@akanjs/cli 3.1.0-rc.1 → 3.1.0-rc.10

package/{subspace.command-md2teygq.js → subspace.command-5c7yasd7.js}

@@ -5,7 +5,7 @@ import {
   runner,
   script,
   command
-} from "./index-6jjtnhkw.js";
+} from "./index-jw1zm273.js";
 import {
   FileSys2
 } from "./index-52w0fvh8.js";
@@ -14,21 +14,31 @@ import {
   Executor,
   WorkspaceExecutor,
   AppExecutor
-} from "./index-55mynnqs.js";
+} from "./index-va06nr10.js";
 import {
   GlobalConfig
-} from "./index-pgj2rt78.js";
+} from "./index-cpb3nvma.js";
+import"./index-m9jj544v.js";
+import"./index-g1mbppa9.js";
+import"./index-192ha4xh.js";
 import {
   SubspaceConfig
-} from "./index-ww9bhp67.js";
+} from "./index-4pf8g7ff.js";
 import {
   SlicePlanner
-} from "./index-qt22xstj.js";
+} from "./index-35hc95h5.js";
+import"./index-665zp9rs.js";
 
 // pkgs/@akanjs/devkit/subspace.ts
+import { mkdir as mkdir2 } from "fs/promises";
+import path2 from "path";
+import { toError as toError2 } from "akanjs/common";
+
+// pkgs/@akanjs/devkit/subspaceClone.ts
 import { mkdir, readdir, rename, rm } from "fs/promises";
 import path from "path";
-class Subspace {
+import { toError } from "akanjs/common";
+class SubspaceClone {
   static anchorFile = "akan.subspace.json";
   static subspaceOwnedRootEntries = ["akan.config.ts", "Jenkinsfile"];
   static syncSubjectPrefix = "chore(subspace): sync from ";
@@ -36,175 +46,107 @@ class Subspace {
   static subspaceOwnedDirs = ["env"];
   static secretsMarkers = ["# akan:secrets (managed by akan.config.ts \u2014 do not edit)", "# akan:secrets:end"];
   static holdDir = ".akan-subspace-hold";
-  static #loopbackRegistry = /https?:\/\/(?:127\.0\.0\.1|localhost|0\.0\.0\.0|\[::1\])(?::\d+)?/;
+  static isSubspaceOwned(file) {
+    const segments = file.split("/");
+    if (!SubspaceClone.memberDirs.includes(segments[0] ?? ""))
+      return false;
+    return SubspaceClone.subspaceOwnedDirs.includes(segments[2] ?? "");
+  }
+  static async open(workspace, declaration, branch) {
+    const clone = new SubspaceClone(workspace, declaration);
+    await clone.#ensure(branch);
+    return clone;
+  }
   #workspace;
-  #config;
   #declaration;
-  constructor(workspace, config, declaration) {
+  #clonePath;
+  #clone;
+  constructor(workspace, declaration) {
     this.#workspace = workspace;
-    this.#config = config;
     this.#declaration = declaration;
-  }
-  get name() {
-    return this.#declaration.name;
-  }
-  get apps() {
-    return this.#declaration.apps;
-  }
-  get workspaceId() {
-    return this.#declaration.workspaceId;
-  }
-  get #remote() {
-    return `subspace-${this.#declaration.name}`;
-  }
-  get #clonePath() {
-    return path.join(this.#workspace.workspaceRoot, ".akan/subspace", this.#declaration.name);
-  }
-  async#git(args) {
-    return await this.#workspace.spawn("git", args);
+    this.#clonePath = path.join(workspace.workspaceRoot, ".akan/subspace", declaration.name);
+    this.#clone = new Executor(`subspace-${declaration.name}`, this.#clonePath);
   }
   async#cloneGit(args) {
     return await this.#workspace.spawn("git", ["-C", this.#clonePath, ...args]);
   }
-  async branch() {
-    return (await this.#git(["rev-parse", "--abbrev-ref", "HEAD"])).trim();
-  }
-  async headSha() {
-    return (await this.#git(["rev-parse", "--short", "HEAD"])).trim();
-  }
-  async fetch(branch) {
-    const remotes = (await this.#git(["remote"])).split(`
-`).map((line) => line.trim());
-    if (remotes.includes(this.#remote))
-      await this.#git(["remote", "set-url", this.#remote, this.#declaration.repo]);
-    else
-      await this.#git(["remote", "add", this.#remote, this.#declaration.repo]);
-    try {
-      await this.#git(["fetch", "--quiet", this.#remote, branch]);
-      return true;
-    } catch {
-      return false;
+  async#ensure(branch) {
+    if (!await FileSys2.dirExists(path.join(this.#clonePath, ".git"))) {
+      await rm(this.#clonePath, { recursive: true, force: true });
+      await mkdir(path.dirname(this.#clonePath), { recursive: true });
+      await this.#workspace.spawn("git", ["clone", "--quiet", this.#declaration.repo, this.#clonePath]);
     }
+    await this.#clone.spawn("git", ["fetch", "--quiet", "origin", branch]);
+    await this.#clone.spawn("git", ["checkout", "--quiet", "-f", "-B", branch, `origin/${branch}`]);
+    await this.#clone.spawn("git", ["clean", "-qfd"]);
   }
-  async anchor(branch) {
-    const ref = `${this.#remote}/${branch}`;
-    const commit = (await this.#git(["log", "-1", "--format=%H", ref, "--", Subspace.anchorFile])).trim();
-    if (!commit)
-      return { commit: null, incoming: [] };
-    const log = await this.#git(["log", "--format=%H%x09%an%x09%s", `${commit}..${ref}`]);
-    const incoming = log.split(`
-`).filter((line) => !!line.trim()).map((line) => {
-      const [sha = "", author = "", ...subject] = line.split("\t");
-      return { sha: sha.slice(0, 12), author, subject: subject.join("\t") };
-    });
-    return { commit, incoming };
+  async applySlice({ libs, paths, plans }, { branch, sha, remove }) {
+    const held = await this.#holdSubspaceOwned();
+    const heldRootEntries = await this.#holdRootEntries();
+    for (const member of SubspaceClone.memberDirs)
+      await rm(path.join(this.#clonePath, member), { recursive: true, force: true });
+    await this.#extract(["."], ["apps/*", "libs/*", "pkgs/*"]);
+    await this.#extract(paths);
+    await this.#restoreRootEntries(heldRootEntries);
+    await this.#restoreSubspaceOwned(held);
+    for (const entry of remove)
+      if (!SubspaceClone.subspaceOwnedRootEntries.includes(entry))
+        await rm(path.join(this.#clonePath, entry), { recursive: true, force: true });
+    await this.#rewriteGitignore();
+    const pruned = await this.#rewriteManifest(plans);
+    await this.#rewriteWorkspaceSection(libs);
+    await this.#writeLocalEnv();
+    for (const lib of libs)
+      await this.#stampLib(lib, branch, sha);
+    return { libs, pruned };
   }
-  async slice() {
-    const plans = await Promise.all(this.#declaration.apps.map(async (appName) => await new SlicePlanner(AppExecutor.from(this.#workspace, appName)).plan()));
-    const libs = [...new Set(plans.flatMap((plan) => plan.libs))].sort();
-    const paths = [...this.#declaration.apps.map((app) => `apps/${app}`), ...libs.map((lib) => `libs/${lib}`)];
-    return { plans, libs, paths };
+  async changedFiles() {
+    const dirty = (await this.#clone.spawn("git", ["status", "--porcelain"])).trim();
+    return dirty ? dirty.split(`
+`).length : 0;
   }
-  async plan(branch) {
-    const { plans, libs } = await this.slice();
-    const rootFiles = plans[0]?.rootFiles ?? [];
-    const present = new Set(rootFiles.map((file) => file.split("/")[0] ?? file));
-    const owned = Subspace.subspaceOwnedRootEntries;
-    const excluded = this.#config.exclude.filter((entry) => !owned.includes(entry));
-    const excludedTops = new Set(excluded.map((entry) => entry.replace(/\/+$/, "")));
-    const libFiles = new Map(plans.flatMap((plan) => Object.entries(plan.libFiles)));
-    const { pruned, warnings } = await SlicePlanner.pruneDependencies(this.#workspace, await this.#workspace.getPackageJson(), plans.flatMap((plan) => plan.requiredDependencies));
-    let branchRefusal = null;
+  async verify() {
+    const env = { ...process.env, ...this.#localEnv() };
     try {
-      this.#config.assertPushable(branch);
+      await this.#clone.spawn("bun", ["install"], { env });
+      for (const app of this.#declaration.apps)
+        await this.#clone.spawn("bunx", ["akan", "sync", app], { env });
+      return null;
     } catch (error) {
-      branchRefusal = error instanceof Error ? error.message : String(error);
+      return toError(error).message;
     }
-    return {
-      name: this.name,
-      repo: this.#declaration.repo,
-      branch,
-      branchRefusal,
-      apps: [...this.#declaration.apps],
-      libs: libs.map((lib) => ({
-        name: lib,
-        apps: plans.filter((plan) => plan.libs.includes(lib)).map((plan) => plan.app)
-      })),
-      files: plans.reduce((sum, plan) => sum + plan.appFiles.length, 0) + [...libFiles.values()].reduce((sum, files) => sum + files.length, 0),
-      rootEntries: [...present].filter((entry) => !excludedTops.has(entry) && !owned.includes(entry)).sort((a, b) => a.localeCompare(b)),
-      excludedRootEntries: excluded,
-      subspaceOwnedRootEntries: owned.filter((entry) => present.has(entry)),
-      prunedDependencies: pruned,
-      lockProblem: rootFiles.includes("bun.lock") ? await this.#loopbackRegistryLock(this.#workspace.workspaceRoot) : null,
-      warnings: [...new Set([...plans.flatMap((plan) => plan.warnings), ...warnings])]
-    };
-  }
-  #isSubspaceOwned(file) {
-    const segments = file.split("/");
-    if (!Subspace.memberDirs.includes(segments[0] ?? ""))
-      return false;
-    return Subspace.subspaceOwnedDirs.includes(segments[2] ?? "");
   }
-  #isStamped(file) {
-    return /^libs\/[^/]+\/package\.json$/.test(file);
+  async lock() {
+    const lockPath = path.join(this.#clonePath, "bun.lock");
+    return await FileSys2.fileExists(lockPath) ? await FileSys2.readText(lockPath) : null;
   }
-  async#differsBeyondStamp(ref, file) {
-    const [theirs, ours] = await Promise.all([
-      this.#git(["show", `${ref}:${file}`]).catch(() => ""),
-      this.#git(["show", `HEAD:${file}`]).catch(() => "")
-    ]);
-    if (!theirs || !ours)
-      return true;
-    const normalize = (content) => {
-      try {
-        return LibSource.unstamped(content);
-      } catch {
-        return content;
-      }
-    };
-    return normalize(theirs) !== normalize(ours);
+  async commit(branch, sha) {
+    await this.#writeAnchorFile(branch, sha);
+    await this.#clone.spawn("git", ["add", "-A"]);
+    const message = `${SubspaceClone.syncSubjectPrefix}${this.#workspace.repoName}@${sha}`;
+    await this.#clone.spawn("git", ["commit", "--quiet", "-m", message]);
+    await this.#clone.spawn("git", ["push", "--quiet", "origin", branch]);
+    return (await this.#clone.spawn("git", ["rev-parse", "--short", "HEAD"])).trim();
   }
-  async#changedSliceFiles(ref, diffArgs) {
-    const files = (await this.#git(["diff", "--name-only", ...diffArgs])).split(`
-`).filter((file) => !!file.trim() && !this.#isSubspaceOwned(file));
-    const kept = await Promise.all(files.map(async (file) => this.#isStamped(file) ? await this.#differsBeyondStamp(ref, file) : true));
-    return files.filter((_, index) => kept[index]);
-  }
-  async status(branch) {
-    const hasBranch = await this.fetch(branch);
-    const [{ paths, libs }, anchor] = await Promise.all([
-      this.slice(),
-      hasBranch ? this.anchor(branch) : Promise.resolve({ commit: null, incoming: [] })
-    ]);
-    if (!hasBranch)
-      return { name: this.name, branch, hasBranch, anchor, behindPaths: [], driftedLibs: [] };
-    const ref = `${this.#remote}/${branch}`;
-    const behindPaths = await this.#changedSliceFiles(ref, ["HEAD", ref, "--", ...paths]);
-    const driftedLibs = libs.filter((lib) => behindPaths.some((file) => file.startsWith(`libs/${lib}/`)));
-    return { name: this.name, branch, hasBranch, anchor, behindPaths, driftedLibs };
-  }
-  async#ensureClone(branch) {
-    if (!await FileSys2.dirExists(path.join(this.#clonePath, ".git"))) {
-      await rm(this.#clonePath, { recursive: true, force: true });
-      await mkdir(path.dirname(this.#clonePath), { recursive: true });
-      await this.#workspace.spawn("git", ["clone", "--quiet", this.#declaration.repo, this.#clonePath]);
-    }
-    const clone = new Executor(`subspace-${this.name}`, this.#clonePath);
-    await clone.spawn("git", ["fetch", "--quiet", "origin", branch]);
-    await clone.spawn("git", ["checkout", "--quiet", "-f", "-B", branch, `origin/${branch}`]);
-    await clone.spawn("git", ["clean", "-qfd"]);
-    return clone;
+  async#writeAnchorFile(branch, sha) {
+    await FileSys2.writeJson(path.join(this.#clonePath, SubspaceClone.anchorFile), {
+      workspace: this.#workspace.repoName,
+      hubSha: sha,
+      branch,
+      apps: this.#declaration.apps,
+      syncedAt: new Date().toISOString()
+    });
   }
   async#holdSubspaceOwned() {
     const held = [];
-    const holdRoot = path.join(this.#clonePath, Subspace.holdDir);
+    const holdRoot = path.join(this.#clonePath, SubspaceClone.holdDir);
     await rm(holdRoot, { recursive: true, force: true });
-    for (const member of Subspace.memberDirs) {
+    for (const member of SubspaceClone.memberDirs) {
       const memberRoot = path.join(this.#clonePath, member);
       if (!await FileSys2.dirExists(memberRoot))
         continue;
       for (const name of await readdir(memberRoot)) {
-        for (const owned of Subspace.subspaceOwnedDirs) {
+        for (const owned of SubspaceClone.subspaceOwnedDirs) {
           const from = path.join(memberRoot, name, owned);
           if (!await FileSys2.dirExists(from))
             continue;
@@ -219,13 +161,13 @@ class Subspace {
   }
   async#restoreSubspaceOwned(held) {
     for (const { from, to } of held)
-      await Subspace.#copyMissing(to, from);
-    await rm(path.join(this.#clonePath, Subspace.holdDir), { recursive: true, force: true });
+      await SubspaceClone.#copyMissing(to, from);
+    await rm(path.join(this.#clonePath, SubspaceClone.holdDir), { recursive: true, force: true });
   }
   async#holdRootEntries() {
-    const holdRoot = path.join(this.#clonePath, Subspace.holdDir, "root");
+    const holdRoot = path.join(this.#clonePath, SubspaceClone.holdDir, "root");
     const held = [];
-    for (const entry of Subspace.subspaceOwnedRootEntries) {
+    for (const entry of SubspaceClone.subspaceOwnedRootEntries) {
       const from = path.join(this.#clonePath, entry);
       if (!await FileSys2.entryExists(from))
         continue;
@@ -238,8 +180,8 @@ class Subspace {
     return held;
   }
   async#restoreRootEntries(held) {
-    const holdRoot = path.join(this.#clonePath, Subspace.holdDir, "root");
-    for (const entry of Subspace.subspaceOwnedRootEntries) {
+    const holdRoot = path.join(this.#clonePath, SubspaceClone.holdDir, "root");
+    for (const entry of SubspaceClone.subspaceOwnedRootEntries) {
       const target = path.join(this.#clonePath, entry);
       await rm(target, { recursive: true, force: true });
       if (held.includes(entry))
@@ -248,7 +190,7 @@ class Subspace {
   }
   async#isPushedCopy(entry) {
     const subject = await this.#cloneGit(["log", "-1", "--format=%s", "--", entry]).catch(() => "");
-    return subject.trim().startsWith(Subspace.syncSubjectPrefix);
+    return subject.trim().startsWith(SubspaceClone.syncSubjectPrefix);
   }
   static async#copyMissing(from, to) {
     await mkdir(to, { recursive: true });
@@ -256,7 +198,7 @@ class Subspace {
       const source = path.join(from, entry.name);
       const target = path.join(to, entry.name);
       if (entry.isDirectory())
-        await Subspace.#copyMissing(source, target);
+        await SubspaceClone.#copyMissing(source, target);
       else if (!await FileSys2.entryExists(target))
         await rename(source, target);
     }
@@ -278,11 +220,11 @@ class Subspace {
     }
   }
   #localEnv() {
-    const { serveDomain } = WorkspaceExecutor.getBaseDevEnv();
+    const { serveDomain, defaulted = [] } = WorkspaceExecutor.getBaseDevEnv();
     return {
       AKAN_WORKSPACE_ID: "local",
-      AKAN_PUBLIC_REPO_NAME: this.name,
-      AKAN_PUBLIC_SERVE_DOMAIN: serveDomain,
+      AKAN_PUBLIC_REPO_NAME: this.#declaration.name,
+      ...defaulted.includes("AKAN_PUBLIC_SERVE_DOMAIN") ? {} : { AKAN_PUBLIC_SERVE_DOMAIN: serveDomain },
       AKAN_PUBLIC_ENV: "local",
       AKAN_PUBLIC_OPERATION_MODE: "local",
       AKAN_PUBLIC_LOG_LEVEL: "warn"
@@ -317,37 +259,16 @@ class Subspace {
       this.#workspace.logger.warn(warning);
     await FileSys2.writeJson(manifestPath, {
       ...packageJson,
-      name: this.name,
-      description: `${this.name} workspace`
+      name: this.#declaration.name,
+      description: `${this.#declaration.name} workspace`
     });
     return pruned;
   }
-  async#applySlice(clone, branch) {
-    const { libs, paths, plans } = await this.slice();
-    const held = await this.#holdSubspaceOwned();
-    const heldRootEntries = await this.#holdRootEntries();
-    for (const member of Subspace.memberDirs)
-      await rm(path.join(this.#clonePath, member), { recursive: true, force: true });
-    await this.#extract(["."], ["apps/*", "libs/*", "pkgs/*"]);
-    await this.#extract(paths);
-    await this.#restoreRootEntries(heldRootEntries);
-    await this.#restoreSubspaceOwned(held);
-    for (const entry of this.#config.exclude)
-      if (!Subspace.subspaceOwnedRootEntries.includes(entry))
-        await rm(path.join(this.#clonePath, entry), { recursive: true, force: true });
-    await this.#rewriteGitignore();
-    const pruned = await this.#rewriteManifest(plans);
-    await this.#rewriteWorkspaceSection(libs);
-    await this.#writeLocalEnv();
-    for (const lib of libs)
-      await this.#stampLib(clone, lib, branch);
-    return { libs, pruned };
-  }
   async#rewriteGitignore() {
     const gitignorePath = path.join(this.#clonePath, ".gitignore");
     if (!await FileSys2.fileExists(gitignorePath))
       return;
-    const [begin = "", end = ""] = Subspace.secretsMarkers;
+    const [begin = "", end = ""] = SubspaceClone.secretsMarkers;
     const lines = (await FileSys2.readText(gitignorePath)).split(/\r?\n/);
     const beginIdx = lines.indexOf(begin);
     const endIdx = lines.indexOf(end);
@@ -361,7 +282,7 @@ class Subspace {
   }
   async#rewriteWorkspaceSection(libs) {
     const replacements = [
-      [/^- Repo: .*$/m, `- Repo: ${this.name}`],
+      [/^- Repo: .*$/m, `- Repo: ${this.#declaration.name}`],
       [/^- Apps: .*$/m, `- Apps: ${this.#declaration.apps.join(", ")}`],
       [/^- Libraries: .*$/m, `- Libraries: ${libs.length ? libs.join(", ") : "(none)"}`]
     ];
@@ -375,13 +296,12 @@ class Subspace {
         await FileSys2.writeText(filePath, rewritten);
     }
   }
-  async#stampLib(clone, lib, branch) {
+  async#stampLib(lib, branch, sha) {
     const manifestPath = path.join(this.#clonePath, "libs", lib, "package.json");
     if (!await FileSys2.fileExists(manifestPath))
       return;
     const origin = `${this.#workspace.repoName}#${branch}`;
-    const sha = await this.headSha();
-    const [hash, previous] = await Promise.all([this.#hashLib(clone, lib), this.#committedStamp(clone, lib)]);
+    const [hash, previous] = await Promise.all([this.#hashLib(lib), this.#committedStamp(lib)]);
     const manifest = await FileSys2.readJson(manifestPath);
     const akan = manifest[LibSource.manifestKey] ?? {};
     const unchanged = previous?.origin === origin && previous.hash === hash;
@@ -389,9 +309,9 @@ class Subspace {
     manifest[LibSource.manifestKey] = { ...akan, source };
     await FileSys2.writeJson(manifestPath, manifest);
   }
-  async#committedStamp(clone, lib) {
+  async#committedStamp(lib) {
     try {
-      const committed = await clone.spawn("git", ["show", `HEAD:libs/${lib}/package.json`]);
+      const committed = await this.#clone.spawn("git", ["show", `HEAD:libs/${lib}/package.json`]);
       const manifest = JSON.parse(committed);
       const akan = manifest[LibSource.manifestKey] ?? {};
       return akan.source;
@@ -399,8 +319,8 @@ class Subspace {
       return;
     }
   }
-  async#hashLib(clone, lib) {
-    const listed = await clone.spawn("git", [
+  async#hashLib(lib) {
+    const listed = await this.#clone.spawn("git", [
       "ls-files",
       "-z",
       "--cached",
@@ -409,11 +329,165 @@ class Subspace {
       "--",
       `libs/${lib}`
     ]);
-    const candidates = listed.split("\x00").filter((file) => !!file && !this.#isSubspaceOwned(file)).sort();
+    const candidates = listed.split("\x00").filter((file) => !!file && !SubspaceClone.isSubspaceOwned(file)).sort();
     const present = await Promise.all(candidates.map(async (file) => await FileSys2.entryExists(path.join(this.#clonePath, file))));
     const files = candidates.filter((_, index) => present[index]);
     return await LibSource.hashFiles(files, `libs/${lib}/package.json`, (file) => FileSys2.readText(path.join(this.#clonePath, file)));
   }
+}
+
+// pkgs/@akanjs/devkit/subspace.ts
+class Subspace {
+  static retiredConfigFile = "akan.subspace.ts";
+  static #retiredConfigRefusal = `${Subspace.retiredConfigFile} is no longer read: move it under \`subspace\` in akan.config.ts and delete it`;
+  static #loopbackRegistry = /https?:\/\/(?:127\.0\.0\.1|localhost|0\.0\.0\.0|\[::1\])(?::\d+)?/;
+  #workspace;
+  #config;
+  #declaration;
+  constructor(workspace, config, declaration) {
+    this.#workspace = workspace;
+    this.#config = config;
+    this.#declaration = declaration;
+  }
+  get name() {
+    return this.#declaration.name;
+  }
+  get apps() {
+    return this.#declaration.apps;
+  }
+  get workspaceId() {
+    return this.#declaration.workspaceId;
+  }
+  get #remote() {
+    return `subspace-${this.#declaration.name}`;
+  }
+  async#git(args) {
+    return await this.#workspace.spawn("git", args);
+  }
+  async branch() {
+    return (await this.#git(["rev-parse", "--abbrev-ref", "HEAD"])).trim();
+  }
+  async headSha() {
+    return (await this.#git(["rev-parse", "--short", "HEAD"])).trim();
+  }
+  async fetch(branch) {
+    const remotes = (await this.#git(["remote"])).split(`
+`).map((line) => line.trim());
+    if (remotes.includes(this.#remote))
+      await this.#git(["remote", "set-url", this.#remote, this.#declaration.repo]);
+    else
+      await this.#git(["remote", "add", this.#remote, this.#declaration.repo]);
+    try {
+      await this.#git(["fetch", "--quiet", this.#remote, branch]);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async anchor(branch) {
+    const ref = `${this.#remote}/${branch}`;
+    const commit = (await this.#git(["log", "-1", "--format=%H", ref, "--", SubspaceClone.anchorFile])).trim();
+    if (!commit)
+      return { commit: null, incoming: [] };
+    const log = await this.#git(["log", "--format=%H%x09%an%x09%s", `${commit}..${ref}`]);
+    const incoming = log.split(`
+`).filter((line) => !!line.trim()).map((line) => {
+      const [sha = "", author = "", ...subject] = line.split("\t");
+      return { sha: sha.slice(0, 12), author, subject: subject.join("\t") };
+    });
+    return { commit, incoming };
+  }
+  async slice() {
+    const plans = await Promise.all(this.#declaration.apps.map(async (appName) => await new SlicePlanner(AppExecutor.from(this.#workspace, appName)).plan()));
+    const libs = [...new Set(plans.flatMap((plan) => plan.libs))].sort();
+    const paths = [...this.#declaration.apps.map((app) => `apps/${app}`), ...libs.map((lib) => `libs/${lib}`)];
+    return { plans, libs, paths };
+  }
+  async plan(branch) {
+    const workspaceRefusal = await this.#workspaceRefusal();
+    const { plans, libs } = await this.slice();
+    const rootFiles = plans[0]?.rootFiles ?? [];
+    const present = new Set(SlicePlanner.rootEntriesOf(rootFiles));
+    const owned = SubspaceClone.subspaceOwnedRootEntries;
+    const excluded = this.#config.exclude.filter((entry) => !owned.includes(entry));
+    const excludedTops = new Set(excluded.map((entry) => entry.replace(/\/+$/, "")));
+    const libFiles = new Map(plans.flatMap((plan) => Object.entries(plan.libFiles)));
+    const { pruned, warnings } = await SlicePlanner.pruneDependencies(this.#workspace, await this.#workspace.getPackageJson(), plans.flatMap((plan) => plan.requiredDependencies));
+    let branchRefusal = null;
+    try {
+      this.#config.assertPushable(branch);
+    } catch (error) {
+      branchRefusal = toError2(error).message;
+    }
+    return {
+      name: this.name,
+      repo: this.#declaration.repo,
+      branch,
+      branchRefusal,
+      workspaceRefusal,
+      apps: [...this.#declaration.apps],
+      libs: libs.map((lib) => ({
+        name: lib,
+        apps: plans.filter((plan) => plan.libs.includes(lib)).map((plan) => plan.app)
+      })),
+      files: plans.reduce((sum, plan) => sum + plan.appFiles.length, 0) + [...libFiles.values()].reduce((sum, files) => sum + files.length, 0),
+      rootEntries: [...present].filter((entry) => !excludedTops.has(entry) && !owned.includes(entry) && entry !== Subspace.retiredConfigFile).sort((a, b) => a.localeCompare(b)),
+      excludedRootEntries: excluded,
+      subspaceOwnedRootEntries: owned.filter((entry) => present.has(entry)),
+      prunedDependencies: pruned,
+      lockProblem: await this.#headLockProblem(),
+      warnings: [...new Set([...plans.flatMap((plan) => plan.warnings), ...warnings])]
+    };
+  }
+  static planBlockers(plan) {
+    return [plan.branchRefusal, plan.workspaceRefusal, plan.lockProblem].filter((reason) => !!reason);
+  }
+  async#retiredConfigLeft() {
+    return await FileSys2.fileExists(path2.join(this.#workspace.workspaceRoot, Subspace.retiredConfigFile));
+  }
+  async#workspaceRefusal() {
+    if (await this.#retiredConfigLeft())
+      return Subspace.#retiredConfigRefusal;
+    return await this.#workspace.hasChanges() ? "workspace working tree is dirty" : null;
+  }
+  #isStamped(file) {
+    return /^libs\/[^/]+\/package\.json$/.test(file);
+  }
+  async#differsBeyondStamp(ref, file) {
+    const [theirs, ours] = await Promise.all([
+      this.#git(["show", `${ref}:${file}`]).catch(() => ""),
+      this.#git(["show", `HEAD:${file}`]).catch(() => "")
+    ]);
+    if (!theirs || !ours)
+      return true;
+    const normalize = (content) => {
+      try {
+        return LibSource.unstamped(content);
+      } catch {
+        return content;
+      }
+    };
+    return normalize(theirs) !== normalize(ours);
+  }
+  async#changedSliceFiles(ref, diffArgs) {
+    const files = (await this.#git(["diff", "--name-only", ...diffArgs])).split(`
+`).filter((file) => !!file.trim() && !SubspaceClone.isSubspaceOwned(file));
+    const kept = await Promise.all(files.map(async (file) => this.#isStamped(file) ? await this.#differsBeyondStamp(ref, file) : true));
+    return files.filter((_, index) => kept[index]);
+  }
+  async status(branch) {
+    const hasBranch = await this.fetch(branch);
+    const [{ paths, libs }, anchor] = await Promise.all([
+      this.slice(),
+      hasBranch ? this.anchor(branch) : Promise.resolve({ commit: null, incoming: [] })
+    ]);
+    if (!hasBranch)
+      return { name: this.name, branch, hasBranch, anchor, behindPaths: [], driftedLibs: [] };
+    const ref = `${this.#remote}/${branch}`;
+    const behindPaths = await this.#changedSliceFiles(ref, ["HEAD", ref, "--", ...paths]);
+    const driftedLibs = libs.filter((lib) => behindPaths.some((file) => file.startsWith(`libs/${lib}/`)));
+    return { name: this.name, branch, hasBranch, anchor, behindPaths, driftedLibs };
+  }
   async diff(branch, filter) {
     if (!await this.fetch(branch))
       throw new Error(`Subspace "${this.name}" has no branch "${branch}"`);
@@ -436,34 +510,28 @@ class Subspace {
       return { files: [], patch: "" };
     return { files, patch: await this.#git(["diff", from, "HEAD", "--", ...files]) };
   }
-  async#loopbackRegistryLock(root = this.#clonePath) {
-    const lockPath = path.join(root, "bun.lock");
-    if (!await FileSys2.fileExists(lockPath))
-      return null;
-    const registry = (await FileSys2.readText(lockPath)).match(Subspace.#loopbackRegistry)?.[0];
+  static #loopbackRegistryProblem(lock) {
+    const registry = lock?.match(Subspace.#loopbackRegistry)?.[0];
     return registry ? `bun.lock resolves packages from ${registry}, a registry only this machine reaches; reinstall from a public registry and commit that lock first` : null;
   }
-  async#verify(clone) {
-    const env = { ...process.env, ...this.#localEnv() };
-    try {
-      await clone.spawn("bun", ["install"], { env });
-      for (const app of this.#declaration.apps)
-        await clone.spawn("bunx", ["akan", "sync", app], { env });
-      return null;
-    } catch (error) {
-      return error instanceof Error ? error.message : String(error);
-    }
+  async#headLockProblem() {
+    return Subspace.#loopbackRegistryProblem(await this.#git(["show", "HEAD:bun.lock"]).catch(() => null));
   }
   async push(branch, { verify = true } = {}) {
     this.#config.assertPushable(branch);
-    if (await this.#workspace.hasChanges())
-      return { name: this.name, outcome: "refused", reason: "workspace working tree is dirty", changedFiles: 0 };
+    const refusal = await this.#workspaceRefusal() ?? await this.#headLockProblem();
+    if (refusal)
+      return { name: this.name, outcome: "refused", reason: refusal, changedFiles: 0 };
     if (!await this.fetch(branch))
       return { name: this.name, outcome: "refused", reason: `subspace has no branch "${branch}"`, changedFiles: 0 };
-    const clone = await this.#ensureClone(branch);
-    const { pruned } = await this.#applySlice(clone, branch);
-    const dirty = (await clone.spawn("git", ["status", "--porcelain"])).trim();
-    if (!dirty)
+    const clone = await SubspaceClone.open(this.#workspace, this.#declaration, branch);
+    const { pruned } = await clone.applySlice(await this.slice(), {
+      branch,
+      sha: await this.headSha(),
+      remove: [Subspace.retiredConfigFile, ...this.#config.exclude]
+    });
+    const changedFiles = await clone.changedFiles();
+    if (!changedFiles)
       return {
         name: this.name,
         outcome: "skipped",
@@ -471,52 +539,38 @@ class Subspace {
         changedFiles: 0,
         prunedDependencies: pruned
       };
-    const changedFiles = dirty.split(`
-`).length;
     if (verify) {
-      const failure = await this.#verify(clone);
+      const failure = await clone.verify();
       if (failure)
         return { name: this.name, outcome: "refused", reason: failure, changedFiles };
     }
-    const lockProblem = await this.#loopbackRegistryLock();
+    const lockProblem = Subspace.#loopbackRegistryProblem(await clone.lock());
     if (lockProblem)
       return { name: this.name, outcome: "refused", reason: lockProblem, changedFiles };
-    await this.#writeAnchorFile(branch);
-    await clone.spawn("git", ["add", "-A"]);
-    const message = `${Subspace.syncSubjectPrefix}${this.#workspace.repoName}@${await this.headSha()}`;
-    await clone.spawn("git", ["commit", "--quiet", "-m", message]);
-    await clone.spawn("git", ["push", "--quiet", "origin", branch]);
     return {
       name: this.name,
       outcome: "pushed",
-      commit: (await clone.spawn("git", ["rev-parse", "--short", "HEAD"])).trim(),
+      commit: await clone.commit(branch, await this.headSha()),
       changedFiles,
       prunedDependencies: pruned
     };
   }
-  async#writeAnchorFile(branch) {
-    await FileSys2.writeJson(path.join(this.#clonePath, Subspace.anchorFile), {
-      workspace: this.#workspace.repoName,
-      hubSha: await this.headSha(),
-      branch,
-      apps: this.#declaration.apps,
-      syncedAt: new Date().toISOString()
-    });
-  }
   async pull(branch, { adoptLibs = false } = {}) {
+    if (await this.#retiredConfigLeft())
+      throw new Error(Subspace.#retiredConfigRefusal);
     if (!await this.fetch(branch))
       throw new Error(`Subspace "${this.name}" has no branch "${branch}"`);
     const anchor = await this.anchor(branch);
     if (!anchor.commit)
-      throw new Error(`Subspace "${this.name}" carries no ${Subspace.anchorFile} \u2014 it has never received a push`);
+      throw new Error(`Subspace "${this.name}" carries no ${SubspaceClone.anchorFile} \u2014 it has never received a push`);
     if (!anchor.incoming.length)
       return { name: this.name, applied: [], libPatch: null, ignored: [], incoming: [] };
     const range = `${anchor.commit}..${this.#remote}/${branch}`;
     const changed = (await this.#git(["diff", "--name-only", range])).split(`
 `).filter((file) => !!file.trim());
     const appPrefixes = this.#declaration.apps.map((app) => `apps/${app}/`);
-    const appFiles = changed.filter((file) => appPrefixes.some((prefix) => file.startsWith(prefix)) && !this.#isSubspaceOwned(file));
-    const libFiles = changed.filter((file) => file.startsWith("libs/") && !this.#isSubspaceOwned(file));
+    const appFiles = changed.filter((file) => appPrefixes.some((prefix) => file.startsWith(prefix)) && !SubspaceClone.isSubspaceOwned(file));
+    const libFiles = changed.filter((file) => file.startsWith("libs/") && !SubspaceClone.isSubspaceOwned(file));
     const ignored = changed.filter((file) => !appFiles.includes(file) && !libFiles.includes(file));
     const applied = adoptLibs ? [...appFiles, ...libFiles] : appFiles;
     if (applied.length)
@@ -530,145 +584,149 @@ class Subspace {
     await this.#git(["apply", "--3way", absolute]);
   }
   async#savePatch(range, files, label) {
-    const patchPath = path.join(this.#workspace.workspaceRoot, ".akan/subspace", `${this.name}-${label}.patch`);
-    await mkdir(path.dirname(patchPath), { recursive: true });
+    const patchPath = path2.join(this.#workspace.workspaceRoot, ".akan/subspace", `${this.name}-${label}.patch`);
+    await mkdir2(path2.dirname(patchPath), { recursive: true });
     await FileSys2.writeText(patchPath, await this.#git(["diff", range, "--", ...files]));
-    return { path: path.relative(this.#workspace.workspaceRoot, patchPath), absolute: patchPath, files };
+    return { path: path2.relative(this.#workspace.workspaceRoot, patchPath), absolute: patchPath, files };
   }
 }
-function formatSubspaceStatuses(statuses) {
-  const sections = [
-    "Akan Subspace Status",
-    `branch: ${statuses[0]?.branch ?? "(none)"}`,
-    "",
-    ...statuses.flatMap((status) => {
-      if (!status.hasBranch)
-        return [`  ${status.name}: no such branch in the subspace \u2014 push is refused`];
-      const behind = status.behindPaths.length ? `${status.behindPaths.length} file(s) behind` : "up to date";
-      const incoming = status.anchor.incoming.length ? `${status.anchor.incoming.length} customer commit(s) to pull` : "no customer commits";
-      const drift = status.driftedLibs.length ? `  DRIFTED LIBS: ${status.driftedLibs.join(", ")}` : null;
-      return [
-        `  ${status.name}: ${behind}, ${incoming}`,
-        ...status.anchor.incoming.map((commit) => `    ${commit.sha}  ${commit.author}  ${commit.subject}`),
-        ...drift ? [drift] : []
-      ];
-    })
-  ];
-  return sections.join(`
+
+// pkgs/@akanjs/devkit/subspaceReport.ts
+class SubspaceReport {
+  static statuses(statuses) {
+    const sections = [
+      "Akan Subspace Status",
+      `branch: ${statuses[0]?.branch ?? "(none)"}`,
+      "",
+      ...statuses.flatMap((status) => {
+        if (!status.hasBranch)
+          return [`  ${status.name}: no such branch in the subspace \u2014 push is refused`];
+        const behind = status.behindPaths.length ? `${status.behindPaths.length} file(s) behind` : "up to date";
+        const incoming = status.anchor.incoming.length ? `${status.anchor.incoming.length} customer commit(s) to pull` : "no customer commits";
+        const drift = status.driftedLibs.length ? `  DRIFTED LIBS: ${status.driftedLibs.join(", ")}` : null;
+        return [
+          `  ${status.name}: ${behind}, ${incoming}`,
+          ...status.anchor.incoming.map((commit) => `    ${commit.sha}  ${commit.author}  ${commit.subject}`),
+          ...drift ? [drift] : []
+        ];
+      })
+    ];
+    return sections.join(`
 `);
-}
-function formatSubspacePushResults(results) {
-  const sections = [
-    "Akan Subspace Push",
-    "",
-    ...results.flatMap((result) => {
-      const detail = result.outcome === "pushed" ? `${result.commit} (${result.changedFiles} files)` : result.reason ?? "";
-      const [first = "", ...rest] = detail.split(`
+  }
+  static pushResults(results) {
+    const sections = [
+      "Akan Subspace Push",
+      "",
+      ...results.flatMap((result) => {
+        const detail = result.outcome === "pushed" ? `${result.commit} (${result.changedFiles} files)` : result.reason ?? "";
+        const [first = "", ...rest] = detail.split(`
 `);
-      const pruned = result.prunedDependencies?.length ? [`    ${result.prunedDependencies.length} unused root dependenc(ies) left out of package.json`] : [];
-      return [
-        `  ${result.outcome.padEnd(8)} ${result.name}  ${first}`,
-        ...rest.map((line) => `    ${line}`),
-        ...pruned
-      ];
-    })
-  ];
-  return sections.join(`
+        const pruned = result.prunedDependencies?.length ? [`    ${result.prunedDependencies.length} unused root dependenc(ies) left out of package.json`] : [];
+        return [
+          `  ${result.outcome.padEnd(8)} ${result.name}  ${first}`,
+          ...rest.map((line) => `    ${line}`),
+          ...pruned
+        ];
+      })
+    ];
+    return sections.join(`
 `);
-}
-function formatSubspacePullResult(result) {
-  const sections = [
-    `Akan Subspace Pull \u2014 ${result.name}`,
-    "",
-    `Customer commits since the last push (${result.incoming.length}):`,
-    "",
-    ...result.incoming.length ? result.incoming.map((commit) => `  ${commit.sha}  ${commit.author}  ${commit.subject}`) : ["  (none \u2014 nothing to pull)"],
-    "",
-    `Applied to the working tree, uncommitted (${result.applied.length}):`,
-    "",
-    ...result.applied.length ? result.applied.map((file) => `  ${file}`) : ["  (none)"],
-    ...result.libPatch ? [
+  }
+  static pullResult(result) {
+    const sections = [
+      `Akan Subspace Pull \u2014 ${result.name}`,
+      "",
+      `Customer commits since the last push (${result.incoming.length}):`,
       "",
-      `Library edits NOT applied (${result.libPatch.files.length}) \u2014 review before adopting:`,
+      ...result.incoming.length ? result.incoming.map((commit) => `  ${commit.sha}  ${commit.author}  ${commit.subject}`) : ["  (none \u2014 nothing to pull)"],
       "",
-      ...result.libPatch.files.map((file) => `  ${file}`),
+      `Applied to the working tree, uncommitted (${result.applied.length}):`,
       "",
-      `  patch: ${result.libPatch.path}`,
-      "  adopt with: akan subspace pull <name> --adopt-libs"
-    ] : [],
-    ...result.ignored.length ? ["", `Ignored (workspace-owned or subspace-owned): ${result.ignored.length} file(s)`] : []
-  ];
-  return sections.join(`
+      ...result.applied.length ? result.applied.map((file) => `  ${file}`) : ["  (none)"],
+      ...result.libPatch ? [
+        "",
+        `Library edits NOT applied (${result.libPatch.files.length}) \u2014 review before adopting:`,
+        "",
+        ...result.libPatch.files.map((file) => `  ${file}`),
+        "",
+        `  patch: ${result.libPatch.path}`,
+        "  adopt with: akan subspace pull <name> --adopt-libs"
+      ] : [],
+      ...result.ignored.length ? ["", `Ignored (workspace-owned or subspace-owned): ${result.ignored.length} file(s)`] : []
+    ];
+    return sections.join(`
 `);
-}
-function formatSubspaceEnvUpload(result) {
-  const sections = [
-    `Akan Subspace Env Upload \u2014 ${result.name}`,
-    `cloud workspace: ${result.workspaceId} \xB7 host: ${result.host}`,
-    "",
-    ...result.outcome === "cancelled" ? ["  cancelled \u2014 the subspace's env archive is untouched."] : [
-      `Uploaded (${result.files.length}), replacing that workspace's whole archive:`,
+  }
+  static envUpload(result) {
+    const sections = [
+      `Akan Subspace Env Upload \u2014 ${result.name}`,
+      `cloud workspace: ${result.workspaceId} \xB7 host: ${result.host}`,
       "",
-      ...result.files.map((file) => `  ${file}`),
+      ...result.outcome === "cancelled" ? ["  cancelled \u2014 the subspace's env archive is untouched."] : [
+        `Uploaded (${result.files.length}), replacing that workspace's whole archive:`,
+        "",
+        ...result.files.map((file) => `  ${file}`),
+        "",
+        `  apps: ${result.apps.join(", ")}`,
+        `  libs: ${result.libs.join(", ") || "(none)"}`
+      ]
+    ];
+    return sections.join(`
+`);
+  }
+  static diff(result) {
+    const total = result.app.files.length + result.libs.files.length;
+    const sections = [
+      `Akan Subspace Diff \u2014 ${result.name} (${result.branch})`,
+      "what `akan subspace push` would change in the subspace",
       "",
-      `  apps: ${result.apps.join(", ")}`,
-      `  libs: ${result.libs.join(", ") || "(none)"}`
-    ]
-  ];
-  return sections.join(`
+      ...total ? [] : ["  subspace is identical to the workspace for this slice."],
+      ...result.libs.files.length ? [
+        `LIBRARY changes (${result.libs.files.length}) \u2014 the subspace edited shared code:`,
+        "",
+        ...result.libs.files.map((file) => `  ${file}`),
+        "",
+        result.libs.patch
+      ] : [],
+      ...result.app.files.length ? [
+        `App changes (${result.app.files.length}):`,
+        "",
+        ...result.app.files.map((file) => `  ${file}`),
+        "",
+        result.app.patch
+      ] : []
+    ];
+    return sections.join(`
 `);
-}
-function formatSubspaceDiff(result) {
-  const total = result.app.files.length + result.libs.files.length;
-  const sections = [
-    `Akan Subspace Diff \u2014 ${result.name} (${result.branch})`,
-    "what `akan subspace push` would change in the subspace",
-    "",
-    ...total ? [] : ["  subspace is identical to the workspace for this slice."],
-    ...result.libs.files.length ? [
-      `LIBRARY changes (${result.libs.files.length}) \u2014 the subspace edited shared code:`,
+  }
+  static plan(plan) {
+    const list = (entries) => entries.length ? entries.join(", ") : "(none)";
+    const blockers = Subspace.planBlockers(plan);
+    const sections = [
+      `Akan Subspace Plan \u2014 ${plan.name} (${plan.branch})`,
+      `repo: ${plan.repo}`,
+      "what `akan subspace push` would ship, worked out from this checkout alone",
       "",
-      ...result.libs.files.map((file) => `  ${file}`),
+      `apps: ${list(plan.apps)}`,
+      `libs: ${plan.libs.length ? "" : "(none)"}`.trimEnd(),
+      ...plan.libs.map((lib) => `  - ${lib.name} (from ${lib.apps.join(", ")})`),
+      `files under apps/ and libs/: ${plan.files}`,
       "",
-      result.libs.patch
-    ] : [],
-    ...result.app.files.length ? [
-      `App changes (${result.app.files.length}):`,
+      `root entries pushed: ${list(plan.rootEntries)}`,
+      `root entries excluded: ${list(plan.excludedRootEntries)}`,
+      `root entries the subspace keeps its own: ${list(plan.subspaceOwnedRootEntries)}`,
       "",
-      ...result.app.files.map((file) => `  ${file}`),
+      `Root dependencies left out of package.json (${plan.prunedDependencies.length}):`,
+      ...plan.prunedDependencies.length ? plan.prunedDependencies.map((dep) => `  - ${dep}`) : ["  (none)"],
       "",
-      result.app.patch
-    ] : []
-  ];
-  return sections.join(`
-`);
-}
-function formatSubspacePlan(plan) {
-  const list = (entries) => entries.length ? entries.join(", ") : "(none)";
-  const blockers = [plan.branchRefusal, plan.lockProblem].filter((reason) => !!reason);
-  const sections = [
-    `Akan Subspace Plan \u2014 ${plan.name} (${plan.branch})`,
-    `repo: ${plan.repo}`,
-    "what `akan subspace push` would ship, worked out from this checkout alone",
-    "",
-    `apps: ${list(plan.apps)}`,
-    `libs: ${plan.libs.length ? "" : "(none)"}`.trimEnd(),
-    ...plan.libs.map((lib) => `  - ${lib.name} (from ${lib.apps.join(", ")})`),
-    `files under apps/ and libs/: ${plan.files}`,
-    "",
-    `root entries pushed: ${list(plan.rootEntries)}`,
-    `root entries excluded: ${list(plan.excludedRootEntries)}`,
-    `root entries the subspace keeps its own: ${list(plan.subspaceOwnedRootEntries)}`,
-    "",
-    `Root dependencies left out of package.json (${plan.prunedDependencies.length}):`,
-    ...plan.prunedDependencies.length ? plan.prunedDependencies.map((dep) => `  - ${dep}`) : ["  (none)"],
-    "",
-    blockers.length ? "A push would be refused:" : "Nothing here would make a push refuse.",
-    ...blockers.map((reason) => `  - ${reason}`),
-    ...plan.warnings.length ? ["", `Warnings (${plan.warnings.length}):`, ...plan.warnings.map((w) => `  - ${w}`)] : []
-  ];
-  return sections.join(`
+      blockers.length ? "A push would be refused:" : "Nothing here would make a push refuse.",
+      ...blockers.map((reason) => `  - ${reason}`),
+      ...plan.warnings.length ? ["", `Warnings (${plan.warnings.length}):`, ...plan.warnings.map((w) => `  - ${w}`)] : []
+    ];
+    return sections.join(`
 `);
+  }
 }
 
 // pkgs/@akanjs/cli/subspace/subspace.script.ts
@@ -767,7 +825,7 @@ class SubspaceRunner extends runner("subspace") {
     if (!asked)
       return { name: subspace.name, workspaceId, host, apps, libs: [], outcome: "cancelled", files: [] };
     const { libs } = await subspace.slice();
-    const { CloudScript } = await import("./cloud.script-h6pvcpa2.js");
+    const { CloudScript } = await import("./cloud.script-dgstqt1m.js");
     const { files } = await CommandContainer.get(CloudScript).uploadEnv(workspace, {
       host,
       workspaceId,
@@ -800,14 +858,14 @@ class SubspaceScript extends script("subspace", [SubspaceRunner]) {
     const statuses = await this.subspaceRunner.status(workspace, names);
     const drifted = statuses.filter((status) => status.driftedLibs.length).length;
     spinner.succeed(`Checked ${statuses.length} subspace(s) (${drifted} with library drift)`);
-    Logger.rawLog(format === "json" ? JSON.stringify(statuses, null, 2) : formatSubspaceStatuses(statuses));
+    Logger.rawLog(format === "json" ? JSON.stringify(statuses, null, 2) : SubspaceReport.statuses(statuses));
   }
   async push(workspace, names, { verify, format }) {
     const spinner = workspace.spinning("Pushing to subspaces...");
     const results = await this.subspaceRunner.push(workspace, names, { verify });
     const pushed = results.filter((result) => result.outcome === "pushed").length;
     spinner.succeed(`Pushed ${pushed} of ${results.length} subspace(s)`);
-    Logger.rawLog(format === "json" ? JSON.stringify(results, null, 2) : formatSubspacePushResults(results));
+    Logger.rawLog(format === "json" ? JSON.stringify(results, null, 2) : SubspaceReport.pushResults(results));
     if (results.some((result) => result.outcome === "refused"))
       process.exitCode = 1;
   }
@@ -815,27 +873,29 @@ class SubspaceScript extends script("subspace", [SubspaceRunner]) {
     const spinner = workspace.spinning(`Planning ${name}...`);
     const plan = await this.subspaceRunner.plan(workspace, name);
     spinner.succeed(`${plan.apps.length} app(s), ${plan.libs.length} librar(ies), ${plan.files} file(s)`);
-    Logger.rawLog(format === "json" ? JSON.stringify(plan, null, 2) : formatSubspacePlan(plan));
+    Logger.rawLog(format === "json" ? JSON.stringify(plan, null, 2) : SubspaceReport.plan(plan));
+    if (Subspace.planBlockers(plan).length)
+      process.exitCode = 1;
   }
   async diff(workspace, name, filter, format = "text") {
     const spinner = workspace.spinning(`Diffing ${name}...`);
     const result = await this.subspaceRunner.diff(workspace, name, filter);
     const total = result.app.files.length + result.libs.files.length;
     spinner.succeed(`${total} file(s) differ (${result.libs.files.length} in shared libraries)`);
-    Logger.rawLog(format === "json" ? JSON.stringify(result, null, 2) : formatSubspaceDiff(result));
+    Logger.rawLog(format === "json" ? JSON.stringify(result, null, 2) : SubspaceReport.diff(result));
   }
   async uploadEnv(workspace, name, { host, force, format }) {
     const result = await this.subspaceRunner.uploadEnv(workspace, name, {
       host: await GlobalConfig.hostFor(workspace, host),
       force
     });
-    Logger.rawLog(format === "json" ? JSON.stringify(result, null, 2) : formatSubspaceEnvUpload(result));
+    Logger.rawLog(format === "json" ? JSON.stringify(result, null, 2) : SubspaceReport.envUpload(result));
   }
   async pull(workspace, name, { adoptLibs, format }) {
     const spinner = workspace.spinning(`Pulling customer commits from ${name}...`);
     const result = await this.subspaceRunner.pull(workspace, name, { adoptLibs });
     spinner.succeed(`${result.incoming.length} customer commit(s), ${result.applied.length} file(s) applied`);
-    Logger.rawLog(format === "json" ? JSON.stringify(result, null, 2) : formatSubspacePullResult(result));
+    Logger.rawLog(format === "json" ? JSON.stringify(result, null, 2) : SubspaceReport.pullResult(result));
   }
 }