   ];
   try {
     packageJsonPaths.unshift(Bun.resolveSync("akanjs/package.json", sourceDir));
@@ -1342,26 +1500,81 @@ class AkanLibConfig {
     const configImp = await AkanAppConfig.importConfigModule(lib.cwdPath, { bustImportCache });
     const resolved = typeof configImp === "function" ? configImp(lib) : configImp;
     const { plugins, ...config } = resolved ?? {};
+    if ("pipeline" in config)
+      throw new Error(`libs/${lib.name}/akan.config.ts declares \`pipeline\`, which a lib does not take: pipelines belong to apps and the workspace root, and a lib's build-time work goes in an akan build plugin.`);
+    if ("subspace" in config)
+      throw new Error(`libs/${lib.name}/akan.config.ts declares \`subspace\`, a workspace setting: it belongs in the workspace root akan.config.ts.`);
     return new AkanLibConfig(lib, config, plugins ?? []);
   }
 }
 //! need to refactor
 var shiftBuildNum = async (app, delta) => {
   const { buildNum } = (await AkanAppConfig.from(app)).native;
-  const akanConfigPath = path5.join(app.cwdPath, "akan.config.ts");
+  const akanConfigPath = path6.join(app.cwdPath, "akan.config.ts");
   const akanConfig = fs2.readFileSync(akanConfigPath, "utf8");
   fs2.writeFileSync(akanConfigPath, akanConfig.replace(`buildNum: ${buildNum}`, `buildNum: ${buildNum + delta}`));
 };
 var increaseBuildNum = async (app) => await shiftBuildNum(app, 1);
 var decreaseBuildNum = async (app) => await shiftBuildNum(app, -1);
+// pkgs/@akanjs/devkit/akanConfig/akanWorkspaceConfig.ts
+import path7 from "path";
+class AkanWorkspaceConfig {
+  static fileName = "akan.config.ts";
+  static #keys = ["subspace", "pipeline", "cloud"];
+  static #loopbackHosts = ["localhost", "127.0.0.1", "[::1]"];
+  static async from(workspace, { bustImportCache = false } = {}) {
+    const file = path7.join(workspace.workspaceRoot, AkanWorkspaceConfig.fileName);
+    if (!await FileSys2.fileExists(file))
+      return new AkanWorkspaceConfig(null, {});
+    const input = await AkanAppConfig.importConfigModule(workspace.workspaceRoot, { bustImportCache });
+    return new AkanWorkspaceConfig(file, input);
+  }
+  file;
+  subspace;
+  pipeline;
+  cloudHost;
+  constructor(file, input) {
+    this.file = file;
+    if (typeof input !== "object" || input === null || Array.isArray(input))
+      throw new Error("The workspace root akan.config.ts must default-export a WorkspaceConfig object.");
+    for (const key of Object.keys(input))
+      if (!AkanWorkspaceConfig.#keys.includes(key))
+        throw new Error(`The workspace root akan.config.ts declares \`${key}\`, which it does not take: it holds \`subspace\`, \`pipeline\` and \`cloud\`, and app or lib settings belong in apps/<app>/akan.config.ts or libs/<lib>/akan.config.ts.`);
+    const config = input;
+    this.subspace = config.subspace ?? null;
+    this.pipeline = config.pipeline ?? null;
+    this.cloudHost = AkanWorkspaceConfig.#cloudHost(config.cloud);
+  }
+  static #cloudHost(cloud) {
+    if (cloud === undefined)
+      return null;
+    const refuse = (why) => {
+      throw new Error(`The workspace root akan.config.ts has cloud ${why}.`);
+    };
+    if (typeof cloud !== "object" || cloud === null || Array.isArray(cloud))
+      return refuse("that is not an object");
+    const unknown = Object.keys(cloud).filter((key) => key !== "host");
+    if (unknown.length)
+      return refuse(`keys it does not take: ${unknown.join(", ")} (only \`host\`)`);
+    const { host } = cloud;
+    if (host === undefined)
+      return null;
+    const url = typeof host === "string" && URL.canParse(host) ? new URL(host) : null;
+    if (!url || url.search || url.hash || url.username || url.password)
+      return refuse(`.host ${JSON.stringify(host)}, which is not a URL like "https://cloud.example.com"`);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && AkanWorkspaceConfig.#loopbackHosts.includes(url.hostname)))
+      return refuse(`.host ${JSON.stringify(host)}: https only, or http on this computer`);
+    return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+  }
+}
 // pkgs/@akanjs/devkit/jsonFormatter.ts
-import path6 from "path";
+import path8 from "path";
 
 class JsonFormatter {
   static lineWidth = 120;
   static stringify(value, filePath) {
     const json = JSON.stringify(value, null, 2);
-    if (path6.basename(filePath) === "package.json")
+    if (path8.basename(filePath) === "package.json")
       return `${json}
 `;
     return `${JsonFormatter.#print(JSON.parse(json), 0, { column: 0, trailing: 0 })}
@@ -1432,7 +1645,7 @@ ${"  ".repeat(depth)}]`;
 // pkgs/@akanjs/devkit/linter.ts
 import { spawn } from "child_process";
 import { existsSync, readFileSync } from "fs";
-import path7 from "path";
+import path9 from "path";
 import chalk from "chalk";
 var parseBiomeReport = (output) => {
   for (let start = output.indexOf("{");start !== -1; start = output.indexOf("{", start + 1)) {
@@ -1498,13 +1711,13 @@ class Linter {
   #biomeBin;
   constructor(cwdPath) {
     this.lintRoot = this.#findBiomeRootPath(cwdPath);
-    this.configPath = Linter.#configPathIn(this.lintRoot) ?? path7.join(this.lintRoot, "biome.json");
-    const localBiomeBin = path7.join(this.lintRoot, "node_modules", ".bin", Linter.biomeBinName);
+    this.configPath = Linter.#configPathIn(this.lintRoot) ?? path9.join(this.lintRoot, "biome.json");
+    const localBiomeBin = path9.join(this.lintRoot, "node_modules", ".bin", Linter.biomeBinName);
     this.#biomeBin = existsSync(localBiomeBin) ? localBiomeBin : "biome";
   }
   static #configPathIn(dir) {
     for (const fileName of BIOME_CONFIG_FILES) {
-      const configPath = path7.join(dir, fileName);
+      const configPath = path9.join(dir, fileName);
       if (existsSync(configPath))
         return configPath;
     }
@@ -1513,19 +1726,19 @@ class Linter {
   #findBiomeRootPath(dir) {
     if (Linter.#configPathIn(dir))
       return dir;
-    const parentDir = path7.dirname(dir);
+    const parentDir = path9.dirname(dir);
     if (parentDir === dir)
       throw new Error(`biome.json not found from ${dir}`);
     return this.#findBiomeRootPath(parentDir);
   }
   #toBiomePath(filePath) {
-    const relativePath = path7.relative(this.lintRoot, filePath);
-    if (!relativePath.startsWith("..") && !path7.isAbsolute(relativePath))
+    const relativePath = path9.relative(this.lintRoot, filePath);
+    if (!relativePath.startsWith("..") && !path9.isAbsolute(relativePath))
       return relativePath;
     return filePath;
   }
   #resolveFilePath(filePath) {
-    return path7.isAbsolute(filePath) ? filePath : path7.join(this.lintRoot, filePath);
+    return path9.isAbsolute(filePath) ? filePath : path9.join(this.lintRoot, filePath);
   }
   async#runBiome(args, input) {
     return await new Promise((resolve, reject) => {
@@ -1550,7 +1763,7 @@ class Linter {
     const diagnosticPath = diagnostic.location?.path;
     if (!diagnosticPath)
       return fallbackFilePath;
-    return path7.isAbsolute(diagnosticPath) ? diagnosticPath : path7.join(this.lintRoot, diagnosticPath);
+    return path9.isAbsolute(diagnosticPath) ? diagnosticPath : path9.join(this.lintRoot, diagnosticPath);
   }
   #createLintMessage(diagnostic) {
     const start = diagnostic.location?.start;
@@ -1886,7 +2099,7 @@ class ManifestDependencies {
 
 // pkgs/@akanjs/devkit/repoIdentity.ts
 import { execFileSync } from "child_process";
-import path8 from "path";
+import path10 from "path";
 var resolved = new Map;
 var readRemoteName = (workspaceRoot) => {
   try {
@@ -1904,13 +2117,13 @@ var resolveRepoName = (workspaceRoot) => {
   const cached = resolved.get(workspaceRoot);
   if (cached)
     return cached;
-  const repoName = readRemoteName(workspaceRoot) ?? path8.basename(workspaceRoot);
+  const repoName = readRemoteName(workspaceRoot) ?? path10.basename(workspaceRoot);
   resolved.set(workspaceRoot, repoName);
   return repoName;
 };
 
 // pkgs/@akanjs/devkit/scanInfo.ts
-import path9 from "path";
+import path11 from "path";
 
 // pkgs/@akanjs/devkit/workspaceLayout.ts
 var appRootAllowedFiles = new Set([
@@ -1981,8 +2194,11 @@ var libFacetRootAllowedFiles = new Set([
   "useClient.ts",
   "useServer.ts"
 ]);
-var libFacetRootTestPattern = /^[A-Za-z][A-Za-z0-9_-]*\.signal\.(test|spec)\.(ts|tsx)$/;
-var isAllowedLibFacetRootFile = (filename) => libFacetRootAllowedFiles.has(filename) || libFacetRootTestPattern.test(filename);
+var isAllowedLibFacetRootFile = (filename) => libFacetRootAllowedFiles.has(filename);
+var testSuffix = /\.(test|spec)(\.tsx?)$/;
+var libFacetRootHintOf = (filename) => testSuffix.test(filename) ? "a test beside the generated barrels; move it into the module folder it covers " + "(lib/<model>/<model>.signal.test.ts), or into srvkit/ when it drives several modules" : null;
+var moduleTestTargetOf = (filename) => testSuffix.test(filename) ? filename.replace(testSuffix, "$2") : null;
+var moduleTestHint = "a module test is named after the one module file it covers (<model>.<role>.test.ts); add a describe block to " + "that file's suite instead, or move a suite that drives several modules into srvkit/";
 var barrelFacetDirs = ["ui", "webkit", "srvkit", "common", "plugin"];
 var barrelShadowingIndexFiles = new Set(["index.tsx", "index.jsx", "index.mts"]);
 var facetIndexShadowOf = (sysRelativePath) => {
@@ -2029,9 +2245,9 @@ var moduleUiFileTypes = {
   scalar: new Set(["Template", "Unit"])
 };
 var createDependencyScanner = async (exec) => (await import("./dependencyScanner-06z2dmrr.js")).TypeScriptDependencyScanner.from(exec);
-var getScanPath = (exec, relativePath) => path9.posix.join(`${exec.type}s`, exec.name, relativePath.split(path9.sep).join("/"));
+var getScanPath = (exec, relativePath) => path11.posix.join(`${exec.type}s`, exec.name, relativePath.split(path11.sep).join("/"));
 var getModuleNameFromPath = (kind, modulePath) => {
-  const dirname = path9.basename(modulePath);
+  const dirname = path11.basename(modulePath);
   return kind === "service" ? dirname.replace(/^_+/, "") : dirname;
 };
 async function assertScanConvention(exec, libRoot) {
@@ -2052,24 +2268,24 @@ async function assertScanConvention(exec, libRoot) {
     for (const filename of await exec.readdir(facet)) {
       const shadow = facetIndexShadowOf(`${facet}/${filename}`);
       if (shadow)
-        addViolation(path9.join(facet, filename), shadow);
+        addViolation(path11.join(facet, filename), shadow);
     }
   if (exec.type === "lib")
     for (const { relativePath, reason } of await exec.getPageConventionViolations())
       addViolation(relativePath, reason);
   for (const filename of libRoot.files)
     if (!isAllowedLibFacetRootFile(filename))
-      addViolation(path9.join("lib", filename), "unsupported lib facet root file");
+      addViolation(path11.join("lib", filename), libFacetRootHintOf(filename) ?? "unsupported lib facet root file");
   for (const dirname of libRoot.dirs)
     if (dirname.startsWith("__") && !internalLibDirs.has(dirname))
-      addViolation(path9.join("lib", dirname), "unsupported internal lib folder");
+      addViolation(path11.join("lib", dirname), "unsupported internal lib folder");
   const databaseDirs = libRoot.dirs.filter((dirname) => !dirname.startsWith("_"));
   const serviceDirs = libRoot.dirs.filter((dirname) => dirname.startsWith("_") && !dirname.startsWith("__"));
   const scalarDirs = await exec.readdir("lib/__scalar");
   await Promise.all([
-    ...databaseDirs.map((dirname) => validateModuleFiles(exec, violations, "database", path9.join("lib", dirname))),
-    ...serviceDirs.map((dirname) => validateModuleFiles(exec, violations, "service", path9.join("lib", dirname))),
-    ...scalarDirs.map((dirname) => validateModuleFiles(exec, violations, "scalar", path9.join("lib/__scalar", dirname)))
+    ...databaseDirs.map((dirname) => validateModuleFiles(exec, violations, "database", path11.join("lib", dirname))),
+    ...serviceDirs.map((dirname) => validateModuleFiles(exec, violations, "service", path11.join("lib", dirname))),
+    ...scalarDirs.map((dirname) => validateModuleFiles(exec, violations, "scalar", path11.join("lib/__scalar", dirname)))
   ]);
   if (violations.length > 0) {
     throw new Error(`[scan-convention]
@@ -2081,19 +2297,21 @@ async function validateModuleFiles(exec, violations, kind, modulePath) {
   const { files, dirs } = await exec.getFilesAndDirs(modulePath);
   const moduleName = getModuleNameFromPath(kind, modulePath);
   dirs.forEach((dirname) => {
-    violations.push(`${getScanPath(exec, path9.join(modulePath, dirname))}: unsupported module folder`);
+    violations.push(`${getScanPath(exec, path11.join(modulePath, dirname))}: unsupported module folder`);
   });
   const uiModuleName = moduleName[0].toUpperCase() + moduleName.slice(1);
   for (const filename of files) {
-    const scanPath = getScanPath(exec, path9.join(modulePath, filename));
-    if (filename === "index.ts" || filename === "index.tsx" || /\.(test|spec)\.(ts|tsx)$/.test(filename))
+    const scanPath = getScanPath(exec, path11.join(modulePath, filename));
+    if (filename === "index.ts" || filename === "index.tsx")
       continue;
     if (filename === `${moduleName}.abstract.md`)
       continue;
-    const uiMatch = filename.match(/^([A-Z][A-Za-z0-9]+)\.([A-Z][A-Za-z0-9]*)\.tsx$/);
-    const match = uiMatch ?? filename.match(/^([a-z][a-zA-Z0-9]*)\.([a-z][a-z0-9]*)\.ts$/);
+    const testTarget = moduleTestTargetOf(filename);
+    const sourceName = testTarget ?? filename;
+    const uiMatch = sourceName.match(/^([A-Z][A-Za-z0-9]+)\.([A-Z][A-Za-z0-9]*)\.tsx$/);
+    const match = uiMatch ?? sourceName.match(/^([a-z][a-zA-Z0-9]*)\.([a-z][a-z0-9]*)\.ts$/);
     if (!match) {
-      violations.push(`${scanPath}: unsupported module file`);
+      violations.push(`${scanPath}: ${testTarget ? moduleTestHint : "unsupported module file"}`);
       continue;
     }
     const [, fileModuleName, fileType] = match;
@@ -2101,7 +2319,7 @@ async function validateModuleFiles(exec, violations, kind, modulePath) {
     if (fileModuleName !== expectedName)
       violations.push(`${scanPath}: module name mismatch: expected '${expectedName}', got '${fileModuleName}'`);
     if (!(uiMatch ? moduleUiFileTypes : moduleNonUiFileTypes)[kind].has(fileType))
-      violations.push(`${scanPath}: unsupported ${kind}${uiMatch ? " UI" : ""} file`);
+      violations.push(`${scanPath}: ${testTarget ? moduleTestHint : `unsupported ${kind}${uiMatch ? " UI" : ""} file`}`);
   }
 }
 
@@ -2158,16 +2376,16 @@ class ScanInfo {
       }
     };
     await Promise.all([
-      ...databaseDirs.map((name) => collect(path9.join("lib", name), name, "databases")),
-      ...serviceDirs.map((dirname) => collect(path9.join("lib", dirname), dirname.slice(1), "services")),
-      ...scalarDirs.map((name) => collect(path9.join("lib/__scalar", name), name, "scalars"))
+      ...databaseDirs.map((name) => collect(path11.join("lib", name), name, "databases")),
+      ...serviceDirs.map((dirname) => collect(path11.join("lib", dirname), dirname.slice(1), "services")),
+      ...scalarDirs.map((name) => collect(path11.join("lib/__scalar", name), name, "scalars"))
     ]);
     const routes = exec.type === "lib" ? [] : await exec.getPageKeys();
     const common = {
       name: exec.name,
       type: exec.type,
       repoName: exec.workspace.repoName,
-      serveDomain: WorkspaceExecutor.getBaseDevEnv(path9.join(exec.workspace.workspaceRoot, ".env")).serveDomain,
+      serveDomain: WorkspaceExecutor.getBaseDevEnv(path11.join(exec.workspace.workspaceRoot, ".env")).serveDomain,
       files,
       libDeps,
       pkgDeps,
@@ -2549,10 +2767,10 @@ class Executor {
     return this.#settle(proc, target, { redStderr: true }).then(({ code, signal }) => ({ code, signal }));
   }
   getPath(filePath) {
-    if (path10.isAbsolute(filePath))
+    if (path12.isAbsolute(filePath))
       return filePath;
     if (filePath.startsWith("."))
-      return path10.join(this.cwdPath, filePath);
+      return path12.join(this.cwdPath, filePath);
     const baseParts = this.cwdPath.split(/[\\/]/).filter(Boolean);
     const targetParts = filePath.split(/[\\/]/).filter(Boolean);
     let overlapLength = 0;
@@ -2566,7 +2784,7 @@ class Executor {
       if (isOverlap)
         overlapLength = i;
     }
-    return path10.join(this.cwdPath, ...targetParts.slice(overlapLength));
+    return path12.join(this.cwdPath, ...targetParts.slice(overlapLength));
   }
   async mkdir(dirPath) {
     const writePath = this.getPath(dirPath);
@@ -2607,7 +2825,7 @@ class Executor {
     return this;
   }
   async removeDir(dirPath) {
-    const readPath = path10.join(this.getPath(dirPath), ".");
+    const readPath = path12.join(this.getPath(dirPath), ".");
     if (await FileSys2.entryExists(readPath))
       await rm3(readPath, { recursive: true, force: true });
     this.logger.verbose(`Remove directory ${readPath}`);
@@ -2615,7 +2833,7 @@ class Executor {
   }
   async writeFile(filePath, content, { overwrite = true, silent = false } = {}) {
     const writePath = this.getPath(filePath);
-    const dir = path10.dirname(writePath);
+    const dir = path12.dirname(writePath);
     if (!await FileSys2.dirExists(dir))
       await mkdir2(dir, { recursive: true });
     let contentStr = typeof content === "string" ? content : JsonFormatter.stringify(content, writePath);
@@ -2640,7 +2858,7 @@ class Executor {
     await this.writeFile(filePath, content);
   }
   async getLocalFile(targetPath) {
-    const filePath = path10.isAbsolute(targetPath) ? targetPath : targetPath.replace(this.cwdPath, "");
+    const filePath = path12.isAbsolute(targetPath) ? targetPath : targetPath.replace(this.cwdPath, "");
     const content = await this.readFile(filePath);
     return { filePath, content };
   }
@@ -2727,9 +2945,9 @@ class Executor {
       const result = await getContent.default(scanInfo ?? null, dict, options);
       if (result === null)
         return null;
-      const filename = typeof result === "object" ? result.filename : path10.basename(targetPath).replace(".js", ".ts");
+      const filename = typeof result === "object" ? result.filename : path12.basename(targetPath).replace(".js", ".ts");
       const content = typeof result === "object" ? result.content : result;
-      const convertedTargetPath = convertPath(`${path10.dirname(targetPath)}/${filename}`);
+      const convertedTargetPath = convertPath(`${path12.dirname(targetPath)}/${filename}`);
       this.logger.verbose(`Apply template ${templatePath} to ${convertedTargetPath}`);
       return this.writeFile(convertedTargetPath, content, { overwrite });
     } else if (targetPath.endsWith(".template")) {
@@ -2738,10 +2956,10 @@ class Executor {
       const convertedContent = Object.entries(dict).reduce((data, [key, value]) => data.replace(new RegExp(`<%= ${key} %>`, "g"), value), content);
       this.logger.verbose(`Apply template ${templatePath} to ${convertedTargetPath}`);
       return this.writeFile(convertedTargetPath, convertedContent, { overwrite });
-    } else if (staticTemplateFileExtensions.has(path10.extname(targetPath).toLowerCase())) {
+    } else if (staticTemplateFileExtensions.has(path12.extname(targetPath).toLowerCase())) {
       const convertedTargetPath = convertPath(targetPath);
       const writePath = this.getPath(convertedTargetPath);
-      const dirname = path10.dirname(writePath);
+      const dirname = path12.dirname(writePath);
       if (!await FileSys2.dirExists(dirname))
         await mkdir2(dirname, { recursive: true });
       await copyFile(templatePath, writePath);
@@ -2763,7 +2981,7 @@ class Executor {
     if ((await stat2(templatePath)).isFile()) {
       const fileContent = await this.#applyTemplateFile({
         templatePath,
-        targetPath: path10.join(basePath, path10.basename(templatePath)),
+        targetPath: path12.join(basePath, path12.basename(templatePath)),
         scanInfo,
         overwrite
       }, dict, options);
@@ -2771,19 +2989,19 @@ class Executor {
     } else {
       const subdirs = await readDirEntries(templatePath);
       const fileContents = (await Promise.all(subdirs.map(async (subdir) => {
-        const subpath = path10.join(templatePath, subdir);
+        const subpath = path12.join(templatePath, subdir);
         if ((await stat2(subpath)).isFile()) {
           const fileContent = await this.#applyTemplateFile({
             templatePath: subpath,
-            targetPath: path10.join(basePath, subdir),
+            targetPath: path12.join(basePath, subdir),
             scanInfo,
             overwrite
           }, dict, options);
           return fileContent ? [fileContent] : [];
         } else
           return await this._applyTemplate({
-            basePath: path10.join(basePath, subdir),
-            template: path10.join(template, subdir),
+            basePath: path12.join(basePath, subdir),
+            template: path12.join(template, subdir),
             scanInfo,
             dict,
             overwrite,
@@ -2795,8 +3013,8 @@ class Executor {
   }
   async#resolveTemplateRoot() {
     const candidates = [
-      path10.resolve(getDirname2(import.meta.url), "templates"),
-      path10.resolve(getDirname2(import.meta.url), "../cli/templates")
+      path12.resolve(getDirname2(import.meta.url), "templates"),
+      path12.resolve(getDirname2(import.meta.url), "../cli/templates")
     ];
     for (const candidate of candidates) {
       if (await FileSys2.dirExists(candidate))
@@ -2864,11 +3082,11 @@ class Executor {
   async#resolveTypecheckWorkerEntry() {
     const dirname = getDirname2(import.meta.url);
     const candidates = [
-      path10.join(process.cwd(), "pkgs/@akanjs/devkit/typecheck/typecheck.proc.ts"),
-      path10.join(process.cwd(), "node_modules/@akanjs/devkit/typecheck/typecheck.proc.ts"),
-      path10.join(dirname, "typecheck/typecheck.proc.ts"),
-      path10.join(dirname, "typecheck.proc.js"),
-      path10.join(dirname, "typecheck.proc.ts")
+      path12.join(process.cwd(), "pkgs/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path12.join(process.cwd(), "node_modules/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path12.join(dirname, "typecheck/typecheck.proc.ts"),
+      path12.join(dirname, "typecheck.proc.js"),
+      path12.join(dirname, "typecheck.proc.ts")
     ];
     for (const candidate of candidates)
       if (await Bun.file(candidate).exists())
@@ -2942,6 +3160,13 @@ class WorkspaceExecutor extends Executor {
   async scan() {
     return await WorkspaceInfo.fromExecutor(this);
   }
+  #akanConfig = null;
+  async getConfig({ refresh } = {}) {
+    if (this.#akanConfig && !refresh)
+      return this.#akanConfig;
+    this.#akanConfig = await AkanWorkspaceConfig.from(this, { bustImportCache: refresh });
+    return this.#akanConfig;
+  }
   async getApps() {
     return await this.#getDirHasFile(`${this.workspaceRoot}/apps`, "akan.config.ts");
   }
@@ -2988,7 +3213,7 @@ class WorkspaceExecutor extends Executor {
       await Promise.all(dirs.map(async (dir) => {
         if (dir.includes("_") || AVOID_DIRS.includes(dir))
           return;
-        const dirPath = path10.join(dirname, dir);
+        const dirPath = path12.join(dirname, dir);
         if ((await stat2(dirPath)).isDirectory()) {
           results.push(`${prefix}${dir}`);
           if (maxDepth > 0)
@@ -3025,9 +3250,9 @@ class WorkspaceExecutor extends Executor {
       await Promise.all(dirs.map(async (dir) => {
         if (AVOID_DIRS.includes(dir))
           return;
-        const dirPath = path10.join(dirname, dir);
+        const dirPath = path12.join(dirname, dir);
         if (await FileSys2.dirExists(dirPath)) {
-          const hasTargetFile = await FileSys2.fileExists(path10.join(dirPath, targetFilename));
+          const hasTargetFile = await FileSys2.fileExists(path12.join(dirPath, targetFilename));
           if (hasTargetFile)
             results.push(`${prefix}${dir}`);
           if (maxDepth > 0)
@@ -3086,7 +3311,7 @@ class SysExecutor extends Executor {
       return [];
     const violations = [];
     for (const entry of await this.getAllFiles("**/*", { cwd: this.getPath("page") })) {
-      const relativePath = entry.split(path10.sep).join("/");
+      const relativePath = entry.split(path12.sep).join("/");
       const reason = getPageSourceFileViolation(relativePath);
       if (reason)
         violations.push({ relativePath: `page/${relativePath}`, reason });
@@ -3181,7 +3406,7 @@ class SysExecutor extends Executor {
     await this.setPackageJson({ ...packageJson, dependencies, devDependencies });
   }
   async getLocalFile(targetPath) {
-    const filePath = path10.isAbsolute(targetPath) ? targetPath : `${this.type}s/${this.name}/${targetPath}`;
+    const filePath = path12.isAbsolute(targetPath) ? targetPath : `${this.type}s/${this.name}/${targetPath}`;
     const content = await this.workspace.readFile(filePath);
     return { filePath, content };
   }
@@ -3248,7 +3473,7 @@ class SysExecutor extends Executor {
   }
   async applyTemplate(options) {
     const scanInfo = await this.scan();
-    const fileContents = await this._applyTemplate({ ...options, scanInfo, dict: withCapitalizedDict(options.dict) });
+    const fileContents = await super.applyTemplate({ ...options, scanInfo });
     await this.scan();
     return fileContents;
   }
@@ -3269,19 +3494,19 @@ class AppExecutor extends SysExecutor {
   static from(executor, name) {
     return new AppExecutor({ workspace: executor instanceof WorkspaceExecutor ? executor : executor.workspace, name });
   }
-  static #keptOnStart = [path10.join(".akan", "cache", "bin")];
-  static #legacyNative = path10.join(".akan", "native");
+  static #keptOnStart = [path12.join(".akan", "cache", "bin")];
+  static #legacyNative = path12.join(".akan", "native");
   async#removeDevOutput(dir = ".akan") {
     const entries = await readDirEntries(this.getPath(dir)).catch(() => []);
     await Promise.all(entries.map(async (name) => {
-      const entry = path10.join(dir, name);
+      const entry = path12.join(dir, name);
       if (entry === AppExecutor.#legacyNative) {
         this.logger.warn(`apps/${this.name}/.akan/native holds native builds from before they moved to dist/native/${this.name}: upload any release waiting in its updates folders, then delete it.`);
         return;
       }
       if (AppExecutor.#keptOnStart.includes(entry))
         return;
-      if (AppExecutor.#keptOnStart.some((kept) => kept.startsWith(`${entry}${path10.sep}`)))
+      if (AppExecutor.#keptOnStart.some((kept) => kept.startsWith(`${entry}${path12.sep}`)))
         return await this.#removeDevOutput(entry);
       await this.removeDir(entry);
     }));
@@ -3405,13 +3630,13 @@ class AppExecutor extends SysExecutor {
         absolute: false,
         onlyFiles: true
       })) {
-        const segments = rel.split(path10.sep);
+        const segments = rel.split(path12.sep);
         if (segments.some((s) => s === "node_modules"))
           continue;
         const posix = `${root.keyPrefix}${segments.join("/")}`;
         if (!root.keyPrefix && libKeyPrefixes.some((prefix) => posix.startsWith(prefix)))
           continue;
-        const absPath = path10.join(root.dir, ...segments);
+        const absPath = path12.join(root.dir, ...segments);
         validatePageSourceFile(posix, { filePath: absPath });
         if (!isRouteSourceFile(posix))
           continue;
@@ -3552,7 +3777,7 @@ class AppExecutor extends SysExecutor {
   static async#linkLibAsset(targetPath, linkPath) {
     const isWindows = process.platform === "win32";
     try {
-      const target = isWindows ? targetPath : path10.relative(path10.dirname(linkPath), targetPath);
+      const target = isWindows ? targetPath : path12.relative(path12.dirname(linkPath), targetPath);
       await symlink(target, linkPath, isWindows ? "junction" : "dir");
     } catch (error) {
       if (!isWindows)
@@ -3595,7 +3820,7 @@ class AppExecutor extends SysExecutor {
         await this.writeFile(rel, content, opts);
       },
       readEnvClient: async () => {
-        const envClientPath = path10.join(this.cwdPath, "env", "env.client.ts");
+        const envClientPath = path12.join(this.cwdPath, "env", "env.client.ts");
         if (!await FileSys2.fileExists(envClientPath))
           return null;
         try {
@@ -3689,7 +3914,7 @@ class PkgExecutor extends Executor {
       return overrideVersion;
     try {
       const packageJsonPath = `pkgs/${dep}/package.json`;
-      if (!await Bun.file(path10.join(this.workspace.workspaceRoot, packageJsonPath)).exists())
+      if (!await Bun.file(path12.join(this.workspace.workspaceRoot, packageJsonPath)).exists())
         return;
       const packageJson = await this.workspace.readJson(packageJsonPath);
       if (packageJson.name === dep)
@@ -3782,4 +4007,4 @@ class ModuleExecutor extends Executor {
   }
 }
 
-export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, CLAUDE_COMMENT_RULE, binPlatforms, AsyncDefaultExportDetector, resolveSsrPageEntriesForApp, CodegenLock, Linter, LibSource, formatLibStatuses, rootAllowedFiles, rootAllowedDirs, isAllowedLibFacetRootFile, barrelFacetDirs, facetIndexShadowOf, rootEntryHintOf, isScannedRootEntry, AppInfo, Spinner, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };
+export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, CLAUDE_COMMENT_RULE, binPlatforms, ServerEnvProfile, AkanAppConfig, AkanWorkspaceConfig, AsyncDefaultExportDetector, resolveSsrPageEntriesForApp, CodegenLock, Linter, LibSource, formatLibStatuses, rootAllowedFiles, rootAllowedDirs, isAllowedLibFacetRootFile, libFacetRootHintOf, barrelFacetDirs, facetIndexShadowOf, rootEntryHintOf, isScannedRootEntry, AppInfo, Spinner, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };