@akanjs/cli 3.1.0-rc.0 → 3.1.0-rc.2

package/{index-55mynnqs.js → index-2etqq75t.js}

@@ -4,94 +4,336 @@ import {
   FileSys2
 } from "./index-52w0fvh8.js";
 
-// pkgs/@akanjs/devkit/transforms/serverEnvProfile.ts
+// pkgs/@akanjs/devkit/typecheck/projectTypecheck.ts
+import { mkdir, rm } from "fs/promises";
 import path from "path";
-var secretKey = /password|passwd|passphrase|^pass$|token|jwt|authorization|cookie|secret|api[-_]?key|private[-_]?key|access[-_]?key|auth[-_]?key|hash[-_]?key|webhook|cred|iap[-_]?verify|service[-_]?account/i;
+
+class ProjectTypecheck2 {
+  projectDir;
+  workspaceRoot;
+  env;
+  static #testIncludes = ["**/*.test.ts", "**/*.test.tsx", "**/*.spec.ts", "**/*.spec.tsx"];
+  static #excludes = [".akan/**", "node_modules/**", "local/**"];
+  constructor(projectDir, workspaceRoot, env) {
+    this.projectDir = projectDir;
+    this.workspaceRoot = workspaceRoot;
+    this.env = env;
+  }
+  get typecheckDir() {
+    return path.join(this.projectDir, ".akan", "typecheck");
+  }
+  async run(entries, { clean = false, incremental = true, tests = false } = {}) {
+    const name = tests ? "tsconfig.tests" : "tsconfig";
+    await mkdir(this.typecheckDir, { recursive: true });
+    const tsconfig = {
+      extends: "../../tsconfig.json",
+      compilerOptions: { noEmit: true, incremental, tsBuildInfoFile: `./${name}.tsbuildinfo` },
+      include: [...entries, ...tests ? ProjectTypecheck2.#testIncludes.map((glob) => `../../${glob}`) : []],
+      ...tests ? { exclude: ProjectTypecheck2.#excludes.map((glob) => `../../${glob}`) } : {},
+      references: []
+    };
+    const tsconfigPath = path.join(this.typecheckDir, `${name}.json`);
+    await Bun.write(tsconfigPath, `${JSON.stringify(tsconfig, null, 2)}
+`);
+    if (clean)
+      await rm(path.join(this.typecheckDir, `${name}.tsbuildinfo`), { force: true });
+    await this.#check(tsconfigPath);
+    return tsconfigPath;
+  }
+  async#check(tsconfigPath) {
+    const proc = Bun.spawn([process.execPath, await ProjectTypecheck2.workerEntry(this.workspaceRoot)], {
+      cwd: this.workspaceRoot,
+      env: { ...this.env, AKAN_COMMAND_TYPE: "typecheck", AKAN_TYPECHECK_TSCONFIG: tsconfigPath },
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]);
+    if (exitCode !== 0)
+      throw new Error((stderr || stdout).trim() || `Typecheck failed with exit code ${exitCode}`);
+  }
+  static async workerEntry(workspaceRoot) {
+    const candidates = [
+      path.join(workspaceRoot, "pkgs/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path.join(workspaceRoot, "node_modules/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path.join(import.meta.dir, "typecheck.proc.js"),
+      path.join(import.meta.dir, "typecheck.proc.ts"),
+      path.join(import.meta.dir, "..", "typecheck.proc.js")
+    ];
+    for (const candidate of candidates)
+      if (await Bun.file(candidate).exists())
+        return candidate;
+    throw new Error(`[devkit] typecheck worker entry not found; looked in: ${candidates.join(", ")}`);
+  }
+}
+
+// pkgs/@akanjs/devkit/transforms/serverEnvProfile.ts
+import { existsSync, realpathSync } from "fs";
+import path2 from "path";
+import { Logger, toError } from "akanjs/common";
 
 class ServerEnvProfile {
   static namePattern = /^[a-z][a-zA-Z0-9-]*$/;
+  static envFilePattern = /[\\/]env[\\/]env\.server\.[A-Za-z0-9-]+\.ts$/;
   static fileName(environment, profile) {
     return `env.server.${environment}.${profile}.ts`;
   }
   static profileFileOf(file, profile) {
     return file.replace(/\.ts$/, `.${profile}.ts`);
   }
-  static strip(value, at = "", underSecret = false) {
-    if (typeof value === "string")
-      return underSecret && value.trim() ? { value: undefined, stripped: [at] } : { value, stripped: [] };
-    if (!value || typeof value !== "object")
-      return { value, stripped: [] };
-    const stripped = [];
-    const strip = (key, child) => {
-      const result = ServerEnvProfile.strip(child, at ? `${at}.${key}` : key, underSecret || secretKey.test(key));
-      stripped.push(...result.stripped);
-      return result.value;
-    };
-    if (Array.isArray(value))
-      return { value: value.map((child, idx) => strip(String(idx), child)), stripped };
-    const kept = Object.fromEntries(Object.entries(value).map(([key, child]) => [key, strip(key, child)]).filter(([, child]) => child !== undefined));
-    return { value: kept, stripped };
-  }
-  static secretValues(value, at = "", underSecret = false) {
-    if (typeof value === "string") {
-      const named = secretKey.test(at.split(".").at(-1) ?? "");
-      const distinct = value.length >= 16 && !/^https?:\/\//.test(value) && !/^[a-z]+(?:[._-][a-z]+)*$/.test(value);
-      return underSecret && value.length >= 8 && (named || distinct) ? [{ path: at, value }] : [];
+  static #url(value) {
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(value))
+      return null;
+    try {
+      return new URL(value);
+    } catch {
+      return null;
     }
-    if (!value || typeof value !== "object")
-      return [];
-    return Object.entries(value).flatMap(([key, child]) => ServerEnvProfile.secretValues(child, at ? `${at}.${key}` : key, underSecret || secretKey.test(key)));
   }
-  static secretPaths(value, at = "", underSecret = false) {
+  static #carriesCredential(url) {
+    return !!url.password || [...url.searchParams.keys()].some((name) => Logger.isSecretKey(name));
+  }
+  static #isCredentialUrl(value) {
+    const url = ServerEnvProfile.#url(value);
+    return !!url && ServerEnvProfile.#carriesCredential(url);
+  }
+  static #isSecret(value, underSecret) {
+    return underSecret && !!value.trim() || ServerEnvProfile.#isCredentialUrl(value);
+  }
+  static #fold(value, fold, at = "", underSecret = false) {
     if (typeof value === "string")
-      return underSecret && value.trim() ? [at] : [];
+      return fold.text(value, at, underSecret);
     if (!value || typeof value !== "object")
-      return [];
-    return Object.entries(value).flatMap(([key, child]) => ServerEnvProfile.secretPaths(child, at ? `${at}.${key}` : key, underSecret || secretKey.test(key)));
+      return fold.other(value);
+    return fold.node(value, Object.entries(value).map(([key, child]) => [
+      key,
+      ServerEnvProfile.#fold(child, fold, at ? `${at}.${key}` : key, underSecret || Logger.isSecretKey(key))
+    ]));
+  }
+  static #collect(text) {
+    return { text, other: () => [], node: (_, children) => children.flatMap(([, found]) => found) };
+  }
+  static strip(value) {
+    return ServerEnvProfile.#fold(value, {
+      text: (text, at, underSecret) => ServerEnvProfile.#isSecret(text, underSecret) ? { value: undefined, stripped: [at] } : { value: text, stripped: [] },
+      other: (other) => ({ value: other, stripped: [] }),
+      node: (node, children) => {
+        const stripped = children.flatMap(([, result]) => result.stripped);
+        if (Array.isArray(node))
+          return {
+            value: children.flatMap(([, result]) => result.value === undefined || result.stripped.length && typeof result.value === "object" && !Object.keys(result.value ?? {}).length ? [] : [result.value]),
+            stripped
+          };
+        return {
+          value: Object.fromEntries(children.flatMap(([key, result]) => result.value === undefined ? [] : [[key, result.value]])),
+          stripped
+        };
+      }
+    });
   }
-  static async evaluate(file, cwd) {
+  static secretValues(value) {
+    return ServerEnvProfile.#fold(value, ServerEnvProfile.#collect((text, at, underSecret) => {
+      const url = ServerEnvProfile.#url(text);
+      if (url)
+        return ServerEnvProfile.#carriesCredential(url) || underSecret && (/webhook/i.test(at) || ServerEnvProfile.distinctive(text)) ? [...new Set([text, url.password])].filter((part) => part.length >= 8).map((part) => ({ path: at, value: part })) : [];
+      const named = Logger.isSecretKey(at.split(".").at(-1) ?? "");
+      return underSecret && text.length >= 8 && (named || ServerEnvProfile.distinctive(text)) ? [{ path: at, value: text }] : [];
+    }));
+  }
+  static distinctive(value) {
+    const url = ServerEnvProfile.#url(value);
+    if (url)
+      return ServerEnvProfile.#carriesCredential(url) || [...url.pathname.split("/"), ...url.searchParams.values()].some((part) => ServerEnvProfile.distinctive(part));
+    return value.length >= 16 && !/^https?:\/\//.test(value) && !/^[a-z]+(?:[._-][a-z]+)*$/.test(value);
+  }
+  static secretPaths(value) {
+    return ServerEnvProfile.#fold(value, ServerEnvProfile.#collect((text, at, underSecret) => ServerEnvProfile.#isSecret(text, underSecret) ? [at] : []));
+  }
+  static async evaluate(file, cwd, load) {
+    return (await ServerEnvProfile.#evaluated(file, cwd, load)).value;
+  }
+  static async#evaluated(file, cwd, load) {
+    const pattern = (regex, flags = "") => `new RegExp(${JSON.stringify(regex.source)}, "${flags}")`;
+    const literal = /(["'`])((?:\\[\s\S]|(?!\1)[^\\])*)\1/;
+    const frame = /^\s*at (?:[^(]*\()?(.+):(\d+):(\d+)\)?\s*$/;
     const script = [
-      "const { env } = await import(process.env.AKAN_PROFILE_ENV_FILE);",
-      'const plain = (_, value) => (typeof value === "function" || typeof value === "symbol" ? undefined : typeof value === "bigint" ? String(value) : value);',
-      "process.stdout.write(JSON.stringify(env ?? null, plain));"
+      "const waiting = new Map();",
+      'process.on("message", ({ load, error, loader, contents }) => {',
+      "  const reply = waiting.get(load);",
+      "  waiting.delete(load);",
+      "  if (error === undefined) reply?.resolve({ loader, contents });",
+      "  else reply?.reject(new Error(error));",
+      "});",
+      "if (process.env.AKAN_PROFILE_ENV_LOAD)",
+      "  Bun.plugin({",
+      '    name: "akan-server-env",',
+      "    setup(build) {",
+      "      build.onLoad({ filter: new RegExp(process.env.AKAN_PROFILE_ENV_LOAD) }, (args) =>",
+      "        new Promise((resolve, reject) => {",
+      "          waiting.set(args.path, { resolve, reject });",
+      "          process.send({ load: args.path });",
+      "        }));",
+      "    },",
+      "  });",
+      `const literal = ${pattern(literal, "g")};`,
+      `const interpolation = ${pattern(/\$\{[^}]*\}/)};`,
+      `const frameOf = ${pattern(frame)};`,
+      `const evaluating = ${pattern(/\s*\(evaluating '[\s\S]*'\)\s*$/)};`,
+      "const literalsOf = async (file) =>",
+      '  [...(await Bun.file(file).text().catch(() => "")).matchAll(literal)].flatMap((match) => match[2].split(interpolation));',
+      "const describe = async (error) => {",
+      "  const first = Array.isArray(error?.errors) && error.errors.length ? error.errors[0] : error;",
+      '  const frame = String(first?.stack ?? "").split("\\n").map((line) => frameOf.exec(line)).find(Boolean);',
+      "  const at = first?.position?.file ? [first.position.file, first.position.line, first.position.column] : frame ? frame.slice(1, 4) : [];",
+      "  const files = [process.env.AKAN_PROFILE_ENV_FILE, at[0]].filter(Boolean);",
+      "  const literals = (await Promise.all(files.map(literalsOf))).flat().filter((part) => part.length >= 4);",
+      '  let message = String(first?.message ?? first).replace(evaluating, "");',
+      "  for (const part of literals.sort((a, b) => b.length - a.length))",
+      '    message = message.split(part).join("[redacted]");',
+      '  const name = typeof first?.name === "string" && /^[A-Za-z]+$/.test(first.name) ? first.name : "Error";',
+      '  return name + ": " + message.slice(0, 200) + (at.length ? " (at " + at.join(":") + ")" : "");',
+      "};",
+      "try {",
+      "  const { env } = await import(process.env.AKAN_PROFILE_ENV_FILE);",
+      "  const lossy = [];",
+      "  const walk = (value, at) => {",
+      '    if (typeof value === "function" || typeof value === "symbol" || typeof value === "bigint" || (typeof value === "number" && !Number.isFinite(value))) return lossy.push(at);',
+      '    if (!value || typeof value !== "object") return;',
+      "    const proto = Object.getPrototypeOf(value);",
+      "    if (!Array.isArray(value) && proto !== Object.prototype && proto !== null) return lossy.push(at);",
+      '    for (const [key, child] of Object.entries(value)) walk(child, at ? at + "." + key : key);',
+      "  };",
+      '  walk(env, "");',
+      '  const plain = (_, value) => (typeof value === "function" || typeof value === "symbol" ? undefined : typeof value === "bigint" ? String(value) : value);',
+      '  process.send({ env: JSON.stringify(env ?? null, plain) ?? "null", lossy }, undefined, undefined, () => process.disconnect());',
+      "} catch (error) {",
+      "  process.exitCode = 1;",
+      "  process.send({ failure: await describe(error) }, undefined, undefined, () => process.disconnect());",
+      "}"
     ].join(`
 `);
+    let sent;
+    let failure;
+    let loadError;
     const child = Bun.spawn([process.execPath, "--eval", script], {
       cwd,
-      env: { PATH: process.env.PATH ?? "", HOME: process.env.HOME ?? "", AKAN_PROFILE_ENV_FILE: file },
-      stdout: "pipe",
-      stderr: "pipe"
+      env: {
+        PATH: process.env.PATH ?? "",
+        HOME: process.env.HOME ?? "",
+        AKAN_PROFILE_ENV_FILE: file,
+        ...load ? { AKAN_PROFILE_ENV_LOAD: ServerEnvProfile.envFilePattern.source } : {}
+      },
+      stdout: "ignore",
+      stderr: "ignore",
+      serialization: "json",
+      ipc: (message, subprocess) => {
+        if ("env" in message) {
+          sent = message;
+          return;
+        }
+        if ("failure" in message) {
+          failure = message.failure;
+          return;
+        }
+        if (!load)
+          return;
+        const requested = message.load;
+        load(requested).then(({ loader, contents }) => ({ load: requested, loader, contents }), (error) => {
+          loadError ??= error;
+          return { load: requested, error: toError(error).message };
+        }).then((reply) => subprocess.send(reply)).catch(() => {
+          return;
+        });
+      }
     });
-    const [stdout, stderr, exitCode] = await Promise.all([
-      new Response(child.stdout).text(),
-      new Response(child.stderr).text(),
-      child.exited
-    ]);
-    if (exitCode !== 0)
-      throw new Error(`${path.basename(file)} could not be evaluated to check it for secrets:
-${stderr.trim()}`);
-    return JSON.parse(stdout || "null");
+    const exitCode = await child.exited;
+    if (exitCode !== 0 || !sent) {
+      if (loadError)
+        throw loadError;
+      throw new Error(`${path2.basename(file)} could not be evaluated to check it for secrets: ${failure ?? `its process exited with code ${exitCode} and sent nothing`}`);
+    }
+    return { value: JSON.parse(sent.env), lossy: sent.lossy };
+  }
+  static async sourceInPlaceOf(profileFile, replacedFile, profile) {
+    const contents = await Bun.file(profileFile).text();
+    const dir = path2.dirname(profileFile);
+    const replaced = ServerEnvProfile.#real(replacedFile);
+    const selfImports = new Bun.Transpiler({ loader: "ts" }).scanImports(contents).flatMap(({ path: specifier }) => {
+      try {
+        return ServerEnvProfile.#real(Bun.resolveSync(specifier, dir)) === replaced ? [specifier] : [];
+      } catch {
+        return [];
+      }
+    });
+    if (selfImports.length)
+      throw new Error(`${path2.basename(profileFile)} imports ${selfImports.join(", ")}, the file a "${profile}" build bundles it in place of, so it would import itself. Write the values it needs into it instead.`);
+    return contents;
+  }
+  static #real(file) {
+    return existsSync(file) ? realpathSync.native(file) : path2.resolve(file);
+  }
+  static async libEnvSource(file, profile, chain = []) {
+    if (chain.includes(file))
+      throw new Error(`${[...chain, file].join(" -> ")}: lib env files reach each other, which a "${profile}" build cannot swap.`);
+    const profileFile = ServerEnvProfile.profileFileOf(file, profile);
+    const libRoot = path2.dirname(path2.dirname(file));
+    if (await Bun.file(profileFile).exists()) {
+      const contents = await ServerEnvProfile.sourceInPlaceOf(profileFile, file, profile);
+      const reached = [...chain, file];
+      const value = await ServerEnvProfile.evaluate(profileFile, libRoot, (envFile) => ServerEnvProfile.#underProfile(envFile, profile, new Set, reached));
+      const secrets = ServerEnvProfile.secretPaths(value);
+      if (secrets.length)
+        throw new Error(`${profileFile} holds secret-named values, which the "${profile}" bundle carries to every computer it runs on: ${secrets.join(", ")}.`);
+      return { loader: "ts", contents, profileFile: true, stripped: [] };
+    }
+    const { exports } = new Bun.Transpiler({ loader: "ts" }).scan(await Bun.file(file).text());
+    if (exports.some((name) => name !== "env"))
+      throw new Error(`${file} exports ${exports.join(", ")}: a "${profile}" build carries only a lib env's \`env\`, so give the lib ${path2.basename(profileFile)}.`);
+    const evaluated = await ServerEnvProfile.#evaluated(file, libRoot);
+    if (evaluated.lossy.length)
+      throw new Error(`${file} holds ${evaluated.lossy.join(", ")}, which a "${profile}" build cannot carry: it bundles a lib env's defaults as JSON, which keeps no function, Map, Set, Date or class instance. Give the lib ${path2.basename(profileFile)}.`);
+    const { value, stripped } = ServerEnvProfile.strip(evaluated.value);
+    return {
+      loader: "js",
+      contents: `export const env = ${JSON.stringify(value ?? {})};
+`,
+      profileFile: false,
+      stripped
+    };
+  }
+  static async#underProfile(envFile, profile, appEnvDirs, chain) {
+    const name = path2.basename(envFile, ".ts").slice("env.server.".length);
+    if (appEnvDirs.has(path2.dirname(envFile)) || name === "type" || name === "example")
+      return { loader: "ts", contents: await Bun.file(envFile).text() };
+    const { loader, contents } = await ServerEnvProfile.libEnvSource(envFile, profile, chain);
+    return { loader, contents };
   }
   static async assertShippable({ envDir, environment, profile }) {
     if (!ServerEnvProfile.namePattern.test(profile))
       throw new Error(`The server env profile "${profile}" must be a lowercase-first name of letters, digits and dashes.`);
     const name = ServerEnvProfile.fileName(environment, profile);
-    const file = path.join(envDir, name);
+    const file = path2.join(envDir, name);
     if (!await Bun.file(file).exists())
       throw new Error(`The server env profile "${profile}" bundles env/${name} in place of env/env.server.${environment}.ts, and there is no such file.`);
-    const secrets = ServerEnvProfile.secretPaths(await ServerEnvProfile.evaluate(file, path.dirname(envDir)));
+    await ServerEnvProfile.sourceInPlaceOf(file, path2.join(envDir, `env.server.${environment}.ts`), profile);
+    const appEnvDirs = new Set([path2.resolve(envDir), realpathSync.native(envDir)]);
+    const value = await ServerEnvProfile.evaluate(file, path2.dirname(envDir), (envFile) => ServerEnvProfile.#underProfile(envFile, profile, appEnvDirs, []));
+    const secrets = ServerEnvProfile.secretPaths(value);
     if (secrets.length)
       throw new Error(`env/${name} holds secret-named values, which a profile's bundle carries to every computer it runs on: ${secrets.join(", ")}. Leave them out, or read them from the process env of the server that needs them.`);
   }
 }
 
 // pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
-import { readdir, rm } from "fs/promises";
-import path3 from "path";
+import { readdir, rm as rm2 } from "fs/promises";
+import path4 from "path";
 
 // pkgs/@akanjs/devkit/transforms/asyncDefaultExportDetector.ts
 import fs from "fs";
-import path2 from "path";
+import path3 from "path";
 
 class AsyncDefaultExportDetector {
   static #typescriptLoad;
@@ -102,7 +344,7 @@ class AsyncDefaultExportDetector {
   static async detect(moduleAbsPath) {
     try {
       const typescript = await AsyncDefaultExportDetector.#loadTypescript();
-      const source = fs.readFileSync(path2.resolve(moduleAbsPath), "utf8");
+      const source = fs.readFileSync(path3.resolve(moduleAbsPath), "utf8");
       const sourceFile = typescript.createSourceFile(moduleAbsPath, source, typescript.ScriptTarget.Latest, true, /\.[tj]sx$/.test(moduleAbsPath) ? typescript.ScriptKind.TSX : typescript.ScriptKind.TS);
       return new AsyncDefaultExportDetector(typescript).detectInSourceFile(sourceFile);
     } catch {
@@ -166,17 +408,17 @@ class AsyncDefaultExportDetector {
 
 // pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
 var LAYOUT_KEY_RE = /^\.\/(.+\/)?_layout\.(tsx|ts|jsx|js)$/;
-var IMPLICIT_LAYOUT_DIR = path3.join(".akan", "generated", "root-layouts");
-var IMPLICIT_DICT_DIR = path3.join(".akan", "generated", "dict");
-var IMPLICIT_OVERRIDES_DIR = path3.join(".akan", "generated", "overrides");
+var IMPLICIT_LAYOUT_DIR = path4.join(".akan", "generated", "root-layouts");
+var IMPLICIT_DICT_DIR = path4.join(".akan", "generated", "dict");
+var IMPLICIT_OVERRIDES_DIR = path4.join(".akan", "generated", "overrides");
 var OVERRIDES_KEY_RE = /^\.\/(.+\/)?_overrides\.(tsx|ts|jsx|js)$/;
 var importSpecifier = (fromAbsPath, toAbsPath) => {
-  const rel = path3.relative(path3.dirname(fromAbsPath), toAbsPath).split(path3.sep).join("/");
+  const rel = path4.relative(path4.dirname(fromAbsPath), toAbsPath).split(path4.sep).join("/");
   return rel.startsWith(".") ? rel : `./${rel}`;
 };
 async function writeGeneratedOverridesLayoutFile(opts) {
   const filename = `${opts.key.replace(/^\.\//, "").replace(/[^a-zA-Z0-9]+/g, "_")}.tsx`;
-  const absPath = path3.join(path3.resolve(opts.appCwdPath), IMPLICIT_OVERRIDES_DIR, filename);
+  const absPath = path4.join(path4.resolve(opts.appCwdPath), IMPLICIT_OVERRIDES_DIR, filename);
   const source = `"use client";
 import { UiOverrideProvider } from "akanjs/ui";
 import { createElement, type ReactNode } from "react";
@@ -192,7 +434,7 @@ export default function AkanUiOverridesLayout({ children }: { children?: ReactNo
 async function pruneGeneratedFiles(dirAbsPath, keepAbsPaths) {
   const keep = new Set(keepAbsPaths);
   const names = await readdir(dirAbsPath).catch(() => []);
-  await Promise.all(names.map((name) => path3.join(dirAbsPath, name)).filter((absPath) => !keep.has(absPath)).map((absPath) => rm(absPath, { force: true })));
+  await Promise.all(names.map((name) => path4.join(dirAbsPath, name)).filter((absPath) => !keep.has(absPath)).map((absPath) => rm2(absPath, { force: true })));
 }
 function getRootBoundarySegments(key) {
   const match = LAYOUT_KEY_RE.exec(key);
@@ -208,7 +450,7 @@ function implicitRootLayoutKey(segments) {
 }
 function implicitRootLayoutAbsPath(appCwdPath, segments) {
   const filename = segments.length ? `${segments.join("__")}__root_layout.tsx` : "__root_layout.tsx";
-  return path3.join(path3.resolve(appCwdPath), IMPLICIT_LAYOUT_DIR, filename);
+  return path4.join(path4.resolve(appCwdPath), IMPLICIT_LAYOUT_DIR, filename);
 }
 function isRootBoundarySegments(segments, basePaths) {
   const firstVisibleIndex = segments.findIndex((segment) => !/^\(.+\)$/.test(segment));
@@ -231,7 +473,7 @@ function findRootBoundaries(pageKeys, appCwdPath, basePaths) {
     const id = segments.join("/");
     boundaries.set(id, {
       sourceKey: key,
-      sourceAbsPath: path3.resolve(appCwdPath, "page", key.replace(/^\.\//, "")),
+      sourceAbsPath: path4.resolve(appCwdPath, "page", key.replace(/^\.\//, "")),
       segments
     });
   }
@@ -247,16 +489,16 @@ function findExplicitRootLayoutAbsPath(pageKeys, appCwdPath) {
     const segments = getRootBoundarySegments(key);
     return segments !== null && segments.length === 0;
   });
-  return rootLayoutKey ? path3.resolve(appCwdPath, "page", rootLayoutKey.replace(/^\.\//, "")) : null;
+  return rootLayoutKey ? path4.resolve(appCwdPath, "page", rootLayoutKey.replace(/^\.\//, "")) : null;
 }
 async function assertEnvClientConvention(appCwdPath, appName) {
-  const envPath = path3.join(appCwdPath, "env", "env.client.ts");
+  const envPath = path4.join(appCwdPath, "env", "env.client.ts");
   if (!await Bun.file(envPath).exists()) {
     throw new Error(`[route-convention] app "${appName}" must provide env/env.client.ts exporting "env" for generated System.Provider`);
   }
 }
 async function writeGeneratedDictionaryMacroFile(appCwdPath, appName) {
-  const absPath = path3.join(path3.resolve(appCwdPath), IMPLICIT_DICT_DIR, "useDict.ts");
+  const absPath = path4.join(path4.resolve(appCwdPath), IMPLICIT_DICT_DIR, "useDict.ts");
   await Bun.write(absPath, `import { getAllDictionary } from "@apps/${appName}/lib/dict" with { type: "macro" };
 
 export const allDictionary = getAllDictionary();
@@ -275,13 +517,13 @@ async function writeGeneratedRootLayoutFile(opts) {
 void st;
 ` : `import "@apps/${opts.appName}/client";
 `;
-  const inheritedLabel = inheritedSourceAbsPath ? path3.relative(opts.appCwdPath, inheritedSourceAbsPath) : "";
+  const inheritedLabel = inheritedSourceAbsPath ? path4.relative(opts.appCwdPath, inheritedSourceAbsPath) : "";
   const inheritedImport = inheritedSourceSpecifier ? `import * as inheritedModule from ${JSON.stringify(inheritedSourceSpecifier)};
 const inheritedLayout = resolveRouteModule(inheritedModule as never, ${JSON.stringify(inheritedLabel)}).module as LayoutModule;
 ` : `const inheritedLayout: LayoutModule = {};
 `;
   const prefix = opts.boundary.segments.find((segment) => !/^\(.+\)$/.test(segment)) ?? null;
-  const userLabel = opts.boundary.sourceAbsPath ? path3.relative(opts.appCwdPath, opts.boundary.sourceAbsPath) : "";
+  const userLabel = opts.boundary.sourceAbsPath ? path4.relative(opts.appCwdPath, opts.boundary.sourceAbsPath) : "";
   const userImport = sourceSpecifier ? `import * as userModule from ${JSON.stringify(sourceSpecifier)};
 const userLayout = resolveRouteModule(userModule as never, ${JSON.stringify(userLabel)}).module as LayoutModule;
 const UserLayout = userLayout.default as (props: LayoutProps) => ReactNode | Promise<ReactNode>;
@@ -360,8 +602,8 @@ ${layoutExports}${layoutReturn};
   return absPath;
 }
 async function resolveSsrPageEntries(opts) {
-  const absPageDir = path3.resolve(opts.appCwdPath, "page");
-  const hasSt = await Bun.file(path3.join(opts.appCwdPath, "lib", "st.ts")).exists();
+  const absPageDir = path4.resolve(opts.appCwdPath, "page");
+  const hasSt = await Bun.file(path4.join(opts.appCwdPath, "lib", "st.ts")).exists();
   const basePaths = opts.basePaths ?? [];
   const rootSourceAbsPath = findExplicitRootLayoutAbsPath(opts.pageKeys, opts.appCwdPath);
   const rootBoundaries = findRootBoundaries(opts.pageKeys, opts.appCwdPath, basePaths);
@@ -370,7 +612,7 @@ async function resolveSsrPageEntries(opts) {
     return segments !== null && isRootBoundarySegments(segments, basePaths);
   }));
   const base = await Promise.all(opts.pageKeys.filter((key) => !rootLayoutKeys.has(key)).map(async (key) => {
-    const userAbsPath = path3.resolve(absPageDir, key);
+    const userAbsPath = path4.resolve(absPageDir, key);
     if (OVERRIDES_KEY_RE.test(key)) {
       const moduleAbsPath = await writeGeneratedOverridesLayoutFile({
         appCwdPath: opts.appCwdPath,
@@ -393,10 +635,10 @@ async function resolveSsrPageEntries(opts) {
     }),
     seedAbsPaths: [...new Set([boundary.sourceAbsPath, rootSourceAbsPath].filter((absPath) => absPath !== null))]
   })));
-  const appCwdAbsPath = path3.resolve(opts.appCwdPath);
+  const appCwdAbsPath = path4.resolve(opts.appCwdPath);
   await Promise.all([
-    pruneGeneratedFiles(path3.join(appCwdAbsPath, IMPLICIT_OVERRIDES_DIR), base.filter(({ key }) => OVERRIDES_KEY_RE.test(key)).map(({ moduleAbsPath }) => moduleAbsPath)),
-    pruneGeneratedFiles(path3.join(appCwdAbsPath, IMPLICIT_LAYOUT_DIR), generated.map(({ moduleAbsPath }) => moduleAbsPath))
+    pruneGeneratedFiles(path4.join(appCwdAbsPath, IMPLICIT_OVERRIDES_DIR), base.filter(({ key }) => OVERRIDES_KEY_RE.test(key)).map(({ moduleAbsPath }) => moduleAbsPath)),
+    pruneGeneratedFiles(path4.join(appCwdAbsPath, IMPLICIT_LAYOUT_DIR), generated.map(({ moduleAbsPath }) => moduleAbsPath))
   ]);
   return [...base, ...generated].sort((a, b) => a.key.localeCompare(b.key));
 }
@@ -406,19 +648,19 @@ async function resolveSsrPageEntriesForApp(app, pageKeys) {
 }
 
 // pkgs/@akanjs/devkit/codegenLock.ts
-import { mkdir, open, readFile, rm as rm2, stat } from "fs/promises";
-import path4 from "path";
-import { Logger } from "akanjs/common";
+import { mkdir as mkdir2, open, readFile, rm as rm3, stat } from "fs/promises";
+import path5 from "path";
+import { Logger as Logger2 } from "akanjs/common";
 
 class CodegenLock {
   static fileName = "codegen.lock";
   static waitTimeoutMs = 1e4;
   static unknownHolderStaleMs = 60000;
   static #pollMs = 25;
-  static #logger = new Logger("CodegenLock");
+  static #logger = new Logger2("CodegenLock");
   static #queue = Promise.resolve();
   static pathIn(workspaceRoot) {
-    return path4.join(workspaceRoot, "local", ".akan", CodegenLock.fileName);
+    return path5.join(workspaceRoot, "local", ".akan", CodegenLock.fileName);
   }
   static async run(workspaceRoot, label, fn) {
     const ahead = CodegenLock.#queue;
@@ -448,7 +690,7 @@ class CodegenLock {
   }
   static async#withFileLock(workspaceRoot, label, fn) {
     const lockPath = CodegenLock.pathIn(workspaceRoot);
-    await mkdir(path4.dirname(lockPath), { recursive: true }).catch(() => {
+    await mkdir2(path5.dirname(lockPath), { recursive: true }).catch(() => {
       return;
     });
     const held = await CodegenLock.#acquire(lockPath, label);
@@ -456,7 +698,7 @@ class CodegenLock {
       return await fn();
     } finally {
       if (held)
-        await rm2(lockPath, { force: true }).catch(() => {
+        await rm3(lockPath, { force: true }).catch(() => {
           return;
         });
     }
@@ -493,7 +735,7 @@ class CodegenLock {
         return false;
     } else if (Date.now() - info.mtimeMs < CodegenLock.unknownHolderStaleMs)
       return false;
-    await rm2(lockPath, { force: true }).catch(() => {
+    await rm3(lockPath, { force: true }).catch(() => {
       return;
     });
     return true;
@@ -590,26 +832,27 @@ import {
   fork,
   spawn as spawn2
 } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
 import {
   copyFile,
   cp as cpEntry,
   lstat,
-  mkdir as mkdir2,
+  mkdir as mkdir3,
   readdir as readDirEntries,
   realpath,
-  rm as rm3,
+  rm as rm4,
   stat as stat2,
   symlink
 } from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 import { pathToFileURL } from "url";
 import {
   capitalize,
   getPageSourceFileViolation,
   isRouteSourceFile,
-  Logger as Logger2,
+  Logger as Logger3,
   parseRouteModuleKey,
+  toError as toError2,
   validatePageSourceFile,
   validateSubRoutePageKey
 } from "akanjs/common";
@@ -755,7 +998,7 @@ ${CLAUDE_COMMENT_RULE}
 `;
 
 // pkgs/@akanjs/devkit/akanConfig/akanBin.ts
-import path5 from "path";
+import path6 from "path";
 
 // pkgs/@akanjs/devkit/akanConfig/types.ts
 import { archs, binPlatforms, defaultAppPipeline } from "akanjs";
@@ -806,7 +1049,7 @@ class AkanBin {
     if (!archive)
       throw new Error(`${at}: file picks the executable out of an archive, and this source is none`);
     const parts = typeof file === "string" ? file.split(/[\\/]/).filter((part) => part && part !== ".") : [];
-    if (!parts.length || path5.isAbsolute(file) || parts.includes(".."))
+    if (!parts.length || path6.isAbsolute(file) || parts.includes(".."))
       throw new Error(`${at}: file must be a path inside the archive (got ${JSON.stringify(file)})`);
     return { ...resolved, file: parts.join("/") };
   }
@@ -822,12 +1065,12 @@ class AkanBin {
       throw new Error(`${at}: path must name a file`);
     if (sha256 !== undefined)
       throw new Error(`${at}: sha256 checks a download, and a path source downloads nothing`);
-    return { path: path5.resolve(baseDir, localPath) };
+    return { path: path6.resolve(baseDir, localPath) };
   }
 }
 // pkgs/@akanjs/devkit/akanConfig/akanConfig.ts
 import fs2 from "fs";
-import path6 from "path";
+import path7 from "path";
 import { fileURLToPath } from "url";
 import { DatabaseModes, normalizeRoutePrefix } from "akanjs/base";
 import { resolveAkanI18nConfig } from "akanjs/common";
@@ -915,6 +1158,9 @@ var dedupeDockerRuns = (runs) => {
   return [...byKey.values()];
 };
 
+class LibConfigRefusal extends Error {
+}
+
 class AkanAppConfig {
   app;
   rootPackageJson;
@@ -1025,6 +1271,8 @@ class AkanAppConfig {
       const { updates } = merged;
       if (updates && (!updates.url || !(updates.publicKey || updates.publicKeys?.length)))
         throw new Error(`${where}.updates in ${configPath} has no url or publicKeys${named ? "; give them in native.updates or the target's own" : ""}.`);
+      if (updates?.publicKey !== undefined && updates.publicKeys !== undefined)
+        throw new Error(`${where}.updates in ${configPath} has both publicKey and publicKeys${named ? ", native.updates merged in: give one, in native.updates' own form when overriding its keys" : ": give one"}.`);
       AkanAppConfig.#assertFiles(own ?? {}, where, configPath);
       const {
         basePath: _basePath,
@@ -1100,6 +1348,8 @@ class AkanAppConfig {
     "AKAN_DATABASE_MODES",
     "AKAN_SSR",
     "AKAN_CSR",
+    "AKAN_MCP",
+    "AKAN_SHUTDOWN_TIMEOUT_MS",
     "AKAN_MODULES"
   ]);
   static #desktopServerEnv(env, where, configPath) {
@@ -1118,11 +1368,14 @@ class AkanAppConfig {
   static #desktopServerWatchdog(watchdog, where, configPath) {
     if (watchdog === undefined || watchdog === false)
       return null;
-    const { intervalMs = 1e4, failures = 3 } = watchdog === true ? {} : watchdog;
-    const whole = (value) => Number.isInteger(value) && value > 0;
-    if (watchdog !== true && !AkanAppConfig.#isPlainObject(watchdog) || !whole(intervalMs) || !whole(failures))
+    const options = watchdog === true ? {} : watchdog;
+    const whole = (value) => value === undefined || Number.isInteger(value) && value > 0;
+    if (!AkanAppConfig.#isPlainObject(options) || Object.keys(options).some((key) => key !== "intervalMs" && key !== "failures") || !whole(options.intervalMs) || !whole(options.failures))
       throw new Error(`${where}.watchdog in ${configPath} must be true or { intervalMs, failures }, whole numbers from 1.`);
-    return { intervalMs, failures };
+    return {
+      intervalMs: options.intervalMs ?? 1e4,
+      failures: options.failures ?? 3
+    };
   }
   static #platformIndexPath(section) {
     const { indexPath: rawIndexPath, ...rest } = section;
@@ -1344,7 +1597,7 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
   static async from(app, { bustImportCache = false } = {}) {
     const [configImp, baseDevEnv, libs, rootPackageJson] = await Promise.all([
       AkanAppConfig.importConfigModule(app.cwdPath, { bustImportCache }),
-      WorkspaceExecutor.getBaseDevEnv(path6.join(app.workspace.workspaceRoot, ".env")),
+      WorkspaceExecutor.getBaseDevEnv(path7.join(app.workspace.workspaceRoot, ".env")),
       app.workspace.getLibs(),
       app.workspace.getPackageJson()
     ]);
@@ -1361,6 +1614,8 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
   }
   static async#collectLibContributions(app, libs, bustImportCache) {
     const libConfigs = await Promise.all(libs.map(async (libName) => LibExecutor.from(app, libName).getConfig({ refresh: bustImportCache }).catch((error) => {
+      if (error instanceof LibConfigRefusal)
+        throw error;
       app.logger.warn(`Skipped libs/${libName}/akan.config.ts contributions: ${String(error)}`);
       return null;
     })));
@@ -1442,11 +1697,11 @@ var akanPackageJson = null;
 function getAkanPackageJson() {
   if (akanPackageJson)
     return akanPackageJson;
-  const sourceDir = path6.dirname(fileURLToPath(import.meta.url));
+  const sourceDir = path7.dirname(fileURLToPath(import.meta.url));
   const packageJsonPaths = [
-    path6.join(sourceDir, "../../../akanjs/package.json"),
-    path6.join(process.cwd(), "pkgs/akanjs/package.json"),
-    path6.join(path6.dirname(Bun.main), "node_modules/akanjs/package.json")
+    path7.join(sourceDir, "../../../akanjs/package.json"),
+    path7.join(process.cwd(), "pkgs/akanjs/package.json"),
+    path7.join(path7.dirname(Bun.main), "node_modules/akanjs/package.json")
   ];
   try {
     packageJsonPaths.unshift(Bun.resolveSync("akanjs/package.json", sourceDir));
@@ -1501,29 +1756,29 @@ class AkanLibConfig {
     const resolved = typeof configImp === "function" ? configImp(lib) : configImp;
     const { plugins, ...config } = resolved ?? {};
     if ("pipeline" in config)
-      throw new Error(`libs/${lib.name}/akan.config.ts declares \`pipeline\`, which a lib does not take: pipelines belong to apps and the workspace root, and a lib's build-time work goes in an akan build plugin.`);
+      throw new LibConfigRefusal(`libs/${lib.name}/akan.config.ts declares \`pipeline\`, which a lib does not take: pipelines belong to apps and the workspace root, and a lib's build-time work goes in an akan build plugin.`);
     if ("subspace" in config)
-      throw new Error(`libs/${lib.name}/akan.config.ts declares \`subspace\`, a workspace setting: it belongs in the workspace root akan.config.ts.`);
+      throw new LibConfigRefusal(`libs/${lib.name}/akan.config.ts declares \`subspace\`, a workspace setting: it belongs in the workspace root akan.config.ts.`);
     return new AkanLibConfig(lib, config, plugins ?? []);
   }
 }
 //! need to refactor
 var shiftBuildNum = async (app, delta) => {
   const { buildNum } = (await AkanAppConfig.from(app)).native;
-  const akanConfigPath = path6.join(app.cwdPath, "akan.config.ts");
+  const akanConfigPath = path7.join(app.cwdPath, "akan.config.ts");
   const akanConfig = fs2.readFileSync(akanConfigPath, "utf8");
   fs2.writeFileSync(akanConfigPath, akanConfig.replace(`buildNum: ${buildNum}`, `buildNum: ${buildNum + delta}`));
 };
 var increaseBuildNum = async (app) => await shiftBuildNum(app, 1);
 var decreaseBuildNum = async (app) => await shiftBuildNum(app, -1);
 // pkgs/@akanjs/devkit/akanConfig/akanWorkspaceConfig.ts
-import path7 from "path";
+import path8 from "path";
 class AkanWorkspaceConfig {
   static fileName = "akan.config.ts";
   static #keys = ["subspace", "pipeline", "cloud"];
   static #loopbackHosts = ["localhost", "127.0.0.1", "[::1]"];
   static async from(workspace, { bustImportCache = false } = {}) {
-    const file = path7.join(workspace.workspaceRoot, AkanWorkspaceConfig.fileName);
+    const file = path8.join(workspace.workspaceRoot, AkanWorkspaceConfig.fileName);
     if (!await FileSys2.fileExists(file))
       return new AkanWorkspaceConfig(null, {});
     const input = await AkanAppConfig.importConfigModule(workspace.workspaceRoot, { bustImportCache });
@@ -1568,13 +1823,13 @@ class AkanWorkspaceConfig {
   }
 }
 // pkgs/@akanjs/devkit/jsonFormatter.ts
-import path8 from "path";
+import path9 from "path";
 
 class JsonFormatter {
   static lineWidth = 120;
   static stringify(value, filePath) {
     const json = JSON.stringify(value, null, 2);
-    if (path8.basename(filePath) === "package.json")
+    if (path9.basename(filePath) === "package.json")
       return `${json}
 `;
     return `${JsonFormatter.#print(JSON.parse(json), 0, { column: 0, trailing: 0 })}
@@ -1644,8 +1899,8 @@ ${"  ".repeat(depth)}]`;
 
 // pkgs/@akanjs/devkit/linter.ts
 import { spawn } from "child_process";
-import { existsSync, readFileSync } from "fs";
-import path9 from "path";
+import { existsSync as existsSync2, readFileSync } from "fs";
+import path10 from "path";
 import chalk from "chalk";
 var parseBiomeReport = (output) => {
   for (let start = output.indexOf("{");start !== -1; start = output.indexOf("{", start + 1)) {
@@ -1711,14 +1966,14 @@ class Linter {
   #biomeBin;
   constructor(cwdPath) {
     this.lintRoot = this.#findBiomeRootPath(cwdPath);
-    this.configPath = Linter.#configPathIn(this.lintRoot) ?? path9.join(this.lintRoot, "biome.json");
-    const localBiomeBin = path9.join(this.lintRoot, "node_modules", ".bin", Linter.biomeBinName);
-    this.#biomeBin = existsSync(localBiomeBin) ? localBiomeBin : "biome";
+    this.configPath = Linter.#configPathIn(this.lintRoot) ?? path10.join(this.lintRoot, "biome.json");
+    const localBiomeBin = path10.join(this.lintRoot, "node_modules", ".bin", Linter.biomeBinName);
+    this.#biomeBin = existsSync2(localBiomeBin) ? localBiomeBin : "biome";
   }
   static #configPathIn(dir) {
     for (const fileName of BIOME_CONFIG_FILES) {
-      const configPath = path9.join(dir, fileName);
-      if (existsSync(configPath))
+      const configPath = path10.join(dir, fileName);
+      if (existsSync2(configPath))
         return configPath;
     }
     return null;
@@ -1726,19 +1981,19 @@ class Linter {
   #findBiomeRootPath(dir) {
     if (Linter.#configPathIn(dir))
       return dir;
-    const parentDir = path9.dirname(dir);
+    const parentDir = path10.dirname(dir);
     if (parentDir === dir)
       throw new Error(`biome.json not found from ${dir}`);
     return this.#findBiomeRootPath(parentDir);
   }
   #toBiomePath(filePath) {
-    const relativePath = path9.relative(this.lintRoot, filePath);
-    if (!relativePath.startsWith("..") && !path9.isAbsolute(relativePath))
+    const relativePath = path10.relative(this.lintRoot, filePath);
+    if (!relativePath.startsWith("..") && !path10.isAbsolute(relativePath))
       return relativePath;
     return filePath;
   }
   #resolveFilePath(filePath) {
-    return path9.isAbsolute(filePath) ? filePath : path9.join(this.lintRoot, filePath);
+    return path10.isAbsolute(filePath) ? filePath : path10.join(this.lintRoot, filePath);
   }
   async#runBiome(args, input) {
     return await new Promise((resolve, reject) => {
@@ -1763,7 +2018,7 @@ class Linter {
     const diagnosticPath = diagnostic.location?.path;
     if (!diagnosticPath)
       return fallbackFilePath;
-    return path9.isAbsolute(diagnosticPath) ? diagnosticPath : path9.join(this.lintRoot, diagnosticPath);
+    return path10.isAbsolute(diagnosticPath) ? diagnosticPath : path10.join(this.lintRoot, diagnosticPath);
   }
   #createLintMessage(diagnostic) {
     const start = diagnostic.location?.start;
@@ -1806,7 +2061,7 @@ class Linter {
     };
   }
   async#checkFile(filePath, { write = false } = {}) {
-    const originalContent = existsSync(filePath) ? readFileSync(filePath, "utf8") : "";
+    const originalContent = existsSync2(filePath) ? readFileSync(filePath, "utf8") : "";
     const { stdout, stderr } = await this.#runBiome([
       "check",
       ...write ? ["--write"] : [],
@@ -1820,7 +2075,7 @@ class Linter {
     const report = parseBiomeReport(stdout || stderr);
     const results = this.#toLintResults(report, filePath);
     const { errors, warnings } = this.#splitMessages(results);
-    const output = write && existsSync(filePath) ? readFileSync(filePath, "utf8") : undefined;
+    const output = write && existsSync2(filePath) ? readFileSync(filePath, "utf8") : undefined;
     return {
       fixed: write && output !== originalContent,
       output,
@@ -1836,7 +2091,7 @@ class Linter {
   }
   async lintFile(filePath) {
     const resolvedFilePath = this.#resolveFilePath(filePath);
-    if (!existsSync(resolvedFilePath))
+    if (!existsSync2(resolvedFilePath))
       throw new Error(`File not found: ${filePath}`);
     return await this.#checkFile(resolvedFilePath);
   }
@@ -1853,7 +2108,7 @@ class Linter {
         output.push(`
 ${chalk.cyan(result.filePath)}`);
         let sourceLines = [];
-        if (existsSync(result.filePath)) {
+        if (existsSync2(result.filePath)) {
           try {
             const sourceContent = readFileSync(result.filePath, "utf8");
             sourceLines = sourceContent.split(`
@@ -1925,7 +2180,7 @@ ${errorText}, ${warningText} found`];
   }
   async fixFile(filePath, dryRun = false) {
     const resolvedFilePath = this.#resolveFilePath(filePath);
-    if (!existsSync(resolvedFilePath))
+    if (!existsSync2(resolvedFilePath))
       throw new Error(`File not found: ${filePath}`);
     if (!dryRun)
       return await this.#checkFile(resolvedFilePath, { write: true });
@@ -1935,7 +2190,7 @@ ${errorText}, ${warningText} found`];
     return { ...lintResult, fixed: stdout !== source, output: stdout };
   }
   async fixFiles(filePaths) {
-    const resolved = filePaths.map((filePath) => this.#resolveFilePath(filePath)).filter(existsSync);
+    const resolved = filePaths.map((filePath) => this.#resolveFilePath(filePath)).filter(existsSync2);
     if (resolved.length === 0)
       return { fixed: [] };
     const before = new Map(resolved.map((filePath) => [filePath, readFileSync(filePath, "utf8")]));
@@ -1955,7 +2210,7 @@ ${errorText}, ${warningText} found`];
   }
   async getConfigForFile(filePath) {
     const resolvedFilePath = this.#resolveFilePath(filePath);
-    if (!existsSync(resolvedFilePath))
+    if (!existsSync2(resolvedFilePath))
       throw new Error(`File not found: ${filePath}`);
     return JSON.parse(readFileSync(this.configPath, "utf8"));
   }
@@ -2099,7 +2354,7 @@ class ManifestDependencies {
 
 // pkgs/@akanjs/devkit/repoIdentity.ts
 import { execFileSync } from "child_process";
-import path10 from "path";
+import path11 from "path";
 var resolved = new Map;
 var readRemoteName = (workspaceRoot) => {
   try {
@@ -2117,13 +2372,13 @@ var resolveRepoName = (workspaceRoot) => {
   const cached = resolved.get(workspaceRoot);
   if (cached)
     return cached;
-  const repoName = readRemoteName(workspaceRoot) ?? path10.basename(workspaceRoot);
+  const repoName = readRemoteName(workspaceRoot) ?? path11.basename(workspaceRoot);
   resolved.set(workspaceRoot, repoName);
   return repoName;
 };
 
 // pkgs/@akanjs/devkit/scanInfo.ts
-import path11 from "path";
+import path12 from "path";
 
 // pkgs/@akanjs/devkit/workspaceLayout.ts
 var appRootAllowedFiles = new Set([
@@ -2245,9 +2500,9 @@ var moduleUiFileTypes = {
   scalar: new Set(["Template", "Unit"])
 };
 var createDependencyScanner = async (exec) => (await import("./dependencyScanner-06z2dmrr.js")).TypeScriptDependencyScanner.from(exec);
-var getScanPath = (exec, relativePath) => path11.posix.join(`${exec.type}s`, exec.name, relativePath.split(path11.sep).join("/"));
+var getScanPath = (exec, relativePath) => path12.posix.join(`${exec.type}s`, exec.name, relativePath.split(path12.sep).join("/"));
 var getModuleNameFromPath = (kind, modulePath) => {
-  const dirname = path11.basename(modulePath);
+  const dirname = path12.basename(modulePath);
   return kind === "service" ? dirname.replace(/^_+/, "") : dirname;
 };
 async function assertScanConvention(exec, libRoot) {
@@ -2268,24 +2523,24 @@ async function assertScanConvention(exec, libRoot) {
     for (const filename of await exec.readdir(facet)) {
       const shadow = facetIndexShadowOf(`${facet}/${filename}`);
       if (shadow)
-        addViolation(path11.join(facet, filename), shadow);
+        addViolation(path12.join(facet, filename), shadow);
     }
   if (exec.type === "lib")
     for (const { relativePath, reason } of await exec.getPageConventionViolations())
       addViolation(relativePath, reason);
   for (const filename of libRoot.files)
     if (!isAllowedLibFacetRootFile(filename))
-      addViolation(path11.join("lib", filename), libFacetRootHintOf(filename) ?? "unsupported lib facet root file");
+      addViolation(path12.join("lib", filename), libFacetRootHintOf(filename) ?? "unsupported lib facet root file");
   for (const dirname of libRoot.dirs)
     if (dirname.startsWith("__") && !internalLibDirs.has(dirname))
-      addViolation(path11.join("lib", dirname), "unsupported internal lib folder");
+      addViolation(path12.join("lib", dirname), "unsupported internal lib folder");
   const databaseDirs = libRoot.dirs.filter((dirname) => !dirname.startsWith("_"));
   const serviceDirs = libRoot.dirs.filter((dirname) => dirname.startsWith("_") && !dirname.startsWith("__"));
   const scalarDirs = await exec.readdir("lib/__scalar");
   await Promise.all([
-    ...databaseDirs.map((dirname) => validateModuleFiles(exec, violations, "database", path11.join("lib", dirname))),
-    ...serviceDirs.map((dirname) => validateModuleFiles(exec, violations, "service", path11.join("lib", dirname))),
-    ...scalarDirs.map((dirname) => validateModuleFiles(exec, violations, "scalar", path11.join("lib/__scalar", dirname)))
+    ...databaseDirs.map((dirname) => validateModuleFiles(exec, violations, "database", path12.join("lib", dirname))),
+    ...serviceDirs.map((dirname) => validateModuleFiles(exec, violations, "service", path12.join("lib", dirname))),
+    ...scalarDirs.map((dirname) => validateModuleFiles(exec, violations, "scalar", path12.join("lib/__scalar", dirname)))
   ]);
   if (violations.length > 0) {
     throw new Error(`[scan-convention]
@@ -2297,11 +2552,11 @@ async function validateModuleFiles(exec, violations, kind, modulePath) {
   const { files, dirs } = await exec.getFilesAndDirs(modulePath);
   const moduleName = getModuleNameFromPath(kind, modulePath);
   dirs.forEach((dirname) => {
-    violations.push(`${getScanPath(exec, path11.join(modulePath, dirname))}: unsupported module folder`);
+    violations.push(`${getScanPath(exec, path12.join(modulePath, dirname))}: unsupported module folder`);
   });
   const uiModuleName = moduleName[0].toUpperCase() + moduleName.slice(1);
   for (const filename of files) {
-    const scanPath = getScanPath(exec, path11.join(modulePath, filename));
+    const scanPath = getScanPath(exec, path12.join(modulePath, filename));
     if (filename === "index.ts" || filename === "index.tsx")
       continue;
     if (filename === `${moduleName}.abstract.md`)
@@ -2376,16 +2631,16 @@ class ScanInfo {
       }
     };
     await Promise.all([
-      ...databaseDirs.map((name) => collect(path11.join("lib", name), name, "databases")),
-      ...serviceDirs.map((dirname) => collect(path11.join("lib", dirname), dirname.slice(1), "services")),
-      ...scalarDirs.map((name) => collect(path11.join("lib/__scalar", name), name, "scalars"))
+      ...databaseDirs.map((name) => collect(path12.join("lib", name), name, "databases")),
+      ...serviceDirs.map((dirname) => collect(path12.join("lib", dirname), dirname.slice(1), "services")),
+      ...scalarDirs.map((name) => collect(path12.join("lib/__scalar", name), name, "scalars"))
     ]);
     const routes = exec.type === "lib" ? [] : await exec.getPageKeys();
     const common = {
       name: exec.name,
       type: exec.type,
       repoName: exec.workspace.repoName,
-      serveDomain: WorkspaceExecutor.getBaseDevEnv(path11.join(exec.workspace.workspaceRoot, ".env")).serveDomain,
+      serveDomain: WorkspaceExecutor.getBaseDevEnv(path12.join(exec.workspace.workspaceRoot, ".env")).serveDomain,
       files,
       libDeps,
       pkgDeps,
@@ -2709,16 +2964,16 @@ class Executor {
   linter = null;
   constructor(name, cwdPath) {
     this.name = name;
-    this.logger = new Logger2(name);
+    this.logger = new Logger3(name);
     this.logs = [];
     this.cwdPath = cwdPath;
   }
   #stdout(data) {
     if (Executor.verbose)
-      Logger2.raw(chalk2.dim(data.toString()));
+      Logger3.raw(chalk2.dim(data.toString()));
   }
   #stderr(data) {
-    Logger2.raw(chalk2.red(data.toString()));
+    Logger3.raw(chalk2.red(data.toString()));
   }
   #settle(proc, target, { onClose = false, keepLogs = false, redStderr = false } = {}) {
     let stdout = "";
@@ -2767,10 +3022,10 @@ class Executor {
     return this.#settle(proc, target, { redStderr: true }).then(({ code, signal }) => ({ code, signal }));
   }
   getPath(filePath) {
-    if (path12.isAbsolute(filePath))
+    if (path13.isAbsolute(filePath))
       return filePath;
     if (filePath.startsWith("."))
-      return path12.join(this.cwdPath, filePath);
+      return path13.join(this.cwdPath, filePath);
     const baseParts = this.cwdPath.split(/[\\/]/).filter(Boolean);
     const targetParts = filePath.split(/[\\/]/).filter(Boolean);
     let overlapLength = 0;
@@ -2784,12 +3039,12 @@ class Executor {
       if (isOverlap)
         overlapLength = i;
     }
-    return path12.join(this.cwdPath, ...targetParts.slice(overlapLength));
+    return path13.join(this.cwdPath, ...targetParts.slice(overlapLength));
   }
   async mkdir(dirPath) {
     const writePath = this.getPath(dirPath);
     if (!await FileSys2.dirExists(writePath))
-      await mkdir2(writePath, { recursive: true });
+      await mkdir3(writePath, { recursive: true });
     this.logger.verbose(`Make directory ${writePath}`);
     return this;
   }
@@ -2825,26 +3080,28 @@ class Executor {
     return this;
   }
   async removeDir(dirPath) {
-    const readPath = path12.join(this.getPath(dirPath), ".");
+    const readPath = path13.join(this.getPath(dirPath), ".");
     if (await FileSys2.entryExists(readPath))
-      await rm3(readPath, { recursive: true, force: true });
+      await rm4(readPath, { recursive: true, force: true });
     this.logger.verbose(`Remove directory ${readPath}`);
     return this;
   }
   async writeFile(filePath, content, { overwrite = true, silent = false } = {}) {
     const writePath = this.getPath(filePath);
-    const dir = path12.dirname(writePath);
+    const dir = path13.dirname(writePath);
     if (!await FileSys2.dirExists(dir))
-      await mkdir2(dir, { recursive: true });
+      await mkdir3(dir, { recursive: true });
     let contentStr = typeof content === "string" ? content : JsonFormatter.stringify(content, writePath);
+    let written = true;
     if (await FileSys2.fileExists(writePath)) {
       const currentContent = await FileSys2.readText(writePath);
       if (currentContent === contentStr || !overwrite) {
         this.logger.verbose(`File ${writePath} is unchanged`);
         contentStr = currentContent;
+        written = false;
       } else {
         await FileSys2.writeText(writePath, contentStr);
-        if (Logger2.isVerbose())
+        if (Logger3.isVerbose())
           this.logger.rawLog(chalk2.yellow(`File Update: ${filePath}`));
       }
     } else {
@@ -2852,13 +3109,13 @@ class Executor {
       if (!silent)
         this.logger.rawLog(chalk2.green(`File Create: ${filePath}`));
     }
-    return { filePath: writePath, content: contentStr };
+    return { filePath: writePath, content: contentStr, written };
   }
   async writeJson(filePath, content) {
     await this.writeFile(filePath, content);
   }
   async getLocalFile(targetPath) {
-    const filePath = path12.isAbsolute(targetPath) ? targetPath : targetPath.replace(this.cwdPath, "");
+    const filePath = path13.isAbsolute(targetPath) ? targetPath : targetPath.replace(this.cwdPath, "");
     const content = await this.readFile(filePath);
     return { filePath, content };
   }
@@ -2875,7 +3132,7 @@ class Executor {
       return;
     const isDirectory = (await stat2(src)).isDirectory();
     if (!await FileSys2.exists(dest) && isDirectory)
-      await mkdir2(dest, { recursive: true });
+      await mkdir3(dest, { recursive: true });
     if (dereference || process.platform === "win32")
       await cpEntry(src, dest, { recursive: isDirectory, dereference: true, force: true });
     else
@@ -2945,9 +3202,9 @@ class Executor {
       const result = await getContent.default(scanInfo ?? null, dict, options);
       if (result === null)
         return null;
-      const filename = typeof result === "object" ? result.filename : path12.basename(targetPath).replace(".js", ".ts");
+      const filename = typeof result === "object" ? result.filename : path13.basename(targetPath).replace(".js", ".ts");
       const content = typeof result === "object" ? result.content : result;
-      const convertedTargetPath = convertPath(`${path12.dirname(targetPath)}/${filename}`);
+      const convertedTargetPath = convertPath(`${path13.dirname(targetPath)}/${filename}`);
       this.logger.verbose(`Apply template ${templatePath} to ${convertedTargetPath}`);
       return this.writeFile(convertedTargetPath, content, { overwrite });
     } else if (targetPath.endsWith(".template")) {
@@ -2956,15 +3213,17 @@ class Executor {
       const convertedContent = Object.entries(dict).reduce((data, [key, value]) => data.replace(new RegExp(`<%= ${key} %>`, "g"), value), content);
       this.logger.verbose(`Apply template ${templatePath} to ${convertedTargetPath}`);
       return this.writeFile(convertedTargetPath, convertedContent, { overwrite });
-    } else if (staticTemplateFileExtensions.has(path12.extname(targetPath).toLowerCase())) {
+    } else if (staticTemplateFileExtensions.has(path13.extname(targetPath).toLowerCase())) {
       const convertedTargetPath = convertPath(targetPath);
       const writePath = this.getPath(convertedTargetPath);
-      const dirname = path12.dirname(writePath);
+      if (!overwrite && await FileSys2.fileExists(writePath))
+        return { filePath: writePath, content: "", written: false };
+      const dirname = path13.dirname(writePath);
       if (!await FileSys2.dirExists(dirname))
-        await mkdir2(dirname, { recursive: true });
+        await mkdir3(dirname, { recursive: true });
       await copyFile(templatePath, writePath);
       this.logger.verbose(`Apply template ${templatePath} to ${convertedTargetPath}`);
-      return { filePath: writePath, content: "" };
+      return { filePath: writePath, content: "", written: true };
     } else
       return null;
   }
@@ -2981,7 +3240,7 @@ class Executor {
     if ((await stat2(templatePath)).isFile()) {
       const fileContent = await this.#applyTemplateFile({
         templatePath,
-        targetPath: path12.join(basePath, path12.basename(templatePath)),
+        targetPath: path13.join(basePath, path13.basename(templatePath)),
         scanInfo,
         overwrite
       }, dict, options);
@@ -2989,19 +3248,19 @@ class Executor {
     } else {
       const subdirs = await readDirEntries(templatePath);
       const fileContents = (await Promise.all(subdirs.map(async (subdir) => {
-        const subpath = path12.join(templatePath, subdir);
+        const subpath = path13.join(templatePath, subdir);
         if ((await stat2(subpath)).isFile()) {
           const fileContent = await this.#applyTemplateFile({
             templatePath: subpath,
-            targetPath: path12.join(basePath, subdir),
+            targetPath: path13.join(basePath, subdir),
             scanInfo,
             overwrite
           }, dict, options);
           return fileContent ? [fileContent] : [];
         } else
           return await this._applyTemplate({
-            basePath: path12.join(basePath, subdir),
-            template: path12.join(template, subdir),
+            basePath: path13.join(basePath, subdir),
+            template: path13.join(template, subdir),
             scanInfo,
             dict,
             overwrite,
@@ -3013,8 +3272,8 @@ class Executor {
   }
   async#resolveTemplateRoot() {
     const candidates = [
-      path12.resolve(getDirname2(import.meta.url), "templates"),
-      path12.resolve(getDirname2(import.meta.url), "../cli/templates")
+      path13.resolve(getDirname2(import.meta.url), "templates"),
+      path13.resolve(getDirname2(import.meta.url), "../cli/templates")
     ];
     for (const candidate of candidates) {
       if (await FileSys2.dirExists(candidate))
@@ -3024,7 +3283,7 @@ class Executor {
   }
   async applyTemplate(options) {
     const fileContents = await this._applyTemplate({ ...options, dict: withCapitalizedDict(options.dict) });
-    await this.#formatAppliedTemplate(fileContents);
+    await this.#formatAppliedTemplate(fileContents.filter((fileContent) => fileContent.written));
     return fileContents;
   }
   async#formatAppliedTemplate(fileContents) {
@@ -3036,7 +3295,7 @@ class Executor {
       if (fixed.length > 0)
         this.logger.verbose(`Formatted ${fixed.length} scaffolded file(s)`);
     } catch (err) {
-      this.logger.verbose(`Skipped formatting scaffolded files: ${err instanceof Error ? err.message : String(err)}`);
+      this.logger.verbose(`Skipped formatting scaffolded files: ${toError2(err).message}`);
     }
   }
   async getTypeChecker() {
@@ -3053,7 +3312,7 @@ class Executor {
   }
   async typeCheckAsync(filePath) {
     const path = this.getPath(filePath);
-    const entry = await this.#resolveTypecheckWorkerEntry();
+    const entry = await ProjectTypecheck2.workerEntry(process.cwd());
     const proc = Bun.spawn([process.execPath, entry], {
       cwd: this.cwdPath,
       env: {
@@ -3079,20 +3338,6 @@ class Executor {
       message: result.message
     };
   }
-  async#resolveTypecheckWorkerEntry() {
-    const dirname = getDirname2(import.meta.url);
-    const candidates = [
-      path12.join(process.cwd(), "pkgs/@akanjs/devkit/typecheck/typecheck.proc.ts"),
-      path12.join(process.cwd(), "node_modules/@akanjs/devkit/typecheck/typecheck.proc.ts"),
-      path12.join(dirname, "typecheck/typecheck.proc.ts"),
-      path12.join(dirname, "typecheck.proc.js"),
-      path12.join(dirname, "typecheck.proc.ts")
-    ];
-    for (const candidate of candidates)
-      if (await Bun.file(candidate).exists())
-        return candidate;
-    throw new Error(`[devkit] typecheck worker entry not found; looked in: ${candidates.join(", ")}`);
-  }
   getLinter() {
     this.linter ??= new Linter(this.cwdPath);
     return this.linter;
@@ -3124,8 +3369,12 @@ class WorkspaceExecutor extends Executor {
   } = {}) {
     return new WorkspaceExecutor({ workspaceRoot, repoName });
   }
+  static publicEnvPin = null;
   static getBaseDevEnv(envPath) {
-    const sourceEnv = envPath ? { ...process.env, ...parseEnvFile(envPath) } : process.env;
+    const sourceEnv = {
+      ...envPath ? { ...process.env, ...parseEnvFile(envPath) } : process.env,
+      ...WorkspaceExecutor.publicEnvPin
+    };
     const appName = sourceEnv.AKAN_PUBLIC_APP_NAME;
     const workspaceRoot = sourceEnv.AKAN_WORKSPACE_ROOT;
     const workspaceId = sourceEnv.AKAN_WORKSPACE_ID;
@@ -3213,7 +3462,7 @@ class WorkspaceExecutor extends Executor {
       await Promise.all(dirs.map(async (dir) => {
         if (dir.includes("_") || AVOID_DIRS.includes(dir))
           return;
-        const dirPath = path12.join(dirname, dir);
+        const dirPath = path13.join(dirname, dir);
         if ((await stat2(dirPath)).isDirectory()) {
           results.push(`${prefix}${dir}`);
           if (maxDepth > 0)
@@ -3250,9 +3499,9 @@ class WorkspaceExecutor extends Executor {
       await Promise.all(dirs.map(async (dir) => {
         if (AVOID_DIRS.includes(dir))
           return;
-        const dirPath = path12.join(dirname, dir);
+        const dirPath = path13.join(dirname, dir);
         if (await FileSys2.dirExists(dirPath)) {
-          const hasTargetFile = await FileSys2.fileExists(path12.join(dirPath, targetFilename));
+          const hasTargetFile = await FileSys2.fileExists(path13.join(dirPath, targetFilename));
           if (hasTargetFile)
             results.push(`${prefix}${dir}`);
           if (maxDepth > 0)
@@ -3311,7 +3560,7 @@ class SysExecutor extends Executor {
       return [];
     const violations = [];
     for (const entry of await this.getAllFiles("**/*", { cwd: this.getPath("page") })) {
-      const relativePath = entry.split(path12.sep).join("/");
+      const relativePath = entry.split(path13.sep).join("/");
       const reason = getPageSourceFileViolation(relativePath);
       if (reason)
         violations.push({ relativePath: `page/${relativePath}`, reason });
@@ -3406,21 +3655,21 @@ class SysExecutor extends Executor {
     await this.setPackageJson({ ...packageJson, dependencies, devDependencies });
   }
   async getLocalFile(targetPath) {
-    const filePath = path12.isAbsolute(targetPath) ? targetPath : `${this.type}s/${this.name}/${targetPath}`;
+    const filePath = path13.isAbsolute(targetPath) ? targetPath : `${this.type}s/${this.name}/${targetPath}`;
     const content = await this.workspace.readFile(filePath);
     return { filePath, content };
   }
   async getDatabaseModules() {
-    return (await this.readdir("lib")).filter((name) => !name.startsWith("_") && !name.endsWith(".ts")).filter((name) => existsSync2(`${this.cwdPath}/lib/${name}/${name}.constant.ts`));
+    return (await this.readdir("lib")).filter((name) => !name.startsWith("_") && !name.endsWith(".ts")).filter((name) => existsSync3(`${this.cwdPath}/lib/${name}/${name}.constant.ts`));
   }
   async getServiceModules() {
-    return (await this.readdir("lib")).filter((name) => name.startsWith("_") && !name.startsWith("__")).filter((name) => existsSync2(`${this.cwdPath}/lib/${name}/${name.slice(1)}.service.ts`));
+    return (await this.readdir("lib")).filter((name) => name.startsWith("_") && !name.startsWith("__")).filter((name) => existsSync3(`${this.cwdPath}/lib/${name}/${name.slice(1)}.service.ts`));
   }
   async getScalarModules() {
-    return (await this.readdir("lib/__scalar")).filter((name) => !name.startsWith("_")).filter((name) => existsSync2(`${this.cwdPath}/lib/__scalar/${name}/${name}.constant.ts`));
+    return (await this.readdir("lib/__scalar")).filter((name) => !name.startsWith("_")).filter((name) => existsSync3(`${this.cwdPath}/lib/__scalar/${name}/${name}.constant.ts`));
   }
   async#getComponentModules(role) {
-    return (await this.readdir("lib")).filter((name) => !name.startsWith("_") && !name.endsWith(".ts")).filter((name) => existsSync2(`${this.cwdPath}/lib/${name}/${capitalize(name)}.${role}.tsx`));
+    return (await this.readdir("lib")).filter((name) => !name.startsWith("_") && !name.endsWith(".ts")).filter((name) => existsSync3(`${this.cwdPath}/lib/${name}/${capitalize(name)}.${role}.tsx`));
   }
   async#getComponentSources(role) {
     const modules = await this.#getComponentModules(role);
@@ -3494,19 +3743,19 @@ class AppExecutor extends SysExecutor {
   static from(executor, name) {
     return new AppExecutor({ workspace: executor instanceof WorkspaceExecutor ? executor : executor.workspace, name });
   }
-  static #keptOnStart = [path12.join(".akan", "cache", "bin")];
-  static #legacyNative = path12.join(".akan", "native");
+  static #keptOnStart = [path13.join(".akan", "cache", "bin")];
+  static #legacyNative = path13.join(".akan", "native");
   async#removeDevOutput(dir = ".akan") {
     const entries = await readDirEntries(this.getPath(dir)).catch(() => []);
     await Promise.all(entries.map(async (name) => {
-      const entry = path12.join(dir, name);
+      const entry = path13.join(dir, name);
       if (entry === AppExecutor.#legacyNative) {
         this.logger.warn(`apps/${this.name}/.akan/native holds native builds from before they moved to dist/native/${this.name}: upload any release waiting in its updates folders, then delete it.`);
         return;
       }
       if (AppExecutor.#keptOnStart.includes(entry))
         return;
-      if (AppExecutor.#keptOnStart.some((kept) => kept.startsWith(`${entry}${path12.sep}`)))
+      if (AppExecutor.#keptOnStart.some((kept) => kept.startsWith(`${entry}${path13.sep}`)))
         return await this.#removeDevOutput(entry);
       await this.removeDir(entry);
     }));
@@ -3630,13 +3879,13 @@ class AppExecutor extends SysExecutor {
         absolute: false,
         onlyFiles: true
       })) {
-        const segments = rel.split(path12.sep);
+        const segments = rel.split(path13.sep);
         if (segments.some((s) => s === "node_modules"))
           continue;
         const posix = `${root.keyPrefix}${segments.join("/")}`;
         if (!root.keyPrefix && libKeyPrefixes.some((prefix) => posix.startsWith(prefix)))
           continue;
-        const absPath = path12.join(root.dir, ...segments);
+        const absPath = path13.join(root.dir, ...segments);
         validatePageSourceFile(posix, { filePath: absPath });
         if (!isRouteSourceFile(posix))
           continue;
@@ -3777,12 +4026,12 @@ class AppExecutor extends SysExecutor {
   static async#linkLibAsset(targetPath, linkPath) {
     const isWindows = process.platform === "win32";
     try {
-      const target = isWindows ? targetPath : path12.relative(path12.dirname(linkPath), targetPath);
+      const target = isWindows ? targetPath : path13.relative(path13.dirname(linkPath), targetPath);
       await symlink(target, linkPath, isWindows ? "junction" : "dir");
     } catch (error) {
       if (!isWindows)
         throw error;
-      await mkdir2(linkPath, { recursive: true });
+      await mkdir3(linkPath, { recursive: true });
       await cpEntry(targetPath, linkPath, { recursive: true, dereference: true, force: true });
     }
   }
@@ -3820,7 +4069,7 @@ class AppExecutor extends SysExecutor {
         await this.writeFile(rel, content, opts);
       },
       readEnvClient: async () => {
-        const envClientPath = path12.join(this.cwdPath, "env", "env.client.ts");
+        const envClientPath = path13.join(this.cwdPath, "env", "env.client.ts");
         if (!await FileSys2.fileExists(envClientPath))
           return null;
         try {
@@ -3914,7 +4163,7 @@ class PkgExecutor extends Executor {
       return overrideVersion;
     try {
       const packageJsonPath = `pkgs/${dep}/package.json`;
-      if (!await Bun.file(path12.join(this.workspace.workspaceRoot, packageJsonPath)).exists())
+      if (!await Bun.file(path13.join(this.workspace.workspaceRoot, packageJsonPath)).exists())
         return;
       const packageJson = await this.workspace.readJson(packageJsonPath);
       if (packageJson.name === dep)
@@ -4007,4 +4256,4 @@ class ModuleExecutor extends Executor {
   }
 }
 
-export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, CLAUDE_COMMENT_RULE, binPlatforms, ServerEnvProfile, AkanAppConfig, AkanWorkspaceConfig, AsyncDefaultExportDetector, resolveSsrPageEntriesForApp, CodegenLock, Linter, LibSource, formatLibStatuses, rootAllowedFiles, rootAllowedDirs, isAllowedLibFacetRootFile, libFacetRootHintOf, barrelFacetDirs, facetIndexShadowOf, rootEntryHintOf, isScannedRootEntry, AppInfo, Spinner, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };
+export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, CLAUDE_COMMENT_RULE, binPlatforms, ServerEnvProfile, AkanAppConfig, AkanWorkspaceConfig, AsyncDefaultExportDetector, resolveSsrPageEntriesForApp, CodegenLock, Linter, LibSource, formatLibStatuses, rootAllowedFiles, rootAllowedDirs, isAllowedLibFacetRootFile, libFacetRootHintOf, barrelFacetDirs, facetIndexShadowOf, rootEntryHintOf, isScannedRootEntry, AppInfo, Spinner, ProjectTypecheck2, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };