@endora-commerce/platform 0.100.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Endora sp. z o.o. and the Endora Commerce contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,58 @@
+# `@endora-commerce/platform` — the host package
+
+The surface an installed extension package compiles against. Five enumerated `exports`
+subpaths, one per platform directory that has published API; no root export and no wildcard
+(D-160.7). The design, the classification behind it and every rejected alternative are in
+`specs/080-f4-real-scope/contracts/host-package.md`; this file records only what is peculiar
+to the package directory itself.
+
+## It has no `src/`, and that is the answer to the placement question
+
+The contract's §2.1 points every subpath at `./dist/<dir>/index.js` and its §8 step 5 says
+`rootDir`. Read together those two sentences imply the package's own `src/` holds `kernel/`,
+`http/`, `tenancy/`, `commands/` and `events/` — which would mean **relocating five
+directories out of `backend/src`**: 82 files, plus every relative specifier aimed at them from
+the 1400-plus module files, plus both composition roots and the whole test tree. §9 records
+that `tsc -p` over a host package with `rootDir` set was never run, so this was the part the
+contract had not tested.
+
+It is not required. `tsconfig.build.json` sets `rootDir` to `../../backend/src` and includes
+exactly the five published directories. `tsc` emits paths relative to `rootDir`, so the layout
+under `dist` is `kernel/`, `http/`, `tenancy/`, `commands/`, `events/` — byte-for-byte the
+layout §2.1's `exports` map names, with the sources left where 1400 files already point at
+them.
+
+Two measurements make that safe rather than lucky:
+
+- **The five directories are closed under relative imports.** 82 files, and **zero**
+  specifiers escaping the set — nothing reaches `db/`, `overlay/`, `packages/`, `modules/` or
+  `apps/`. So the `include` list is the whole compilation and no `db/index.js` (§1.4f: 219
+  module-owned entity references) can be dragged in behind it.
+- **`backend`'s own build is untouched.** `backend` type-checks with `--noEmit` and executes
+  through `tsx`/`vitest`; it does not compile these files to `dist`. Nothing about this
+  package changes what `backend` reads or emits, and the emitted output lands only under
+  `packages/platform/dist`, which is git-ignored.
+
+The relocation stays available and stays cheap in the direction that matters: moving the
+sources here later changes `rootDir` and `include` and nothing else, because the `exports`
+map already names the emitted layout rather than the source layout.
+
+## Two tsconfigs, for the reason the other packages have two
+
+`tsconfig.json` type-checks with `tsconfig.base.json`'s `paths` active — `@endora-commerce/*`
+resolves at a sibling's source, which is what keeps a worktree honest (issue #255) — and
+carries `noEmit`. `tsconfig.build.json` clears `paths`, sets `rootDir`, and emits with
+`noEmitOnError`. Do not merge them: `rootDir` with an active `paths` block is TS6059, which
+exits 2 **and** writes the sibling's output beside the sibling's source.
+
+`rootDir` is deliberately absent from the type-check half. Here it would be a guaranteed
+TS6059 — with `paths` active, `@endora-commerce/contracts` resolves into
+`packages/contracts/src`, which no `rootDir` this package could name contains.
+
+## No `lint` and no `test` script
+
+The sources belong to the `backend` workspace, which lints them (`eslint src`) and tests them
+(`backend/test`). A second `eslint` pass over the same files from here would be a second
+author of the same verdict, and the package's own probes — the type probe, the runtime probe
+and the distribution-shape assertions — live in `backend/test/unit/packages/`, where the rest
+of the packaging evidence already is.

package/dist/cli/dispatch.d.ts

@@ -0,0 +1,146 @@
+/**
+ * The operator CLI, whole: argv in, an exit code out
+ * (`specs/123-oss-install-experience/` G2, T2-B).
+ *
+ * ## Why the process moved here, when `./cli`'s own header said it would not
+ *
+ * That header — and `HOST_INTERNAL_SUBPATHS`' entry beside it — said *"the
+ * process around it — argv, the composition, the system scope and the exit code
+ * — stays in the application at `backend/src/cli.ts`"*. It was written when this
+ * repository was the only application there was, and it was measured wrong the
+ * moment a second one existed: `endora new instance` reported
+ * `backend/src/cli.ts` as an **omission**, so a scaffolded instance could run no
+ * command its modules declared — no `admin_users create`, and therefore nobody
+ * to log in to the admin bundle A5 and A13 prove is built and styled.
+ *
+ * The alternative was rendering ~170 lines of dispatch into a client's tree,
+ * which is the copy `contracts/operator-half.md` R7.1 refuses in as many words:
+ * *"a client's copy of it is a copy that diverges the first time we correct
+ * ours"*. D-207 is the same rule from the other side — an instance takes the
+ * platform as a dependency and receives none of the host's sources.
+ *
+ * **What is left in an application is genuinely the application's**, and it is
+ * the four suppliers below rather than nothing: which manifests this build ships
+ * as core, which composition it composes, where its own demo composition lives,
+ * and the one directory holding `apps/`. This repository supplies all four; a
+ * scaffolded instance supplies the last one and takes the defaults, which is why
+ * its entry point is five lines.
+ *
+ * ## `./cli` is still host-internal, and this changes nothing about that
+ *
+ * D-160.14's third state is unmoved: `./cli` is declared by the `exports` map,
+ * carried by no published barrel, and a **module** naming it is
+ * `host-internal-subpath` — refused. The consumer here is an application's entry
+ * point, which is not a module, and which already names `./composition`,
+ * `./db`, `./lifecycle`, `./overlay`, `./packages` and `./kernel` in the six
+ * wiring files `endora new instance` renders. No subpath is added and
+ * `PUBLISHED_SUBPATHS` stays at five.
+ */
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { KernelContainer } from '../kernel/container.js';
+import type { RegisteredManifestEntry } from '../lifecycle/index.js';
+import { type DemoCompositionLoader } from '../demo/host-command.js';
+import { type RunModuleCommandOptions } from './module-commands.js';
+/**
+ * How an operator reached this dispatcher, as their own shell writes it.
+ *
+ * **Defect F-1** (`specs/125-first-mile-install/spec.md` §2.5, T1-F). This text
+ * was a constant opening `usage: endora <module id> <command>`, and in a
+ * scaffolded instance `endora` on the path is a **different program**: the
+ * scaffolder, `@endora-commerce/cli`, whose `bin` is `endora` and which has no
+ * `demo` verb and no `<module id>` positional. So the tool's own help
+ * contradicted the tool's own next step — `endora new instance` correctly
+ * prints `pnpm run cli …` — and a stranger following the help got an
+ * unknown-command refusal from a program they did not think they were running.
+ *
+ * The dispatcher cannot see how it was invoked, and `process.argv[1]` is no
+ * answer: it is a path to a compiled entry point (`…/backend/dist/cli.js`),
+ * which is a worse sentence than either name. So it is **told**, and the
+ * default below is a scaffolded instance's own line, because a scaffolded
+ * instance is the audience the defect was measured on. This repository's entry
+ * point passes its own.
+ */
+export declare const DEFAULT_CLI_PROGRAM = "pnpm run cli";
+/** The usage text, addressed to whoever is actually running it. */
+export declare function cliUsage(program?: string): string;
+/**
+ * The composed platform, as this file reads it.
+ *
+ * Structurally a `ComposeAppHandle` and deliberately *not* that type by name:
+ * naming it would put a runtime edge from `./cli` to `./composition`, and the
+ * whole of the composition graph would load for a `--list` that composes
+ * nothing. The default supplier imports it dynamically, one function down.
+ */
+export interface CliComposition {
+    readonly container: KernelContainer;
+    readonly contextFor: RunModuleCommandOptions['contextFor'];
+    readonly resolvedModules: readonly RegisteredManifestEntry[];
+    readonly orm: {
+        readonly em: {
+            fork(): EntityManager;
+        };
+    };
+    dispose(): Promise<void>;
+}
+export interface RunCliOptions {
+    /**
+     * The absolute path of the directory that holds `apps/` — the one thing no
+     * package can derive for itself, for `composeApp`'s own reason.
+     */
+    readonly deploymentRoot: string;
+    /** Defaults to `process.argv.slice(2)`. */
+    readonly argv?: readonly string[];
+    /**
+     * How this tree's operator reaches this dispatcher, for the usage text and
+     * every help sentence under it. Defaults to {@link DEFAULT_CLI_PROGRAM},
+     * which is a scaffolded instance's own line — see that constant for the
+     * defect this parameter exists for.
+     */
+    readonly program?: string;
+    /**
+     * The manifest set, answered **before** anything is opened.
+     *
+     * `resolvedManifestEntries()` in this repository, because its core half is a
+     * generated index this build ships. An instance ships none, so the default
+     * below is the instance's answer: its overlay modules and every installed
+     * package.
+     */
+    readonly resolveEntries?: () => Promise<readonly RegisteredManifestEntry[]>;
+    /**
+     * The composition. This repository's own `composeApp`, which carries its
+     * generated composition; an instance takes `@endora-commerce/platform`'s.
+     */
+    readonly compose?: () => Promise<CliComposition>;
+    /** Where this tree keeps its demo composition, if it has one (§5.6). */
+    readonly demoComposition?: DemoCompositionLoader;
+    readonly out?: (chunk: string) => void;
+    readonly err?: (chunk: string) => void;
+    readonly env?: NodeJS.ProcessEnv;
+}
+/**
+ * Decide and run, and return the exit code. It opens no process concern of its
+ * own, which is what lets a test drive it.
+ */
+export declare function dispatchCli(options: RunCliOptions): Promise<number>;
+/**
+ * The exit code a thrown failure earns, with the sentence an operator reads.
+ *
+ * The one discrimination here is not a conditional re-throw: both branches exit
+ * non-zero and neither lets the command's work proceed. It exists because a
+ * stack trace is the wrong answer to "this module is switched off" — the
+ * operator needs the sentence and the module id, which the error already
+ * carries.
+ */
+export declare function cliFailureExitCode(thrown: unknown, err: (chunk: string) => void): number;
+/**
+ * The whole of an operator CLI entry point: dispatch, then exit.
+ *
+ * No `try`/`catch` anywhere above a command's body, and this is why: a `catch`
+ * around a port call swallows `ModuleDisabledError` and turns fail-closed into
+ * fail-open, which is what `check:port-catches` refuses. A `.catch()` **method**
+ * on the entry promise is outside that check's population by construction
+ * (D-157.3), and it is the right place for a CLI to turn a throw into an exit
+ * code.
+ */
+export declare function runCli(options: RunCliOptions): Promise<never>;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/cli/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/cli/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAQL,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD,mEAAmE;AACnE,wBAAgB,QAAQ,CAAC,OAAO,GAAE,MAA4B,GAAG,MAAM,CAmBtE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAC3D,QAAQ,CAAC,eAAe,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC7D,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE;YAAE,IAAI,IAAI,aAAa,CAAA;SAAE,CAAA;KAAE,CAAC;IACzD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAC;IAC5E;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IACjD,wEAAwE;IACxE,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACjD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC;AAqGD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoFzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,CAgBxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,CAK7D"}

package/dist/cli/dispatch.js

@@ -0,0 +1,259 @@
+import { effectiveState } from '../kernel/lifecycle/effective-state.js';
+import { ModuleDisabledError } from '../kernel/lifecycle/plugin-helpers.js';
+import { enterSystemScope } from '../kernel/scope.js';
+import { instanceManifestEntries } from '../lifecycle/commands/operator-entry.js';
+import { DEMO_HOST_COMMANDS, NO_DEMO_COMPOSITION_NOTICE, demoEntriesFrom, demoHelpFor, formatHostCommandList, isDemoInvocation, parseDemoVerb, } from '../demo/host-command.js';
+import { formatDemoReport } from '../demo/report.js';
+import { mustBeNonProduction } from '../demo/guard.js';
+import { runDemo, unwrapDemoFailure } from '../demo/runner.js';
+import { DEMO_RESET_SCOPE_REASON, DEMO_SEED_SCOPE_REASON } from '../demo/scope.js';
+import { collectModuleCommands, findModuleCommand, formatCommandList, helpFor, runModuleCommand, } from './module-commands.js';
+/**
+ * How an operator reached this dispatcher, as their own shell writes it.
+ *
+ * **Defect F-1** (`specs/125-first-mile-install/spec.md` §2.5, T1-F). This text
+ * was a constant opening `usage: endora <module id> <command>`, and in a
+ * scaffolded instance `endora` on the path is a **different program**: the
+ * scaffolder, `@endora-commerce/cli`, whose `bin` is `endora` and which has no
+ * `demo` verb and no `<module id>` positional. So the tool's own help
+ * contradicted the tool's own next step — `endora new instance` correctly
+ * prints `pnpm run cli …` — and a stranger following the help got an
+ * unknown-command refusal from a program they did not think they were running.
+ *
+ * The dispatcher cannot see how it was invoked, and `process.argv[1]` is no
+ * answer: it is a path to a compiled entry point (`…/backend/dist/cli.js`),
+ * which is a worse sentence than either name. So it is **told**, and the
+ * default below is a scaffolded instance's own line, because a scaffolded
+ * instance is the audience the defect was measured on. This repository's entry
+ * point passes its own.
+ */
+export const DEFAULT_CLI_PROGRAM = 'pnpm run cli';
+/** The usage text, addressed to whoever is actually running it. */
+export function cliUsage(program = DEFAULT_CLI_PROGRAM) {
+    const pad = ' '.repeat('usage: '.length);
+    return `usage: ${program} <module id> <command> [args…]
+${pad}${program} <module id> <command> --help
+${pad}${program} demo seed | ${program} demo reset
+${pad}${program} --list
+
+Runs an operator command a module declares in its \`manifest.ts\`. The host
+composes the platform once and hands the command its module's own context, so
+it resolves the same services — and the same deployment decorations — the
+running server does.
+
+\`demo\` is the host's own command rather than any module's: it fans out over
+every module that declares demo data in its manifest, in the order the
+dependency graph gives, and then applies this instance's composition.
+
+  --list        every command this instance offers, including an overlay
+                module's and an installed package's
+`;
+}
+/**
+ * `endora demo seed` / `endora demo reset` (feature 113 Phase 0, §3.3–§3.4).
+ *
+ * The order of the first three statements **is** the contract, and nothing else
+ * in this file has this property:
+ *
+ *  1. **The guard, first** — before anything is composed, before a scope is
+ *     opened, and outside every `try` (§3.3). A refusal here writes nothing,
+ *     which is the whole of FR-012, and it cannot be reached through a `catch`
+ *     that decided to continue because there is no `catch` above it.
+ *  2. **One composition**, exactly as a module-declared command gets, so a demo
+ *     body resolves the same services — and the same deployment decorations —
+ *     the running server does.
+ *  3. **One system scope for the whole run** (§3.4), so no module's demo body is
+ *     its own entry point, and no module's body has to remember to open one.
+ *
+ * Presence is decided inside `runDemo`, from the declaration and before a
+ * context is built (§3.5) — the rule `runModuleCommand` already applies one
+ * command at a time, applied here once per declaring module.
+ *
+ * The composition is loaded from the calling tree and handed in (§5.2). A tree
+ * that has none is an ordinary tree: every present module still seeds its own
+ * rows and the notice below says so once (§5.6).
+ */
+async function runDemoCommand(verb, resolved, compose, loadComposition, out) {
+    mustBeNonProduction();
+    const entries = demoEntriesFrom(resolved);
+    const composition = await compose();
+    try {
+        return await enterSystemScope(verb === 'seed' ? DEMO_SEED_SCOPE_REASON : DEMO_RESET_SCOPE_REASON, async () => {
+            // Feature 113 T212 — the EntityManager is forked **inside** the scope,
+            // so the composition's reads carry the same system scope every module's
+            // body does, and the presence oracle handed to it is the composed
+            // platform's own: a composition step over a switched-off module is a
+            // reported skip (§5.4), decided from the conjunction of both axes and
+            // never re-derived.
+            const em = composition.orm.em.fork();
+            const found = loadComposition === undefined
+                ? { found: false, notice: NO_DEMO_COMPOSITION_NOTICE }
+                : await loadComposition({
+                    em,
+                    isPresent: (id) => effectiveState.isPresent(id),
+                });
+            // Feature 113 T226 — there is no host residue left to run. Every demo
+            // row this repository seeds is now either a module's own (its
+            // `manifest.ts` declares it) or the composition's.
+            const result = await runDemo({
+                mode: verb,
+                entries,
+                isPresent: (id) => effectiveState.isPresent(id),
+                contextFor: composition.contextFor,
+                ...(found.found ? { composition: found.composition } : {}),
+            });
+            out(formatDemoReport(result));
+            // §5.6, once and enumerating nothing.
+            if (!found.found)
+                out(`\n${found.notice}\n`);
+            return 0;
+        }, { entryPoint: 'cli', container: composition.container });
+    }
+    finally {
+        await composition.dispose();
+    }
+}
+/**
+ * Composition preconditions become CLI preconditions, deliberately (D-157.3d):
+ * `assertPublicApiBaseUrlConfigured()` and a reachable PostgreSQL are now
+ * required for every command that composes. That is the property being bought —
+ * a command that runs on the deployment's own graph needs the deployment's
+ * environment — rather than a cost to be worked around.
+ *
+ * One line suppresses the single Redis write a composition performs:
+ * `product_feeds`' boot hook re-asserts its BullMQ Job Schedulers when
+ * `runWorkers` is true, and `runWorkers` is `BACKEND_ROLE !== 'api'`. Nothing
+ * else in a composition issues a Redis command, and `registryCache.watch()` is
+ * not reached, so this keeps Redis off a one-shot command's critical path.
+ *
+ * What composing does **not** do, contrary to a belief three shard comments
+ * recorded: it starts no BullMQ worker and arms no timer (D-157.2, measured
+ * three ways).
+ */
+async function defaultCompose(deploymentRoot) {
+    process.env['BACKEND_ROLE'] = 'api';
+    const { composeApp } = await import('../composition/compose-app.js');
+    return (await composeApp({ deploymentRoot }));
+}
+/**
+ * Decide and run, and return the exit code. It opens no process concern of its
+ * own, which is what lets a test drive it.
+ */
+export async function dispatchCli(options) {
+    const argv = options.argv ?? process.argv.slice(2);
+    const env = options.env ?? process.env;
+    const out = options.out ?? ((chunk) => void process.stdout.write(chunk));
+    const err = options.err ?? ((chunk) => void process.stderr.write(chunk));
+    const compose = options.compose ?? (() => defaultCompose(options.deploymentRoot));
+    const program = options.program ?? DEFAULT_CLI_PROGRAM;
+    if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {
+        out(cliUsage(program));
+        return argv.length === 0 ? 1 : 0;
+    }
+    // The two **declaration-level** questions, answered before anything is
+    // opened. Resolving manifests reads `node_modules` and touches no database,
+    // which is the property D-102 attached as a condition to `audit_logs read`:
+    // its credential is host access, not a working connection string, so it has to
+    // be able to say what it does before it can do it. It is also the property
+    // D-157.8 rejected path-convention dispatch for, since nothing can list a
+    // convention.
+    const resolved = await (options.resolveEntries ??
+        (() => instanceManifestEntries(options.deploymentRoot, env)))();
+    const declared = collectModuleCommands(resolved);
+    if (argv[0] === '--list') {
+        out(formatHostCommandList(DEMO_HOST_COMMANDS));
+        out(formatCommandList(declared));
+        return 0;
+    }
+    const [moduleId, name, ...rest] = argv;
+    if (isDemoInvocation(moduleId)) {
+        if (name === undefined || name === '--help' || name === '-h') {
+            out(DEMO_HOST_COMMANDS.map((command) => `${command.address} — ${command.summary}`).join('\n'));
+            out('\n');
+            return name === undefined ? 1 : 0;
+        }
+        const verb = parseDemoVerb(name);
+        if (rest.includes('--help') || rest.includes('-h')) {
+            out(demoHelpFor(verb, program));
+            return 0;
+        }
+        return await runDemoCommand(verb, resolved, compose, options.demoComposition, out);
+    }
+    if (moduleId === undefined || name === undefined) {
+        err(`${cliUsage(program)}\nerror: a command is addressed as '<module id> <command>'.\n`);
+        return 1;
+    }
+    if (rest.includes('--help') || rest.includes('-h')) {
+        out(`${helpFor(findModuleCommand(declared, moduleId, name))}\n`);
+        return 0;
+    }
+    const composition = await compose();
+    try {
+        // The scope opens over **this composition's** container. `composeApp`
+        // deliberately never calls `setRootContainer`, so a scope with no
+        // `container` would branch off a process-wide root with nothing in it and
+        // every `ctx.cradle()` read inside a command would fail to resolve
+        // (D-157.7).
+        return await enterSystemScope(`cli: ${argv.join(' ')}`, async () => 
+        // The set the composition was **actually built from**, not the one read
+        // above: `contextFor` answers for exactly those ids, so reading the
+        // command off the same array is what makes "found a command" and "can
+        // build its context" one question rather than two.
+        await runModuleCommand({
+            entries: composition.resolvedModules,
+            moduleId,
+            name,
+            argv: rest,
+            contextFor: composition.contextFor,
+            out: (line) => out(`${line}\n`),
+            err: (line) => err(`${line}\n`),
+        }), { entryPoint: 'cli', container: composition.container });
+    }
+    finally {
+        // Every command shares one disposal, which is the other thing a per-script
+        // entry point kept getting wrong: `closeOrm()` in a `finally` around a
+        // `return promise` tore the pool down under the query it was still running.
+        await composition.dispose();
+    }
+}
+/**
+ * The exit code a thrown failure earns, with the sentence an operator reads.
+ *
+ * The one discrimination here is not a conditional re-throw: both branches exit
+ * non-zero and neither lets the command's work proceed. It exists because a
+ * stack trace is the wrong answer to "this module is switched off" — the
+ * operator needs the sentence and the module id, which the error already
+ * carries.
+ */
+export function cliFailureExitCode(thrown, err) {
+    // `unwrapDemoFailure` is not a `catch` and decides nothing: it takes one known
+    // wrapper off so the discrimination below sees what it saw before the demo
+    // layer existed. `DemoRunFailedError`'s own message — which names the module —
+    // is printed by the fallback branch.
+    const error = unwrapDemoFailure(thrown);
+    if (error instanceof ModuleDisabledError) {
+        err(`error: module '${error.moduleId}' is switched off in this instance, so its commands ` +
+            `do not run. Switch it on under Platform → Modules, or check that it is installed ` +
+            `here (\`module:status\`).\n`);
+        return 3;
+    }
+    err(`${thrown instanceof Error ? (thrown.stack ?? thrown.message) : String(thrown)}\n`);
+    return 1;
+}
+/**
+ * The whole of an operator CLI entry point: dispatch, then exit.
+ *
+ * No `try`/`catch` anywhere above a command's body, and this is why: a `catch`
+ * around a port call swallows `ModuleDisabledError` and turns fail-closed into
+ * fail-open, which is what `check:port-catches` refuses. A `.catch()` **method**
+ * on the entry promise is outside that check's population by construction
+ * (D-157.3), and it is the right place for a CLI to turn a throw into an exit
+ * code.
+ */
+export function runCli(options) {
+    const err = options.err ?? ((chunk) => void process.stderr.write(chunk));
+    return dispatchCli(options)
+        .then((code) => process.exit(code))
+        .catch((thrown) => process.exit(cliFailureExitCode(thrown, err)));
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/cli/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../src/cli/dispatch.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAElF,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GAEd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAEnF,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,OAAO,EACP,gBAAgB,GAEjB,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAElD,mEAAmE;AACnE,MAAM,UAAU,QAAQ,CAAC,UAAkB,mBAAmB;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,UAAU,OAAO;EACxB,GAAG,GAAG,OAAO;EACb,GAAG,GAAG,OAAO,gBAAgB,OAAO;EACpC,GAAG,GAAG,OAAO;;;;;;;;;;;;;CAad,CAAC;AACF,CAAC;AAsDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAsB,EACtB,QAA4C,EAC5C,OAAsC,EACtC,eAAkD,EAClD,GAA4B;IAE5B,mBAAmB,EAAE,CAAC;IAEtB,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE1C,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAC3B,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,uBAAuB,EAClE,KAAK,IAAI,EAAE;YACT,uEAAuE;YACvE,wEAAwE;YACxE,kEAAkE;YAClE,qEAAqE;YACrE,sEAAsE;YACtE,oBAAoB;YACpB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,KAAK,GACT,eAAe,KAAK,SAAS;gBAC3B,CAAC,CAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAY;gBACjE,CAAC,CAAC,MAAM,eAAe,CAAC;oBACpB,EAAE;oBACF,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;iBAChD,CAAC,CAAC;YACT,sEAAsE;YACtE,8DAA8D;YAC9D,mDAAmD;YACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;gBAC3B,IAAI,EAAE,IAAI;gBACV,OAAO;gBACP,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/C,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAC;YACH,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9B,sCAAsC;YACtC,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;YAC7C,OAAO,CAAC,CAAC;QACX,CAAC,EACD,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CACxD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,cAAc,CAAC,cAAsB;IAClD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC;IACpC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,CAA8B,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAElF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAC;IAEvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,2EAA2E;IAC3E,0EAA0E;IAC1E,cAAc;IACd,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc;QAC5C,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzB,GAAG,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACvC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC7D,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/F,GAAG,CAAC,IAAI,CAAC,CAAC;YACV,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAChC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,MAAM,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACjD,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,sEAAsE;QACtE,kEAAkE;QAClE,0EAA0E;QAC1E,mEAAmE;QACnE,aAAa;QACb,OAAO,MAAM,gBAAgB,CAC3B,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EACxB,KAAK,IAAI,EAAE;QACT,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,mDAAmD;QACnD,MAAM,gBAAgB,CAAC;YACrB,OAAO,EAAE,WAAW,CAAC,eAAe;YACpC,QAAQ;YACR,IAAI;YACJ,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC;YAC/B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC;SAChC,CAAC,EACJ,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CACxD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe,EAAE,GAA4B;IAC9E,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,qCAAqC;IACrC,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,GAAG,CACD,kBAAkB,KAAK,CAAC,QAAQ,sDAAsD;YACpF,mFAAmF;YACnF,6BAA6B,CAChC,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CAAC,GAAG,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAAC,OAAsB;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,OAAO,WAAW,CAAC,OAAO,CAAC;SACxB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAClC,KAAK,CAAC,CAAC,MAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,58 @@
+/**
+ * `./cli` — the host's side of a module-declared operator command, and the
+ * platform's thirteenth subpath (`specs/110-instance-repository/` T117,
+ * FR-013).
+ *
+ * ## What is on it
+ *
+ * Everything a `pnpm --filter backend run cli` invocation decides **with no
+ * process and no database**: the enumeration of every command the resolved
+ * manifest set declares, the two refusals a declaration can earn, the
+ * `<module id> <command name>` lookup, the `--list` and `--help` renderings,
+ * and the find-gate-invoke that ends in the module's own `run`.
+ *
+ * ## And the process around it, since `specs/123-oss-install-experience/` G2
+ *
+ * This header used to end *"the process — argv, the composition, the system
+ * scope and the exit code — stays in the application at `backend/src/cli.ts`"*,
+ * and the partition it cited is the reason it changed. `operator-half.md` §1.1:
+ * *"a file belongs to `@endora-commerce/platform` unless it names a path in the
+ * tree that installs the platform"*. The dispatch names none — the core
+ * manifests, the composition and a tree's own demo composition are all
+ * **parameters** — and the sentence was measured wrong the moment a second
+ * application existed: `endora new instance` reported `backend/src/cli.ts` as an
+ * omission, so a scaffolded instance could run **no** command its modules
+ * declared, `admin_users create` included, and nobody could log in to it.
+ *
+ * What did not move is what genuinely names a path: this repository's generated
+ * core index, its own `composeApp`, its `src/seeds/demo-composition.ts` probe,
+ * and the one directory holding `apps/`. `backend/src/cli.ts` supplies those
+ * four and is otherwise an exit code; a scaffolded instance supplies the last
+ * one and is five lines. See `dispatch.ts`' own header.
+ *
+ * It is also **not** the `module:*` path and must never become one. Those five
+ * operate *on* the platform rather than with it, compose nothing (D-157.2/.4)
+ * and keep their own ~20-line entry points under `backend/src/lifecycle/` over
+ * `@endora-commerce/platform/lifecycle`'s `commands/<verb>.ts` (R2.5).
+ * `research.md` §3.1 calls this file *"the host's `module:*` dispatcher"*; it is
+ * not, and `backend/src/cli.ts`' own header has said so since feature 080.
+ *
+ * ## Why no module may name it
+ *
+ * D-160.14's third state, for `./composition`'s own reason one surface over.
+ * This is the code that decides **which** command runs and whether the module
+ * that declared it is present at all — so a module that could name it could
+ * enumerate its siblings' operator commands, and invoke one. A module declares
+ * its commands in its own `manifest.ts` and receives a `ModuleContext`; that is
+ * the whole of the surface it is entitled to. Declared by the `exports` map,
+ * carried by no published barrel, and answered for a module's reach with
+ * `host-internal-subpath`.
+ *
+ * The barrel names every symbol explicitly rather than re-exporting a
+ * directory: `check:platform-surface` exits 2 on an `export *`, because a
+ * wildcard makes the published set a property of whatever the files happen to
+ * declare rather than of a decision anybody took.
+ */
+export { collectModuleCommands, findModuleCommand, formatCommandList, helpFor, InvalidCommandDeclarationError, runModuleCommand, UnknownCommandError, type CommandDeclaringEntry, type DeclaredCommand, type RunModuleCommandOptions, } from './module-commands.js';
+export { cliFailureExitCode, cliUsage, DEFAULT_CLI_PROGRAM, dispatchCli, runCli, type CliComposition, type RunCliOptions, } from './dispatch.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,OAAO,EACP,8BAA8B,EAC9B,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,uBAAuB,GAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,mBAAmB,EACnB,WAAW,EACX,MAAM,EACN,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC"}

package/dist/cli/index.js

@@ -0,0 +1,58 @@
+/**
+ * `./cli` — the host's side of a module-declared operator command, and the
+ * platform's thirteenth subpath (`specs/110-instance-repository/` T117,
+ * FR-013).
+ *
+ * ## What is on it
+ *
+ * Everything a `pnpm --filter backend run cli` invocation decides **with no
+ * process and no database**: the enumeration of every command the resolved
+ * manifest set declares, the two refusals a declaration can earn, the
+ * `<module id> <command name>` lookup, the `--list` and `--help` renderings,
+ * and the find-gate-invoke that ends in the module's own `run`.
+ *
+ * ## And the process around it, since `specs/123-oss-install-experience/` G2
+ *
+ * This header used to end *"the process — argv, the composition, the system
+ * scope and the exit code — stays in the application at `backend/src/cli.ts`"*,
+ * and the partition it cited is the reason it changed. `operator-half.md` §1.1:
+ * *"a file belongs to `@endora-commerce/platform` unless it names a path in the
+ * tree that installs the platform"*. The dispatch names none — the core
+ * manifests, the composition and a tree's own demo composition are all
+ * **parameters** — and the sentence was measured wrong the moment a second
+ * application existed: `endora new instance` reported `backend/src/cli.ts` as an
+ * omission, so a scaffolded instance could run **no** command its modules
+ * declared, `admin_users create` included, and nobody could log in to it.
+ *
+ * What did not move is what genuinely names a path: this repository's generated
+ * core index, its own `composeApp`, its `src/seeds/demo-composition.ts` probe,
+ * and the one directory holding `apps/`. `backend/src/cli.ts` supplies those
+ * four and is otherwise an exit code; a scaffolded instance supplies the last
+ * one and is five lines. See `dispatch.ts`' own header.
+ *
+ * It is also **not** the `module:*` path and must never become one. Those five
+ * operate *on* the platform rather than with it, compose nothing (D-157.2/.4)
+ * and keep their own ~20-line entry points under `backend/src/lifecycle/` over
+ * `@endora-commerce/platform/lifecycle`'s `commands/<verb>.ts` (R2.5).
+ * `research.md` §3.1 calls this file *"the host's `module:*` dispatcher"*; it is
+ * not, and `backend/src/cli.ts`' own header has said so since feature 080.
+ *
+ * ## Why no module may name it
+ *
+ * D-160.14's third state, for `./composition`'s own reason one surface over.
+ * This is the code that decides **which** command runs and whether the module
+ * that declared it is present at all — so a module that could name it could
+ * enumerate its siblings' operator commands, and invoke one. A module declares
+ * its commands in its own `manifest.ts` and receives a `ModuleContext`; that is
+ * the whole of the surface it is entitled to. Declared by the `exports` map,
+ * carried by no published barrel, and answered for a module's reach with
+ * `host-internal-subpath`.
+ *
+ * The barrel names every symbol explicitly rather than re-exporting a
+ * directory: `check:platform-surface` exits 2 on an `export *`, because a
+ * wildcard makes the published set a property of whatever the files happen to
+ * declare rather than of a decision anybody took.
+ */
+export { collectModuleCommands, findModuleCommand, formatCommandList, helpFor, InvalidCommandDeclarationError, runModuleCommand, UnknownCommandError, } from './module-commands.js';
+export { cliFailureExitCode, cliUsage, DEFAULT_CLI_PROGRAM, dispatchCli, runCli, } from './dispatch.js';
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,OAAO,EACP,8BAA8B,EAC9B,gBAAgB,EAChB,mBAAmB,GAIpB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,mBAAmB,EACnB,WAAW,EACX,MAAM,GAGP,MAAM,eAAe,CAAC"}