@stacksjs/buddy 0.70.163 → 0.70.165

package/dist/commands/protocol/source-manifest.js

@@ -0,0 +1,113 @@
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, extname, resolve } from "node:path";
+const root = resolve(import.meta.dir, "../../../../../../.."), outputPath = resolve(root, ".github/protocol/evidence/source-manifest.json");
+function runGit(...arguments_) {
+  try {
+    return execFileSync("git", arguments_, { cwd: root, maxBuffer: 67108864 });
+  } catch (error) {
+    throw Error(`git ${arguments_.join(" ")} failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function revision(value) {
+  return runGit("rev-parse", `${value}^{commit}`).toString().trim();
+}
+function showJson(sourceRevision, path) {
+  return JSON.parse(runGit("show", `${sourceRevision}:${path}`).toString());
+}
+function category(path) {
+  if (/(^|\/)(test|tests|__tests__)(\/|$)|\.(test|spec)\.[^.]+$/.test(path))
+    return "tests";
+  if (path.startsWith("protocol/suite/"))
+    return "vendored-protocol";
+  if (/(^|\/)(dist|generated|coverage)(\/|$)|\.d\.ts$/.test(path))
+    return "generated";
+  if (/\.(md|mdx|rst|txt)$/.test(path) || /(^|\/)docs\//.test(path))
+    return "documentation";
+  if (/(^|\/)(config|configs|\.github)(\/|$)|(^|\/)(tsconfig|package|bun\.lock|pantry)\b/.test(path))
+    return "configuration";
+  if (/\.(ts|tsx|js|jsx|vue|svelte|zig|rs|go|py|sh)$/.test(path))
+    return "source";
+  return "assets-and-data";
+}
+function addCount(record, key, bytes) {
+  const current = record[key] || { files: 0, bytes: 0 };
+  record[key] = { files: current.files + 1, bytes: current.bytes + bytes };
+}
+export function buildSourceManifest(requestedRevision) {
+  const sourceRevision = revision(requestedRevision), sourceTree = runGit("rev-parse", `${sourceRevision}^{tree}`).toString().trim(), treeListing = runGit("ls-tree", "-r", "-l", sourceRevision).toString(), lines = treeListing.trim().split(`
+`).filter(Boolean), categories = {}, extensions = {};
+  let totalBytes = 0;
+  const paths = [];
+  for (const line of lines) {
+    const match = line.match(/^\d+\s+blob\s+[0-9a-f]+\s+(\d+)\t(.+)$/);
+    if (!match)
+      continue;
+    const bytes = Number(match[1]), path = match[2];
+    if (path == null)
+      continue;
+    paths.push(path);
+    totalBytes += bytes;
+    addCount(categories, category(path), bytes);
+    const extension = extname(path).toLowerCase() || "[none]";
+    extensions[extension] = (extensions[extension] || 0) + 1;
+  }
+  const packages = paths.filter((path) => path === "package.json" || path.endsWith("/package.json")).flatMap((path) => {
+    const pkg = showJson(sourceRevision, path);
+    if (!pkg.name || !pkg.version)
+      return [];
+    return [{ name: pkg.name, path, version: pkg.version, publishable: pkg.private !== !0 }];
+  }).sort((a, b) => a.name.localeCompare(b.name) || a.path.localeCompare(b.path)), rootPackage = showJson(sourceRevision, "package.json"), suiteLock = showJson(sourceRevision, "protocol/suite.lock.json");
+  return {
+    schemaVersion: "1.0.0",
+    repository: "https://github.com/stacksjs/stacks",
+    sourceRevision,
+    sourceTree,
+    sourceDigest: `sha256:${createHash("sha256").update(treeListing).digest("hex")}`,
+    generatedAt: "derived-from-immutable-git-objects",
+    classification: {
+      status: "reference-implementation",
+      conformance: "unverified",
+      notes: "Reference implementation status does not imply a protocol profile claim; consult the report for per-requirement evidence."
+    },
+    prerequisites: rootPackage.system || {},
+    packages,
+    inventory: {
+      totalFiles: lines.length,
+      totalBytes,
+      categories: Object.fromEntries(Object.entries(categories).sort(([a], [b]) => a.localeCompare(b))),
+      extensions: Object.fromEntries(Object.entries(extensions).sort(([a], [b]) => a.localeCompare(b)))
+    },
+    protocolSuite: { version: suiteLock.protocolVersion, rfcsRevision: suiteLock.rfcsRevision }
+  };
+}
+function render(manifest) {
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+export async function run() {
+  const mode = process.argv.includes("--write") ? "write" : process.argv.includes("--check") ? "check" : null;
+  if (!mode) {
+    console.error("usage: bun storage/framework/core/buddy/src/commands/protocol/source-manifest.ts --write [--revision <ref>] | --check");
+    process.exit(2);
+  }
+  if (mode === "write") {
+    const index = process.argv.indexOf("--revision"), requestedRevision = index === -1 ? "HEAD" : process.argv[index + 1];
+    if (!requestedRevision)
+      throw Error("--revision requires a Git ref");
+    const manifest = buildSourceManifest(requestedRevision);
+    mkdirSync(dirname(outputPath), { recursive: !0 });
+    writeFileSync(outputPath, render(manifest));
+    console.log(`Wrote source manifest for ${manifest.sourceRevision} (${manifest.inventory.totalFiles} files, ${manifest.packages.length} packages)`);
+  } else {
+    if (!existsSync(outputPath))
+      throw Error("source manifest is missing; run bun run protocol:manifest");
+    const current = JSON.parse(readFileSync(outputPath, "utf8")), expected = render(buildSourceManifest(current.sourceRevision));
+    if (readFileSync(outputPath, "utf8") !== expected)
+      throw Error(`source manifest is stale or modified; run bun storage/framework/core/buddy/src/commands/protocol/source-manifest.ts --write --revision ${current.sourceRevision}`);
+    console.log(`Source manifest matches ${current.sourceRevision}`);
+  }
+}
+if (import.meta.main)
+  await run();

package/dist/commands/protocol/sync-suite.d.ts

@@ -0,0 +1,8 @@
+/** Requirement ids that appear more than once in `ids` (sorted, deduped). */
+export declare function duplicateRequirementIds(ids: string[]): string[];
+/**
+ * Requirement ids referenced by a fixture that are absent from `catalogIds`,
+ * formatted `fixtureId -> requirementId`.
+ */
+export declare function danglingFixtureRequirements(fixtures: Array<{ id: string, requirements?: string[] }>, catalogIds: Set<string>): string[];
+export declare function run(): Promise<void>;

package/dist/commands/protocol/sync-suite.js

@@ -0,0 +1,137 @@
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, relative, resolve } from "node:path";
+const root = resolve(import.meta.dir, "../../../../../../.."), suiteRoot = resolve(root, ".github/protocol/suite/1.0-draft"), lockPath = resolve(root, ".github/protocol/suite.lock.json");
+function digest(data) {
+  return `sha256:${createHash("sha256").update(data).digest("hex")}`;
+}
+function filesBelow(directory) {
+  return readdirSync(directory, { withFileTypes: !0 }).flatMap((entry) => {
+    const path = resolve(directory, entry.name);
+    return entry.isDirectory() ? filesBelow(path) : [path];
+  }).sort();
+}
+function argument(name) {
+  const index = process.argv.indexOf(name);
+  return index === -1 ? void 0 : process.argv[index + 1];
+}
+function gitRevision(repository) {
+  const result = Bun.spawnSync(["git", "-C", repository, "rev-parse", "HEAD"]);
+  if (result.exitCode !== 0)
+    throw Error(`Could not resolve the RFC repository revision: ${result.stderr.toString().trim()}`);
+  return result.stdout.toString().trim();
+}
+function writeSnapshot(sourceRepository) {
+  const sourceRoot = resolve(sourceRepository, "protocol/1.0-draft");
+  if (!existsSync(resolve(sourceRoot, "catalog.json")))
+    throw Error(`No protocol suite found at ${sourceRoot}`);
+  rmSync(suiteRoot, { force: !0, recursive: !0 });
+  const files = {}, sourceFiles = [
+    ...filesBelow(sourceRoot).map((sourcePath) => ({ sourcePath, path: relative(sourceRoot, sourcePath) })),
+    ...["LICENSE-SPECIFICATION.md", "LICENSE-FIXTURES.md"].map((path) => ({ sourcePath: resolve(sourceRepository, path), path }))
+  ];
+  for (const { sourcePath, path } of sourceFiles) {
+    const outputPath = resolve(suiteRoot, path), contents = readFileSync(sourcePath);
+    mkdirSync(dirname(outputPath), { recursive: !0 });
+    writeFileSync(outputPath, contents);
+    files[path] = digest(contents);
+  }
+  const lock = {
+    protocolVersion: "1.0-draft",
+    rfcsRevision: gitRevision(sourceRepository),
+    sourceRepository: "https://github.com/stacksjs/rfcs",
+    files
+  };
+  mkdirSync(dirname(lockPath), { recursive: !0 });
+  writeFileSync(lockPath, `${JSON.stringify(lock, null, 2)}
+`);
+  console.log(`Pinned ${Object.keys(files).length} protocol files at ${lock.rfcsRevision}`);
+}
+function checkSnapshot() {
+  if (!existsSync(lockPath))
+    throw Error(".github/protocol/suite.lock.json is missing; run bun run protocol:sync");
+  const lock = JSON.parse(readFileSync(lockPath, "utf8"));
+  if (!/^[0-9a-f]{40}$/.test(lock.rfcsRevision))
+    throw Error("suite lock has an invalid RFC revision");
+  const actualFiles = filesBelow(suiteRoot).map((path) => relative(suiteRoot, path)), expectedFiles = Object.keys(lock.files).sort(), unexpected = actualFiles.filter((path) => !lock.files[path]), missing = expectedFiles.filter((path) => !actualFiles.includes(path)), changed = expectedFiles.filter((path) => {
+    const absolutePath = resolve(suiteRoot, path);
+    return existsSync(absolutePath) && digest(readFileSync(absolutePath)) !== lock.files[path];
+  }), errors = [
+    ...missing.map((path) => `missing: ${path}`),
+    ...unexpected.map((path) => `unexpected: ${path}`),
+    ...changed.map((path) => `modified: ${path}`)
+  ];
+  if (errors.length > 0)
+    throw Error(`Vendored protocol suite does not match its lock:
+${errors.join(`
+`)}`);
+  console.log(`Protocol suite matches ${basename(lock.sourceRepository)}@${lock.rfcsRevision} (${actualFiles.length} files)`);
+}
+export function duplicateRequirementIds(ids) {
+  const seen = new Set, duplicates = new Set;
+  for (const id of ids)
+    if (seen.has(id))
+      duplicates.add(id);
+    else
+      seen.add(id);
+  return [...duplicates].sort();
+}
+function checkCatalog() {
+  const catalogPath = resolve(suiteRoot, "catalog.json");
+  if (!existsSync(catalogPath))
+    throw Error(`protocol catalog missing at ${relative(root, catalogPath)}; run bun run protocol:sync`);
+  const catalog = JSON.parse(readFileSync(catalogPath, "utf8")), requirements = Array.isArray(catalog.requirements) ? catalog.requirements : [];
+  if (requirements.length === 0)
+    throw Error("protocol catalog has no requirements");
+  const ids = requirements.map((requirement) => requirement?.id), missing = ids.filter((id) => typeof id !== "string" || id.length === 0).length;
+  if (missing > 0)
+    throw Error(`protocol catalog has ${missing} requirement(s) without a string id`);
+  const duplicates = duplicateRequirementIds(ids);
+  if (duplicates.length > 0)
+    throw Error(`protocol catalog has duplicate requirement id(s): ${duplicates.join(", ")}`);
+  console.log(`Protocol catalog: ${ids.length} requirement ids, all unique`);
+}
+export function danglingFixtureRequirements(fixtures, catalogIds) {
+  const dangling = [];
+  for (const fixture of fixtures)
+    for (const requirement of fixture.requirements ?? [])
+      if (!catalogIds.has(requirement))
+        dangling.push(`${fixture.id} -> ${requirement}`);
+  return dangling;
+}
+function checkFixtures() {
+  const fixturesPath = resolve(suiteRoot, "fixtures/conformance.json");
+  if (!existsSync(fixturesPath))
+    throw Error(`protocol fixture corpus missing at ${relative(root, fixturesPath)}; run bun run protocol:sync`);
+  const corpus = JSON.parse(readFileSync(fixturesPath, "utf8")), fixtures = Array.isArray(corpus.fixtures) ? corpus.fixtures : [];
+  if (fixtures.length === 0)
+    throw Error("protocol fixture corpus has no fixtures");
+  const ids = fixtures.map((fixture) => fixture?.id), missing = ids.filter((id) => typeof id !== "string" || id.length === 0).length;
+  if (missing > 0)
+    throw Error(`protocol fixture corpus has ${missing} fixture(s) without a string id`);
+  const duplicates = duplicateRequirementIds(ids);
+  if (duplicates.length > 0)
+    throw Error(`protocol fixture corpus has duplicate fixture id(s): ${duplicates.join(", ")}`);
+  const catalog = JSON.parse(readFileSync(resolve(suiteRoot, "catalog.json"), "utf8")), catalogIds = new Set((catalog.requirements ?? []).map((requirement) => requirement?.id).filter((id) => typeof id === "string")), normalized = fixtures.map((fixture) => ({
+    id: String(fixture?.id),
+    requirements: Array.isArray(fixture?.requirements) ? fixture.requirements.filter((requirement) => typeof requirement === "string") : []
+  })), dangling = danglingFixtureRequirements(normalized, catalogIds);
+  if (dangling.length > 0)
+    throw Error(`protocol fixtures reference unknown requirement id(s): ${dangling.slice(0, 10).join(", ")}`);
+  console.log(`Protocol fixtures: ${ids.length} fixtures, ids unique, all requirement refs resolve`);
+}
+export async function run() {
+  if (process.argv.includes("--write")) {
+    const source = resolve(argument("--source") || process.env.STACKS_RFC_SOURCE || resolve(root, "../rfcs"));
+    writeSnapshot(source);
+  } else if (process.argv.includes("--check")) {
+    checkSnapshot();
+    checkCatalog();
+    checkFixtures();
+  } else {
+    console.error("usage: bun storage/framework/core/buddy/src/commands/protocol/sync-suite.ts --write [--source ../rfcs] | --check");
+    process.exit(2);
+  }
+}
+if (import.meta.main)
+  await run();

package/dist/commands/protocol/sync-suite.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/protocol/sync-suite.test.js

@@ -0,0 +1,44 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { describe, expect, it } from "bun:test";
+import { danglingFixtureRequirements, duplicateRequirementIds } from "./sync-suite";
+describe("protocol requirement-id uniqueness (stacksjs/stacks#2050)", () => {
+  it("reports no duplicates for a unique list", () => {
+    expect(duplicateRequirementIds(["CORE-CONV-01", "CORE-CONV-02", "CORE-MVA-01"])).toEqual([]);
+  });
+  it("reports each duplicated id once, sorted", () => {
+    expect(duplicateRequirementIds(["B-1", "A-1", "B-1", "A-1", "A-1", "C-1"])).toEqual(["A-1", "B-1"]);
+  });
+  it("handles an empty list", () => {
+    expect(duplicateRequirementIds([])).toEqual([]);
+  });
+  it("the vendored catalog.json has unique requirement ids", () => {
+    const ids = JSON.parse(readFileSync(resolve(import.meta.dir, "../../../../../../../.github/protocol/suite/1.0-draft/catalog.json"), "utf8")).requirements.map((requirement) => requirement.id);
+    expect(ids.length).toBeGreaterThan(0);
+    expect(duplicateRequirementIds(ids)).toEqual([]);
+  });
+});
+describe("protocol fixture-corpus integrity (stacksjs/stacks#2051)", () => {
+  const catalogIds = new Set(["CORE-CONV-01", "CORE-CONV-02", "CORE-MVA-01"]);
+  it("reports no dangling refs when every requirement resolves", () => {
+    expect(danglingFixtureRequirements([
+      { id: "fixture.a", requirements: ["CORE-CONV-01", "CORE-CONV-02"] },
+      { id: "fixture.b", requirements: ["CORE-MVA-01"] }
+    ], catalogIds)).toEqual([]);
+  });
+  it("reports each unknown requirement ref as `fixture -> requirement`", () => {
+    expect(danglingFixtureRequirements([
+      { id: "fixture.a", requirements: ["CORE-CONV-01", "CORE-GONE-99"] },
+      { id: "fixture.b", requirements: ["NOPE-01"] }
+    ], catalogIds)).toEqual(["fixture.a -> CORE-GONE-99", "fixture.b -> NOPE-01"]);
+  });
+  it("tolerates fixtures with no requirements", () => {
+    expect(danglingFixtureRequirements([{ id: "fixture.a" }], catalogIds)).toEqual([]);
+  });
+  it("the vendored fixture corpus has unique ids and no dangling requirement refs", () => {
+    const base = resolve(import.meta.dir, "../../../../../../../.github/protocol/suite/1.0-draft"), corpus = JSON.parse(readFileSync(resolve(base, "fixtures/conformance.json"), "utf8")), catalog = JSON.parse(readFileSync(resolve(base, "catalog.json"), "utf8")), realIds = new Set(catalog.requirements.map((requirement) => requirement.id));
+    expect(corpus.fixtures.length).toBeGreaterThan(0);
+    expect(duplicateRequirementIds(corpus.fixtures.map((fixture) => fixture.id))).toEqual([]);
+    expect(danglingFixtureRequirements(corpus.fixtures, realIds)).toEqual([]);
+  });
+});

package/dist/commands/protocol.d.ts

@@ -0,0 +1,8 @@
+import type { CLI } from '@stacksjs/types';
+/**
+ * Framework-repo `buddy protocol:*` commands. The governance tooling itself
+ * lives beside this file under `commands/protocol/`; the protocol suite +
+ * evidence DATA stays under `.github/protocol/`. These wrap the tooling so it
+ * is discoverable via the CLI (`buddy protocol:conformance`).
+ */
+export declare function protocol(buddy: CLI): void;

package/dist/commands/protocol.js

@@ -0,0 +1,60 @@
+import { run as runConformance } from "./protocol/run-conformance";
+import { run as runCraft } from "./protocol/craft-evidence";
+import { run as runDesktop } from "./protocol/desktop-support";
+import { run as runDrivers } from "./protocol/driver-registry";
+import { run as runDriverContracts } from "./protocol/run-driver-contracts";
+import { run as runPantry } from "./protocol/pantry-evidence";
+import { run as runRelease } from "./protocol/release-manifest";
+import { run as runManifest } from "./protocol/source-manifest";
+import { run as runSync } from "./protocol/sync-suite";
+import { runTool } from "./run-tool";
+export function protocol(buddy) {
+  buddy.command("protocol:conformance", "Generate the Stacks protocol conformance report").action(async () => {
+    await runConformance();
+  });
+  buddy.command("protocol:sync", "Sync the vendored protocol suite from stacksjs/rfcs").option("--source <path>", "Path to a local rfcs checkout", { default: void 0 }).action(async (options) => {
+    await runTool(runSync, "--write", ...options.source ? ["--source", options.source] : []);
+  });
+  buddy.command("protocol:check", "Verify the vendored protocol suite is pinned + internally consistent").action(async () => {
+    await runTool(runSync, "--check");
+  });
+  buddy.command("protocol:manifest", "Write the protocol source manifest").option("--revision <ref>", "Source revision to pin (default HEAD)", { default: void 0 }).action(async (options) => {
+    await runTool(runManifest, "--write", ...options.revision ? ["--revision", options.revision] : []);
+  });
+  buddy.command("protocol:manifest:check", "Verify the protocol source manifest is current").action(async () => {
+    await runTool(runManifest, "--check");
+  });
+  buddy.command("protocol:release", "Write the protocol release manifest").option("--tag <tag>", "Release tag", { default: void 0 }).action(async (options) => {
+    await runTool(runRelease, "--write", ...options.tag ? ["--tag", options.tag] : []);
+  });
+  buddy.command("protocol:release:check", "Verify the protocol release manifest is current").action(async () => {
+    await runTool(runRelease, "--check");
+  });
+  buddy.command("protocol:drivers", "Write the driver capability registry evidence").action(async () => {
+    await runTool(runDrivers, "--write");
+  });
+  buddy.command("protocol:drivers:check", "Verify the driver capability registry evidence").action(async () => {
+    await runTool(runDrivers, "--check");
+  });
+  buddy.command("protocol:drivers:test", "Run the driver contract suite").action(async () => {
+    await runTool(runDriverContracts);
+  });
+  buddy.command("protocol:desktop", "Write the desktop support matrix evidence").action(async () => {
+    await runTool(runDesktop, "--write");
+  });
+  buddy.command("protocol:desktop:check", "Verify the desktop support matrix evidence").action(async () => {
+    await runTool(runDesktop, "--check");
+  });
+  buddy.command("protocol:pantry", "Write the pantry evidence").action(async () => {
+    await runTool(runPantry, "--write");
+  });
+  buddy.command("protocol:pantry:check", "Verify the pantry evidence").action(async () => {
+    await runTool(runPantry, "--check");
+  });
+  buddy.command("protocol:craft", "Write the Craft evidence").action(async () => {
+    await runTool(runCraft, "--write");
+  });
+  buddy.command("protocol:craft:check", "Verify the Craft evidence").action(async () => {
+    await runTool(runCraft, "--check");
+  });
+}

package/dist/commands/publish.js

@@ -14,9 +14,12 @@ export function publish(buddy) {
     middleware: "Publish a default middleware from storage/framework/defaults/app/Middleware/ to app/Middleware/",
     action: "Publish a default action from storage/framework/defaults/app/Actions/ to app/Actions/",
     core: "Publish a framework package source from node_modules/@stacksjs/<pkg>/ into storage/framework/core/<pkg>/ for editing",
+    unpublishCore: "Drop a vendored storage/framework/core/<pkg>/ and go back to the installed @stacksjs/<pkg>",
+    all: "Unvendor the whole framework: remove storage/framework/core and resolve every @stacksjs package from the `stacks` dependency in package.json",
     name: "The name of the resource to publish (e.g. Cart, User)",
     pkg: "The name of the framework package (e.g. router, orm, faker \u2014 without @stacksjs/ prefix)",
     force: "Overwrite an existing userland file",
+    forceUnpublish: "Delete the vendored source even when it has uncommitted changes",
     verbose: "Enable verbose output"
   };
   buddy.command("publish:model <name>", descriptions.model).option("--force", descriptions.force, { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (name, options) => {
@@ -58,6 +61,17 @@ export function publish(buddy) {
   buddy.command("publish:core <pkg>", descriptions.core).option("--force", descriptions.force, { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (pkg, options) => {
     await publishCorePackage(pkg, !!options.force);
   });
+  buddy.command("unpublish:core [pkg]", descriptions.unpublishCore).option("--all", descriptions.all, { default: !1 }).option("--force", descriptions.forceUnpublish, { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (pkg, options) => {
+    if (options.all) {
+      await unvendorFramework(!!options.force);
+      return;
+    }
+    if (!pkg) {
+      log.error("Usage: buddy unpublish:core <pkg>   (or --all to move the whole framework to node_modules)");
+      process.exit(ExitCode.FatalError);
+    }
+    await unpublishCorePackage(pkg, !!options.force);
+  });
   buddy.command("publish [resource] [name]", descriptions.command).option("--force", descriptions.force, { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (resource, name, options) => {
     if (!resource || !name) {
       log.error("Usage: buddy publish:<resource> <Name>  (e.g. buddy publish:model Cart)");
@@ -170,3 +184,138 @@ async function publishResource(ctx) {
   await fs.promises.copyFile(sourcePath, targetPath);
   log.success(`Published ${kind} ${italic(name)} \u2192 ${italic(targetPath.replace(`${process.cwd()}/`, ""))}`);
 }
+async function unpublishCorePackage(pkg, force) {
+  const shortName = normalizeCoreName(pkg), targetDir = path.frameworkPath(`core/${shortName}`), rel = (p) => p.replace(`${process.cwd()}/`, "");
+  if (!existsSync(targetDir)) {
+    log.info(`Not vendored: ${italic(rel(targetDir))} \u2014 nothing to do.`);
+    return;
+  }
+  const installed = resolve(process.cwd(), "node_modules", "@stacksjs", shortName);
+  if (!existsSync(installed) && !force) {
+    log.error(`@stacksjs/${shortName} is not installed, so removing the vendored copy would leave nothing to resolve.`);
+    log.info(`Run \`bun add @stacksjs/${shortName}\` first, or pass --force to remove it anyway.`);
+    process.exit(ExitCode.FatalError);
+  }
+  await assertNoUncommittedChanges(targetDir, force);
+  await fs.promises.rm(targetDir, { recursive: !0, force: !0 });
+  log.success(`Unpublished ${italic(rel(targetDir))} \u2014 @stacksjs/${shortName} now resolves from node_modules.`);
+}
+async function unvendorFramework(force) {
+  const coreDir = path.frameworkPath("core"), rel = (p) => p.replace(`${process.cwd()}/`, "");
+  if (!existsSync(coreDir)) {
+    log.info("No storage/framework/core in this project \u2014 already on the installed packages.");
+    return;
+  }
+  const corePkgPath = resolve(coreDir, "package.json");
+  if (!existsSync(corePkgPath)) {
+    log.error(`${rel(coreDir)} has no package.json, so its version cannot be determined.`);
+    log.info("Unvendor the packages individually with `buddy unpublish:core <pkg>` instead.");
+    process.exit(ExitCode.FatalError);
+  }
+  const corePkg = JSON.parse(await fs.promises.readFile(corePkgPath, "utf-8")), version = corePkg.version;
+  if (!version) {
+    log.error(`${rel(corePkgPath)} has no version field.`);
+    process.exit(ExitCode.FatalError);
+  }
+  await assertNoUncommittedChanges(coreDir, force);
+  const rootPkgPath = resolve(process.cwd(), "package.json"), rootPkgRaw = await fs.promises.readFile(rootPkgPath, "utf-8"), rootPkg = JSON.parse(rootPkgRaw), depName = corePkg.name ?? "stacks", range = `^${version}`, provided = new Set([depName, ...Object.keys(corePkg.dependencies ?? {}).filter((name) => name.startsWith("@stacksjs/"))]);
+  for (const entry of await readdir(coreDir, { withFileTypes: !0 }))
+    if (entry.isDirectory())
+      provided.add(`@stacksjs/${entry.name}`);
+  let repointed = 0;
+  const repointWorkspaceRanges = (pkg) => {
+    let touched = !1;
+    for (const field of ["dependencies", "devDependencies", "peerDependencies"]) {
+      const deps = pkg[field];
+      if (!deps)
+        continue;
+      for (const [name, spec] of Object.entries(deps)) {
+        if (!spec.startsWith("workspace:") || !provided.has(name))
+          continue;
+        deps[name] = range;
+        touched = !0;
+        repointed++;
+      }
+    }
+    return touched;
+  };
+  repointWorkspaceRanges(rootPkg);
+  if (!rootPkg.dependencies?.[depName] && !rootPkg.devDependencies?.[depName])
+    rootPkg.dependencies = { ...rootPkg.dependencies, [depName]: range };
+  if (Array.isArray(rootPkg.workspaces)) {
+    rootPkg.workspaces = rootPkg.workspaces.filter((glob) => !isCoreWorkspaceGlob(glob));
+    if (rootPkg.workspaces.length === 0)
+      delete rootPkg.workspaces;
+  }
+  await fs.promises.writeFile(rootPkgPath, `${JSON.stringify(rootPkg, null, 2)}
+`);
+  for (const glob of rootPkg.workspaces ?? [])
+    for (const memberPkgPath of globSync(`${glob.replace(/\/$/, "")}/package.json`, { cwd: process.cwd(), absolute: !0 })) {
+      const raw = await fs.promises.readFile(memberPkgPath, "utf-8"), memberPkg = JSON.parse(raw);
+      if (repointWorkspaceRanges(memberPkg))
+        await fs.promises.writeFile(memberPkgPath, `${JSON.stringify(memberPkg, null, 2)}
+`);
+    }
+  const bunfigPath = resolve(process.cwd(), "bunfig.toml");
+  let rewrittenPreloads = 0;
+  if (existsSync(bunfigPath)) {
+    const bunfig = await fs.promises.readFile(bunfigPath, "utf-8"), next = bunfig.replace(/(["'])\.?\/?storage\/framework\/core\/([\w-]+)\/([^"']+?)\.ts\1/g, (_match, quote, pkgName, subpath) => {
+      rewrittenPreloads++;
+      return `${quote}@stacksjs/${pkgName}/${subpath}.js${quote}`;
+    });
+    if (next !== bunfig)
+      await fs.promises.writeFile(bunfigPath, next);
+  }
+  await fs.promises.rm(coreDir, { recursive: !0, force: !0 });
+  log.success(`Removed ${italic(rel(coreDir))}`);
+  log.info(`package.json now depends on ${depName}@${range}`);
+  if (repointed > 0)
+    log.info(`Repointed ${repointed} workspace: range${repointed === 1 ? "" : "s"} to ${range}`);
+  if (rewrittenPreloads > 0)
+    log.info(`Rewrote ${rewrittenPreloads} bunfig.toml preload path${rewrittenPreloads === 1 ? "" : "s"} to package specifiers`);
+  log.info("Installing the published packages...");
+  if (await Bun.spawn(["bun", "install"], { cwd: process.cwd(), stdout: "inherit", stderr: "inherit" }).exited !== 0) {
+    log.error("`bun install` failed. package.json and bunfig.toml were updated; re-run the install once the failure is resolved.");
+    process.exit(ExitCode.FatalError);
+  }
+  log.success("This project now runs on the published Stacks packages.");
+  log.info("Vendor an individual package again any time with `buddy publish:core <pkg>`.");
+}
+function normalizeCoreName(pkg) {
+  const shortName = pkg.replace(/^@stacksjs\//, "").replace(/^core\//, "");
+  if (!shortName || shortName.includes("/") || shortName.includes("..")) {
+    process.stderr.write(`Invalid package name: ${pkg}
+`);
+    process.stderr.write("  Use a short name like `router` or the fully qualified `@stacksjs/router`.\n");
+    process.exit(ExitCode.FatalError);
+  }
+  return shortName;
+}
+function isCoreWorkspaceGlob(glob) {
+  const normalized = glob.replace(/^\.\//, "").replace(/\/$/, "");
+  return normalized === "storage/framework/core" || normalized.startsWith("storage/framework/core/");
+}
+async function assertNoUncommittedChanges(dir, force) {
+  if (force)
+    return;
+  try {
+    const proc = Bun.spawn(["git", "status", "--porcelain", "--", dir], {
+      cwd: process.cwd(),
+      stdout: "pipe",
+      stderr: "ignore"
+    }), output = await new Response(proc.stdout).text();
+    if (await proc.exited !== 0)
+      return;
+    const changed = output.split(`
+`).filter(Boolean);
+    if (changed.length === 0)
+      return;
+    log.error(`${changed.length} uncommitted change${changed.length === 1 ? "" : "s"} under ${italic(dir.replace(`${process.cwd()}/`, ""))}:`);
+    for (const line of changed.slice(0, 10))
+      log.info(`  ${line}`);
+    if (changed.length > 10)
+      log.info(`  ... and ${changed.length - 10} more`);
+    log.info("Commit or stash them first, or pass --force to delete them anyway.");
+    process.exit(ExitCode.FatalError);
+  } catch {}
+}

package/dist/commands/run-tool.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Invoke a migrated tooling module's `run()` with a synthetic argv so its
+ * existing `process.argv` flag parsing (`--check` / `--write` / `--revision` …)
+ * sees the flags the buddy command wants, then restore the real argv. Buddy runs
+ * one command per process and the action is terminal, so this swap is safe.
+ */
+export declare function runTool(run: () => void | Promise<void>, ...flags: string[]): Promise<void>;

package/dist/commands/run-tool.js

@@ -0,0 +1,9 @@
+export async function runTool(run, ...flags) {
+  const saved = process.argv;
+  process.argv = [saved[0] ?? "bun", saved[1] ?? "buddy", ...flags];
+  try {
+    await run();
+  } finally {
+    process.argv = saved;
+  }
+}

package/dist/commands/seed.js

@@ -7,49 +7,24 @@ export function seed(buddy) {
     project: "Target a specific project",
     verbose: "Enable verbose output"
   };
-  buddy.command("seed", descriptions.seed).alias("db:seed").option("-p, --project [project]", descriptions.project, { default: !1 }).option("-c, --class [class]", "Run a specific seeder class from database/seeders/", { default: "" }).option("--allow-protected", "Seed auth/oauth models even on a non-fresh DB (will invalidate live tokens)", { default: !1 }).option("--fresh", "Truncate tables before seeding", { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (options) => {
+  buddy.command("seed", descriptions.seed).alias("db:seed").option("-p, --project [project]", descriptions.project, { default: !1 }).option("--only [models]", "Comma-separated list of models to seed", { default: "" }).option("--except [models]", "Comma-separated list of models to skip", { default: "" }).option("--include-defaults", "Also seed the framework's built-in models", { default: !1 }).option("--allow-protected", "Seed auth/oauth models even on a non-fresh DB (will invalidate live tokens)", { default: !1 }).option("--fresh", "Truncate tables before seeding", { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (options) => {
     log.debug("Running `buddy seed` ...", options);
-    const perf = await intro("buddy seed");
-    if (options.class) {
-      const { injectGlobalAutoImports } = await import("@stacksjs/server");
-      await injectGlobalAutoImports();
-      const { runClassSeeders } = await import("@stacksjs/database"), result = await runClassSeeders({ class: options.class });
-      await outro(`Class seeders: ran=${result.ran.length}, skipped=${result.skipped.length}`, { startTime: perf, useSeconds: !0 });
-      process.exit(result.ran.length > 0 ? ExitCode.Success : ExitCode.FatalError);
-    }
-    const { injectGlobalAutoImports } = await import("@stacksjs/server");
+    const perf = await intro("buddy seed"), { injectGlobalAutoImports } = await import("@stacksjs/server");
     await injectGlobalAutoImports();
-    const { runClassSeeders, listSeedableModels } = await import("@stacksjs/database"), { path } = await import("@stacksjs/path"), { fs } = await import("@stacksjs/storage"), seedableModels = await listSeedableModels(), seedersDir = path.projectPath("database/seeders"), existingSeederFiles = fs.existsSync(seedersDir) ? new Set(fs.readdirSync(seedersDir).filter((f) => f.endsWith(".ts"))) : new Set, unmigratedModels = seedableModels.filter((m) => !existingSeederFiles.has(`${m.name}Seeder.ts`));
-    if (unmigratedModels.length > 0)
-      log.warn(`[seed] ${unmigratedModels.length} model(s) declare the deprecated \`useSeeder\` trait but have no class seeder file: ${unmigratedModels.map((m) => m.name).join(", ")}. ` + "The auto-walker has been removed (stacksjs/stacks#1919) \u2014 these models will NOT seed. " + "Run `./buddy seed:scaffold` to codemod a class seeder per model and strip the trait (stacksjs/stacks#1929), then re-run `./buddy seed`.");
-    const classResult = await runClassSeeders(), APP_ENV = process.env.APP_ENV || "local", ran = classResult.ran.length;
-    await outro(`Seeded your ${APP_ENV} database. Class seeders: ran=${ran}, skipped=${classResult.skipped.length}.`, { startTime: perf, useSeconds: !0 });
-    process.exit(ExitCode.Success);
-  });
-  buddy.command("seed:scaffold", "Generate class seeders for every model with a useSeeder trait (codemod for stacksjs/stacks#1919)").option("--force", "Overwrite existing seeder files", { default: !1 }).option("--dry-run", "Print what would be generated without writing files", { default: !1 }).action(async (options) => {
-    const perf = await intro("buddy seed:scaffold");
-    try {
-      const { scaffoldClassSeedersFromModels } = await import("@stacksjs/database"), result = await scaffoldClassSeedersFromModels({
-        force: options.force,
-        dryRun: options.dryRun
-      }), generated = result.generated.length, alreadyThere = result.skipped.filter((s) => s.reason === "already-exists").length, stripped = result.strippedTrait.length, errors = result.errors.length;
-      for (const g of result.generated)
-        console.log(`  + ${g.model} \u2192 ${g.file}`);
-      for (const s of result.skipped.filter((s) => s.reason === "already-exists"))
-        console.log(`  \xB7 ${s.model}: seeder exists (pass --force to overwrite)`);
-      for (const t of result.strippedTrait)
-        console.log(`  - ${t.model}: removed useSeeder trait from model`);
-      for (const t of result.traitStripSkipped)
-        log.warn(`  ! ${t.model}: useSeeder value couldn't be auto-removed \u2014 strip it manually (${t.file})`);
-      for (const e of result.errors)
-        log.warn(`  ! ${e.model}: ${e.error}`);
-      const verb = options.dryRun ? "would generate" : "generated", strippedVerb = options.dryRun ? "would strip" : "stripped";
-      await outro(`Seeder scaffold: ${verb} ${generated}, skipped ${alreadyThere} existing, ${strippedVerb} ${stripped} trait(s), ${errors} error(s).`, { startTime: perf, useSeconds: !0 });
-      process.exit(errors > 0 && generated === 0 ? ExitCode.FatalError : ExitCode.Success);
-    } catch (err) {
-      await outro("seed:scaffold failed", { startTime: perf, useSeconds: !0 }, err);
-      process.exit(ExitCode.FatalError);
+    const { seed: seedDatabase } = await import("@stacksjs/database"), list = (value) => value ? value.split(",").map((entry) => entry.trim()).filter(Boolean) : void 0, summary = await seedDatabase({
+      verbose: options.verbose,
+      fresh: options.fresh,
+      only: list(options.only),
+      except: list(options.except),
+      includeDefaults: options.includeDefaults,
+      allowProtected: options.allowProtected
+    }), APP_ENV = process.env.APP_ENV || "local";
+    if (summary.total === 0) {
+      await outro("No models declare a `useSeeder` trait \u2014 nothing to seed.", { startTime: perf, useSeconds: !0 });
+      process.exit(ExitCode.Success);
     }
+    await outro(`Seeded your ${APP_ENV} database. ${summary.successful}/${summary.total} model(s) seeded${summary.failed > 0 ? `, ${summary.failed} failed` : ""}.`, { startTime: perf, useSeconds: !0 });
+    process.exit(summary.failed > 0 ? ExitCode.FatalError : ExitCode.Success);
   });
   buddy.command("seed:roles", "Seed default RBAC role packs (admin, dev, client)").alias("roles:seed").action(async () => {
     const perf = await intro("buddy seed:roles");