@akanjs/devkit 3.0.0-beta.18 → 3.0.0-beta.19

package/codeAgent/agent/codeAgentRpcListener.test.ts

@@ -0,0 +1,113 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import type { CodeAgentEvent } from "akanjs/common";
+import type { CodeAgent } from "./CodeAgent";
+import { CodeAgentRpcHost } from "./CodeAgentRpcHost";
+import { CodeAgentRpcListener } from "./CodeAgentRpcListener";
+
+const dir = mkdtempSync(path.join(tmpdir(), "akan-rpc-"));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+class FakeAgent {
+  seq = 0;
+  frames: CodeAgentEvent[] = [];
+  disposed = false;
+  aborted = false;
+  #listener: (event: CodeAgentEvent) => void = () => {};
+  on(listener: (event: CodeAgentEvent) => void) {
+    this.#listener = listener;
+    return () => {};
+  }
+  announce() {
+    this.emit();
+  }
+  emit() {
+    const event = { type: "idle", seq: ++this.seq } as CodeAgentEvent;
+    this.frames.push(event);
+    this.#listener(event);
+  }
+  async prompt() {
+    this.emit();
+  }
+  async abort() {
+    this.aborted = true;
+  }
+  async state({ sinceSeq }: { sinceSeq?: number } = {}) {
+    return { replayFrom: 0, frames: this.frames.filter((event) => event.seq > (sinceSeq ?? Number.MAX_SAFE_INTEGER)) };
+  }
+  dispose() {
+    this.disposed = true;
+  }
+}
+
+class Client {
+  lines: unknown[] = [];
+  #buffer = "";
+  #socket: Awaited<ReturnType<typeof Bun.connect>> | null = null;
+  static async connect(unix: string) {
+    const client = new Client();
+    client.#socket = await Bun.connect({
+      unix,
+      socket: {
+        data: (_socket, data) => {
+          client.#buffer += data.toString();
+          const parts = client.#buffer.split("\n");
+          client.#buffer = parts.pop() ?? "";
+          for (const part of parts) if (part) client.lines.push(JSON.parse(part));
+        },
+      },
+    });
+    return client;
+  }
+  send(id: string, command: object) {
+    this.#socket?.write(`${JSON.stringify({ id, command })}\n`);
+  }
+  async reply(id: string) {
+    for (let idx = 0; idx < 200; idx++) {
+      const found = this.lines.find((line) => (line as { id?: string }).id === id);
+      if (found) return found as { ok: boolean; data: { frames?: CodeAgentEvent[] } };
+      await Bun.sleep(5);
+    }
+    throw new Error(`no reply ${id}`);
+  }
+  close() {
+    this.#socket?.end();
+  }
+}
+
+describe("CodeAgentRpcListener", () => {
+  test("parses unix and tcp addresses, defaulting tcp to loopback", () => {
+    expect(CodeAgentRpcListener.parse("unix:/tmp/a.sock")).toEqual({ unix: "/tmp/a.sock" });
+    expect(CodeAgentRpcListener.parse("tcp:7000")).toEqual({ hostname: "127.0.0.1", port: 7000 });
+    expect(CodeAgentRpcListener.parse("0.0.0.0:7000")).toEqual({ hostname: "0.0.0.0", port: 7000 });
+    expect(() => CodeAgentRpcListener.parse("tcp:nope")).toThrow("--rpc-listen");
+  });
+
+  test("the agent outlives a dropped client, and the next one catches up by seq", async () => {
+    const agent = new FakeAgent();
+    const unix = path.join(dir, "agent.sock");
+    const listener = new CodeAgentRpcListener(new CodeAgentRpcHost(agent as unknown as CodeAgent, null), { unix });
+    listener.listen();
+    const served = listener.serve();
+
+    const first = await Client.connect(unix);
+    first.send("1", { type: "prompt", message: "hi" });
+    expect((await first.reply("1")).ok).toBe(true);
+    first.close();
+    await Bun.sleep(20);
+    agent.emit();
+    expect(agent.aborted).toBe(false);
+
+    const second = await Client.connect(unix);
+    second.send("2", { type: "get_state", sinceSeq: 2 });
+    const state = await second.reply("2");
+    expect(state.data.frames?.map((frame) => frame.seq)).toEqual([3]);
+
+    second.send("3", { type: "shutdown" });
+    await second.reply("3");
+    await served;
+    expect(agent.disposed).toBe(true);
+  });
+});

package/codeAgent/agent/codeAgentSuspended.test.ts

@@ -0,0 +1,47 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { CodeAgentSuspended } from "./CodeAgentSuspended";
+
+const dir = mkdtempSync(path.join(tmpdir(), "akan-suspended-"));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+const question = {
+  questionId: "qx.1",
+  prompt: "Which app?",
+  kind: "select" as const,
+  options: [{ key: "a", label: "akan" }],
+};
+const approval = {
+  approvalId: "ax.2",
+  toolCallId: "c1",
+  name: "write",
+  summary: "write a.ts",
+  policy: "writes" as const,
+};
+
+describe("CodeAgentSuspended", () => {
+  test("a restarted worker reads back what it was waiting on, and each ask is taken once", () => {
+    const file = CodeAgentSuspended.fileOf(dir, "s1");
+    const before = new CodeAgentSuspended(file);
+    before.setQuestion(question);
+    before.addApproval(approval);
+
+    const after = new CodeAgentSuspended(file);
+    expect(after.question).toEqual(question);
+    expect(after.approvals).toEqual([approval]);
+    expect(after.takeQuestion("qx.1")).toEqual(question);
+    expect(after.takeQuestion("qx.1")).toBeUndefined();
+    expect(after.takeApproval("ax.2")).toEqual(approval);
+    expect(after.takeApproval("ax.2")).toBeUndefined();
+    expect(existsSync(file ?? "")).toBe(false);
+  });
+
+  test("a memory session keeps its asks without touching disk", () => {
+    const memory = new CodeAgentSuspended(CodeAgentSuspended.fileOf(undefined, "s2"));
+    memory.setQuestion(question);
+    expect(memory.takeQuestion("other")).toBeUndefined();
+    expect(memory.takeQuestion("qx.1")).toEqual(question);
+  });
+});

package/codeAgent/tools/mcpOAuth.test.ts

@@ -303,12 +303,16 @@ describe("MCP sign-in", () => {
 });
 
 describe("the token file", () => {
-  test("it is readable only by its owner, and lives outside the workspace", async () => {
+  test("it lives outside the workspace", async () => {
     await McpSignIn.run(refOf(), { open: browser });
     const file = McpTokenStore.file();
     expect(file.startsWith(home)).toBe(true);
     expect(await Bun.file(file).exists()).toBe(true);
-    expect(statSync(file).mode & 0o777).toBe(0o600);
+  });
+
+  test.skipIf(process.platform === "win32")("it is readable only by its owner", async () => {
+    await McpSignIn.run(refOf(), { open: browser });
+    expect(statSync(McpTokenStore.file()).mode & 0o777).toBe(0o600);
   });
 
   test("a corrupt file costs the sign-ins and not the session", async () => {

package/dependencyScanner.ts

@@ -10,8 +10,10 @@ const testFileRegex = /\.(?:test|spec)\.[cm]?[tj]sx?$/;
 // `__fixtures__` holds deliberately invalid sample sources for the lint-rule suites; tsconfig `exclude` and
 // biome's `!` override already skip them, and their imports are violations rather than real dependencies.
 const skipDirs = ["node_modules", "dist", "build", ".git", ".next", "public", "ios", "android", "__fixtures__"];
-const isSkippedPath = (filePath: string) =>
-  skipDirs.some((dir) => filePath.includes(`/${dir}/`) || filePath.startsWith(`${dir}/`));
+const isSkippedPath = (filePath: string) => {
+  const posixPath = filePath.split(path.sep).join("/");
+  return skipDirs.some((dir) => posixPath.includes(`/${dir}/`) || posixPath.startsWith(`${dir}/`));
+};
 const builtinModuleSet = new Set([...builtinModules, ...builtinModules.map((mod) => `node:${mod}`)]);
 const stripShebang = (source: string) => source.replace(/^#!.*(?:\r?\n|$)/, "");
 

package/devkitUtils.test.ts

@@ -40,7 +40,7 @@ describe("resolveSignalTestPreloadPath", () => {
     await write(path.join(root, "node_modules/akanjs/test/signalTest.preload.ts"), "export {};\n");
 
     await expect(resolveSignalTestPreloadPath({ cwdPath: libDir })).resolves.toContain(
-      "node_modules/akanjs/test/signalTest.preload.ts",
+      path.join("node_modules/akanjs/test/signalTest.preload.ts"),
     );
   });
 });

package/executors.linkFallback.test.ts

@@ -0,0 +1,103 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import * as fsPromises from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+//? The Windows VM runs as an administrator, so a refused link only ever happens here — injected, on every OS.
+const realSymlink = fsPromises.symlink;
+let refuseLinks = false;
+mock.module("node:fs/promises", () => ({
+  ...fsPromises,
+  symlink: async (...args: Parameters<typeof fsPromises.symlink>) => {
+    if (refuseLinks)
+      throw Object.assign(new Error(`EPERM: operation not permitted, symlink '${String(args[0])}'`), {
+        code: "EPERM",
+      });
+    return await realSymlink(...args);
+  },
+}));
+const { AppExecutor, WorkspaceExecutor } = await import("./executors");
+
+const { lstat, mkdir, mkdtemp, readFile, rm, writeFile } = fsPromises;
+const originalEnv = { ...process.env };
+const originalPlatform = process.platform;
+const tempRoots: string[] = [];
+const PAGE_SOURCE = "export default function Page() {\n  return null;\n}\n";
+
+const setPlatform = (platform: NodeJS.Platform) =>
+  Object.defineProperty(process, "platform", { value: platform, configurable: true, writable: true });
+
+// `AppExecutor.from` memoises by name, so each test needs a name no other test has used.
+const makeApp = async (appName: string) => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "akan-link-fallback-"));
+  tempRoots.push(root);
+  process.env.AKAN_PUBLIC_REPO_NAME = "repo";
+  process.env.AKAN_PUBLIC_SERVE_DOMAIN = "example.com";
+  process.env.AKAN_PUBLIC_ENV = "local";
+  process.env.PORT_OFFSET = "0";
+  await writeFile(path.join(root, "package.json"), JSON.stringify({ name: "fixture", version: "1.0.0" }));
+  await mkdir(path.join(root, "libs/shared/public"), { recursive: true });
+  await writeFile(path.join(root, "libs/shared/public/logo.png"), "logo");
+  await mkdir(path.join(root, "libs/shared/page/about"), { recursive: true });
+  await writeFile(path.join(root, "libs/shared/page/about/_index.tsx"), PAGE_SOURCE);
+  await mkdir(path.join(root, "apps", appName, "page"), { recursive: true });
+  await writeFile(path.join(root, "apps", appName, "akan.config.ts"), "export default { syncPageLibs: true };\n");
+  const workspace = new WorkspaceExecutor({ workspaceRoot: root, repoName: "repo" });
+  return { root, app: AppExecutor.from(workspace, appName), appRoot: path.join(root, "apps", appName) };
+};
+
+beforeEach(() => {
+  process.env = { ...originalEnv };
+  refuseLinks = true;
+});
+
+afterEach(async () => {
+  refuseLinks = false;
+  setPlatform(originalPlatform);
+  process.env = { ...originalEnv };
+  await Promise.all(tempRoots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
+});
+
+describe("lib links the OS refuses to create", () => {
+  test("Windows gets a copy of the lib assets, and a resync replaces it without touching the lib", async () => {
+    setPlatform("win32");
+    const { root, app, appRoot } = await makeApp("fallback-assets");
+
+    await app.syncAssets(["shared"]);
+    const copied = path.join(appRoot, "public/libs/shared");
+    expect((await lstat(copied)).isSymbolicLink()).toBe(false);
+    expect(await readFile(path.join(copied, "logo.png"), "utf8")).toBe("logo");
+
+    await writeFile(path.join(root, "libs/shared/public/logo.png"), "logo-v2");
+    await app.syncAssets(["shared"]);
+    expect(await readFile(path.join(copied, "logo.png"), "utf8")).toBe("logo-v2");
+
+    await app.syncAssets([]);
+    expect(await lstat(path.join(appRoot, "public/libs")).catch(() => null)).toBeNull();
+    expect(await readFile(path.join(root, "libs/shared/public/logo.png"), "utf8")).toBe("logo-v2");
+  });
+
+  test("Windows gets a copy of the lib pages that still routes, and a resync picks up a new lib route", async () => {
+    setPlatform("win32");
+    const { root, app, appRoot } = await makeApp("fallback-pages");
+
+    expect(await app.syncPages(["shared"])).toBe(true);
+    expect((await lstat(path.join(appRoot, "page/(libs)/(shared)"))).isSymbolicLink()).toBe(false);
+    expect(await app.getPageKeys({ refresh: true })).toEqual(["./(libs)/(shared)/about/_index.tsx"]);
+
+    await mkdir(path.join(root, "libs/shared/page/terms"), { recursive: true });
+    await writeFile(path.join(root, "libs/shared/page/terms/_index.tsx"), PAGE_SOURCE);
+    expect(await app.syncPages(["shared"])).toBe(true);
+    expect(await app.getPageKeys({ refresh: true })).toEqual([
+      "./(libs)/(shared)/about/_index.tsx",
+      "./(libs)/(shared)/terms/_index.tsx",
+    ]);
+  });
+
+  test("elsewhere the refusal surfaces rather than being papered over with a copy", async () => {
+    setPlatform(originalPlatform === "win32" ? "linux" : originalPlatform);
+    const { app } = await makeApp("fallback-posix");
+
+    await expect(app.syncAssets(["shared"])).rejects.toThrow("EPERM");
+  });
+});

package/executors.test.ts

@@ -312,9 +312,17 @@ describe("Workspace and app executor environment contracts", () => {
     expect(env.AKAN_PUBLIC_SERVER_PORT).toBe("8285");
     expect(env.EXTRA).toBe("ok");
 
+    const shellOperationMode = process.env.AKAN_PUBLIC_OPERATION_MODE;
+    process.env.AKAN_PUBLIC_OPERATION_MODE = "local";
     const prepared = await app.prepareCommand("build");
+    const bakedOperationMode = process.env.AKAN_PUBLIC_OPERATION_MODE;
+    if (shellOperationMode === undefined) delete process.env.AKAN_PUBLIC_OPERATION_MODE;
+    else process.env.AKAN_PUBLIC_OPERATION_MODE = shellOperationMode;
+    expect(bakedOperationMode).toBeUndefined();
     expect(prepared.env.AKAN_COMMAND_TYPE).toBe("build");
     expect(prepared.env.AKAN_PUBLIC_BASE_PATHS).toBe("admin");
+    expect(prepared.env.AKAN_DATABASE_MODE).toBe("single");
+    expect(prepared.env.AKAN_DATABASE_MODES).toBe("single");
     // Bundling reads `process.env` through getPublicEnv and `define`s every AKAN_PUBLIC_* into a literal, so a
     // dev port published here would be baked into the artifact and outrank the PORT the container is run with.
     expect(process.env.AKAN_PUBLIC_APP_NAME).toBe("demo");

package/executors.ts

@@ -11,6 +11,7 @@ import { readFileSync } from "node:fs";
 import {
   copyFile,
   cp as cpEntry,
+  lstat,
   mkdir,
   readdir as readDirEntries,
   realpath,
@@ -96,7 +97,9 @@ const staticTemplateFileExtensions = new Set([
   ".xml",
 ]);
 
-const formatCommandArg = (value: string) => (/^[\w@%+=:,./-]+$/.test(value) ? value : JSON.stringify(value));
+//? A backslash is a path separator on Windows but an escape in a POSIX shell, so only there does it force quoting.
+const plainCommandArgPattern = process.platform === "win32" ? /^[\w@%+=:,./\\-]+$/ : /^[\w@%+=:,./-]+$/;
+const formatCommandArg = (value: string) => (plainCommandArgPattern.test(value) ? value : JSON.stringify(value));
 
 const formatCommandForDisplay = (command: string, args: string[] = []) =>
   [command, ...args].map(formatCommandArg).join(" ");
@@ -475,8 +478,10 @@ export class Executor {
     const isDirectory = (await stat(src)).isDirectory();
     if (!(await FileSys.exists(dest)) && isDirectory) await mkdir(dest, { recursive: true });
     //* `cp -r` keeps symlinks on GNU coreutils but follows them on macOS, so anything that must land as
-    //* real files regardless of platform has to say so explicitly.
-    if (dereference) await cpEntry(src, dest, { recursive: isDirectory, dereference: true, force: true });
+    //* real files regardless of platform has to say so explicitly. Windows has no `cp -r <dir>/.` and a
+    //* symlink there needs a privilege most accounts lack, so it always lands as real files.
+    if (dereference || process.platform === "win32")
+      await cpEntry(src, dest, { recursive: isDirectory, dereference: true, force: true });
     else await $`cp -r ${src}${isDirectory ? "/." : ""} ${dest}`;
   }
   log(msg: string) {
@@ -1405,14 +1410,21 @@ export class AppExecutor extends SysExecutor {
       ...env,
     };
   }
+  /** The database mode a command runs this app in, and the modes its build carries — the same rule the server boots by. */
+  async getDatabaseModeEnv() {
+    const akanConfig = await this.getConfig();
+    return {
+      AKAN_DATABASE_MODE: akanConfig.resolveDatabaseMode(),
+      AKAN_DATABASE_MODES: akanConfig.database.modes.join(","),
+    };
+  }
   async prepareCommand(type: "build" | "start") {
     const akanConfig = await this.getConfig();
-    const databaseMode = process.env.AKAN_DATABASE_MODE ?? akanConfig.defaultDatabaseMode ?? "single";
     const routeEnv = {
       AKAN_PUBLIC_BASE_PATHS: [...akanConfig.basePaths].join(","),
       AKAN_PUBLIC_API_PREFIX: akanConfig.api.prefix,
       AKAN_PUBLIC_WS_PREFIX: akanConfig.api.websocketPrefix,
-      AKAN_DATABASE_MODE: databaseMode,
+      ...(await this.getDatabaseModeEnv()),
     };
     Object.assign(process.env, routeEnv);
     if (type === "build") {
@@ -1457,11 +1469,14 @@ export class AppExecutor extends SysExecutor {
     // this does not leak non-public env.
     // The port keys are this machine's dev allocation, and `define` turns an `AKAN_PUBLIC_*` into a literal the
     // artifact can never be run with a different value for — a baked port would outrank the `PORT` the container
-    // is started with and send every SSR self-call to a port nothing bound.
+    // is started with and send every SSR self-call to a port nothing bound. The operation mode likewise: one image
+    // serves an edge site and a cloud cluster, and a shell's `local` would pin every artifact to it.
     if (type === "build") {
       const buildEnv = { ...env };
       delete buildEnv.AKAN_PUBLIC_CLIENT_PORT;
       delete buildEnv.AKAN_PUBLIC_SERVER_PORT;
+      delete buildEnv.AKAN_PUBLIC_OPERATION_MODE;
+      delete process.env.AKAN_PUBLIC_OPERATION_MODE;
       Object.assign(process.env, buildEnv);
     }
     return { env };
@@ -1507,7 +1522,9 @@ export class AppExecutor extends SysExecutor {
     const owners = new Map<string, { absPath: string; fromLib: boolean }>();
     const devOnlyKeys = new Set<string>();
     const devOnlyDirs: string[] = [];
-    for (const root of await this.getPageRoots()) {
+    const pageRoots = await this.getPageRoots();
+    const libKeyPrefixes = pageRoots.map((root) => root.keyPrefix).filter(Boolean);
+    for (const root of pageRoots) {
       if (!(await FileSys.dirExists(root.dir))) continue;
       for await (const rel of glob.scan({
         cwd: root.dir,
@@ -1517,6 +1534,8 @@ export class AppExecutor extends SysExecutor {
         const segments = rel.split(path.sep);
         if (segments.some((s) => s === "node_modules")) continue;
         const posix = `${root.keyPrefix}${segments.join("/")}`;
+        //* A lib folder that is a copy rather than a link (the Windows fallback) is walked into from `page` too.
+        if (!root.keyPrefix && libKeyPrefixes.some((prefix) => posix.startsWith(prefix))) continue;
         const absPath = path.join(root.dir, ...segments);
         validatePageSourceFile(posix, { filePath: absPath });
         if (!isRouteSourceFile(posix)) continue;
@@ -1619,7 +1638,11 @@ export class AppExecutor extends SysExecutor {
       )
     ).flat();
     const wanted = parents.flatMap((parent) => libs.map((lib) => `${parent}${AppExecutor.#pageLibsDir}/(${lib})/`));
-    if (linked.sort().join(",") === wanted.sort().join(",")) return false;
+    //* A copy — the Windows fallback when a junction is refused — does not follow its lib, so only links are current.
+    const isLink = async (key: string) =>
+      (await lstat(`${this.cwdPath}/page/${key.slice(0, -1)}`).catch(() => null))?.isSymbolicLink() ?? false;
+    if (linked.sort().join(",") === wanted.sort().join(",") && (await Promise.all(linked.map(isLink))).every(Boolean))
+      return false;
     await Promise.all(
       parents.map((parent) => this.removeDir(`${this.cwdPath}/page/${parent}${AppExecutor.#pageLibsDir}`)),
     );

package/frontendBuild/autoImportSync.test.ts

@@ -161,6 +161,19 @@ describe("transformSource — client role (package client entry)", () => {
     );
   });
 
+  test("never claims fetch from a file that calls the platform fetch", () => {
+    const globalOnly = `"use client";\n\nexport const toBlob = async (url: string) => await (await fetch(url)).blob();\n`;
+    const mixed = `"use client";\n\nexport const C = async (url: string) => (await fetch(url)).ok && fetch.me() && st.foo;\n`;
+    const passed = `"use client";\n\nexport const load = (get = fetch) => get("/a");\n`;
+
+    expect(transformSource(globalOnly, "CropImage.tsx", clientLibCtx)).toBeNull();
+    expect(transformSource(mixed, "C.Zone.tsx", clientLibCtx)).toBe(
+      `"use client";\nimport { st } from "@libs/shared/client";\n\nexport const C = async (url: string) => (await fetch(url)).ok && fetch.me() && st.foo;\n`,
+    );
+    expect(transformSource(passed, "load.ts", clientLibCtx)).toBeNull();
+    expect(transformSource(globalOnly, "x.store.ts", storeCtx)).toBeNull();
+  });
+
   test("handles webkit .ts files (no jsx) the same as tsx", () => {
     const source = `import { getEnv } from "akanjs/base";\n\nexport const load = () => fetch.me();\n`;
     const out = transformSource(source, "cookie.ts", clientLibCtx);

package/frontendBuild/autoImportSync.ts

@@ -161,6 +161,10 @@ const LIB_BARRELS: Record<string, { barrel: string; kind: ImportKind }> = {
   cnst: { barrel: "cnst", kind: "namespace" },
   srv: { barrel: "srv", kind: "namespace" },
 };
+//* Registry names that are also runtime globals. An unbound `fetch(url)` is the platform's fetch, and importing Akan's
+//* over it silently rebinds the call, so such a name is claimed only when every reference has the Akan member shape
+//* (`fetch.viewX()`); one bare use leaves the file alone.
+const GLOBAL_NAMES = new Set(["fetch"]);
 //* ECMAScript/TS structural globals never resolved as domain symbols, so that a package model named
 //* e.g. `Map` cannot shadow the JS `Map` used in `new Map()`. Domain-y globals like `File` are allowed
 //* on purpose (they are real models here).
@@ -378,13 +382,14 @@ export const transformSource = (
   const sf = ts.createSourceFile(fileName, source, ts.ScriptTarget.Latest, true, scriptKindFor(fileName));
   const bound = collectBoundNames(sf);
   const used = collectUsedReferences(sf);
+  const bareGlobals = collectBareGlobalReferences(sf);
 
   // Group the needed symbols by their import target: framework registry first, then dynamic resolver.
   // Named groups map each name to whether it is type-only, so we can emit `import type`/inline `type`.
   const namedBySpecifier = new Map<string, Map<string, boolean>>();
   const namespaceImports: { name: string; specifier: string }[] = [];
   for (const name of used) {
-    if (bound.has(name)) continue;
+    if (bound.has(name) || bareGlobals.has(name)) continue;
     const target = targetFor(name, ctx) ?? resolveExtra?.(name) ?? null;
     if (!target) continue;
     if (target.kind === "namespace") namespaceImports.push({ name, specifier: target.specifier });
@@ -478,6 +483,19 @@ const collectUsedReferences = (sf: ts.SourceFile): Set<string> => {
   return used;
 };
 
+const collectBareGlobalReferences = (sf: ts.SourceFile): Set<string> => {
+  const bare = new Set<string>();
+  const visit = (node: ts.Node) => {
+    if (ts.isIdentifier(node) && GLOBAL_NAMES.has(node.text) && isReferencePosition(node)) {
+      const parent = node.parent;
+      if (!(parent && ts.isPropertyAccessExpression(parent) && parent.expression === node)) bare.add(node.text);
+    }
+    ts.forEachChild(node, visit);
+  };
+  ts.forEachChild(sf, visit);
+  return bare;
+};
+
 //* True when the identifier reads a binding, as opposed to being a member name, property key, or
 //* declaration name. e.g. in `cnst.Coordinate`, `cnst` is a reference but `Coordinate` is not.
 const isReferencePosition = (node: ts.Identifier): boolean => {

package/frontendBuild/buildRouteClient.test.ts

@@ -27,7 +27,7 @@ afterEach(async () => {
 
 describe("route client store bootstrap", () => {
   test("wraps client entries with app client bootstrap before re-exporting components", () => {
-    const original = "/repo/pkgs/akanjs/ui/Model/NewWrapper_Client.tsx";
+    const original = path.resolve("/repo/pkgs/akanjs/ui/Model/NewWrapper_Client.tsx");
     const source = RouteClientBuilder.createStoreBootstrapEntrySource({
       appName: "akan",
       originalEntry: original,
@@ -147,6 +147,57 @@ describe("route client store bootstrap", () => {
     );
   });
 
+  test("bundles every route's entries into one graph so a page never loads a module twice", async () => {
+    const root = await makeTempRoot();
+    const appDir = path.join(root, "apps/demo");
+    const pageA = path.join(appDir, "page/a.tsx");
+    const pageB = path.join(appDir, "page/b.tsx");
+    const entryA = path.join(appDir, "ui/A.tsx");
+    const entryB = path.join(appDir, "ui/B.tsx");
+    const shared = path.join(appDir, "common/shared.ts");
+    await write(pageA, 'import { A } from "../ui/A";\nexport default A;\n');
+    await write(pageB, 'import { B } from "../ui/B";\nexport default B;\n');
+    await write(entryA, '"use client";\nimport { mark } from "../common/shared";\nexport const A = () => mark;\n');
+    await write(entryB, '"use client";\nimport { mark } from "../common/shared";\nexport const B = () => mark;\n');
+    await write(shared, 'export const mark = "shared-module-marker";\n');
+    const app = {
+      name: "demo",
+      cwdPath: appDir,
+      dist: { cwdPath: path.join(root, "dist/apps/demo") },
+      workspace: { workspaceRoot: root },
+      getConfig: async () => ({ barrelImports: [], optimizeImports: [] }),
+      getTsConfig: async () => ({ compilerOptions: { paths: {} } }),
+      getPublicEnv: () => ({}),
+    } as never;
+    const discovery = new GraphClientEntryDiscovery({ barrelImports: [] }, async () => null);
+    const build = (seeds: string[], knownEntries: Set<string>) =>
+      new RouteClientBuilder({
+        app,
+        seeds,
+        graphSeeds: [pageA, pageB],
+        knownEntries,
+        discovery,
+        artifact: {} as never,
+      }).build();
+
+    const first = await build([pageA], new Set());
+    const second = await build([pageB], new Set(first.newEntries));
+
+    expect(first.newEntries).toEqual([entryA, entryB]);
+    expect(first.discoveredEntries).toEqual([entryA]);
+    expect(first.clientDeps).not.toContain(entryB);
+    expect(Object.keys(first.clientDepsByEntry ?? {}).sort()).toEqual([entryA, entryB]);
+    expect(second.newEntries).toEqual([]);
+    expect(second.discoveredEntries).toEqual([entryB]);
+    expect(Object.keys(second.manifestDelta)).toEqual([]);
+    const clientOut = path.join(appDir, ".akan/artifact/client");
+    const outputs = [...new Bun.Glob("**/*.js").scanSync(clientOut)];
+    const carriers = await Promise.all(
+      outputs.map(async (file) => (await Bun.file(path.join(clientOut, file)).text()).includes("shared-module-marker")),
+    );
+    expect(carriers.filter(Boolean)).toHaveLength(1);
+  });
+
   test("discovers client entries from installed akanjs package sources", async () => {
     const root = await makeTempRoot();
     const seed = path.join(root, "apps/demo/page/_index.tsx");

package/frontendBuild/cssImportResolver.ts

@@ -135,7 +135,7 @@ export class CssImportResolver {
 
   async #firstExisting(basePath: string): Promise<string | null> {
     for (const suffix of CSS_IMPORT_EXTS) {
-      const candidate = `${basePath}${suffix}`;
+      const candidate = path.normalize(`${basePath}${suffix}`);
       if (await Bun.file(candidate).exists()) return candidate;
     }
     return null;

package/frontendBuild/fontOptimizer.test.ts

@@ -170,7 +170,7 @@ describe("FontOptimizer discovery", () => {
     expect(result.fonts).toEqual([]);
     expect(result.files).toEqual([]);
     expect(warnings).toHaveLength(1);
-    expect(warnings[0]).toContain("page/_layout.tsx");
+    expect(warnings[0]).toContain(path.join("page", "_layout.tsx"));
   });
 
   test("warns about an entry it cannot read and keeps the ones it can", async () => {