@akanjs/cli 3.1.0-rc.2 → 3.1.0-rc.21

package/{index-2etqq75t.js → index-g6ax17x4.js}

@@ -4,101 +4,284 @@ import {
   FileSys2
 } from "./index-52w0fvh8.js";
 
-// pkgs/@akanjs/devkit/typecheck/projectTypecheck.ts
-import { mkdir, rm } from "fs/promises";
-import path from "path";
+// pkgs/@akanjs/devkit/executors.ts
+import {
+  exec,
+  fork,
+  spawn as spawn2
+} from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import {
+  copyFile,
+  cp as cpEntry,
+  lstat,
+  mkdir as mkdir3,
+  readdir as readDirEntries,
+  realpath,
+  rm as rm4,
+  stat as stat2,
+  symlink
+} from "fs/promises";
+import path13 from "path";
+import { pathToFileURL } from "url";
+import {
+  capitalize,
+  getPageSourceFileViolation,
+  isRouteSourceFile,
+  Logger as Logger3,
+  parseRouteModuleKey,
+  toError as toError2,
+  validatePageSourceFile,
+  validateSubRoutePageKey
+} from "akanjs/common";
+var {$ } = globalThis.Bun;
+import chalk2 from "chalk";
 
-class ProjectTypecheck2 {
-  projectDir;
-  workspaceRoot;
-  env;
-  static #testIncludes = ["**/*.test.ts", "**/*.test.tsx", "**/*.spec.ts", "**/*.spec.tsx"];
-  static #excludes = [".akan/**", "node_modules/**", "local/**"];
-  constructor(projectDir, workspaceRoot, env) {
-    this.projectDir = projectDir;
-    this.workspaceRoot = workspaceRoot;
-    this.env = env;
+// pkgs/@akanjs/devkit/agentsIndex.ts
+var recipeScannerLoad = null;
+var loadRecipeScanner = () => recipeScannerLoad ??= import("./recipeScanner-4b69ybe0.js");
+var AGENT_BLOCK_START = "<!-- akan:agent:start -->";
+var AGENT_BLOCK_END = "<!-- akan:agent:end -->";
+var AGENT_VERSION_PREFIX = "<!-- akan:agent:version ";
+var stampBlockVersion = (block, version) => `${AGENT_VERSION_PREFIX}${version} -->
+
+${block}`;
+var extractBlockVersion = (content) => content.match(/<!-- akan:agent:version ([^\s]+) -->/)?.[1] ?? null;
+var readDevkitVersion = async () => {
+  const { readFile } = await import("fs/promises");
+  const { getDirname } = await import("./fileSys-wzzrntkw.js");
+  try {
+    const raw = await readFile(`${getDirname(import.meta.url)}/package.json`, "utf-8");
+    return JSON.parse(raw).version ?? null;
+  } catch {
+    return null;
   }
-  get typecheckDir() {
-    return path.join(this.projectDir, ".akan", "typecheck");
+};
+var upsertAgentBlock = (existing, block) => {
+  const managed = `${AGENT_BLOCK_START}
+${block}
+${AGENT_BLOCK_END}`;
+  const startIndex = existing.indexOf(AGENT_BLOCK_START);
+  const endIndex = existing.indexOf(AGENT_BLOCK_END);
+  if (startIndex >= 0 && endIndex > startIndex) {
+    return `${existing.slice(0, startIndex)}${managed}${existing.slice(endIndex + AGENT_BLOCK_END.length)}`;
   }
-  async run(entries, { clean = false, incremental = true, tests = false } = {}) {
-    const name = tests ? "tsconfig.tests" : "tsconfig";
-    await mkdir(this.typecheckDir, { recursive: true });
-    const tsconfig = {
-      extends: "../../tsconfig.json",
-      compilerOptions: { noEmit: true, incremental, tsBuildInfoFile: `./${name}.tsbuildinfo` },
-      include: [...entries, ...tests ? ProjectTypecheck2.#testIncludes.map((glob) => `../../${glob}`) : []],
-      ...tests ? { exclude: ProjectTypecheck2.#excludes.map((glob) => `../../${glob}`) } : {},
-      references: []
-    };
-    const tsconfigPath = path.join(this.typecheckDir, `${name}.json`);
-    await Bun.write(tsconfigPath, `${JSON.stringify(tsconfig, null, 2)}
+  return `${existing.replace(/\s*$/, "")}
+
+${managed}
+`;
+};
+var extractAgentBlock = (content) => {
+  const startIndex = content.indexOf(AGENT_BLOCK_START);
+  const endIndex = content.indexOf(AGENT_BLOCK_END);
+  if (startIndex < 0 || endIndex <= startIndex)
+    return null;
+  return content.slice(startIndex + AGENT_BLOCK_START.length, endIndex).trim();
+};
+var signatureOf = (recipe) => {
+  const entries = Object.entries(recipe.variants);
+  if (entries.length === 0)
+    return "";
+  const parts = entries.map(([key, values]) => {
+    if (values.length === 1 && values[0] === "true")
+      return `${key}?`;
+    const def = recipe.defaultVariants?.[key];
+    return `${key}: ${values.map((value) => value === def ? `${value}*` : value).join("|")}`;
+  });
+  return `(${parts.join(" \xB7 ")})`;
+};
+var renderRecipeEntries = (recipes) => {
+  const groups = new Map;
+  for (const recipe of recipes)
+    groups.set(recipe.importFrom, [...groups.get(recipe.importFrom) ?? [], recipe]);
+  return [...groups.entries()].map(([importFrom, list]) => {
+    const items = list.sort((a, b) => a.name.localeCompare(b.name)).map((recipe) => `- \`${recipe.name}\`${signatureOf(recipe)}${recipe.doc ? ` \u2014 ${recipe.doc}` : ""}`).join(`
 `);
-    if (clean)
-      await rm(path.join(this.typecheckDir, `${name}.tsbuildinfo`), { force: true });
-    await this.#check(tsconfigPath);
-    return tsconfigPath;
-  }
-  async#check(tsconfigPath) {
-    const proc = Bun.spawn([process.execPath, await ProjectTypecheck2.workerEntry(this.workspaceRoot)], {
-      cwd: this.workspaceRoot,
-      env: { ...this.env, AKAN_COMMAND_TYPE: "typecheck", AKAN_TYPECHECK_TSCONFIG: tsconfigPath },
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const [stdout, stderr, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited
-    ]);
-    if (exitCode !== 0)
-      throw new Error((stderr || stdout).trim() || `Typecheck failed with exit code ${exitCode}`);
-  }
-  static async workerEntry(workspaceRoot) {
-    const candidates = [
-      path.join(workspaceRoot, "pkgs/@akanjs/devkit/typecheck/typecheck.proc.ts"),
-      path.join(workspaceRoot, "node_modules/@akanjs/devkit/typecheck/typecheck.proc.ts"),
-      path.join(import.meta.dir, "typecheck.proc.js"),
-      path.join(import.meta.dir, "typecheck.proc.ts"),
-      path.join(import.meta.dir, "..", "typecheck.proc.js")
-    ];
-    for (const candidate of candidates)
-      if (await Bun.file(candidate).exists())
-        return candidate;
-    throw new Error(`[devkit] typecheck worker entry not found; looked in: ${candidates.join(", ")}`);
+    return `Import from \`${importFrom}\`:
+${items}`;
+  }).join(`
+
+`);
+};
+var collectScopeRecipeSources = async (workspaceRoot, scope, libDeps) => {
+  const { collectRecipeSources } = await loadRecipeScanner();
+  const sources = [
+    ...await collectRecipeSources(`${workspaceRoot}/${scope.type}s/${scope.name}/ui`, `@${scope.type}s/${scope.name}/ui`)
+  ];
+  for (const lib of [...new Set(libDeps)].sort()) {
+    if (scope.type === "lib" && lib === scope.name)
+      continue;
+    sources.push(...await collectRecipeSources(`${workspaceRoot}/libs/${lib}/ui`, `@libs/${lib}/ui`));
   }
-}
+  return sources;
+};
+var scanScopeRecipes = async (workspaceRoot, scope, libDeps) => {
+  const { scanRecipes } = await loadRecipeScanner();
+  return scanRecipes(await collectScopeRecipeSources(workspaceRoot, scope, libDeps));
+};
+var renderScopeAgentBlock = (scope, recipes) => {
+  const scopePath = `${scope.type}s/${scope.name}`;
+  const intro = `## Recipes In Scope
 
-// pkgs/@akanjs/devkit/transforms/serverEnvProfile.ts
-import { existsSync, realpathSync } from "fs";
-import path2 from "path";
-import { Logger, toError } from "akanjs/common";
+UI recipes importable from \`${scopePath}\` code, **in addition to** the framework recipes indexed in the root
+\`AGENTS.md\` \`## Recipes\`. Same contract: import by exact name, then \`<name>(variants?, className?)\` \u2014 the second
+arg merges internally and takes an array too, so never wrap it in \`cn()\`. \`*\` marks the default, \`key?\` is a
+boolean flag. Do not guess recipe names or import paths; this index is regenerated by \`akan sync ${scope.name}\`
+and verified by \`akan lint ${scope.name}\`.`;
+  if (recipes.length === 0) {
+    return `${intro}
 
-class ServerEnvProfile {
-  static namePattern = /^[a-z][a-zA-Z0-9-]*$/;
-  static envFilePattern = /[\\/]env[\\/]env\.server\.[A-Za-z0-9-]+\.ts$/;
-  static fileName(environment, profile) {
-    return `env.server.${environment}.${profile}.ts`;
-  }
-  static profileFileOf(file, profile) {
-    return file.replace(/\.ts$/, `.${profile}.ts`);
+No scope recipes yet. Before inlining a repeated surface (card, box, tile, \u2026), reuse a framework recipe from the
+root \`AGENTS.md\` or author one as \`${scopePath}/ui/Recipe/<name>.ts\` (one recipe per file, re-exported from that
+folder's \`index.ts\`) \u2014 see the \`recipeRule\` guideline.`;
   }
-  static #url(value) {
-    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(value))
-      return null;
-    try {
-      return new URL(value);
-    } catch {
-      return null;
-    }
+  return `${intro}
+
+${renderRecipeEntries(recipes)}`;
+};
+var renderScopeAgentsMd = (scope, block) => `# ${scope.name} \u2014 Agent Guide
+
+Scoped guide for coding agents working in \`${scope.type}s/${scope.name}\`. Workspace-wide conventions live in the
+root \`AGENTS.md\`; this file carries what is importable from this ${scope.type === "app" ? "app" : "library"}. The
+section between the \`akan:agent\` markers is regenerated by \`akan sync ${scope.name}\`; edit anything outside the
+markers freely.
+
+${AGENT_BLOCK_START}
+${block}
+${AGENT_BLOCK_END}
+`;
+var CLAUDE_COMMENT_RULE = `## Comments \u2014 Overrides Your Default
+
+Write **no comments** unless the comment passes the test below. This is the rule agents break most often here, so it
+is repeated outside the guide: a diff that adds a comment the test rejects is a diff to redo.
+
+Before typing \`//\`, \`/*\`, or a doc block, ask \u2014 **does this sentence carry a fact that is nowhere in the code?**
+
+- Restates the identifier, the signature, or the line under it \u2192 delete it.
+- Labels a section (\`// helpers\`, \`// state\`) or narrates a step (\`// fetch the user\`, \`// then save\`) \u2192 delete it.
+- JSDoc on an ordinary function, or a why/how preamble on ordinary logic \u2192 delete it.
+- Explains the edit you just made, for whoever reads the diff \u2192 say it in your reply, not in the file.
+- Names a vendor or protocol quirk, an infrastructure constraint, a library gotcha, security reasoning, a math
+  derivation, a domain field's business meaning, a state transition, or why an obvious alternative was rejected \u2192
+  keep it, one line.
+
+That keep-list is exact \u2014 \`Comments\` in the guide is the full version. "It aids readability" and "this logic is
+subtle" are not on it: rename or split the code instead. When you edit an existing file, match its density; if the
+surrounding code carries none, your diff carries none.`;
+var renderScopeClaudeMd = (scope) => `# ${scope.name} \u2014 Claude Code Guide
+
+@AGENTS.md
+
+${CLAUDE_COMMENT_RULE}
+`;
+
+// pkgs/@akanjs/devkit/akanConfig/akanBin.ts
+import path from "path";
+
+// pkgs/@akanjs/devkit/akanConfig/types.ts
+import { archs, binPlatforms, defaultAppPipeline } from "akanjs";
+
+// pkgs/@akanjs/devkit/akanConfig/akanBin.ts
+class AkanBin {
+  static archive = /\.(zip|tar\.gz|tgz|tar\.xz|txz|tar\.bz2|tbz2|tar)$/i;
+  static fileName = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+  static parse(declared, owner, baseDir) {
+    if (declared === undefined)
+      return {};
+    if (!declared || typeof declared !== "object" || Array.isArray(declared))
+      throw new Error(`${owner}: bin maps each executable's name to its platforms`);
+    return Object.fromEntries(Object.entries(declared).map(([name, platforms]) => [name, AkanBin.#platforms(name, platforms, owner, baseDir)]));
   }
-  static #carriesCredential(url) {
-    return !!url.password || [...url.searchParams.keys()].some((name) => Logger.isSecretKey(name));
+  static isArchive(source) {
+    return AkanBin.archive.test("url" in source ? new URL(source.url).pathname : source.path);
   }
-  static #isCredentialUrl(value) {
-    const url = ServerEnvProfile.#url(value);
-    return !!url && ServerEnvProfile.#carriesCredential(url);
+  static #platforms(name, platforms, owner, baseDir) {
+    if (!AkanBin.fileName.test(name))
+      throw new Error(`${owner}: bin.${name} is not a file name`);
+    if (!platforms || typeof platforms !== "object" || Array.isArray(platforms))
+      throw new Error(`${owner}: bin.${name} maps platforms (${binPlatforms.join(", ")}) to where the file comes from`);
+    const resolved = {};
+    for (const [platform, source] of Object.entries(platforms)) {
+      if (!binPlatforms.includes(platform))
+        throw new Error(`${owner}: bin.${name}.${platform} is not one of ${binPlatforms.join(", ")}`);
+      resolved[platform] = AkanBin.#source(`${owner}: bin.${name}.${platform}`, source, baseDir);
+    }
+    return resolved;
+  }
+  static #source(at, source, baseDir) {
+    if (!source || typeof source !== "object" || Array.isArray(source))
+      throw new Error(`${at} must be { url, sha256 } or { path }`);
+    const { url, sha256, path: localPath, file, ...rest } = source;
+    const extra = Object.keys(rest);
+    if (extra.length)
+      throw new Error(`${at}: unknown key ${extra.join(", ")}`);
+    if (url === undefined === (localPath === undefined))
+      throw new Error(`${at} takes either url and sha256, or path`);
+    const resolved = url !== undefined ? AkanBin.#urlSource(at, url, sha256) : AkanBin.#pathSource(at, localPath, sha256, baseDir);
+    const archive = AkanBin.isArchive(resolved);
+    if (file === undefined) {
+      if (archive)
+        throw new Error(`${at} names an archive: file picks the executable inside it`);
+      return resolved;
+    }
+    if (!archive)
+      throw new Error(`${at}: file picks the executable out of an archive, and this source is none`);
+    const parts = typeof file === "string" ? file.split(/[\\/]/).filter((part) => part && part !== ".") : [];
+    if (!parts.length || path.isAbsolute(file) || parts.includes(".."))
+      throw new Error(`${at}: file must be a path inside the archive (got ${JSON.stringify(file)})`);
+    return { ...resolved, file: parts.join("/") };
+  }
+  static #urlSource(at, url, sha256) {
+    if (typeof url !== "string" || !URL.canParse(url) || !/^https?:$/.test(new URL(url).protocol))
+      throw new Error(`${at}: url must be an http(s) address`);
+    if (typeof sha256 !== "string" || !/^[0-9a-f]{64}$/i.test(sha256))
+      throw new Error(`${at}: sha256 must be the downloaded file's 64-digit hex digest`);
+    return { url, sha256: sha256.toLowerCase() };
+  }
+  static #pathSource(at, localPath, sha256, baseDir) {
+    if (typeof localPath !== "string" || !localPath)
+      throw new Error(`${at}: path must name a file`);
+    if (sha256 !== undefined)
+      throw new Error(`${at}: sha256 checks a download, and a path source downloads nothing`);
+    return { path: path.resolve(baseDir, localPath) };
+  }
+}
+// pkgs/@akanjs/devkit/akanConfig/akanConfig.ts
+import fs from "fs";
+import path3 from "path";
+import { fileURLToPath } from "url";
+import { DatabaseModes, normalizeRoutePrefix } from "akanjs/base";
+import { resolveAkanI18nConfig, trimSlashes } from "akanjs/common";
+
+// pkgs/@akanjs/devkit/transforms/serverEnvProfile.ts
+import { existsSync, realpathSync } from "fs";
+import path2 from "path";
+import { Logger, toError } from "akanjs/common";
+
+class ServerEnvProfile {
+  static namePattern = /^[a-z][a-zA-Z0-9-]*$/;
+  static envFilePattern = /[\\/]env[\\/]env\.server\.[A-Za-z0-9-]+\.ts$/;
+  static fileName(environment, profile) {
+    return `env.server.${environment}.${profile}.ts`;
+  }
+  static profileFileOf(file, profile) {
+    return file.replace(/\.ts$/, `.${profile}.ts`);
+  }
+  static #url(value) {
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(value))
+      return null;
+    try {
+      return new URL(value);
+    } catch {
+      return null;
+    }
+  }
+  static #carriesCredential(url) {
+    return !!url.password || [...url.searchParams.keys()].some((name) => Logger.isSecretKey(name));
+  }
+  static #isCredentialUrl(value) {
+    const url = ServerEnvProfile.#url(value);
+    return !!url && ServerEnvProfile.#carriesCredential(url);
   }
   static #isSecret(value, underSecret) {
     return underSecret && !!value.trim() || ServerEnvProfile.#isCredentialUrl(value);
@@ -327,838 +510,92 @@ class ServerEnvProfile {
   }
 }
 
-// pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
-import { readdir, rm as rm2 } from "fs/promises";
-import path4 from "path";
-
-// pkgs/@akanjs/devkit/transforms/asyncDefaultExportDetector.ts
-import fs from "fs";
-import path3 from "path";
-
-class AsyncDefaultExportDetector {
-  static #typescriptLoad;
-  static #loadTypescript() {
-    AsyncDefaultExportDetector.#typescriptLoad ??= import("typescript").then((mod) => mod.default ?? mod);
-    return AsyncDefaultExportDetector.#typescriptLoad;
-  }
-  static async detect(moduleAbsPath) {
-    try {
-      const typescript = await AsyncDefaultExportDetector.#loadTypescript();
-      const source = fs.readFileSync(path3.resolve(moduleAbsPath), "utf8");
-      const sourceFile = typescript.createSourceFile(moduleAbsPath, source, typescript.ScriptTarget.Latest, true, /\.[tj]sx$/.test(moduleAbsPath) ? typescript.ScriptKind.TSX : typescript.ScriptKind.TS);
-      return new AsyncDefaultExportDetector(typescript).detectInSourceFile(sourceFile);
-    } catch {
-      return false;
-    }
-  }
-  #ts;
-  constructor(typescript) {
-    this.#ts = typescript;
-  }
-  detectInSourceFile(sourceFile) {
-    const ts = this.#ts;
-    const asyncBindings = new Map;
-    let defaultIdentifier = null;
-    for (const statement of sourceFile.statements) {
-      if (ts.isFunctionDeclaration(statement)) {
-        if (this.#hasModifier(statement, ts.SyntaxKind.DefaultKeyword)) {
-          return this.#hasModifier(statement, ts.SyntaxKind.AsyncKeyword);
-        }
-        if (statement.name) {
-          asyncBindings.set(statement.name.text, this.#hasModifier(statement, ts.SyntaxKind.AsyncKeyword));
-        }
-        continue;
-      }
-      if (ts.isVariableStatement(statement)) {
-        for (const declaration of statement.declarationList.declarations) {
-          if (!ts.isIdentifier(declaration.name))
-            continue;
-          asyncBindings.set(declaration.name.text, this.#isAsyncFunctionExpression(declaration.initializer));
-        }
-        continue;
-      }
-      if (ts.isExportAssignment(statement)) {
-        if (this.#isAsyncFunctionExpression(statement.expression))
-          return true;
-        if (ts.isCallExpression(statement.expression))
-          return true;
-        if (ts.isIdentifier(statement.expression))
-          defaultIdentifier = statement.expression.text;
-        continue;
-      }
-      if (ts.isExportDeclaration(statement) && statement.exportClause && ts.isNamedExports(statement.exportClause)) {
-        for (const specifier of statement.exportClause.elements) {
-          if (specifier.name.text !== "default")
-            continue;
-          defaultIdentifier = specifier.propertyName?.text ?? specifier.name.text;
-        }
-      }
-    }
-    return defaultIdentifier ? asyncBindings.get(defaultIdentifier) === true : false;
-  }
-  #hasModifier(node, kind) {
-    const ts = this.#ts;
-    return ts.canHaveModifiers(node) && (ts.getModifiers(node)?.some((modifier) => modifier.kind === kind) ?? false);
-  }
-  #isAsyncFunctionExpression(node) {
-    const ts = this.#ts;
-    return Boolean(node && (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) && this.#hasModifier(node, ts.SyntaxKind.AsyncKeyword));
+// pkgs/@akanjs/devkit/akanConfig/akanConfig.ts
+var DEFAULT_BARREL_IMPORTS = ["akanjs/webkit", "akanjs/common", "akanjs/ui", "akanjs/server"];
+var DEFAULT_OPTIMIZE_IMPORTS = [
+  "lucide-react date-fns lodash-es ramda antd react-bootstrap ahooks @ant-design/icons @headlessui/react",
+  "@headlessui-float/react @heroicons/react/20/solid @heroicons/react/24/solid @heroicons/react/24/outline",
+  "@visx/visx @tremor/react rxjs @mui/material @mui/icons-material recharts react-use @material-ui/core",
+  "@material-ui/icons @tabler/icons-react mui-core react-icons/*"
+].flatMap((line) => line.split(" "));
+var WORKSPACE_BARREL_FACETS = ["ui", "webkit", "common", "client", "server"];
+var DEFAULT_DOCKER_IMAGE = "oven/bun:1-slim";
+var SSR_RUNTIME_PACKAGES = ["react", "react-dom", "react-server-dom-webpack"];
+var DEFAULT_AKAN_IMAGE_CONFIG = {
+  deviceSizes: [640, 750, 828, 1080, 1200, 1920, 2048, 3840],
+  imageSizes: [32, 48, 64, 96, 128, 256, 384],
+  formats: ["image/webp"],
+  qualities: [75],
+  minimumCacheTTL: 14400,
+  remotePatterns: [],
+  localPatterns: [{ pathname: "/**" }],
+  dangerouslyAllowSVG: false,
+  maximumRedirects: 3,
+  fetchTimeoutMs: 7000,
+  maxRemoteBytes: 25 * 1024 * 1024,
+  maxConcurrency: 0
+};
+var normalizeIndexPath = (indexPath) => {
+  const normalized = indexPath?.trim();
+  if (!normalized)
+    return;
+  const path = `/${normalized.replace(/^\/+|\/+$/g, "")}`;
+  return path === "/" ? "/" : path;
+};
+var normalizeStringList = (values) => {
+  const normalized = values?.map((value) => value.trim()).filter(Boolean) ?? [];
+  return normalized.length > 0 ? [...new Set(normalized)] : undefined;
+};
+var sanitizeAppIdSegment = (value) => {
+  const cleaned = value.toLowerCase().replace(/[^a-z0-9]+/g, "");
+  if (!cleaned)
+    return "app";
+  return /^[a-z]/.test(cleaned) ? cleaned : `app${cleaned}`;
+};
+var deriveDefaultAppId = (orgName, appName) => `com.${sanitizeAppIdSegment(orgName)}.${sanitizeAppIdSegment(appName)}`;
+var normalizeDeepLinkDomain = (domain) => {
+  const normalized = domain.trim();
+  if (!normalized)
+    return "";
+  try {
+    const url = new URL(normalized.includes("://") ? normalized : `https://${normalized}`);
+    return url.host.toLowerCase();
+  } catch {
+    return normalized.replace(/^https?:\/\//, "").replace(/\/+$/g, "").toLowerCase();
   }
-}
-
-// pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
-var LAYOUT_KEY_RE = /^\.\/(.+\/)?_layout\.(tsx|ts|jsx|js)$/;
-var IMPLICIT_LAYOUT_DIR = path4.join(".akan", "generated", "root-layouts");
-var IMPLICIT_DICT_DIR = path4.join(".akan", "generated", "dict");
-var IMPLICIT_OVERRIDES_DIR = path4.join(".akan", "generated", "overrides");
-var OVERRIDES_KEY_RE = /^\.\/(.+\/)?_overrides\.(tsx|ts|jsx|js)$/;
-var importSpecifier = (fromAbsPath, toAbsPath) => {
-  const rel = path4.relative(path4.dirname(fromAbsPath), toAbsPath).split(path4.sep).join("/");
-  return rel.startsWith(".") ? rel : `./${rel}`;
 };
-async function writeGeneratedOverridesLayoutFile(opts) {
-  const filename = `${opts.key.replace(/^\.\//, "").replace(/[^a-zA-Z0-9]+/g, "_")}.tsx`;
-  const absPath = path4.join(path4.resolve(opts.appCwdPath), IMPLICIT_OVERRIDES_DIR, filename);
-  const source = `"use client";
-import { UiOverrideProvider } from "akanjs/ui";
-import { createElement, type ReactNode } from "react";
-import value from ${JSON.stringify(importSpecifier(absPath, opts.userAbsPath))};
+var normalizeDeepLinks = (deepLinks) => {
+  const schemes = normalizeStringList(deepLinks?.schemes);
+  const domains = normalizeStringList(deepLinks?.domains?.map(normalizeDeepLinkDomain));
+  if (!schemes && !domains)
+    return;
+  return { ...schemes ? { schemes } : {}, ...domains ? { domains } : {} };
+};
+var emptyLibContributions = () => ({
+  externalLibs: [],
+  trustedDependencies: [],
+  bin: [],
+  docker: { preRuns: [], postRuns: [] },
+  keepFonts: []
+});
+var normalizePackageNames = (names, owner) => {
+  if (names === undefined)
+    return [];
+  if (!Array.isArray(names) || names.some((name) => typeof name !== "string" || !name.trim()))
+    throw new Error(`${owner}: trustedDependencies lists package names`);
+  return [...new Set(names.map((name) => name.trim()))];
+};
+var normalizeKeepFonts = (keepFonts) => [
+  ...new Set((keepFonts ?? []).map((glob) => glob.trim().replace(/^\/+/, "")).filter(Boolean))
+];
+var dedupeDockerRuns = (runs) => {
+  const byKey = new Map;
+  for (const run of runs)
+    byKey.set(typeof run === "string" ? run : JSON.stringify(run), run);
+  return [...byKey.values()];
+};
 
-export default function AkanUiOverridesLayout({ children }: { children?: ReactNode }) {
-  return createElement(UiOverrideProvider, { value }, children);
-}
-`;
-  await Bun.write(absPath, source);
-  return absPath;
-}
-async function pruneGeneratedFiles(dirAbsPath, keepAbsPaths) {
-  const keep = new Set(keepAbsPaths);
-  const names = await readdir(dirAbsPath).catch(() => []);
-  await Promise.all(names.map((name) => path4.join(dirAbsPath, name)).filter((absPath) => !keep.has(absPath)).map((absPath) => rm2(absPath, { force: true })));
-}
-function getRootBoundarySegments(key) {
-  const match = LAYOUT_KEY_RE.exec(key);
-  if (!match)
-    return null;
-  const prefix = match[1]?.replace(/\/$/, "");
-  if (!prefix)
-    return [];
-  return prefix.split("/").filter(Boolean);
-}
-function implicitRootLayoutKey(segments) {
-  return `./${[...segments, "__root_layout"].join("/")}.tsx`;
-}
-function implicitRootLayoutAbsPath(appCwdPath, segments) {
-  const filename = segments.length ? `${segments.join("__")}__root_layout.tsx` : "__root_layout.tsx";
-  return path4.join(path4.resolve(appCwdPath), IMPLICIT_LAYOUT_DIR, filename);
-}
-function isRootBoundarySegments(segments, basePaths) {
-  const firstVisibleIndex = segments.findIndex((segment) => !/^\(.+\)$/.test(segment));
-  if (firstVisibleIndex === -1)
-    return segments.length <= 1;
-  if (segments.slice(firstVisibleIndex + 1).some((segment) => /^\(.+\)$/.test(segment)))
-    return false;
-  const visible = segments.slice(firstVisibleIndex);
-  const allowedBasePaths = new Set([...basePaths].map((basePath) => basePath.trim()).filter(Boolean));
-  return visible.length === 1 && (firstVisibleIndex > 0 || allowedBasePaths.has(visible[0] ?? ""));
-}
-function findRootBoundaries(pageKeys, appCwdPath, basePaths) {
-  const boundaries = new Map;
-  for (const key of pageKeys) {
-    const segments = getRootBoundarySegments(key);
-    if (!segments)
-      continue;
-    if (!isRootBoundarySegments(segments, basePaths))
-      continue;
-    const id = segments.join("/");
-    boundaries.set(id, {
-      sourceKey: key,
-      sourceAbsPath: path4.resolve(appCwdPath, "page", key.replace(/^\.\//, "")),
-      segments
-    });
-  }
-  if (boundaries.size === 0)
-    boundaries.set("", { sourceKey: null, sourceAbsPath: null, segments: [] });
-  return [...boundaries.values()].sort((a, b) => a.segments.join("/").localeCompare(b.segments.join("/")));
-}
-function hasAncestorRootBoundary(boundary, boundaries) {
-  return boundaries.some((candidate) => candidate !== boundary && candidate.segments.length < boundary.segments.length && candidate.segments.every((segment, index) => boundary.segments[index] === segment));
-}
-function findExplicitRootLayoutAbsPath(pageKeys, appCwdPath) {
-  const rootLayoutKey = pageKeys.find((key) => {
-    const segments = getRootBoundarySegments(key);
-    return segments !== null && segments.length === 0;
-  });
-  return rootLayoutKey ? path4.resolve(appCwdPath, "page", rootLayoutKey.replace(/^\.\//, "")) : null;
-}
-async function assertEnvClientConvention(appCwdPath, appName) {
-  const envPath = path4.join(appCwdPath, "env", "env.client.ts");
-  if (!await Bun.file(envPath).exists()) {
-    throw new Error(`[route-convention] app "${appName}" must provide env/env.client.ts exporting "env" for generated System.Provider`);
-  }
-}
-async function writeGeneratedDictionaryMacroFile(appCwdPath, appName) {
-  const absPath = path4.join(path4.resolve(appCwdPath), IMPLICIT_DICT_DIR, "useDict.ts");
-  await Bun.write(absPath, `import { getAllDictionary } from "@apps/${appName}/lib/dict" with { type: "macro" };
-
-export const allDictionary = getAllDictionary();
-`);
-  return absPath;
-}
-async function writeGeneratedRootLayoutFile(opts) {
-  await assertEnvClientConvention(opts.appCwdPath, opts.appName);
-  const dictMacroAbsPath = opts.includeSystemProvider ? await writeGeneratedDictionaryMacroFile(opts.appCwdPath, opts.appName) : null;
-  const absPath = implicitRootLayoutAbsPath(opts.appCwdPath, opts.boundary.segments);
-  const dictMacroSpecifier = dictMacroAbsPath ? importSpecifier(absPath, dictMacroAbsPath) : null;
-  const sourceSpecifier = opts.boundary.sourceAbsPath ? importSpecifier(absPath, opts.boundary.sourceAbsPath) : null;
-  const inheritedSourceAbsPath = opts.rootSourceAbsPath && opts.rootSourceAbsPath !== opts.boundary.sourceAbsPath ? opts.rootSourceAbsPath : null;
-  const inheritedSourceSpecifier = inheritedSourceAbsPath ? importSpecifier(absPath, inheritedSourceAbsPath) : null;
-  const clientImport = opts.includeStInit ? `import { st } from "@apps/${opts.appName}/client";
-void st;
-` : `import "@apps/${opts.appName}/client";
-`;
-  const inheritedLabel = inheritedSourceAbsPath ? path4.relative(opts.appCwdPath, inheritedSourceAbsPath) : "";
-  const inheritedImport = inheritedSourceSpecifier ? `import * as inheritedModule from ${JSON.stringify(inheritedSourceSpecifier)};
-const inheritedLayout = resolveRouteModule(inheritedModule as never, ${JSON.stringify(inheritedLabel)}).module as LayoutModule;
-` : `const inheritedLayout: LayoutModule = {};
-`;
-  const prefix = opts.boundary.segments.find((segment) => !/^\(.+\)$/.test(segment)) ?? null;
-  const userLabel = opts.boundary.sourceAbsPath ? path4.relative(opts.appCwdPath, opts.boundary.sourceAbsPath) : "";
-  const userImport = sourceSpecifier ? `import * as userModule from ${JSON.stringify(sourceSpecifier)};
-const userLayout = resolveRouteModule(userModule as never, ${JSON.stringify(userLabel)}).module as LayoutModule;
-const UserLayout = userLayout.default as (props: LayoutProps) => ReactNode | Promise<ReactNode>;
-` : `const UserLayout = ({ children }: LayoutProps) => children;
-const userLayout: LayoutModule = {};
-`;
-  const isAsyncUserLayout = opts.boundary.sourceAbsPath ? await AsyncDefaultExportDetector.detect(opts.boundary.sourceAbsPath) : false;
-  const userLayoutElement = "<UserLayout params={params} searchParams={searchParams}>{children}</UserLayout>";
-  const layoutSignature = isAsyncUserLayout ? "export default async function GeneratedLayout" : "export default function GeneratedLayout";
-  const layoutBinding = isAsyncUserLayout ? `  const layout =
-    process.env.AKAN_PUBLIC_RENDER_ENV === "csr"
-      ? await UserLayout({ params, searchParams, children })
-      : ${userLayoutElement};
-` : "";
-  const layoutChild = isAsyncUserLayout ? "{layout}" : userLayoutElement;
-  const layoutReturn = isAsyncUserLayout ? "layout" : userLayoutElement;
-  const headLayouts = opts.includeSystemProvider ? "[inheritedLayout, userLayout]" : "[userLayout]";
-  const layoutExports = `export async function generateHead(props: PageProps) {
-  const heads = await Promise.all(
-    ${headLayouts}.map((layout) => (layout.generateHead ? layout.generateHead(props) : layout.head)),
-  );
-  return RouteHead.mergeNodes(heads);
-}
-
-export const NotFound = userLayout.NotFound ?? inheritedLayout.NotFound;
-export const Error = userLayout.Error ?? inheritedLayout.Error;
-export const pageConfig = userLayout.pageConfig ?? inheritedLayout.pageConfig;
-
-${layoutSignature}({ children, params, searchParams }: LayoutProps) {
-${layoutBinding}  return `;
-  const source = opts.includeSystemProvider ? `import type { LayoutModule, LayoutProps, PageProps } from "akanjs/client";
-import { loadFonts, resolveRouteModule, RouteHead } from "akanjs/client";
-import type { ReactNode } from "react";
-import { System } from "akanjs/ui";
-import { env } from "@apps/${opts.appName}/env/env.client";
-import { allDictionary } from ${JSON.stringify(dictMacroSpecifier)};
-${clientImport}${inheritedImport}${userImport}
-const userFonts = userLayout.fonts ?? inheritedLayout.fonts ?? [];
-const defaultFonts = userFonts.filter((font) => font.default);
-if (defaultFonts.length > 1) throw new Error("[route-convention] only one default font is allowed per root layout");
-const defaultFont = defaultFonts[0];
-const defaultFontClassName = defaultFont ? (defaultFont.className ?? \`font-\${defaultFont.name}\`) : undefined;
-export const theme = userLayout.theme ?? inheritedLayout.theme;
-export const viewport = userLayout.viewport ?? inheritedLayout.viewport;
-export const manifest = userLayout.manifest ?? inheritedLayout.manifest;
-
-${layoutExports}(
-    <System.Provider
-      of={GeneratedLayout as never}
-      appName=${JSON.stringify(opts.appName)}
-      ${prefix ? `prefix=${JSON.stringify(prefix)}
-      ` : ""}params={params}
-      manifest={manifest}
-      env={env}
-      theme={theme}
-      viewport={viewport}
-      fonts={loadFonts(userFonts)}
-      className={defaultFontClassName}
-      layoutStyle={userLayout.layoutStyle ?? inheritedLayout.layoutStyle}
-      reconnect={userLayout.reconnect ?? inheritedLayout.reconnect ?? false}
-      wsConnect={userLayout.wsConnect ?? inheritedLayout.wsConnect ?? true}
-      allDictionary={process.env.AKAN_PUBLIC_RENDER_ENV === "ssr" ? allDictionary : undefined}
-    >
-      ${layoutChild}
-    </System.Provider>
-  );
-}
-` : `import type { LayoutModule, LayoutProps, PageProps } from "akanjs/client";
-import { resolveRouteModule, RouteHead } from "akanjs/client";
-import type { ReactNode } from "react";
-${inheritedImport}${userImport}
-${layoutExports}${layoutReturn};
-}
-`;
-  await Bun.write(absPath, source);
-  return absPath;
-}
-async function resolveSsrPageEntries(opts) {
-  const absPageDir = path4.resolve(opts.appCwdPath, "page");
-  const hasSt = await Bun.file(path4.join(opts.appCwdPath, "lib", "st.ts")).exists();
-  const basePaths = opts.basePaths ?? [];
-  const rootSourceAbsPath = findExplicitRootLayoutAbsPath(opts.pageKeys, opts.appCwdPath);
-  const rootBoundaries = findRootBoundaries(opts.pageKeys, opts.appCwdPath, basePaths);
-  const rootLayoutKeys = new Set(opts.pageKeys.filter((key) => {
-    const segments = getRootBoundarySegments(key);
-    return segments !== null && isRootBoundarySegments(segments, basePaths);
-  }));
-  const base = await Promise.all(opts.pageKeys.filter((key) => !rootLayoutKeys.has(key)).map(async (key) => {
-    const userAbsPath = path4.resolve(absPageDir, key);
-    if (OVERRIDES_KEY_RE.test(key)) {
-      const moduleAbsPath = await writeGeneratedOverridesLayoutFile({
-        appCwdPath: opts.appCwdPath,
-        key,
-        userAbsPath
-      });
-      return { key, moduleAbsPath, seedAbsPaths: [userAbsPath] };
-    }
-    return { key, moduleAbsPath: userAbsPath };
-  }));
-  const generated = await Promise.all(rootBoundaries.map(async (boundary) => ({
-    key: implicitRootLayoutKey(boundary.segments),
-    moduleAbsPath: await writeGeneratedRootLayoutFile({
-      appCwdPath: opts.appCwdPath,
-      appName: opts.appName,
-      boundary,
-      rootSourceAbsPath,
-      includeStInit: hasSt && boundary.segments.length === 0,
-      includeSystemProvider: !hasAncestorRootBoundary(boundary, rootBoundaries)
-    }),
-    seedAbsPaths: [...new Set([boundary.sourceAbsPath, rootSourceAbsPath].filter((absPath) => absPath !== null))]
-  })));
-  const appCwdAbsPath = path4.resolve(opts.appCwdPath);
-  await Promise.all([
-    pruneGeneratedFiles(path4.join(appCwdAbsPath, IMPLICIT_OVERRIDES_DIR), base.filter(({ key }) => OVERRIDES_KEY_RE.test(key)).map(({ moduleAbsPath }) => moduleAbsPath)),
-    pruneGeneratedFiles(path4.join(appCwdAbsPath, IMPLICIT_LAYOUT_DIR), generated.map(({ moduleAbsPath }) => moduleAbsPath))
-  ]);
-  return [...base, ...generated].sort((a, b) => a.key.localeCompare(b.key));
-}
-async function resolveSsrPageEntriesForApp(app, pageKeys) {
-  const config = await app.getConfig();
-  return resolveSsrPageEntries({ appCwdPath: app.cwdPath, appName: app.name, pageKeys, basePaths: config.basePaths });
-}
-
-// pkgs/@akanjs/devkit/codegenLock.ts
-import { mkdir as mkdir2, open, readFile, rm as rm3, stat } from "fs/promises";
-import path5 from "path";
-import { Logger as Logger2 } from "akanjs/common";
-
-class CodegenLock {
-  static fileName = "codegen.lock";
-  static waitTimeoutMs = 1e4;
-  static unknownHolderStaleMs = 60000;
-  static #pollMs = 25;
-  static #logger = new Logger2("CodegenLock");
-  static #queue = Promise.resolve();
-  static pathIn(workspaceRoot) {
-    return path5.join(workspaceRoot, "local", ".akan", CodegenLock.fileName);
-  }
-  static async run(workspaceRoot, label, fn) {
-    const ahead = CodegenLock.#queue;
-    let done;
-    CodegenLock.#queue = new Promise((resolve) => {
-      done = resolve;
-    });
-    try {
-      await CodegenLock.#waitForQueue(ahead, label);
-      return await CodegenLock.#withFileLock(workspaceRoot, label, fn);
-    } finally {
-      done();
-    }
-  }
-  static async#waitForQueue(ahead, label) {
-    let timer = null;
-    const expired = new Promise((resolve) => {
-      timer = setTimeout(() => resolve("expired"), CodegenLock.waitTimeoutMs);
-    });
-    try {
-      if (await Promise.race([ahead.then(() => "done"), expired]) === "expired")
-        CodegenLock.#logger.warn(`codegen lock queued past ${CodegenLock.waitTimeoutMs}ms in this process; continuing without waiting (${label})`);
-    } finally {
-      if (timer)
-        clearTimeout(timer);
-    }
-  }
-  static async#withFileLock(workspaceRoot, label, fn) {
-    const lockPath = CodegenLock.pathIn(workspaceRoot);
-    await mkdir2(path5.dirname(lockPath), { recursive: true }).catch(() => {
-      return;
-    });
-    const held = await CodegenLock.#acquire(lockPath, label);
-    try {
-      return await fn();
-    } finally {
-      if (held)
-        await rm3(lockPath, { force: true }).catch(() => {
-          return;
-        });
-    }
-  }
-  static async#acquire(lockPath, label) {
-    const deadline = Date.now() + CodegenLock.waitTimeoutMs;
-    for (;; ) {
-      const handle = await open(lockPath, "wx").catch(() => null);
-      if (handle) {
-        await handle.writeFile(JSON.stringify({ pid: process.pid, at: Date.now(), label })).catch(() => {
-          return;
-        });
-        await handle.close().catch(() => {
-          return;
-        });
-        return true;
-      }
-      if (await CodegenLock.#reclaimIfAbandoned(lockPath))
-        continue;
-      if (Date.now() >= deadline) {
-        CodegenLock.#logger.warn(`codegen lock at ${lockPath} held past ${CodegenLock.waitTimeoutMs}ms; continuing without it (${label})`);
-        return false;
-      }
-      await Bun.sleep(CodegenLock.#pollMs);
-    }
-  }
-  static async#reclaimIfAbandoned(lockPath) {
-    const info = await stat(lockPath).catch(() => null);
-    if (!info)
-      return true;
-    const holder = CodegenLock.#parseHolder(await readFile(lockPath, "utf8").catch(() => ""));
-    if (holder) {
-      if (CodegenLock.#isAlive(holder.pid))
-        return false;
-    } else if (Date.now() - info.mtimeMs < CodegenLock.unknownHolderStaleMs)
-      return false;
-    await rm3(lockPath, { force: true }).catch(() => {
-      return;
-    });
-    return true;
-  }
-  static #parseHolder(raw) {
-    try {
-      const parsed = JSON.parse(raw);
-      if (typeof parsed.pid !== "number" || typeof parsed.at !== "number")
-        return null;
-      return { pid: parsed.pid, at: parsed.at, label: typeof parsed.label === "string" ? parsed.label : "" };
-    } catch {
-      return null;
-    }
-  }
-  static #isAlive(pid) {
-    if (!Number.isInteger(pid) || pid <= 0)
-      return false;
-    try {
-      process.kill(pid, 0);
-      return true;
-    } catch (error) {
-      return error.code === "EPERM";
-    }
-  }
-}
-
-// pkgs/@akanjs/devkit/spinner.ts
-import ora from "ora";
-
-class Spinner {
-  static padding = 12;
-  static oraOptions = { discardStdin: false };
-  static canAnimate(stream = process.stderr) {
-    return !stream.isTTY || stream.columns > 0;
-  }
-  spinner;
-  stopWatch = null;
-  startAt = new Date;
-  prefix;
-  message;
-  enableSpin;
-  constructor(message, { prefix = "", indent = 0, enableSpin = true } = {}) {
-    Spinner.padding = Math.max(Spinner.padding, prefix.length);
-    this.prefix = prefix;
-    this.message = message;
-    this.spinner = ora({ ...Spinner.oraOptions, text: message });
-    this.spinner.prefixText = prefix.padStart(Spinner.padding, " ");
-    this.spinner.indent = indent;
-    this.enableSpin = enableSpin && Spinner.canAnimate();
-  }
-  start() {
-    this.startAt = new Date;
-    if (this.enableSpin) {
-      this.spinner.start();
-      this.stopWatch = setInterval(() => {
-        this.spinner.prefixText = this.prefix.padStart(Spinner.padding, " ");
-        this.spinner.text = `${this.message} (${this.#getElapsedTimeStr({ floor: true })})`;
-      }, 1000);
-    } else
-      this.spinner.info();
-    return this;
-  }
-  succeed(message) {
-    this.spinner.succeed(`${message} (${this.#getElapsedTimeStr()})`);
-    this.#reset();
-  }
-  fail(message) {
-    this.spinner.fail(`${message} (${this.#getElapsedTimeStr()})`);
-    this.#reset();
-  }
-  isSpinning() {
-    return this.spinner.isSpinning;
-  }
-  #reset() {
-    if (this.stopWatch)
-      clearInterval(this.stopWatch);
-    this.stopWatch = null;
-  }
-  #getElapsedTimeStr({ floor = false } = {}) {
-    const ms = Date.now() - this.startAt.getTime();
-    if (ms < 1000)
-      return `${ms}ms`;
-    const s = Math.floor(ms / 1000);
-    if (s < 60)
-      return `${floor ? Math.floor(ms / 1000) : Math.floor(ms / 100) / 10}s`;
-    const m = Math.floor(s / 60);
-    return `${m}m ${s % 60}s`;
-  }
-}
-
-// pkgs/@akanjs/devkit/executors.ts
-import {
-  exec,
-  fork,
-  spawn as spawn2
-} from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import {
-  copyFile,
-  cp as cpEntry,
-  lstat,
-  mkdir as mkdir3,
-  readdir as readDirEntries,
-  realpath,
-  rm as rm4,
-  stat as stat2,
-  symlink
-} from "fs/promises";
-import path13 from "path";
-import { pathToFileURL } from "url";
-import {
-  capitalize,
-  getPageSourceFileViolation,
-  isRouteSourceFile,
-  Logger as Logger3,
-  parseRouteModuleKey,
-  toError as toError2,
-  validatePageSourceFile,
-  validateSubRoutePageKey
-} from "akanjs/common";
-var {$ } = globalThis.Bun;
-import chalk2 from "chalk";
-
-// pkgs/@akanjs/devkit/agentsIndex.ts
-var recipeScannerLoad = null;
-var loadRecipeScanner = () => recipeScannerLoad ??= import("./recipeScanner-4b69ybe0.js");
-var AGENT_BLOCK_START = "<!-- akan:agent:start -->";
-var AGENT_BLOCK_END = "<!-- akan:agent:end -->";
-var AGENT_VERSION_PREFIX = "<!-- akan:agent:version ";
-var stampBlockVersion = (block, version) => `${AGENT_VERSION_PREFIX}${version} -->
-
-${block}`;
-var extractBlockVersion = (content) => content.match(/<!-- akan:agent:version ([^\s]+) -->/)?.[1] ?? null;
-var readDevkitVersion = async () => {
-  const { readFile } = await import("fs/promises");
-  const { getDirname } = await import("./fileSys-wzzrntkw.js");
-  try {
-    const raw = await readFile(`${getDirname(import.meta.url)}/package.json`, "utf-8");
-    return JSON.parse(raw).version ?? null;
-  } catch {
-    return null;
-  }
-};
-var upsertAgentBlock = (existing, block) => {
-  const managed = `${AGENT_BLOCK_START}
-${block}
-${AGENT_BLOCK_END}`;
-  const startIndex = existing.indexOf(AGENT_BLOCK_START);
-  const endIndex = existing.indexOf(AGENT_BLOCK_END);
-  if (startIndex >= 0 && endIndex > startIndex) {
-    return `${existing.slice(0, startIndex)}${managed}${existing.slice(endIndex + AGENT_BLOCK_END.length)}`;
-  }
-  return `${existing.replace(/\s*$/, "")}
-
-${managed}
-`;
-};
-var extractAgentBlock = (content) => {
-  const startIndex = content.indexOf(AGENT_BLOCK_START);
-  const endIndex = content.indexOf(AGENT_BLOCK_END);
-  if (startIndex < 0 || endIndex <= startIndex)
-    return null;
-  return content.slice(startIndex + AGENT_BLOCK_START.length, endIndex).trim();
-};
-var signatureOf = (recipe) => {
-  const entries = Object.entries(recipe.variants);
-  if (entries.length === 0)
-    return "";
-  const parts = entries.map(([key, values]) => {
-    if (values.length === 1 && values[0] === "true")
-      return `${key}?`;
-    const def = recipe.defaultVariants?.[key];
-    return `${key}: ${values.map((value) => value === def ? `${value}*` : value).join("|")}`;
-  });
-  return `(${parts.join(" \xB7 ")})`;
-};
-var renderRecipeEntries = (recipes) => {
-  const groups = new Map;
-  for (const recipe of recipes)
-    groups.set(recipe.importFrom, [...groups.get(recipe.importFrom) ?? [], recipe]);
-  return [...groups.entries()].map(([importFrom, list]) => {
-    const items = list.sort((a, b) => a.name.localeCompare(b.name)).map((recipe) => `- \`${recipe.name}\`${signatureOf(recipe)}${recipe.doc ? ` \u2014 ${recipe.doc}` : ""}`).join(`
-`);
-    return `Import from \`${importFrom}\`:
-${items}`;
-  }).join(`
-
-`);
-};
-var collectScopeRecipeSources = async (workspaceRoot, scope, libDeps) => {
-  const { collectRecipeSources } = await loadRecipeScanner();
-  const sources = [
-    ...await collectRecipeSources(`${workspaceRoot}/${scope.type}s/${scope.name}/ui`, `@${scope.type}s/${scope.name}/ui`)
-  ];
-  for (const lib of [...new Set(libDeps)].sort()) {
-    if (scope.type === "lib" && lib === scope.name)
-      continue;
-    sources.push(...await collectRecipeSources(`${workspaceRoot}/libs/${lib}/ui`, `@libs/${lib}/ui`));
-  }
-  return sources;
-};
-var scanScopeRecipes = async (workspaceRoot, scope, libDeps) => {
-  const { scanRecipes } = await loadRecipeScanner();
-  return scanRecipes(await collectScopeRecipeSources(workspaceRoot, scope, libDeps));
-};
-var renderScopeAgentBlock = (scope, recipes) => {
-  const scopePath = `${scope.type}s/${scope.name}`;
-  const intro = `## Recipes In Scope
-
-UI recipes importable from \`${scopePath}\` code, **in addition to** the framework recipes indexed in the root
-\`AGENTS.md\` \`## Recipes\`. Same contract: import by exact name, then \`<name>(variants?, className?)\` \u2014 the second
-arg merges internally and takes an array too, so never wrap it in \`cn()\`. \`*\` marks the default, \`key?\` is a
-boolean flag. Do not guess recipe names or import paths; this index is regenerated by \`akan sync ${scope.name}\`
-and verified by \`akan lint ${scope.name}\`.`;
-  if (recipes.length === 0) {
-    return `${intro}
-
-No scope recipes yet. Before inlining a repeated surface (card, box, tile, \u2026), reuse a framework recipe from the
-root \`AGENTS.md\` or author one as \`${scopePath}/ui/Recipe/<name>.ts\` (one recipe per file, re-exported from that
-folder's \`index.ts\`) \u2014 see the \`recipeRule\` guideline.`;
-  }
-  return `${intro}
-
-${renderRecipeEntries(recipes)}`;
-};
-var renderScopeAgentsMd = (scope, block) => `# ${scope.name} \u2014 Agent Guide
-
-Scoped guide for coding agents working in \`${scope.type}s/${scope.name}\`. Workspace-wide conventions live in the
-root \`AGENTS.md\`; this file carries what is importable from this ${scope.type === "app" ? "app" : "library"}. The
-section between the \`akan:agent\` markers is regenerated by \`akan sync ${scope.name}\`; edit anything outside the
-markers freely.
-
-${AGENT_BLOCK_START}
-${block}
-${AGENT_BLOCK_END}
-`;
-var CLAUDE_COMMENT_RULE = `## Comments \u2014 Overrides Your Default
-
-Write **no comments** unless the comment passes the test below. This is the rule agents break most often here, so it
-is repeated outside the guide: a diff that adds a comment the test rejects is a diff to redo.
-
-Before typing \`//\`, \`/*\`, or a doc block, ask \u2014 **does this sentence carry a fact that is nowhere in the code?**
-
-- Restates the identifier, the signature, or the line under it \u2192 delete it.
-- Labels a section (\`// helpers\`, \`// state\`) or narrates a step (\`// fetch the user\`, \`// then save\`) \u2192 delete it.
-- JSDoc on an ordinary function, or a why/how preamble on ordinary logic \u2192 delete it.
-- Explains the edit you just made, for whoever reads the diff \u2192 say it in your reply, not in the file.
-- Names a vendor or protocol quirk, an infrastructure constraint, a library gotcha, security reasoning, a math
-  derivation, a domain field's business meaning, a state transition, or why an obvious alternative was rejected \u2192
-  keep it, one line.
-
-That keep-list is exact \u2014 \`Comments\` in the guide is the full version. "It aids readability" and "this logic is
-subtle" are not on it: rename or split the code instead. When you edit an existing file, match its density; if the
-surrounding code carries none, your diff carries none.`;
-var renderScopeClaudeMd = (scope) => `# ${scope.name} \u2014 Claude Code Guide
-
-@AGENTS.md
-
-${CLAUDE_COMMENT_RULE}
-`;
-
-// pkgs/@akanjs/devkit/akanConfig/akanBin.ts
-import path6 from "path";
-
-// pkgs/@akanjs/devkit/akanConfig/types.ts
-import { archs, binPlatforms, defaultAppPipeline } from "akanjs";
-
-// pkgs/@akanjs/devkit/akanConfig/akanBin.ts
-class AkanBin {
-  static archive = /\.(zip|tar\.gz|tgz|tar\.xz|txz|tar\.bz2|tbz2|tar)$/i;
-  static fileName = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-  static parse(declared, owner, baseDir) {
-    if (declared === undefined)
-      return {};
-    if (!declared || typeof declared !== "object" || Array.isArray(declared))
-      throw new Error(`${owner}: bin maps each executable's name to its platforms`);
-    return Object.fromEntries(Object.entries(declared).map(([name, platforms]) => [name, AkanBin.#platforms(name, platforms, owner, baseDir)]));
-  }
-  static isArchive(source) {
-    return AkanBin.archive.test("url" in source ? new URL(source.url).pathname : source.path);
-  }
-  static #platforms(name, platforms, owner, baseDir) {
-    if (!AkanBin.fileName.test(name))
-      throw new Error(`${owner}: bin.${name} is not a file name`);
-    if (!platforms || typeof platforms !== "object" || Array.isArray(platforms))
-      throw new Error(`${owner}: bin.${name} maps platforms (${binPlatforms.join(", ")}) to where the file comes from`);
-    const resolved = {};
-    for (const [platform, source] of Object.entries(platforms)) {
-      if (!binPlatforms.includes(platform))
-        throw new Error(`${owner}: bin.${name}.${platform} is not one of ${binPlatforms.join(", ")}`);
-      resolved[platform] = AkanBin.#source(`${owner}: bin.${name}.${platform}`, source, baseDir);
-    }
-    return resolved;
-  }
-  static #source(at, source, baseDir) {
-    if (!source || typeof source !== "object" || Array.isArray(source))
-      throw new Error(`${at} must be { url, sha256 } or { path }`);
-    const { url, sha256, path: localPath, file, ...rest } = source;
-    const extra = Object.keys(rest);
-    if (extra.length)
-      throw new Error(`${at}: unknown key ${extra.join(", ")}`);
-    if (url === undefined === (localPath === undefined))
-      throw new Error(`${at} takes either url and sha256, or path`);
-    const resolved = url !== undefined ? AkanBin.#urlSource(at, url, sha256) : AkanBin.#pathSource(at, localPath, sha256, baseDir);
-    const archive = AkanBin.isArchive(resolved);
-    if (file === undefined) {
-      if (archive)
-        throw new Error(`${at} names an archive: file picks the executable inside it`);
-      return resolved;
-    }
-    if (!archive)
-      throw new Error(`${at}: file picks the executable out of an archive, and this source is none`);
-    const parts = typeof file === "string" ? file.split(/[\\/]/).filter((part) => part && part !== ".") : [];
-    if (!parts.length || path6.isAbsolute(file) || parts.includes(".."))
-      throw new Error(`${at}: file must be a path inside the archive (got ${JSON.stringify(file)})`);
-    return { ...resolved, file: parts.join("/") };
-  }
-  static #urlSource(at, url, sha256) {
-    if (typeof url !== "string" || !URL.canParse(url) || !/^https?:$/.test(new URL(url).protocol))
-      throw new Error(`${at}: url must be an http(s) address`);
-    if (typeof sha256 !== "string" || !/^[0-9a-f]{64}$/i.test(sha256))
-      throw new Error(`${at}: sha256 must be the downloaded file's 64-digit hex digest`);
-    return { url, sha256: sha256.toLowerCase() };
-  }
-  static #pathSource(at, localPath, sha256, baseDir) {
-    if (typeof localPath !== "string" || !localPath)
-      throw new Error(`${at}: path must name a file`);
-    if (sha256 !== undefined)
-      throw new Error(`${at}: sha256 checks a download, and a path source downloads nothing`);
-    return { path: path6.resolve(baseDir, localPath) };
-  }
-}
-// pkgs/@akanjs/devkit/akanConfig/akanConfig.ts
-import fs2 from "fs";
-import path7 from "path";
-import { fileURLToPath } from "url";
-import { DatabaseModes, normalizeRoutePrefix } from "akanjs/base";
-import { resolveAkanI18nConfig } from "akanjs/common";
-var DEFAULT_BARREL_IMPORTS = ["akanjs/webkit", "akanjs/common", "akanjs/ui", "akanjs/server"];
-var DEFAULT_OPTIMIZE_IMPORTS = [
-  "lucide-react date-fns lodash-es ramda antd react-bootstrap ahooks @ant-design/icons @headlessui/react",
-  "@headlessui-float/react @heroicons/react/20/solid @heroicons/react/24/solid @heroicons/react/24/outline",
-  "@visx/visx @tremor/react rxjs @mui/material @mui/icons-material recharts react-use @material-ui/core",
-  "@material-ui/icons @tabler/icons-react mui-core react-icons/*"
-].flatMap((line) => line.split(" "));
-var WORKSPACE_BARREL_FACETS = ["ui", "webkit", "common", "client", "server"];
-var DEFAULT_DOCKER_IMAGE = "oven/bun:1-slim";
-var SSR_RUNTIME_PACKAGES = ["react", "react-dom", "react-server-dom-webpack"];
-var DEFAULT_AKAN_IMAGE_CONFIG = {
-  deviceSizes: [640, 750, 828, 1080, 1200, 1920, 2048, 3840],
-  imageSizes: [32, 48, 64, 96, 128, 256, 384],
-  formats: ["image/webp"],
-  qualities: [75],
-  minimumCacheTTL: 14400,
-  remotePatterns: [],
-  localPatterns: [{ pathname: "/**" }],
-  dangerouslyAllowSVG: false,
-  maximumRedirects: 3,
-  fetchTimeoutMs: 7000,
-  maxRemoteBytes: 25 * 1024 * 1024,
-  maxConcurrency: 0
-};
-var normalizeIndexPath = (indexPath) => {
-  const normalized = indexPath?.trim();
-  if (!normalized)
-    return;
-  const path = `/${normalized.replace(/^\/+|\/+$/g, "")}`;
-  return path === "/" ? "/" : path;
-};
-var normalizeStringList = (values) => {
-  const normalized = values?.map((value) => value.trim()).filter(Boolean) ?? [];
-  return normalized.length > 0 ? [...new Set(normalized)] : undefined;
-};
-var sanitizeAppIdSegment = (value) => {
-  const cleaned = value.toLowerCase().replace(/[^a-z0-9]+/g, "");
-  if (!cleaned)
-    return "app";
-  return /^[a-z]/.test(cleaned) ? cleaned : `app${cleaned}`;
-};
-var deriveDefaultAppId = (orgName, appName) => `com.${sanitizeAppIdSegment(orgName)}.${sanitizeAppIdSegment(appName)}`;
-var normalizeDeepLinkDomain = (domain) => {
-  const normalized = domain.trim();
-  if (!normalized)
-    return "";
-  try {
-    const url = new URL(normalized.includes("://") ? normalized : `https://${normalized}`);
-    return url.host.toLowerCase();
-  } catch {
-    return normalized.replace(/^https?:\/\//, "").replace(/\/+$/g, "").toLowerCase();
-  }
-};
-var normalizeDeepLinks = (deepLinks) => {
-  const schemes = normalizeStringList(deepLinks?.schemes);
-  const domains = normalizeStringList(deepLinks?.domains?.map(normalizeDeepLinkDomain));
-  if (!schemes && !domains)
-    return;
-  return { ...schemes ? { schemes } : {}, ...domains ? { domains } : {} };
-};
-var emptyLibContributions = () => ({
-  externalLibs: [],
-  trustedDependencies: [],
-  bin: [],
-  docker: { preRuns: [], postRuns: [] },
-  keepFonts: []
-});
-var normalizePackageNames = (names, owner) => {
-  if (names === undefined)
-    return [];
-  if (!Array.isArray(names) || names.some((name) => typeof name !== "string" || !name.trim()))
-    throw new Error(`${owner}: trustedDependencies lists package names`);
-  return [...new Set(names.map((name) => name.trim()))];
-};
-var normalizeKeepFonts = (keepFonts) => [
-  ...new Set((keepFonts ?? []).map((glob) => glob.trim().replace(/^\/+/, "")).filter(Boolean))
-];
-var dedupeDockerRuns = (runs) => {
-  const byKey = new Map;
-  for (const run of runs)
-    byKey.set(typeof run === "string" ? run : JSON.stringify(run), run);
-  return [...byKey.values()];
-};
-
-class LibConfigRefusal extends Error {
+class LibConfigRefusal extends Error {
 }
 
 class AkanAppConfig {
@@ -1495,7 +932,7 @@ class AkanAppConfig {
   }
   #applyRoutes(routes = []) {
     for (const route of routes) {
-      const basePath = route.basePath ? route.basePath.replace(/^\/+|\/+$/g, "") : null;
+      const basePath = route.basePath ? trimSlashes(route.basePath) : null;
       if (basePath !== null)
         this.basePaths.add(basePath);
       const domains = basePath !== null ? this.subRoutes.getOrInsert(basePath, new Set) : this.domains;
@@ -1597,7 +1034,7 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
   static async from(app, { bustImportCache = false } = {}) {
     const [configImp, baseDevEnv, libs, rootPackageJson] = await Promise.all([
       AkanAppConfig.importConfigModule(app.cwdPath, { bustImportCache }),
-      WorkspaceExecutor.getBaseDevEnv(path7.join(app.workspace.workspaceRoot, ".env")),
+      WorkspaceExecutor.getBaseDevEnv(path3.join(app.workspace.workspaceRoot, ".env")),
       app.workspace.getLibs(),
       app.workspace.getPackageJson()
     ]);
@@ -1693,143 +1130,579 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
     };
   }
 }
-var akanPackageJson = null;
-function getAkanPackageJson() {
-  if (akanPackageJson)
-    return akanPackageJson;
-  const sourceDir = path7.dirname(fileURLToPath(import.meta.url));
-  const packageJsonPaths = [
-    path7.join(sourceDir, "../../../akanjs/package.json"),
-    path7.join(process.cwd(), "pkgs/akanjs/package.json"),
-    path7.join(path7.dirname(Bun.main), "node_modules/akanjs/package.json")
-  ];
-  try {
-    packageJsonPaths.unshift(Bun.resolveSync("akanjs/package.json", sourceDir));
-  } catch {}
-  for (const packageJsonPath of packageJsonPaths) {
-    try {
-      akanPackageJson = JSON.parse(fs2.readFileSync(packageJsonPath, "utf8"));
-      return akanPackageJson;
-    } catch {}
+var akanPackageJson = null;
+function getAkanPackageJson() {
+  if (akanPackageJson)
+    return akanPackageJson;
+  const sourceDir = path3.dirname(fileURLToPath(import.meta.url));
+  const packageJsonPaths = [
+    path3.join(sourceDir, "../../../akanjs/package.json"),
+    path3.join(process.cwd(), "pkgs/akanjs/package.json"),
+    path3.join(path3.dirname(Bun.main), "node_modules/akanjs/package.json")
+  ];
+  try {
+    packageJsonPaths.unshift(Bun.resolveSync("akanjs/package.json", sourceDir));
+  } catch {}
+  for (const packageJsonPath of packageJsonPaths) {
+    try {
+      akanPackageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+      return akanPackageJson;
+    } catch {}
+  }
+  akanPackageJson = {
+    name: "akanjs",
+    version: "0.0.0",
+    description: "akanjs",
+    dependencies: {}
+  };
+  return akanPackageJson;
+}
+function mergeImageConfig(config = {}) {
+  return {
+    ...DEFAULT_AKAN_IMAGE_CONFIG,
+    ...config,
+    deviceSizes: config.deviceSizes ?? DEFAULT_AKAN_IMAGE_CONFIG.deviceSizes,
+    imageSizes: config.imageSizes ?? DEFAULT_AKAN_IMAGE_CONFIG.imageSizes,
+    formats: config.formats ?? DEFAULT_AKAN_IMAGE_CONFIG.formats,
+    qualities: config.qualities ?? DEFAULT_AKAN_IMAGE_CONFIG.qualities,
+    remotePatterns: config.remotePatterns ?? DEFAULT_AKAN_IMAGE_CONFIG.remotePatterns,
+    localPatterns: config.localPatterns ?? DEFAULT_AKAN_IMAGE_CONFIG.localPatterns
+  };
+}
+
+class AkanLibConfig {
+  lib;
+  externalLibs;
+  trustedDependencies;
+  bin;
+  docker;
+  assets;
+  plugins;
+  constructor(lib, config, plugins = []) {
+    this.lib = lib;
+    this.externalLibs = config?.externalLibs ?? [];
+    const owner = `libs/${lib.name}/akan.config.ts`;
+    this.trustedDependencies = normalizePackageNames(config?.trustedDependencies, owner);
+    this.bin = AkanBin.parse(config?.bin, owner, lib.cwdPath);
+    this.docker = { preRuns: config?.docker?.preRuns ?? [], postRuns: config?.docker?.postRuns ?? [] };
+    this.assets = { keepFonts: normalizeKeepFonts(config?.assets?.keepFonts) };
+    this.plugins = plugins;
+  }
+  static async from(lib, { bustImportCache = false } = {}) {
+    const configImp = await AkanAppConfig.importConfigModule(lib.cwdPath, { bustImportCache });
+    const resolved = typeof configImp === "function" ? configImp(lib) : configImp;
+    const { plugins, ...config } = resolved ?? {};
+    if ("pipeline" in config)
+      throw new LibConfigRefusal(`libs/${lib.name}/akan.config.ts declares \`pipeline\`, which a lib does not take: pipelines belong to apps and the workspace root, and a lib's build-time work goes in an akan build plugin.`);
+    if ("subspace" in config)
+      throw new LibConfigRefusal(`libs/${lib.name}/akan.config.ts declares \`subspace\`, a workspace setting: it belongs in the workspace root akan.config.ts.`);
+    return new AkanLibConfig(lib, config, plugins ?? []);
+  }
+}
+//! need to refactor
+var shiftBuildNum = async (app, delta) => {
+  const { buildNum } = (await AkanAppConfig.from(app)).native;
+  const akanConfigPath = path3.join(app.cwdPath, "akan.config.ts");
+  const akanConfig = fs.readFileSync(akanConfigPath, "utf8");
+  fs.writeFileSync(akanConfigPath, akanConfig.replace(`buildNum: ${buildNum}`, `buildNum: ${buildNum + delta}`));
+};
+var increaseBuildNum = async (app) => await shiftBuildNum(app, 1);
+var decreaseBuildNum = async (app) => await shiftBuildNum(app, -1);
+// pkgs/@akanjs/devkit/akanConfig/akanWorkspaceConfig.ts
+import path4 from "path";
+class AkanWorkspaceConfig {
+  static fileName = "akan.config.ts";
+  static #keys = ["subspace", "pipeline", "cloud"];
+  static #loopbackHosts = ["localhost", "127.0.0.1", "[::1]"];
+  static async from(workspace, { bustImportCache = false } = {}) {
+    const file = path4.join(workspace.workspaceRoot, AkanWorkspaceConfig.fileName);
+    if (!await FileSys2.fileExists(file))
+      return new AkanWorkspaceConfig(null, {});
+    const input = await AkanAppConfig.importConfigModule(workspace.workspaceRoot, { bustImportCache });
+    return new AkanWorkspaceConfig(file, input);
+  }
+  file;
+  subspace;
+  pipeline;
+  cloudHost;
+  constructor(file, input) {
+    this.file = file;
+    if (typeof input !== "object" || input === null || Array.isArray(input))
+      throw new Error("The workspace root akan.config.ts must default-export a WorkspaceConfig object.");
+    for (const key of Object.keys(input))
+      if (!AkanWorkspaceConfig.#keys.includes(key))
+        throw new Error(`The workspace root akan.config.ts declares \`${key}\`, which it does not take: it holds \`subspace\`, \`pipeline\` and \`cloud\`, and app or lib settings belong in apps/<app>/akan.config.ts or libs/<lib>/akan.config.ts.`);
+    const config = input;
+    this.subspace = config.subspace ?? null;
+    this.pipeline = config.pipeline ?? null;
+    this.cloudHost = AkanWorkspaceConfig.#cloudHost(config.cloud);
+  }
+  static #cloudHost(cloud) {
+    if (cloud === undefined)
+      return null;
+    const refuse = (why) => {
+      throw new Error(`The workspace root akan.config.ts has cloud ${why}.`);
+    };
+    if (typeof cloud !== "object" || cloud === null || Array.isArray(cloud))
+      return refuse("that is not an object");
+    const unknown = Object.keys(cloud).filter((key) => key !== "host");
+    if (unknown.length)
+      return refuse(`keys it does not take: ${unknown.join(", ")} (only \`host\`)`);
+    const { host } = cloud;
+    if (host === undefined)
+      return null;
+    const url = typeof host === "string" && URL.canParse(host) ? new URL(host) : null;
+    if (!url || url.search || url.hash || url.username || url.password)
+      return refuse(`.host ${JSON.stringify(host)}, which is not a URL like "https://cloud.example.com"`);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && AkanWorkspaceConfig.#loopbackHosts.includes(url.hostname)))
+      return refuse(`.host ${JSON.stringify(host)}: https only, or http on this computer`);
+    return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+  }
+}
+// pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
+import { readdir, rm } from "fs/promises";
+import path6 from "path";
+
+// pkgs/@akanjs/devkit/transforms/asyncDefaultExportDetector.ts
+import fs2 from "fs";
+import path5 from "path";
+
+class AsyncDefaultExportDetector {
+  static #typescriptLoad;
+  static #loadTypescript() {
+    AsyncDefaultExportDetector.#typescriptLoad ??= import("typescript").then((mod) => mod.default ?? mod);
+    return AsyncDefaultExportDetector.#typescriptLoad;
+  }
+  static async detect(moduleAbsPath) {
+    try {
+      const typescript = await AsyncDefaultExportDetector.#loadTypescript();
+      const source = fs2.readFileSync(path5.resolve(moduleAbsPath), "utf8");
+      const sourceFile = typescript.createSourceFile(moduleAbsPath, source, typescript.ScriptTarget.Latest, true, /\.[tj]sx$/.test(moduleAbsPath) ? typescript.ScriptKind.TSX : typescript.ScriptKind.TS);
+      return new AsyncDefaultExportDetector(typescript).detectInSourceFile(sourceFile);
+    } catch {
+      return false;
+    }
+  }
+  #ts;
+  constructor(typescript) {
+    this.#ts = typescript;
+  }
+  detectInSourceFile(sourceFile) {
+    const ts = this.#ts;
+    const asyncBindings = new Map;
+    let defaultIdentifier = null;
+    for (const statement of sourceFile.statements) {
+      if (ts.isFunctionDeclaration(statement)) {
+        if (this.#hasModifier(statement, ts.SyntaxKind.DefaultKeyword)) {
+          return this.#hasModifier(statement, ts.SyntaxKind.AsyncKeyword);
+        }
+        if (statement.name) {
+          asyncBindings.set(statement.name.text, this.#hasModifier(statement, ts.SyntaxKind.AsyncKeyword));
+        }
+        continue;
+      }
+      if (ts.isVariableStatement(statement)) {
+        for (const declaration of statement.declarationList.declarations) {
+          if (!ts.isIdentifier(declaration.name))
+            continue;
+          asyncBindings.set(declaration.name.text, this.#isAsyncFunctionExpression(declaration.initializer));
+        }
+        continue;
+      }
+      if (ts.isExportAssignment(statement)) {
+        if (this.#isAsyncFunctionExpression(statement.expression))
+          return true;
+        if (ts.isCallExpression(statement.expression))
+          return true;
+        if (ts.isIdentifier(statement.expression))
+          defaultIdentifier = statement.expression.text;
+        continue;
+      }
+      if (ts.isExportDeclaration(statement) && statement.exportClause && ts.isNamedExports(statement.exportClause)) {
+        for (const specifier of statement.exportClause.elements) {
+          if (specifier.name.text !== "default")
+            continue;
+          defaultIdentifier = specifier.propertyName?.text ?? specifier.name.text;
+        }
+      }
+    }
+    return defaultIdentifier ? asyncBindings.get(defaultIdentifier) === true : false;
+  }
+  #hasModifier(node, kind) {
+    const ts = this.#ts;
+    return ts.canHaveModifiers(node) && (ts.getModifiers(node)?.some((modifier) => modifier.kind === kind) ?? false);
+  }
+  #isAsyncFunctionExpression(node) {
+    const ts = this.#ts;
+    return Boolean(node && (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) && this.#hasModifier(node, ts.SyntaxKind.AsyncKeyword));
+  }
+}
+
+// pkgs/@akanjs/devkit/artifact/implicitRootLayout.ts
+var LAYOUT_KEY_RE = /^\.\/(.+\/)?_layout\.(tsx|ts|jsx|js)$/;
+var IMPLICIT_LAYOUT_DIR = path6.join(".akan", "generated", "root-layouts");
+var IMPLICIT_DICT_DIR = path6.join(".akan", "generated", "dict");
+var IMPLICIT_OVERRIDES_DIR = path6.join(".akan", "generated", "overrides");
+var OVERRIDES_KEY_RE = /^\.\/(.+\/)?_overrides\.(tsx|ts|jsx|js)$/;
+var importSpecifier = (fromAbsPath, toAbsPath) => {
+  const rel = path6.relative(path6.dirname(fromAbsPath), toAbsPath).split(path6.sep).join("/");
+  return rel.startsWith(".") ? rel : `./${rel}`;
+};
+async function writeGeneratedOverridesLayoutFile(opts) {
+  const filename = `${opts.key.replace(/^\.\//, "").replace(/[^a-zA-Z0-9]+/g, "_")}.tsx`;
+  const absPath = path6.join(path6.resolve(opts.appCwdPath), IMPLICIT_OVERRIDES_DIR, filename);
+  const source = `"use client";
+import { UiOverrideProvider } from "akanjs/ui";
+import { createElement, type ReactNode } from "react";
+import value from ${JSON.stringify(importSpecifier(absPath, opts.userAbsPath))};
+
+export default function AkanUiOverridesLayout({ children }: { children?: ReactNode }) {
+  return createElement(UiOverrideProvider, { value }, children);
+}
+`;
+  await Bun.write(absPath, source);
+  return absPath;
+}
+async function pruneGeneratedFiles(dirAbsPath, keepAbsPaths) {
+  const keep = new Set(keepAbsPaths);
+  const names = await readdir(dirAbsPath).catch(() => []);
+  await Promise.all(names.map((name) => path6.join(dirAbsPath, name)).filter((absPath) => !keep.has(absPath)).map((absPath) => rm(absPath, { force: true })));
+}
+function getRootBoundarySegments(key) {
+  const match = LAYOUT_KEY_RE.exec(key);
+  if (!match)
+    return null;
+  const prefix = match[1]?.replace(/\/$/, "");
+  if (!prefix)
+    return [];
+  return prefix.split("/").filter(Boolean);
+}
+function implicitRootLayoutKey(segments) {
+  return `./${[...segments, "__root_layout"].join("/")}.tsx`;
+}
+function implicitRootLayoutAbsPath(appCwdPath, segments) {
+  const filename = segments.length ? `${segments.join("__")}__root_layout.tsx` : "__root_layout.tsx";
+  return path6.join(path6.resolve(appCwdPath), IMPLICIT_LAYOUT_DIR, filename);
+}
+function isRootBoundarySegments(segments, basePaths) {
+  const firstVisibleIndex = segments.findIndex((segment) => !/^\(.+\)$/.test(segment));
+  if (firstVisibleIndex === -1)
+    return segments.length <= 1;
+  if (segments.slice(firstVisibleIndex + 1).some((segment) => /^\(.+\)$/.test(segment)))
+    return false;
+  const visible = segments.slice(firstVisibleIndex);
+  const allowedBasePaths = new Set([...basePaths].map((basePath) => basePath.trim()).filter(Boolean));
+  return visible.length === 1 && (firstVisibleIndex > 0 || allowedBasePaths.has(visible[0] ?? ""));
+}
+function findRootBoundaries(pageKeys, appCwdPath, basePaths) {
+  const boundaries = new Map;
+  for (const key of pageKeys) {
+    const segments = getRootBoundarySegments(key);
+    if (!segments)
+      continue;
+    if (!isRootBoundarySegments(segments, basePaths))
+      continue;
+    const id = segments.join("/");
+    boundaries.set(id, {
+      sourceKey: key,
+      sourceAbsPath: path6.resolve(appCwdPath, "page", key.replace(/^\.\//, "")),
+      segments
+    });
+  }
+  if (boundaries.size === 0)
+    boundaries.set("", { sourceKey: null, sourceAbsPath: null, segments: [] });
+  return [...boundaries.values()].sort((a, b) => a.segments.join("/").localeCompare(b.segments.join("/")));
+}
+function hasAncestorRootBoundary(boundary, boundaries) {
+  return boundaries.some((candidate) => candidate !== boundary && candidate.segments.length < boundary.segments.length && candidate.segments.every((segment, index) => boundary.segments[index] === segment));
+}
+function findExplicitRootLayoutAbsPath(pageKeys, appCwdPath) {
+  const rootLayoutKey = pageKeys.find((key) => {
+    const segments = getRootBoundarySegments(key);
+    return segments !== null && segments.length === 0;
+  });
+  return rootLayoutKey ? path6.resolve(appCwdPath, "page", rootLayoutKey.replace(/^\.\//, "")) : null;
+}
+async function assertEnvClientConvention(appCwdPath, appName) {
+  const envPath = path6.join(appCwdPath, "env", "env.client.ts");
+  if (!await Bun.file(envPath).exists()) {
+    throw new Error(`[route-convention] app "${appName}" must provide env/env.client.ts exporting "env" for generated System.Provider`);
   }
-  akanPackageJson = {
-    name: "akanjs",
-    version: "0.0.0",
-    description: "akanjs",
-    dependencies: {}
-  };
-  return akanPackageJson;
 }
-function mergeImageConfig(config = {}) {
-  return {
-    ...DEFAULT_AKAN_IMAGE_CONFIG,
-    ...config,
-    deviceSizes: config.deviceSizes ?? DEFAULT_AKAN_IMAGE_CONFIG.deviceSizes,
-    imageSizes: config.imageSizes ?? DEFAULT_AKAN_IMAGE_CONFIG.imageSizes,
-    formats: config.formats ?? DEFAULT_AKAN_IMAGE_CONFIG.formats,
-    qualities: config.qualities ?? DEFAULT_AKAN_IMAGE_CONFIG.qualities,
-    remotePatterns: config.remotePatterns ?? DEFAULT_AKAN_IMAGE_CONFIG.remotePatterns,
-    localPatterns: config.localPatterns ?? DEFAULT_AKAN_IMAGE_CONFIG.localPatterns
-  };
+async function writeGeneratedDictionaryMacroFile(appCwdPath, appName) {
+  const absPath = path6.join(path6.resolve(appCwdPath), IMPLICIT_DICT_DIR, "useDict.ts");
+  await Bun.write(absPath, `import { getAllDictionary } from "@apps/${appName}/lib/dict" with { type: "macro" };
+
+export const allDictionary = getAllDictionary();
+`);
+  return absPath;
+}
+async function writeGeneratedRootLayoutFile(opts) {
+  await assertEnvClientConvention(opts.appCwdPath, opts.appName);
+  const dictMacroAbsPath = opts.includeSystemProvider ? await writeGeneratedDictionaryMacroFile(opts.appCwdPath, opts.appName) : null;
+  const absPath = implicitRootLayoutAbsPath(opts.appCwdPath, opts.boundary.segments);
+  const dictMacroSpecifier = dictMacroAbsPath ? importSpecifier(absPath, dictMacroAbsPath) : null;
+  const sourceSpecifier = opts.boundary.sourceAbsPath ? importSpecifier(absPath, opts.boundary.sourceAbsPath) : null;
+  const inheritedSourceAbsPath = opts.rootSourceAbsPath && opts.rootSourceAbsPath !== opts.boundary.sourceAbsPath ? opts.rootSourceAbsPath : null;
+  const inheritedSourceSpecifier = inheritedSourceAbsPath ? importSpecifier(absPath, inheritedSourceAbsPath) : null;
+  const clientImport = opts.includeStInit ? `import { st } from "@apps/${opts.appName}/client";
+void st;
+` : `import "@apps/${opts.appName}/client";
+`;
+  const inheritedLabel = inheritedSourceAbsPath ? path6.relative(opts.appCwdPath, inheritedSourceAbsPath) : "";
+  const inheritedImport = inheritedSourceSpecifier ? `import * as inheritedModule from ${JSON.stringify(inheritedSourceSpecifier)};
+const inheritedLayout = resolveRouteModule(inheritedModule as never, ${JSON.stringify(inheritedLabel)}).module as LayoutModule;
+` : `const inheritedLayout: LayoutModule = {};
+`;
+  const prefix = opts.boundary.segments.find((segment) => !/^\(.+\)$/.test(segment)) ?? null;
+  const userLabel = opts.boundary.sourceAbsPath ? path6.relative(opts.appCwdPath, opts.boundary.sourceAbsPath) : "";
+  const userImport = sourceSpecifier ? `import * as userModule from ${JSON.stringify(sourceSpecifier)};
+const userLayout = resolveRouteModule(userModule as never, ${JSON.stringify(userLabel)}).module as LayoutModule;
+const UserLayout = userLayout.default as (props: LayoutProps) => ReactNode | Promise<ReactNode>;
+` : `const UserLayout = ({ children }: LayoutProps) => children;
+const userLayout: LayoutModule = {};
+`;
+  const isAsyncUserLayout = opts.boundary.sourceAbsPath ? await AsyncDefaultExportDetector.detect(opts.boundary.sourceAbsPath) : false;
+  const userLayoutElement = "<UserLayout params={params} searchParams={searchParams}>{children}</UserLayout>";
+  const layoutSignature = isAsyncUserLayout ? "export default async function GeneratedLayout" : "export default function GeneratedLayout";
+  const layoutBinding = isAsyncUserLayout ? `  const layout =
+    process.env.AKAN_PUBLIC_RENDER_ENV === "csr"
+      ? await UserLayout({ params, searchParams, children })
+      : ${userLayoutElement};
+` : "";
+  const layoutChild = isAsyncUserLayout ? "{layout}" : userLayoutElement;
+  const layoutReturn = isAsyncUserLayout ? "layout" : userLayoutElement;
+  const headLayouts = opts.includeSystemProvider ? "[inheritedLayout, userLayout]" : "[userLayout]";
+  const layoutExports = `export async function generateHead(props: PageProps) {
+  const heads = await Promise.all(
+    ${headLayouts}.map((layout) => (layout.generateHead ? layout.generateHead(props) : layout.head)),
+  );
+  return RouteHead.mergeNodes(heads);
 }
 
-class AkanLibConfig {
-  lib;
-  externalLibs;
-  trustedDependencies;
-  bin;
-  docker;
-  assets;
-  plugins;
-  constructor(lib, config, plugins = []) {
-    this.lib = lib;
-    this.externalLibs = config?.externalLibs ?? [];
-    const owner = `libs/${lib.name}/akan.config.ts`;
-    this.trustedDependencies = normalizePackageNames(config?.trustedDependencies, owner);
-    this.bin = AkanBin.parse(config?.bin, owner, lib.cwdPath);
-    this.docker = { preRuns: config?.docker?.preRuns ?? [], postRuns: config?.docker?.postRuns ?? [] };
-    this.assets = { keepFonts: normalizeKeepFonts(config?.assets?.keepFonts) };
-    this.plugins = plugins;
+export const NotFound = userLayout.NotFound ?? inheritedLayout.NotFound;
+export const Error = userLayout.Error ?? inheritedLayout.Error;
+export const pageConfig = userLayout.pageConfig ?? inheritedLayout.pageConfig;
+export const Loading = userLayout.Loading;
+
+${layoutSignature}({ children, params, searchParams }: LayoutProps) {
+${layoutBinding}  return `;
+  const source = opts.includeSystemProvider ? `import type { LayoutModule, LayoutProps, PageProps } from "akanjs/client";
+import { loadFonts, resolveRouteModule, RouteHead } from "akanjs/client";
+import type { ReactNode } from "react";
+import { System } from "akanjs/ui";
+import { env } from "@apps/${opts.appName}/env/env.client";
+import { allDictionary } from ${JSON.stringify(dictMacroSpecifier)};
+${clientImport}${inheritedImport}${userImport}
+const userFonts = userLayout.fonts ?? inheritedLayout.fonts ?? [];
+const defaultFonts = userFonts.filter((font) => font.default);
+if (defaultFonts.length > 1) throw new Error("[route-convention] only one default font is allowed per root layout");
+const defaultFont = defaultFonts[0];
+const defaultFontClassName = defaultFont ? (defaultFont.className ?? \`font-\${defaultFont.name}\`) : undefined;
+export const theme = userLayout.theme ?? inheritedLayout.theme;
+export const viewport = userLayout.viewport ?? inheritedLayout.viewport;
+export const manifest = userLayout.manifest ?? inheritedLayout.manifest;
+
+${layoutExports}(
+    <System.Provider
+      of={GeneratedLayout as never}
+      appName=${JSON.stringify(opts.appName)}
+      ${prefix ? `prefix=${JSON.stringify(prefix)}
+      ` : ""}params={params}
+      manifest={manifest}
+      env={env}
+      theme={theme}
+      viewport={viewport}
+      fonts={loadFonts(userFonts)}
+      className={defaultFontClassName}
+      layoutStyle={userLayout.layoutStyle ?? inheritedLayout.layoutStyle}
+      reconnect={userLayout.reconnect ?? inheritedLayout.reconnect ?? false}
+      wsConnect={userLayout.wsConnect ?? inheritedLayout.wsConnect ?? true}
+      allDictionary={process.env.AKAN_PUBLIC_RENDER_ENV === "ssr" ? allDictionary : undefined}
+    >
+      ${layoutChild}
+    </System.Provider>
+  );
+}
+` : `import type { LayoutModule, LayoutProps, PageProps } from "akanjs/client";
+import { resolveRouteModule, RouteHead } from "akanjs/client";
+import type { ReactNode } from "react";
+${inheritedImport}${userImport}
+${layoutExports}${layoutReturn};
+}
+`;
+  await Bun.write(absPath, source);
+  return absPath;
+}
+async function resolveSsrPageEntries(opts) {
+  const absPageDir = path6.resolve(opts.appCwdPath, "page");
+  const hasSt = await Bun.file(path6.join(opts.appCwdPath, "lib", "st.ts")).exists();
+  const basePaths = opts.basePaths ?? [];
+  const rootSourceAbsPath = findExplicitRootLayoutAbsPath(opts.pageKeys, opts.appCwdPath);
+  const rootBoundaries = findRootBoundaries(opts.pageKeys, opts.appCwdPath, basePaths);
+  const rootLayoutKeys = new Set(opts.pageKeys.filter((key) => {
+    const segments = getRootBoundarySegments(key);
+    return segments !== null && isRootBoundarySegments(segments, basePaths);
+  }));
+  const base = await Promise.all(opts.pageKeys.filter((key) => !rootLayoutKeys.has(key)).map(async (key) => {
+    const userAbsPath = path6.resolve(absPageDir, key);
+    if (OVERRIDES_KEY_RE.test(key)) {
+      const moduleAbsPath = await writeGeneratedOverridesLayoutFile({
+        appCwdPath: opts.appCwdPath,
+        key,
+        userAbsPath
+      });
+      return { key, moduleAbsPath, seedAbsPaths: [userAbsPath] };
+    }
+    return { key, moduleAbsPath: userAbsPath };
+  }));
+  const generated = await Promise.all(rootBoundaries.map(async (boundary) => ({
+    key: implicitRootLayoutKey(boundary.segments),
+    moduleAbsPath: await writeGeneratedRootLayoutFile({
+      appCwdPath: opts.appCwdPath,
+      appName: opts.appName,
+      boundary,
+      rootSourceAbsPath,
+      includeStInit: hasSt && boundary.segments.length === 0,
+      includeSystemProvider: !hasAncestorRootBoundary(boundary, rootBoundaries)
+    }),
+    seedAbsPaths: [...new Set([boundary.sourceAbsPath, rootSourceAbsPath].filter((absPath) => absPath !== null))]
+  })));
+  const appCwdAbsPath = path6.resolve(opts.appCwdPath);
+  await Promise.all([
+    pruneGeneratedFiles(path6.join(appCwdAbsPath, IMPLICIT_OVERRIDES_DIR), base.filter(({ key }) => OVERRIDES_KEY_RE.test(key)).map(({ moduleAbsPath }) => moduleAbsPath)),
+    pruneGeneratedFiles(path6.join(appCwdAbsPath, IMPLICIT_LAYOUT_DIR), generated.map(({ moduleAbsPath }) => moduleAbsPath))
+  ]);
+  return [...base, ...generated].sort((a, b) => a.key.localeCompare(b.key));
+}
+async function resolveSsrPageEntriesForApp(app, pageKeys) {
+  const config = await app.getConfig();
+  return resolveSsrPageEntries({ appCwdPath: app.cwdPath, appName: app.name, pageKeys, basePaths: config.basePaths });
+}
+
+// pkgs/@akanjs/devkit/codegenLock.ts
+import { mkdir, open, readFile, rm as rm2, stat } from "fs/promises";
+import path7 from "path";
+import { Logger as Logger2 } from "akanjs/common";
+
+class CodegenLock {
+  static fileName = "codegen.lock";
+  static waitTimeoutMs = 1e4;
+  static unknownHolderStaleMs = 60000;
+  static #pollMs = 25;
+  static #logger = new Logger2("CodegenLock");
+  static #queue = Promise.resolve();
+  static pathIn(workspaceRoot) {
+    return path7.join(workspaceRoot, "local", ".akan", CodegenLock.fileName);
   }
-  static async from(lib, { bustImportCache = false } = {}) {
-    const configImp = await AkanAppConfig.importConfigModule(lib.cwdPath, { bustImportCache });
-    const resolved = typeof configImp === "function" ? configImp(lib) : configImp;
-    const { plugins, ...config } = resolved ?? {};
-    if ("pipeline" in config)
-      throw new LibConfigRefusal(`libs/${lib.name}/akan.config.ts declares \`pipeline\`, which a lib does not take: pipelines belong to apps and the workspace root, and a lib's build-time work goes in an akan build plugin.`);
-    if ("subspace" in config)
-      throw new LibConfigRefusal(`libs/${lib.name}/akan.config.ts declares \`subspace\`, a workspace setting: it belongs in the workspace root akan.config.ts.`);
-    return new AkanLibConfig(lib, config, plugins ?? []);
+  static async run(workspaceRoot, label, fn) {
+    const ahead = CodegenLock.#queue;
+    let done;
+    CodegenLock.#queue = new Promise((resolve) => {
+      done = resolve;
+    });
+    try {
+      await CodegenLock.#waitForQueue(ahead, label);
+      return await CodegenLock.#withFileLock(workspaceRoot, label, fn);
+    } finally {
+      done();
+    }
+  }
+  static async#waitForQueue(ahead, label) {
+    let timer = null;
+    const expired = new Promise((resolve) => {
+      timer = setTimeout(() => resolve("expired"), CodegenLock.waitTimeoutMs);
+    });
+    try {
+      if (await Promise.race([ahead.then(() => "done"), expired]) === "expired")
+        CodegenLock.#logger.warn(`codegen lock queued past ${CodegenLock.waitTimeoutMs}ms in this process; continuing without waiting (${label})`);
+    } finally {
+      if (timer)
+        clearTimeout(timer);
+    }
   }
-}
-//! need to refactor
-var shiftBuildNum = async (app, delta) => {
-  const { buildNum } = (await AkanAppConfig.from(app)).native;
-  const akanConfigPath = path7.join(app.cwdPath, "akan.config.ts");
-  const akanConfig = fs2.readFileSync(akanConfigPath, "utf8");
-  fs2.writeFileSync(akanConfigPath, akanConfig.replace(`buildNum: ${buildNum}`, `buildNum: ${buildNum + delta}`));
-};
-var increaseBuildNum = async (app) => await shiftBuildNum(app, 1);
-var decreaseBuildNum = async (app) => await shiftBuildNum(app, -1);
-// pkgs/@akanjs/devkit/akanConfig/akanWorkspaceConfig.ts
-import path8 from "path";
-class AkanWorkspaceConfig {
-  static fileName = "akan.config.ts";
-  static #keys = ["subspace", "pipeline", "cloud"];
-  static #loopbackHosts = ["localhost", "127.0.0.1", "[::1]"];
-  static async from(workspace, { bustImportCache = false } = {}) {
-    const file = path8.join(workspace.workspaceRoot, AkanWorkspaceConfig.fileName);
-    if (!await FileSys2.fileExists(file))
-      return new AkanWorkspaceConfig(null, {});
-    const input = await AkanAppConfig.importConfigModule(workspace.workspaceRoot, { bustImportCache });
-    return new AkanWorkspaceConfig(file, input);
+  static async#withFileLock(workspaceRoot, label, fn) {
+    const lockPath = CodegenLock.pathIn(workspaceRoot);
+    await mkdir(path7.dirname(lockPath), { recursive: true }).catch(() => {
+      return;
+    });
+    const held = await CodegenLock.#acquire(lockPath, label);
+    try {
+      return await fn();
+    } finally {
+      if (held)
+        await rm2(lockPath, { force: true }).catch(() => {
+          return;
+        });
+    }
   }
-  file;
-  subspace;
-  pipeline;
-  cloudHost;
-  constructor(file, input) {
-    this.file = file;
-    if (typeof input !== "object" || input === null || Array.isArray(input))
-      throw new Error("The workspace root akan.config.ts must default-export a WorkspaceConfig object.");
-    for (const key of Object.keys(input))
-      if (!AkanWorkspaceConfig.#keys.includes(key))
-        throw new Error(`The workspace root akan.config.ts declares \`${key}\`, which it does not take: it holds \`subspace\`, \`pipeline\` and \`cloud\`, and app or lib settings belong in apps/<app>/akan.config.ts or libs/<lib>/akan.config.ts.`);
-    const config = input;
-    this.subspace = config.subspace ?? null;
-    this.pipeline = config.pipeline ?? null;
-    this.cloudHost = AkanWorkspaceConfig.#cloudHost(config.cloud);
+  static async#acquire(lockPath, label) {
+    const deadline = Date.now() + CodegenLock.waitTimeoutMs;
+    for (;; ) {
+      const handle = await open(lockPath, "wx").catch(() => null);
+      if (handle) {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, at: Date.now(), label })).catch(() => {
+          return;
+        });
+        await handle.close().catch(() => {
+          return;
+        });
+        return true;
+      }
+      if (await CodegenLock.#reclaimIfAbandoned(lockPath))
+        continue;
+      if (Date.now() >= deadline) {
+        CodegenLock.#logger.warn(`codegen lock at ${lockPath} held past ${CodegenLock.waitTimeoutMs}ms; continuing without it (${label})`);
+        return false;
+      }
+      await Bun.sleep(CodegenLock.#pollMs);
+    }
   }
-  static #cloudHost(cloud) {
-    if (cloud === undefined)
-      return null;
-    const refuse = (why) => {
-      throw new Error(`The workspace root akan.config.ts has cloud ${why}.`);
-    };
-    if (typeof cloud !== "object" || cloud === null || Array.isArray(cloud))
-      return refuse("that is not an object");
-    const unknown = Object.keys(cloud).filter((key) => key !== "host");
-    if (unknown.length)
-      return refuse(`keys it does not take: ${unknown.join(", ")} (only \`host\`)`);
-    const { host } = cloud;
-    if (host === undefined)
+  static async#reclaimIfAbandoned(lockPath) {
+    const info = await stat(lockPath).catch(() => null);
+    if (!info)
+      return true;
+    const holder = CodegenLock.#parseHolder(await readFile(lockPath, "utf8").catch(() => ""));
+    if (holder) {
+      if (CodegenLock.#isAlive(holder.pid))
+        return false;
+    } else if (Date.now() - info.mtimeMs < CodegenLock.unknownHolderStaleMs)
+      return false;
+    await rm2(lockPath, { force: true }).catch(() => {
+      return;
+    });
+    return true;
+  }
+  static #parseHolder(raw) {
+    try {
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.pid !== "number" || typeof parsed.at !== "number")
+        return null;
+      return { pid: parsed.pid, at: parsed.at, label: typeof parsed.label === "string" ? parsed.label : "" };
+    } catch {
       return null;
-    const url = typeof host === "string" && URL.canParse(host) ? new URL(host) : null;
-    if (!url || url.search || url.hash || url.username || url.password)
-      return refuse(`.host ${JSON.stringify(host)}, which is not a URL like "https://cloud.example.com"`);
-    if (url.protocol !== "https:" && !(url.protocol === "http:" && AkanWorkspaceConfig.#loopbackHosts.includes(url.hostname)))
-      return refuse(`.host ${JSON.stringify(host)}: https only, or http on this computer`);
-    return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+    }
+  }
+  static #isAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+      return false;
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (error) {
+      return error.code === "EPERM";
+    }
   }
 }
+
 // pkgs/@akanjs/devkit/jsonFormatter.ts
-import path9 from "path";
+import path8 from "path";
 
 class JsonFormatter {
   static lineWidth = 120;
   static stringify(value, filePath) {
     const json = JSON.stringify(value, null, 2);
-    if (path9.basename(filePath) === "package.json")
+    if (path8.basename(filePath) === "package.json")
       return `${json}
 `;
     return `${JsonFormatter.#print(JSON.parse(json), 0, { column: 0, trailing: 0 })}
@@ -1900,7 +1773,7 @@ ${"  ".repeat(depth)}]`;
 // pkgs/@akanjs/devkit/linter.ts
 import { spawn } from "child_process";
 import { existsSync as existsSync2, readFileSync } from "fs";
-import path10 from "path";
+import path9 from "path";
 import chalk from "chalk";
 var parseBiomeReport = (output) => {
   for (let start = output.indexOf("{");start !== -1; start = output.indexOf("{", start + 1)) {
@@ -1966,13 +1839,13 @@ class Linter {
   #biomeBin;
   constructor(cwdPath) {
     this.lintRoot = this.#findBiomeRootPath(cwdPath);
-    this.configPath = Linter.#configPathIn(this.lintRoot) ?? path10.join(this.lintRoot, "biome.json");
-    const localBiomeBin = path10.join(this.lintRoot, "node_modules", ".bin", Linter.biomeBinName);
+    this.configPath = Linter.#configPathIn(this.lintRoot) ?? path9.join(this.lintRoot, "biome.json");
+    const localBiomeBin = path9.join(this.lintRoot, "node_modules", ".bin", Linter.biomeBinName);
     this.#biomeBin = existsSync2(localBiomeBin) ? localBiomeBin : "biome";
   }
   static #configPathIn(dir) {
     for (const fileName of BIOME_CONFIG_FILES) {
-      const configPath = path10.join(dir, fileName);
+      const configPath = path9.join(dir, fileName);
       if (existsSync2(configPath))
         return configPath;
     }
@@ -1981,19 +1854,19 @@ class Linter {
   #findBiomeRootPath(dir) {
     if (Linter.#configPathIn(dir))
       return dir;
-    const parentDir = path10.dirname(dir);
+    const parentDir = path9.dirname(dir);
     if (parentDir === dir)
       throw new Error(`biome.json not found from ${dir}`);
     return this.#findBiomeRootPath(parentDir);
   }
   #toBiomePath(filePath) {
-    const relativePath = path10.relative(this.lintRoot, filePath);
-    if (!relativePath.startsWith("..") && !path10.isAbsolute(relativePath))
+    const relativePath = path9.relative(this.lintRoot, filePath);
+    if (!relativePath.startsWith("..") && !path9.isAbsolute(relativePath))
       return relativePath;
     return filePath;
   }
   #resolveFilePath(filePath) {
-    return path10.isAbsolute(filePath) ? filePath : path10.join(this.lintRoot, filePath);
+    return path9.isAbsolute(filePath) ? filePath : path9.join(this.lintRoot, filePath);
   }
   async#runBiome(args, input) {
     return await new Promise((resolve, reject) => {
@@ -2018,7 +1891,7 @@ class Linter {
     const diagnosticPath = diagnostic.location?.path;
     if (!diagnosticPath)
       return fallbackFilePath;
-    return path10.isAbsolute(diagnosticPath) ? diagnosticPath : path10.join(this.lintRoot, diagnosticPath);
+    return path9.isAbsolute(diagnosticPath) ? diagnosticPath : path9.join(this.lintRoot, diagnosticPath);
   }
   #createLintMessage(diagnostic) {
     const start = diagnostic.location?.start;
@@ -2354,7 +2227,7 @@ class ManifestDependencies {
 
 // pkgs/@akanjs/devkit/repoIdentity.ts
 import { execFileSync } from "child_process";
-import path11 from "path";
+import path10 from "path";
 var resolved = new Map;
 var readRemoteName = (workspaceRoot) => {
   try {
@@ -2372,13 +2245,14 @@ var resolveRepoName = (workspaceRoot) => {
   const cached = resolved.get(workspaceRoot);
   if (cached)
     return cached;
-  const repoName = readRemoteName(workspaceRoot) ?? path11.basename(workspaceRoot);
+  const repoName = readRemoteName(workspaceRoot) ?? path10.basename(workspaceRoot);
   resolved.set(workspaceRoot, repoName);
   return repoName;
 };
 
 // pkgs/@akanjs/devkit/scanInfo.ts
-import path12 from "path";
+import { createHash } from "crypto";
+import path11 from "path";
 
 // pkgs/@akanjs/devkit/workspaceLayout.ts
 var appRootAllowedFiles = new Set([
@@ -2499,10 +2373,10 @@ var moduleUiFileTypes = {
   service: new Set(["Util", "Zone"]),
   scalar: new Set(["Template", "Unit"])
 };
-var createDependencyScanner = async (exec) => (await import("./dependencyScanner-06z2dmrr.js")).TypeScriptDependencyScanner.from(exec);
-var getScanPath = (exec, relativePath) => path12.posix.join(`${exec.type}s`, exec.name, relativePath.split(path12.sep).join("/"));
+var createDependencyScanner = async (exec) => (await import("./dependencyScanner-3afj2vt1.js")).TypeScriptDependencyScanner.from(exec);
+var getScanPath = (exec, relativePath) => path11.posix.join(`${exec.type}s`, exec.name, relativePath.split(path11.sep).join("/"));
 var getModuleNameFromPath = (kind, modulePath) => {
-  const dirname = path12.basename(modulePath);
+  const dirname = path11.basename(modulePath);
   return kind === "service" ? dirname.replace(/^_+/, "") : dirname;
 };
 async function assertScanConvention(exec, libRoot) {
@@ -2523,28 +2397,28 @@ async function assertScanConvention(exec, libRoot) {
     for (const filename of await exec.readdir(facet)) {
       const shadow = facetIndexShadowOf(`${facet}/${filename}`);
       if (shadow)
-        addViolation(path12.join(facet, filename), shadow);
+        addViolation(path11.join(facet, filename), shadow);
     }
   if (exec.type === "lib")
     for (const { relativePath, reason } of await exec.getPageConventionViolations())
       addViolation(relativePath, reason);
   for (const filename of libRoot.files)
     if (!isAllowedLibFacetRootFile(filename))
-      addViolation(path12.join("lib", filename), libFacetRootHintOf(filename) ?? "unsupported lib facet root file");
+      addViolation(path11.join("lib", filename), libFacetRootHintOf(filename) ?? "unsupported lib facet root file");
   for (const dirname of libRoot.dirs)
     if (dirname.startsWith("__") && !internalLibDirs.has(dirname))
-      addViolation(path12.join("lib", dirname), "unsupported internal lib folder");
+      addViolation(path11.join("lib", dirname), "unsupported internal lib folder");
   const databaseDirs = libRoot.dirs.filter((dirname) => !dirname.startsWith("_"));
   const serviceDirs = libRoot.dirs.filter((dirname) => dirname.startsWith("_") && !dirname.startsWith("__"));
   const scalarDirs = await exec.readdir("lib/__scalar");
   await Promise.all([
-    ...databaseDirs.map((dirname) => validateModuleFiles(exec, violations, "database", path12.join("lib", dirname))),
-    ...serviceDirs.map((dirname) => validateModuleFiles(exec, violations, "service", path12.join("lib", dirname))),
-    ...scalarDirs.map((dirname) => validateModuleFiles(exec, violations, "scalar", path12.join("lib/__scalar", dirname)))
+    ...databaseDirs.map((dirname) => validateModuleFiles(exec, violations, "database", path11.join("lib", dirname))),
+    ...serviceDirs.map((dirname) => validateModuleFiles(exec, violations, "service", path11.join("lib", dirname))),
+    ...scalarDirs.map((dirname) => validateModuleFiles(exec, violations, "scalar", path11.join("lib/__scalar", dirname)))
   ]);
   if (violations.length > 0) {
     throw new Error(`[scan-convention]
-${violations.sort().map((violation) => `- ${violation}`).join(`
+${violations.sort((a, b) => a < b ? -1 : a > b ? 1 : 0).map((violation) => `- ${violation}`).join(`
 `)}`);
   }
 }
@@ -2552,11 +2426,11 @@ async function validateModuleFiles(exec, violations, kind, modulePath) {
   const { files, dirs } = await exec.getFilesAndDirs(modulePath);
   const moduleName = getModuleNameFromPath(kind, modulePath);
   dirs.forEach((dirname) => {
-    violations.push(`${getScanPath(exec, path12.join(modulePath, dirname))}: unsupported module folder`);
+    violations.push(`${getScanPath(exec, path11.join(modulePath, dirname))}: unsupported module folder`);
   });
   const uiModuleName = moduleName[0].toUpperCase() + moduleName.slice(1);
   for (const filename of files) {
-    const scanPath = getScanPath(exec, path12.join(modulePath, filename));
+    const scanPath = getScanPath(exec, path11.join(modulePath, filename));
     if (filename === "index.ts" || filename === "index.tsx")
       continue;
     if (filename === `${moduleName}.abstract.md`)
@@ -2631,16 +2505,16 @@ class ScanInfo {
       }
     };
     await Promise.all([
-      ...databaseDirs.map((name) => collect(path12.join("lib", name), name, "databases")),
-      ...serviceDirs.map((dirname) => collect(path12.join("lib", dirname), dirname.slice(1), "services")),
-      ...scalarDirs.map((name) => collect(path12.join("lib/__scalar", name), name, "scalars"))
+      ...databaseDirs.map((name) => collect(path11.join("lib", name), name, "databases")),
+      ...serviceDirs.map((dirname) => collect(path11.join("lib", dirname), dirname.slice(1), "services")),
+      ...scalarDirs.map((name) => collect(path11.join("lib/__scalar", name), name, "scalars"))
     ]);
     const routes = exec.type === "lib" ? [] : await exec.getPageKeys();
     const common = {
       name: exec.name,
       type: exec.type,
       repoName: exec.workspace.repoName,
-      serveDomain: WorkspaceExecutor.getBaseDevEnv(path12.join(exec.workspace.workspaceRoot, ".env")).serveDomain,
+      serveDomain: WorkspaceExecutor.getBaseDevEnv(path11.join(exec.workspace.workspaceRoot, ".env")).serveDomain,
       files,
       libDeps,
       pkgDeps,
@@ -2701,10 +2575,13 @@ class ScanInfo {
 var isAkanFrameworkDependency = (dep) => dep === "akanjs" || dep.startsWith("akanjs/");
 
 class AppInfo extends ScanInfo {
+  static migrationDir = "script/migration";
+  static #migrationIdRe = /^\d{12}_[A-Za-z][A-Za-z0-9]*$/;
   type = "app";
   exec;
   akanConfig;
   libDeps;
+  migrations;
   static appInfos = new Map;
   static async fromExecutor(exec, options = {}) {
     const existingAppInfo = AppInfo.appInfos.get(exec.name);
@@ -2716,16 +2593,20 @@ class AppInfo extends ScanInfo {
       const libExecutor = LibExecutor.from(exec, libName);
       LibInfo.libInfos.set(libName, await LibInfo.fromExecutor(libExecutor));
     }));
-    const libDeps = await AppInfo.#getAllLibDeps(exec, scanResult.libDeps);
-    const appInfo = new AppInfo(exec, scanResult, libDeps);
+    const [libDeps, migrations] = await Promise.all([
+      AppInfo.#getAllLibDeps(exec, scanResult.libDeps),
+      AppInfo.scanMigrations(exec)
+    ]);
+    const appInfo = new AppInfo(exec, scanResult, libDeps, migrations);
     AppInfo.appInfos.set(exec.name, appInfo);
     return appInfo;
   }
-  constructor(exec, scanResult, libDeps) {
+  constructor(exec, scanResult, libDeps, migrations = []) {
     super(scanResult);
     this.exec = exec;
     this.akanConfig = scanResult.akanConfig;
     this.libDeps = libDeps;
+    this.migrations = migrations;
   }
   getScanResult() {
     return this.scanResult;
@@ -2733,6 +2614,18 @@ class AppInfo extends ScanInfo {
   setRoutes(routes) {
     this.scanResult.routes = routes;
   }
+  static async scanMigrations(exec) {
+    const files = (await exec.readdir(AppInfo.migrationDir)).filter((file) => file.endsWith(".ts") && !/\.(test|spec|d)\.ts$/.test(file));
+    return await Promise.all(files.map(async (file) => {
+      const id = file.slice(0, -".ts".length);
+      if (!AppInfo.#migrationIdRe.test(id))
+        throw new Error(`${AppInfo.migrationDir}/${file}: a migration is named <yyyyMMddHHmm>_<camelName>.ts; create one with \`akan create-migration\``);
+      const source = (await exec.readFile(`${AppInfo.migrationDir}/${file}`)).replace(/^\uFEFF/, "").replaceAll(`\r
+`, `
+`);
+      return { id, checksum: createHash("sha256").update(source).digest("hex") };
+    }));
+  }
   static async#getAllLibDeps(exec, libDeps, libSet = new Set) {
     await Promise.all(libDeps.map(async (libName) => {
       if (libSet.has(libName))
@@ -2868,6 +2761,136 @@ class WorkspaceInfo {
   }
 }
 
+// pkgs/@akanjs/devkit/spinner.ts
+import ora from "ora";
+
+class Spinner {
+  static padding = 12;
+  static oraOptions = { discardStdin: false };
+  static canAnimate(stream = process.stderr) {
+    return !stream.isTTY || stream.columns > 0;
+  }
+  spinner;
+  stopWatch = null;
+  startAt = new Date;
+  prefix;
+  message;
+  enableSpin;
+  constructor(message, { prefix = "", indent = 0, enableSpin = true } = {}) {
+    Spinner.padding = Math.max(Spinner.padding, prefix.length);
+    this.prefix = prefix;
+    this.message = message;
+    this.spinner = ora({ ...Spinner.oraOptions, text: message });
+    this.spinner.prefixText = prefix.padStart(Spinner.padding, " ");
+    this.spinner.indent = indent;
+    this.enableSpin = enableSpin && Spinner.canAnimate();
+  }
+  start() {
+    this.startAt = new Date;
+    if (this.enableSpin) {
+      this.spinner.start();
+      this.stopWatch = setInterval(() => {
+        this.spinner.prefixText = this.prefix.padStart(Spinner.padding, " ");
+        this.spinner.text = `${this.message} (${this.#getElapsedTimeStr({ floor: true })})`;
+      }, 1000);
+    } else
+      this.spinner.info();
+    return this;
+  }
+  succeed(message) {
+    this.spinner.succeed(`${message} (${this.#getElapsedTimeStr()})`);
+    this.#reset();
+  }
+  fail(message) {
+    this.spinner.fail(`${message} (${this.#getElapsedTimeStr()})`);
+    this.#reset();
+  }
+  isSpinning() {
+    return this.spinner.isSpinning;
+  }
+  #reset() {
+    if (this.stopWatch)
+      clearInterval(this.stopWatch);
+    this.stopWatch = null;
+  }
+  #getElapsedTimeStr({ floor = false } = {}) {
+    const ms = Date.now() - this.startAt.getTime();
+    if (ms < 1000)
+      return `${ms}ms`;
+    const s = Math.floor(ms / 1000);
+    if (s < 60)
+      return `${floor ? Math.floor(ms / 1000) : Math.floor(ms / 100) / 10}s`;
+    const m = Math.floor(s / 60);
+    return `${m}m ${s % 60}s`;
+  }
+}
+
+// pkgs/@akanjs/devkit/typecheck/projectTypecheck.ts
+import { mkdir as mkdir2, rm as rm3 } from "fs/promises";
+import path12 from "path";
+
+class ProjectTypecheck2 {
+  projectDir;
+  workspaceRoot;
+  env;
+  static #testIncludes = ["**/*.test.ts", "**/*.test.tsx", "**/*.spec.ts", "**/*.spec.tsx"];
+  static #excludes = [".akan/**", "node_modules/**", "local/**"];
+  constructor(projectDir, workspaceRoot, env) {
+    this.projectDir = projectDir;
+    this.workspaceRoot = workspaceRoot;
+    this.env = env;
+  }
+  get typecheckDir() {
+    return path12.join(this.projectDir, ".akan", "typecheck");
+  }
+  async run(entries, { clean = false, incremental = true, tests = false } = {}) {
+    const name = tests ? "tsconfig.tests" : "tsconfig";
+    await mkdir2(this.typecheckDir, { recursive: true });
+    const tsconfig = {
+      extends: "../../tsconfig.json",
+      compilerOptions: { noEmit: true, incremental, tsBuildInfoFile: `./${name}.tsbuildinfo` },
+      include: [...entries, ...tests ? ProjectTypecheck2.#testIncludes.map((glob) => `../../${glob}`) : []],
+      ...tests ? { exclude: ProjectTypecheck2.#excludes.map((glob) => `../../${glob}`) } : {},
+      references: []
+    };
+    const tsconfigPath = path12.join(this.typecheckDir, `${name}.json`);
+    await Bun.write(tsconfigPath, `${JSON.stringify(tsconfig, null, 2)}
+`);
+    if (clean)
+      await rm3(path12.join(this.typecheckDir, `${name}.tsbuildinfo`), { force: true });
+    await this.#check(tsconfigPath);
+    return tsconfigPath;
+  }
+  async#check(tsconfigPath) {
+    const proc = Bun.spawn([process.execPath, await ProjectTypecheck2.workerEntry(this.workspaceRoot)], {
+      cwd: this.workspaceRoot,
+      env: { ...this.env, AKAN_COMMAND_TYPE: "typecheck", AKAN_TYPECHECK_TSCONFIG: tsconfigPath },
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]);
+    if (exitCode !== 0)
+      throw new Error((stderr || stdout).trim() || `Typecheck failed with exit code ${exitCode}`);
+  }
+  static async workerEntry(workspaceRoot) {
+    const candidates = [
+      path12.join(workspaceRoot, "pkgs/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path12.join(workspaceRoot, "node_modules/@akanjs/devkit/typecheck/typecheck.proc.ts"),
+      path12.join(import.meta.dir, "typecheck.proc.js"),
+      path12.join(import.meta.dir, "typecheck.proc.ts"),
+      path12.join(import.meta.dir, "..", "typecheck.proc.js")
+    ];
+    for (const candidate of candidates)
+      if (await Bun.file(candidate).exists())
+        return candidate;
+    throw new Error(`[devkit] typecheck worker entry not found; looked in: ${candidates.join(", ")}`);
+  }
+}
+
 // pkgs/@akanjs/devkit/executors.ts
 var staticTemplateFileExtensions = new Set(".avif .bmp .cjs .css .eot .gif .html .ico .jpeg .jpg .js .json .map .md .mjs .mp3 .mp4 .ogg .otf .pdf .png .svg".split(" ").concat(".ttf .txt .wasm .wav .webm .webp .woff .woff2 .xml".split(" ")));
 var plainCommandArgPattern = process.platform === "win32" ? /^[\w@%+=:,./\\-]+$/ : /^[\w@%+=:,./-]+$/;
@@ -3052,20 +3075,20 @@ class Executor {
     const readPath = this.getPath(dirPath);
     try {
       const glob = new Bun.Glob("*");
-      return Array.from(glob.scanSync({ cwd: readPath, onlyFiles: false }));
+      return Array.from(glob.scanSync({ cwd: readPath, onlyFiles: false })).sort();
     } catch {
       return [];
     }
   }
   async getAllFiles(pattern = "**/*", { cwd } = {}) {
     const glob = new Bun.Glob(pattern);
-    return Array.from(glob.scanSync({ cwd: cwd ?? this.cwdPath, onlyFiles: true }));
+    return Array.from(glob.scanSync({ cwd: cwd ?? this.cwdPath, onlyFiles: true })).sort();
   }
   async getFilesAndDirs(dirPath) {
     const fullDirPath = this.getPath(dirPath);
     const glob = new Bun.Glob("*");
-    const files = Array.from(glob.scanSync({ cwd: fullDirPath, onlyFiles: true }));
-    const allEntries = Array.from(glob.scanSync({ cwd: fullDirPath, onlyFiles: false }));
+    const files = Array.from(glob.scanSync({ cwd: fullDirPath, onlyFiles: true })).sort();
+    const allEntries = Array.from(glob.scanSync({ cwd: fullDirPath, onlyFiles: false })).sort();
     const dirs = allEntries.filter((entry) => !files.includes(entry));
     return { files, dirs };
   }
@@ -3370,6 +3393,7 @@ class WorkspaceExecutor extends Executor {
     return new WorkspaceExecutor({ workspaceRoot, repoName });
   }
   static publicEnvPin = null;
+  static localServeDomain = "localhost";
   static getBaseDevEnv(envPath) {
     const sourceEnv = {
       ...envPath ? { ...process.env, ...parseEnvFile(envPath) } : process.env,
@@ -3378,12 +3402,9 @@ class WorkspaceExecutor extends Executor {
     const appName = sourceEnv.AKAN_PUBLIC_APP_NAME;
     const workspaceRoot = sourceEnv.AKAN_WORKSPACE_ROOT;
     const workspaceId = sourceEnv.AKAN_WORKSPACE_ID;
-    const repoName = sourceEnv.AKAN_PUBLIC_REPO_NAME;
-    if (!repoName)
-      throw new Error("AKAN_PUBLIC_REPO_NAME is not set");
-    const serveDomain = sourceEnv.AKAN_PUBLIC_SERVE_DOMAIN;
-    if (!serveDomain)
-      throw new Error("AKAN_PUBLIC_SERVE_DOMAIN is not set");
+    const repoName = sourceEnv.AKAN_PUBLIC_REPO_NAME || resolveRepoName(envPath ? path13.dirname(envPath) : workspaceRoot ?? process.cwd());
+    const serveDomain = sourceEnv.AKAN_PUBLIC_SERVE_DOMAIN || WorkspaceExecutor.localServeDomain;
+    const defaulted = ["AKAN_PUBLIC_REPO_NAME", "AKAN_PUBLIC_SERVE_DOMAIN"].filter((key) => !sourceEnv[key]);
     const portOffset = parseInt(sourceEnv.PORT_OFFSET ?? "0");
     const env = sourceEnv.AKAN_PUBLIC_ENV ?? "debug";
     if (!env)
@@ -3395,9 +3416,18 @@ class WorkspaceExecutor extends Executor {
       serveDomain,
       env,
       portOffset,
-      workspaceId
+      workspaceId,
+      defaulted
     };
   }
+  static assertDeployableEnv(baseDevEnv, environment, purpose) {
+    const defaulted = environment === "local" ? [] : baseDevEnv.defaulted ?? [];
+    if (!defaulted.length)
+      return;
+    const values = { AKAN_PUBLIC_REPO_NAME: baseDevEnv.repoName, AKAN_PUBLIC_SERVE_DOMAIN: baseDevEnv.serveDomain };
+    const standIns = defaulted.map((key) => `${key} (would be "${values[key]}")`).join(" and ");
+    throw new Error(`${purpose} for the "${environment}" environment needs ${standIns} set, not a local default. Set ${defaulted.length > 1 ? "them" : "it"} in the workspace .env or the shell, or use AKAN_PUBLIC_ENV=local.`);
+  }
   getWorkspaceId({
     allowEmpty
   } = {}) {
@@ -3774,10 +3804,12 @@ class AppExecutor extends SysExecutor {
     return basePort + appIndex + portOffset;
   }
   getCommandEnv(env = {}) {
-    const { portOffset } = WorkspaceExecutor.getBaseDevEnv();
+    const { portOffset, repoName, serveDomain } = WorkspaceExecutor.getBaseDevEnv();
     const PORT = (8282 + portOffset).toString();
     return {
       ...process.env,
+      AKAN_PUBLIC_REPO_NAME: repoName,
+      AKAN_PUBLIC_SERVE_DOMAIN: serveDomain,
       AKAN_PUBLIC_APP_NAME: this.name,
       AKAN_WORKSPACE_ROOT: this.workspace.workspaceRoot,
       NODE_NO_WARNINGS: "1",
@@ -3928,7 +3960,7 @@ class AppExecutor extends SysExecutor {
         pageKeys.push(key);
       }
     }
-    pageKeys.sort();
+    pageKeys.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
     this.#pageKeys = this.#excludeDevOnlyPages ? this.#dropDevOnlyPages(pageKeys, devOnlyKeys, devOnlyDirs) : pageKeys;
     return this.#pageKeys;
   }
@@ -4174,7 +4206,7 @@ class PkgExecutor extends Executor {
   }
   async#toDependencyMap(rootPackageJson, dependencies = [], devDependencies = []) {
     const dependencyNames = [...new Set(dependencies)].sort();
-    const devDependencyNames = [...new Set(devDependencies)].filter((dep) => !dependencyNames.includes(dep)).sort();
+    const devDependencyNames = [...new Set(devDependencies)].filter((dep) => !dependencyNames.includes(dep)).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
     const dependencyVersions = new Map;
     const missingDeps = [];
     for (const dep of [...dependencyNames, ...devDependencyNames]) {
@@ -4256,4 +4288,4 @@ class ModuleExecutor extends Executor {
   }
 }
 
-export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, CLAUDE_COMMENT_RULE, binPlatforms, ServerEnvProfile, AkanAppConfig, AkanWorkspaceConfig, AsyncDefaultExportDetector, resolveSsrPageEntriesForApp, CodegenLock, Linter, LibSource, formatLibStatuses, rootAllowedFiles, rootAllowedDirs, isAllowedLibFacetRootFile, libFacetRootHintOf, barrelFacetDirs, facetIndexShadowOf, rootEntryHintOf, isScannedRootEntry, AppInfo, Spinner, ProjectTypecheck2, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };
+export { AGENT_BLOCK_START, AGENT_BLOCK_END, stampBlockVersion, extractBlockVersion, readDevkitVersion, upsertAgentBlock, extractAgentBlock, renderRecipeEntries, collectScopeRecipeSources, renderScopeAgentBlock, CLAUDE_COMMENT_RULE, binPlatforms, ServerEnvProfile, AkanAppConfig, AkanWorkspaceConfig, AsyncDefaultExportDetector, resolveSsrPageEntriesForApp, CodegenLock, Linter, LibSource, formatLibStatuses, rootAllowedFiles, rootAllowedDirs, isAllowedLibFacetRootFile, libFacetRootHintOf, barrelFacetDirs, facetIndexShadowOf, rootEntryHintOf, isScannedRootEntry, AppInfo, Spinner, ProjectTypecheck2, CommandExecutionError, Executor, WorkspaceExecutor, SysExecutor, AppExecutor, LibExecutor, PkgExecutor, ModuleExecutor };