@akanjs/devkit 3.1.1 → 3.1.2-rc.1

package/mobile/nativePublicEnv.test.ts

@@ -43,12 +43,14 @@ describe("NativePublicEnv", () => {
         AKAN_PUBLIC_MAP_TOKEN: "x",
         AKAN_PUBLIC_PORT: 8282,
         AKAN_PUBLIC_NOTE: "line\nbreak",
+        AKAN_PUBLIC_SIGNER: "-----BEGIN EC PRIVATE KEY-----\\nMHc\\n-----END EC PRIVATE KEY-----",
       }),
     ).toEqual([
       "AKAN_PUBLIC_lower is not an AKAN_PUBLIC_[A-Z0-9_] name",
       "AKAN_PUBLIC_MAP_TOKEN names a token, which a page bundle must not carry",
       "AKAN_PUBLIC_PORT is not a string",
       "AKAN_PUBLIC_NOTE holds a control character",
+      "AKAN_PUBLIC_SIGNER holds a private key",
     ]);
     const many = Object.fromEntries(Array.from({ length: 257 }, (_, idx) => [`AKAN_PUBLIC_K${idx}`, "v"]));
     expect(NativePublicEnv.problems(many)).toEqual(["257 keys, more than 256"]);

package/mobile/nativePublicEnv.ts

@@ -16,6 +16,7 @@ export class NativePublicEnv {
     "AKAN_PUBLIC_RENDER_ENV",
     "AKAN_PUBLIC_DEFAULT_LOCALE",
     "AKAN_PUBLIC_LOCALES",
+    "AKAN_PUBLIC_LOCALE_PREFIX",
   ];
   //? Akan Cloud's own limits on a recorded env: a build it would refuse fails here, before anything is signed.
   static readonly #keyPattern = /^AKAN_PUBLIC_[A-Z0-9_]{1,128}$/;
@@ -46,6 +47,7 @@ export class NativePublicEnv {
       const word = NativePublicEnv.#secretWords.find((secret) => key.includes(secret));
       if (word) return [`${key} names a ${word.toLowerCase()}, which a page bundle must not carry`];
       if (typeof value !== "string") return [`${key} is not a string`];
+      if (/-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/.test(value)) return [`${key} holds a private key`];
       // biome-ignore lint/suspicious/noControlCharactersInRegex: the control characters are what is refused
       if (/[\u0000-\u001f\u007f]/.test(value)) return [`${key} holds a control character`];
       return [];
@@ -71,6 +73,17 @@ export class NativePublicEnv {
     return NativePublicEnv.of((await file.json()) as Record<string, unknown>);
   }
 
+  /** Every `AKAN_PUBLIC_*` the last `akan build` inlined, derived keys included, else the ones this process has. */
+  static async inlined(app: App): Promise<PublicEnv> {
+    const file = Bun.file(CsrArtifactBuilder.publicEnvPath(app));
+    const env = (await file.exists()) ? ((await file.json()) as Record<string, unknown>) : process.env;
+    return Object.fromEntries(
+      Object.entries(env).flatMap(([key, value]) =>
+        key.startsWith("AKAN_PUBLIC_") && typeof value === "string" ? [[key, value]] : [],
+      ),
+    );
+  }
+
   /** A bundle.json's record, or null when it has none (a build from before the record, or no file at all). */
   static async recordedIn(bundleFile: string): Promise<PublicEnv | null> {
     const file = Bun.file(bundleFile);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akanjs/devkit",
-  "version": "3.1.1",
+  "version": "3.1.2-rc.1",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -41,6 +41,7 @@
     "./*": "./*.ts"
   },
   "dependencies": {
+    "@akanjs/language": "3.1.2-rc.1",
     "@earendil-works/pi-agent-core": "1.3.0",
     "@earendil-works/pi-ai": "1.3.0",
     "@earendil-works/pi-codemode": "1.3.0",
@@ -49,7 +50,7 @@
     "@earendil-works/pi-tui": "1.3.0",
     "@inquirer/prompts": "^8.7.3",
     "@tailwindcss/node": "^4.3.3",
-    "akanjs": "3.1.1",
+    "akanjs": "3.1.2-rc.1",
     "chalk": "^6.0.1",
     "commander": "^15.0.0",
     "dayjs": "^1.11.23",

package/shellOnlyEnv.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { ShellOnlyEnv } from "./shellOnlyEnv";
+
+const key = "AKAN_SHELL_ONLY_TEST_KEY";
+const shellValue = "from-shell";
+
+const inRepo = (files: Record<string, string>, run: (env: ShellOnlyEnv<typeof key>) => void) => {
+  const repo = mkdtempSync(path.join(tmpdir(), "akan-shell-only-env-"));
+  const cwd = process.cwd();
+  try {
+    for (const [name, content] of Object.entries(files)) writeFileSync(path.join(repo, name), content);
+    process.chdir(repo);
+    process.env[key] = shellValue;
+    run(new ShellOnlyEnv([key]));
+  } finally {
+    process.chdir(cwd);
+    delete process.env[key];
+    rmSync(repo, { recursive: true, force: true });
+  }
+};
+
+describe("ShellOnlyEnv", () => {
+  test.each([
+    ".env",
+    ".env.local",
+    ".env.development",
+    ".env.development.local",
+    ".env.production",
+    ".env.production.local",
+    ".env.test",
+    ".env.test.local",
+  ])("ignores a key that %s names", (file) => {
+    inRepo({ [file]: `${key}=placeholder\n` }, (env) => {
+      expect(env.get(key)).toBeUndefined();
+      expect(env.ignored()).toEqual([
+        `${key} is set in ${file}, which the repository controls, so it is ignored. Export it in your shell instead.`,
+      ]);
+    });
+  });
+
+  test.each([
+    `${key}=placeholder`,
+    `export ${key}=placeholder`,
+    `  ${key} = placeholder`,
+    `${key}: placeholder`,
+    `export ${key}: placeholder`,
+    `${key}\t:\tplaceholder`,
+    `${key}:`,
+    `${key}=placeholder\r`,
+  ])("ignores a key set as %j", (line) => {
+    inRepo({ ".env": `OTHER_KEY=placeholder\n${line}\n` }, (env) => {
+      expect(env.get(key)).toBeUndefined();
+    });
+  });
+
+  test("reads the shell value when no dotenv file names the key", () => {
+    inRepo({ ".env": `OTHER_KEY=placeholder\n# ${key}=placeholder\n${key}_SUFFIX=placeholder\n` }, (env) => {
+      expect(env.get(key)).toBe(shellValue);
+      expect(env.ignored()).toEqual([]);
+    });
+  });
+});

package/shellOnlyEnv.ts

@@ -0,0 +1,54 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+// Bun loads the ones NODE_ENV picks from the working directory before code runs, so a cloned repo's file can set them.
+const dotenvFiles = [
+  ".env",
+  ".env.local",
+  ".env.development",
+  ".env.development.local",
+  ".env.production",
+  ".env.production.local",
+  ".env.test",
+  ".env.test.local",
+];
+// Bun also reads `KEY: value` lines.
+const assignedKey = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*[=:]/;
+
+// Judged by presence, not value: a comparison would trust whatever a parser difference with Bun's reader lets through.
+export class ShellOnlyEnv<Key extends string> {
+  readonly #keys: ReadonlySet<string>;
+  #cache: { cwd: string; found: Map<string, string> } | undefined;
+
+  constructor(keys: readonly Key[]) {
+    this.#keys = new Set(keys);
+  }
+
+  get(key: Key): string | undefined {
+    if (this.#found().has(key)) return undefined;
+    return process.env[key];
+  }
+
+  ignored() {
+    return [...this.#found()].map(
+      ([key, file]) =>
+        `${key} is set in ${file}, which the repository controls, so it is ignored. Export it in your shell instead.`,
+    );
+  }
+
+  #found() {
+    const cwd = process.cwd();
+    if (this.#cache?.cwd === cwd) return this.#cache.found;
+    const found = new Map<string, string>();
+    for (const name of dotenvFiles) {
+      const file = path.join(cwd, name);
+      if (!existsSync(file)) continue;
+      for (const line of readFileSync(file, "utf8").split("\n")) {
+        const key = line.match(assignedKey)?.[1];
+        if (key && this.#keys.has(key) && !found.has(key)) found.set(key, name);
+      }
+    }
+    this.#cache = { cwd, found };
+    return found;
+  }
+}

package/signalMutationIndex.ts

@@ -1,3 +1,5 @@
+import { createAst, createFactReader, type FileFacts } from "@akanjs/language";
+import { modelNames } from "akanjs/common";
 import ts from "typescript";
 import type { SourceFileInfo } from "./qualityScanner";
 
@@ -8,8 +10,14 @@ interface EndpointShape {
 
 export class SignalMutationIndex {
   //? As the client generates them: `update<Model>(id, data, option?)`, `add<Model>Files(files, parentId?, option?)`.
-  static #generatedArgCounts = { create: 1, update: 2, remove: 1, merge: 2 } as const;
-  static #argMethods = new Set(["param", "body", "search", "room", "msg"]);
+  static #generatedArgCounts = [
+    ["createModel", 1],
+    ["updateModel", 2],
+    ["removeModel", 1],
+    ["mergeModel", 2],
+    ["addModelFiles", 2],
+  ] as const;
+  static #reader = createFactReader(ts, createAst(ts));
   readonly #shapesByOwner = new Map<string, Map<string, EndpointShape>>();
 
   constructor(sourceFiles: SourceFileInfo[]) {
@@ -17,7 +25,7 @@ export class SignalMutationIndex {
       if (!/^(apps|libs)\/[^/]+\/lib\/.+\.signal\.ts$/.test(file)) continue;
       const owner = file.split("/").slice(0, 2).join("/");
       const shapes = this.#shapesByOwner.get(owner) ?? new Map<string, EndpointShape>();
-      SignalMutationIndex.#collect(sourceFile, shapes);
+      SignalMutationIndex.#collect(SignalMutationIndex.#reader.read(sourceFile, owner), shapes);
       this.#shapesByOwner.set(owner, shapes);
     }
   }
@@ -43,85 +51,18 @@ export class SignalMutationIndex {
     return undefined;
   }
 
-  static #collect(sourceFile: ts.SourceFile, kinds: Map<string, EndpointShape>) {
-    const visit = (node: ts.Node) => {
-      if (ts.isCallExpression(node) && ts.isIdentifier(node.expression)) {
-        if (node.expression.text === "slice") SignalMutationIndex.#collectGenerated(node, kinds);
-        else if (node.expression.text === "endpoint") SignalMutationIndex.#collectEndpoints(node, kinds);
-      }
-      ts.forEachChild(node, visit);
-    };
-    visit(sourceFile);
-  }
-
-  static #collectGenerated(slice: ts.CallExpression, kinds: Map<string, EndpointShape>) {
-    let service: ts.Expression | undefined = slice.arguments[0];
-    while (service && ts.isCallExpression(service) && ts.isPropertyAccessExpression(service.expression))
-      service = service.expression.expression;
-    if (!service || !ts.isPropertyAccessExpression(service) || !SignalMutationIndex.#isNamed(service.expression, "srv"))
-      return;
-    const model = service.name.text;
-    const capModel = `${model.charAt(0).toUpperCase()}${model.slice(1)}`;
-    for (const [verb, argCount] of Object.entries(SignalMutationIndex.#generatedArgCounts))
-      kinds.set(`${verb}${capModel}`, { kind: "mutation", argCount });
-    kinds.set(`add${capModel}Files`, { kind: "mutation", argCount: 2 });
-  }
-
-  static #collectEndpoints(endpoint: ts.CallExpression, kinds: Map<string, EndpointShape>) {
-    const builder = endpoint.arguments[1];
-    if (!builder || (!ts.isArrowFunction(builder) && !ts.isFunctionExpression(builder))) return;
-    const map = SignalMutationIndex.#returnedObjectOf(builder);
-    if (!map) return;
-    const verbOf = SignalMutationIndex.#verbReaderOf(builder.parameters[0]);
-    for (const property of map.properties) {
-      if (!ts.isPropertyAssignment(property)) continue;
-      if (!ts.isIdentifier(property.name) && !ts.isStringLiteral(property.name)) continue;
-      const { root, argCount } = SignalMutationIndex.#chainOf(property.initializer);
-      const verb = verbOf(root);
-      //? A socket message writes with the visitor's credential as a mutation does, and the client refuses it alike.
-      const kind = verb === "message" ? "mutation" : verb;
-      if (kind === "query" || kind === "mutation") kinds.set(property.name.text, { kind, argCount });
+  static #collect(facts: FileFacts, shapes: Map<string, EndpointShape>) {
+    for (const { model } of facts.slices) {
+      if (!model) continue;
+      const names = modelNames(model);
+      for (const [role, argCount] of SignalMutationIndex.#generatedArgCounts)
+        shapes.set(names[role], { kind: "mutation", argCount });
     }
-  }
-
-  static #returnedObjectOf(builder: ts.ArrowFunction | ts.FunctionExpression) {
-    let body: ts.Node | undefined = builder.body;
-    if (ts.isBlock(body)) body = body.statements.find(ts.isReturnStatement)?.expression;
-    while (body && ts.isParenthesizedExpression(body)) body = body.expression;
-    return body && ts.isObjectLiteralExpression(body) ? body : null;
-  }
-
-  static #verbReaderOf(parameter: ts.ParameterDeclaration | undefined) {
-    const verbs = new Map<string, string>();
-    if (parameter && ts.isObjectBindingPattern(parameter.name))
-      for (const element of parameter.name.elements) {
-        const verb = element.propertyName ?? element.name;
-        if (ts.isIdentifier(verb) && ts.isIdentifier(element.name)) verbs.set(element.name.text, verb.text);
+    for (const { keys } of facts.endpoints)
+      for (const { name, verb, argCount } of keys) {
+        //? A socket message writes with the visitor's credential as a mutation does, and the client refuses it alike.
+        const kind = verb === "message" ? "mutation" : verb;
+        if (kind === "query" || kind === "mutation") shapes.set(name, { kind, argCount });
       }
-    const holder = parameter && ts.isIdentifier(parameter.name) ? parameter.name.text : null;
-    return (callee: ts.Expression | undefined) => {
-      if (callee && ts.isIdentifier(callee)) return verbs.get(callee.text);
-      if (callee && ts.isPropertyAccessExpression(callee) && SignalMutationIndex.#isNamed(callee.expression, holder))
-        return callee.name.text;
-      return undefined;
-    };
-  }
-
-  static #isNamed(expression: ts.Expression, name: string | null) {
-    return ts.isIdentifier(expression) && expression.text === name;
-  }
-
-  static #chainOf(initializer: ts.Expression) {
-    let root = initializer;
-    let argCount = 0;
-    while (
-      ts.isCallExpression(root) &&
-      ts.isPropertyAccessExpression(root.expression) &&
-      ts.isCallExpression(root.expression.expression)
-    ) {
-      if (SignalMutationIndex.#argMethods.has(root.expression.name.text)) argCount += 1;
-      root = root.expression.expression;
-    }
-    return { root: ts.isCallExpression(root) ? root.expression : undefined, argCount };
   }
 }

package/sshHostKeys.ts

@@ -0,0 +1,59 @@
+import { createHash } from "node:crypto";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { ConfigLock } from "./cloud/configLock";
+import { FileSys } from "./fileSys";
+
+type KnownHosts = Record<string, string>;
+
+export interface HostKeyVerdict {
+  trusted: boolean;
+  firstUse: boolean;
+  fingerprint: string;
+}
+
+export class SshHostKeys {
+  static defaultPath() {
+    return path.join(Bun.env.HOME ?? Bun.env.USERPROFILE ?? "", ".akan", "ssh_known_hosts.json");
+  }
+  static fingerprintOf(key: Buffer) {
+    return `SHA256:${createHash("sha256").update(key).digest("base64").replace(/=+$/, "")}`;
+  }
+  static parsePinned(value: string | undefined) {
+    return (value ?? "")
+      .split(",")
+      .map((fingerprint) => fingerprint.trim())
+      .filter(Boolean)
+      .map((fingerprint) => (fingerprint.startsWith("SHA256:") ? fingerprint : `SHA256:${fingerprint}`));
+  }
+  readonly filePath: string;
+  constructor(filePath: string = SshHostKeys.defaultPath()) {
+    this.filePath = filePath;
+  }
+  //? Pinned fingerprints decide alone; without them the first key a host shows is kept and any other is refused.
+  async verify(hostId: string, key: Buffer, pinned: string[] = []): Promise<HostKeyVerdict> {
+    const fingerprint = SshHostKeys.fingerprintOf(key);
+    if (pinned.length) return { trusted: pinned.includes(fingerprint), firstUse: false, fingerprint };
+    return await ConfigLock.run(`${this.filePath}.lock`, async () => {
+      const known = await this.#read();
+      const stored = known[hostId];
+      if (stored) return { trusted: stored === fingerprint, firstUse: false, fingerprint };
+      await this.#write({ ...known, [hostId]: fingerprint });
+      return { trusted: true, firstUse: true, fingerprint };
+    });
+  }
+  async #read(): Promise<KnownHosts> {
+    return (await FileSys.fileExists(this.filePath)) ? await FileSys.readJson<KnownHosts>(this.filePath) : {};
+  }
+  async #write(known: KnownHosts) {
+    await mkdir(path.dirname(this.filePath), { recursive: true, mode: 0o700 });
+    const temp = `${this.filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    try {
+      await writeFile(temp, JSON.stringify(known, null, 2), { mode: 0o600 });
+      await FileSys.replace(temp, this.filePath);
+    } catch (error) {
+      await rm(temp, { force: true });
+      throw error;
+    }
+  }
+}

package/storeSource.ts

@@ -1,3 +1,4 @@
+import { modelNames } from "akanjs/common";
 import ts from "typescript";
 import type { SourceFileInfo } from "./qualityScanner";
 
@@ -28,15 +29,15 @@ export class StoreSource {
 
   //? The actions `store()` generates that send a mutation; `upload<Field>On<Model>` only stages a file the form saves.
   static generatedWritesOf(refName: string) {
-    const model = `${refName.charAt(0).toUpperCase()}${refName.slice(1)}`;
+    const names = modelNames(refName);
     return [
-      `create${model}`,
-      `update${model}`,
-      `remove${model}`,
-      `merge${model}`,
-      `create${model}InForm`,
-      `update${model}InForm`,
-      `submit${model}`,
+      names.createModel,
+      names.updateModel,
+      names.removeModel,
+      names.mergeModel,
+      names.createModelInForm,
+      names.updateModelInForm,
+      names.submitModel,
     ];
   }
 

package/subspace.test.ts

@@ -513,6 +513,16 @@ describe("SubspaceConfig", () => {
     ).toThrow(/duplicate subspace/);
   });
 
+  test("refuses a subspace name that is not a plain folder name", () => {
+    for (const name of ["..", "../outside", "a/b", ".hidden", "-x", "a b"])
+      expect(() => new SubspaceConfig({ subspaces: [{ name, repo: "a.git", apps: ["one"] }] })).toThrow(
+        /subspace name .* takes letters, digits/,
+      );
+    expect(
+      new SubspaceConfig({ subspaces: [{ name: "acme.v2_beta-1", repo: "a.git", apps: ["one"] }] }).subspaces,
+    ).toHaveLength(1);
+  });
+
   test("refuses two subspaces on one cloud workspace, and takes a declaration with none", () => {
     expect(
       () =>

package/subspaceClone.ts

@@ -5,7 +5,7 @@ import { Executor, WorkspaceExecutor } from "./executors";
 import { FileSys } from "./fileSys";
 import { LibSource } from "./libSource";
 import { type SlicePlan, SlicePlanner } from "./slicePlanner";
-import type { SubspaceDeclaration } from "./subspaceConfig";
+import { SubspaceConfig, type SubspaceDeclaration } from "./subspaceConfig";
 import type { PackageJson } from "./types";
 
 export class SubspaceClone {
@@ -43,6 +43,8 @@ export class SubspaceClone {
   constructor(workspace: WorkspaceExecutor, declaration: SubspaceDeclaration) {
     this.#workspace = workspace;
     this.#declaration = declaration;
+    if (!SubspaceConfig.namePattern.test(declaration.name))
+      throw new Error(`Subspace name "${declaration.name}" cannot name a folder under .akan/subspace.`);
     this.#clonePath = path.join(workspace.workspaceRoot, ".akan/subspace", declaration.name);
     this.#clone = new Executor(`subspace-${declaration.name}`, this.#clonePath);
   }

package/subspaceConfig.ts

@@ -7,6 +7,7 @@ export type { SubspaceConfigInput, SubspaceDeclaration };
 export class SubspaceConfig {
   static readonly source = "subspace in the workspace root akan.config.ts";
   static readonly defaultPushableBranches = ["main", "develop", "debug"];
+  static readonly namePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 
   static async from(workspace: WorkspaceExecutor): Promise<SubspaceConfig | null> {
     const { subspace } = await workspace.getConfig();
@@ -31,6 +32,11 @@ export class SubspaceConfig {
     for (const subspace of this.subspaces) {
       if (!subspace.name || !subspace.repo)
         throw new Error(`${SubspaceConfig.source}: every subspace needs a name and a repo`);
+      //? The name is the clone folder under .akan/subspace, which a fresh clone empties first.
+      if (!SubspaceConfig.namePattern.test(subspace.name))
+        throw new Error(
+          `${SubspaceConfig.source}: subspace name "${subspace.name}" takes letters, digits, ".", "_" and "-", starting with a letter or digit`,
+        );
       if (seenNames.has(subspace.name))
         throw new Error(`${SubspaceConfig.source}: duplicate subspace "${subspace.name}"`);
       seenNames.add(subspace.name);

package/transforms/barrelImportsPlugin.ts

@@ -12,14 +12,17 @@ export interface BarrelImportsPluginOptions {
   pipeAfter?: (source: string, args: { path: string }) => string | Promise<string | null> | null;
   /** Barrels the bundle leaves external: a rewritten import would inline the modules the import map already serves. */
   external?: readonly string[];
+  /** The barrels to rewrite, instead of the app config's `barrelImports`. */
+  barrels?: readonly string[];
 }
 
 export const createBarrelImportsPlugin = async (
   app: App,
-  { skipPath = defaultSkipPath, pipeAfter, external = [] }: BarrelImportsPluginOptions = {},
+  { skipPath = defaultSkipPath, pipeAfter, external = [], barrels: only }: BarrelImportsPluginOptions = {},
 ): Promise<BunPlugin> => {
-  const akanConfig = await app.getConfig();
-  const barrels = [...new Set(akanConfig.barrelImports)].filter((barrel) => barrel && !external.includes(barrel));
+  const barrels = [...new Set(only ?? (await app.getConfig()).barrelImports)].filter(
+    (barrel) => barrel && !external.includes(barrel),
+  );
   const analyzer = new BarrelAnalyzer({
     resolvePackage: await createTsconfigPackageResolver(app),
   });
@@ -37,7 +40,10 @@ export const createBarrelImportsPlugin = async (
         async (args) => {
           const realPath = args.path.replace(/\?v=\d+$/, "");
           const loader = loaderFor(realPath);
-          let source = await Bun.file(realPath).text();
+          const file = Bun.file(realPath);
+          //? A build's `files` entry has no copy on disk: Bun loads it itself.
+          if (!(await file.exists())) return undefined;
+          let source = await file.text();
           if (skipPath(realPath)) return { contents: source, loader };
 
           // Bun's macro evaluator races when a rewritten module holds `with { type: "macro" }` imports while another

package/transforms/mcpAppPageTrimmer.test.ts

@@ -2,9 +2,15 @@ import { describe, expect, test } from "bun:test";
 import { symlink } from "node:fs/promises";
 import path from "node:path";
 import { tempDirs, writeText } from "../testHelpers";
+import { createBarrelImportsPlugin } from "./barrelImportsPlugin";
 import { McpAppPageTrimmer } from "./mcpAppPageTrimmer";
 
 const makeTempRoot = tempDirs("akan-mcp-app-trim-");
+const trimmerPlugin = async (root: string, pagePaths: string[]) =>
+  await createBarrelImportsPlugin(
+    { workspace: { workspaceRoot: root }, getTsConfig: async () => ({ compilerOptions: {} }) } as never,
+    { barrels: [], pipeAfter: McpAppPageTrimmer.pipe(pagePaths) },
+  );
 
 describe("McpAppPageTrimmer", () => {
   test("hands every stage but the apps a function that draws nothing, and keeps the rest of the chain as written", () => {
@@ -51,7 +57,7 @@ describe("McpAppPageTrimmer", () => {
     await writeText(path.join(root, "entry.ts"), 'import login from "./linked/login.tsx";\nexport { login };\n');
     const result = await Bun.build({
       entrypoints: [path.join(root, "entry.ts")],
-      plugins: [McpAppPageTrimmer.plugin([path.join(root, "linked/login.tsx")])],
+      plugins: [await trimmerPlugin(root, [path.join(root, "linked/login.tsx")])],
     });
     const [output] = result.outputs;
     expect(result.success).toBe(true);
@@ -73,7 +79,7 @@ describe("McpAppPageTrimmer", () => {
     await writeText(path.join(root, "entry.ts"), 'import trip from "./trip.tsx";\nconsole.info(trip);\n');
     const result = await Bun.build({
       entrypoints: [path.join(root, "entry.ts")],
-      plugins: [McpAppPageTrimmer.plugin([path.join(root, "trip.tsx")])],
+      plugins: [await trimmerPlugin(root, [path.join(root, "trip.tsx")])],
       splitting: false,
     });
     const text = (await result.outputs[0]?.text()) ?? "";

package/transforms/mcpAppPageTrimmer.ts

@@ -1,6 +1,4 @@
 import { realpathSync } from "node:fs";
-import path from "node:path";
-import type { BunPlugin } from "bun";
 import ts from "typescript";
 import { PureLazyMarker } from "./pureLazyMarker";
 
@@ -11,24 +9,11 @@ type ChainStage = ts.CallExpression & { expression: ts.PropertyAccessExpression
 export class McpAppPageTrimmer {
   static readonly #unused = new Set(["render", "head", "loading", "guard"]);
 
-  /** Trims exactly `pagePaths`: the rest of the graph loads as it does for the CSR shell. */
-  static plugin(pagePaths: string[]): BunPlugin {
-    return {
-      name: "akan-mcp-app-page",
-      setup(build) {
-        if (!pagePaths.length) return;
-        //? The bundler loads a module by the path a link points at: a synced lib page is one under `page/(libs)`.
-        const loadedPaths = new Set(
-          pagePaths.flatMap((pagePath) => [pagePath, McpAppPageTrimmer.#realPathOf(pagePath)]),
-        );
-        const filter = new RegExp(`^(?:${[...loadedPaths].map((pagePath) => RegExp.escape(pagePath)).join("|")})$`);
-        //? The bundler runs one onLoad per module, so this one also marks the page's own `lazy()` components.
-        build.onLoad({ filter }, async (args) => ({
-          contents: PureLazyMarker.mark(McpAppPageTrimmer.trim(await Bun.file(args.path).text(), args.path), args.path),
-          loader: path.extname(args.path).slice(1) as "tsx" | "ts" | "jsx" | "js",
-        }));
-      },
-    };
+  static pipe(pagePaths: string[]): (source: string, args: { path: string }) => string {
+    //? The bundler loads a module by the path a link points at: a synced lib page is one under `page/(libs)`.
+    const loadedPaths = new Set(pagePaths.flatMap((pagePath) => [pagePath, McpAppPageTrimmer.#realPathOf(pagePath)]));
+    return (source, { path: filePath }) =>
+      PureLazyMarker.mark(loadedPaths.has(filePath) ? McpAppPageTrimmer.trim(source, filePath) : source, filePath);
   }
 
   static trim(source: string, filePath: string): string {

package/transforms/pureLazyMarker.ts

@@ -25,7 +25,7 @@ export class PureLazyMarker {
 
   static mark(source: string, filePath: string): string {
     if (!source.includes("lazy(")) return source;
-    const kind = filePath.endsWith(".tsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS;
+    const kind = /\.[jt]sx$/.test(filePath) ? ts.ScriptKind.TSX : ts.ScriptKind.TS;
     const sourceFile = ts.createSourceFile(filePath, source, ts.ScriptTarget.Latest, true, kind);
     const starts: number[] = [];
     const visit = (node: ts.Node) => {