@dforge-core/dforge-mcp 0.2.28 → 0.2.30

package/dist/server.js

@@ -3226,8 +3226,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path18) {
-      let input = path18;
+    function removeDotSegments(path21) {
+      let input = path21;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3479,8 +3479,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path18, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path18 && path18 !== "/" ? path18 : void 0;
+        const [path21, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path21 && path21 !== "/" ? path21 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -6899,12 +6899,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs15, exportName) {
+    function addFormats(ajv, list, fs19, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs15[f]);
+        ajv.addFormat(f, fs19[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7271,8 +7271,8 @@ function getErrorMap() {
 
 // node_modules/.pnpm/zod@4.4.3/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path18, errorMaps, issueData } = params;
-  const fullPath = [...path18, ...issueData.path || []];
+  const { data, path: path21, errorMaps, issueData } = params;
+  const fullPath = [...path21, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -7387,11 +7387,11 @@ var errorUtil;
 
 // node_modules/.pnpm/zod@4.4.3/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path18, key) {
+  constructor(parent, value, path21, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path18;
+    this._path = path21;
     this._key = key;
   }
   get path() {
@@ -11311,10 +11311,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema2) {
   return mergeDefs(schema2._zod.def);
 }
-function getElementAtPath(obj, path18) {
-  if (!path18)
+function getElementAtPath(obj, path21) {
+  if (!path21)
     return obj;
-  return path18.reduce((acc, key) => acc?.[key], obj);
+  return path21.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11723,11 +11723,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path18, issues) {
+function prefixIssues(path21, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path18);
+    iss.path.unshift(path21);
     return iss;
   });
 }
@@ -11874,16 +11874,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path18 = []) => {
+  const processError = (error52, path21 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path18, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path21, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else {
-        const fullpath = [...path18, ...issue2.path];
+        const fullpath = [...path21, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -11910,17 +11910,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path18 = []) => {
+  const processError = (error52, path21 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path18, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path21, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else {
-        const fullpath = [...path18, ...issue2.path];
+        const fullpath = [...path21, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -11952,8 +11952,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path18 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path18) {
+  const path21 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path21) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -23065,11 +23065,11 @@ function normalizeObjectSchema(schema2) {
   }
   return void 0;
 }
-function getDotPath(path18) {
-  if (path18.length === 0) {
+function getDotPath(path21) {
+  if (path21.length === 0) {
     return "object root";
   }
-  return path18.reduce((acc, seg, index) => {
+  return path21.reduce((acc, seg, index) => {
     if (index === 0) {
       return String(seg);
     }
@@ -25094,13 +25094,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path18 = ref.slice(1).split("/").filter(Boolean);
-  if (path18.length === 0) {
+  const path21 = ref.slice(1).split("/").filter(Boolean);
+  if (path21.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path18[0] === defsKey) {
-    const key = path18[1];
+  if (path21[0] === defsKey) {
+    const key = path21[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -31002,7 +31002,7 @@ var import_node_crypto = require("crypto");
 var fs2 = __toESM(require("fs"));
 var path2 = __toESM(require("path"));
 
-// node_modules/.pnpm/@dforge-core+dforge-cli@0.2.22/node_modules/@dforge-core/dforge-cli/dist/lib.mjs
+// node_modules/.pnpm/@dforge-core+dforge-cli@0.2.23/node_modules/@dforge-core/dforge-cli/dist/lib.mjs
 function buildManifest(opts, moduleId) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const manifest = {
@@ -31201,6 +31201,7 @@ var SCHEMA_BINDINGS = [
   { fileMatch: ["entities/*.json"], schema: "entity" },
   { fileMatch: ["ui/data_views.json"], schema: "data-views" },
   { fileMatch: ["ui/folders.json"], schema: "folders" },
+  { fileMatch: ["docs/diagrams/*.json"], schema: "diagram" },
   { fileMatch: ["ui/menus.json"], schema: "menus" },
   { fileMatch: ["ui/reports.json"], schema: "reports" },
   { fileMatch: ["ui/print_templates.json"], schema: "print-templates" },
@@ -31283,7 +31284,7 @@ function buildZedTasks() {
 var fs = __toESM(require("fs"));
 var path = __toESM(require("path"));
 
-// node_modules/.pnpm/@dforge-core+metadata@0.0.29/node_modules/@dforge-core/metadata/dist/index.js
+// node_modules/.pnpm/@dforge-core+metadata@0.0.30/node_modules/@dforge-core/metadata/dist/index.js
 var AggType = {
   Sum: "sum",
   Count: "count",
@@ -31296,9 +31297,9 @@ var AGG_TYPE_LIST = Object.values(AggType);
 var fieldTypes = [
   { cd: "text", name: "Text", columnType: "D", baseDatatypeCd: "string", supportedAgg: null, maxLen: null, precision: null, useStringInFilter: true },
   { cd: "avatar", name: "Avatar Name", columnType: "D", baseDatatypeCd: "string", supportedAgg: null, maxLen: null, precision: null, useStringInFilter: true },
-  { cd: "email", name: "Email", columnType: "D", baseDatatypeCd: "string", supportedAgg: null, maxLen: null, precision: null, useStringInFilter: true },
-  { cd: "phone", name: "Phone", columnType: "D", baseDatatypeCd: "string", supportedAgg: null, maxLen: null, precision: null, useStringInFilter: true },
-  { cd: "url", name: "URL", columnType: "D", baseDatatypeCd: "string", supportedAgg: null, maxLen: null, precision: null, useStringInFilter: true },
+  { cd: "email", name: "Email", columnType: "D", baseDatatypeCd: "string", supportedAgg: null, maxLen: null, precision: null, useStringInFilter: true, defParams: { pattern: "^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$" } },
+  { cd: "phone", name: "Phone", columnType: "D", baseDatatypeCd: "string", supportedAgg: null, maxLen: null, precision: null, useStringInFilter: true, defParams: { pattern: "^\\+?[0-9\\s\\-().]+$" } },
+  { cd: "url", name: "URL", columnType: "D", baseDatatypeCd: "string", supportedAgg: null, maxLen: null, precision: null, useStringInFilter: true, defParams: { pattern: "^https?://.+", patternFlags: "i" } },
   { cd: "textarea", name: "Multiline Text", columnType: "D", baseDatatypeCd: "string", supportedAgg: null, maxLen: null, precision: null, useStringInFilter: true },
   { cd: "number", name: "Number", columnType: "D", baseDatatypeCd: "number", supportedAgg: "SCAM", maxLen: null, precision: null, useStringInFilter: false },
   { cd: "currency", name: "Currency", columnType: "D", baseDatatypeCd: "number", supportedAgg: "SCAM", maxLen: null, precision: 2, useStringInFilter: false },
@@ -31466,19 +31467,19 @@ function addTraitField(sink, key, def) {
     }
   }
 }
-function expandTraitInner(traitCd, entityName, localTraits, path18, sink) {
-  if (path18.has(traitCd)) return;
-  path18.add(traitCd);
+function expandTraitInner(traitCd, entityName, localTraits, path21, sink) {
+  if (path21.has(traitCd)) return;
+  path21.add(traitCd);
   const trait = localTraits && Object.hasOwn(localTraits, traitCd) ? localTraits[traitCd] : byCd3.get(traitCd);
   if (trait) {
     for (const included of trait.includes ?? []) {
-      expandTraitInner(included, entityName, localTraits, path18, sink);
+      expandTraitInner(included, entityName, localTraits, path21, sink);
     }
     for (const [name, def] of Object.entries(trait.fields ?? {})) {
       addTraitField(sink, applyTemplate(name, entityName), templateField(def, entityName));
     }
   }
-  path18.delete(traitCd);
+  path21.delete(traitCd);
 }
 function expandTraits(traitCds, entityName, localTraits) {
   const sink = { fields: emptyFields(), origin: /* @__PURE__ */ new Map() };
@@ -31538,10 +31539,12 @@ function modulePaths(moduleDir) {
     translationsDir: path.join(root, "translations"),
     dataViews: path.join(root, "ui", "data_views.json"),
     folders: path.join(root, "ui", "folders.json"),
+    diagramsDir: path.join(root, "docs", "diagrams"),
     menus: path.join(root, "ui", "menus.json"),
     actions: path.join(root, "ui", "actions.json"),
     reports: path.join(root, "ui", "reports.json"),
     queries: path.join(root, "ui", "queries.json"),
+    storedProcedures: path.join(root, "logic", "stored_procedures.json"),
     printTemplates: path.join(root, "ui", "print_templates.json"),
     roles: path.join(root, "security", "roles.json"),
     jobs: path.join(root, "logic", "jobs.json"),
@@ -31569,6 +31572,52 @@ function readJsonOrDefault(absPath, dflt) {
     throw new Error(`${absPath}: ${e.message}`);
   }
 }
+function diagramFiles(diagramsDir) {
+  if (!fs.existsSync(diagramsDir)) return [];
+  return fs.readdirSync(diagramsDir).filter((f) => f.endsWith(".json")).sort().map((f) => path.join(diagramsDir, f));
+}
+function isPlannedDiagramKey(key, entityMap) {
+  return !key.includes(".") && !Object.prototype.hasOwnProperty.call(entityMap, key);
+}
+function likelyMisspelledEntity(key, entityMap) {
+  let best;
+  for (const code2 of Object.keys(entityMap)) {
+    if (code2.includes(".")) continue;
+    const d = editDistance(key, code2);
+    if (d > 2 || d >= Math.min(key.length, code2.length) / 3) continue;
+    if (!best || d < best.d) best = { code: code2, d };
+  }
+  return best?.code;
+}
+function editDistance(a, b) {
+  let prev = Array.from({ length: b.length + 1 }, (_, j) => j);
+  for (let i = 1; i <= a.length; i++) {
+    const cur = [i];
+    for (let j = 1; j <= b.length; j++) {
+      cur[j] = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+    }
+    prev = cur;
+  }
+  return prev[b.length];
+}
+function diagramKeyProblem(key, entityMap, deps, root) {
+  if (Object.prototype.hasOwnProperty.call(entityMap, key)) return void 0;
+  const dep = [...deps].filter((d) => key.startsWith(`${d}.`) && key.length > d.length + 1).sort((a, b) => b.length - a.length)[0];
+  if (!dep) {
+    return key.includes(".") ? `'${key}' is not an entity of this module, and no declared dependency matches its module prefix. Declare the dependency, or drop the entity from the diagram.` : `'${key}' is not an entity in manifest.entities. Drop it from the diagram, or fix the code.`;
+  }
+  const contractPath = path.join(root, "deps", `${dep}.json`);
+  if (!fs.existsSync(contractPath)) return void 0;
+  let consumed;
+  try {
+    consumed = JSON.parse(fs.readFileSync(contractPath, "utf8"))?.entities;
+  } catch {
+    return void 0;
+  }
+  if (!consumed || typeof consumed !== "object") return void 0;
+  const entity = key.slice(dep.length + 1);
+  return Object.prototype.hasOwnProperty.call(consumed, entity) ? void 0 : `'${entity}' is not among the entities deps/${dep}.json consumes from '${dep}'. Add it to the contract if the module uses it, or drop it from the diagram.`;
+}
 function jsonText(obj) {
   return JSON.stringify(obj, null, "	") + "\n";
 }
@@ -34207,6 +34256,20 @@ function entityRename(args) {
   const entityMap = manifest.entities ?? {};
   if (!(oldE in entityMap)) throw new Error(`Entity '${oldE}' is not in the manifest.`);
   if (newE in entityMap) throw new Error(`Entity '${newE}' already exists in this module.`);
+  const collisions = diagramFiles(paths.diagramsDir).filter((fp) => {
+    let d;
+    try {
+      d = JSON.parse(fs6.readFileSync(fp, "utf8"));
+    } catch {
+      return false;
+    }
+    return !!d && typeof d === "object" && diagramMentions(d, oldE) && diagramMentions(d, newE);
+  }).map((fp) => `docs/diagrams/${path8.basename(fp)}`);
+  if (collisions.length > 0) {
+    throw new Error(
+      `${collisions.join(", ")} already draw${collisions.length === 1 ? "s" : ""} a '${newE}' alongside '${oldE}' \u2014 renaming would merge the two nodes. Remove or rename '${newE}' in the diagram first.`
+    );
+  }
   const files = {};
   const deletes = [];
   const changes = [];
@@ -34312,6 +34375,36 @@ function entityRename(args) {
     files[rel(paths.root, paths.folders)] = jsonText(folders);
     changes.push("folders.json (entity bindings)");
   }
+  for (const fp of diagramFiles(paths.diagramsDir)) {
+    let d;
+    try {
+      d = JSON.parse(fs6.readFileSync(fp, "utf8"));
+    } catch {
+      continue;
+    }
+    if (!d || typeof d !== "object") continue;
+    const what = [];
+    const ents = d.entities;
+    if (ents && typeof ents === "object" && oldE in ents) {
+      d.entities = renameKey(ents, oldE, newE);
+      what.push("entity key");
+    }
+    let relTouched = false;
+    for (const r of diagramRelations(d)) {
+      if (r.from === oldE) {
+        r.from = newE;
+        relTouched = true;
+      }
+      if (r.to === oldE) {
+        r.to = newE;
+        relTouched = true;
+      }
+    }
+    if (relTouched) what.push("relations");
+    if (what.length === 0) continue;
+    files[rel(paths.root, fp)] = jsonText(d);
+    changes.push(`docs/diagrams/${path8.basename(fp)} (${what.join(", ")})`);
+  }
   if (fs6.existsSync(paths.seedDataDir)) {
     for (const file2 of fs6.readdirSync(paths.seedDataDir).filter((f) => f.endsWith(".json"))) {
       const fp = path8.join(paths.seedDataDir, file2);
@@ -34338,6 +34431,17 @@ function entityRename(args) {
     deletes
   );
 }
+function diagramRelations(d) {
+  if (!Array.isArray(d.relations)) return [];
+  return d.relations.filter(
+    (r) => !!r && typeof r === "object" && !Array.isArray(r)
+  );
+}
+function diagramMentions(d, key) {
+  const ents = d.entities;
+  if (ents && typeof ents === "object" && Object.prototype.hasOwnProperty.call(ents, key)) return true;
+  return diagramRelations(d).some((r) => r.from === key || r.to === key);
+}
 var entityDeleteSchema = {
   moduleDir: external_exports.string().describe("Path to the module root."),
   entityName: code.describe("Entity code to delete.")
@@ -34405,6 +34509,29 @@ function entityDelete(args) {
     files[rel(paths.root, paths.folders)] = jsonText(folders);
     changes.push("folders.json (binding)");
   }
+  for (const fp of diagramFiles(paths.diagramsDir)) {
+    let d;
+    try {
+      d = JSON.parse(fs6.readFileSync(fp, "utf8"));
+    } catch {
+      continue;
+    }
+    if (!d || typeof d !== "object") continue;
+    const what = [];
+    const ents = d.entities;
+    if (ents && typeof ents === "object" && target in ents) {
+      delete ents[target];
+      what.push("entity key");
+    }
+    const doomed = new Set(diagramRelations(d).filter((r) => r.from === target || r.to === target));
+    if (doomed.size > 0) {
+      d.relations = d.relations.filter((r) => !doomed.has(r));
+      what.push("relations");
+    }
+    if (what.length === 0) continue;
+    files[rel(paths.root, fp)] = jsonText(d);
+    changes.push(`docs/diagrams/${path8.basename(fp)} (${what.join(", ")})`);
+  }
   const views = readJsonOrDefault(paths.dataViews, {});
   let viewsTouched = false;
   const removedViews = [];
@@ -34465,7 +34592,7 @@ function entityDelete(args) {
 // src/tools/action-add.ts
 var path9 = __toESM(require("path"));
 
-// node_modules/.pnpm/@dforge-core+metadata@0.0.29/node_modules/@dforge-core/metadata/dist/dsl/index.js
+// node_modules/.pnpm/@dforge-core+metadata@0.0.30/node_modules/@dforge-core/metadata/dist/dsl/index.js
 var PUNCT3 = ["===", "!=="];
 var PUNCT2 = [
   "==",
@@ -36739,6 +36866,81 @@ function folderAdd(args) {
     }
   );
 }
+var diagramAddSchema = {
+  moduleDir: external_exports.string(),
+  code: external_exports.string().regex(/^[a-z][a-z0-9_]*$/).describe("Diagram code \u2014 becomes the file name docs/diagrams/<code>.json."),
+  label: external_exports.string().optional().describe("Display name. Defaults to the fromFolder's label, else the code."),
+  description: external_exports.string().optional().describe("What part of the model the diagram covers."),
+  entities: external_exports.array(external_exports.string().min(1)).default([]).describe(
+    "Entity keys to draw: the manifest's own entity code ('invoice'), or 'module.entity' for an entity of a declared dependency ('parties.party') \u2014 the same form a field link's `entity` takes."
+  ),
+  fromFolder: external_exports.string().optional().describe(
+    "A folder code from ui/folders.json (anywhere in the tree). Adds the entities bound to that folder AND to all its descendants."
+  ),
+  showBoundary: external_exports.boolean().optional().describe(
+    "Also draw the entities outside the diagram that its entities reference or are referenced by, as header-only stubs. Default true."
+  )
+};
+function diagramAdd(args) {
+  if (!/^[a-z][a-z0-9_]*$/.test(args.code)) {
+    throw new Error(`Diagram code '${args.code}' must be snake_case (^[a-z][a-z0-9_]*$) \u2014 it becomes the file name.`);
+  }
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const entityMap = manifest.entities ?? {};
+  const deps = new Set(Object.keys(manifest.dependencies ?? {}));
+  const keys = [...args.entities];
+  let folderLabel;
+  if (args.fromFolder !== void 0) {
+    const root = readJsonOrDefault(paths.folders, {});
+    const folder = walkFolders(root).find((f) => f.code === args.fromFolder);
+    if (!folder) {
+      throw new Error(
+        `Folder '${args.fromFolder}' is not in ui/folders.json. Pass a sub-folder's code (codes are unique across the tree); for every entity in the module, list them in 'entities' instead.`
+      );
+    }
+    if (typeof folder.node.label === "string") folderLabel = folder.node.label;
+    for (const node of [folder.node, ...walkFolders(folder.node).map((f) => f.node)]) {
+      keys.push(...Object.keys(node.entities ?? {}));
+    }
+  }
+  const wanted = [...new Set(keys)];
+  const problems = wanted.map((k) => diagramKeyProblem(k, entityMap, deps, paths.root)).filter((p) => p !== void 0);
+  if (problems.length > 0) {
+    throw new Error(`Nothing written \u2014 ${problems.join(" ")}`);
+  }
+  const file2 = path13.join(paths.diagramsDir, `${args.code}.json`);
+  const exists = fs10.existsSync(file2);
+  let diagram;
+  if (exists) {
+    const existing = readJson(file2);
+    if (!existing || typeof existing !== "object" || Array.isArray(existing) || !existing.entities || typeof existing.entities !== "object" || Array.isArray(existing.entities)) {
+      throw new Error(
+        `${rel(paths.root, file2)} is not a diagram (an object with an 'entities' map) \u2014 fix or delete it first.`
+      );
+    }
+    diagram = existing;
+    if (args.label !== void 0) diagram.label = args.label;
+    if (args.description !== void 0) diagram.description = args.description;
+    if (args.showBoundary !== void 0) diagram.showBoundary = args.showBoundary;
+  } else {
+    diagram = { label: args.label ?? folderLabel ?? args.code };
+    if (args.description !== void 0) diagram.description = args.description;
+    diagram.entities = {};
+    if (args.showBoundary !== void 0) diagram.showBoundary = args.showBoundary;
+  }
+  const entities = diagram.entities;
+  const added = wanted.filter((k) => !Object.prototype.hasOwnProperty.call(entities, k));
+  for (const k of added) entities[k] = {};
+  const relPath = rel(paths.root, file2);
+  const present = wanted.length - added.length;
+  return makeResult(
+    exists ? `Updated diagram '${args.code}' (${relPath}): added ${added.length} entit${added.length === 1 ? "y" : "ies"}${present ? `, ${present} already drawn` : ""}.` : `Created diagram '${args.code}' (${relPath}) with ${added.length} entit${added.length === 1 ? "y" : "ies"}.`,
+    {
+      [relPath]: jsonText(diagram),
+      "manifest.json": jsonText(withTodayStamp(manifest))
+    }
+  );
+}
 var SYSTEM_MODULES = /* @__PURE__ */ new Set(["admin", "metadata", "workspace"]);
 var dependencyAddSchema = {
   moduleDir: external_exports.string(),
@@ -36900,6 +37102,18 @@ function moduleInspect(args) {
   }));
   const foldersTree = readJsonOrDefault(paths.folders, {});
   const folderDepth = computeDepth(foldersTree);
+  const diagramSummaries = diagramFiles(paths.diagramsDir).map((fp) => {
+    let d = {};
+    try {
+      d = JSON.parse(fs11.readFileSync(fp, "utf8"));
+    } catch {
+    }
+    return {
+      code: path14.basename(fp, ".json"),
+      label: typeof d?.label === "string" ? d.label : void 0,
+      entities: Object.keys(d?.entities ?? {})
+    };
+  });
   const menus = readJsonOrDefault(paths.menus, {});
   const menuSummaries = Object.entries(menus).map(([code2, m]) => ({
     code: code2,
@@ -36967,6 +37181,7 @@ function moduleInspect(args) {
     entities: entitySummaries,
     views: viewSummaries,
     folders: { tree: foldersTree, depth: folderDepth },
+    diagrams: diagramSummaries,
     menus: menuSummaries,
     roles: roleSummaries,
     actions: actionSummaries,
@@ -36996,52 +37211,17 @@ function computeDepth(folder, current = 1) {
   return childDepths.length === 0 ? current : Math.max(...childDepths);
 }
 
-// src/tools/module-validate.ts
+// src/tools/validate/context.ts
 var fs12 = __toESM(require("fs"));
 var path15 = __toESM(require("path"));
-var moduleValidateSchema = {
-  moduleDir: external_exports.string().describe("Path to the module root. Run this after authoring and before dforge_module_pack.")
-};
 var SYSTEM_ENTITY_PK = {
   user: "user_id",
   document: "document_id",
   menu_item: "menu_item_id",
   resource: "resource_id"
 };
-var COLUMN_AGNOSTIC_VIEW_TYPES = /* @__PURE__ */ new Set(["diagram", "matrix", "library"]);
-function hasVisibleScalarColumn(fields) {
-  for (const f of Object.values(fields)) {
-    if (!f || typeof f !== "object") continue;
-    const flags = typeof f.flags === "string" ? f.flags : "";
-    if (flags.includes("V") && f.columnType !== "S") return true;
-  }
-  return false;
-}
-function resolveTranslationFile(translationsDir, locale) {
-  const exact = path15.join(translationsDir, `${locale}.json`);
-  if (fs12.existsSync(exact)) return exact;
-  if (!fs12.existsSync(translationsDir)) return void 0;
-  const want = `${locale}.json`.toLowerCase();
-  for (const f of fs12.readdirSync(translationsDir)) {
-    if (f.toLowerCase() === want) return path15.join(translationsDir, f);
-  }
-  return void 0;
-}
-function hasConstraintOverride(root, entityCd, constraintCd) {
-  if (!root || typeof root !== "object") return false;
-  const entities = root.entities;
-  if (!entities || typeof entities !== "object") return false;
-  const entity = entities[entityCd];
-  if (!entity || typeof entity !== "object") return false;
-  const constraints = entity.constraints;
-  if (!constraints || typeof constraints !== "object") return false;
-  const ck = constraints[constraintCd];
-  if (!ck || typeof ck !== "object") return false;
-  const msg = ck.message;
-  return typeof msg === "string" && msg.trim() !== "";
-}
-function moduleValidate(args, cli) {
-  const { paths, manifest } = loadManifest(args.moduleDir);
+function loadContext(moduleDir) {
+  const { paths, manifest } = loadManifest(moduleDir);
   const issues = [];
   const err = (where, message) => issues.push({ level: "error", where, message });
   const warn = (where, message) => issues.push({ level: "warning", where, message });
@@ -37102,6 +37282,35 @@ function moduleValidate(args, cli) {
     if (e && (e.traits ?? []).includes("identity")) return `${code2}_id`;
     return void 0;
   };
+  const views = readJsonOrDefault(paths.dataViews, {});
+  const supportedLocales = Array.isArray(manifest.supportedLocales) ? manifest.supportedLocales.filter((l) => typeof l === "string") : [];
+  return {
+    moduleDir,
+    paths,
+    manifest,
+    issues,
+    err,
+    warn,
+    entityMap,
+    entities,
+    columnsOf,
+    fieldDefsOf,
+    partialColumns,
+    deps,
+    isKnownEntity,
+    pkOf: pkOf2,
+    views,
+    viewCodes: new Set(Object.keys(views)),
+    roles: readJsonOrDefault(paths.roles, {}),
+    actions: readJsonOrDefault(paths.actions, {}),
+    reports: readJsonOrDefault(paths.reports, {}),
+    supportedLocales
+  };
+}
+
+// src/tools/validate/entities.ts
+function checkReferences(ctx) {
+  const { err, warn, entities, columnsOf, isKnownEntity, pkOf: pkOf2 } = ctx;
   for (const [name, e] of Object.entries(entities)) {
     const fields = e.fields ?? {};
     for (const [fname, f] of Object.entries(fields)) {
@@ -37133,6 +37342,9 @@ function moduleValidate(args, cli) {
       }
     }
   }
+}
+function checkEntityViews(ctx) {
+  const { err, entities, columnsOf, fieldDefsOf, pkOf: pkOf2 } = ctx;
   for (const [name, e] of Object.entries(entities)) {
     const entityViews = e.views ?? {};
     if (Object.keys(entityViews).length === 0) continue;
@@ -37194,8 +37406,118 @@ function moduleValidate(args, cli) {
       }
     }
   }
-  const views = readJsonOrDefault(paths.dataViews, {});
-  const viewCodes = new Set(Object.keys(views));
+}
+function checkFieldSpecs(ctx) {
+  const { issues, entities } = ctx;
+  for (const [name, e] of Object.entries(entities)) {
+    const fields = e.fields ?? {};
+    for (const [fname, f] of Object.entries(fields)) {
+      for (const issue2 of checkFieldSpec(`${name}.${fname}`, f)) {
+        issues.push({ level: issue2.level, where: `entities/${name}.json`, message: issue2.message });
+      }
+    }
+  }
+}
+function checkToString(ctx) {
+  const { err, warn, entities, columnsOf } = ctx;
+  for (const [name, e] of Object.entries(entities)) {
+    const isExtension = typeof e.extends === "string" && e.extends.length > 0;
+    const ts = Object.prototype.hasOwnProperty.call(e, "toString") ? e.toString : void 0;
+    if (ts === void 0 || ts === null || typeof ts === "string" && ts.trim() === "") {
+      if (!isExtension) {
+        warn(
+          `entities/${name}.json`,
+          `has no 'toString' template \u2014 every entity should have one, e.g. "toString": "{name}" (extension entities use null to inherit the base).`
+        );
+      }
+      continue;
+    }
+    if (typeof ts !== "string") {
+      err(`entities/${name}.json`, `'toString' must be a string template, got ${typeof ts}.`);
+      continue;
+    }
+    const braces = [...ts.matchAll(/\{([a-z][a-z0-9_]*)\}/gi)].map((m) => m[1]);
+    if (braces.length === 0) {
+      warn(
+        `entities/${name}.json`,
+        `'toString' is "${ts}" with no {column} placeholder \u2014 every record will render the same label.`
+      );
+    }
+    for (const b of braces) {
+      if (!columnsOf[name].has(b)) {
+        err(
+          `entities/${name}.json`,
+          `'toString' references {${b}}, which is not a column on '${name}'.`
+        );
+      }
+    }
+  }
+}
+function checkSetAggregates(ctx) {
+  const { err, warn, entities, fieldDefsOf } = ctx;
+  for (const [name, e] of Object.entries(entities)) {
+    const fields = e.fields ?? {};
+    for (const [fname, f] of Object.entries(fields)) {
+      const formula = typeof f?.formula === "string" ? f.formula : "";
+      if (!formula) continue;
+      const agg = parseSetAggregate(formula);
+      if (!agg) continue;
+      const where = `entities/${name}.json \u2192 ${fname}`;
+      if (f.columnType === "F") {
+        err(
+          where,
+          `is a Formula ('F') column with a set aggregate ${agg.agg}([${agg.setField}].[${agg.childField}]) \u2014 an F set-aggregate is unsupported and silently renders empty. Use a Generated ('G') column with dbDatatype + formula instead. (See dforge://reference/column-types.)`
+        );
+        continue;
+      }
+      if (f.columnType !== "G") continue;
+      const setCol = fields[agg.setField] ?? fieldDefsOf[name]?.[agg.setField];
+      if (!setCol) {
+        err(where, `aggregates over '[${agg.setField}]', which is not a column on '${name}'.`);
+        continue;
+      }
+      if (setCol.columnType !== "S") {
+        warn(
+          where,
+          `aggregates over '[${agg.setField}]', which is not a set column (columnType 'S') on '${name}'.`
+        );
+        continue;
+      }
+      const childEntity = setCol.link?.entity;
+      if (!childEntity) continue;
+      const childDefs = fieldDefsOf[childEntity];
+      if (!childDefs) continue;
+      const childCol = childDefs[agg.childField];
+      if (!childCol) {
+        err(
+          where,
+          `aggregates '[${agg.setField}].[${agg.childField}]' but '${agg.childField}' is not a column on child entity '${childEntity}'.`
+        );
+        continue;
+      }
+      const childType = typeof childCol.columnType === "string" ? childCol.columnType : "D";
+      if (childType === "F" || childType === "R" || childType === "S") {
+        err(
+          where,
+          `aggregates '[${agg.setField}].[${agg.childField}]', but '${childEntity}.${agg.childField}' is a virtual '${childType}' column. A Generated aggregate reads the child's PHYSICAL column \u2014 install fails with \`column old.${agg.childField} does not exist\`. Aggregate a 'D' (or same-row 'G') child column instead.`
+        );
+      }
+    }
+  }
+}
+
+// src/tools/validate/views.ts
+var COLUMN_AGNOSTIC_VIEW_TYPES = /* @__PURE__ */ new Set(["diagram", "matrix", "library"]);
+function hasVisibleScalarColumn(fields) {
+  for (const f of Object.values(fields)) {
+    if (!f || typeof f !== "object") continue;
+    const flags = typeof f.flags === "string" ? f.flags : "";
+    if (flags.includes("V") && f.columnType !== "S") return true;
+  }
+  return false;
+}
+function checkDataViews(ctx) {
+  const { err, columnsOf, isKnownEntity, views } = ctx;
   for (const [vcode, v] of Object.entries(views)) {
     const sources = v.dataSources ?? [];
     for (const s of sources) {
@@ -37214,6 +37536,9 @@ function moduleValidate(args, cli) {
       }
     }
   }
+}
+function checkVisibleColumns(ctx) {
+  const { err, fieldDefsOf, views } = ctx;
   const vcSeen = /* @__PURE__ */ new Set();
   for (const [vcode, v] of Object.entries(views)) {
     const sources = v.dataSources ?? [];
@@ -37235,6 +37560,9 @@ function moduleValidate(args, cli) {
       );
     }
   }
+}
+function checkMenus(ctx) {
+  const { paths, err, viewCodes } = ctx;
   const menus = readJsonOrDefault(paths.menus, {});
   const walk = (node, where) => {
     if (!node || typeof node !== "object") return;
@@ -37248,9 +37576,31 @@ function moduleValidate(args, cli) {
     }
   };
   for (const [mcode, m] of Object.entries(menus)) walk(m, `menus \u2192 ${mcode}`);
-  const roles = readJsonOrDefault(paths.roles, {});
-  const actions = readJsonOrDefault(paths.actions, {});
-  const reports = readJsonOrDefault(paths.reports, {});
+}
+
+// src/tools/validate/security.ts
+var fs13 = __toESM(require("fs"));
+function checkRoleRights(ctx) {
+  const { paths, manifest, err, deps, isKnownEntity, roles, actions, reports } = ctx;
+  const storedProcedures = readJsonOrDefault(paths.storedProcedures, {});
+  const checkObjectKey = (rcode, key, kind, own, absFile, file2) => {
+    const ref = key.slice(kind.length + 1);
+    const noun = kind === "sp" ? "stored procedure" : "report";
+    if (!/^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)?$/.test(ref)) {
+      err(`roles \u2192 ${rcode}`, `malformed rights key '${key}' \u2014 expected '${kind}:code' or '${kind}:module.code', each part matching [a-z][a-z0-9_]*`);
+      return;
+    }
+    const dot = ref.indexOf(".");
+    const mod = dot < 0 ? manifest.code : ref.slice(0, dot);
+    const code2 = dot < 0 ? ref : ref.slice(dot + 1);
+    if (mod !== manifest.code) {
+      if (!deps.has(mod)) err(`roles \u2192 ${rcode}`, `grants on '${key}' but '${mod}' is not a declared dependency`);
+    } else if (!fs13.existsSync(absFile)) {
+      err(`roles \u2192 ${rcode}`, `grants on '${key}' but ${file2} is missing \u2014 declare the ${noun} there`);
+    } else if (!(code2 in own)) {
+      err(`roles \u2192 ${rcode}`, `grants on '${key}' but no such ${noun} exists in ${file2}`);
+    }
+  };
   for (const [rcode, r] of Object.entries(roles)) {
     const rights = r.rights ?? {};
     for (const key of Object.keys(rights)) {
@@ -37258,22 +37608,55 @@ function moduleValidate(args, cli) {
         const a = key.slice("action:".length);
         if (!(a in actions)) err(`roles \u2192 ${rcode}`, `grants on 'action:${a}' but no such action exists`);
       } else if (key.startsWith("report:")) {
-        const rp = key.slice("report:".length);
-        if (!(rp in reports)) err(`roles \u2192 ${rcode}`, `grants on 'report:${rp}' but no such report exists`);
+        checkObjectKey(rcode, key, "report", reports, paths.reports, "ui/reports.json");
+      } else if (key.startsWith("sp:")) {
+        checkObjectKey(rcode, key, "sp", storedProcedures, paths.storedProcedures, "logic/stored_procedures.json");
       } else if (key.startsWith("folder:")) {
       } else if (!isKnownEntity(key)) {
         err(`roles \u2192 ${rcode}`, `grants rights on '${key}', which is not a known entity (same-module, system, or a declared cross-module dependency)`);
       }
     }
   }
+}
+function checkSelectCoverage(ctx) {
+  const { moduleDir, warn } = ctx;
   try {
-    const { uncoveredEntities } = checkSecurityCoverage(args.moduleDir);
+    const { uncoveredEntities } = checkSecurityCoverage(moduleDir);
     for (const e of uncoveredEntities) {
       warn("security", `entity '${e}' has no role granting Select (S) \u2014 it will be inaccessible`);
     }
   } catch {
   }
-  const supportedLocales = Array.isArray(manifest.supportedLocales) ? manifest.supportedLocales.filter((l) => typeof l === "string") : [];
+}
+
+// src/tools/validate/translations.ts
+var fs14 = __toESM(require("fs"));
+var path16 = __toESM(require("path"));
+function resolveTranslationFile(translationsDir, locale) {
+  const exact = path16.join(translationsDir, `${locale}.json`);
+  if (fs14.existsSync(exact)) return exact;
+  if (!fs14.existsSync(translationsDir)) return void 0;
+  const want = `${locale}.json`.toLowerCase();
+  for (const f of fs14.readdirSync(translationsDir)) {
+    if (f.toLowerCase() === want) return path16.join(translationsDir, f);
+  }
+  return void 0;
+}
+function hasConstraintOverride(root, entityCd, constraintCd) {
+  if (!root || typeof root !== "object") return false;
+  const entities = root.entities;
+  if (!entities || typeof entities !== "object") return false;
+  const entity = entities[entityCd];
+  if (!entity || typeof entity !== "object") return false;
+  const constraints = entity.constraints;
+  if (!constraints || typeof constraints !== "object") return false;
+  const ck = constraints[constraintCd];
+  if (!ck || typeof ck !== "object") return false;
+  const msg = ck.message;
+  return typeof msg === "string" && msg.trim() !== "";
+}
+function checkConstraintTranslations(ctx) {
+  const { paths, warn, entities, supportedLocales } = ctx;
   if (supportedLocales.length > 0) {
     const declared = [];
     for (const [name, e] of Object.entries(entities)) {
@@ -37301,7 +37684,7 @@ function moduleValidate(args, cli) {
         const abs = resolveTranslationFile(paths.translationsDir, locale);
         if (abs) {
           try {
-            tx = JSON.parse(fs12.readFileSync(abs, "utf8"));
+            tx = JSON.parse(fs14.readFileSync(abs, "utf8"));
           } catch {
             tx = null;
           }
@@ -37317,95 +37700,54 @@ function moduleValidate(args, cli) {
       }
     }
   }
-  for (const [name, e] of Object.entries(entities)) {
-    const fields = e.fields ?? {};
-    for (const [fname, f] of Object.entries(fields)) {
-      for (const issue2 of checkFieldSpec(`${name}.${fname}`, f)) {
-        issues.push({ level: issue2.level, where: `entities/${name}.json`, message: issue2.message });
-      }
+}
+function checkTranslationCompleteness(ctx) {
+  const { paths, err, warn, roles, supportedLocales } = ctx;
+  const roleCodes = Object.keys(roles);
+  const localeFiles = fs14.existsSync(paths.translationsDir) ? fs14.readdirSync(paths.translationsDir).filter((f) => f.toLowerCase().endsWith(".json")).sort() : [];
+  for (const raw of supportedLocales) {
+    const locale = raw.trim();
+    if (!locale) continue;
+    if (!resolveTranslationFile(paths.translationsDir, locale)) {
+      err(
+        "translations",
+        `manifest.supportedLocales lists '${locale}' but translations/${locale}.json does not exist \u2014 install fails translation completeness validation.`
+      );
     }
   }
-  for (const [name, e] of Object.entries(entities)) {
-    const isExtension = typeof e.extends === "string" && e.extends.length > 0;
-    const ts = Object.prototype.hasOwnProperty.call(e, "toString") ? e.toString : void 0;
-    if (ts === void 0 || ts === null || typeof ts === "string" && ts.trim() === "") {
-      if (!isExtension) {
-        warn(
-          `entities/${name}.json`,
-          `has no 'toString' template \u2014 every entity should have one, e.g. "toString": "{name}" (extension entities use null to inherit the base).`
-        );
-      }
-      continue;
-    }
-    if (typeof ts !== "string") {
-      err(`entities/${name}.json`, `'toString' must be a string template, got ${typeof ts}.`);
+  if (roleCodes.length > 0 && localeFiles.length === 0) {
+    warn(
+      "translations",
+      `no translations/ files \u2014 ship at least translations/en-US.json with a roles block (a 'label' for each of: ${roleCodes.join(", ")}); role labels are completeness-enforced at install.`
+    );
+  }
+  for (const file2 of localeFiles) {
+    let tx;
+    try {
+      tx = JSON.parse(fs14.readFileSync(path16.join(paths.translationsDir, file2), "utf8"));
+    } catch (ex) {
+      err(`translations/${file2}`, `invalid JSON: ${ex.message}`);
       continue;
     }
-    const braces = [...ts.matchAll(/\{([a-z][a-z0-9_]*)\}/gi)].map((m) => m[1]);
-    if (braces.length === 0) {
-      warn(
-        `entities/${name}.json`,
-        `'toString' is "${ts}" with no {column} placeholder \u2014 every record will render the same label.`
+    const txRoles = tx.roles ?? {};
+    const missing = roleCodes.filter((rc) => {
+      const entry = txRoles[rc];
+      return !entry || typeof entry.label !== "string" || entry.label.trim() === "";
+    });
+    if (missing.length > 0) {
+      err(
+        `translations/${file2}`,
+        `missing roles.<code>.label for: ${missing.join(", ")} \u2014 completeness is enforced in every locale (including en-US); install fails with "Label for role '<code>'."`
       );
     }
-    for (const b of braces) {
-      if (!columnsOf[name].has(b)) {
-        err(
-          `entities/${name}.json`,
-          `'toString' references {${b}}, which is not a column on '${name}'.`
-        );
-      }
-    }
-  }
-  for (const [name, e] of Object.entries(entities)) {
-    const fields = e.fields ?? {};
-    for (const [fname, f] of Object.entries(fields)) {
-      const formula = typeof f?.formula === "string" ? f.formula : "";
-      if (!formula) continue;
-      const agg = parseSetAggregate(formula);
-      if (!agg) continue;
-      const where = `entities/${name}.json \u2192 ${fname}`;
-      if (f.columnType === "F") {
-        err(
-          where,
-          `is a Formula ('F') column with a set aggregate ${agg.agg}([${agg.setField}].[${agg.childField}]) \u2014 an F set-aggregate is unsupported and silently renders empty. Use a Generated ('G') column with dbDatatype + formula instead. (See dforge://reference/column-types.)`
-        );
-        continue;
-      }
-      if (f.columnType !== "G") continue;
-      const setCol = fields[agg.setField] ?? fieldDefsOf[name]?.[agg.setField];
-      if (!setCol) {
-        err(where, `aggregates over '[${agg.setField}]', which is not a column on '${name}'.`);
-        continue;
-      }
-      if (setCol.columnType !== "S") {
-        warn(
-          where,
-          `aggregates over '[${agg.setField}]', which is not a set column (columnType 'S') on '${name}'.`
-        );
-        continue;
-      }
-      const childEntity = setCol.link?.entity;
-      if (!childEntity) continue;
-      const childDefs = fieldDefsOf[childEntity];
-      if (!childDefs) continue;
-      const childCol = childDefs[agg.childField];
-      if (!childCol) {
-        err(
-          where,
-          `aggregates '[${agg.setField}].[${agg.childField}]' but '${agg.childField}' is not a column on child entity '${childEntity}'.`
-        );
-        continue;
-      }
-      const childType = typeof childCol.columnType === "string" ? childCol.columnType : "D";
-      if (childType === "F" || childType === "R" || childType === "S") {
-        err(
-          where,
-          `aggregates '[${agg.setField}].[${agg.childField}]', but '${childEntity}.${agg.childField}' is a virtual '${childType}' column. A Generated aggregate reads the child's PHYSICAL column \u2014 install fails with \`column old.${agg.childField} does not exist\`. Aggregate a 'D' (or same-row 'G') child column instead.`
-        );
-      }
-    }
   }
+}
+
+// src/tools/validate/logic.ts
+var fs15 = __toESM(require("fs"));
+var path17 = __toESM(require("path"));
+function checkActions(ctx) {
+  const { paths, err, isKnownEntity, actions } = ctx;
   for (const [acode, a] of Object.entries(actions)) {
     const act = a ?? {};
     const where = `actions \u2192 ${acode}`;
@@ -37417,7 +37759,7 @@ function moduleValidate(args, cli) {
         where,
         `script '${script}' must be a BARE filename \u2014 no path, no '.dsl' extension (e.g. "script": "${script.replace(/\.dsl$/, "").split(/[\\/]/).pop()}").`
       );
-    } else if (!fs12.existsSync(path15.join(paths.logicDir, "actions", `${script}.dsl`))) {
+    } else if (!fs15.existsSync(path17.join(paths.logicDir, "actions", `${script}.dsl`))) {
       err(where, `script '${script}' has no file at logic/actions/${script}.dsl.`);
     }
     const ent = act.entityCode ?? act.entity;
@@ -37425,6 +37767,9 @@ function moduleValidate(args, cli) {
       err(where, `targets entity '${ent}', which is not a known entity.`);
     }
   }
+}
+function checkTriggersJobsWebhooks(ctx) {
+  const { paths, manifest, issues, err, deps, isKnownEntity, actions } = ctx;
   const isKnownAction = (code2) => {
     if (code2 in actions) return true;
     const dot = code2.indexOf(".");
@@ -37458,11 +37803,11 @@ function moduleValidate(args, cli) {
       const registered = actions[act] ?? {};
       const script = registered.script;
       if (typeof script === "string") {
-        const dslPath = path15.join(paths.logicDir, "actions", `${script}.dsl`);
-        if (fs12.existsSync(dslPath)) {
+        const dslPath = path17.join(paths.logicDir, "actions", `${script}.dsl`);
+        if (fs15.existsSync(dslPath)) {
           let body = "";
           try {
-            body = fs12.readFileSync(dslPath, "utf8");
+            body = fs15.readFileSync(dslPath, "utf8");
           } catch {
           }
           for (const issue2 of checkDsl2(body, {
@@ -37488,14 +37833,17 @@ function moduleValidate(args, cli) {
       err(`webhooks \u2192 ${String(w.code ?? "?")}`, `is bound to entity '${ent}', which is not a known entity.`);
     }
   }
+}
+function checkActionDsl(ctx) {
+  const { paths, manifest, issues, columnsOf, partialColumns, actions } = ctx;
   for (const [acode, a] of Object.entries(actions)) {
     const script = a?.script;
     if (typeof script !== "string" || !script) continue;
-    const dslPath = path15.join(paths.logicDir, "actions", `${script}.dsl`);
-    if (!fs12.existsSync(dslPath)) continue;
+    const dslPath = path17.join(paths.logicDir, "actions", `${script}.dsl`);
+    if (!fs15.existsSync(dslPath)) continue;
     let body;
     try {
-      body = fs12.readFileSync(dslPath, "utf8");
+      body = fs15.readFileSync(dslPath, "utf8");
     } catch {
       continue;
     }
@@ -37518,6 +37866,13 @@ function moduleValidate(args, cli) {
       });
     }
   }
+}
+
+// src/tools/validate/folders.ts
+var fs16 = __toESM(require("fs"));
+var path18 = __toESM(require("path"));
+function checkFolders(ctx) {
+  const { paths, err, entities } = ctx;
   const folderRoot = readJsonOrDefault(paths.folders, {});
   for (const [code2, dupPaths] of duplicateFolderCodes(folderRoot)) {
     err(
@@ -37549,6 +37904,55 @@ function moduleValidate(args, cli) {
       }
     }
   }
+}
+function checkDiagrams(ctx) {
+  const { paths, err, warn, entityMap, deps } = ctx;
+  for (const fp of diagramFiles(paths.diagramsDir)) {
+    const where = `docs/diagrams/${path18.basename(fp)}`;
+    let diagram;
+    try {
+      diagram = JSON.parse(fs16.readFileSync(fp, "utf8"));
+    } catch (ex) {
+      err(where, `invalid JSON: ${ex.message}`);
+      continue;
+    }
+    if (!diagram || typeof diagram !== "object" || Array.isArray(diagram)) {
+      warn(where, "must be an object \u2014 the diagram itself, with an 'entities' map.");
+      continue;
+    }
+    const diagramEntities = diagram.entities;
+    if (!diagramEntities || typeof diagramEntities !== "object" || Array.isArray(diagramEntities)) {
+      warn(where, "has no 'entities' object \u2014 list the entities the diagram draws, keyed by entity code.");
+      continue;
+    }
+    for (const [key, placement] of Object.entries(diagramEntities)) {
+      const at = `${where} \u2192 entities.${key}`;
+      if (isPlannedDiagramKey(key, entityMap)) {
+        const meant = likelyMisspelledEntity(key, entityMap);
+        if (meant) {
+          warn(
+            at,
+            `'${key}' is not built yet, so the diagram draws it as a planned entity. If you meant the existing '${meant}', fix the key.`
+          );
+        }
+      } else {
+        const unresolved = diagramKeyProblem(key, entityMap, deps, paths.root);
+        if (unresolved) warn(at, unresolved);
+      }
+      const p = placement && typeof placement === "object" ? placement : {};
+      if ("x" in p !== "y" in p) {
+        warn(
+          at,
+          `sets '${"x" in p ? "x" : "y"}' without '${"x" in p ? "y" : "x"}'. Give both to pin the entity, or neither to let the diagram place it.`
+        );
+      }
+    }
+  }
+}
+
+// src/tools/validate/reports.ts
+function checkReports(ctx) {
+  const { manifest, err, warn, fieldDefsOf, deps, isKnownEntity, reports } = ctx;
   for (const [rcode, rawReport] of Object.entries(reports)) {
     const report = rawReport ?? {};
     const where = `ui/reports.json \u2192 ${rcode}`;
@@ -37662,44 +38066,36 @@ function moduleValidate(args, cli) {
       );
     }
   }
-  const roleCodes = Object.keys(roles);
-  const localeFiles = fs12.existsSync(paths.translationsDir) ? fs12.readdirSync(paths.translationsDir).filter((f) => f.toLowerCase().endsWith(".json")).sort() : [];
-  for (const raw of supportedLocales) {
-    const locale = raw.trim();
-    if (!locale) continue;
-    if (!resolveTranslationFile(paths.translationsDir, locale)) {
-      err(
-        "translations",
-        `manifest.supportedLocales lists '${locale}' but translations/${locale}.json does not exist \u2014 install fails translation completeness validation.`
-      );
-    }
-  }
-  if (roleCodes.length > 0 && localeFiles.length === 0) {
-    warn(
-      "translations",
-      `no translations/ files \u2014 ship at least translations/en-US.json with a roles block (a 'label' for each of: ${roleCodes.join(", ")}); role labels are completeness-enforced at install.`
-    );
-  }
-  for (const file2 of localeFiles) {
-    let tx;
-    try {
-      tx = JSON.parse(fs12.readFileSync(path15.join(paths.translationsDir, file2), "utf8"));
-    } catch (ex) {
-      err(`translations/${file2}`, `invalid JSON: ${ex.message}`);
-      continue;
-    }
-    const txRoles = tx.roles ?? {};
-    const missing = roleCodes.filter((rc) => {
-      const entry = txRoles[rc];
-      return !entry || typeof entry.label !== "string" || entry.label.trim() === "";
-    });
-    if (missing.length > 0) {
-      err(
-        `translations/${file2}`,
-        `missing roles.<code>.label for: ${missing.join(", ")} \u2014 completeness is enforced in every locale (including en-US); install fails with "Label for role '<code>'."`
-      );
-    }
-  }
+}
+
+// src/tools/module-validate.ts
+var moduleValidateSchema = {
+  moduleDir: external_exports.string().describe("Path to the module root. Run this after authoring and before dforge_module_pack.")
+};
+var CHECKS = [
+  checkReferences,
+  checkEntityViews,
+  checkDataViews,
+  checkVisibleColumns,
+  checkMenus,
+  checkRoleRights,
+  checkSelectCoverage,
+  checkConstraintTranslations,
+  checkFieldSpecs,
+  checkToString,
+  checkSetAggregates,
+  checkActions,
+  checkTriggersJobsWebhooks,
+  checkActionDsl,
+  checkFolders,
+  checkDiagrams,
+  checkReports,
+  checkTranslationCompleteness
+];
+function moduleValidate(args, cli) {
+  const ctx = loadContext(args.moduleDir);
+  for (const check2 of CHECKS) check2(ctx);
+  const { manifest, issues, err, warn, entities, viewCodes, roles } = ctx;
   if (cli) {
     const res = cli(args.moduleDir);
     if ("unavailable" in res) {
@@ -37881,18 +38277,18 @@ function webhookAdd(args) {
 }
 
 // src/tools/apply.ts
-var fs13 = __toESM(require("fs"));
-var path16 = __toESM(require("path"));
+var fs17 = __toESM(require("fs"));
+var path19 = __toESM(require("path"));
 var applyInput = {
   apply: external_exports.boolean().default(false).describe(
     "When true, WRITE the resulting files to disk (and remove any `deletes`) instead of returning their contents for the client to write. The response then lists the paths touched. Use it for routine patches the user isn't reviewing line-by-line; leave it false when you want to preview a diff first."
   )
 };
-var isReportPayload = (relPath) => path16.basename(relPath).startsWith("_");
+var isReportPayload = (relPath) => path19.basename(relPath).startsWith("_");
 function resolveInside(root, relPath) {
-  const abs = path16.resolve(root, relPath);
-  const rel2 = path16.relative(root, abs);
-  if (rel2.startsWith("..") || path16.isAbsolute(rel2)) {
+  const abs = path19.resolve(root, relPath);
+  const rel2 = path19.relative(root, abs);
+  if (rel2.startsWith("..") || path19.isAbsolute(rel2)) {
     throw new Error(
       `Refusing to write '${relPath}' \u2014 it resolves outside the module directory (${abs}).`
     );
@@ -37900,7 +38296,7 @@ function resolveInside(root, relPath) {
   return abs;
 }
 function applyToDisk(moduleDir, result) {
-  const root = path16.resolve(moduleDir);
+  const root = path19.resolve(moduleDir);
   const written = [];
   const skipped = [];
   for (const [relPath, contents] of Object.entries(result.files ?? {})) {
@@ -37909,8 +38305,8 @@ function applyToDisk(moduleDir, result) {
       continue;
     }
     const abs = resolveInside(root, relPath);
-    fs13.mkdirSync(path16.dirname(abs), { recursive: true });
-    fs13.writeFileSync(abs, contents, "utf8");
+    fs17.mkdirSync(path19.dirname(abs), { recursive: true });
+    fs17.writeFileSync(abs, contents, "utf8");
     written.push(relPath);
   }
   const deleted = [];
@@ -37918,7 +38314,7 @@ function applyToDisk(moduleDir, result) {
     const abs = resolveInside(root, relPath);
     let stat;
     try {
-      stat = fs13.lstatSync(abs);
+      stat = fs17.lstatSync(abs);
     } catch {
       continue;
     }
@@ -37927,7 +38323,7 @@ function applyToDisk(moduleDir, result) {
         `Refusing to delete '${relPath}': it is a directory, and \`deletes\` is a file-only contract (it exists to remove a renamed entity's old JSON or an orphaned seed file). Remove the directory by hand if that is really what you want.`
       );
     }
-    fs13.rmSync(abs, { force: true });
+    fs17.rmSync(abs, { force: true });
     deleted.push(relPath);
   }
   const out = {
@@ -37942,10 +38338,10 @@ function applyToDisk(moduleDir, result) {
 }
 
 // src/resources/index.ts
-var fs14 = __toESM(require("fs"));
-var path17 = __toESM(require("path"));
-var RESOURCES_DIR = path17.resolve(__dirname, "..", "resources");
-var SKILL_DIR = path17.resolve(__dirname, "..", "skills", "dforge-mcp-author");
+var fs18 = __toESM(require("fs"));
+var path20 = __toESM(require("path"));
+var RESOURCES_DIR = path20.resolve(__dirname, "..", "resources");
+var SKILL_DIR = path20.resolve(__dirname, "..", "skills", "dforge-mcp-author");
 function schema(name, label, description) {
   return {
     uri: `dforge://schema/${name}`,
@@ -38022,6 +38418,11 @@ var resources = [
     "Folders JSON schema",
     "JSON Schema for ui/folders.json \u2014 root folder tree with per-entity view bindings."
   ),
+  schema(
+    "diagram",
+    "Diagram JSON schema",
+    "JSON Schema for docs/diagrams/<code>.json \u2014 one entity diagram per file, the file name is its code (a subset of entities + optional x/y placement each). Design-time only: install ignores it."
+  ),
   schema(
     "menus",
     "Menus JSON schema",
@@ -38148,20 +38549,20 @@ var resources = [
   columnSecurityExample("README.md", "Why entity views exist, what each of the two views demonstrates, and the five ways a view fails the install.")
 ];
 function readVendored(rel2) {
-  const p = path17.join(RESOURCES_DIR, rel2);
-  if (!fs14.existsSync(p)) {
+  const p = path20.join(RESOURCES_DIR, rel2);
+  if (!fs18.existsSync(p)) {
     return `// Resource missing at build time: ${rel2}
 // Run scripts/vendor-resources.sh in dforge-mcp to refresh from dForge-core.`;
   }
-  return fs14.readFileSync(p, "utf8");
+  return fs18.readFileSync(p, "utf8");
 }
 function readSkill(rel2) {
-  const p = path17.join(SKILL_DIR, rel2);
-  if (!fs14.existsSync(p)) {
+  const p = path20.join(SKILL_DIR, rel2);
+  if (!fs18.existsSync(p)) {
     return `// Skill resource missing: ${rel2}
 // Expected under skills/dforge-mcp-author/ \u2014 check the package 'files' list.`;
   }
-  return fs14.readFileSync(p, "utf8");
+  return fs18.readFileSync(p, "utf8");
 }
 
 // src/server.ts
@@ -38309,7 +38710,7 @@ server.registerTool(
   "dforge_entity_rename",
   {
     title: "Rename an entity (refactor-safe)",
-    description: "Refactor-safe rename of an entity code. Moves the entity file (old is listed in the response's `deletes` \u2014 delete it), renames the manifest key, cascades the identity PK {old}_id \u2192 {new}_id wherever an FK targets it, and repoints every reference: other entities' link.entity / references.to, view entityCode, role rights keys, action entity, folder bindings, and seed-data entityCode + PK keys. Reports/translations/menu labels/DSL are NOT rewritten (warned). Apply `files` AND `deletes` (or pass apply: true), then run dforge_module_validate.",
+    description: "Refactor-safe rename of an entity code. Moves the entity file (old is listed in the response's `deletes` \u2014 delete it), renames the manifest key, cascades the identity PK {old}_id \u2192 {new}_id wherever an FK targets it, and repoints every reference: other entities' link.entity / references.to, view entityCode, role rights keys, action entity, folder bindings, diagram entity keys and relation endpoints (docs/diagrams/*.json \u2014 refused if a diagram already draws the new code next to the old), and seed-data entityCode + PK keys. Reports/translations/menu labels/DSL are NOT rewritten (warned). Apply `files` AND `deletes` (or pass apply: true), then run dforge_module_validate.",
     inputSchema: { ...entityRenameSchema, ...applyInput },
     annotations: DESTRUCTIVE
   },
@@ -38319,7 +38720,7 @@ server.registerTool(
   "dforge_entity_delete",
   {
     title: "Delete an entity (refactor-safe)",
-    description: "Refactor-safe deletion of an entity. Removes the entity file + its seed files (listed in `deletes`), drops the manifest entry, role rights key, folder binding, and data-view sources (deleting a view left with no source). Cross-entity FKs targeting it, actions on it, and menus pointing at removed views are surfaced as warnings \u2014 fix those by hand. Apply `files` AND `deletes` (or pass apply: true), then run dforge_module_validate.",
+    description: "Refactor-safe deletion of an entity. Removes the entity file + its seed files (listed in `deletes`), drops the manifest entry, role rights key, folder binding, diagram entries and the relations touching it (docs/diagrams/*.json), and data-view sources (deleting a view left with no source). Cross-entity FKs targeting it, actions on it, and menus pointing at removed views are surfaced as warnings \u2014 fix those by hand. Apply `files` AND `deletes` (or pass apply: true), then run dforge_module_validate.",
     inputSchema: { ...entityDeleteSchema, ...applyInput },
     annotations: DESTRUCTIVE
   },
@@ -38534,6 +38935,15 @@ server.registerTool(
   },
   envelope(dependencyAdd)
 );
+server.registerTool(
+  "dforge_diagram_add",
+  {
+    title: "Add or extend an entity diagram",
+    description: "Create or extend a named entity diagram, docs/diagrams/<code>.json \u2014 one file per diagram, drawing a chosen subset of entities. Design-time only (install ignores it). Use it on a LARGE module to give each functional area its own readable diagram (e.g. 'billing', 'inventory'); a small module needs none. Pass `entities` (own code, or 'module.entity' for a declared dependency) and/or `fromFolder` to take a folder's entities plus all its descendants'. On an existing diagram it only appends missing entities \u2014 positions already set are kept and nothing is removed. Leave layout to the editor: new entities get no x/y. An entity key that resolves to nothing is rejected and nothing is written.",
+    inputSchema: { ...diagramAddSchema, ...applyInput }
+  },
+  envelope(diagramAdd)
+);
 server.registerTool(
   "dforge_dbml_import",
   {