@tomflow/proflow-platform-cli 0.1.1 → 0.1.3

package/dist/src/errors.d.ts

@@ -1,4 +1,4 @@
-export declare const platformErrorCodes: readonly ["INVALID_REQUEST", "DESCRIPTOR_INVALID", "DUPLICATE_IDENTITY", "DEPENDENCY_UNRESOLVED", "DEPENDENCY_INCOMPATIBLE", "DEPENDENCY_CYCLE", "CONFIG_MISSING", "SECRET_REF_INVALID", "PLAN_STALE", "PLAN_NOT_FOUND", "PLAN_INVALID", "WORKSPACE_LOCKED", "LIFECYCLE_UNSUPPORTED", "SECRET_LEAK", "APPLY_FAILED", "UPGRADE_FAILED", "CORE_PACKAGE_REQUIRED", "UNINSTALL_FAILED", "VERIFY_FAILED", "REGISTRY_UNAVAILABLE", "REGISTRY_AUTH_REQUIRED", "REGISTRY_RESPONSE_INVALID", "PACKAGE_NOT_FOUND", "PACKAGE_NOT_PROFLOW", "COMMAND_FAILED"];
+export declare const platformErrorCodes: readonly ["INVALID_REQUEST", "DESCRIPTOR_INVALID", "DUPLICATE_IDENTITY", "DEPENDENCY_UNRESOLVED", "DEPENDENCY_INCOMPATIBLE", "DEPENDENCY_CYCLE", "CONFIG_MISSING", "CONFIG_INVALID", "SECRET_REF_INVALID", "PLAN_STALE", "PLAN_NOT_FOUND", "PLAN_INVALID", "WORKSPACE_LOCKED", "WORKSPACE_NOT_FOUND", "WORKSPACE_NOT_WRITABLE", "WORKSPACE_NOT_BOUND", "WORKSPACE_ALREADY_BOUND", "BOUND_WORKSPACE_MISSING", "WORKSPACE_INSTANCE_INVALID", "GLOBAL_BINDING_INVALID", "GLOBAL_BINDING_LOCKED", "GLOBAL_OPERATION_LOCKED", "PACKAGE_MANAGER_UNSUPPORTED", "PACKAGE_MANAGER_CONFLICT", "PACKAGE_MANAGER_UNAVAILABLE", "LIFECYCLE_UNSUPPORTED", "SECRET_LEAK", "APPLY_FAILED", "UPGRADE_FAILED", "CORE_PACKAGE_REQUIRED", "UNINSTALL_FAILED", "VERIFY_FAILED", "REGISTRY_UNAVAILABLE", "REGISTRY_AUTH_REQUIRED", "REGISTRY_RESPONSE_INVALID", "PACKAGE_NOT_FOUND", "PACKAGE_NOT_PROFLOW", "COMMAND_FAILED"];
 export type PlatformErrorCode = (typeof platformErrorCodes)[number];
 export declare class PlatformError extends Error {
     readonly code: PlatformErrorCode;

package/dist/src/errors.js

@@ -6,11 +6,24 @@ export const platformErrorCodes = [
     "DEPENDENCY_INCOMPATIBLE",
     "DEPENDENCY_CYCLE",
     "CONFIG_MISSING",
+    "CONFIG_INVALID",
     "SECRET_REF_INVALID",
     "PLAN_STALE",
     "PLAN_NOT_FOUND",
     "PLAN_INVALID",
     "WORKSPACE_LOCKED",
+    "WORKSPACE_NOT_FOUND",
+    "WORKSPACE_NOT_WRITABLE",
+    "WORKSPACE_NOT_BOUND",
+    "WORKSPACE_ALREADY_BOUND",
+    "BOUND_WORKSPACE_MISSING",
+    "WORKSPACE_INSTANCE_INVALID",
+    "GLOBAL_BINDING_INVALID",
+    "GLOBAL_BINDING_LOCKED",
+    "GLOBAL_OPERATION_LOCKED",
+    "PACKAGE_MANAGER_UNSUPPORTED",
+    "PACKAGE_MANAGER_CONFLICT",
+    "PACKAGE_MANAGER_UNAVAILABLE",
     "LIFECYCLE_UNSUPPORTED",
     "SECRET_LEAK",
     "APPLY_FAILED",

package/dist/src/install/environment.d.ts

@@ -1,5 +1,5 @@
 import { type NpmCommandRunner } from "../registry/index.ts";
-import { type SupportedWorkspacePackageManager } from "./package-manager.ts";
+import { type PackageManagerSelectionSource, type SupportedWorkspacePackageManager } from "./package-manager.ts";
 export declare const PLATFORM_INSTALL_NODE_RANGE = ">=24.19.0";
 export type InstallerPreflightStatus = "READY" | "ACTION_REQUIRED" | "BLOCKED";
 export type InstallerFindingSeverity = "info" | "action" | "error";
@@ -17,6 +17,7 @@ export interface InstallerEnvironmentPreflightResult {
     npmVersion?: string;
     packageManager?: {
         name: SupportedWorkspacePackageManager;
+        source: PackageManagerSelectionSource;
         declared?: string;
         version?: string;
     };

package/dist/src/install/environment.js

@@ -48,57 +48,61 @@ export async function preflightInstallerEnvironment(options) {
             findings.push(platformErrorFinding(error, "NPM_UNAVAILABLE"));
         }
     }
-    const packageManager = await readWorkspacePackageManagerSelection(options.workspaceRoot);
+    let packageManager;
     let packageManagerVersion;
-    if (packageManager === undefined) {
-        findings.push({
-            code: "PACKAGE_MANAGER_UNSUPPORTED",
-            severity: "action",
-            message: `unsupported packageManager declaration: ${workspace.packageManager ?? "<unknown>"}`,
-        });
-    }
-    else if (packageManager.name === "pnpm") {
-        if (!findExecutable("pnpm")) {
+    try {
+        packageManager = await readWorkspacePackageManagerSelection(options.workspaceRoot);
+        if (!findExecutable(packageManager.name)) {
             findings.push({
-                code: "PNPM_REQUIRED",
+                code: "PACKAGE_MANAGER_UNAVAILABLE",
                 severity: "action",
-                message: `workspace declares ${packageManager.declared}; install/enable pnpm before applying package changes`,
+                message: `workspace selects ${packageManager.name}, but that executable is not available on PATH`,
             });
         }
+        else if (packageManager.name === "npm" && npmVersion !== undefined) {
+            packageManagerVersion = npmVersion;
+        }
         else {
             try {
-                const result = (await systemPackageCommandRunner().run("pnpm", ["--version"], options.workspaceRoot)).trim();
-                packageManagerVersion = result;
-                findings.push({
-                    code: "PNPM_READY",
-                    severity: "info",
-                    message: `pnpm ${result} is available for this workspace`,
-                });
+                packageManagerVersion = (await systemPackageCommandRunner().run(packageManager.name, ["--version"], options.workspaceRoot)).trim();
             }
             catch (error) {
                 findings.push({
-                    code: "PNPM_REQUIRED",
+                    code: "PACKAGE_MANAGER_UNAVAILABLE",
                     severity: "action",
                     message: error instanceof Error ? error.message : String(error),
                 });
             }
         }
+        if (packageManagerVersion !== undefined) {
+            findings.push({
+                code: "PACKAGE_MANAGER_READY",
+                severity: "info",
+                message: `${packageManager.name} ${packageManagerVersion} is selected via ${packageManager.source}`,
+            });
+        }
     }
-    else if (npmVersion !== undefined) {
-        packageManagerVersion = npmVersion;
-        findings.push({
-            code: "PACKAGE_MANAGER_READY",
-            severity: "info",
-            message: packageManager.declared === undefined
-                ? "workspace does not declare packageManager; npm will be used for bootstrap package operations"
-                : `workspace declares ${packageManager.declared}`,
-        });
+    catch (error) {
+        if (error instanceof PlatformError) {
+            findings.push({
+                code: error.code,
+                severity: error.code === "PACKAGE_MANAGER_CONFLICT" ? "error" : "action",
+                message: error.message,
+            });
+        }
+        else {
+            findings.push({
+                code: "PACKAGE_MANAGER_UNAVAILABLE",
+                severity: "action",
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
     }
     let registry;
     if (npmVersion !== undefined) {
         try {
             registry = await resolveScopeRegistry(options.workspaceRoot, runner);
-            await runner.run(["ping", "--json", "--prefer-online", `--registry=${registry}`], options.workspaceRoot);
+            await runner.run(["ping", "--json", "--prefer-online", `--registry=${registry}`], options.workspaceRoot, 10_000);
             findings.push({
                 code: "REGISTRY_READY",
                 severity: "info",

package/dist/src/install/install.js

@@ -111,6 +111,47 @@ export function renderInstallDoc(input) {
         }
         lines.push("");
     }
+    const missingRequiredConfig = {};
+    for (const module of modules) {
+        const resolved = resolveModuleConfig(module, input.config?.[module.moduleRef]);
+        for (const slot of module.configSlots) {
+            if (!slot.required || resolved.values[slot.key] !== undefined)
+                continue;
+            const placeholder = slot.type === "secretRef"
+                ? "secret://provider/name"
+                : slot.type === "url"
+                    ? "https://example.invalid"
+                    : slot.type === "path"
+                        ? "/absolute/path"
+                        : slot.type === "moduleRef"
+                            ? "module-ref"
+                            : "<value>";
+            const moduleConfig = missingRequiredConfig[module.moduleRef] ?? {};
+            moduleConfig[slot.key] = placeholder;
+            missingRequiredConfig[module.moduleRef] = moduleConfig;
+        }
+    }
+    lines.push("## Configure Before Start");
+    lines.push("");
+    if (Object.keys(missingRequiredConfig).length === 0) {
+        lines.push("No required configuration is currently missing. Re-run `platform preflight --intent start` before starting to confirm current runtime readiness.");
+    }
+    else {
+        lines.push("Create a JSON config file (for example `./proflow-config.json`) using the required missing slots below. Replace placeholders with real environment-specific values. `secretRef` values must remain opaque references such as `secret://provider/name`; do not place raw secrets in this file.");
+        lines.push("");
+        lines.push("```json");
+        lines.push(JSON.stringify({ modules: missingRequiredConfig }, null, 2));
+        lines.push("```");
+        lines.push("");
+        lines.push("Apply and re-check the configuration:");
+        lines.push("");
+        lines.push("1. `platform plan --intent configure --config ./proflow-config.json`");
+        lines.push("2. Copy the returned `planRef`.");
+        lines.push("3. `platform apply <planRef>`");
+        lines.push("4. `platform preflight --intent start`");
+        lines.push("5. Resolve any remaining human or external-resource actions reported by preflight, then run the same preflight command again until the Platform reports the expected readiness state.");
+    }
+    lines.push("");
     lines.push("## Verification Plan");
     lines.push("");
     for (const module of modules) {

package/dist/src/install/package-manager.d.ts

@@ -1,11 +1,13 @@
-export type SupportedWorkspacePackageManager = "npm" | "pnpm";
+export type SupportedWorkspacePackageManager = "npm" | "yarn" | "pnpm";
+export type PackageManagerSelectionSource = "declared" | "lockfile" | "bootstrap-default";
 export interface WorkspacePackageManagerSelection {
     name: SupportedWorkspacePackageManager;
+    source: PackageManagerSelectionSource;
     declared?: string;
 }
 export interface PackageCommandRunner {
     run(command: string, args: readonly string[], cwd: string): Promise<string>;
 }
 export declare function systemPackageCommandRunner(): PackageCommandRunner;
-export declare function readWorkspacePackageManagerSelection(workspaceRoot: string): Promise<WorkspacePackageManagerSelection | undefined>;
+export declare function readWorkspacePackageManagerSelection(workspaceRoot: string): Promise<WorkspacePackageManagerSelection>;
 export declare function findExecutable(command: string): boolean;

package/dist/src/install/package-manager.js

@@ -1,8 +1,9 @@
 import { execFile } from "node:child_process";
 import { accessSync, constants } from "node:fs";
-import { readFile } from "node:fs/promises";
+import { access, readFile } from "node:fs/promises";
 import { delimiter, join } from "node:path";
 import { promisify } from "node:util";
+import { PlatformError } from "../errors.js";
 const execFileAsync = promisify(execFile);
 export function systemPackageCommandRunner() {
     return {
@@ -17,25 +18,27 @@ export function systemPackageCommandRunner() {
     };
 }
 export async function readWorkspacePackageManagerSelection(workspaceRoot) {
-    let declared;
-    try {
-        const raw = await readFile(join(workspaceRoot, "package.json"), "utf8");
-        const parsed = JSON.parse(raw);
-        if (isRecord(parsed) && typeof parsed.packageManager === "string") {
-            declared = parsed.packageManager;
+    const declared = await readDeclaredPackageManager(workspaceRoot);
+    const lockManagers = await detectLockfileManagers(workspaceRoot);
+    if (declared !== undefined) {
+        const name = packageManagerName(declared);
+        if (name === undefined) {
+            throw new PlatformError("PACKAGE_MANAGER_UNSUPPORTED", `unsupported packageManager declaration: ${declared}; expected npm, yarn, or pnpm`);
+        }
+        const conflicts = [...lockManagers].filter((manager) => manager !== name);
+        if (conflicts.length > 0) {
+            throw new PlatformError("PACKAGE_MANAGER_CONFLICT", `packageManager declares ${declared}, but conflicting lockfiles indicate ${conflicts.join(", ")}`);
         }
+        return { name, source: "declared", declared };
     }
-    catch {
-        // A Fresh Workspace without package.json uses npm for bootstrap. Invalid
-        // package.json is rejected earlier by installer preflight.
+    if (lockManagers.size > 1) {
+        throw new PlatformError("PACKAGE_MANAGER_CONFLICT", `multiple package-manager lockfiles are present: ${[...lockManagers].sort().join(", ")}`);
     }
-    if (declared === undefined)
-        return { name: "npm" };
-    const separator = declared.lastIndexOf("@");
-    const name = separator > 0 ? declared.slice(0, separator) : declared;
-    if (name !== "npm" && name !== "pnpm")
-        return undefined;
-    return { name, declared };
+    const [fromLockfile] = lockManagers;
+    if (fromLockfile !== undefined) {
+        return { name: fromLockfile, source: "lockfile" };
+    }
+    return { name: "npm", source: "bootstrap-default" };
 }
 export function findExecutable(command) {
     const path = process.env.PATH ?? "";
@@ -53,6 +56,59 @@ export function findExecutable(command) {
     }
     return false;
 }
+async function readDeclaredPackageManager(workspaceRoot) {
+    try {
+        const raw = await readFile(join(workspaceRoot, "package.json"), "utf8");
+        const parsed = JSON.parse(raw);
+        if (!isRecord(parsed)) {
+            throw new PlatformError("PACKAGE_MANAGER_CONFLICT", "workspace package.json root must be an object");
+        }
+        return typeof parsed.packageManager === "string"
+            ? parsed.packageManager
+            : undefined;
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return undefined;
+        if (error instanceof PlatformError)
+            throw error;
+        throw new PlatformError("PACKAGE_MANAGER_CONFLICT", `cannot inspect workspace package.json: ${errorMessage(error)}`);
+    }
+}
+async function detectLockfileManagers(workspaceRoot) {
+    const managers = new Set();
+    if ((await pathExists(join(workspaceRoot, "package-lock.json"))) ||
+        (await pathExists(join(workspaceRoot, "npm-shrinkwrap.json")))) {
+        managers.add("npm");
+    }
+    if (await pathExists(join(workspaceRoot, "yarn.lock")))
+        managers.add("yarn");
+    if (await pathExists(join(workspaceRoot, "pnpm-lock.yaml")))
+        managers.add("pnpm");
+    return managers;
+}
+function packageManagerName(declared) {
+    const separator = declared.lastIndexOf("@");
+    const name = separator > 0 ? declared.slice(0, separator) : declared;
+    return name === "npm" || name === "yarn" || name === "pnpm"
+        ? name
+        : undefined;
+}
+async function pathExists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isMissingFile(error) {
+    return isRecord(error) && error.code === "ENOENT";
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/src/lifecycle/dispatch.js

@@ -110,7 +110,58 @@ async function runInOrder(catalog, modules, order, primitive) {
  * `start` primitive only to modules that declare it.
  */
 export async function startModules(catalog, modules) {
-    return runInOrder(catalog, modules, buildDependencyGraph(modules).order, "start");
+    const graph = buildDependencyGraph(modules);
+    const byRef = new Map(modules.map((module) => [module.moduleRef, module]));
+    const resultByRef = new Map();
+    const results = [];
+    for (const moduleRef of graph.order) {
+        const module = byRef.get(moduleRef);
+        if (module === undefined)
+            continue;
+        if (!module.lifecycle.includes("start")) {
+            const skipped = await runOne(catalog, module, "start");
+            results.push(skipped);
+            resultByRef.set(moduleRef, skipped);
+            continue;
+        }
+        const blockingDependency = graph.edges
+            .filter((edge) => edge.from === moduleRef)
+            .map((edge) => edge.to)
+            .find((dependencyRef) => {
+            const dependencyModule = byRef.get(dependencyRef);
+            if (!dependencyModule?.lifecycle.includes("start"))
+                return false;
+            const dependencyResult = resultByRef.get(dependencyRef);
+            return dependencyResult?.result?.status !== "SUCCEEDED";
+        });
+        if (blockingDependency !== undefined) {
+            const blocked = {
+                moduleRef,
+                primitive: "start",
+                status: "EXECUTED",
+                result: {
+                    contract: "deployment.result.v1",
+                    ok: false,
+                    status: "BLOCKED",
+                    moduleRef: module.moduleRef,
+                    moduleVersion: module.moduleVersion,
+                    error: {
+                        code: "COMMAND_FAILED",
+                        message: `dependency ${blockingDependency} did not start successfully; ${moduleRef} was not started`,
+                        retryable: true,
+                    },
+                },
+                observedEffects: [],
+            };
+            results.push(blocked);
+            resultByRef.set(moduleRef, blocked);
+            continue;
+        }
+        const result = await runOne(catalog, module, "start");
+        results.push(result);
+        resultByRef.set(moduleRef, result);
+    }
+    return results;
 }
 /**
  * Stops a module set in reverse dependency topological order, dispatching the

package/dist/src/lifecycle/service-process.js

@@ -195,6 +195,15 @@ export async function managedServiceStatus(paths, module) {
         observedEffects: [],
     };
 }
+async function waitForStartupStability(pid, milliseconds = 500) {
+    const deadline = Date.now() + milliseconds;
+    while (Date.now() < deadline) {
+        if (!isAlive(pid))
+            return false;
+        await new Promise((resolveWait) => setTimeout(resolveWait, 50));
+    }
+    return isAlive(pid);
+}
 export async function startManagedService(paths, module, rawBinding) {
     const existing = await readRecord(paths, module.moduleRef);
     if (existing && (await isOwnedProcess(existing))) {
@@ -243,13 +252,20 @@ export async function startManagedService(paths, module, rawBinding) {
                 result: failed(module, "service process spawned without pid"),
                 observedEffects: [],
             };
+        const pid = child.pid;
+        if (!(await waitForStartupStability(pid))) {
+            return {
+                result: failed(module, `service process ${pid} exited during startup stabilization`),
+                observedEffects: [],
+            };
+        }
         child.unref();
         const record = {
             contract: "deployment.service-process-state.v1",
             moduleRef: module.moduleRef,
             packageName: module.packageName,
             moduleVersion: module.moduleVersion,
-            pid: child.pid,
+            pid,
             startedAt: new Date().toISOString(),
             binPath,
             configPath,
@@ -257,8 +273,22 @@ export async function startManagedService(paths, module, rawBinding) {
             stderrPath,
         };
         await writeJsonAtomic(recordPath(paths, module.moduleRef), record, 0o600);
+        const observed = await managedServiceStatus(paths, module);
+        if (observed.result.status !== "SUCCEEDED") {
+            await removeRecord(paths, module.moduleRef);
+            try {
+                process.kill(pid, "SIGTERM");
+            }
+            catch {
+                // process already exited between observations
+            }
+            return {
+                result: failed(module, `service process ${pid} could not be observed as the owned RUNNING process after spawn`),
+                observedEffects: [],
+            };
+        }
         return {
-            result: { ...base(module), data: { state: "RUNNING", pid: child.pid } },
+            ...observed,
             observedEffects: ["Manage the declared service process"],
         };
     }

package/dist/src/persistence/guards.js

@@ -19,6 +19,7 @@ function isDeploymentIntent(value) {
     return (value === "install" ||
         value === "configure" ||
         value === "upgrade" ||
+        value === "uninstall" ||
         value === "repair");
 }
 function isSelectedModuleFact(value) {

package/dist/src/planner/check.js

@@ -76,7 +76,18 @@ function checkConfig(step, plan, reality) {
             return notSatisfied(`required config ${slot.key} is missing`);
         }
     }
-    return satisfied(`required config materialized for ${step.moduleRef}`);
+    // A configure step is satisfied only when current persisted reality matches
+    // the immutable target carried by this plan. Required-key presence alone is
+    // insufficient: a failed/partial prior apply can leave every key present but
+    // with values that the module-owned materializer rejected.
+    const target = plan.moduleTargets.find((entry) => entry.moduleRef === step.moduleRef)?.config;
+    for (const [key, expected] of Object.entries(target ?? {})) {
+        const observed = reality.configValues[key];
+        if (observed !== expected) {
+            return notSatisfied(`config ${key} for ${step.moduleRef} is ${observed === undefined ? "not observed" : "not at the planned target"}`);
+        }
+    }
+    return satisfied(`planned config materialized for ${step.moduleRef}`);
 }
 function checkVerify(step, plan, reality) {
     const module = moduleOf(plan, step);

package/dist/src/planner/plan.d.ts

@@ -9,6 +9,7 @@ export interface PlanInput {
     currentDescriptors?: readonly ModuleDescriptor[];
     targetDescriptors?: readonly ModuleDescriptor[];
     facts?: readonly RepairFact[];
+    uninstallScope?: "module" | "platform-instance";
     now?: Date;
 }
 export declare function planDeployment(input: PlanInput): DeploymentPlan;

package/dist/src/planner/plan.js

@@ -52,14 +52,14 @@ function planInstallOrConfigure(input) {
     const graph = buildDependencyGraph(modules);
     const steps = input.intent === "install"
         ? installSteps(modules, graph)
-        : configureSteps(modules, graph);
+        : configureSteps(modules, graph, input.targets ?? [], input.config);
     return assemblePlan({
         intent: input.intent,
         modules,
         targets: input.targets ?? [],
         config: input.config,
         steps,
-        humanActions: humanActionsFromModules(modules),
+        humanActions: input.intent === "install" ? humanActionsFromModules(modules) : [],
         now: input.now ?? new Date(),
     });
 }
@@ -90,35 +90,23 @@ function installSteps(modules, graph) {
     }
     return steps;
 }
-function configureSteps(modules, graph) {
+function configureSteps(modules, graph, targets, config) {
     const seq = createSequencer();
     const byRef = new Map(modules.map((module) => [module.moduleRef, module]));
+    const targetByRef = new Map(targets.map((target) => [target.moduleRef, target]));
     const steps = [];
     for (const ref of graph.order) {
         const module = byRef.get(ref);
-        if (module === undefined)
+        if (module === undefined || module.configSlots.length === 0)
             continue;
-        if (module.configSlots.length > 0) {
-            steps.push(configStep(seq, module));
-        }
-        if (module.kind === "external-resource") {
-            const step = externalResourceStep(seq, module);
-            if (step !== undefined)
-                steps.push(step);
-        }
-        if (module.kind === "service") {
-            if (module.lifecycle.includes("restart")) {
-                steps.push(lifecycleStep(seq, module, "restart"));
-            }
-            else if (module.lifecycle.includes("start")) {
-                steps.push(lifecycleStep(seq, module, "start"));
-            }
-        }
-        for (const requirement of module.requirements) {
-            if (requirement.kind === "human") {
-                steps.push(humanStep(seq, module, requirement.action));
-            }
-        }
+        const explicitConfig = targetByRef.get(ref)?.config;
+        const providedConfig = config?.[ref];
+        const hasMaterializationTarget = (explicitConfig !== undefined &&
+            Object.keys(explicitConfig).length > 0) ||
+            (providedConfig !== undefined && Object.keys(providedConfig).length > 0);
+        if (!hasMaterializationTarget)
+            continue;
+        steps.push(configStep(seq, module));
     }
     return steps;
 }
@@ -128,7 +116,7 @@ function planUninstall(input) {
         throw new PlatformError("INVALID_REQUEST", "uninstall requires modules");
     }
     const core = modules.find((module) => module.installClass === "core");
-    if (core !== undefined) {
+    if (core !== undefined && input.uninstallScope !== "platform-instance") {
         throw new PlatformError("CORE_PACKAGE_REQUIRED", `core module ${core.moduleRef} cannot be individually uninstalled`);
     }
     const graph = buildDependencyGraph(modules);

package/dist/src/preflight/config.d.ts

@@ -8,3 +8,4 @@ export interface ResolvedModuleConfig {
 }
 export declare function resolveModuleConfig(module: ResolvedModule, provided: Record<string, string> | undefined): ResolvedModuleConfig;
 export declare function checkConfigReadiness(modules: readonly ResolvedModule[], config: Record<string, Record<string, string>> | undefined): PreflightFinding[];
+export declare function checkConfigReality(modules: readonly ResolvedModule[], config: Record<string, Record<string, string>> | undefined): Promise<PreflightFinding[]>;

package/dist/src/preflight/config.js

@@ -1,3 +1,5 @@
+import { constants } from "node:fs";
+import { access, readFile, stat } from "node:fs/promises";
 import { PlatformError } from "../errors.js";
 import { isValidSecretRef } from "../security/redact.js";
 function compareRef(a, b) {
@@ -43,3 +45,44 @@ export function checkConfigReadiness(modules, config) {
     }
     return findings;
 }
+function requiresExistingInputFile(key, sensitive) {
+    return (sensitive === true ||
+        /(?:ConfigPath|ProfilesFile|CredentialFile|TokenFile|tokenFile|credentialFile)$/.test(key));
+}
+function requiresJsonFile(key) {
+    return /(?:ConfigPath|ProfilesFile)$/.test(key);
+}
+export async function checkConfigReality(modules, config) {
+    const findings = [];
+    for (const module of [...modules].sort((a, b) => compareRef(a.moduleRef, b.moduleRef))) {
+        for (const slot of module.configSlots) {
+            if (slot.type !== "path")
+                continue;
+            const value = config?.[module.moduleRef]?.[slot.key] ??
+                (slot.default === undefined ? undefined : String(slot.default));
+            if (!value || !requiresExistingInputFile(slot.key, slot.sensitive))
+                continue;
+            try {
+                await access(value, constants.R_OK);
+                const info = await stat(value);
+                if (!info.isFile())
+                    throw new Error("not a file");
+                const raw = await readFile(value, "utf8");
+                if (slot.sensitive === true && raw.trim().length < 32) {
+                    throw new Error("credential/token file is shorter than 32 characters");
+                }
+                if (requiresJsonFile(slot.key))
+                    JSON.parse(raw);
+            }
+            catch (error) {
+                findings.push({
+                    code: "CONFIG_INVALID",
+                    severity: "error",
+                    moduleRef: module.moduleRef,
+                    message: `config path "${slot.key}" for ${module.moduleRef} is not runtime-ready: ${error instanceof Error ? error.message : String(error)}`,
+                });
+            }
+        }
+    }
+    return findings;
+}

package/dist/src/preflight/preflight.d.ts

@@ -1,8 +1,10 @@
 import type { ResolvedModule } from "../contracts.ts";
 import type { ModuleCatalog } from "../modules.ts";
+import type { WorkspacePaths } from "../paths.ts";
 import type { PreflightResult } from "./findings.ts";
 export interface PreflightOptions {
     config?: Record<string, Record<string, string>>;
     catalog?: ModuleCatalog;
+    paths?: WorkspacePaths;
 }
 export declare function runPreflight(modules: readonly ResolvedModule[], options?: PreflightOptions): Promise<PreflightResult>;