@akanjs/cli 3.0.2 → 3.1.0-rc.1

package/{index-2wc41k5w.js → index-56d2g8ms.js}

@@ -2,7 +2,7 @@
 import {
   GlobalConfig,
   CloudApi
-} from "./index-94s080qm.js";
+} from "./index-pgj2rt78.js";
 
 // pkgs/@akanjs/cli/tunnel/TunnelShare.ts
 import { TunnelAgent } from "akanjs/server/tunnel";
@@ -18,7 +18,7 @@ class TunnelShare2 {
     this.grant = grant;
   }
   static async open(app, { workspace, host, port, ttlMinutes, onLost }) {
-    const api = await CloudApi.fromHost(workspace, host ?? GlobalConfig.akanCloudHost);
+    const api = await CloudApi.fromHost(workspace, await GlobalConfig.hostFor(workspace, host));
     const grant = await api.requestTunnel({ name: app.name, ...ttlMinutes ? { ttlMinutes } : {} });
     const origin = `http://localhost:${port ?? await app.getDevPort()}`;
     const agent = new TunnelAgent({

package/{index-q6ft9fkc.js → index-6jjtnhkw.js}

@@ -10,7 +10,7 @@ import {
   LibExecutor,
   PkgExecutor,
   ModuleExecutor
-} from "./index-50wb2a26.js";
+} from "./index-55mynnqs.js";
 
 // pkgs/@akanjs/devkit/commandDecorators/camelToKebabCase.ts
 var camelToKebabCase = (str) => str.replace(/([A-Z])/g, "-$1").toLowerCase();
@@ -537,9 +537,10 @@ var getInternalArgumentValue = async (argMeta, value, workspace) => {
     throw new Error(`Invalid system type: ${argMeta.type}`);
 };
 var runCommands = async (...commands) => {
+  let failureExitCode = 1;
   process.on("unhandledRejection", (error) => {
     printCliError(error);
-    process.exit(1);
+    process.exit(failureExitCode);
   });
   const __dirname2 = getDirname2(import.meta.url);
   const packageJsonCandidates = [`${path2.dirname(Bun.main)}/package.json`, `${__dirname2}/../package.json`];
@@ -576,6 +577,9 @@ It may cause unexpected behavior. Run \`akan update\` to update latest akanjs.`)
         let programCommand = program.command(commandName, {
           hidden: targetMeta.targetOption.devOnly
         });
+        const targetFailureExitCode = targetMeta.targetOption.failureExitCode;
+        if (targetFailureExitCode !== undefined)
+          programCommand.exitOverride((error) => process.exit(error.exitCode === 0 ? 0 : targetFailureExitCode));
         const [allArgMetas] = getArgMetas(command, targetMeta.key);
         for (const argMeta of allArgMetas) {
           if (argMeta.type === "Option")
@@ -598,6 +602,7 @@ It may cause unexpected behavior. Run \`akan update\` to update latest akanjs.`)
           return formatCommandHelp(command, targetMeta.key);
         };
         programCommand.action(async (...args) => {
+          failureExitCode = targetFailureExitCode ?? 1;
           if (!targetMeta.targetOption.stdio)
             Logger.rawLog();
           const cmdArgs = args.slice(0, args.length - 2);
@@ -642,7 +647,7 @@ It may cause unexpected behavior. Run \`akan update\` to update latest akanjs.`)
   }
   await program.parseAsync(process.argv).catch((error) => {
     printCliError(error);
-    process.exit(1);
+    process.exit(failureExitCode);
   });
 };
 

package/index-6w0rbr9d.js

@@ -0,0 +1,68 @@
+// @bun
+// pkgs/@akanjs/devkit/typecheck/projectTypecheck.ts
+import { mkdir, rm } from "fs/promises";
+import path from "path";
+
+class ProjectTypecheck2 {
+  projectDir;
+  workspaceRoot;
+  env;
+  static #testIncludes = ["**/*.test.ts", "**/*.test.tsx", "**/*.spec.ts", "**/*.spec.tsx"];
+  static #excludes = [".akan/**", "node_modules/**", "local/**"];
+  constructor(projectDir, workspaceRoot, env) {
+    this.projectDir = projectDir;
+    this.workspaceRoot = workspaceRoot;
+    this.env = env;
+  }
+  get typecheckDir() {
+    return path.join(this.projectDir, ".akan", "typecheck");
+  }
+  async run(entries, { clean = false, incremental = true, tests = false } = {}) {
+    const name = tests ? "tsconfig.tests" : "tsconfig";
+    await mkdir(this.typecheckDir, { recursive: true });
+    const tsconfig = {
+      extends: "../../tsconfig.json",
+      compilerOptions: { noEmit: true, incremental, tsBuildInfoFile: `./${name}.tsbuildinfo` },
+      include: [...entries, ...tests ? ProjectTypecheck2.#testIncludes.map((glob) => `../../${glob}`) : []],
+      ...tests ? { exclude: ProjectTypecheck2.#excludes.map((glob) => `../../${glob}`) } : {},
+      references: []
+    };
+    const tsconfigPath = path.join(this.typecheckDir, `${name}.json`);
+    await Bun.write(tsconfigPath, `${JSON.stringify(tsconfig, null, 2)}
+`);
+    if (clean)
+      await rm(path.join(this.typecheckDir, `${name}.tsbuildinfo`), { force: true });
+    await this.#check(tsconfigPath);
+    return tsconfigPath;
+  }
+  async#check(tsconfigPath) {
+    const proc = Bun.spawn([process.execPath, await this.#workerEntry()], {
+      cwd: this.workspaceRoot,
+      env: { ...this.env, AKAN_COMMAND_TYPE: "typecheck", AKAN_TYPECHECK_TSCONFIG: tsconfigPath },
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]);
+    if (exitCode !== 0)
+      throw new Error((stderr || stdout).trim() || `Typecheck failed with exit code ${exitCode}`);
+  }
+  async#workerEntry() {
+    const candidates = [
+      path.join(this.workspaceRoot, "pkgs/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path.join(this.workspaceRoot, "node_modules/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path.join(import.meta.dir, "typecheck.proc.js"),
+      path.join(import.meta.dir, "typecheck.proc.ts"),
+      path.join(import.meta.dir, "..", "typecheck.proc.js")
+    ];
+    for (const candidate of candidates)
+      if (await Bun.file(candidate).exists())
+        return candidate;
+    throw new Error(`[cli] typecheck worker entry not found; looked in: ${candidates.join(", ")}`);
+  }
+}
+
+export { ProjectTypecheck2 };

package/{index-hxnnfy57.js → index-8ggztp8k.js}

@@ -2,15 +2,25 @@
 import {
   getDefaultHostConfig,
   GlobalConfig,
-  CloudApi
-} from "./index-94s080qm.js";
+  CloudApi,
+  UpdatePackUpload
+} from "./index-pgj2rt78.js";
 import {
   runner
-} from "./index-q6ft9fkc.js";
+} from "./index-6jjtnhkw.js";
 import {
   WorkspaceExecutor,
   AppExecutor
-} from "./index-50wb2a26.js";
+} from "./index-55mynnqs.js";
+import {
+  NativeApp
+} from "./index-1w2qaee2.js";
+import {
+  SubspaceConfig
+} from "./index-ww9bhp67.js";
+import {
+  resolveMobileTargets
+} from "./index-q958tqqg.js";
 import {
   openBrowser
 } from "./index-9dp031by.js";
@@ -647,9 +657,11 @@ class PlatformTestRun {
 }
 
 // pkgs/@akanjs/cli/cloud/cloud.runner.ts
+import { rm } from "fs/promises";
+import os3 from "os";
 import path7 from "path";
-import { confirm, input, select } from "@inquirer/prompts";
-import { Logger, sleep } from "akanjs/common";
+import { confirm, input, password, select } from "@inquirer/prompts";
+import { Logger, PipelineNames, sleep } from "akanjs/common";
 import chalk2 from "chalk";
 import * as QRcode from "qrcode";
 
@@ -1001,14 +1013,18 @@ ${run.format(results)}
   }
   async downloadEnv(cloudApi, workspace, workspaceId) {
     await workspace.mkdir("local");
-    const localPath = await cloudApi.downloadEnv(workspaceId);
+    const localPath = await cloudApi.downloadEnv(workspaceId).catch((error) => {
+      throw CloudRunner.#refusal(error, "downloading its env archive takes the project owner's own `akan login`");
+    });
     const relativePath = path7.relative(workspace.workspaceRoot, localPath).split(path7.sep).join("/");
     await workspace.spawn("tar", ["-xf", relativePath], { cwd: workspace.workspaceRoot });
     await workspace.remove(localPath);
   }
   async uploadEnv(cloudApi, workspaceId, filePath) {
     const file = new File([Bun.file(filePath)], path7.basename(filePath));
-    await cloudApi.uploadEnv(workspaceId, file);
+    await cloudApi.uploadEnv(workspaceId, file).catch((error) => {
+      throw CloudRunner.#refusal(error, "an env archive is uploaded by a project member signed in with `akan login`");
+    });
   }
   async downloadEnvByScp(workspace) {
     const envArchivePath = "local/env.tar";
@@ -1080,6 +1096,186 @@ ${run.format(results)}
     }));
     return secretPaths.flat();
   }
+  async secretProject(workspace, subspace) {
+    if (!subspace) {
+      const workspaceId = workspace.getWorkspaceId({ allowEmpty: true });
+      if (!workspaceId)
+        throw new Error("AKAN_WORKSPACE_ID is not set in the workspace .env, so there is no project to address.");
+      return workspaceId;
+    }
+    const config = await SubspaceConfig.from(workspace);
+    if (!config)
+      throw new Error("The workspace root akan.config.ts declares no `subspace`.");
+    const [declaration] = config.select([subspace]);
+    if (!declaration?.workspaceId)
+      throw new Error(`Subspace "${subspace}" declares no workspaceId in ${SubspaceConfig.source}.`);
+    return declaration.workspaceId;
+  }
+  async readSecretValue(name, file) {
+    const raw = file ? await Bun.file(file).text() : process.stdin.isTTY ? await password({ message: `Value of ${name} (hidden; it can never be read back)`, mask: "*" }) : await Bun.stdin.text();
+    const value = raw.replace(/\r?\n$/, "");
+    if (!value)
+      throw new Error(`The value of ${name} is empty.`);
+    const bytes = new TextEncoder().encode(value).length;
+    if (bytes > CloudRunner.#secretBytes)
+      throw new Error(`The value of ${name} is ${bytes} bytes, over ${CloudRunner.#secretBytes}.`);
+    return value;
+  }
+  async uploadSecret(cloudApi, devProjectId, { name, branch, value }) {
+    CloudRunner.#assertSecretName(name);
+    CloudRunner.#assertSecretBranch(branch);
+    const saved = await cloudApi.uploadSecret(devProjectId, { scope: branch ?? "*", name, value }).catch((error) => {
+      throw CloudRunner.#refusal(error, "a secret is written by a project member signed in with `akan login`", {
+        unavailable: CloudRunner.#secretsUnavailable
+      });
+    });
+    Logger.rawLog(`Saved ${saved.name} for ${saved.scope === "*" ? "every branch" : `branch ${saved.scope}`}. Builds that start from now on use it.`);
+  }
+  async listSecrets(cloudApi, devProjectId, branch) {
+    CloudRunner.#assertSecretBranch(branch);
+    const listed = await cloudApi.listSecrets(devProjectId).catch((error) => {
+      throw CloudRunner.#refusal(error, "the secrets are listed for a project member", {
+        unavailable: CloudRunner.#secretsUnavailable
+      });
+    });
+    const secrets = listed.filter((secret) => !branch || secret.scope === "*" || secret.scope === branch);
+    Logger.rawLog(CloudRunner.formatSecrets(secrets));
+  }
+  async removeSecret(cloudApi, devProjectId, { name, branch }) {
+    CloudRunner.#assertSecretName(name);
+    CloudRunner.#assertSecretBranch(branch);
+    const removed = await cloudApi.removeSecret(devProjectId, { scope: branch ?? "*", name }).catch((error) => {
+      throw CloudRunner.#refusal(error, "a secret is removed by a project member signed in with `akan login`", {
+        unavailable: CloudRunner.#secretsUnavailable
+      });
+    });
+    Logger.rawLog(removed ? `Removed ${name} for ${branch ? `branch ${branch}` : "every branch"}.` : `No ${name} for ${branch ? `branch ${branch}` : "every branch"} to remove.`);
+  }
+  static #packRecords = ["manifest.template.json", "bundle.json", "pack.json", "compat.json"];
+  static async#tarPack(pack) {
+    const templateFile = Bun.file(path7.join(pack.out, "manifest.template.json"));
+    if (!await templateFile.exists())
+      throw new Error(`${pack.out} holds no manifest.template.json: give the folder \`akan pack-update\` wrote.`);
+    const template = await templateFile.json();
+    const hashes = new Set((template.files ?? []).map((file) => file.sha256));
+    if (![...hashes].every((hash) => typeof hash === "string" && /^[0-9a-f]{64}$/.test(hash)))
+      throw new Error(`${pack.out}/manifest.template.json lists a file whose sha256 is not 64 hex digits.`);
+    const present = await Promise.all(CloudRunner.#packRecords.map((name) => Bun.file(path7.join(pack.out, name)).exists()));
+    const entries = [
+      ...CloudRunner.#packRecords.filter((_, idx) => present[idx]),
+      ...[...hashes].map((hash) => `files/${hash}`)
+    ];
+    const base = path7.join(os3.tmpdir(), `akan-pack-${pack.app}-${pack.target}-${pack.platform}-${process.pid}`);
+    await Bun.write(`${base}.list`, entries.map((entry) => `./${entry}
+`).join(""));
+    try {
+      const tar = Bun.spawn(["tar", "-czf", `${base}.tgz`, "-C", pack.out, "-T", `${base}.list`], {
+        stdout: "ignore",
+        stderr: "pipe"
+      });
+      if (await tar.exited !== 0)
+        throw new Error(`tar of ${pack.out} failed: ${(await new Response(tar.stderr).text()).trim()}`);
+    } finally {
+      await rm(`${base}.list`, { force: true });
+    }
+    return `${base}.tgz`;
+  }
+  async pushUpdate(cloudApi, devProjectId, pack, { channel, notes }) {
+    const archive = await CloudRunner.#tarPack(pack);
+    const target = channel ?? pack.channel;
+    try {
+      const release = await new UpdatePackUpload(cloudApi, devProjectId).send(archive, { appName: pack.app, target: pack.target, platform: pack.platform, channel: target, notes }).catch((error) => {
+        throw CloudRunner.#refusal(error, "a pack is uploaded by a project member signed in with `akan login`");
+      });
+      const label = `${pack.app} ${pack.target} ${pack.platform} on channel ${target}: release ${release.id}`;
+      if (release.status === "rejected") {
+        process.exitCode = 2;
+        Logger.error(`The project rejected ${label}:
+${(release.problems ?? []).map((problem) => `  - ${problem}`).join(`
+`)}`);
+      } else if (release.status === "published")
+        Logger.rawLog(`Published ${label} (${pack.files} files, native API ${pack.nativeApi}).`);
+      else
+        Logger.rawLog(`Staged ${label} (${pack.files} files, native API ${pack.nativeApi}). Publish it from the project's release screen.`);
+      return release;
+    } finally {
+      await rm(archive, { force: true });
+    }
+  }
+  async registerBinary(cloudApi, devProjectId, app, pack, { distribution, env }) {
+    const [mobileTarget] = await resolveMobileTargets(app, pack.target);
+    if (!mobileTarget)
+      throw new Error(`Native target '${pack.target}' was not found.`);
+    const bundlePath = path7.join(new NativeApp(app, mobileTarget).outDir(pack.platform), "bundle.json");
+    const bundleFile = Bun.file(bundlePath);
+    if (!await bundleFile.exists())
+      throw new Error(`No store build at ${bundlePath}: run \`akan release-${pack.platform} ${app.name} --target ${pack.target} --env ${env}\` first.`);
+    const bundle = await bundleFile.json();
+    if (!bundle.updates)
+      throw new Error(`The store build at ${bundlePath} takes no updates: give the target native.updates.`);
+    if (bundle.nativeApi?.hash !== pack.nativeApi)
+      throw new Error(`The store build at ${bundlePath} provides native API ${bundle.nativeApi?.hash}, and this commit's pack needs ${pack.nativeApi}: build the store binary from this commit.`);
+    const archive = await CloudRunner.#tarPack(pack);
+    const channel = bundle.updates.channel ?? pack.channel;
+    const upload = new UpdatePackUpload(cloudApi, devProjectId);
+    try {
+      const binary = await upload.stage(archive, { appName: pack.app, target: pack.target, platform: pack.platform, channel, notes: null }).then((packUploadId) => upload.settle(() => cloudApi.registerAppBinary(devProjectId, {
+        appName: pack.app,
+        target: pack.target,
+        distribution,
+        bundle: bundleFile,
+        packUploadId,
+        channel
+      }))).catch((error) => {
+        throw CloudRunner.#refusal(error, "a binary is registered by a project member signed in with `akan login`");
+      });
+      Logger.rawLog(`Registered ${pack.app} ${pack.target} ${pack.platform} (${distribution}): binary ${binary.id}, native API ${pack.nativeApi}.`);
+      return binary;
+    } finally {
+      await rm(archive, { force: true });
+    }
+  }
+  static formatSecrets(secrets) {
+    if (!secrets.length)
+      return "No pipeline secrets.";
+    const rows = [...secrets].sort((a, b) => a.name.localeCompare(b.name) || a.scope.localeCompare(b.scope)).map((secret) => [
+      secret.name,
+      secret.scope === "*" ? "every branch" : secret.scope,
+      secret.updatedAt,
+      secret.updatedBy
+    ]);
+    const header = ["NAME", "SCOPE", "UPDATED", "BY"];
+    const widths = header.map((title, column) => Math.max(title.length, ...rows.map((row) => row[column]?.length ?? 0)));
+    return [header, ...rows].map((row) => row.map((cell, column) => cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd()).join(`
+`);
+  }
+  static #secretBytes = 64 * 1024;
+  static #secretBranches = ["debug", "develop", "main"];
+  static #secretsUnavailable = "The server is not configured for pipeline secrets yet.";
+  static #assertSecretName(name) {
+    const problem = PipelineNames.secretNameError(name);
+    if (problem)
+      throw new Error(problem);
+  }
+  static #assertSecretBranch(branch) {
+    if (branch !== null && !CloudRunner.#secretBranches.includes(branch))
+      throw new Error(`--branch ${branch} is not a deployed branch: ${CloudRunner.#secretBranches.join(", ")}.`);
+  }
+  static #refusal(error, who, { unavailable } = {}) {
+    const message = error instanceof Error ? error.message : String(error);
+    const status = CloudApi.statusOf(error);
+    if (status === 401)
+      return new Error("The server did not accept your sign-in: run `akan login`, then try again.");
+    if (status === 403)
+      return new Error(`The project refused: ${who}.`);
+    if (status === 400) {
+      const key = /"error"\s*:\s*"([^"]+)"/.exec(message)?.[1];
+      return new Error(`The project refused the request${key ? `: ${key}` : ""}.`);
+    }
+    if (status === 503 && unavailable)
+      return new Error(unavailable);
+    return error;
+  }
   async#syncSecretGitignore(workspace, appNames) {
     const patterns = (await Promise.all(appNames.map(async (appName) => {
       const config = await AppExecutor.from(workspace, appName).getConfig();

package/{index-zwd84m0w.js → index-8r4d7cmt.js}

@@ -1,16 +1,16 @@
 // @bun
 import {
   jsonText
-} from "./index-h9ht6s60.js";
+} from "./index-05g3jayg.js";
 import {
   akanMcpInstallTargets
-} from "./index-zyw622y1.js";
+} from "./index-2mx692qq.js";
 import {
   script
-} from "./index-q6ft9fkc.js";
+} from "./index-6jjtnhkw.js";
 import {
   ContextRunner2
-} from "./index-j38qkvkk.js";
+} from "./index-ae5pwhgs.js";
 
 // pkgs/@akanjs/cli/context/context.script.ts
 import { Logger } from "akanjs/common";

package/{index-j38qkvkk.js → index-ae5pwhgs.js}

@@ -1,13 +1,13 @@
 // @bun
 import {
   AppExecutor
-} from "./index-50wb2a26.js";
+} from "./index-55mynnqs.js";
 import {
   jsonText,
   createWorkflowBaselineSummary,
   buildAkanModuleContextIndex,
   toolingRolloutGate
-} from "./index-h9ht6s60.js";
+} from "./index-05g3jayg.js";
 import {
   buildResourceList,
   codexMcpConfigPath,
@@ -17,25 +17,27 @@ import {
   upsertCodexMcpServerBlock,
   renderDoctorText,
   AkanContextAnalyzer
-} from "./index-zyw622y1.js";
+} from "./index-2mx692qq.js";
 import {
   runner
-} from "./index-q6ft9fkc.js";
+} from "./index-6jjtnhkw.js";
 import {
-  getMobileTargets,
-  appIdsOf,
   NativeApp,
   isPlaceholderAppId
-} from "./index-jk9xnck6.js";
+} from "./index-1w2qaee2.js";
 import {
   Prompter2
 } from "./index-zzvvc845.js";
 import {
   RepairRunner
-} from "./index-hp3stk1m.js";
+} from "./index-fm46xrf1.js";
 import {
   WorkflowRunner
-} from "./index-bsv901fd.js";
+} from "./index-rwq3ekqc.js";
+import {
+  getMobileTargets,
+  appIdsOf
+} from "./index-q958tqqg.js";
 
 // pkgs/@akanjs/devkit/akanMcpContract.ts
 import path from "path";
@@ -947,7 +949,7 @@ ${payload}`);
       "add-enum-field": "`akan add-enum-field --app <app-or-lib> --module <module> --field <field> --values a,b --format json` adds an enum field to source constant/dictionary files without editing generated files.",
       sync: "`akan sync <app-or-lib>` refreshes generated Akan files from source conventions.",
       lint: "`akan lint <app-or-lib-or-pkg>` runs Biome linting after preparing generated files.",
-      typecheck: "`akan typecheck <app-name>` runs an application typecheck after preparing generated files.",
+      typecheck: "`akan typecheck <app-or-lib>` typechecks an app or a library after preparing generated files, its tests and specs included (`--tests false` to leave them out; a build does).",
       test: "`akan test <app-or-lib-or-pkg>` prepares the target and runs its tests.",
       build: "`akan build <app-name>` creates a production build after preparing generated files.",
       doctor: "`akan doctor --strict --format json` reports agent-readable workspace convention diagnostics and validation hints.",

package/{index-gtjgnv36.js → index-aprt7pkz.js}

@@ -9,7 +9,7 @@ import {
 import {
   AsyncDefaultExportDetector,
   resolveSsrPageEntriesForApp
-} from "./index-50wb2a26.js";
+} from "./index-55mynnqs.js";
 
 // pkgs/@akanjs/devkit/artifact/routeSeedIndex.ts
 import path from "path";
@@ -2103,13 +2103,7 @@ import path11 from "path";
 var DEFAULT_INCLUDE = ["akanjs/", "@apps/", "@libs/"];
 var DEFAULT_EXCLUDE_EXACT = new Set(["akanjs/webkit", "@akanjs/cli", "@akanjs/devkit"]);
 var DEFAULT_EXCLUDE_PREFIX = ["@akanjs/cli/", "@akanjs/devkit/"];
-var OPTIONAL_BACKEND_EXTERNAL_EXACT = new Set([
-  "@libsql/client",
-  "bullmq",
-  "ioredis",
-  "postgres",
-  "protobufjs"
-]);
+var OPTIONAL_BACKEND_EXTERNAL_EXACT = new Set(["bullmq", "ioredis", "postgres", "protobufjs"]);
 var RUNTIME_EXTERNAL_EXACT = new Set([
   "react",
   "react-dom",
@@ -2319,10 +2313,12 @@ class PagesBundleBuilder {
   #command;
   #pageEntries;
   #started = Date.now();
-  constructor(app, command = "start", pageEntries) {
+  #serverEnv;
+  constructor(app, command = "start", pageEntries, serverEnv) {
     this.#app = app;
     this.#command = command;
     this.#pageEntries = pageEntries;
+    this.#serverEnv = serverEnv;
   }
   async build() {
     const akanConfig = await this.#app.getConfig();
@@ -2349,6 +2345,7 @@ class PagesBundleBuilder {
       define: bundleDefine(this.#app, this.#command, "ssr"),
       metafile: dev,
       plugins: [
+        ...this.#serverEnv ? [this.#serverEnv] : [],
         PagesBundleBuilder.createPagesEntryPlugin(entrySource),
         PagesBundleBuilder.createCssStubPlugin(),
         PagesBundleBuilder.createServerUseClientFetchPlugin(),

package/{index-1bjkfvm9.js → index-c1x0be5j.js}

@@ -2,12 +2,12 @@
 import {
   runner,
   script
-} from "./index-q6ft9fkc.js";
+} from "./index-6jjtnhkw.js";
 import {
   LibSource,
   formatLibStatuses,
   LibExecutor
-} from "./index-50wb2a26.js";
+} from "./index-55mynnqs.js";
 
 // pkgs/@akanjs/cli/library/library.script.ts
 import { Logger } from "akanjs/common";

package/{index-z750gk1j.js → index-c2yrsxdh.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   resolveSsrPageEntriesForApp
-} from "./index-50wb2a26.js";
+} from "./index-55mynnqs.js";
 import {
   computeRouteSeedIndex,
   saveRouteSeedIndex,
@@ -16,7 +16,7 @@ import {
   CsrEntryFiles,
   PagesEntrySourceGenerator,
   PagesBundleBuilder
-} from "./index-gtjgnv36.js";
+} from "./index-aprt7pkz.js";
 import {
   SOURCE_EXTS
 } from "./index-k9rrten6.js";
@@ -135,10 +135,12 @@ class CsrArtifactBuilder {
   #app;
   #command;
   #lang;
-  constructor(app, command = "start", lang = "en") {
+  #cssAssets;
+  constructor(app, command = "start", lang = "en", { cssAssets = null } = {}) {
     this.#app = app;
     this.#command = command;
     this.#lang = lang;
+    this.#cssAssets = cssAssets;
   }
   async build() {
     const pageKeys = await this.#app.getPageKeys();
@@ -238,6 +240,8 @@ void bootCsr(pages);
     ];
   }
   async#loadCssAssets() {
+    if (this.#cssAssets)
+      return this.#cssAssets;
     const artifactFile = Bun.file(path2.join(this.#artifactDir, "base-artifact.json"));
     if (!await artifactFile.exists())
       return {};
@@ -355,10 +359,10 @@ import { compile } from "tailwindcss";
 
 // pkgs/@akanjs/devkit/frontendBuild/cssCandidateCache.ts
 import { stat } from "fs/promises";
-var CANDIDATE_RE = /-?(?:[\w@]|\[[^\]\s]+\])[\w:/.-]*(?:\[[^\]\s]+\][\w:/.-]*)*/g;
+var CANDIDATE_RE = /-?(?:[\w@]|\[[^\]\s]+\])[\w:/.-]*(?:(?:\[[^\]\s]+\]|\((?:[a-z-]+:)?--[^)\s]+\))[\w:/.-]*)*/g;
 
 class CssCandidateCache {
-  static #version = 3;
+  static #version = 4;
   #path;
   #entries = new Map;
   #dirty = false;
@@ -1604,9 +1608,11 @@ class SsrBaseArtifactBuilder {
   #artifactDir;
   #absArtifactDir;
   #started = Date.now();
-  constructor(app, command = "start") {
+  #serverEnv;
+  constructor(app, command = "start", { serverEnv } = {}) {
     this.#app = app;
     this.#command = command;
+    this.#serverEnv = serverEnv;
     this.#artifactDir = `${command === "build" ? app.dist.cwdPath : app.cwdPath}/.akan/artifact`;
     this.#absArtifactDir = path8.resolve(this.#artifactDir);
   }
@@ -1620,7 +1626,7 @@ class SsrBaseArtifactBuilder {
     this.#app.verbose(`[base-artifact] discovered ${pageKeys.length} route files under ${this.#app.cwdPath}/page`);
     const pageEntries = await resolveSsrPageEntriesForApp(this.#app, pageKeys);
     const { cssCompiler, optimizedFonts, cssAssets } = await this.#buildStyleAssets();
-    const pagesBundle = await new PagesBundleBuilder(this.#app, this.#command, pageEntries).build();
+    const pagesBundle = await new PagesBundleBuilder(this.#app, this.#command, pageEntries, this.#serverEnv).build();
     this.#app.verbose(`[base-artifact] pages bundle -> ${pagesBundle.bundlePath} (buildId=${pagesBundle.buildId}, splitting=${pagesBundle.splitting}, entry=${pagesBundle.entryBytes} bytes, outputs=${pagesBundle.outputCount}, chunks=${pagesBundle.chunkCount}, total=${pagesBundle.outputBytes} bytes)`);
     const seedIndex = computeRouteSeedIndex(pageEntries);
     const seedIndexPath = await saveRouteSeedIndex(this.#absArtifactDir, seedIndex, {

package/{index-cb6yc5mb.js → index-c76k723e.js}

@@ -2,12 +2,12 @@
 import {
   runner,
   script
-} from "./index-q6ft9fkc.js";
+} from "./index-6jjtnhkw.js";
 import {
   generatedFilesForSync,
   createPassedPrimitiveReport,
   scalarChangedFiles
-} from "./index-h9ht6s60.js";
+} from "./index-05g3jayg.js";
 import {
   pluralizeName
 } from "./index-nz8prx9g.js";

package/{index-6keyf4sg.js → index-ctanya41.js}

@@ -1,12 +1,12 @@
 // @bun
 import {
   script
-} from "./index-q6ft9fkc.js";
+} from "./index-6jjtnhkw.js";
 import {
   AppExecutor,
   LibExecutor,
   ModuleExecutor
-} from "./index-50wb2a26.js";
+} from "./index-55mynnqs.js";
 import {
   workflowStatus,
   compactDiagnostics,
@@ -41,10 +41,10 @@ import {
   hasSignalFactoryEntry,
   insertSignalFactoryEntry,
   addFieldUiPolicyForType
-} from "./index-h9ht6s60.js";
+} from "./index-05g3jayg.js";
 import {
   ModuleScript
-} from "./index-f4e08ptp.js";
+} from "./index-e0cvze1s.js";
 
 // pkgs/@akanjs/cli/primitive/primitive.script.ts
 import { capitalize, lowerlize } from "akanjs/common";

package/{index-f4e08ptp.js → index-e0cvze1s.js}

@@ -2,10 +2,10 @@
 import {
   runner,
   script
-} from "./index-q6ft9fkc.js";
+} from "./index-6jjtnhkw.js";
 import {
   ModuleExecutor
-} from "./index-50wb2a26.js";
+} from "./index-55mynnqs.js";
 import {
   sourceFile,
   moduleSourcePaths,
@@ -13,10 +13,10 @@ import {
   createPassedPrimitiveReport,
   bilingualLabelForField,
   bilingualDescriptionForField
-} from "./index-h9ht6s60.js";
+} from "./index-05g3jayg.js";
 import {
   PageScript
-} from "./index-g38nhv87.js";
+} from "./index-2etcv0sc.js";
 import {
   pluralizeName
 } from "./index-nz8prx9g.js";