@akanjs/cli 3.1.0-rc.1 → 3.1.0-rc.10

package/{index-55mynnqs.js → index-va06nr10.js}

@@ -4,916 +4,599 @@ import {
   FileSys2
 } from "./index-52w0fvh8.js";
 
-// pkgs/@akanjs/devkit/transforms/serverEnvProfile.ts
+// pkgs/@akanjs/devkit/executors.ts
+import {
+  exec,
+  fork,
+  spawn as spawn2
+} from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import {
+  copyFile,
+  cp as cpEntry,
+  lstat,
+  mkdir as mkdir3,
+  readdir as readDirEntries,
+  realpath,
+  rm as rm4,
+  stat as stat2,
+  symlink
+} from "fs/promises";
+import path13 from "path";
+import { pathToFileURL } from "url";
+import {
+  capitalize,
+  getPageSourceFileViolation,
+  isRouteSourceFile,
+  Logger as Logger3,
+  parseRouteModuleKey,
+  toError as toError2,
+  validatePageSourceFile,
+  validateSubRoutePageKey
+} from "akanjs/common";
+var {$ } = globalThis.Bun;
+import chalk2 from "chalk";
+
+// pkgs/@akanjs/devkit/agentsIndex.ts
+var recipeScannerLoad = null;
+var loadRecipeScanner = () => recipeScannerLoad ??= import("./recipeScanner-4b69ybe0.js");
+var AGENT_BLOCK_START = "<!-- akan:agent:start -->";
+var AGENT_BLOCK_END = "<!-- akan:agent:end -->";
+var AGENT_VERSION_PREFIX = "<!-- akan:agent:version ";
+var stampBlockVersion = (block, version) => `${AGENT_VERSION_PREFIX}${version} -->
+
+${block}`;
+var extractBlockVersion = (content) => content.match(/<!-- akan:agent:version ([^\s]+) -->/)?.[1] ?? null;
+var readDevkitVersion = async () => {
+  const { readFile } = await import("fs/promises");
+  const { getDirname } = await import("./fileSys-wzzrntkw.js");
+  try {
+    const raw = await readFile(`${getDirname(import.meta.url)}/package.json`, "utf-8");
+    return JSON.parse(raw).version ?? null;
+  } catch {
+    return null;
+  }
+};
+var upsertAgentBlock = (existing, block) => {
+  const managed = `${AGENT_BLOCK_START}
+${block}
+${AGENT_BLOCK_END}`;
+  const startIndex = existing.indexOf(AGENT_BLOCK_START);
+  const endIndex = existing.indexOf(AGENT_BLOCK_END);
+  if (startIndex >= 0 && endIndex > startIndex) {
+    return `${existing.slice(0, startIndex)}${managed}${existing.slice(endIndex + AGENT_BLOCK_END.length)}`;
+  }
+  return `${existing.replace(/\s*$/, "")}
+
+${managed}
+`;
+};
+var extractAgentBlock = (content) => {
+  const startIndex = content.indexOf(AGENT_BLOCK_START);
+  const endIndex = content.indexOf(AGENT_BLOCK_END);
+  if (startIndex < 0 || endIndex <= startIndex)
+    return null;
+  return content.slice(startIndex + AGENT_BLOCK_START.length, endIndex).trim();
+};
+var signatureOf = (recipe) => {
+  const entries = Object.entries(recipe.variants);
+  if (entries.length === 0)
+    return "";
+  const parts = entries.map(([key, values]) => {
+    if (values.length === 1 && values[0] === "true")
+      return `${key}?`;
+    const def = recipe.defaultVariants?.[key];
+    return `${key}: ${values.map((value) => value === def ? `${value}*` : value).join("|")}`;
+  });
+  return `(${parts.join(" \xB7 ")})`;
+};
+var renderRecipeEntries = (recipes) => {
+  const groups = new Map;
+  for (const recipe of recipes)
+    groups.set(recipe.importFrom, [...groups.get(recipe.importFrom) ?? [], recipe]);
+  return [...groups.entries()].map(([importFrom, list]) => {
+    const items = list.sort((a, b) => a.name.localeCompare(b.name)).map((recipe) => `- \`${recipe.name}\`${signatureOf(recipe)}${recipe.doc ? ` \u2014 ${recipe.doc}` : ""}`).join(`
+`);
+    return `Import from \`${importFrom}\`:
+${items}`;
+  }).join(`
+
+`);
+};
+var collectScopeRecipeSources = async (workspaceRoot, scope, libDeps) => {
+  const { collectRecipeSources } = await loadRecipeScanner();
+  const sources = [
+    ...await collectRecipeSources(`${workspaceRoot}/${scope.type}s/${scope.name}/ui`, `@${scope.type}s/${scope.name}/ui`)
+  ];
+  for (const lib of [...new Set(libDeps)].sort()) {
+    if (scope.type === "lib" && lib === scope.name)
+      continue;
+    sources.push(...await collectRecipeSources(`${workspaceRoot}/libs/${lib}/ui`, `@libs/${lib}/ui`));
+  }
+  return sources;
+};
+var scanScopeRecipes = async (workspaceRoot, scope, libDeps) => {
+  const { scanRecipes } = await loadRecipeScanner();
+  return scanRecipes(await collectScopeRecipeSources(workspaceRoot, scope, libDeps));
+};
+var renderScopeAgentBlock = (scope, recipes) => {
+  const scopePath = `${scope.type}s/${scope.name}`;
+  const intro = `## Recipes In Scope
+
+UI recipes importable from \`${scopePath}\` code, **in addition to** the framework recipes indexed in the root
+\`AGENTS.md\` \`## Recipes\`. Same contract: import by exact name, then \`<name>(variants?, className?)\` \u2014 the second
+arg merges internally and takes an array too, so never wrap it in \`cn()\`. \`*\` marks the default, \`key?\` is a
+boolean flag. Do not guess recipe names or import paths; this index is regenerated by \`akan sync ${scope.name}\`
+and verified by \`akan lint ${scope.name}\`.`;
+  if (recipes.length === 0) {
+    return `${intro}
+
+No scope recipes yet. Before inlining a repeated surface (card, box, tile, \u2026), reuse a framework recipe from the
+root \`AGENTS.md\` or author one as \`${scopePath}/ui/Recipe/<name>.ts\` (one recipe per file, re-exported from that
+folder's \`index.ts\`) \u2014 see the \`recipeRule\` guideline.`;
+  }
+  return `${intro}
+
+${renderRecipeEntries(recipes)}`;
+};
+var renderScopeAgentsMd = (scope, block) => `# ${scope.name} \u2014 Agent Guide
+
+Scoped guide for coding agents working in \`${scope.type}s/${scope.name}\`. Workspace-wide conventions live in the
+root \`AGENTS.md\`; this file carries what is importable from this ${scope.type === "app" ? "app" : "library"}. The
+section between the \`akan:agent\` markers is regenerated by \`akan sync ${scope.name}\`; edit anything outside the
+markers freely.
+
+${AGENT_BLOCK_START}
+${block}
+${AGENT_BLOCK_END}
+`;
+var CLAUDE_COMMENT_RULE = `## Comments \u2014 Overrides Your Default
+
+Write **no comments** unless the comment passes the test below. This is the rule agents break most often here, so it
+is repeated outside the guide: a diff that adds a comment the test rejects is a diff to redo.
+
+Before typing \`//\`, \`/*\`, or a doc block, ask \u2014 **does this sentence carry a fact that is nowhere in the code?**
+
+- Restates the identifier, the signature, or the line under it \u2192 delete it.
+- Labels a section (\`// helpers\`, \`// state\`) or narrates a step (\`// fetch the user\`, \`// then save\`) \u2192 delete it.
+- JSDoc on an ordinary function, or a why/how preamble on ordinary logic \u2192 delete it.
+- Explains the edit you just made, for whoever reads the diff \u2192 say it in your reply, not in the file.
+- Names a vendor or protocol quirk, an infrastructure constraint, a library gotcha, security reasoning, a math
+  derivation, a domain field's business meaning, a state transition, or why an obvious alternative was rejected \u2192
+  keep it, one line.
+
+That keep-list is exact \u2014 \`Comments\` in the guide is the full version. "It aids readability" and "this logic is
+subtle" are not on it: rename or split the code instead. When you edit an existing file, match its density; if the
+surrounding code carries none, your diff carries none.`;
+var renderScopeClaudeMd = (scope) => `# ${scope.name} \u2014 Claude Code Guide
+
+@AGENTS.md
+
+${CLAUDE_COMMENT_RULE}
+`;
+
+// pkgs/@akanjs/devkit/akanConfig/akanBin.ts
 import path from "path";
-var secretKey = /password|passwd|passphrase|^pass$|token|jwt|authorization|cookie|secret|api[-_]?key|private[-_]?key|access[-_]?key|auth[-_]?key|hash[-_]?key|webhook|cred|iap[-_]?verify|service[-_]?account/i;
+
+// pkgs/@akanjs/devkit/akanConfig/types.ts
+import { archs, binPlatforms, defaultAppPipeline } from "akanjs";
+
+// pkgs/@akanjs/devkit/akanConfig/akanBin.ts
+class AkanBin {
+  static archive = /\.(zip|tar\.gz|tgz|tar\.xz|txz|tar\.bz2|tbz2|tar)$/i;
+  static fileName = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+  static parse(declared, owner, baseDir) {
+    if (declared === undefined)
+      return {};
+    if (!declared || typeof declared !== "object" || Array.isArray(declared))
+      throw new Error(`${owner}: bin maps each executable's name to its platforms`);
+    return Object.fromEntries(Object.entries(declared).map(([name, platforms]) => [name, AkanBin.#platforms(name, platforms, owner, baseDir)]));
+  }
+  static isArchive(source) {
+    return AkanBin.archive.test("url" in source ? new URL(source.url).pathname : source.path);
+  }
+  static #platforms(name, platforms, owner, baseDir) {
+    if (!AkanBin.fileName.test(name))
+      throw new Error(`${owner}: bin.${name} is not a file name`);
+    if (!platforms || typeof platforms !== "object" || Array.isArray(platforms))
+      throw new Error(`${owner}: bin.${name} maps platforms (${binPlatforms.join(", ")}) to where the file comes from`);
+    const resolved = {};
+    for (const [platform, source] of Object.entries(platforms)) {
+      if (!binPlatforms.includes(platform))
+        throw new Error(`${owner}: bin.${name}.${platform} is not one of ${binPlatforms.join(", ")}`);
+      resolved[platform] = AkanBin.#source(`${owner}: bin.${name}.${platform}`, source, baseDir);
+    }
+    return resolved;
+  }
+  static #source(at, source, baseDir) {
+    if (!source || typeof source !== "object" || Array.isArray(source))
+      throw new Error(`${at} must be { url, sha256 } or { path }`);
+    const { url, sha256, path: localPath, file, ...rest } = source;
+    const extra = Object.keys(rest);
+    if (extra.length)
+      throw new Error(`${at}: unknown key ${extra.join(", ")}`);
+    if (url === undefined === (localPath === undefined))
+      throw new Error(`${at} takes either url and sha256, or path`);
+    const resolved = url !== undefined ? AkanBin.#urlSource(at, url, sha256) : AkanBin.#pathSource(at, localPath, sha256, baseDir);
+    const archive = AkanBin.isArchive(resolved);
+    if (file === undefined) {
+      if (archive)
+        throw new Error(`${at} names an archive: file picks the executable inside it`);
+      return resolved;
+    }
+    if (!archive)
+      throw new Error(`${at}: file picks the executable out of an archive, and this source is none`);
+    const parts = typeof file === "string" ? file.split(/[\\/]/).filter((part) => part && part !== ".") : [];
+    if (!parts.length || path.isAbsolute(file) || parts.includes(".."))
+      throw new Error(`${at}: file must be a path inside the archive (got ${JSON.stringify(file)})`);
+    return { ...resolved, file: parts.join("/") };
+  }
+  static #urlSource(at, url, sha256) {
+    if (typeof url !== "string" || !URL.canParse(url) || !/^https?:$/.test(new URL(url).protocol))
+      throw new Error(`${at}: url must be an http(s) address`);
+    if (typeof sha256 !== "string" || !/^[0-9a-f]{64}$/i.test(sha256))
+      throw new Error(`${at}: sha256 must be the downloaded file's 64-digit hex digest`);
+    return { url, sha256: sha256.toLowerCase() };
+  }
+  static #pathSource(at, localPath, sha256, baseDir) {
+    if (typeof localPath !== "string" || !localPath)
+      throw new Error(`${at}: path must name a file`);
+    if (sha256 !== undefined)
+      throw new Error(`${at}: sha256 checks a download, and a path source downloads nothing`);
+    return { path: path.resolve(baseDir, localPath) };
+  }
+}
+// pkgs/@akanjs/devkit/akanConfig/akanConfig.ts
+import fs from "fs";
+import path3 from "path";
+import { fileURLToPath } from "url";
+import { DatabaseModes, normalizeRoutePrefix } from "akanjs/base";
+import { resolveAkanI18nConfig, trimSlashes } from "akanjs/common";
+
+// pkgs/@akanjs/devkit/transforms/serverEnvProfile.ts
+import { existsSync, realpathSync } from "fs";
+import path2 from "path";
+import { Logger, toError } from "akanjs/common";
 
 class ServerEnvProfile {
   static namePattern = /^[a-z][a-zA-Z0-9-]*$/;
+  static envFilePattern = /[\\/]env[\\/]env\.server\.[A-Za-z0-9-]+\.ts$/;
   static fileName(environment, profile) {
     return `env.server.${environment}.${profile}.ts`;
   }
   static profileFileOf(file, profile) {
     return file.replace(/\.ts$/, `.${profile}.ts`);
   }
-  static strip(value, at = "", underSecret = false) {
-    if (typeof value === "string")
-      return underSecret && value.trim() ? { value: undefined, stripped: [at] } : { value, stripped: [] };
-    if (!value || typeof value !== "object")
-      return { value, stripped: [] };
-    const stripped = [];
-    const strip = (key, child) => {
-      const result = ServerEnvProfile.strip(child, at ? `${at}.${key}` : key, underSecret || secretKey.test(key));
-      stripped.push(...result.stripped);
-      return result.value;
-    };
-    if (Array.isArray(value))
-      return { value: value.map((child, idx) => strip(String(idx), child)), stripped };
-    const kept = Object.fromEntries(Object.entries(value).map(([key, child]) => [key, strip(key, child)]).filter(([, child]) => child !== undefined));
-    return { value: kept, stripped };
-  }
-  static secretValues(value, at = "", underSecret = false) {
-    if (typeof value === "string") {
-      const named = secretKey.test(at.split(".").at(-1) ?? "");
-      const distinct = value.length >= 16 && !/^https?:\/\//.test(value) && !/^[a-z]+(?:[._-][a-z]+)*$/.test(value);
-      return underSecret && value.length >= 8 && (named || distinct) ? [{ path: at, value }] : [];
+  static #url(value) {
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(value))
+      return null;
+    try {
+      return new URL(value);
+    } catch {
+      return null;
     }
-    if (!value || typeof value !== "object")
-      return [];
-    return Object.entries(value).flatMap(([key, child]) => ServerEnvProfile.secretValues(child, at ? `${at}.${key}` : key, underSecret || secretKey.test(key)));
   }
-  static secretPaths(value, at = "", underSecret = false) {
+  static #carriesCredential(url) {
+    return !!url.password || [...url.searchParams.keys()].some((name) => Logger.isSecretKey(name));
+  }
+  static #isCredentialUrl(value) {
+    const url = ServerEnvProfile.#url(value);
+    return !!url && ServerEnvProfile.#carriesCredential(url);
+  }
+  static #isSecret(value, underSecret) {
+    return underSecret && !!value.trim() || ServerEnvProfile.#isCredentialUrl(value);
+  }
+  static #fold(value, fold, at = "", underSecret = false) {
     if (typeof value === "string")
-      return underSecret && value.trim() ? [at] : [];
+      return fold.text(value, at, underSecret);
     if (!value || typeof value !== "object")
-      return [];
-    return Object.entries(value).flatMap(([key, child]) => ServerEnvProfile.secretPaths(child, at ? `${at}.${key}` : key, underSecret || secretKey.test(key)));
+      return fold.other(value);
+    return fold.node(value, Object.entries(value).map(([key, child]) => [
+      key,
+      ServerEnvProfile.#fold(child, fold, at ? `${at}.${key}` : key, underSecret || Logger.isSecretKey(key))
+    ]));
+  }
+  static #collect(text) {
+    return { text, other: () => [], node: (_, children) => children.flatMap(([, found]) => found) };
+  }
+  static strip(value) {
+    return ServerEnvProfile.#fold(value, {
+      text: (text, at, underSecret) => ServerEnvProfile.#isSecret(text, underSecret) ? { value: undefined, stripped: [at] } : { value: text, stripped: [] },
+      other: (other) => ({ value: other, stripped: [] }),
+      node: (node, children) => {
+        const stripped = children.flatMap(([, result]) => result.stripped);
+        if (Array.isArray(node))
+          return {
+            value: children.flatMap(([, result]) => result.value === undefined || result.stripped.length && typeof result.value === "object" && !Object.keys(result.value ?? {}).length ? [] : [result.value]),
+            stripped
+          };
+        return {
+          value: Object.fromEntries(children.flatMap(([key, result]) => result.value === undefined ? [] : [[key, result.value]])),
+          stripped
+        };
+      }
+    });
+  }
+  static secretValues(value) {
+    return ServerEnvProfile.#fold(value, ServerEnvProfile.#collect((text, at, underSecret) => {
+      const url = ServerEnvProfile.#url(text);
+      if (url)
+        return ServerEnvProfile.#carriesCredential(url) || underSecret && (/webhook/i.test(at) || ServerEnvProfile.distinctive(text)) ? [...new Set([text, url.password])].filter((part) => part.length >= 8).map((part) => ({ path: at, value: part })) : [];
+      const named = Logger.isSecretKey(at.split(".").at(-1) ?? "");
+      return underSecret && text.length >= 8 && (named || ServerEnvProfile.distinctive(text)) ? [{ path: at, value: text }] : [];
+    }));
+  }
+  static distinctive(value) {
+    const url = ServerEnvProfile.#url(value);
+    if (url)
+      return ServerEnvProfile.#carriesCredential(url) || [...url.pathname.split("/"), ...url.searchParams.values()].some((part) => ServerEnvProfile.distinctive(part));
+    return value.length >= 16 && !/^https?:\/\//.test(value) && !/^[a-z]+(?:[._-][a-z]+)*$/.test(value);
+  }
+  static secretPaths(value) {
+    return ServerEnvProfile.#fold(value, ServerEnvProfile.#collect((text, at, underSecret) => ServerEnvProfile.#isSecret(text, underSecret) ? [at] : []));
   }
-  static async evaluate(file, cwd) {
+  static async evaluate(file, cwd, load) {
+    return (await ServerEnvProfile.#evaluated(file, cwd, load)).value;
+  }
+  static async#evaluated(file, cwd, load) {
+    const pattern = (regex, flags = "") => `new RegExp(${JSON.stringify(regex.source)}, "${flags}")`;
+    const literal = /(["'`])((?:\\[\s\S]|(?!\1)[^\\])*)\1/;
+    const frame = /^\s*at (?:[^(]*\()?(.+):(\d+):(\d+)\)?\s*$/;
     const script = [
-      "const { env } = await import(process.env.AKAN_PROFILE_ENV_FILE);",
-      'const plain = (_, value) => (typeof value === "function" || typeof value === "symbol" ? undefined : typeof value === "bigint" ? String(value) : value);',
-      "process.stdout.write(JSON.stringify(env ?? null, plain));"
+      "const waiting = new Map();",
+      'process.on("message", ({ load, error, loader, contents }) => {',
+      "  const reply = waiting.get(load);",
+      "  waiting.delete(load);",
+      "  if (error === undefined) reply?.resolve({ loader, contents });",
+      "  else reply?.reject(new Error(error));",
+      "});",
+      "if (process.env.AKAN_PROFILE_ENV_LOAD)",
+      "  Bun.plugin({",
+      '    name: "akan-server-env",',
+      "    setup(build) {",
+      "      build.onLoad({ filter: new RegExp(process.env.AKAN_PROFILE_ENV_LOAD) }, (args) =>",
+      "        new Promise((resolve, reject) => {",
+      "          waiting.set(args.path, { resolve, reject });",
+      "          process.send({ load: args.path });",
+      "        }));",
+      "    },",
+      "  });",
+      `const literal = ${pattern(literal, "g")};`,
+      `const interpolation = ${pattern(/\$\{[^}]*\}/)};`,
+      `const frameOf = ${pattern(frame)};`,
+      `const evaluating = ${pattern(/\s*\(evaluating '[\s\S]*'\)\s*$/)};`,
+      "const literalsOf = async (file) =>",
+      '  [...(await Bun.file(file).text().catch(() => "")).matchAll(literal)].flatMap((match) => match[2].split(interpolation));',
+      "const describe = async (error) => {",
+      "  const first = Array.isArray(error?.errors) && error.errors.length ? error.errors[0] : error;",
+      '  const frame = String(first?.stack ?? "").split("\\n").map((line) => frameOf.exec(line)).find(Boolean);',
+      "  const at = first?.position?.file ? [first.position.file, first.position.line, first.position.column] : frame ? frame.slice(1, 4) : [];",
+      "  const files = [process.env.AKAN_PROFILE_ENV_FILE, at[0]].filter(Boolean);",
+      "  const literals = (await Promise.all(files.map(literalsOf))).flat().filter((part) => part.length >= 4);",
+      '  let message = String(first?.message ?? first).replace(evaluating, "");',
+      "  for (const part of literals.sort((a, b) => b.length - a.length))",
+      '    message = message.split(part).join("[redacted]");',
+      '  const name = typeof first?.name === "string" && /^[A-Za-z]+$/.test(first.name) ? first.name : "Error";',
+      '  return name + ": " + message.slice(0, 200) + (at.length ? " (at " + at.join(":") + ")" : "");',
+      "};",
+      "try {",
+      "  const { env } = await import(process.env.AKAN_PROFILE_ENV_FILE);",
+      "  const lossy = [];",
+      "  const walk = (value, at) => {",
+      '    if (typeof value === "function" || typeof value === "symbol" || typeof value === "bigint" || (typeof value === "number" && !Number.isFinite(value))) return lossy.push(at);',
+      '    if (!value || typeof value !== "object") return;',
+      "    const proto = Object.getPrototypeOf(value);",
+      "    if (!Array.isArray(value) && proto !== Object.prototype && proto !== null) return lossy.push(at);",
+      '    for (const [key, child] of Object.entries(value)) walk(child, at ? at + "." + key : key);',
+      "  };",
+      '  walk(env, "");',
+      '  const plain = (_, value) => (typeof value === "function" || typeof value === "symbol" ? undefined : typeof value === "bigint" ? String(value) : value);',
+      '  process.send({ env: JSON.stringify(env ?? null, plain) ?? "null", lossy }, undefined, undefined, () => process.disconnect());',
+      "} catch (error) {",
+      "  process.exitCode = 1;",
+      "  process.send({ failure: await describe(error) }, undefined, undefined, () => process.disconnect());",
+      "}"
     ].join(`
 `);
+    let sent;
+    let failure;
+    let loadError;
     const child = Bun.spawn([process.execPath, "--eval", script], {
       cwd,
-      env: { PATH: process.env.PATH ?? "", HOME: process.env.HOME ?? "", AKAN_PROFILE_ENV_FILE: file },
-      stdout: "pipe",
-      stderr: "pipe"
+      env: {
+        PATH: process.env.PATH ?? "",
+        HOME: process.env.HOME ?? "",
+        AKAN_PROFILE_ENV_FILE: file,
+        ...load ? { AKAN_PROFILE_ENV_LOAD: ServerEnvProfile.envFilePattern.source } : {}
+      },
+      stdout: "ignore",
+      stderr: "ignore",
+      serialization: "json",
+      ipc: (message, subprocess) => {
+        if ("env" in message) {
+          sent = message;
+          return;
+        }
+        if ("failure" in message) {
+          failure = message.failure;
+          return;
+        }
+        if (!load)
+          return;
+        const requested = message.load;
+        load(requested).then(({ loader, contents }) => ({ load: requested, loader, contents }), (error) => {
+          loadError ??= error;
+          return { load: requested, error: toError(error).message };
+        }).then((reply) => subprocess.send(reply)).catch(() => {
+          return;
+        });
+      }
     });
-    const [stdout, stderr, exitCode] = await Promise.all([
-      new Response(child.stdout).text(),
-      new Response(child.stderr).text(),
-      child.exited
-    ]);
-    if (exitCode !== 0)
-      throw new Error(`${path.basename(file)} could not be evaluated to check it for secrets:
-${stderr.trim()}`);
-    return JSON.parse(stdout || "null");
+    const exitCode = await child.exited;
+    if (exitCode !== 0 || !sent) {
+      if (loadError)
+        throw loadError;
+      throw new Error(`${path2.basename(file)} could not be evaluated to check it for secrets: ${failure ?? `its process exited with code ${exitCode} and sent nothing`}`);
+    }
+    return { value: JSON.parse(sent.env), lossy: sent.lossy };
+  }
+  static async sourceInPlaceOf(profileFile, replacedFile, profile) {
+    const contents = await Bun.file(profileFile).text();
+    const dir = path2.dirname(profileFile);
+    const replaced = ServerEnvProfile.#real(replacedFile);
+    const selfImports = new Bun.Transpiler({ loader: "ts" }).scanImports(contents).flatMap(({ path: specifier }) => {
+      try {
+        return ServerEnvProfile.#real(Bun.resolveSync(specifier, dir)) === replaced ? [specifier] : [];
+      } catch {
+        return [];
+      }
+    });
+    if (selfImports.length)
+      throw new Error(`${path2.basename(profileFile)} imports ${selfImports.join(", ")}, the file a "${profile}" build bundles it in place of, so it would import itself. Write the values it needs into it instead.`);
+    return contents;
+  }
+  static #real(file) {
+    return existsSync(file) ? realpathSync.native(file) : path2.resolve(file);
+  }
+  static async libEnvSource(file, profile, chain = []) {
+    if (chain.includes(file))
+      throw new Error(`${[...chain, file].join(" -> ")}: lib env files reach each other, which a "${profile}" build cannot swap.`);
+    const profileFile = ServerEnvProfile.profileFileOf(file, profile);
+    const libRoot = path2.dirname(path2.dirname(file));
+    if (await Bun.file(profileFile).exists()) {
+      const contents = await ServerEnvProfile.sourceInPlaceOf(profileFile, file, profile);
+      const reached = [...chain, file];
+      const value = await ServerEnvProfile.evaluate(profileFile, libRoot, (envFile) => ServerEnvProfile.#underProfile(envFile, profile, new Set, reached));
+      const secrets = ServerEnvProfile.secretPaths(value);
+      if (secrets.length)
+        throw new Error(`${profileFile} holds secret-named values, which the "${profile}" bundle carries to every computer it runs on: ${secrets.join(", ")}.`);
+      return { loader: "ts", contents, profileFile: true, stripped: [] };
+    }
+    const { exports } = new Bun.Transpiler({ loader: "ts" }).scan(await Bun.file(file).text());
+    if (exports.some((name) => name !== "env"))
+      throw new Error(`${file} exports ${exports.join(", ")}: a "${profile}" build carries only a lib env's \`env\`, so give the lib ${path2.basename(profileFile)}.`);
+    const evaluated = await ServerEnvProfile.#evaluated(file, libRoot);
+    if (evaluated.lossy.length)
+      throw new Error(`${file} holds ${evaluated.lossy.join(", ")}, which a "${profile}" build cannot carry: it bundles a lib env's defaults as JSON, which keeps no function, Map, Set, Date or class instance. Give the lib ${path2.basename(profileFile)}.`);
+    const { value, stripped } = ServerEnvProfile.strip(evaluated.value);
+    return {
+      loader: "js",
+      contents: `export const env = ${JSON.stringify(value ?? {})};
+`,
+      profileFile: false,
+      stripped
+    };
+  }
+  static async#underProfile(envFile, profile, appEnvDirs, chain) {
+    const name = path2.basename(envFile, ".ts").slice("env.server.".length);
+    if (appEnvDirs.has(path2.dirname(envFile)) || name === "type" || name === "example")
+      return { loader: "ts", contents: await Bun.file(envFile).text() };
+    const { loader, contents } = await ServerEnvProfile.libEnvSource(envFile, profile, chain);
+    return { loader, contents };
   }
   static async assertShippable({ envDir, environment, profile }) {
     if (!ServerEnvProfile.namePattern.test(profile))
       throw new Error(`The server env profile "${profile}" must be a lowercase-first name of letters, digits and dashes.`);
     const name = ServerEnvProfile.fileName(environment, profile);
-    const file = path.join(envDir, name);
+    const file = path2.join(envDir, name);
     if (!await Bun.file(file).exists())
       throw new Error(`The server env profile "${profile}" bundles env/${name} in place of env/env.server.${environment}.ts, and there is no such file.`);
-    const secrets = ServerEnvProfile.secretPaths(await ServerEnvProfile.evaluate(file, path.dirname(envDir)));
+    await ServerEnvProfile.sourceInPlaceOf(file, path2.join(envDir, `env.server.${environment}.ts`), profile);
+    const appEnvDirs = new Set([path2.resolve(envDir), realpathSync.native(envDir)]);
+    const value = await ServerEnvProfile.evaluate(file, path2.dirname(envDir), (envFile) => ServerEnvProfile.#underProfile(envFile, profile, appEnvDirs, []));
+    const secrets = ServerEnvProfile.secretPaths(value);
     if (secrets.length)
       throw new Error(`env/${name} holds secret-named values, which a profile's bundle carries to every computer it runs on: ${secrets.join(", ")}. Leave them out, or read them from the process env of the server that needs them.`);
   }
 }
 
-// pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
-import { readdir, rm } from "fs/promises";
-import path3 from "path";
-
-// pkgs/@akanjs/devkit/transforms/asyncDefaultExportDetector.ts
-import fs from "fs";
-import path2 from "path";
-
-class AsyncDefaultExportDetector {
-  static #typescriptLoad;
-  static #loadTypescript() {
-    AsyncDefaultExportDetector.#typescriptLoad ??= import("typescript").then((mod) => mod.default ?? mod);
-    return AsyncDefaultExportDetector.#typescriptLoad;
-  }
-  static async detect(moduleAbsPath) {
-    try {
-      const typescript = await AsyncDefaultExportDetector.#loadTypescript();
-      const source = fs.readFileSync(path2.resolve(moduleAbsPath), "utf8");
-      const sourceFile = typescript.createSourceFile(moduleAbsPath, source, typescript.ScriptTarget.Latest, true, /\.[tj]sx$/.test(moduleAbsPath) ? typescript.ScriptKind.TSX : typescript.ScriptKind.TS);
-      return new AsyncDefaultExportDetector(typescript).detectInSourceFile(sourceFile);
-    } catch {
-      return false;
-    }
-  }
-  #ts;
-  constructor(typescript) {
-    this.#ts = typescript;
-  }
-  detectInSourceFile(sourceFile) {
-    const ts = this.#ts;
-    const asyncBindings = new Map;
-    let defaultIdentifier = null;
-    for (const statement of sourceFile.statements) {
-      if (ts.isFunctionDeclaration(statement)) {
-        if (this.#hasModifier(statement, ts.SyntaxKind.DefaultKeyword)) {
-          return this.#hasModifier(statement, ts.SyntaxKind.AsyncKeyword);
-        }
-        if (statement.name) {
-          asyncBindings.set(statement.name.text, this.#hasModifier(statement, ts.SyntaxKind.AsyncKeyword));
-        }
-        continue;
-      }
-      if (ts.isVariableStatement(statement)) {
-        for (const declaration of statement.declarationList.declarations) {
-          if (!ts.isIdentifier(declaration.name))
-            continue;
-          asyncBindings.set(declaration.name.text, this.#isAsyncFunctionExpression(declaration.initializer));
-        }
-        continue;
-      }
-      if (ts.isExportAssignment(statement)) {
-        if (this.#isAsyncFunctionExpression(statement.expression))
-          return true;
-        if (ts.isCallExpression(statement.expression))
-          return true;
-        if (ts.isIdentifier(statement.expression))
-          defaultIdentifier = statement.expression.text;
-        continue;
-      }
-      if (ts.isExportDeclaration(statement) && statement.exportClause && ts.isNamedExports(statement.exportClause)) {
-        for (const specifier of statement.exportClause.elements) {
-          if (specifier.name.text !== "default")
-            continue;
-          defaultIdentifier = specifier.propertyName?.text ?? specifier.name.text;
-        }
-      }
-    }
-    return defaultIdentifier ? asyncBindings.get(defaultIdentifier) === true : false;
-  }
-  #hasModifier(node, kind) {
-    const ts = this.#ts;
-    return ts.canHaveModifiers(node) && (ts.getModifiers(node)?.some((modifier) => modifier.kind === kind) ?? false);
-  }
-  #isAsyncFunctionExpression(node) {
-    const ts = this.#ts;
-    return Boolean(node && (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) && this.#hasModifier(node, ts.SyntaxKind.AsyncKeyword));
+// pkgs/@akanjs/devkit/akanConfig/akanConfig.ts
+var DEFAULT_BARREL_IMPORTS = ["akanjs/webkit", "akanjs/common", "akanjs/ui", "akanjs/server"];
+var DEFAULT_OPTIMIZE_IMPORTS = [
+  "lucide-react date-fns lodash-es ramda antd react-bootstrap ahooks @ant-design/icons @headlessui/react",
+  "@headlessui-float/react @heroicons/react/20/solid @heroicons/react/24/solid @heroicons/react/24/outline",
+  "@visx/visx @tremor/react rxjs @mui/material @mui/icons-material recharts react-use @material-ui/core",
+  "@material-ui/icons @tabler/icons-react mui-core react-icons/*"
+].flatMap((line) => line.split(" "));
+var WORKSPACE_BARREL_FACETS = ["ui", "webkit", "common", "client", "server"];
+var DEFAULT_DOCKER_IMAGE = "oven/bun:1-slim";
+var SSR_RUNTIME_PACKAGES = ["react", "react-dom", "react-server-dom-webpack"];
+var DEFAULT_AKAN_IMAGE_CONFIG = {
+  deviceSizes: [640, 750, 828, 1080, 1200, 1920, 2048, 3840],
+  imageSizes: [32, 48, 64, 96, 128, 256, 384],
+  formats: ["image/webp"],
+  qualities: [75],
+  minimumCacheTTL: 14400,
+  remotePatterns: [],
+  localPatterns: [{ pathname: "/**" }],
+  dangerouslyAllowSVG: false,
+  maximumRedirects: 3,
+  fetchTimeoutMs: 7000,
+  maxRemoteBytes: 25 * 1024 * 1024,
+  maxConcurrency: 0
+};
+var normalizeIndexPath = (indexPath) => {
+  const normalized = indexPath?.trim();
+  if (!normalized)
+    return;
+  const path = `/${normalized.replace(/^\/+|\/+$/g, "")}`;
+  return path === "/" ? "/" : path;
+};
+var normalizeStringList = (values) => {
+  const normalized = values?.map((value) => value.trim()).filter(Boolean) ?? [];
+  return normalized.length > 0 ? [...new Set(normalized)] : undefined;
+};
+var sanitizeAppIdSegment = (value) => {
+  const cleaned = value.toLowerCase().replace(/[^a-z0-9]+/g, "");
+  if (!cleaned)
+    return "app";
+  return /^[a-z]/.test(cleaned) ? cleaned : `app${cleaned}`;
+};
+var deriveDefaultAppId = (orgName, appName) => `com.${sanitizeAppIdSegment(orgName)}.${sanitizeAppIdSegment(appName)}`;
+var normalizeDeepLinkDomain = (domain) => {
+  const normalized = domain.trim();
+  if (!normalized)
+    return "";
+  try {
+    const url = new URL(normalized.includes("://") ? normalized : `https://${normalized}`);
+    return url.host.toLowerCase();
+  } catch {
+    return normalized.replace(/^https?:\/\//, "").replace(/\/+$/g, "").toLowerCase();
   }
-}
-
-// pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
-var LAYOUT_KEY_RE = /^\.\/(.+\/)?_layout\.(tsx|ts|jsx|js)$/;
-var IMPLICIT_LAYOUT_DIR = path3.join(".akan", "generated", "root-layouts");
-var IMPLICIT_DICT_DIR = path3.join(".akan", "generated", "dict");
-var IMPLICIT_OVERRIDES_DIR = path3.join(".akan", "generated", "overrides");
-var OVERRIDES_KEY_RE = /^\.\/(.+\/)?_overrides\.(tsx|ts|jsx|js)$/;
-var importSpecifier = (fromAbsPath, toAbsPath) => {
-  const rel = path3.relative(path3.dirname(fromAbsPath), toAbsPath).split(path3.sep).join("/");
-  return rel.startsWith(".") ? rel : `./${rel}`;
 };
-async function writeGeneratedOverridesLayoutFile(opts) {
-  const filename = `${opts.key.replace(/^\.\//, "").replace(/[^a-zA-Z0-9]+/g, "_")}.tsx`;
-  const absPath = path3.join(path3.resolve(opts.appCwdPath), IMPLICIT_OVERRIDES_DIR, filename);
-  const source = `"use client";
-import { UiOverrideProvider } from "akanjs/ui";
-import { createElement, type ReactNode } from "react";
-import value from ${JSON.stringify(importSpecifier(absPath, opts.userAbsPath))};
-
-export default function AkanUiOverridesLayout({ children }: { children?: ReactNode }) {
-  return createElement(UiOverrideProvider, { value }, children);
-}
-`;
-  await Bun.write(absPath, source);
-  return absPath;
-}
-async function pruneGeneratedFiles(dirAbsPath, keepAbsPaths) {
-  const keep = new Set(keepAbsPaths);
-  const names = await readdir(dirAbsPath).catch(() => []);
-  await Promise.all(names.map((name) => path3.join(dirAbsPath, name)).filter((absPath) => !keep.has(absPath)).map((absPath) => rm(absPath, { force: true })));
-}
-function getRootBoundarySegments(key) {
-  const match = LAYOUT_KEY_RE.exec(key);
-  if (!match)
-    return null;
-  const prefix = match[1]?.replace(/\/$/, "");
-  if (!prefix)
+var normalizeDeepLinks = (deepLinks) => {
+  const schemes = normalizeStringList(deepLinks?.schemes);
+  const domains = normalizeStringList(deepLinks?.domains?.map(normalizeDeepLinkDomain));
+  if (!schemes && !domains)
+    return;
+  return { ...schemes ? { schemes } : {}, ...domains ? { domains } : {} };
+};
+var emptyLibContributions = () => ({
+  externalLibs: [],
+  trustedDependencies: [],
+  bin: [],
+  docker: { preRuns: [], postRuns: [] },
+  keepFonts: []
+});
+var normalizePackageNames = (names, owner) => {
+  if (names === undefined)
     return [];
-  return prefix.split("/").filter(Boolean);
-}
-function implicitRootLayoutKey(segments) {
-  return `./${[...segments, "__root_layout"].join("/")}.tsx`;
-}
-function implicitRootLayoutAbsPath(appCwdPath, segments) {
-  const filename = segments.length ? `${segments.join("__")}__root_layout.tsx` : "__root_layout.tsx";
-  return path3.join(path3.resolve(appCwdPath), IMPLICIT_LAYOUT_DIR, filename);
-}
-function isRootBoundarySegments(segments, basePaths) {
-  const firstVisibleIndex = segments.findIndex((segment) => !/^\(.+\)$/.test(segment));
-  if (firstVisibleIndex === -1)
-    return segments.length <= 1;
-  if (segments.slice(firstVisibleIndex + 1).some((segment) => /^\(.+\)$/.test(segment)))
-    return false;
-  const visible = segments.slice(firstVisibleIndex);
-  const allowedBasePaths = new Set([...basePaths].map((basePath) => basePath.trim()).filter(Boolean));
-  return visible.length === 1 && (firstVisibleIndex > 0 || allowedBasePaths.has(visible[0] ?? ""));
-}
-function findRootBoundaries(pageKeys, appCwdPath, basePaths) {
-  const boundaries = new Map;
-  for (const key of pageKeys) {
-    const segments = getRootBoundarySegments(key);
-    if (!segments)
-      continue;
-    if (!isRootBoundarySegments(segments, basePaths))
-      continue;
-    const id = segments.join("/");
-    boundaries.set(id, {
-      sourceKey: key,
-      sourceAbsPath: path3.resolve(appCwdPath, "page", key.replace(/^\.\//, "")),
-      segments
-    });
-  }
-  if (boundaries.size === 0)
-    boundaries.set("", { sourceKey: null, sourceAbsPath: null, segments: [] });
-  return [...boundaries.values()].sort((a, b) => a.segments.join("/").localeCompare(b.segments.join("/")));
+  if (!Array.isArray(names) || names.some((name) => typeof name !== "string" || !name.trim()))
+    throw new Error(`${owner}: trustedDependencies lists package names`);
+  return [...new Set(names.map((name) => name.trim()))];
+};
+var normalizeKeepFonts = (keepFonts) => [
+  ...new Set((keepFonts ?? []).map((glob) => glob.trim().replace(/^\/+/, "")).filter(Boolean))
+];
+var dedupeDockerRuns = (runs) => {
+  const byKey = new Map;
+  for (const run of runs)
+    byKey.set(typeof run === "string" ? run : JSON.stringify(run), run);
+  return [...byKey.values()];
+};
+
+class LibConfigRefusal extends Error {
 }
-function hasAncestorRootBoundary(boundary, boundaries) {
-  return boundaries.some((candidate) => candidate !== boundary && candidate.segments.length < boundary.segments.length && candidate.segments.every((segment, index) => boundary.segments[index] === segment));
-}
-function findExplicitRootLayoutAbsPath(pageKeys, appCwdPath) {
-  const rootLayoutKey = pageKeys.find((key) => {
-    const segments = getRootBoundarySegments(key);
-    return segments !== null && segments.length === 0;
-  });
-  return rootLayoutKey ? path3.resolve(appCwdPath, "page", rootLayoutKey.replace(/^\.\//, "")) : null;
-}
-async function assertEnvClientConvention(appCwdPath, appName) {
-  const envPath = path3.join(appCwdPath, "env", "env.client.ts");
-  if (!await Bun.file(envPath).exists()) {
-    throw new Error(`[route-convention] app "${appName}" must provide env/env.client.ts exporting "env" for generated System.Provider`);
-  }
-}
-async function writeGeneratedDictionaryMacroFile(appCwdPath, appName) {
-  const absPath = path3.join(path3.resolve(appCwdPath), IMPLICIT_DICT_DIR, "useDict.ts");
-  await Bun.write(absPath, `import { getAllDictionary } from "@apps/${appName}/lib/dict" with { type: "macro" };
-
-export const allDictionary = getAllDictionary();
-`);
-  return absPath;
-}
-async function writeGeneratedRootLayoutFile(opts) {
-  await assertEnvClientConvention(opts.appCwdPath, opts.appName);
-  const dictMacroAbsPath = opts.includeSystemProvider ? await writeGeneratedDictionaryMacroFile(opts.appCwdPath, opts.appName) : null;
-  const absPath = implicitRootLayoutAbsPath(opts.appCwdPath, opts.boundary.segments);
-  const dictMacroSpecifier = dictMacroAbsPath ? importSpecifier(absPath, dictMacroAbsPath) : null;
-  const sourceSpecifier = opts.boundary.sourceAbsPath ? importSpecifier(absPath, opts.boundary.sourceAbsPath) : null;
-  const inheritedSourceAbsPath = opts.rootSourceAbsPath && opts.rootSourceAbsPath !== opts.boundary.sourceAbsPath ? opts.rootSourceAbsPath : null;
-  const inheritedSourceSpecifier = inheritedSourceAbsPath ? importSpecifier(absPath, inheritedSourceAbsPath) : null;
-  const clientImport = opts.includeStInit ? `import { st } from "@apps/${opts.appName}/client";
-void st;
-` : `import "@apps/${opts.appName}/client";
-`;
-  const inheritedLabel = inheritedSourceAbsPath ? path3.relative(opts.appCwdPath, inheritedSourceAbsPath) : "";
-  const inheritedImport = inheritedSourceSpecifier ? `import * as inheritedModule from ${JSON.stringify(inheritedSourceSpecifier)};
-const inheritedLayout = resolveRouteModule(inheritedModule as never, ${JSON.stringify(inheritedLabel)}).module as LayoutModule;
-` : `const inheritedLayout: LayoutModule = {};
-`;
-  const prefix = opts.boundary.segments.find((segment) => !/^\(.+\)$/.test(segment)) ?? null;
-  const userLabel = opts.boundary.sourceAbsPath ? path3.relative(opts.appCwdPath, opts.boundary.sourceAbsPath) : "";
-  const userImport = sourceSpecifier ? `import * as userModule from ${JSON.stringify(sourceSpecifier)};
-const userLayout = resolveRouteModule(userModule as never, ${JSON.stringify(userLabel)}).module as LayoutModule;
-const UserLayout = userLayout.default as (props: LayoutProps) => ReactNode | Promise<ReactNode>;
-` : `const UserLayout = ({ children }: LayoutProps) => children;
-const userLayout: LayoutModule = {};
-`;
-  const isAsyncUserLayout = opts.boundary.sourceAbsPath ? await AsyncDefaultExportDetector.detect(opts.boundary.sourceAbsPath) : false;
-  const userLayoutElement = "<UserLayout params={params} searchParams={searchParams}>{children}</UserLayout>";
-  const layoutSignature = isAsyncUserLayout ? "export default async function GeneratedLayout" : "export default function GeneratedLayout";
-  const layoutBinding = isAsyncUserLayout ? `  const layout =
-    process.env.AKAN_PUBLIC_RENDER_ENV === "csr"
-      ? await UserLayout({ params, searchParams, children })
-      : ${userLayoutElement};
-` : "";
-  const layoutChild = isAsyncUserLayout ? "{layout}" : userLayoutElement;
-  const layoutReturn = isAsyncUserLayout ? "layout" : userLayoutElement;
-  const headLayouts = opts.includeSystemProvider ? "[inheritedLayout, userLayout]" : "[userLayout]";
-  const layoutExports = `export async function generateHead(props: PageProps) {
-  const heads = await Promise.all(
-    ${headLayouts}.map((layout) => (layout.generateHead ? layout.generateHead(props) : layout.head)),
-  );
-  return RouteHead.mergeNodes(heads);
-}
-
-export const NotFound = userLayout.NotFound ?? inheritedLayout.NotFound;
-export const Error = userLayout.Error ?? inheritedLayout.Error;
-export const pageConfig = userLayout.pageConfig ?? inheritedLayout.pageConfig;
-
-${layoutSignature}({ children, params, searchParams }: LayoutProps) {
-${layoutBinding}  return `;
-  const source = opts.includeSystemProvider ? `import type { LayoutModule, LayoutProps, PageProps } from "akanjs/client";
-import { loadFonts, resolveRouteModule, RouteHead } from "akanjs/client";
-import type { ReactNode } from "react";
-import { System } from "akanjs/ui";
-import { env } from "@apps/${opts.appName}/env/env.client";
-import { allDictionary } from ${JSON.stringify(dictMacroSpecifier)};
-${clientImport}${inheritedImport}${userImport}
-const userFonts = userLayout.fonts ?? inheritedLayout.fonts ?? [];
-const defaultFonts = userFonts.filter((font) => font.default);
-if (defaultFonts.length > 1) throw new Error("[route-convention] only one default font is allowed per root layout");
-const defaultFont = defaultFonts[0];
-const defaultFontClassName = defaultFont ? (defaultFont.className ?? \`font-\${defaultFont.name}\`) : undefined;
-export const theme = userLayout.theme ?? inheritedLayout.theme;
-export const viewport = userLayout.viewport ?? inheritedLayout.viewport;
-export const manifest = userLayout.manifest ?? inheritedLayout.manifest;
-
-${layoutExports}(
-    <System.Provider
-      of={GeneratedLayout as never}
-      appName=${JSON.stringify(opts.appName)}
-      ${prefix ? `prefix=${JSON.stringify(prefix)}
-      ` : ""}params={params}
-      manifest={manifest}
-      env={env}
-      theme={theme}
-      viewport={viewport}
-      fonts={loadFonts(userFonts)}
-      className={defaultFontClassName}
-      layoutStyle={userLayout.layoutStyle ?? inheritedLayout.layoutStyle}
-      reconnect={userLayout.reconnect ?? inheritedLayout.reconnect ?? false}
-      wsConnect={userLayout.wsConnect ?? inheritedLayout.wsConnect ?? true}
-      allDictionary={process.env.AKAN_PUBLIC_RENDER_ENV === "ssr" ? allDictionary : undefined}
-    >
-      ${layoutChild}
-    </System.Provider>
-  );
-}
-` : `import type { LayoutModule, LayoutProps, PageProps } from "akanjs/client";
-import { resolveRouteModule, RouteHead } from "akanjs/client";
-import type { ReactNode } from "react";
-${inheritedImport}${userImport}
-${layoutExports}${layoutReturn};
-}
-`;
-  await Bun.write(absPath, source);
-  return absPath;
-}
-async function resolveSsrPageEntries(opts) {
-  const absPageDir = path3.resolve(opts.appCwdPath, "page");
-  const hasSt = await Bun.file(path3.join(opts.appCwdPath, "lib", "st.ts")).exists();
-  const basePaths = opts.basePaths ?? [];
-  const rootSourceAbsPath = findExplicitRootLayoutAbsPath(opts.pageKeys, opts.appCwdPath);
-  const rootBoundaries = findRootBoundaries(opts.pageKeys, opts.appCwdPath, basePaths);
-  const rootLayoutKeys = new Set(opts.pageKeys.filter((key) => {
-    const segments = getRootBoundarySegments(key);
-    return segments !== null && isRootBoundarySegments(segments, basePaths);
-  }));
-  const base = await Promise.all(opts.pageKeys.filter((key) => !rootLayoutKeys.has(key)).map(async (key) => {
-    const userAbsPath = path3.resolve(absPageDir, key);
-    if (OVERRIDES_KEY_RE.test(key)) {
-      const moduleAbsPath = await writeGeneratedOverridesLayoutFile({
-        appCwdPath: opts.appCwdPath,
-        key,
-        userAbsPath
-      });
-      return { key, moduleAbsPath, seedAbsPaths: [userAbsPath] };
-    }
-    return { key, moduleAbsPath: userAbsPath };
-  }));
-  const generated = await Promise.all(rootBoundaries.map(async (boundary) => ({
-    key: implicitRootLayoutKey(boundary.segments),
-    moduleAbsPath: await writeGeneratedRootLayoutFile({
-      appCwdPath: opts.appCwdPath,
-      appName: opts.appName,
-      boundary,
-      rootSourceAbsPath,
-      includeStInit: hasSt && boundary.segments.length === 0,
-      includeSystemProvider: !hasAncestorRootBoundary(boundary, rootBoundaries)
-    }),
-    seedAbsPaths: [...new Set([boundary.sourceAbsPath, rootSourceAbsPath].filter((absPath) => absPath !== null))]
-  })));
-  const appCwdAbsPath = path3.resolve(opts.appCwdPath);
-  await Promise.all([
-    pruneGeneratedFiles(path3.join(appCwdAbsPath, IMPLICIT_OVERRIDES_DIR), base.filter(({ key }) => OVERRIDES_KEY_RE.test(key)).map(({ moduleAbsPath }) => moduleAbsPath)),
-    pruneGeneratedFiles(path3.join(appCwdAbsPath, IMPLICIT_LAYOUT_DIR), generated.map(({ moduleAbsPath }) => moduleAbsPath))
-  ]);
-  return [...base, ...generated].sort((a, b) => a.key.localeCompare(b.key));
-}
-async function resolveSsrPageEntriesForApp(app, pageKeys) {
-  const config = await app.getConfig();
-  return resolveSsrPageEntries({ appCwdPath: app.cwdPath, appName: app.name, pageKeys, basePaths: config.basePaths });
-}
-
-// pkgs/@akanjs/devkit/codegenLock.ts
-import { mkdir, open, readFile, rm as rm2, stat } from "fs/promises";
-import path4 from "path";
-import { Logger } from "akanjs/common";
-
-class CodegenLock {
-  static fileName = "codegen.lock";
-  static waitTimeoutMs = 1e4;
-  static unknownHolderStaleMs = 60000;
-  static #pollMs = 25;
-  static #logger = new Logger("CodegenLock");
-  static #queue = Promise.resolve();
-  static pathIn(workspaceRoot) {
-    return path4.join(workspaceRoot, "local", ".akan", CodegenLock.fileName);
-  }
-  static async run(workspaceRoot, label, fn) {
-    const ahead = CodegenLock.#queue;
-    let done;
-    CodegenLock.#queue = new Promise((resolve) => {
-      done = resolve;
-    });
-    try {
-      await CodegenLock.#waitForQueue(ahead, label);
-      return await CodegenLock.#withFileLock(workspaceRoot, label, fn);
-    } finally {
-      done();
-    }
-  }
-  static async#waitForQueue(ahead, label) {
-    let timer = null;
-    const expired = new Promise((resolve) => {
-      timer = setTimeout(() => resolve("expired"), CodegenLock.waitTimeoutMs);
-    });
-    try {
-      if (await Promise.race([ahead.then(() => "done"), expired]) === "expired")
-        CodegenLock.#logger.warn(`codegen lock queued past ${CodegenLock.waitTimeoutMs}ms in this process; continuing without waiting (${label})`);
-    } finally {
-      if (timer)
-        clearTimeout(timer);
-    }
-  }
-  static async#withFileLock(workspaceRoot, label, fn) {
-    const lockPath = CodegenLock.pathIn(workspaceRoot);
-    await mkdir(path4.dirname(lockPath), { recursive: true }).catch(() => {
-      return;
-    });
-    const held = await CodegenLock.#acquire(lockPath, label);
-    try {
-      return await fn();
-    } finally {
-      if (held)
-        await rm2(lockPath, { force: true }).catch(() => {
-          return;
-        });
-    }
-  }
-  static async#acquire(lockPath, label) {
-    const deadline = Date.now() + CodegenLock.waitTimeoutMs;
-    for (;; ) {
-      const handle = await open(lockPath, "wx").catch(() => null);
-      if (handle) {
-        await handle.writeFile(JSON.stringify({ pid: process.pid, at: Date.now(), label })).catch(() => {
-          return;
-        });
-        await handle.close().catch(() => {
-          return;
-        });
-        return true;
-      }
-      if (await CodegenLock.#reclaimIfAbandoned(lockPath))
-        continue;
-      if (Date.now() >= deadline) {
-        CodegenLock.#logger.warn(`codegen lock at ${lockPath} held past ${CodegenLock.waitTimeoutMs}ms; continuing without it (${label})`);
-        return false;
-      }
-      await Bun.sleep(CodegenLock.#pollMs);
-    }
-  }
-  static async#reclaimIfAbandoned(lockPath) {
-    const info = await stat(lockPath).catch(() => null);
-    if (!info)
-      return true;
-    const holder = CodegenLock.#parseHolder(await readFile(lockPath, "utf8").catch(() => ""));
-    if (holder) {
-      if (CodegenLock.#isAlive(holder.pid))
-        return false;
-    } else if (Date.now() - info.mtimeMs < CodegenLock.unknownHolderStaleMs)
-      return false;
-    await rm2(lockPath, { force: true }).catch(() => {
-      return;
-    });
-    return true;
-  }
-  static #parseHolder(raw) {
-    try {
-      const parsed = JSON.parse(raw);
-      if (typeof parsed.pid !== "number" || typeof parsed.at !== "number")
-        return null;
-      return { pid: parsed.pid, at: parsed.at, label: typeof parsed.label === "string" ? parsed.label : "" };
-    } catch {
-      return null;
-    }
-  }
-  static #isAlive(pid) {
-    if (!Number.isInteger(pid) || pid <= 0)
-      return false;
-    try {
-      process.kill(pid, 0);
-      return true;
-    } catch (error) {
-      return error.code === "EPERM";
-    }
-  }
-}
-
-// pkgs/@akanjs/devkit/spinner.ts
-import ora from "ora";
-
-class Spinner {
-  static padding = 12;
-  static oraOptions = { discardStdin: false };
-  static canAnimate(stream = process.stderr) {
-    return !stream.isTTY || stream.columns > 0;
-  }
-  spinner;
-  stopWatch = null;
-  startAt = new Date;
-  prefix;
-  message;
-  enableSpin;
-  constructor(message, { prefix = "", indent = 0, enableSpin = true } = {}) {
-    Spinner.padding = Math.max(Spinner.padding, prefix.length);
-    this.prefix = prefix;
-    this.message = message;
-    this.spinner = ora({ ...Spinner.oraOptions, text: message });
-    this.spinner.prefixText = prefix.padStart(Spinner.padding, " ");
-    this.spinner.indent = indent;
-    this.enableSpin = enableSpin && Spinner.canAnimate();
-  }
-  start() {
-    this.startAt = new Date;
-    if (this.enableSpin) {
-      this.spinner.start();
-      this.stopWatch = setInterval(() => {
-        this.spinner.prefixText = this.prefix.padStart(Spinner.padding, " ");
-        this.spinner.text = `${this.message} (${this.#getElapsedTimeStr({ floor: true })})`;
-      }, 1000);
-    } else
-      this.spinner.info();
-    return this;
-  }
-  succeed(message) {
-    this.spinner.succeed(`${message} (${this.#getElapsedTimeStr()})`);
-    this.#reset();
-  }
-  fail(message) {
-    this.spinner.fail(`${message} (${this.#getElapsedTimeStr()})`);
-    this.#reset();
-  }
-  isSpinning() {
-    return this.spinner.isSpinning;
-  }
-  #reset() {
-    if (this.stopWatch)
-      clearInterval(this.stopWatch);
-    this.stopWatch = null;
-  }
-  #getElapsedTimeStr({ floor = false } = {}) {
-    const ms = Date.now() - this.startAt.getTime();
-    if (ms < 1000)
-      return `${ms}ms`;
-    const s = Math.floor(ms / 1000);
-    if (s < 60)
-      return `${floor ? Math.floor(ms / 1000) : Math.floor(ms / 100) / 10}s`;
-    const m = Math.floor(s / 60);
-    return `${m}m ${s % 60}s`;
-  }
-}
-
-// pkgs/@akanjs/devkit/executors.ts
-import {
-  exec,
-  fork,
-  spawn as spawn2
-} from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import {
-  copyFile,
-  cp as cpEntry,
-  lstat,
-  mkdir as mkdir2,
-  readdir as readDirEntries,
-  realpath,
-  rm as rm3,
-  stat as stat2,
-  symlink
-} from "fs/promises";
-import path12 from "path";
-import { pathToFileURL } from "url";
-import {
-  capitalize,
-  getPageSourceFileViolation,
-  isRouteSourceFile,
-  Logger as Logger2,
-  parseRouteModuleKey,
-  validatePageSourceFile,
-  validateSubRoutePageKey
-} from "akanjs/common";
-var {$ } = globalThis.Bun;
-import chalk2 from "chalk";
-
-// pkgs/@akanjs/devkit/agentsIndex.ts
-var recipeScannerLoad = null;
-var loadRecipeScanner = () => recipeScannerLoad ??= import("./recipeScanner-4b69ybe0.js");
-var AGENT_BLOCK_START = "<!-- akan:agent:start -->";
-var AGENT_BLOCK_END = "<!-- akan:agent:end -->";
-var AGENT_VERSION_PREFIX = "<!-- akan:agent:version ";
-var stampBlockVersion = (block, version) => `${AGENT_VERSION_PREFIX}${version} -->
-
-${block}`;
-var extractBlockVersion = (content) => content.match(/<!-- akan:agent:version ([^\s]+) -->/)?.[1] ?? null;
-var readDevkitVersion = async () => {
-  const { readFile } = await import("fs/promises");
-  const { getDirname } = await import("./fileSys-wzzrntkw.js");
-  try {
-    const raw = await readFile(`${getDirname(import.meta.url)}/package.json`, "utf-8");
-    return JSON.parse(raw).version ?? null;
-  } catch {
-    return null;
-  }
-};
-var upsertAgentBlock = (existing, block) => {
-  const managed = `${AGENT_BLOCK_START}
-${block}
-${AGENT_BLOCK_END}`;
-  const startIndex = existing.indexOf(AGENT_BLOCK_START);
-  const endIndex = existing.indexOf(AGENT_BLOCK_END);
-  if (startIndex >= 0 && endIndex > startIndex) {
-    return `${existing.slice(0, startIndex)}${managed}${existing.slice(endIndex + AGENT_BLOCK_END.length)}`;
-  }
-  return `${existing.replace(/\s*$/, "")}
-
-${managed}
-`;
-};
-var extractAgentBlock = (content) => {
-  const startIndex = content.indexOf(AGENT_BLOCK_START);
-  const endIndex = content.indexOf(AGENT_BLOCK_END);
-  if (startIndex < 0 || endIndex <= startIndex)
-    return null;
-  return content.slice(startIndex + AGENT_BLOCK_START.length, endIndex).trim();
-};
-var signatureOf = (recipe) => {
-  const entries = Object.entries(recipe.variants);
-  if (entries.length === 0)
-    return "";
-  const parts = entries.map(([key, values]) => {
-    if (values.length === 1 && values[0] === "true")
-      return `${key}?`;
-    const def = recipe.defaultVariants?.[key];
-    return `${key}: ${values.map((value) => value === def ? `${value}*` : value).join("|")}`;
-  });
-  return `(${parts.join(" \xB7 ")})`;
-};
-var renderRecipeEntries = (recipes) => {
-  const groups = new Map;
-  for (const recipe of recipes)
-    groups.set(recipe.importFrom, [...groups.get(recipe.importFrom) ?? [], recipe]);
-  return [...groups.entries()].map(([importFrom, list]) => {
-    const items = list.sort((a, b) => a.name.localeCompare(b.name)).map((recipe) => `- \`${recipe.name}\`${signatureOf(recipe)}${recipe.doc ? ` \u2014 ${recipe.doc}` : ""}`).join(`
-`);
-    return `Import from \`${importFrom}\`:
-${items}`;
-  }).join(`
-
-`);
-};
-var collectScopeRecipeSources = async (workspaceRoot, scope, libDeps) => {
-  const { collectRecipeSources } = await loadRecipeScanner();
-  const sources = [
-    ...await collectRecipeSources(`${workspaceRoot}/${scope.type}s/${scope.name}/ui`, `@${scope.type}s/${scope.name}/ui`)
-  ];
-  for (const lib of [...new Set(libDeps)].sort()) {
-    if (scope.type === "lib" && lib === scope.name)
-      continue;
-    sources.push(...await collectRecipeSources(`${workspaceRoot}/libs/${lib}/ui`, `@libs/${lib}/ui`));
-  }
-  return sources;
-};
-var scanScopeRecipes = async (workspaceRoot, scope, libDeps) => {
-  const { scanRecipes } = await loadRecipeScanner();
-  return scanRecipes(await collectScopeRecipeSources(workspaceRoot, scope, libDeps));
-};
-var renderScopeAgentBlock = (scope, recipes) => {
-  const scopePath = `${scope.type}s/${scope.name}`;
-  const intro = `## Recipes In Scope
-
-UI recipes importable from \`${scopePath}\` code, **in addition to** the framework recipes indexed in the root
-\`AGENTS.md\` \`## Recipes\`. Same contract: import by exact name, then \`<name>(variants?, className?)\` \u2014 the second
-arg merges internally and takes an array too, so never wrap it in \`cn()\`. \`*\` marks the default, \`key?\` is a
-boolean flag. Do not guess recipe names or import paths; this index is regenerated by \`akan sync ${scope.name}\`
-and verified by \`akan lint ${scope.name}\`.`;
-  if (recipes.length === 0) {
-    return `${intro}
-
-No scope recipes yet. Before inlining a repeated surface (card, box, tile, \u2026), reuse a framework recipe from the
-root \`AGENTS.md\` or author one as \`${scopePath}/ui/Recipe/<name>.ts\` (one recipe per file, re-exported from that
-folder's \`index.ts\`) \u2014 see the \`recipeRule\` guideline.`;
-  }
-  return `${intro}
-
-${renderRecipeEntries(recipes)}`;
-};
-var renderScopeAgentsMd = (scope, block) => `# ${scope.name} \u2014 Agent Guide
-
-Scoped guide for coding agents working in \`${scope.type}s/${scope.name}\`. Workspace-wide conventions live in the
-root \`AGENTS.md\`; this file carries what is importable from this ${scope.type === "app" ? "app" : "library"}. The
-section between the \`akan:agent\` markers is regenerated by \`akan sync ${scope.name}\`; edit anything outside the
-markers freely.
-
-${AGENT_BLOCK_START}
-${block}
-${AGENT_BLOCK_END}
-`;
-var CLAUDE_COMMENT_RULE = `## Comments \u2014 Overrides Your Default
-
-Write **no comments** unless the comment passes the test below. This is the rule agents break most often here, so it
-is repeated outside the guide: a diff that adds a comment the test rejects is a diff to redo.
-
-Before typing \`//\`, \`/*\`, or a doc block, ask \u2014 **does this sentence carry a fact that is nowhere in the code?**
-
-- Restates the identifier, the signature, or the line under it \u2192 delete it.
-- Labels a section (\`// helpers\`, \`// state\`) or narrates a step (\`// fetch the user\`, \`// then save\`) \u2192 delete it.
-- JSDoc on an ordinary function, or a why/how preamble on ordinary logic \u2192 delete it.
-- Explains the edit you just made, for whoever reads the diff \u2192 say it in your reply, not in the file.
-- Names a vendor or protocol quirk, an infrastructure constraint, a library gotcha, security reasoning, a math
-  derivation, a domain field's business meaning, a state transition, or why an obvious alternative was rejected \u2192
-  keep it, one line.
-
-That keep-list is exact \u2014 \`Comments\` in the guide is the full version. "It aids readability" and "this logic is
-subtle" are not on it: rename or split the code instead. When you edit an existing file, match its density; if the
-surrounding code carries none, your diff carries none.`;
-var renderScopeClaudeMd = (scope) => `# ${scope.name} \u2014 Claude Code Guide
-
-@AGENTS.md
-
-${CLAUDE_COMMENT_RULE}
-`;
-
-// pkgs/@akanjs/devkit/akanConfig/akanBin.ts
-import path5 from "path";
-
-// pkgs/@akanjs/devkit/akanConfig/types.ts
-import { archs, binPlatforms, defaultAppPipeline } from "akanjs";
-
-// pkgs/@akanjs/devkit/akanConfig/akanBin.ts
-class AkanBin {
-  static archive = /\.(zip|tar\.gz|tgz|tar\.xz|txz|tar\.bz2|tbz2|tar)$/i;
-  static fileName = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-  static parse(declared, owner, baseDir) {
-    if (declared === undefined)
-      return {};
-    if (!declared || typeof declared !== "object" || Array.isArray(declared))
-      throw new Error(`${owner}: bin maps each executable's name to its platforms`);
-    return Object.fromEntries(Object.entries(declared).map(([name, platforms]) => [name, AkanBin.#platforms(name, platforms, owner, baseDir)]));
-  }
-  static isArchive(source) {
-    return AkanBin.archive.test("url" in source ? new URL(source.url).pathname : source.path);
-  }
-  static #platforms(name, platforms, owner, baseDir) {
-    if (!AkanBin.fileName.test(name))
-      throw new Error(`${owner}: bin.${name} is not a file name`);
-    if (!platforms || typeof platforms !== "object" || Array.isArray(platforms))
-      throw new Error(`${owner}: bin.${name} maps platforms (${binPlatforms.join(", ")}) to where the file comes from`);
-    const resolved = {};
-    for (const [platform, source] of Object.entries(platforms)) {
-      if (!binPlatforms.includes(platform))
-        throw new Error(`${owner}: bin.${name}.${platform} is not one of ${binPlatforms.join(", ")}`);
-      resolved[platform] = AkanBin.#source(`${owner}: bin.${name}.${platform}`, source, baseDir);
-    }
-    return resolved;
-  }
-  static #source(at, source, baseDir) {
-    if (!source || typeof source !== "object" || Array.isArray(source))
-      throw new Error(`${at} must be { url, sha256 } or { path }`);
-    const { url, sha256, path: localPath, file, ...rest } = source;
-    const extra = Object.keys(rest);
-    if (extra.length)
-      throw new Error(`${at}: unknown key ${extra.join(", ")}`);
-    if (url === undefined === (localPath === undefined))
-      throw new Error(`${at} takes either url and sha256, or path`);
-    const resolved = url !== undefined ? AkanBin.#urlSource(at, url, sha256) : AkanBin.#pathSource(at, localPath, sha256, baseDir);
-    const archive = AkanBin.isArchive(resolved);
-    if (file === undefined) {
-      if (archive)
-        throw new Error(`${at} names an archive: file picks the executable inside it`);
-      return resolved;
-    }
-    if (!archive)
-      throw new Error(`${at}: file picks the executable out of an archive, and this source is none`);
-    const parts = typeof file === "string" ? file.split(/[\\/]/).filter((part) => part && part !== ".") : [];
-    if (!parts.length || path5.isAbsolute(file) || parts.includes(".."))
-      throw new Error(`${at}: file must be a path inside the archive (got ${JSON.stringify(file)})`);
-    return { ...resolved, file: parts.join("/") };
-  }
-  static #urlSource(at, url, sha256) {
-    if (typeof url !== "string" || !URL.canParse(url) || !/^https?:$/.test(new URL(url).protocol))
-      throw new Error(`${at}: url must be an http(s) address`);
-    if (typeof sha256 !== "string" || !/^[0-9a-f]{64}$/i.test(sha256))
-      throw new Error(`${at}: sha256 must be the downloaded file's 64-digit hex digest`);
-    return { url, sha256: sha256.toLowerCase() };
-  }
-  static #pathSource(at, localPath, sha256, baseDir) {
-    if (typeof localPath !== "string" || !localPath)
-      throw new Error(`${at}: path must name a file`);
-    if (sha256 !== undefined)
-      throw new Error(`${at}: sha256 checks a download, and a path source downloads nothing`);
-    return { path: path5.resolve(baseDir, localPath) };
-  }
-}
-// pkgs/@akanjs/devkit/akanConfig/akanConfig.ts
-import fs2 from "fs";
-import path6 from "path";
-import { fileURLToPath } from "url";
-import { DatabaseModes, normalizeRoutePrefix } from "akanjs/base";
-import { resolveAkanI18nConfig } from "akanjs/common";
-var DEFAULT_BARREL_IMPORTS = ["akanjs/webkit", "akanjs/common", "akanjs/ui", "akanjs/server"];
-var DEFAULT_OPTIMIZE_IMPORTS = [
-  "lucide-react date-fns lodash-es ramda antd react-bootstrap ahooks @ant-design/icons @headlessui/react",
-  "@headlessui-float/react @heroicons/react/20/solid @heroicons/react/24/solid @heroicons/react/24/outline",
-  "@visx/visx @tremor/react rxjs @mui/material @mui/icons-material recharts react-use @material-ui/core",
-  "@material-ui/icons @tabler/icons-react mui-core react-icons/*"
-].flatMap((line) => line.split(" "));
-var WORKSPACE_BARREL_FACETS = ["ui", "webkit", "common", "client", "server"];
-var DEFAULT_DOCKER_IMAGE = "oven/bun:1-slim";
-var SSR_RUNTIME_PACKAGES = ["react", "react-dom", "react-server-dom-webpack"];
-var DEFAULT_AKAN_IMAGE_CONFIG = {
-  deviceSizes: [640, 750, 828, 1080, 1200, 1920, 2048, 3840],
-  imageSizes: [32, 48, 64, 96, 128, 256, 384],
-  formats: ["image/webp"],
-  qualities: [75],
-  minimumCacheTTL: 14400,
-  remotePatterns: [],
-  localPatterns: [{ pathname: "/**" }],
-  dangerouslyAllowSVG: false,
-  maximumRedirects: 3,
-  fetchTimeoutMs: 7000,
-  maxRemoteBytes: 25 * 1024 * 1024,
-  maxConcurrency: 0
-};
-var normalizeIndexPath = (indexPath) => {
-  const normalized = indexPath?.trim();
-  if (!normalized)
-    return;
-  const path = `/${normalized.replace(/^\/+|\/+$/g, "")}`;
-  return path === "/" ? "/" : path;
-};
-var normalizeStringList = (values) => {
-  const normalized = values?.map((value) => value.trim()).filter(Boolean) ?? [];
-  return normalized.length > 0 ? [...new Set(normalized)] : undefined;
-};
-var sanitizeAppIdSegment = (value) => {
-  const cleaned = value.toLowerCase().replace(/[^a-z0-9]+/g, "");
-  if (!cleaned)
-    return "app";
-  return /^[a-z]/.test(cleaned) ? cleaned : `app${cleaned}`;
-};
-var deriveDefaultAppId = (orgName, appName) => `com.${sanitizeAppIdSegment(orgName)}.${sanitizeAppIdSegment(appName)}`;
-var normalizeDeepLinkDomain = (domain) => {
-  const normalized = domain.trim();
-  if (!normalized)
-    return "";
-  try {
-    const url = new URL(normalized.includes("://") ? normalized : `https://${normalized}`);
-    return url.host.toLowerCase();
-  } catch {
-    return normalized.replace(/^https?:\/\//, "").replace(/\/+$/g, "").toLowerCase();
-  }
-};
-var normalizeDeepLinks = (deepLinks) => {
-  const schemes = normalizeStringList(deepLinks?.schemes);
-  const domains = normalizeStringList(deepLinks?.domains?.map(normalizeDeepLinkDomain));
-  if (!schemes && !domains)
-    return;
-  return { ...schemes ? { schemes } : {}, ...domains ? { domains } : {} };
-};
-var emptyLibContributions = () => ({
-  externalLibs: [],
-  trustedDependencies: [],
-  bin: [],
-  docker: { preRuns: [], postRuns: [] },
-  keepFonts: []
-});
-var normalizePackageNames = (names, owner) => {
-  if (names === undefined)
-    return [];
-  if (!Array.isArray(names) || names.some((name) => typeof name !== "string" || !name.trim()))
-    throw new Error(`${owner}: trustedDependencies lists package names`);
-  return [...new Set(names.map((name) => name.trim()))];
-};
-var normalizeKeepFonts = (keepFonts) => [
-  ...new Set((keepFonts ?? []).map((glob) => glob.trim().replace(/^\/+/, "")).filter(Boolean))
-];
-var dedupeDockerRuns = (runs) => {
-  const byKey = new Map;
-  for (const run of runs)
-    byKey.set(typeof run === "string" ? run : JSON.stringify(run), run);
-  return [...byKey.values()];
-};
 
 class AkanAppConfig {
   app;
@@ -1025,6 +708,8 @@ class AkanAppConfig {
       const { updates } = merged;
       if (updates && (!updates.url || !(updates.publicKey || updates.publicKeys?.length)))
         throw new Error(`${where}.updates in ${configPath} has no url or publicKeys${named ? "; give them in native.updates or the target's own" : ""}.`);
+      if (updates?.publicKey !== undefined && updates.publicKeys !== undefined)
+        throw new Error(`${where}.updates in ${configPath} has both publicKey and publicKeys${named ? ", native.updates merged in: give one, in native.updates' own form when overriding its keys" : ": give one"}.`);
       AkanAppConfig.#assertFiles(own ?? {}, where, configPath);
       const {
         basePath: _basePath,
@@ -1100,6 +785,8 @@ class AkanAppConfig {
     "AKAN_DATABASE_MODES",
     "AKAN_SSR",
     "AKAN_CSR",
+    "AKAN_MCP",
+    "AKAN_SHUTDOWN_TIMEOUT_MS",
     "AKAN_MODULES"
   ]);
   static #desktopServerEnv(env, where, configPath) {
@@ -1118,11 +805,14 @@ class AkanAppConfig {
   static #desktopServerWatchdog(watchdog, where, configPath) {
     if (watchdog === undefined || watchdog === false)
       return null;
-    const { intervalMs = 1e4, failures = 3 } = watchdog === true ? {} : watchdog;
-    const whole = (value) => Number.isInteger(value) && value > 0;
-    if (watchdog !== true && !AkanAppConfig.#isPlainObject(watchdog) || !whole(intervalMs) || !whole(failures))
+    const options = watchdog === true ? {} : watchdog;
+    const whole = (value) => value === undefined || Number.isInteger(value) && value > 0;
+    if (!AkanAppConfig.#isPlainObject(options) || Object.keys(options).some((key) => key !== "intervalMs" && key !== "failures") || !whole(options.intervalMs) || !whole(options.failures))
       throw new Error(`${where}.watchdog in ${configPath} must be true or { intervalMs, failures }, whole numbers from 1.`);
-    return { intervalMs, failures };
+    return {
+      intervalMs: options.intervalMs ?? 1e4,
+      failures: options.failures ?? 3
+    };
   }
   static #platformIndexPath(section) {
     const { indexPath: rawIndexPath, ...rest } = section;
@@ -1242,7 +932,7 @@ class AkanAppConfig {
   }
   #applyRoutes(routes = []) {
     for (const route of routes) {
-      const basePath = route.basePath ? route.basePath.replace(/^\/+|\/+$/g, "") : null;
+      const basePath = route.basePath ? trimSlashes(route.basePath) : null;
       if (basePath !== null)
         this.basePaths.add(basePath);
       const domains = basePath !== null ? this.subRoutes.getOrInsert(basePath, new Set) : this.domains;
@@ -1341,232 +1031,670 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
     const importPath = bustImportCache ? `${configPath}?akanConfigGeneration=${++AkanAppConfig.#importGeneration}` : configPath;
     return await import(importPath).then((mod) => mod.default);
   }
-  static async from(app, { bustImportCache = false } = {}) {
-    const [configImp, baseDevEnv, libs, rootPackageJson] = await Promise.all([
-      AkanAppConfig.importConfigModule(app.cwdPath, { bustImportCache }),
-      WorkspaceExecutor.getBaseDevEnv(path6.join(app.workspace.workspaceRoot, ".env")),
-      app.workspace.getLibs(),
-      app.workspace.getPackageJson()
-    ]);
-    const resolved = typeof configImp === "function" ? configImp(app) : configImp;
-    const {
-      plugins,
-      pipeline: _pipeline,
-      ...config
-    } = resolved ?? {};
+  static async from(app, { bustImportCache = false } = {}) {
+    const [configImp, baseDevEnv, libs, rootPackageJson] = await Promise.all([
+      AkanAppConfig.importConfigModule(app.cwdPath, { bustImportCache }),
+      WorkspaceExecutor.getBaseDevEnv(path3.join(app.workspace.workspaceRoot, ".env")),
+      app.workspace.getLibs(),
+      app.workspace.getPackageJson()
+    ]);
+    const resolved = typeof configImp === "function" ? configImp(app) : configImp;
+    const {
+      plugins,
+      pipeline: _pipeline,
+      ...config
+    } = resolved ?? {};
+    if ("subspace" in config)
+      throw new Error(`apps/${app.name}/akan.config.ts declares \`subspace\`, a workspace setting: it belongs in the workspace root akan.config.ts.`);
+    const libContributions = await AkanAppConfig.#collectLibContributions(app, libs, bustImportCache);
+    return new AkanAppConfig(app, libs, rootPackageJson, config, baseDevEnv, plugins ?? [], libContributions);
+  }
+  static async#collectLibContributions(app, libs, bustImportCache) {
+    const libConfigs = await Promise.all(libs.map(async (libName) => LibExecutor.from(app, libName).getConfig({ refresh: bustImportCache }).catch((error) => {
+      if (error instanceof LibConfigRefusal)
+        throw error;
+      app.logger.warn(`Skipped libs/${libName}/akan.config.ts contributions: ${String(error)}`);
+      return null;
+    })));
+    return {
+      externalLibs: libConfigs.flatMap((libConfig) => libConfig?.externalLibs ?? []),
+      trustedDependencies: libConfigs.flatMap((libConfig) => libConfig?.trustedDependencies ?? []),
+      bin: libConfigs.flatMap((libConfig) => libConfig && Object.keys(libConfig.bin).length ? [{ lib: libConfig.lib.name, bin: libConfig.bin }] : []),
+      docker: {
+        preRuns: libConfigs.flatMap((libConfig) => libConfig?.docker.preRuns ?? []),
+        postRuns: libConfigs.flatMap((libConfig) => libConfig?.docker.postRuns ?? [])
+      },
+      keepFonts: libConfigs.flatMap((libConfig) => (libConfig?.assets.keepFonts ?? []).map((glob) => `libs/${libConfig?.lib.name}/${glob}`))
+    };
+  }
+  #resolveProductionDependencyVersion(lib) {
+    const rootVersion = this.rootPackageJson.dependencies?.[lib] ?? this.rootPackageJson.devDependencies?.[lib];
+    if (rootVersion)
+      return rootVersion;
+    const akanPackageJson = getAkanPackageJson();
+    const version = akanPackageJson.dependencies?.[lib] ?? akanPackageJson.peerDependencies?.[lib];
+    if (!version)
+      throw new Error(`Dependency ${lib} not found in package.json`);
+    return version;
+  }
+  #getProductionRuntimePackages() {
+    return [
+      ...this.externalLibs,
+      ...SSR_RUNTIME_PACKAGES,
+      ...this.database.modes.flatMap((mode) => this.getDatabaseModeRuntimePackages(mode))
+    ];
+  }
+  getDatabaseModeRuntimePackages(databaseMode) {
+    return [...DatabaseModes.drivers[databaseMode]];
+  }
+  getMissingDatabaseModeDependencySpecs(databaseMode) {
+    return this.#getMissingDependencySpecs(this.getDatabaseModeRuntimePackages(databaseMode));
+  }
+  resolveDatabaseMode() {
+    return DatabaseModes.resolve({
+      requested: process.env.AKAN_DATABASE_MODE,
+      declared: this.database.modes.join(","),
+      local: true
+    });
+  }
+  static #database(app, config) {
+    const declared = config?.database?.modes?.filter((mode) => !!mode);
+    const modes = declared?.length ? declared : ["single"];
+    return { modes: DatabaseModes.parseList(modes.join(","), `database.modes in apps/${app.name}/akan.config.ts`) };
+  }
+  #getMissingDependencySpecs(libs) {
+    const rootDependencies = {
+      ...this.rootPackageJson.dependencies,
+      ...this.rootPackageJson.devDependencies
+    };
+    return libs.filter((lib) => !rootDependencies[lib]).map((lib) => `${lib}@${this.#resolveProductionDependencyVersion(lib)}`);
+  }
+  get akanVersion() {
+    return AkanAppConfig.akanVersion;
+  }
+  static get akanVersion() {
+    return getAkanPackageJson().version;
+  }
+  getProductionPackageJson(data = {}) {
+    return {
+      name: this.app.name,
+      description: this.app.name,
+      version: "1.0.0",
+      main: "./main.js",
+      dependencies: Object.fromEntries([...new Set(this.#getProductionRuntimePackages())].map((lib) => [
+        lib,
+        this.#resolveProductionDependencyVersion(lib)
+      ])),
+      ...this.trustedDependencies.length ? { trustedDependencies: this.trustedDependencies } : {},
+      ...data
+    };
+  }
+}
+var akanPackageJson = null;
+function getAkanPackageJson() {
+  if (akanPackageJson)
+    return akanPackageJson;
+  const sourceDir = path3.dirname(fileURLToPath(import.meta.url));
+  const packageJsonPaths = [
+    path3.join(sourceDir, "../../../akanjs/package.json"),
+    path3.join(process.cwd(), "pkgs/akanjs/package.json"),
+    path3.join(path3.dirname(Bun.main), "node_modules/akanjs/package.json")
+  ];
+  try {
+    packageJsonPaths.unshift(Bun.resolveSync("akanjs/package.json", sourceDir));
+  } catch {}
+  for (const packageJsonPath of packageJsonPaths) {
+    try {
+      akanPackageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+      return akanPackageJson;
+    } catch {}
+  }
+  akanPackageJson = {
+    name: "akanjs",
+    version: "0.0.0",
+    description: "akanjs",
+    dependencies: {}
+  };
+  return akanPackageJson;
+}
+function mergeImageConfig(config = {}) {
+  return {
+    ...DEFAULT_AKAN_IMAGE_CONFIG,
+    ...config,
+    deviceSizes: config.deviceSizes ?? DEFAULT_AKAN_IMAGE_CONFIG.deviceSizes,
+    imageSizes: config.imageSizes ?? DEFAULT_AKAN_IMAGE_CONFIG.imageSizes,
+    formats: config.formats ?? DEFAULT_AKAN_IMAGE_CONFIG.formats,
+    qualities: config.qualities ?? DEFAULT_AKAN_IMAGE_CONFIG.qualities,
+    remotePatterns: config.remotePatterns ?? DEFAULT_AKAN_IMAGE_CONFIG.remotePatterns,
+    localPatterns: config.localPatterns ?? DEFAULT_AKAN_IMAGE_CONFIG.localPatterns
+  };
+}
+
+class AkanLibConfig {
+  lib;
+  externalLibs;
+  trustedDependencies;
+  bin;
+  docker;
+  assets;
+  plugins;
+  constructor(lib, config, plugins = []) {
+    this.lib = lib;
+    this.externalLibs = config?.externalLibs ?? [];
+    const owner = `libs/${lib.name}/akan.config.ts`;
+    this.trustedDependencies = normalizePackageNames(config?.trustedDependencies, owner);
+    this.bin = AkanBin.parse(config?.bin, owner, lib.cwdPath);
+    this.docker = { preRuns: config?.docker?.preRuns ?? [], postRuns: config?.docker?.postRuns ?? [] };
+    this.assets = { keepFonts: normalizeKeepFonts(config?.assets?.keepFonts) };
+    this.plugins = plugins;
+  }
+  static async from(lib, { bustImportCache = false } = {}) {
+    const configImp = await AkanAppConfig.importConfigModule(lib.cwdPath, { bustImportCache });
+    const resolved = typeof configImp === "function" ? configImp(lib) : configImp;
+    const { plugins, ...config } = resolved ?? {};
+    if ("pipeline" in config)
+      throw new LibConfigRefusal(`libs/${lib.name}/akan.config.ts declares \`pipeline\`, which a lib does not take: pipelines belong to apps and the workspace root, and a lib's build-time work goes in an akan build plugin.`);
     if ("subspace" in config)
-      throw new Error(`apps/${app.name}/akan.config.ts declares \`subspace\`, a workspace setting: it belongs in the workspace root akan.config.ts.`);
-    const libContributions = await AkanAppConfig.#collectLibContributions(app, libs, bustImportCache);
-    return new AkanAppConfig(app, libs, rootPackageJson, config, baseDevEnv, plugins ?? [], libContributions);
+      throw new LibConfigRefusal(`libs/${lib.name}/akan.config.ts declares \`subspace\`, a workspace setting: it belongs in the workspace root akan.config.ts.`);
+    return new AkanLibConfig(lib, config, plugins ?? []);
   }
-  static async#collectLibContributions(app, libs, bustImportCache) {
-    const libConfigs = await Promise.all(libs.map(async (libName) => LibExecutor.from(app, libName).getConfig({ refresh: bustImportCache }).catch((error) => {
-      app.logger.warn(`Skipped libs/${libName}/akan.config.ts contributions: ${String(error)}`);
+}
+//! need to refactor
+var shiftBuildNum = async (app, delta) => {
+  const { buildNum } = (await AkanAppConfig.from(app)).native;
+  const akanConfigPath = path3.join(app.cwdPath, "akan.config.ts");
+  const akanConfig = fs.readFileSync(akanConfigPath, "utf8");
+  fs.writeFileSync(akanConfigPath, akanConfig.replace(`buildNum: ${buildNum}`, `buildNum: ${buildNum + delta}`));
+};
+var increaseBuildNum = async (app) => await shiftBuildNum(app, 1);
+var decreaseBuildNum = async (app) => await shiftBuildNum(app, -1);
+// pkgs/@akanjs/devkit/akanConfig/akanWorkspaceConfig.ts
+import path4 from "path";
+class AkanWorkspaceConfig {
+  static fileName = "akan.config.ts";
+  static #keys = ["subspace", "pipeline", "cloud"];
+  static #loopbackHosts = ["localhost", "127.0.0.1", "[::1]"];
+  static async from(workspace, { bustImportCache = false } = {}) {
+    const file = path4.join(workspace.workspaceRoot, AkanWorkspaceConfig.fileName);
+    if (!await FileSys2.fileExists(file))
+      return new AkanWorkspaceConfig(null, {});
+    const input = await AkanAppConfig.importConfigModule(workspace.workspaceRoot, { bustImportCache });
+    return new AkanWorkspaceConfig(file, input);
+  }
+  file;
+  subspace;
+  pipeline;
+  cloudHost;
+  constructor(file, input) {
+    this.file = file;
+    if (typeof input !== "object" || input === null || Array.isArray(input))
+      throw new Error("The workspace root akan.config.ts must default-export a WorkspaceConfig object.");
+    for (const key of Object.keys(input))
+      if (!AkanWorkspaceConfig.#keys.includes(key))
+        throw new Error(`The workspace root akan.config.ts declares \`${key}\`, which it does not take: it holds \`subspace\`, \`pipeline\` and \`cloud\`, and app or lib settings belong in apps/<app>/akan.config.ts or libs/<lib>/akan.config.ts.`);
+    const config = input;
+    this.subspace = config.subspace ?? null;
+    this.pipeline = config.pipeline ?? null;
+    this.cloudHost = AkanWorkspaceConfig.#cloudHost(config.cloud);
+  }
+  static #cloudHost(cloud) {
+    if (cloud === undefined)
       return null;
-    })));
-    return {
-      externalLibs: libConfigs.flatMap((libConfig) => libConfig?.externalLibs ?? []),
-      trustedDependencies: libConfigs.flatMap((libConfig) => libConfig?.trustedDependencies ?? []),
-      bin: libConfigs.flatMap((libConfig) => libConfig && Object.keys(libConfig.bin).length ? [{ lib: libConfig.lib.name, bin: libConfig.bin }] : []),
-      docker: {
-        preRuns: libConfigs.flatMap((libConfig) => libConfig?.docker.preRuns ?? []),
-        postRuns: libConfigs.flatMap((libConfig) => libConfig?.docker.postRuns ?? [])
-      },
-      keepFonts: libConfigs.flatMap((libConfig) => (libConfig?.assets.keepFonts ?? []).map((glob) => `libs/${libConfig?.lib.name}/${glob}`))
+    const refuse = (why) => {
+      throw new Error(`The workspace root akan.config.ts has cloud ${why}.`);
     };
+    if (typeof cloud !== "object" || cloud === null || Array.isArray(cloud))
+      return refuse("that is not an object");
+    const unknown = Object.keys(cloud).filter((key) => key !== "host");
+    if (unknown.length)
+      return refuse(`keys it does not take: ${unknown.join(", ")} (only \`host\`)`);
+    const { host } = cloud;
+    if (host === undefined)
+      return null;
+    const url = typeof host === "string" && URL.canParse(host) ? new URL(host) : null;
+    if (!url || url.search || url.hash || url.username || url.password)
+      return refuse(`.host ${JSON.stringify(host)}, which is not a URL like "https://cloud.example.com"`);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && AkanWorkspaceConfig.#loopbackHosts.includes(url.hostname)))
+      return refuse(`.host ${JSON.stringify(host)}: https only, or http on this computer`);
+    return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
   }
-  #resolveProductionDependencyVersion(lib) {
-    const rootVersion = this.rootPackageJson.dependencies?.[lib] ?? this.rootPackageJson.devDependencies?.[lib];
-    if (rootVersion)
-      return rootVersion;
-    const akanPackageJson = getAkanPackageJson();
-    const version = akanPackageJson.dependencies?.[lib] ?? akanPackageJson.peerDependencies?.[lib];
-    if (!version)
-      throw new Error(`Dependency ${lib} not found in package.json`);
-    return version;
+}
+// pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
+import { readdir, rm } from "fs/promises";
+import path6 from "path";
+
+// pkgs/@akanjs/devkit/transforms/asyncDefaultExportDetector.ts
+import fs2 from "fs";
+import path5 from "path";
+
+class AsyncDefaultExportDetector {
+  static #typescriptLoad;
+  static #loadTypescript() {
+    AsyncDefaultExportDetector.#typescriptLoad ??= import("typescript").then((mod) => mod.default ?? mod);
+    return AsyncDefaultExportDetector.#typescriptLoad;
   }
-  #getProductionRuntimePackages() {
-    return [
-      ...this.externalLibs,
-      ...SSR_RUNTIME_PACKAGES,
-      ...this.database.modes.flatMap((mode) => this.getDatabaseModeRuntimePackages(mode))
-    ];
+  static async detect(moduleAbsPath) {
+    try {
+      const typescript = await AsyncDefaultExportDetector.#loadTypescript();
+      const source = fs2.readFileSync(path5.resolve(moduleAbsPath), "utf8");
+      const sourceFile = typescript.createSourceFile(moduleAbsPath, source, typescript.ScriptTarget.Latest, true, /\.[tj]sx$/.test(moduleAbsPath) ? typescript.ScriptKind.TSX : typescript.ScriptKind.TS);
+      return new AsyncDefaultExportDetector(typescript).detectInSourceFile(sourceFile);
+    } catch {
+      return false;
+    }
   }
-  getDatabaseModeRuntimePackages(databaseMode) {
-    return [...DatabaseModes.drivers[databaseMode]];
+  #ts;
+  constructor(typescript) {
+    this.#ts = typescript;
   }
-  getMissingDatabaseModeDependencySpecs(databaseMode) {
-    return this.#getMissingDependencySpecs(this.getDatabaseModeRuntimePackages(databaseMode));
+  detectInSourceFile(sourceFile) {
+    const ts = this.#ts;
+    const asyncBindings = new Map;
+    let defaultIdentifier = null;
+    for (const statement of sourceFile.statements) {
+      if (ts.isFunctionDeclaration(statement)) {
+        if (this.#hasModifier(statement, ts.SyntaxKind.DefaultKeyword)) {
+          return this.#hasModifier(statement, ts.SyntaxKind.AsyncKeyword);
+        }
+        if (statement.name) {
+          asyncBindings.set(statement.name.text, this.#hasModifier(statement, ts.SyntaxKind.AsyncKeyword));
+        }
+        continue;
+      }
+      if (ts.isVariableStatement(statement)) {
+        for (const declaration of statement.declarationList.declarations) {
+          if (!ts.isIdentifier(declaration.name))
+            continue;
+          asyncBindings.set(declaration.name.text, this.#isAsyncFunctionExpression(declaration.initializer));
+        }
+        continue;
+      }
+      if (ts.isExportAssignment(statement)) {
+        if (this.#isAsyncFunctionExpression(statement.expression))
+          return true;
+        if (ts.isCallExpression(statement.expression))
+          return true;
+        if (ts.isIdentifier(statement.expression))
+          defaultIdentifier = statement.expression.text;
+        continue;
+      }
+      if (ts.isExportDeclaration(statement) && statement.exportClause && ts.isNamedExports(statement.exportClause)) {
+        for (const specifier of statement.exportClause.elements) {
+          if (specifier.name.text !== "default")
+            continue;
+          defaultIdentifier = specifier.propertyName?.text ?? specifier.name.text;
+        }
+      }
+    }
+    return defaultIdentifier ? asyncBindings.get(defaultIdentifier) === true : false;
   }
-  resolveDatabaseMode() {
-    return DatabaseModes.resolve({
-      requested: process.env.AKAN_DATABASE_MODE,
-      declared: this.database.modes.join(","),
-      local: true
+  #hasModifier(node, kind) {
+    const ts = this.#ts;
+    return ts.canHaveModifiers(node) && (ts.getModifiers(node)?.some((modifier) => modifier.kind === kind) ?? false);
+  }
+  #isAsyncFunctionExpression(node) {
+    const ts = this.#ts;
+    return Boolean(node && (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) && this.#hasModifier(node, ts.SyntaxKind.AsyncKeyword));
+  }
+}
+
+// pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
+var LAYOUT_KEY_RE = /^\.\/(.+\/)?_layout\.(tsx|ts|jsx|js)$/;
+var IMPLICIT_LAYOUT_DIR = path6.join(".akan", "generated", "root-layouts");
+var IMPLICIT_DICT_DIR = path6.join(".akan", "generated", "dict");
+var IMPLICIT_OVERRIDES_DIR = path6.join(".akan", "generated", "overrides");
+var OVERRIDES_KEY_RE = /^\.\/(.+\/)?_overrides\.(tsx|ts|jsx|js)$/;
+var importSpecifier = (fromAbsPath, toAbsPath) => {
+  const rel = path6.relative(path6.dirname(fromAbsPath), toAbsPath).split(path6.sep).join("/");
+  return rel.startsWith(".") ? rel : `./${rel}`;
+};
+async function writeGeneratedOverridesLayoutFile(opts) {
+  const filename = `${opts.key.replace(/^\.\//, "").replace(/[^a-zA-Z0-9]+/g, "_")}.tsx`;
+  const absPath = path6.join(path6.resolve(opts.appCwdPath), IMPLICIT_OVERRIDES_DIR, filename);
+  const source = `"use client";
+import { UiOverrideProvider } from "akanjs/ui";
+import { createElement, type ReactNode } from "react";
+import value from ${JSON.stringify(importSpecifier(absPath, opts.userAbsPath))};
+
+export default function AkanUiOverridesLayout({ children }: { children?: ReactNode }) {
+  return createElement(UiOverrideProvider, { value }, children);
+}
+`;
+  await Bun.write(absPath, source);
+  return absPath;
+}
+async function pruneGeneratedFiles(dirAbsPath, keepAbsPaths) {
+  const keep = new Set(keepAbsPaths);
+  const names = await readdir(dirAbsPath).catch(() => []);
+  await Promise.all(names.map((name) => path6.join(dirAbsPath, name)).filter((absPath) => !keep.has(absPath)).map((absPath) => rm(absPath, { force: true })));
+}
+function getRootBoundarySegments(key) {
+  const match = LAYOUT_KEY_RE.exec(key);
+  if (!match)
+    return null;
+  const prefix = match[1]?.replace(/\/$/, "");
+  if (!prefix)
+    return [];
+  return prefix.split("/").filter(Boolean);
+}
+function implicitRootLayoutKey(segments) {
+  return `./${[...segments, "__root_layout"].join("/")}.tsx`;
+}
+function implicitRootLayoutAbsPath(appCwdPath, segments) {
+  const filename = segments.length ? `${segments.join("__")}__root_layout.tsx` : "__root_layout.tsx";
+  return path6.join(path6.resolve(appCwdPath), IMPLICIT_LAYOUT_DIR, filename);
+}
+function isRootBoundarySegments(segments, basePaths) {
+  const firstVisibleIndex = segments.findIndex((segment) => !/^\(.+\)$/.test(segment));
+  if (firstVisibleIndex === -1)
+    return segments.length <= 1;
+  if (segments.slice(firstVisibleIndex + 1).some((segment) => /^\(.+\)$/.test(segment)))
+    return false;
+  const visible = segments.slice(firstVisibleIndex);
+  const allowedBasePaths = new Set([...basePaths].map((basePath) => basePath.trim()).filter(Boolean));
+  return visible.length === 1 && (firstVisibleIndex > 0 || allowedBasePaths.has(visible[0] ?? ""));
+}
+function findRootBoundaries(pageKeys, appCwdPath, basePaths) {
+  const boundaries = new Map;
+  for (const key of pageKeys) {
+    const segments = getRootBoundarySegments(key);
+    if (!segments)
+      continue;
+    if (!isRootBoundarySegments(segments, basePaths))
+      continue;
+    const id = segments.join("/");
+    boundaries.set(id, {
+      sourceKey: key,
+      sourceAbsPath: path6.resolve(appCwdPath, "page", key.replace(/^\.\//, "")),
+      segments
     });
   }
-  static #database(app, config) {
-    const declared = config?.database?.modes?.filter((mode) => !!mode);
-    const modes = declared?.length ? declared : ["single"];
-    return { modes: DatabaseModes.parseList(modes.join(","), `database.modes in apps/${app.name}/akan.config.ts`) };
-  }
-  #getMissingDependencySpecs(libs) {
-    const rootDependencies = {
-      ...this.rootPackageJson.dependencies,
-      ...this.rootPackageJson.devDependencies
-    };
-    return libs.filter((lib) => !rootDependencies[lib]).map((lib) => `${lib}@${this.#resolveProductionDependencyVersion(lib)}`);
-  }
-  get akanVersion() {
-    return AkanAppConfig.akanVersion;
-  }
-  static get akanVersion() {
-    return getAkanPackageJson().version;
-  }
-  getProductionPackageJson(data = {}) {
-    return {
-      name: this.app.name,
-      description: this.app.name,
-      version: "1.0.0",
-      main: "./main.js",
-      dependencies: Object.fromEntries([...new Set(this.#getProductionRuntimePackages())].map((lib) => [
-        lib,
-        this.#resolveProductionDependencyVersion(lib)
-      ])),
-      ...this.trustedDependencies.length ? { trustedDependencies: this.trustedDependencies } : {},
-      ...data
-    };
-  }
+  if (boundaries.size === 0)
+    boundaries.set("", { sourceKey: null, sourceAbsPath: null, segments: [] });
+  return [...boundaries.values()].sort((a, b) => a.segments.join("/").localeCompare(b.segments.join("/")));
 }
-var akanPackageJson = null;
-function getAkanPackageJson() {
-  if (akanPackageJson)
-    return akanPackageJson;
-  const sourceDir = path6.dirname(fileURLToPath(import.meta.url));
-  const packageJsonPaths = [
-    path6.join(sourceDir, "../../../akanjs/package.json"),
-    path6.join(process.cwd(), "pkgs/akanjs/package.json"),
-    path6.join(path6.dirname(Bun.main), "node_modules/akanjs/package.json")
-  ];
-  try {
-    packageJsonPaths.unshift(Bun.resolveSync("akanjs/package.json", sourceDir));
-  } catch {}
-  for (const packageJsonPath of packageJsonPaths) {
-    try {
-      akanPackageJson = JSON.parse(fs2.readFileSync(packageJsonPath, "utf8"));
-      return akanPackageJson;
-    } catch {}
+function hasAncestorRootBoundary(boundary, boundaries) {
+  return boundaries.some((candidate) => candidate !== boundary && candidate.segments.length < boundary.segments.length && candidate.segments.every((segment, index) => boundary.segments[index] === segment));
+}
+function findExplicitRootLayoutAbsPath(pageKeys, appCwdPath) {
+  const rootLayoutKey = pageKeys.find((key) => {
+    const segments = getRootBoundarySegments(key);
+    return segments !== null && segments.length === 0;
+  });
+  return rootLayoutKey ? path6.resolve(appCwdPath, "page", rootLayoutKey.replace(/^\.\//, "")) : null;
+}
+async function assertEnvClientConvention(appCwdPath, appName) {
+  const envPath = path6.join(appCwdPath, "env", "env.client.ts");
+  if (!await Bun.file(envPath).exists()) {
+    throw new Error(`[route-convention] app "${appName}" must provide env/env.client.ts exporting "env" for generated System.Provider`);
   }
-  akanPackageJson = {
-    name: "akanjs",
-    version: "0.0.0",
-    description: "akanjs",
-    dependencies: {}
-  };
-  return akanPackageJson;
 }
-function mergeImageConfig(config = {}) {
-  return {
-    ...DEFAULT_AKAN_IMAGE_CONFIG,
-    ...config,
-    deviceSizes: config.deviceSizes ?? DEFAULT_AKAN_IMAGE_CONFIG.deviceSizes,
-    imageSizes: config.imageSizes ?? DEFAULT_AKAN_IMAGE_CONFIG.imageSizes,
-    formats: config.formats ?? DEFAULT_AKAN_IMAGE_CONFIG.formats,
-    qualities: config.qualities ?? DEFAULT_AKAN_IMAGE_CONFIG.qualities,
-    remotePatterns: config.remotePatterns ?? DEFAULT_AKAN_IMAGE_CONFIG.remotePatterns,
-    localPatterns: config.localPatterns ?? DEFAULT_AKAN_IMAGE_CONFIG.localPatterns
-  };
+async function writeGeneratedDictionaryMacroFile(appCwdPath, appName) {
+  const absPath = path6.join(path6.resolve(appCwdPath), IMPLICIT_DICT_DIR, "useDict.ts");
+  await Bun.write(absPath, `import { getAllDictionary } from "@apps/${appName}/lib/dict" with { type: "macro" };
+
+export const allDictionary = getAllDictionary();
+`);
+  return absPath;
+}
+async function writeGeneratedRootLayoutFile(opts) {
+  await assertEnvClientConvention(opts.appCwdPath, opts.appName);
+  const dictMacroAbsPath = opts.includeSystemProvider ? await writeGeneratedDictionaryMacroFile(opts.appCwdPath, opts.appName) : null;
+  const absPath = implicitRootLayoutAbsPath(opts.appCwdPath, opts.boundary.segments);
+  const dictMacroSpecifier = dictMacroAbsPath ? importSpecifier(absPath, dictMacroAbsPath) : null;
+  const sourceSpecifier = opts.boundary.sourceAbsPath ? importSpecifier(absPath, opts.boundary.sourceAbsPath) : null;
+  const inheritedSourceAbsPath = opts.rootSourceAbsPath && opts.rootSourceAbsPath !== opts.boundary.sourceAbsPath ? opts.rootSourceAbsPath : null;
+  const inheritedSourceSpecifier = inheritedSourceAbsPath ? importSpecifier(absPath, inheritedSourceAbsPath) : null;
+  const clientImport = opts.includeStInit ? `import { st } from "@apps/${opts.appName}/client";
+void st;
+` : `import "@apps/${opts.appName}/client";
+`;
+  const inheritedLabel = inheritedSourceAbsPath ? path6.relative(opts.appCwdPath, inheritedSourceAbsPath) : "";
+  const inheritedImport = inheritedSourceSpecifier ? `import * as inheritedModule from ${JSON.stringify(inheritedSourceSpecifier)};
+const inheritedLayout = resolveRouteModule(inheritedModule as never, ${JSON.stringify(inheritedLabel)}).module as LayoutModule;
+` : `const inheritedLayout: LayoutModule = {};
+`;
+  const prefix = opts.boundary.segments.find((segment) => !/^\(.+\)$/.test(segment)) ?? null;
+  const userLabel = opts.boundary.sourceAbsPath ? path6.relative(opts.appCwdPath, opts.boundary.sourceAbsPath) : "";
+  const userImport = sourceSpecifier ? `import * as userModule from ${JSON.stringify(sourceSpecifier)};
+const userLayout = resolveRouteModule(userModule as never, ${JSON.stringify(userLabel)}).module as LayoutModule;
+const UserLayout = userLayout.default as (props: LayoutProps) => ReactNode | Promise<ReactNode>;
+` : `const UserLayout = ({ children }: LayoutProps) => children;
+const userLayout: LayoutModule = {};
+`;
+  const isAsyncUserLayout = opts.boundary.sourceAbsPath ? await AsyncDefaultExportDetector.detect(opts.boundary.sourceAbsPath) : false;
+  const userLayoutElement = "<UserLayout params={params} searchParams={searchParams}>{children}</UserLayout>";
+  const layoutSignature = isAsyncUserLayout ? "export default async function GeneratedLayout" : "export default function GeneratedLayout";
+  const layoutBinding = isAsyncUserLayout ? `  const layout =
+    process.env.AKAN_PUBLIC_RENDER_ENV === "csr"
+      ? await UserLayout({ params, searchParams, children })
+      : ${userLayoutElement};
+` : "";
+  const layoutChild = isAsyncUserLayout ? "{layout}" : userLayoutElement;
+  const layoutReturn = isAsyncUserLayout ? "layout" : userLayoutElement;
+  const headLayouts = opts.includeSystemProvider ? "[inheritedLayout, userLayout]" : "[userLayout]";
+  const layoutExports = `export async function generateHead(props: PageProps) {
+  const heads = await Promise.all(
+    ${headLayouts}.map((layout) => (layout.generateHead ? layout.generateHead(props) : layout.head)),
+  );
+  return RouteHead.mergeNodes(heads);
 }
 
-class AkanLibConfig {
-  lib;
-  externalLibs;
-  trustedDependencies;
-  bin;
-  docker;
-  assets;
-  plugins;
-  constructor(lib, config, plugins = []) {
-    this.lib = lib;
-    this.externalLibs = config?.externalLibs ?? [];
-    const owner = `libs/${lib.name}/akan.config.ts`;
-    this.trustedDependencies = normalizePackageNames(config?.trustedDependencies, owner);
-    this.bin = AkanBin.parse(config?.bin, owner, lib.cwdPath);
-    this.docker = { preRuns: config?.docker?.preRuns ?? [], postRuns: config?.docker?.postRuns ?? [] };
-    this.assets = { keepFonts: normalizeKeepFonts(config?.assets?.keepFonts) };
-    this.plugins = plugins;
+export const NotFound = userLayout.NotFound ?? inheritedLayout.NotFound;
+export const Error = userLayout.Error ?? inheritedLayout.Error;
+export const pageConfig = userLayout.pageConfig ?? inheritedLayout.pageConfig;
+export const Loading = userLayout.Loading;
+
+${layoutSignature}({ children, params, searchParams }: LayoutProps) {
+${layoutBinding}  return `;
+  const source = opts.includeSystemProvider ? `import type { LayoutModule, LayoutProps, PageProps } from "akanjs/client";
+import { loadFonts, resolveRouteModule, RouteHead } from "akanjs/client";
+import type { ReactNode } from "react";
+import { System } from "akanjs/ui";
+import { env } from "@apps/${opts.appName}/env/env.client";
+import { allDictionary } from ${JSON.stringify(dictMacroSpecifier)};
+${clientImport}${inheritedImport}${userImport}
+const userFonts = userLayout.fonts ?? inheritedLayout.fonts ?? [];
+const defaultFonts = userFonts.filter((font) => font.default);
+if (defaultFonts.length > 1) throw new Error("[route-convention] only one default font is allowed per root layout");
+const defaultFont = defaultFonts[0];
+const defaultFontClassName = defaultFont ? (defaultFont.className ?? \`font-\${defaultFont.name}\`) : undefined;
+export const theme = userLayout.theme ?? inheritedLayout.theme;
+export const viewport = userLayout.viewport ?? inheritedLayout.viewport;
+export const manifest = userLayout.manifest ?? inheritedLayout.manifest;
+
+${layoutExports}(
+    <System.Provider
+      of={GeneratedLayout as never}
+      appName=${JSON.stringify(opts.appName)}
+      ${prefix ? `prefix=${JSON.stringify(prefix)}
+      ` : ""}params={params}
+      manifest={manifest}
+      env={env}
+      theme={theme}
+      viewport={viewport}
+      fonts={loadFonts(userFonts)}
+      className={defaultFontClassName}
+      layoutStyle={userLayout.layoutStyle ?? inheritedLayout.layoutStyle}
+      reconnect={userLayout.reconnect ?? inheritedLayout.reconnect ?? false}
+      wsConnect={userLayout.wsConnect ?? inheritedLayout.wsConnect ?? true}
+      allDictionary={process.env.AKAN_PUBLIC_RENDER_ENV === "ssr" ? allDictionary : undefined}
+    >
+      ${layoutChild}
+    </System.Provider>
+  );
+}
+` : `import type { LayoutModule, LayoutProps, PageProps } from "akanjs/client";
+import { resolveRouteModule, RouteHead } from "akanjs/client";
+import type { ReactNode } from "react";
+${inheritedImport}${userImport}
+${layoutExports}${layoutReturn};
+}
+`;
+  await Bun.write(absPath, source);
+  return absPath;
+}
+async function resolveSsrPageEntries(opts) {
+  const absPageDir = path6.resolve(opts.appCwdPath, "page");
+  const hasSt = await Bun.file(path6.join(opts.appCwdPath, "lib", "st.ts")).exists();
+  const basePaths = opts.basePaths ?? [];
+  const rootSourceAbsPath = findExplicitRootLayoutAbsPath(opts.pageKeys, opts.appCwdPath);
+  const rootBoundaries = findRootBoundaries(opts.pageKeys, opts.appCwdPath, basePaths);
+  const rootLayoutKeys = new Set(opts.pageKeys.filter((key) => {
+    const segments = getRootBoundarySegments(key);
+    return segments !== null && isRootBoundarySegments(segments, basePaths);
+  }));
+  const base = await Promise.all(opts.pageKeys.filter((key) => !rootLayoutKeys.has(key)).map(async (key) => {
+    const userAbsPath = path6.resolve(absPageDir, key);
+    if (OVERRIDES_KEY_RE.test(key)) {
+      const moduleAbsPath = await writeGeneratedOverridesLayoutFile({
+        appCwdPath: opts.appCwdPath,
+        key,
+        userAbsPath
+      });
+      return { key, moduleAbsPath, seedAbsPaths: [userAbsPath] };
+    }
+    return { key, moduleAbsPath: userAbsPath };
+  }));
+  const generated = await Promise.all(rootBoundaries.map(async (boundary) => ({
+    key: implicitRootLayoutKey(boundary.segments),
+    moduleAbsPath: await writeGeneratedRootLayoutFile({
+      appCwdPath: opts.appCwdPath,
+      appName: opts.appName,
+      boundary,
+      rootSourceAbsPath,
+      includeStInit: hasSt && boundary.segments.length === 0,
+      includeSystemProvider: !hasAncestorRootBoundary(boundary, rootBoundaries)
+    }),
+    seedAbsPaths: [...new Set([boundary.sourceAbsPath, rootSourceAbsPath].filter((absPath) => absPath !== null))]
+  })));
+  const appCwdAbsPath = path6.resolve(opts.appCwdPath);
+  await Promise.all([
+    pruneGeneratedFiles(path6.join(appCwdAbsPath, IMPLICIT_OVERRIDES_DIR), base.filter(({ key }) => OVERRIDES_KEY_RE.test(key)).map(({ moduleAbsPath }) => moduleAbsPath)),
+    pruneGeneratedFiles(path6.join(appCwdAbsPath, IMPLICIT_LAYOUT_DIR), generated.map(({ moduleAbsPath }) => moduleAbsPath))
+  ]);
+  return [...base, ...generated].sort((a, b) => a.key.localeCompare(b.key));
+}
+async function resolveSsrPageEntriesForApp(app, pageKeys) {
+  const config = await app.getConfig();
+  return resolveSsrPageEntries({ appCwdPath: app.cwdPath, appName: app.name, pageKeys, basePaths: config.basePaths });
+}
+
+// pkgs/@akanjs/devkit/codegenLock.ts
+import { mkdir, open, readFile, rm as rm2, stat } from "fs/promises";
+import path7 from "path";
+import { Logger as Logger2 } from "akanjs/common";
+
+class CodegenLock {
+  static fileName = "codegen.lock";
+  static waitTimeoutMs = 1e4;
+  static unknownHolderStaleMs = 60000;
+  static #pollMs = 25;
+  static #logger = new Logger2("CodegenLock");
+  static #queue = Promise.resolve();
+  static pathIn(workspaceRoot) {
+    return path7.join(workspaceRoot, "local", ".akan", CodegenLock.fileName);
   }
-  static async from(lib, { bustImportCache = false } = {}) {
-    const configImp = await AkanAppConfig.importConfigModule(lib.cwdPath, { bustImportCache });
-    const resolved = typeof configImp === "function" ? configImp(lib) : configImp;
-    const { plugins, ...config } = resolved ?? {};
-    if ("pipeline" in config)
-      throw new Error(`libs/${lib.name}/akan.config.ts declares \`pipeline\`, which a lib does not take: pipelines belong to apps and the workspace root, and a lib's build-time work goes in an akan build plugin.`);
-    if ("subspace" in config)
-      throw new Error(`libs/${lib.name}/akan.config.ts declares \`subspace\`, a workspace setting: it belongs in the workspace root akan.config.ts.`);
-    return new AkanLibConfig(lib, config, plugins ?? []);
+  static async run(workspaceRoot, label, fn) {
+    const ahead = CodegenLock.#queue;
+    let done;
+    CodegenLock.#queue = new Promise((resolve) => {
+      done = resolve;
+    });
+    try {
+      await CodegenLock.#waitForQueue(ahead, label);
+      return await CodegenLock.#withFileLock(workspaceRoot, label, fn);
+    } finally {
+      done();
+    }
   }
-}
-//! need to refactor
-var shiftBuildNum = async (app, delta) => {
-  const { buildNum } = (await AkanAppConfig.from(app)).native;
-  const akanConfigPath = path6.join(app.cwdPath, "akan.config.ts");
-  const akanConfig = fs2.readFileSync(akanConfigPath, "utf8");
-  fs2.writeFileSync(akanConfigPath, akanConfig.replace(`buildNum: ${buildNum}`, `buildNum: ${buildNum + delta}`));
-};
-var increaseBuildNum = async (app) => await shiftBuildNum(app, 1);
-var decreaseBuildNum = async (app) => await shiftBuildNum(app, -1);
-// pkgs/@akanjs/devkit/akanConfig/akanWorkspaceConfig.ts
-import path7 from "path";
-class AkanWorkspaceConfig {
-  static fileName = "akan.config.ts";
-  static #keys = ["subspace", "pipeline", "cloud"];
-  static #loopbackHosts = ["localhost", "127.0.0.1", "[::1]"];
-  static async from(workspace, { bustImportCache = false } = {}) {
-    const file = path7.join(workspace.workspaceRoot, AkanWorkspaceConfig.fileName);
-    if (!await FileSys2.fileExists(file))
-      return new AkanWorkspaceConfig(null, {});
-    const input = await AkanAppConfig.importConfigModule(workspace.workspaceRoot, { bustImportCache });
-    return new AkanWorkspaceConfig(file, input);
+  static async#waitForQueue(ahead, label) {
+    let timer = null;
+    const expired = new Promise((resolve) => {
+      timer = setTimeout(() => resolve("expired"), CodegenLock.waitTimeoutMs);
+    });
+    try {
+      if (await Promise.race([ahead.then(() => "done"), expired]) === "expired")
+        CodegenLock.#logger.warn(`codegen lock queued past ${CodegenLock.waitTimeoutMs}ms in this process; continuing without waiting (${label})`);
+    } finally {
+      if (timer)
+        clearTimeout(timer);
+    }
   }
-  file;
-  subspace;
-  pipeline;
-  cloudHost;
-  constructor(file, input) {
-    this.file = file;
-    if (typeof input !== "object" || input === null || Array.isArray(input))
-      throw new Error("The workspace root akan.config.ts must default-export a WorkspaceConfig object.");
-    for (const key of Object.keys(input))
-      if (!AkanWorkspaceConfig.#keys.includes(key))
-        throw new Error(`The workspace root akan.config.ts declares \`${key}\`, which it does not take: it holds \`subspace\`, \`pipeline\` and \`cloud\`, and app or lib settings belong in apps/<app>/akan.config.ts or libs/<lib>/akan.config.ts.`);
-    const config = input;
-    this.subspace = config.subspace ?? null;
-    this.pipeline = config.pipeline ?? null;
-    this.cloudHost = AkanWorkspaceConfig.#cloudHost(config.cloud);
+  static async#withFileLock(workspaceRoot, label, fn) {
+    const lockPath = CodegenLock.pathIn(workspaceRoot);
+    await mkdir(path7.dirname(lockPath), { recursive: true }).catch(() => {
+      return;
+    });
+    const held = await CodegenLock.#acquire(lockPath, label);
+    try {
+      return await fn();
+    } finally {
+      if (held)
+        await rm2(lockPath, { force: true }).catch(() => {
+          return;
+        });
+    }
   }
-  static #cloudHost(cloud) {
-    if (cloud === undefined)
-      return null;
-    const refuse = (why) => {
-      throw new Error(`The workspace root akan.config.ts has cloud ${why}.`);
-    };
-    if (typeof cloud !== "object" || cloud === null || Array.isArray(cloud))
-      return refuse("that is not an object");
-    const unknown = Object.keys(cloud).filter((key) => key !== "host");
-    if (unknown.length)
-      return refuse(`keys it does not take: ${unknown.join(", ")} (only \`host\`)`);
-    const { host } = cloud;
-    if (host === undefined)
+  static async#acquire(lockPath, label) {
+    const deadline = Date.now() + CodegenLock.waitTimeoutMs;
+    for (;; ) {
+      const handle = await open(lockPath, "wx").catch(() => null);
+      if (handle) {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, at: Date.now(), label })).catch(() => {
+          return;
+        });
+        await handle.close().catch(() => {
+          return;
+        });
+        return true;
+      }
+      if (await CodegenLock.#reclaimIfAbandoned(lockPath))
+        continue;
+      if (Date.now() >= deadline) {
+        CodegenLock.#logger.warn(`codegen lock at ${lockPath} held past ${CodegenLock.waitTimeoutMs}ms; continuing without it (${label})`);
+        return false;
+      }
+      await Bun.sleep(CodegenLock.#pollMs);
+    }
+  }
+  static async#reclaimIfAbandoned(lockPath) {
+    const info = await stat(lockPath).catch(() => null);
+    if (!info)
+      return true;
+    const holder = CodegenLock.#parseHolder(await readFile(lockPath, "utf8").catch(() => ""));
+    if (holder) {
+      if (CodegenLock.#isAlive(holder.pid))
+        return false;
+    } else if (Date.now() - info.mtimeMs < CodegenLock.unknownHolderStaleMs)
+      return false;
+    await rm2(lockPath, { force: true }).catch(() => {
+      return;
+    });
+    return true;
+  }
+  static #parseHolder(raw) {
+    try {
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.pid !== "number" || typeof parsed.at !== "number")
+        return null;
+      return { pid: parsed.pid, at: parsed.at, label: typeof parsed.label === "string" ? parsed.label : "" };
+    } catch {
       return null;
-    const url = typeof host === "string" && URL.canParse(host) ? new URL(host) : null;
-    if (!url || url.search || url.hash || url.username || url.password)
-      return refuse(`.host ${JSON.stringify(host)}, which is not a URL like "https://cloud.example.com"`);
-    if (url.protocol !== "https:" && !(url.protocol === "http:" && AkanWorkspaceConfig.#loopbackHosts.includes(url.hostname)))
-      return refuse(`.host ${JSON.stringify(host)}: https only, or http on this computer`);
-    return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+    }
+  }
+  static #isAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+      return false;
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (error) {
+      return error.code === "EPERM";
+    }
   }
 }
+
 // pkgs/@akanjs/devkit/jsonFormatter.ts
 import path8 from "path";
 
@@ -1644,7 +1772,7 @@ ${"  ".repeat(depth)}]`;
 
 // pkgs/@akanjs/devkit/linter.ts
 import { spawn } from "child_process";
-import { existsSync, readFileSync } from "fs";
+import { existsSync as existsSync2, readFileSync } from "fs";
 import path9 from "path";
 import chalk from "chalk";
 var parseBiomeReport = (output) => {
@@ -1713,12 +1841,12 @@ class Linter {
     this.lintRoot = this.#findBiomeRootPath(cwdPath);
     this.configPath = Linter.#configPathIn(this.lintRoot) ?? path9.join(this.lintRoot, "biome.json");
     const localBiomeBin = path9.join(this.lintRoot, "node_modules", ".bin", Linter.biomeBinName);
-    this.#biomeBin = existsSync(localBiomeBin) ? localBiomeBin : "biome";
+    this.#biomeBin = existsSync2(localBiomeBin) ? localBiomeBin : "biome";
   }
   static #configPathIn(dir) {
     for (const fileName of BIOME_CONFIG_FILES) {
       const configPath = path9.join(dir, fileName);
-      if (existsSync(configPath))
+      if (existsSync2(configPath))
         return configPath;
     }
     return null;
@@ -1806,7 +1934,7 @@ class Linter {
     };
   }
   async#checkFile(filePath, { write = false } = {}) {
-    const originalContent = existsSync(filePath) ? readFileSync(filePath, "utf8") : "";
+    const originalContent = existsSync2(filePath) ? readFileSync(filePath, "utf8") : "";
     const { stdout, stderr } = await this.#runBiome([
       "check",
       ...write ? ["--write"] : [],
@@ -1820,7 +1948,7 @@ class Linter {
     const report = parseBiomeReport(stdout || stderr);
     const results = this.#toLintResults(report, filePath);
     const { errors, warnings } = this.#splitMessages(results);
-    const output = write && existsSync(filePath) ? readFileSync(filePath, "utf8") : undefined;
+    const output = write && existsSync2(filePath) ? readFileSync(filePath, "utf8") : undefined;
     return {
       fixed: write && output !== originalContent,
       output,
@@ -1836,7 +1964,7 @@ class Linter {
   }
   async lintFile(filePath) {
     const resolvedFilePath = this.#resolveFilePath(filePath);
-    if (!existsSync(resolvedFilePath))
+    if (!existsSync2(resolvedFilePath))
       throw new Error(`File not found: ${filePath}`);
     return await this.#checkFile(resolvedFilePath);
   }
@@ -1853,7 +1981,7 @@ class Linter {
         output.push(`
 ${chalk.cyan(result.filePath)}`);
         let sourceLines = [];
-        if (existsSync(result.filePath)) {
+        if (existsSync2(result.filePath)) {
           try {
             const sourceContent = readFileSync(result.filePath, "utf8");
             sourceLines = sourceContent.split(`
@@ -1925,7 +2053,7 @@ ${errorText}, ${warningText} found`];
   }
   async fixFile(filePath, dryRun = false) {
     const resolvedFilePath = this.#resolveFilePath(filePath);
-    if (!existsSync(resolvedFilePath))
+    if (!existsSync2(resolvedFilePath))
       throw new Error(`File not found: ${filePath}`);
     if (!dryRun)
       return await this.#checkFile(resolvedFilePath, { write: true });
@@ -1935,7 +2063,7 @@ ${errorText}, ${warningText} found`];
     return { ...lintResult, fixed: stdout !== source, output: stdout };
   }
   async fixFiles(filePaths) {
-    const resolved = filePaths.map((filePath) => this.#resolveFilePath(filePath)).filter(existsSync);
+    const resolved = filePaths.map((filePath) => this.#resolveFilePath(filePath)).filter(existsSync2);
     if (resolved.length === 0)
       return { fixed: [] };
     const before = new Map(resolved.map((filePath) => [filePath, readFileSync(filePath, "utf8")]));
@@ -1955,7 +2083,7 @@ ${errorText}, ${warningText} found`];
   }
   async getConfigForFile(filePath) {
     const resolvedFilePath = this.#resolveFilePath(filePath);
-    if (!existsSync(resolvedFilePath))
+    if (!existsSync2(resolvedFilePath))
       throw new Error(`File not found: ${filePath}`);
     return JSON.parse(readFileSync(this.configPath, "utf8"));
   }
@@ -2244,7 +2372,7 @@ var moduleUiFileTypes = {
   service: new Set(["Util", "Zone"]),
   scalar: new Set(["Template", "Unit"])
 };
-var createDependencyScanner = async (exec) => (await import("./dependencyScanner-06z2dmrr.js")).TypeScriptDependencyScanner.from(exec);
+var createDependencyScanner = async (exec) => (await import("./dependencyScanner-3afj2vt1.js")).TypeScriptDependencyScanner.from(exec);
 var getScanPath = (exec, relativePath) => path11.posix.join(`${exec.type}s`, exec.name, relativePath.split(path11.sep).join("/"));
 var getModuleNameFromPath = (kind, modulePath) => {
   const dirname = path11.basename(modulePath);
@@ -2289,7 +2417,7 @@ async function assertScanConvention(exec, libRoot) {
   ]);
   if (violations.length > 0) {
     throw new Error(`[scan-convention]
-${violations.sort().map((violation) => `- ${violation}`).join(`
+${violations.sort((a, b) => a < b ? -1 : a > b ? 1 : 0).map((violation) => `- ${violation}`).join(`
 `)}`);
   }
 }
@@ -2613,6 +2741,136 @@ class WorkspaceInfo {
   }
 }
 
+// pkgs/@akanjs/devkit/spinner.ts
+import ora from "ora";
+
+class Spinner {
+  static padding = 12;
+  static oraOptions = { discardStdin: false };
+  static canAnimate(stream = process.stderr) {
+    return !stream.isTTY || stream.columns > 0;
+  }
+  spinner;
+  stopWatch = null;
+  startAt = new Date;
+  prefix;
+  message;
+  enableSpin;
+  constructor(message, { prefix = "", indent = 0, enableSpin = true } = {}) {
+    Spinner.padding = Math.max(Spinner.padding, prefix.length);
+    this.prefix = prefix;
+    this.message = message;
+    this.spinner = ora({ ...Spinner.oraOptions, text: message });
+    this.spinner.prefixText = prefix.padStart(Spinner.padding, " ");
+    this.spinner.indent = indent;
+    this.enableSpin = enableSpin && Spinner.canAnimate();
+  }
+  start() {
+    this.startAt = new Date;
+    if (this.enableSpin) {
+      this.spinner.start();
+      this.stopWatch = setInterval(() => {
+        this.spinner.prefixText = this.prefix.padStart(Spinner.padding, " ");
+        this.spinner.text = `${this.message} (${this.#getElapsedTimeStr({ floor: true })})`;
+      }, 1000);
+    } else
+      this.spinner.info();
+    return this;
+  }
+  succeed(message) {
+    this.spinner.succeed(`${message} (${this.#getElapsedTimeStr()})`);
+    this.#reset();
+  }
+  fail(message) {
+    this.spinner.fail(`${message} (${this.#getElapsedTimeStr()})`);
+    this.#reset();
+  }
+  isSpinning() {
+    return this.spinner.isSpinning;
+  }
+  #reset() {
+    if (this.stopWatch)
+      clearInterval(this.stopWatch);
+    this.stopWatch = null;
+  }
+  #getElapsedTimeStr({ floor = false } = {}) {
+    const ms = Date.now() - this.startAt.getTime();
+    if (ms < 1000)
+      return `${ms}ms`;
+    const s = Math.floor(ms / 1000);
+    if (s < 60)
+      return `${floor ? Math.floor(ms / 1000) : Math.floor(ms / 100) / 10}s`;
+    const m = Math.floor(s / 60);
+    return `${m}m ${s % 60}s`;
+  }
+}
+
+// pkgs/@akanjs/devkit/typecheck/projectTypecheck.ts
+import { mkdir as mkdir2, rm as rm3 } from "fs/promises";
+import path12 from "path";
+
+class ProjectTypecheck2 {
+  projectDir;
+  workspaceRoot;
+  env;
+  static #testIncludes = ["**/*.test.ts", "**/*.test.tsx", "**/*.spec.ts", "**/*.spec.tsx"];
+  static #excludes = [".akan/**", "node_modules/**", "local/**"];
+  constructor(projectDir, workspaceRoot, env) {
+    this.projectDir = projectDir;
+    this.workspaceRoot = workspaceRoot;
+    this.env = env;
+  }
+  get typecheckDir() {
+    return path12.join(this.projectDir, ".akan", "typecheck");
+  }
+  async run(entries, { clean = false, incremental = true, tests = false } = {}) {
+    const name = tests ? "tsconfig.tests" : "tsconfig";
+    await mkdir2(this.typecheckDir, { recursive: true });
+    const tsconfig = {
+      extends: "../../tsconfig.json",
+      compilerOptions: { noEmit: true, incremental, tsBuildInfoFile: `./${name}.tsbuildinfo` },
+      include: [...entries, ...tests ? ProjectTypecheck2.#testIncludes.map((glob) => `../../${glob}`) : []],
+      ...tests ? { exclude: ProjectTypecheck2.#excludes.map((glob) => `../../${glob}`) } : {},
+      references: []
+    };
+    const tsconfigPath = path12.join(this.typecheckDir, `${name}.json`);
+    await Bun.write(tsconfigPath, `${JSON.stringify(tsconfig, null, 2)}
+`);
+    if (clean)
+      await rm3(path12.join(this.typecheckDir, `${name}.tsbuildinfo`), { force: true });
+    await this.#check(tsconfigPath);
+    return tsconfigPath;
+  }
+  async#check(tsconfigPath) {
+    const proc = Bun.spawn([process.execPath, await ProjectTypecheck2.workerEntry(this.workspaceRoot)], {
+      cwd: this.workspaceRoot,
+      env: { ...this.env, AKAN_COMMAND_TYPE: "typecheck", AKAN_TYPECHECK_TSCONFIG: tsconfigPath },
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]);
+    if (exitCode !== 0)
+      throw new Error((stderr || stdout).trim() || `Typecheck failed with exit code ${exitCode}`);
+  }
+  static async workerEntry(workspaceRoot) {
+    const candidates = [
+      path12.join(workspaceRoot, "pkgs/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path12.join(workspaceRoot, "node_modules/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path12.join(import.meta.dir, "typecheck.proc.js"),
+      path12.join(import.meta.dir, "typecheck.proc.ts"),
+      path12.join(import.meta.dir, "..", "typecheck.proc.js")
+    ];
+    for (const candidate of candidates)
+      if (await Bun.file(candidate).exists())
+        return candidate;
+    throw new Error(`[devkit] typecheck worker entry not found; looked in: ${candidates.join(", ")}`);
+  }
+}
+
 // pkgs/@akanjs/devkit/executors.ts
 var staticTemplateFileExtensions = new Set(".avif .bmp .cjs .css .eot .gif .html .ico .jpeg .jpg .js .json .map .md .mjs .mp3 .mp4 .ogg .otf .pdf .png .svg".split(" ").concat(".ttf .txt .wasm .wav .webm .webp .woff .woff2 .xml".split(" ")));
 var plainCommandArgPattern = process.platform === "win32" ? /^[\w@%+=:,./\\-]+$/ : /^[\w@%+=:,./-]+$/;
@@ -2709,16 +2967,16 @@ class Executor {
   linter = null;
   constructor(name, cwdPath) {
     this.name = name;
-    this.logger = new Logger2(name);
+    this.logger = new Logger3(name);
     this.logs = [];
     this.cwdPath = cwdPath;
   }
   #stdout(data) {
     if (Executor.verbose)
-      Logger2.raw(chalk2.dim(data.toString()));
+      Logger3.raw(chalk2.dim(data.toString()));
   }
   #stderr(data) {
-    Logger2.raw(chalk2.red(data.toString()));
+    Logger3.raw(chalk2.red(data.toString()));
   }
   #settle(proc, target, { onClose = false, keepLogs = false, redStderr = false } = {}) {
     let stdout = "";
@@ -2767,10 +3025,10 @@ class Executor {
     return this.#settle(proc, target, { redStderr: true }).then(({ code, signal }) => ({ code, signal }));
   }
   getPath(filePath) {
-    if (path12.isAbsolute(filePath))
+    if (path13.isAbsolute(filePath))
       return filePath;
     if (filePath.startsWith("."))
-      return path12.join(this.cwdPath, filePath);
+      return path13.join(this.cwdPath, filePath);
     const baseParts = this.cwdPath.split(/[\\/]/).filter(Boolean);
     const targetParts = filePath.split(/[\\/]/).filter(Boolean);
     let overlapLength = 0;
@@ -2784,12 +3042,12 @@ class Executor {
       if (isOverlap)
         overlapLength = i;
     }
-    return path12.join(this.cwdPath, ...targetParts.slice(overlapLength));
+    return path13.join(this.cwdPath, ...targetParts.slice(overlapLength));
   }
   async mkdir(dirPath) {
     const writePath = this.getPath(dirPath);
     if (!await FileSys2.dirExists(writePath))
-      await mkdir2(writePath, { recursive: true });
+      await mkdir3(writePath, { recursive: true });
     this.logger.verbose(`Make directory ${writePath}`);
     return this;
   }
@@ -2797,20 +3055,20 @@ class Executor {
     const readPath = this.getPath(dirPath);
     try {
       const glob = new Bun.Glob("*");
-      return Array.from(glob.scanSync({ cwd: readPath, onlyFiles: false }));
+      return Array.from(glob.scanSync({ cwd: readPath, onlyFiles: false })).sort();
     } catch {
       return [];
     }
   }
   async getAllFiles(pattern = "**/*", { cwd } = {}) {
     const glob = new Bun.Glob(pattern);
-    return Array.from(glob.scanSync({ cwd: cwd ?? this.cwdPath, onlyFiles: true }));
+    return Array.from(glob.scanSync({ cwd: cwd ?? this.cwdPath, onlyFiles: true })).sort();
   }
   async getFilesAndDirs(dirPath) {
     const fullDirPath = this.getPath(dirPath);
     const glob = new Bun.Glob("*");
-    const files = Array.from(glob.scanSync({ cwd: fullDirPath, onlyFiles: true }));
-    const allEntries = Array.from(glob.scanSync({ cwd: fullDirPath, onlyFiles: false }));
+    const files = Array.from(glob.scanSync({ cwd: fullDirPath, onlyFiles: true })).sort();
+    const allEntries = Array.from(glob.scanSync({ cwd: fullDirPath, onlyFiles: false })).sort();
     const dirs = allEntries.filter((entry) => !files.includes(entry));
     return { files, dirs };
   }
@@ -2825,26 +3083,28 @@ class Executor {
     return this;
   }
   async removeDir(dirPath) {
-    const readPath = path12.join(this.getPath(dirPath), ".");
+    const readPath = path13.join(this.getPath(dirPath), ".");
     if (await FileSys2.entryExists(readPath))
-      await rm3(readPath, { recursive: true, force: true });
+      await rm4(readPath, { recursive: true, force: true });
     this.logger.verbose(`Remove directory ${readPath}`);
     return this;
   }
   async writeFile(filePath, content, { overwrite = true, silent = false } = {}) {
     const writePath = this.getPath(filePath);
-    const dir = path12.dirname(writePath);
+    const dir = path13.dirname(writePath);
     if (!await FileSys2.dirExists(dir))
-      await mkdir2(dir, { recursive: true });
+      await mkdir3(dir, { recursive: true });
     let contentStr = typeof content === "string" ? content : JsonFormatter.stringify(content, writePath);
+    let written = true;
     if (await FileSys2.fileExists(writePath)) {
       const currentContent = await FileSys2.readText(writePath);
       if (currentContent === contentStr || !overwrite) {
         this.logger.verbose(`File ${writePath} is unchanged`);
         contentStr = currentContent;
+        written = false;
       } else {
         await FileSys2.writeText(writePath, contentStr);
-        if (Logger2.isVerbose())
+        if (Logger3.isVerbose())
           this.logger.rawLog(chalk2.yellow(`File Update: ${filePath}`));
       }
     } else {
@@ -2852,13 +3112,13 @@ class Executor {
       if (!silent)
         this.logger.rawLog(chalk2.green(`File Create: ${filePath}`));
     }
-    return { filePath: writePath, content: contentStr };
+    return { filePath: writePath, content: contentStr, written };
   }
   async writeJson(filePath, content) {
     await this.writeFile(filePath, content);
   }
   async getLocalFile(targetPath) {
-    const filePath = path12.isAbsolute(targetPath) ? targetPath : targetPath.replace(this.cwdPath, "");
+    const filePath = path13.isAbsolute(targetPath) ? targetPath : targetPath.replace(this.cwdPath, "");
     const content = await this.readFile(filePath);
     return { filePath, content };
   }
@@ -2875,7 +3135,7 @@ class Executor {
       return;
     const isDirectory = (await stat2(src)).isDirectory();
     if (!await FileSys2.exists(dest) && isDirectory)
-      await mkdir2(dest, { recursive: true });
+      await mkdir3(dest, { recursive: true });
     if (dereference || process.platform === "win32")
       await cpEntry(src, dest, { recursive: isDirectory, dereference: true, force: true });
     else
@@ -2945,9 +3205,9 @@ class Executor {
       const result = await getContent.default(scanInfo ?? null, dict, options);
       if (result === null)
         return null;
-      const filename = typeof result === "object" ? result.filename : path12.basename(targetPath).replace(".js", ".ts");
+      const filename = typeof result === "object" ? result.filename : path13.basename(targetPath).replace(".js", ".ts");
       const content = typeof result === "object" ? result.content : result;
-      const convertedTargetPath = convertPath(`${path12.dirname(targetPath)}/${filename}`);
+      const convertedTargetPath = convertPath(`${path13.dirname(targetPath)}/${filename}`);
       this.logger.verbose(`Apply template ${templatePath} to ${convertedTargetPath}`);
       return this.writeFile(convertedTargetPath, content, { overwrite });
     } else if (targetPath.endsWith(".template")) {
@@ -2956,15 +3216,17 @@ class Executor {
       const convertedContent = Object.entries(dict).reduce((data, [key, value]) => data.replace(new RegExp(`<%= ${key} %>`, "g"), value), content);
       this.logger.verbose(`Apply template ${templatePath} to ${convertedTargetPath}`);
       return this.writeFile(convertedTargetPath, convertedContent, { overwrite });
-    } else if (staticTemplateFileExtensions.has(path12.extname(targetPath).toLowerCase())) {
+    } else if (staticTemplateFileExtensions.has(path13.extname(targetPath).toLowerCase())) {
       const convertedTargetPath = convertPath(targetPath);
       const writePath = this.getPath(convertedTargetPath);
-      const dirname = path12.dirname(writePath);
+      if (!overwrite && await FileSys2.fileExists(writePath))
+        return { filePath: writePath, content: "", written: false };
+      const dirname = path13.dirname(writePath);
       if (!await FileSys2.dirExists(dirname))
-        await mkdir2(dirname, { recursive: true });
+        await mkdir3(dirname, { recursive: true });
       await copyFile(templatePath, writePath);
       this.logger.verbose(`Apply template ${templatePath} to ${convertedTargetPath}`);
-      return { filePath: writePath, content: "" };
+      return { filePath: writePath, content: "", written: true };
     } else
       return null;
   }
@@ -2981,7 +3243,7 @@ class Executor {
     if ((await stat2(templatePath)).isFile()) {
       const fileContent = await this.#applyTemplateFile({
         templatePath,
-        targetPath: path12.join(basePath, path12.basename(templatePath)),
+        targetPath: path13.join(basePath, path13.basename(templatePath)),
         scanInfo,
         overwrite
       }, dict, options);
@@ -2989,19 +3251,19 @@ class Executor {
     } else {
       const subdirs = await readDirEntries(templatePath);
       const fileContents = (await Promise.all(subdirs.map(async (subdir) => {
-        const subpath = path12.join(templatePath, subdir);
+        const subpath = path13.join(templatePath, subdir);
         if ((await stat2(subpath)).isFile()) {
           const fileContent = await this.#applyTemplateFile({
             templatePath: subpath,
-            targetPath: path12.join(basePath, subdir),
+            targetPath: path13.join(basePath, subdir),
             scanInfo,
             overwrite
           }, dict, options);
           return fileContent ? [fileContent] : [];
         } else
           return await this._applyTemplate({
-            basePath: path12.join(basePath, subdir),
-            template: path12.join(template, subdir),
+            basePath: path13.join(basePath, subdir),
+            template: path13.join(template, subdir),
             scanInfo,
             dict,
             overwrite,
@@ -3013,8 +3275,8 @@ class Executor {
   }
   async#resolveTemplateRoot() {
     const candidates = [
-      path12.resolve(getDirname2(import.meta.url), "templates"),
-      path12.resolve(getDirname2(import.meta.url), "../cli/templates")
+      path13.resolve(getDirname2(import.meta.url), "templates"),
+      path13.resolve(getDirname2(import.meta.url), "../cli/templates")
     ];
     for (const candidate of candidates) {
       if (await FileSys2.dirExists(candidate))
@@ -3024,7 +3286,7 @@ class Executor {
   }
   async applyTemplate(options) {
     const fileContents = await this._applyTemplate({ ...options, dict: withCapitalizedDict(options.dict) });
-    await this.#formatAppliedTemplate(fileContents);
+    await this.#formatAppliedTemplate(fileContents.filter((fileContent) => fileContent.written));
     return fileContents;
   }
   async#formatAppliedTemplate(fileContents) {
@@ -3036,7 +3298,7 @@ class Executor {
       if (fixed.length > 0)
         this.logger.verbose(`Formatted ${fixed.length} scaffolded file(s)`);
     } catch (err) {
-      this.logger.verbose(`Skipped formatting scaffolded files: ${err instanceof Error ? err.message : String(err)}`);
+      this.logger.verbose(`Skipped formatting scaffolded files: ${toError2(err).message}`);
     }
   }
   async getTypeChecker() {
@@ -3053,7 +3315,7 @@ class Executor {
   }
   async typeCheckAsync(filePath) {
     const path = this.getPath(filePath);
-    const entry = await this.#resolveTypecheckWorkerEntry();
+    const entry = await ProjectTypecheck2.workerEntry(process.cwd());
     const proc = Bun.spawn([process.execPath, entry], {
       cwd: this.cwdPath,
       env: {
@@ -3079,20 +3341,6 @@ class Executor {
       message: result.message
     };
   }
-  async#resolveTypecheckWorkerEntry() {
-    const dirname = getDirname2(import.meta.url);
-    const candidates = [
-      path12.join(process.cwd(), "pkgs/@akanjs/devkit/typecheck/typecheck.proc.ts"),
-      path12.join(process.cwd(), "node_modules/@akanjs/devkit/typecheck/typecheck.proc.ts"),
-      path12.join(dirname, "typecheck/typecheck.proc.ts"),
-      path12.join(dirname, "typecheck.proc.js"),
-      path12.join(dirname, "typecheck.proc.ts")
-    ];
-    for (const candidate of candidates)
-      if (await Bun.file(candidate).exists())
-        return candidate;
-    throw new Error(`[devkit] typecheck worker entry not found; looked in: ${candidates.join(", ")}`);
-  }
   getLinter() {
     this.linter ??= new Linter(this.cwdPath);
     return this.linter;
@@ -3124,17 +3372,19 @@ class WorkspaceExecutor extends Executor {
   } = {}) {
     return new WorkspaceExecutor({ workspaceRoot, repoName });
   }
+  static publicEnvPin = null;
+  static localServeDomain = "localhost";
   static getBaseDevEnv(envPath) {
-    const sourceEnv = envPath ? { ...process.env, ...parseEnvFile(envPath) } : process.env;
+    const sourceEnv = {
+      ...envPath ? { ...process.env, ...parseEnvFile(envPath) } : process.env,
+      ...WorkspaceExecutor.publicEnvPin
+    };
     const appName = sourceEnv.AKAN_PUBLIC_APP_NAME;
     const workspaceRoot = sourceEnv.AKAN_WORKSPACE_ROOT;
     const workspaceId = sourceEnv.AKAN_WORKSPACE_ID;
-    const repoName = sourceEnv.AKAN_PUBLIC_REPO_NAME;
-    if (!repoName)
-      throw new Error("AKAN_PUBLIC_REPO_NAME is not set");
-    const serveDomain = sourceEnv.AKAN_PUBLIC_SERVE_DOMAIN;
-    if (!serveDomain)
-      throw new Error("AKAN_PUBLIC_SERVE_DOMAIN is not set");
+    const repoName = sourceEnv.AKAN_PUBLIC_REPO_NAME || resolveRepoName(envPath ? path13.dirname(envPath) : workspaceRoot ?? process.cwd());
+    const serveDomain = sourceEnv.AKAN_PUBLIC_SERVE_DOMAIN || WorkspaceExecutor.localServeDomain;
+    const defaulted = ["AKAN_PUBLIC_REPO_NAME", "AKAN_PUBLIC_SERVE_DOMAIN"].filter((key) => !sourceEnv[key]);
     const portOffset = parseInt(sourceEnv.PORT_OFFSET ?? "0");
     const env = sourceEnv.AKAN_PUBLIC_ENV ?? "debug";
     if (!env)
@@ -3146,9 +3396,18 @@ class WorkspaceExecutor extends Executor {
       serveDomain,
       env,
       portOffset,
-      workspaceId
+      workspaceId,
+      defaulted
     };
   }
+  static assertDeployableEnv(baseDevEnv, environment, purpose) {
+    const defaulted = environment === "local" ? [] : baseDevEnv.defaulted ?? [];
+    if (!defaulted.length)
+      return;
+    const values = { AKAN_PUBLIC_REPO_NAME: baseDevEnv.repoName, AKAN_PUBLIC_SERVE_DOMAIN: baseDevEnv.serveDomain };
+    const standIns = defaulted.map((key) => `${key} (would be "${values[key]}")`).join(" and ");
+    throw new Error(`${purpose} for the "${environment}" environment needs ${standIns} set, not a local default. Set ${defaulted.length > 1 ? "them" : "it"} in the workspace .env or the shell, or use AKAN_PUBLIC_ENV=local.`);
+  }
   getWorkspaceId({
     allowEmpty
   } = {}) {
@@ -3213,7 +3472,7 @@ class WorkspaceExecutor extends Executor {
       await Promise.all(dirs.map(async (dir) => {
         if (dir.includes("_") || AVOID_DIRS.includes(dir))
           return;
-        const dirPath = path12.join(dirname, dir);
+        const dirPath = path13.join(dirname, dir);
         if ((await stat2(dirPath)).isDirectory()) {
           results.push(`${prefix}${dir}`);
           if (maxDepth > 0)
@@ -3250,9 +3509,9 @@ class WorkspaceExecutor extends Executor {
       await Promise.all(dirs.map(async (dir) => {
         if (AVOID_DIRS.includes(dir))
           return;
-        const dirPath = path12.join(dirname, dir);
+        const dirPath = path13.join(dirname, dir);
         if (await FileSys2.dirExists(dirPath)) {
-          const hasTargetFile = await FileSys2.fileExists(path12.join(dirPath, targetFilename));
+          const hasTargetFile = await FileSys2.fileExists(path13.join(dirPath, targetFilename));
           if (hasTargetFile)
             results.push(`${prefix}${dir}`);
           if (maxDepth > 0)
@@ -3311,7 +3570,7 @@ class SysExecutor extends Executor {
       return [];
     const violations = [];
     for (const entry of await this.getAllFiles("**/*", { cwd: this.getPath("page") })) {
-      const relativePath = entry.split(path12.sep).join("/");
+      const relativePath = entry.split(path13.sep).join("/");
       const reason = getPageSourceFileViolation(relativePath);
       if (reason)
         violations.push({ relativePath: `page/${relativePath}`, reason });
@@ -3406,21 +3665,21 @@ class SysExecutor extends Executor {
     await this.setPackageJson({ ...packageJson, dependencies, devDependencies });
   }
   async getLocalFile(targetPath) {
-    const filePath = path12.isAbsolute(targetPath) ? targetPath : `${this.type}s/${this.name}/${targetPath}`;
+    const filePath = path13.isAbsolute(targetPath) ? targetPath : `${this.type}s/${this.name}/${targetPath}`;
     const content = await this.workspace.readFile(filePath);
     return { filePath, content };
   }
   async getDatabaseModules() {
-    return (await this.readdir("lib")).filter((name) => !name.startsWith("_") && !name.endsWith(".ts")).filter((name) => existsSync2(`${this.cwdPath}/lib/${name}/${name}.constant.ts`));
+    return (await this.readdir("lib")).filter((name) => !name.startsWith("_") && !name.endsWith(".ts")).filter((name) => existsSync3(`${this.cwdPath}/lib/${name}/${name}.constant.ts`));
   }
   async getServiceModules() {
-    return (await this.readdir("lib")).filter((name) => name.startsWith("_") && !name.startsWith("__")).filter((name) => existsSync2(`${this.cwdPath}/lib/${name}/${name.slice(1)}.service.ts`));
+    return (await this.readdir("lib")).filter((name) => name.startsWith("_") && !name.startsWith("__")).filter((name) => existsSync3(`${this.cwdPath}/lib/${name}/${name.slice(1)}.service.ts`));
   }
   async getScalarModules() {
-    return (await this.readdir("lib/__scalar")).filter((name) => !name.startsWith("_")).filter((name) => existsSync2(`${this.cwdPath}/lib/__scalar/${name}/${name}.constant.ts`));
+    return (await this.readdir("lib/__scalar")).filter((name) => !name.startsWith("_")).filter((name) => existsSync3(`${this.cwdPath}/lib/__scalar/${name}/${name}.constant.ts`));
   }
   async#getComponentModules(role) {
-    return (await this.readdir("lib")).filter((name) => !name.startsWith("_") && !name.endsWith(".ts")).filter((name) => existsSync2(`${this.cwdPath}/lib/${name}/${capitalize(name)}.${role}.tsx`));
+    return (await this.readdir("lib")).filter((name) => !name.startsWith("_") && !name.endsWith(".ts")).filter((name) => existsSync3(`${this.cwdPath}/lib/${name}/${capitalize(name)}.${role}.tsx`));
   }
   async#getComponentSources(role) {
     const modules = await this.#getComponentModules(role);
@@ -3494,19 +3753,19 @@ class AppExecutor extends SysExecutor {
   static from(executor, name) {
     return new AppExecutor({ workspace: executor instanceof WorkspaceExecutor ? executor : executor.workspace, name });
   }
-  static #keptOnStart = [path12.join(".akan", "cache", "bin")];
-  static #legacyNative = path12.join(".akan", "native");
+  static #keptOnStart = [path13.join(".akan", "cache", "bin")];
+  static #legacyNative = path13.join(".akan", "native");
   async#removeDevOutput(dir = ".akan") {
     const entries = await readDirEntries(this.getPath(dir)).catch(() => []);
     await Promise.all(entries.map(async (name) => {
-      const entry = path12.join(dir, name);
+      const entry = path13.join(dir, name);
       if (entry === AppExecutor.#legacyNative) {
         this.logger.warn(`apps/${this.name}/.akan/native holds native builds from before they moved to dist/native/${this.name}: upload any release waiting in its updates folders, then delete it.`);
         return;
       }
       if (AppExecutor.#keptOnStart.includes(entry))
         return;
-      if (AppExecutor.#keptOnStart.some((kept) => kept.startsWith(`${entry}${path12.sep}`)))
+      if (AppExecutor.#keptOnStart.some((kept) => kept.startsWith(`${entry}${path13.sep}`)))
         return await this.#removeDevOutput(entry);
       await this.removeDir(entry);
     }));
@@ -3525,10 +3784,12 @@ class AppExecutor extends SysExecutor {
     return basePort + appIndex + portOffset;
   }
   getCommandEnv(env = {}) {
-    const { portOffset } = WorkspaceExecutor.getBaseDevEnv();
+    const { portOffset, repoName, serveDomain } = WorkspaceExecutor.getBaseDevEnv();
     const PORT = (8282 + portOffset).toString();
     return {
       ...process.env,
+      AKAN_PUBLIC_REPO_NAME: repoName,
+      AKAN_PUBLIC_SERVE_DOMAIN: serveDomain,
       AKAN_PUBLIC_APP_NAME: this.name,
       AKAN_WORKSPACE_ROOT: this.workspace.workspaceRoot,
       NODE_NO_WARNINGS: "1",
@@ -3630,13 +3891,13 @@ class AppExecutor extends SysExecutor {
         absolute: false,
         onlyFiles: true
       })) {
-        const segments = rel.split(path12.sep);
+        const segments = rel.split(path13.sep);
         if (segments.some((s) => s === "node_modules"))
           continue;
         const posix = `${root.keyPrefix}${segments.join("/")}`;
         if (!root.keyPrefix && libKeyPrefixes.some((prefix) => posix.startsWith(prefix)))
           continue;
-        const absPath = path12.join(root.dir, ...segments);
+        const absPath = path13.join(root.dir, ...segments);
         validatePageSourceFile(posix, { filePath: absPath });
         if (!isRouteSourceFile(posix))
           continue;
@@ -3679,7 +3940,7 @@ class AppExecutor extends SysExecutor {
         pageKeys.push(key);
       }
     }
-    pageKeys.sort();
+    pageKeys.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
     this.#pageKeys = this.#excludeDevOnlyPages ? this.#dropDevOnlyPages(pageKeys, devOnlyKeys, devOnlyDirs) : pageKeys;
     return this.#pageKeys;
   }
@@ -3777,12 +4038,12 @@ class AppExecutor extends SysExecutor {
   static async#linkLibAsset(targetPath, linkPath) {
     const isWindows = process.platform === "win32";
     try {
-      const target = isWindows ? targetPath : path12.relative(path12.dirname(linkPath), targetPath);
+      const target = isWindows ? targetPath : path13.relative(path13.dirname(linkPath), targetPath);
       await symlink(target, linkPath, isWindows ? "junction" : "dir");
     } catch (error) {
       if (!isWindows)
         throw error;
-      await mkdir2(linkPath, { recursive: true });
+      await mkdir3(linkPath, { recursive: true });
       await cpEntry(targetPath, linkPath, { recursive: true, dereference: true, force: true });
     }
   }
@@ -3820,7 +4081,7 @@ class AppExecutor extends SysExecutor {
         await this.writeFile(rel, content, opts);
       },
       readEnvClient: async () => {
-        const envClientPath = path12.join(this.cwdPath, "env", "env.client.ts");
+        const envClientPath = path13.join(this.cwdPath, "env", "env.client.ts");
         if (!await FileSys2.fileExists(envClientPath))
           return null;
         try {
@@ -3914,7 +4175,7 @@ class PkgExecutor extends Executor {
       return overrideVersion;
     try {
       const packageJsonPath = `pkgs/${dep}/package.json`;
-      if (!await Bun.file(path12.join(this.workspace.workspaceRoot, packageJsonPath)).exists())
+      if (!await Bun.file(path13.join(this.workspace.workspaceRoot, packageJsonPath)).exists())
         return;
       const packageJson = await this.workspace.readJson(packageJsonPath);
       if (packageJson.name === dep)
@@ -3925,7 +4186,7 @@ class PkgExecutor extends Executor {
   }
   async#toDependencyMap(rootPackageJson, dependencies = [], devDependencies = []) {
     const dependencyNames = [...new Set(dependencies)].sort();
-    const devDependencyNames = [...new Set(devDependencies)].filter((dep) => !dependencyNames.includes(dep)).sort();
+    const devDependencyNames = [...new Set(devDependencies)].filter((dep) => !dependencyNames.includes(dep)).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
     const dependencyVersions = new Map;
     const missingDeps = [];
     for (const dep of [...dependencyNames, ...devDependencyNames]) {
@@ -4007,4 +4268,4 @@ class ModuleExecutor extends Executor {
   }
 }
 
-export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, CLAUDE_COMMENT_RULE, binPlatforms, ServerEnvProfile, AkanAppConfig, AkanWorkspaceConfig, AsyncDefaultExportDetector, resolveSsrPageEntriesForApp, CodegenLock, Linter, LibSource, formatLibStatuses, rootAllowedFiles, rootAllowedDirs, isAllowedLibFacetRootFile, libFacetRootHintOf, barrelFacetDirs, facetIndexShadowOf, rootEntryHintOf, isScannedRootEntry, AppInfo, Spinner, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };
+export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, CLAUDE_COMMENT_RULE, binPlatforms, ServerEnvProfile, AkanAppConfig, AkanWorkspaceConfig, AsyncDefaultExportDetector, resolveSsrPageEntriesForApp, CodegenLock, Linter, LibSource, formatLibStatuses, rootAllowedFiles, rootAllowedDirs, isAllowedLibFacetRootFile, libFacetRootHintOf, barrelFacetDirs, facetIndexShadowOf, rootEntryHintOf, isScannedRootEntry, AppInfo, Spinner, ProjectTypecheck2, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };