flowdular 0.4.3 → 0.6.0

package/dist/distribution.js

@@ -18,6 +18,9 @@ var RegistryError = class extends Error {
 var ALLOWED = Object.freeze({ allowed: true });
 var NO_POLICIES = Object.freeze([]);
 
+// ../kernel/src/lifecycle.ts
+var ALLOWED2 = Object.freeze({ allowed: true });
+
 // ../kernel/src/version-range.ts
 var VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 var COMPARATOR = /^(\^|~|>=|<=|>|<|=)?\s*(.+)$/;
@@ -1424,7 +1427,7 @@ var project_schema_default = {
   },
   $defs: {
     deliveryTarget: {
-      enum: ["workspace", "git-pr", "official-modules"]
+      enum: ["workspace", "git-pr"]
     },
     gitName: {
       type: "string",
@@ -1587,14 +1590,6 @@ var moduleCatalogSchema = module_catalog_schema_default;
 var moduleArtifactSchema = module_artifact_schema_default;
 
 // ../contracts/src/translations.ts
-var PLURAL_CATEGORIES = [
-  "zero",
-  "one",
-  "two",
-  "few",
-  "many",
-  "other"
-];
 var WHOLE_NUMBER_SAMPLES = [
   ...Array.from({ length: 200 }, (_, index) => index),
   1e3,
@@ -1605,61 +1600,6 @@ var WHOLE_NUMBER_SAMPLES = [
   1e8,
   1e9
 ];
-function requiredPluralCategories(locale) {
-  const rules = new Intl.PluralRules(locale);
-  const selected = /* @__PURE__ */ new Set(["other"]);
-  for (const sample of WHOLE_NUMBER_SAMPLES) selected.add(rules.select(sample));
-  return PLURAL_CATEGORIES.filter((category) => selected.has(category));
-}
-function pluralMember(bundle, key) {
-  const dot = key.lastIndexOf(".");
-  if (dot <= 0) return null;
-  const category = key.slice(dot + 1);
-  if (!PLURAL_CATEGORIES.includes(category)) return null;
-  const base = key.slice(0, dot);
-  if (!Object.hasOwn(bundle, base + ".other")) return null;
-  const inflected = PLURAL_CATEGORIES.some(
-    (other) => other !== "other" && Object.hasOwn(bundle, base + "." + other)
-  );
-  return inflected ? { base, category } : null;
-}
-function translationKeys(bundle) {
-  const keys = /* @__PURE__ */ new Set();
-  for (const key of Object.keys(bundle)) {
-    keys.add(pluralMember(bundle, key)?.base ?? key);
-  }
-  return [...keys].sort();
-}
-function pluralFamilyIssues(bundle, locale) {
-  const families = /* @__PURE__ */ new Map();
-  for (const key of Object.keys(bundle)) {
-    const member = pluralMember(bundle, key);
-    if (member === null) continue;
-    const categories = families.get(member.base) ?? /* @__PURE__ */ new Set();
-    categories.add(member.category);
-    families.set(member.base, categories);
-  }
-  const required = requiredPluralCategories(locale);
-  const known = new Intl.PluralRules(
-    locale
-  ).resolvedOptions().pluralCategories;
-  const issues = [];
-  for (const base of [...families.keys()].sort()) {
-    const categories = families.get(base);
-    const missing = required.filter((category) => !categories.has(category));
-    if (missing.length > 0) {
-      issues.push(
-        `${base} lacks ${missing.map((category) => base + "." + category).join(", ")} for ${locale}`
-      );
-    }
-    for (const category of categories) {
-      if (!known.includes(category)) {
-        issues.push(`${base}.${category} is never selected for ${locale}`);
-      }
-    }
-  }
-  return issues;
-}
 
 // ../contracts/src/web.ts
 var RESERVED_WEB_SEGMENTS = Object.freeze([
@@ -1682,8 +1622,55 @@ var WEB_PAGE_PATH = new RegExp(
   `^(?:/|(?:/(?:${SEGMENT}|:[a-z][a-zA-Z0-9]*))+)$`
 );
 
+// ../contracts/src/branding.ts
+var DEFAULT_APPLICATION_BRANDING = Object.freeze({
+  appName: "Flowdular",
+  documentTitle: "",
+  description: "",
+  ogImageUrl: "/og.png",
+  faviconUrl: "/favicon.svg",
+  themeColor: "#141B2E",
+  logoUrl: ""
+});
+var BRANDING_NAME_MAX = 64;
+var BRANDING_TITLE_MAX = 120;
+var BRANDING_DESCRIPTION_MAX = 200;
+var BRANDING_URL_MAX = 512;
+var TEXT_BODY = `[^<>"'\\\\\\p{Cc}]`;
+var BRANDING_NAME_PATTERN = `${TEXT_BODY}{1,${BRANDING_NAME_MAX}}`;
+var BRANDING_TITLE_PATTERN = `|${TEXT_BODY}{1,${BRANDING_TITLE_MAX}}`;
+var BRANDING_DESCRIPTION_PATTERN = `|${TEXT_BODY}{1,${BRANDING_DESCRIPTION_MAX}}`;
+var ASSET_URL = `/(?![/\\\\])[^\\s<>"'\\\\]{0,${BRANDING_URL_MAX - 1}}|https://[^\\s<>"'\\\\/]{1,255}(?:/[^\\s<>"']{0,${BRANDING_URL_MAX - 1}})?`;
+var BRANDING_ASSET_URL_PATTERN = ASSET_URL;
+var BRANDING_OPTIONAL_ASSET_URL_PATTERN = `|${ASSET_URL}`;
+var BRANDING_COLOR_PATTERN = "#[0-9a-fA-F]{6}";
+var FIELDS = {
+  appName: { pattern: BRANDING_NAME_PATTERN, max: BRANDING_NAME_MAX },
+  documentTitle: {
+    pattern: BRANDING_TITLE_PATTERN,
+    max: BRANDING_TITLE_MAX
+  },
+  description: {
+    pattern: BRANDING_DESCRIPTION_PATTERN,
+    max: BRANDING_DESCRIPTION_MAX
+  },
+  ogImageUrl: { pattern: BRANDING_ASSET_URL_PATTERN, max: BRANDING_URL_MAX },
+  faviconUrl: { pattern: BRANDING_ASSET_URL_PATTERN, max: BRANDING_URL_MAX },
+  themeColor: { pattern: BRANDING_COLOR_PATTERN, max: 7 },
+  logoUrl: {
+    pattern: BRANDING_OPTIONAL_ASSET_URL_PATTERN,
+    max: BRANDING_URL_MAX
+  }
+};
+var EXPRESSIONS = new Map(
+  Object.entries(FIELDS).map(([key, field]) => [
+    key,
+    new RegExp(`^(?:${field.pattern})$`, "u")
+  ])
+);
+
 // ../contracts/src/index.ts
-var PLATFORM_API_VERSION = "0.1.26";
+var PLATFORM_API_VERSION = "0.2.3";
 
 // ../kernel/src/module-compatibility.ts
 function satisfiesModuleVersion(version, range) {
@@ -1695,18 +1682,42 @@ function compareModuleVersions(left, right) {
   if (!first || !second) return 0;
   return compareVersions(second, first);
 }
+function assertPlatformLine(moduleId, range, platformVersion) {
+  const [major, minor] = parseVersion(platformVersion);
+  const line = [major, minor, 0];
+  const candidates = [[0, 0, 0]];
+  for (const [named] of range.matchAll(/\d+\.\d+\.\d+/g)) {
+    const version = parseVersion(named);
+    candidates.push(version, [version[0], version[1], version[2] + 1]);
+  }
+  const older = candidates.some(
+    (candidate) => compareVersions(candidate, line) < 0 && rangeSatisfies(candidate.join("."), range)
+  );
+  if (!older) return;
+  throw new RegistryError(
+    "MODULE_PLATFORM_INCOMPATIBLE",
+    `${moduleId} declares platform API ${range}, which also admits versions before ${line.join(".")}; declare "^${line.join(".")}".`
+  );
+}
 function assertModuleCompatibility(manifest, platformVersion = PLATFORM_API_VERSION) {
   if (parseVersion(manifest.version) === null)
     throw new RegistryError(
       "MODULE_VERSION_INVALID",
       `Invalid version for ${manifest.id}: ${manifest.version}`
     );
-  if (manifest.platformApi !== void 0 && (!isValidRange(manifest.platformApi) || platformVersion !== null && !satisfiesModuleVersion(platformVersion, manifest.platformApi))) {
+  if (manifest.platformApi === void 0)
+    throw new RegistryError(
+      "MODULE_PLATFORM_REQUIRED",
+      `${manifest.id} declares no platformApi; add "platformApi": "^${PLATFORM_API_VERSION}".`
+    );
+  if (!isValidRange(manifest.platformApi) || platformVersion !== null && !satisfiesModuleVersion(platformVersion, manifest.platformApi)) {
     throw new RegistryError(
       "MODULE_PLATFORM_INCOMPATIBLE",
       `${manifest.id} requires platform API ${manifest.platformApi}; available ${PLATFORM_API_VERSION}.`
     );
   }
+  if (platformVersion !== null)
+    assertPlatformLine(manifest.id, manifest.platformApi, platformVersion);
   const ids = /* @__PURE__ */ new Set();
   for (const dependency of manifest.dependencies) {
     if (!dependency.range.trim() || !isValidRange(dependency.range))
@@ -1876,7 +1887,7 @@ var WEEKDAY_NAMES = "sun mon tue wed thu fri sat".split(" ");
 var SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set([
   ".git",
   ".flowdular",
-  ".coreloom",
+  ".vercel",
   "node_modules",
   "dist"
 ]);
@@ -1990,11 +2001,6 @@ function validateModuleArtifact(value) {
     "Invalid module artifact."
   );
   assertModuleCompatibility(artifact.manifest);
-  distributionAssert(
-    artifact.manifest.platformApi,
-    "MODULE_PLATFORM_REQUIRED",
-    "Distributed modules must declare platformApi."
-  );
   const paths = /* @__PURE__ */ new Set();
   let size = 0;
   for (const file of artifact.files) {
@@ -2117,7 +2123,6 @@ async function packModule(root, review) {
 
 // src/module-catalog.ts
 import { readFile as readFile4, stat } from "node:fs/promises";
-import { dirname as dirname3, resolve as resolve2 } from "node:path";
 
 // src/workspace.ts
 import { access, readFile as readFile3, realpath } from "node:fs/promises";
@@ -2141,8 +2146,14 @@ async function resolveExistingInside(root, candidate) {
 }
 
 // src/module-catalog.ts
-var OFFICIAL_CATALOG = "https://raw.githubusercontent.com/Flowdular/official-modules/main/registry/index.json";
-var OFFICIAL_PREFIX = "https://raw.githubusercontent.com/Flowdular/official-modules/";
+function platformAdmits(manifest) {
+  try {
+    assertModuleCompatibility(manifest);
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function boundedRead(location, limit, fetcher = fetch) {
   if (!location.startsWith("https://")) {
     distributionAssert(
@@ -2158,10 +2169,11 @@ async function boundedRead(location, limit, fetcher = fetch) {
     );
     return result;
   }
+  const url = new URL(location);
   distributionAssert(
-    location.startsWith(OFFICIAL_PREFIX),
+    url.username === "" && url.password === "" && !url.search && !url.hash,
     "MODULE_SOURCE_UNTRUSTED",
-    "Only the official HTTPS publisher is supported. Use an explicit local catalog for offline releases."
+    "HTTPS module sources must not contain credentials, a query or a fragment."
   );
   const response = await fetcher(location, {
     redirect: "error",
@@ -2170,7 +2182,7 @@ async function boundedRead(location, limit, fetcher = fetch) {
   distributionAssert(
     response.ok && response.body,
     "MODULE_DOWNLOAD_FAILED",
-    `Official module download failed (${response.status}).`
+    `Module download failed (${response.status}).`
   );
   const reader = response.body.getReader();
   const chunks = [];
@@ -2192,11 +2204,11 @@ async function boundedRead(location, limit, fetcher = fetch) {
   }
   return Buffer.concat(chunks);
 }
-async function loadModuleCatalog(location = OFFICIAL_CATALOG, fetcher = fetch) {
+async function loadModuleCatalog(location, fetcher = fetch) {
   distributionAssert(
-    location === OFFICIAL_CATALOG || !/^[a-z][a-z0-9+.-]*:/i.test(location),
+    location.startsWith("https://") || !/^[a-z][a-z0-9+.-]*:/i.test(location),
     "MODULE_SOURCE_UNTRUSTED",
-    "Use the official catalog or an explicit local catalog path."
+    "Use an explicit HTTPS or local catalog path."
   );
   const catalog = JSON.parse(
     (await boundedRead(location, 4 * 1024 * 1024, fetcher)).toString("utf8")
@@ -2214,11 +2226,6 @@ async function loadModuleCatalog(location = OFFICIAL_CATALOG, fetcher = fetch) {
       "Invalid module release."
     );
     assertModuleCompatibility(release.manifest, null);
-    distributionAssert(
-      release.manifest.platformApi,
-      "MODULE_PLATFORM_REQUIRED",
-      "Distributed modules must declare platformApi."
-    );
     const identity = release.manifest.id + "@" + release.manifest.version;
     distributionAssert(
       !identities.has(identity),
@@ -2229,26 +2236,6 @@ async function loadModuleCatalog(location = OFFICIAL_CATALOG, fetcher = fetch) {
   }
   return { catalog, location };
 }
-async function releaseLocation(source, release) {
-  if (source.location.startsWith("https://")) {
-    const prefix = OFFICIAL_PREFIX + release.sourceCommit + "/";
-    distributionAssert(
-      release.artifact.startsWith(prefix) && new URL(release.artifact).href === release.artifact && !new URL(release.artifact).search && !new URL(release.artifact).hash,
-      "MODULE_SOURCE_UNTRUSTED",
-      "Release artifact must be pinned to its official source commit."
-    );
-    return release.artifact;
-  }
-  distributionAssert(
-    !/^[a-z][a-z0-9+.-]*:/i.test(release.artifact),
-    "MODULE_SOURCE_UNTRUSTED",
-    "An offline catalog must use local artifacts."
-  );
-  return resolveExistingInside(
-    dirname3(resolve2(source.location)),
-    release.artifact
-  );
-}
 function resolveModuleReleases(catalog, target, installed) {
   const split = target.lastIndexOf("@");
   const id = split < 0 ? target : target.slice(0, split);
@@ -2286,10 +2273,7 @@ function resolveModuleReleases(catalog, target, installed) {
     ];
   }
   function platformCompatible(candidate) {
-    return satisfiesModuleVersion(
-      PLATFORM_API_VERSION,
-      candidate.manifest.platformApi
-    );
+    return platformAdmits(candidate.manifest);
   }
   let attempts = 0;
   function search(selected2, pending) {
@@ -2347,31 +2331,24 @@ function resolveModuleReleases(catalog, target, installed) {
     return release ? [release] : [];
   });
 }
-async function readRelease(source, release, fetcher = fetch) {
-  return boundedRead(
-    await releaseLocation(source, release),
-    MAX_ARTIFACT_BYTES,
-    fetcher
-  );
-}
 
 // src/module-install.ts
 import {
   lstat as lstat3,
   mkdir,
-  readFile as readFile8,
-  readdir as readdir4,
+  readFile as readFile7,
+  readdir as readdir3,
   rename,
   rm,
   writeFile
 } from "node:fs/promises";
-import { dirname as dirname6, join as join6, relative as relative5 } from "node:path";
+import { dirname as dirname4, join as join5, relative as relative4 } from "node:path";
 
 // src/sdk.ts
 import { createRequire } from "node:module";
 import { readFile as readFile5 } from "node:fs/promises";
-import { dirname as dirname4, join as join3 } from "node:path";
-var SDK_VERSION = "0.4.3";
+import { dirname as dirname3, join as join3 } from "node:path";
+var SDK_VERSION = "0.6.0";
 function npmPackage(specifier) {
   return specifier.startsWith("@") ? specifier.split("/").slice(0, 2).join("/") : specifier.split("/")[0];
 }
@@ -2395,7 +2372,7 @@ async function sdkModules(workspace) {
     if (!/^@flowdular\/sdk\/modules\/[a-z0-9-]+$/.test(entry.import))
       throw new Error("Invalid SDK module entrypoint.");
     const path = await resolveExistingInside(
-      dirname4(indexPath),
+      dirname3(indexPath),
       entry.manifest
     );
     if (result.has(path)) throw new Error("Duplicate SDK module path.");
@@ -2472,10 +2449,184 @@ async function findModuleFiles(workspace) {
 }
 
 // src/module-validate.ts
-import { access as access2, readFile as readFile7, readdir as readdir3 } from "node:fs/promises";
-import { dirname as dirname5, join as join5, relative as relative4 } from "node:path";
 import { parse as parseYaml3 } from "yaml";
 
+// ../database/src/contracts.ts
+var DATABASE_ADAPTER_IDS = Object.freeze({
+  postgresql: "flowdular.postgresql"
+});
+var DATABASE_DIALECT_IDS = Object.freeze({
+  postgresql: "postgresql"
+});
+var DATABASE_CAPABILITY_IDS = Object.freeze({
+  MIGRATION_LOCK: "flowdular.database.migration-lock",
+  RETURNING: "flowdular.database.returning",
+  ROW_LEVEL_SECURITY: "flowdular.database.row-level-security",
+  SCHEMA_INTROSPECTION: "flowdular.database.schema-introspection",
+  TENANT_CONTEXT: "flowdular.database.tenant-context",
+  TRANSACTIONAL_DDL: "flowdular.database.transactional-ddl",
+  TRANSACTIONS: "flowdular.database.transactions"
+});
+var DatabaseError = class extends Error {
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = "DatabaseError";
+  }
+  code;
+};
+function assertDatabaseId(id, kind) {
+  if (!/^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*$/.test(id)) {
+    throw new DatabaseError(
+      "INVALID_ARGUMENT",
+      `"${id}" is not a valid database ${kind} id.`
+    );
+  }
+}
+function assertSchemaName(name) {
+  if (!/^[a-z_][a-z0-9_]{0,62}$/.test(name)) {
+    throw new DatabaseError(
+      "INVALID_ARGUMENT",
+      `"${name}" is not a valid database schema object name.`
+    );
+  }
+}
+function databasePlaceholder(dialectId, position) {
+  assertDatabaseId(dialectId, "dialect");
+  if (!Number.isSafeInteger(position) || position < 1) {
+    throw new DatabaseError(
+      "INVALID_ARGUMENT",
+      "Database placeholder positions start at 1."
+    );
+  }
+  if (dialectId === DATABASE_DIALECT_IDS.postgresql) return `$${position}`;
+  throw new DatabaseError(
+    "UNSUPPORTED_CAPABILITY",
+    `The well-known placeholder helper does not support dialect "${dialectId}".`
+  );
+}
+function databaseDialectSql(dialectId) {
+  assertDatabaseId(dialectId, "dialect");
+  const ledger = dialectId === DATABASE_DIALECT_IDS.postgresql ? { appliedAt: "BIGINT", suffix: "" } : void 0;
+  if (!ledger) {
+    throw new DatabaseError(
+      "UNSUPPORTED_CAPABILITY",
+      `The well-known dialect SQL helper does not support dialect "${dialectId}".`
+    );
+  }
+  return Object.freeze({
+    placeholder: (position) => databasePlaceholder(dialectId, position),
+    migrationLedgerDdl: (table) => {
+      assertSchemaName(table);
+      return `CREATE TABLE IF NOT EXISTS ${table} (
+	namespace TEXT NOT NULL,
+	id TEXT NOT NULL,
+	dialect TEXT NOT NULL,
+	checksum TEXT NOT NULL,
+	applied_at ${ledger.appliedAt} NOT NULL,
+	PRIMARY KEY (namespace, id)
+)${ledger.suffix};
+-- Default application grants must never make the checksum ledger writable.
+-- Revoke existing grants as well, so databases created before this rule heal.
+DO $ledger_privileges$
+DECLARE
+	granted_role RECORD;
+BEGIN
+	FOR granted_role IN
+		SELECT DISTINCT acl.grantee, roles.rolname
+		FROM pg_class AS relation
+		CROSS JOIN LATERAL aclexplode(relation.relacl) AS acl
+		LEFT JOIN pg_roles AS roles ON roles.oid = acl.grantee
+		WHERE relation.oid = '${table}'::regclass
+		  AND acl.grantee <> relation.relowner
+	LOOP
+		EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %s FROM %s',
+			'${table}'::regclass,
+			CASE WHEN granted_role.grantee = 0 THEN 'PUBLIC'
+				ELSE quote_ident(granted_role.rolname) END);
+	END LOOP;
+END
+$ledger_privileges$;`;
+    }
+  });
+}
+
+// ../database/src/postgresql.ts
+var CAPABILITIES = Object.freeze({
+  features: Object.freeze([
+    DATABASE_CAPABILITY_IDS.MIGRATION_LOCK,
+    DATABASE_CAPABILITY_IDS.RETURNING,
+    DATABASE_CAPABILITY_IDS.ROW_LEVEL_SECURITY,
+    DATABASE_CAPABILITY_IDS.SCHEMA_INTROSPECTION,
+    DATABASE_CAPABILITY_IDS.TENANT_CONTEXT,
+    DATABASE_CAPABILITY_IDS.TRANSACTIONAL_DDL,
+    DATABASE_CAPABILITY_IDS.TRANSACTIONS
+  ]),
+  parameterStyle: "numbered",
+  migrationLock: "advisory-transaction",
+  transactionalDdl: true,
+  returning: true,
+  isolationLevels: [
+    "read-committed",
+    "repeatable-read",
+    "serializable"
+  ],
+  cancellation: "before-start",
+  schemaIntrospection: true,
+  tenantIsolation: "transaction-local-rls",
+  rootOperations: "allowed",
+  sql: databaseDialectSql(DATABASE_DIALECT_IDS.postgresql)
+});
+
+// ../database/src/provider.ts
+var PGLITE_RUNTIME_ROLE = "flowdular_runtime";
+var PGLITE_BACKGROUND_ROLE = "flowdular_background";
+var PGLITE_BOOTSTRAP = `DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${PGLITE_RUNTIME_ROLE}') THEN
+    CREATE ROLE ${PGLITE_RUNTIME_ROLE} NOSUPERUSER NOBYPASSRLS;
+  END IF;
+END
+$$;
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${PGLITE_BACKGROUND_ROLE}') THEN
+    CREATE ROLE ${PGLITE_BACKGROUND_ROLE} NOSUPERUSER NOBYPASSRLS;
+  END IF;
+END
+$$;
+GRANT USAGE ON SCHEMA public TO ${PGLITE_RUNTIME_ROLE}, ${PGLITE_BACKGROUND_ROLE};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${PGLITE_RUNTIME_ROLE};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+  GRANT USAGE, SELECT ON SEQUENCES TO ${PGLITE_RUNTIME_ROLE};
+/* The background role gets no default table grant. A table it may poll across
+   tenants says so itself, in its own migration, by granting the named columns
+   under a FOR SELECT policy. Anything that forgets to is invisible to it. */
+`;
+
+// ../database/src/backup.ts
+var BACKUP_KEY_VARIABLES = Object.freeze([
+  "FD_AGENT_CREDENTIAL_KEY",
+  "FD_AGENT_RUN_GRANT_KEY",
+  "FD_APPROVAL_GRANT_KEY",
+  "FD_WORKFLOWS_PAYLOAD_KEY",
+  "FD_WORKFLOWS_CURSOR_KEY",
+  "FD_AUTH_MFA_KEY",
+  "FD_AUTOMATIONS_CREDENTIAL_KEY",
+  "FD_NOTIFICATIONS_SECRET_KEY",
+  "FD_STORAGE_ENCRYPTION_KEY",
+  "FD_CONNECTORS_SECRET_KEY",
+  "FD_AUDIT_ANCHOR_KEY"
+]);
+
+// ../database/src/reset.ts
+var TABLE_QUERY = Object.freeze({
+  [DATABASE_DIALECT_IDS.postgresql]: `SELECT tablename AS name FROM pg_tables
+	       WHERE schemaname = current_schema()
+	       ORDER BY tablename`
+});
+
 // src/dom-properties.ts
 var DOM_PROPERTY_SPELLINGS = [
   "acceptCharset",
@@ -2493,6 +2644,7 @@ var DOM_PROPERTY_SPELLINGS = [
   "disablePictureInPicture",
   "disableRemotePlayback",
   "encType",
+  "enterKeyHint",
   "fetchPriority",
   "formAction",
   "formEncType",
@@ -2509,6 +2661,7 @@ var DOM_PROPERTY_SPELLINGS = [
   "itemScope",
   "itemType",
   "maxLength",
+  "minLength",
   "noModule",
   "noValidate",
   "playsInline",
@@ -2524,426 +2677,10 @@ var DOM_PROPERTY_SPELLINGS = [
 var SPELLINGS = new Map(
   DOM_PROPERTY_SPELLINGS.map((name) => [name.toLowerCase(), name])
 );
-function hostTagAttributes(source) {
-  const tags = [];
-  for (const match of source.matchAll(/<[a-z][a-z0-9-]*/g)) {
-    const start = match.index + match[0].length;
-    let depth = 0;
-    let quote = "";
-    let text = "";
-    let end = start;
-    for (; end < source.length; end += 1) {
-      const character = source[end];
-      if (quote !== "") {
-        if (character === quote) quote = "";
-        text += " ";
-        continue;
-      }
-      if (depth > 0) {
-        if (character === "{") depth += 1;
-        else if (character === "}") depth -= 1;
-        text += depth === 0 ? character : " ";
-        continue;
-      }
-      if (character === "{") {
-        depth = 1;
-        text += character;
-        continue;
-      }
-      if (character === '"' || character === "'") {
-        quote = character;
-        text += character;
-        continue;
-      }
-      if (character === ">") break;
-      text += character;
-    }
-    tags.push({ start, text });
-  }
-  return tags;
-}
-function domPropertyMisspellings(source) {
-  const found = [];
-  for (const tag of hostTagAttributes(source)) {
-    for (const attribute of tag.text.matchAll(
-      /(?<=\s)([A-Za-z][A-Za-z-]*)=/g
-    )) {
-      const name = attribute[1];
-      const expected = SPELLINGS.get(name.toLowerCase());
-      if (expected === void 0 || expected === name) continue;
-      const index = tag.start + attribute.index;
-      found.push({
-        name,
-        expected,
-        index,
-        line: source.slice(0, index).split("\n").length
-      });
-    }
-  }
-  return found.sort((left, right) => left.index - right.index);
-}
-
-// src/module-validate.ts
-function issue(code, message, path, severity = "error") {
-  return { code, message, path, severity };
-}
-async function exists(path) {
-  try {
-    await access2(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function readJson(path) {
-  return JSON.parse(await readFile7(path, "utf8"));
-}
-async function clientSourceFiles(moduleRoot) {
-  const clientRoot = join5(moduleRoot, "src/client");
-  if (!await exists(clientRoot)) return [];
-  return (await readdir3(clientRoot, {
-    recursive: true,
-    withFileTypes: true
-  })).filter((entry) => entry.isFile() && /\.(?:ts|tsx|tsrx)$/.test(entry.name)).map((entry) => join5(entry.parentPath, entry.name));
-}
-async function platformIssues(moduleRoot, manifest) {
-  const issues = [];
-  let exports = {};
-  let packageName;
-  let packageVersion;
-  try {
-    const pkg = await readJson(join5(moduleRoot, "package.json"));
-    exports = pkg.exports ?? {};
-    packageName = pkg.name;
-    packageVersion = pkg.version;
-  } catch (error) {
-    issues.push(
-      issue(
-        "PACKAGE_MANIFEST_INVALID",
-        `package.json could not be read: ${error instanceof Error ? error.message : String(error)}`,
-        "package.json"
-      )
-    );
-    return issues;
-  }
-  if (packageName !== manifest.package) {
-    issues.push(
-      issue(
-        "PACKAGE_NAME_MISMATCH",
-        `package.json name "${String(packageName)}" differs from module.json package "${manifest.package}".`,
-        "package.json"
-      )
-    );
-  }
-  if (manifest.platformApi === void 0) {
-    issues.push(
-      issue(
-        "PLATFORM_API_MISSING",
-        `module.json declares no platformApi; add "platformApi": "^${PLATFORM_API_VERSION}" so the platform contract the module was built against is checked.`,
-        "module.json"
-      )
-    );
-  }
-  if (packageVersion !== manifest.version) {
-    issues.push(
-      issue(
-        "PACKAGE_VERSION_MISMATCH",
-        `package.json version "${String(packageVersion)}" differs from module.json version "${manifest.version}".`,
-        "package.json"
-      )
-    );
-  }
-  if (manifest.platform?.server === true) {
-    if (!await exists(join5(moduleRoot, "src/platform.ts"))) {
-      issues.push(
-        issue(
-          "PLATFORM_SERVER_ENTRY_MISSING",
-          "platform.server requires src/platform.ts exporting createServerComposition.",
-          "src/platform.ts"
-        )
-      );
-    }
-    if (!("./platform" in exports)) {
-      issues.push(
-        issue(
-          "PLATFORM_EXPORT_MISSING",
-          'platform.server requires a "./platform" entry in package.json exports.',
-          "package.json"
-        )
-      );
-    }
-  }
-  if (manifest.platform?.client === true) {
-    if (!await exists(join5(moduleRoot, "src/client/index.ts"))) {
-      issues.push(
-        issue(
-          "PLATFORM_CLIENT_ENTRY_MISSING",
-          "platform.client requires src/client/index.ts exporting createClientContribution.",
-          "src/client/index.ts"
-        )
-      );
-    }
-    if (!("./client" in exports)) {
-      issues.push(
-        issue(
-          "PLATFORM_CLIENT_EXPORT_MISSING",
-          'platform.client requires a "./client" entry in package.json exports.',
-          "package.json"
-        )
-      );
-    }
-  }
-  return issues;
-}
-async function specIssues(moduleRoot, manifest, specDirectory) {
-  const specPath = join5(specDirectory, "module.yaml");
-  let spec;
-  try {
-    spec = parseYaml3(
-      await readFile7(join5(moduleRoot, specPath), "utf8")
-    );
-  } catch (error) {
-    return [
-      issue(
-        "SPEC_FILE_MISSING",
-        `Module specification could not be read: ${error instanceof Error ? error.message : String(error)}`,
-        specPath,
-        "warning"
-      )
-    ];
-  }
-  const issues = [];
-  if (spec.id !== manifest.id) {
-    issues.push(
-      issue(
-        "SPEC_ID_MISMATCH",
-        `Specification id "${String(spec.id)}" differs from module.json id "${manifest.id}".`,
-        specPath
-      )
-    );
-  }
-  if (String(spec.specVersion) !== manifest.version) {
-    issues.push(
-      issue(
-        "SPEC_VERSION_DRIFT",
-        `module.json version ${manifest.version} differs from specVersion ${String(spec.specVersion)}.`,
-        specPath,
-        "warning"
-      )
-    );
-  }
-  if (Array.isArray(spec.dependencies)) {
-    const declared = spec.dependencies.map((entry) => `${String(entry.id)}@${String(entry.range)}`);
-    const actual = manifest.dependencies.map(
-      (entry) => `${entry.id}@${entry.range}`
-    );
-    const drift = [
-      ...declared.filter((entry) => !actual.includes(entry)),
-      ...actual.filter((entry) => !declared.includes(entry))
-    ];
-    if (drift.length > 0) {
-      issues.push(
-        issue(
-          "SPEC_DEPENDENCY_DRIFT",
-          `Specification dependencies differ from module.json: ${drift.join(", ")}. Run module version bump or align the ranges by hand.`,
-          specPath,
-          "warning"
-        )
-      );
-    }
-  }
-  return issues;
-}
-async function translationIssues(moduleRoot, manifest, projectLocales) {
-  const issues = [];
-  if (projectLocales) {
-    for (const locale of manifest.locales) {
-      if (!projectLocales.includes(locale)) {
-        issues.push(
-          issue(
-            "LOCALE_NOT_IN_PROJECT",
-            `Locale "${locale}" is not listed in flowdular.json locales.`,
-            "module.json",
-            "warning"
-          )
-        );
-      }
-    }
-  }
-  if (!manifest.capabilities.includes("translations")) return issues;
-  const keySets = /* @__PURE__ */ new Map();
-  const referenceBundleKeys = /* @__PURE__ */ new Set();
-  for (const locale of manifest.locales) {
-    const path = `translations/${locale}.json`;
-    if (!await exists(join5(moduleRoot, path))) {
-      issues.push(
-        issue(
-          "TRANSLATION_FILE_MISSING",
-          `Locale "${locale}" has no ${path}.`,
-          path
-        )
-      );
-      continue;
-    }
-    try {
-      const bundle = await readJson(join5(moduleRoot, path));
-      if (!bundle || typeof bundle !== "object" || Array.isArray(bundle)) {
-        throw new Error("Expected a JSON object.");
-      }
-      const strings = bundle;
-      keySets.set(locale, translationKeys(strings));
-      if (keySets.size === 1) {
-        for (const key of Object.keys(strings)) referenceBundleKeys.add(key);
-      }
-      const plurals = pluralFamilyIssues(strings, locale);
-      if (plurals.length > 0) {
-        issues.push(
-          issue(
-            "TRANSLATION_PLURAL_INCOMPLETE",
-            `${path} plural families do not match the ${locale} plural rules: ${plurals.join("; ")}.`,
-            path
-          )
-        );
-      }
-    } catch (error) {
-      issues.push(
-        issue(
-          "TRANSLATION_PARSE_ERROR",
-          `${path} is not a JSON object: ${error instanceof Error ? error.message : String(error)}`,
-          path
-        )
-      );
-    }
-  }
-  const [reference, ...others] = [...keySets.entries()];
-  if (!reference) return issues;
-  for (const [locale, keys] of others) {
-    const missing = reference[1].filter((key) => !keys.includes(key));
-    const extra = keys.filter((key) => !reference[1].includes(key));
-    if (missing.length === 0 && extra.length === 0) continue;
-    const detail = [
-      ...missing.length > 0 ? [`missing ${missing.join(", ")}`] : [],
-      ...extra.length > 0 ? [`extra ${extra.join(", ")}`] : []
-    ].join("; ");
-    issues.push(
-      issue(
-        "TRANSLATION_KEYS_MISMATCH",
-        `translations/${locale}.json keys differ from translations/${reference[0]}.json: ${detail}.`,
-        `translations/${locale}.json`
-      )
-    );
-  }
-  const referenceKeys = /* @__PURE__ */ new Set([...reference[1], ...referenceBundleKeys]);
-  const files = await clientSourceFiles(moduleRoot);
-  if (files.length > 0) {
-    const namespace = manifest.id.split(".")[0] ?? manifest.id;
-    const prefix = namespace + ".";
-    const missing = /* @__PURE__ */ new Map();
-    const pattern = /\bt\s*\(\s*(['"])([a-zA-Z0-9._-]+)\1/g;
-    for (const file of files) {
-      const source = await readFile7(file, "utf8");
-      for (const match of source.matchAll(pattern)) {
-        const fullKey = match[2];
-        if (!fullKey.startsWith(prefix) || fullKey.endsWith(".")) continue;
-        const localKey = fullKey.slice(prefix.length);
-        if (!referenceKeys.has(localKey)) {
-          missing.set(fullKey, relative4(moduleRoot, file));
-        }
-      }
-    }
-    for (const [key, path] of [...missing].sort(
-      ([left], [right]) => left.localeCompare(right)
-    )) {
-      issues.push(
-        issue(
-          "TRANSLATION_KEY_MISSING",
-          `Translation key "${key}" is used by the client but absent from translations/${reference[0]}.json.`,
-          path
-        )
-      );
-    }
-  }
-  return issues;
-}
-function filtersTags(source) {
-  const tags = [];
-  for (const match of source.matchAll(/<Filters\b/g)) {
-    let depth = 0;
-    let end = match.index + match[0].length;
-    for (; end < source.length; end += 1) {
-      const character = source[end];
-      if (character === "{") depth += 1;
-      else if (character === "}") depth -= 1;
-      else if (character === ">" && depth === 0) break;
-    }
-    tags.push(source.slice(match.index, end));
-  }
-  return tags;
-}
-async function userInterfaceIssues(moduleRoot) {
-  const issues = [];
-  for (const file of await clientSourceFiles(moduleRoot)) {
-    const source = await readFile7(file, "utf8");
-    const path = relative4(moduleRoot, file);
-    if (/<table\b/.test(source)) {
-      issues.push(
-        issue(
-          "RAW_TABLE_FORBIDDEN",
-          "Module screens use Table or TableCard from @flowdular/ui instead of raw table markup.",
-          path
-        )
-      );
-    }
-    if (/from\s+['"]@octanejs\/tanstack-table['"]/.test(source)) {
-      issues.push(
-        issue(
-          "TANSTACK_TABLE_DIRECT_IMPORT",
-          "Modules use the shared Table contract from @flowdular/ui; TanStack configuration belongs to the UI package.",
-          path
-        )
-      );
-    }
-    const misspelled = domPropertyMisspellings(source);
-    if (misspelled.length > 0) {
-      issues.push(
-        issue(
-          "DOM_PROPERTY_CASING",
-          "Host elements use Octane's DOM property spelling: " + misspelled.map(
-            (found) => `line ${found.line} ${found.name} as ${found.expected}`
-          ).join(", ") + ".",
-          path
-        )
-      );
-    }
-    if (filtersTags(source).some((tag) => !/\slabel=/.test(tag))) {
-      issues.push(
-        issue(
-          "FILTERS_LABEL_MISSING",
-          'Filters from @flowdular/ui needs a translated label; without one it shows the English word "Filters" in every locale.',
-          path
-        )
-      );
-    }
-  }
-  return issues;
-}
-async function moduleLayoutIssues(moduleRoot, manifest, options = {}) {
-  return [
-    ...await platformIssues(moduleRoot, manifest),
-    ...await specIssues(
-      moduleRoot,
-      manifest,
-      options.specDirectory ?? "spec"
-    ),
-    ...await translationIssues(moduleRoot, manifest, options.projectLocales),
-    ...await userInterfaceIssues(moduleRoot)
-  ];
-}
 
 // src/module-install.ts
 var LOCK = "flowdular.modules.lock.json";
-var TRANSACTION = ".flowdular-module-install";
-async function exists2(path) {
+async function exists(path) {
   try {
     await lstat3(path);
     return true;
@@ -2953,14 +2690,14 @@ async function exists2(path) {
   }
 }
 async function safeParents(workspace, path) {
-  const parts = relative5(
+  const parts = relative4(
     workspace.root,
     resolveInside(workspace.root, path)
   ).split("/");
   let current = workspace.root;
   for (const part of parts) {
-    current = join6(current, part);
-    if (!await exists2(current)) break;
+    current = join5(current, part);
+    if (!await exists(current)) break;
     distributionAssert(
       !(await lstat3(current)).isSymbolicLink(),
       "MODULE_DESTINATION_LINK",
@@ -2985,7 +2722,7 @@ function validateLock(workspace, value) {
     );
     const path = resolveInside(workspace.root, entry.directory);
     distributionAssert(
-      moduleRoots(workspace).some((root) => dirname6(path) === root) && !ids.has(entry.id) && !dirs.has(path.toLowerCase()),
+      moduleRoots(workspace).some((root) => dirname4(path) === root) && !ids.has(entry.id) && !dirs.has(path.toLowerCase()),
       "MODULE_LOCK_INVALID",
       "Duplicate or invalid installed module path."
     );
@@ -3002,17 +2739,17 @@ function validateLock(workspace, value) {
   return lock;
 }
 async function readLock(workspace) {
-  const path = join6(workspace.root, LOCK);
+  const path = join5(workspace.root, LOCK);
   await safeParents(workspace, path);
-  if (!await exists2(path))
+  if (!await exists(path))
     return { lock: { schemaVersion: 1, modules: [] }, raw: null };
-  const raw = await readFile8(path, "utf8");
+  const raw = await readFile7(path, "utf8");
   return { lock: validateLock(workspace, JSON.parse(raw)), raw };
 }
 async function directoryHashes(root) {
   const hashes = /* @__PURE__ */ Object.create(null);
   async function visit(directory, prefix) {
-    for (const entry of await readdir4(directory, { withFileTypes: true })) {
+    for (const entry of await readdir3(directory, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === "dist" || entry.name === ".git")
         continue;
       distributionAssert(
@@ -3022,14 +2759,14 @@ async function directoryHashes(root) {
       );
       const path = prefix + entry.name;
       if (entry.isDirectory())
-        await visit(join6(directory, entry.name), path + "/");
+        await visit(join5(directory, entry.name), path + "/");
       else {
         distributionAssert(
           entry.isFile(),
           "MODULE_LOCAL_CHANGES",
           "Installed module contains a special file."
         );
-        hashes[path] = hashBytes(await readFile8(join6(directory, entry.name)));
+        hashes[path] = hashBytes(await readFile7(join5(directory, entry.name)));
       }
     }
   }
@@ -3043,7 +2780,7 @@ async function assertUnmodified(workspace, entry) {
   const path = resolveInside(workspace.root, entry.directory);
   await safeParents(workspace, path);
   distributionAssert(
-    await exists2(path) && equalHashes(await directoryHashes(path), entry.files),
+    await exists(path) && equalHashes(await directoryHashes(path), entry.files),
     "MODULE_LOCAL_CHANGES",
     `Module ${entry.id} has local changes or is missing. Preserve/merge those changes before updating.`
   );
@@ -3058,8 +2795,8 @@ async function validateInstalledModules(workspace) {
   for (const entry of lock.modules) {
     await assertUnmodified(workspace, entry);
     const manifest = JSON.parse(
-      await readFile8(
-        join6(workspace.root, entry.directory, "module.json"),
+      await readFile7(
+        join5(workspace.root, entry.directory, "module.json"),
         "utf8"
       )
     );
@@ -3071,278 +2808,15 @@ async function validateInstalledModules(workspace) {
   }
   return lock;
 }
-async function rollback(workspace, journal) {
-  const transaction = join6(workspace.root, TRANSACTION);
-  validateLock(workspace, {
-    schemaVersion: 1,
-    modules: journal.entries.map((entry) => entry.installed)
-  });
-  for (const [index, entry] of [...journal.entries.entries()].reverse()) {
-    const destination = resolveInside(
-      workspace.root,
-      entry.installed.directory
-    );
-    await safeParents(workspace, destination);
-    const backup = join6(transaction, `backup-${index}`);
-    const moved = !await exists2(join6(transaction, `stage-${index}`));
-    if (moved && await exists2(destination)) {
-      const hashes = await directoryHashes(destination);
-      if (equalHashes(hashes, entry.installed.files))
-        await rm(destination, { recursive: true });
-      else
-        distributionAssert(
-          entry.previous && equalHashes(hashes, entry.previous.files) && !await exists2(backup),
-          "MODULE_RECOVERY_CONFLICT",
-          `Recovery preserved modified files in ${entry.installed.directory}.`
-        );
-    }
-    if (await exists2(backup)) {
-      distributionAssert(
-        !await exists2(destination),
-        "MODULE_RECOVERY_CONFLICT",
-        "Recovery destination is occupied."
-      );
-      await safeParents(workspace, backup);
-      await rename(backup, destination);
-    }
-  }
-  const lockPath = join6(workspace.root, LOCK);
-  await safeParents(workspace, lockPath);
-  const current = await exists2(lockPath) ? await readFile8(lockPath, "utf8") : null;
-  distributionAssert(
-    current === journal.previous || current === journal.next,
-    "MODULE_RECOVERY_CONFLICT",
-    "Lockfile changed during installation; recovery preserved it."
-  );
-  if (journal.previous === null) await rm(lockPath, { force: true });
-  else await writeFile(lockPath, journal.previous);
-}
-async function installModule(workspace, options) {
-  const transaction = join6(workspace.root, TRANSACTION);
-  await safeParents(workspace, transaction);
-  distributionAssert(
-    !await exists2(transaction),
-    "MODULE_INSTALL_BUSY",
-    "A module installation is active or interrupted. Use module recover after its process exits."
-  );
-  const source = await loadModuleCatalog(options.registry, options.fetcher);
-  const snapshot = await readLock(workspace);
-  const manifests = [];
-  for (const root of moduleRoots(workspace)) await safeParents(workspace, root);
-  const files = await findModuleFiles(workspace);
-  for (const file of files)
-    manifests.push(JSON.parse(await readFile8(file, "utf8")));
-  const id = options.target.split("@")[0];
-  const previous = snapshot.lock.modules.find((entry) => entry.id === id);
-  distributionAssert(
-    previous || !manifests.some((manifest) => manifest.id === id),
-    "MODULE_NOT_MANAGED",
-    `Module ${id} already exists as unmanaged workspace/package source.`
-  );
-  if (options.update) {
-    distributionAssert(
-      previous,
-      "MODULE_NOT_MANAGED",
-      `Module ${id} is not managed by this installer.`
-    );
-    await assertUnmodified(workspace, previous);
-  }
-  const retained = options.update ? manifests.filter((manifest) => manifest.id !== id) : manifests;
-  const releases = resolveModuleReleases(
-    source.catalog,
-    options.target,
-    retained
-  );
-  if (options.update) {
-    const next = releases.find((release) => release.manifest.id === id);
-    distributionAssert(
-      next && compareModuleVersions(next.manifest.version, previous.version) <= 0,
-      "MODULE_DOWNGRADE_FORBIDDEN",
-      "Module downgrades are not supported."
-    );
-  }
-  const registry = createModuleRegistry(
-    [...retained, ...releases.map((release) => release.manifest)].map(
-      (manifest) => ({ manifest })
-    )
-  );
-  void registry;
-  if (!releases.length) {
-    if (previous) await assertUnmodified(workspace, previous);
-    return { applied: false, modules: [], activationRequired: false };
-  }
-  const entries = [];
-  let totalBytes = 0;
-  for (const release of releases) {
-    const bytes = await readRelease(source, release, options.fetcher);
-    totalBytes += bytes.length;
-    distributionAssert(
-      totalBytes <= 96 * 1024 * 1024,
-      "MODULE_INSTALL_LIMIT",
-      "The dependency closure exceeds the installation size limit."
-    );
-    distributionAssert(
-      hashBytes(bytes) === release.sha256,
-      "MODULE_ARTIFACT_DIGEST",
-      `Artifact digest mismatch for ${release.manifest.id}.`
-    );
-    const artifact = validateModuleArtifact(JSON.parse(bytes.toString("utf8")));
-    distributionAssert(
-      JSON.stringify(artifact.manifest) === JSON.stringify(release.manifest),
-      "MODULE_ARTIFACT_IDENTITY",
-      "Catalog and artifact manifest differ."
-    );
-    const old = snapshot.lock.modules.find((entry) => entry.id === release.manifest.id) ?? null;
-    const destination = old ? resolveInside(workspace.root, old.directory) : join6(
-      moduleRoots(workspace)[0],
-      release.manifest.package.replace("@flowdular/module-", "")
-    );
-    await safeParents(workspace, destination);
-    if (old) {
-      distributionAssert(
-        options.update && old.id === id,
-        "MODULE_ALREADY_INSTALLED",
-        `Module ${old.id} is already managed.`
-      );
-      await assertUnmodified(workspace, old);
-    } else
-      distributionAssert(
-        !await exists2(destination),
-        "MODULE_DESTINATION_EXISTS",
-        `Destination exists: ${relative5(workspace.root, destination)}`
-      );
-    const hashes = Object.fromEntries(
-      artifact.files.map((file) => [file.path, file.sha256])
-    );
-    if (old) {
-      for (const [path, hash] of Object.entries(old.files))
-        if (path.startsWith("migrations/"))
-          distributionAssert(
-            hashes[path] === hash,
-            "MODULE_MIGRATION_CHANGED",
-            `Update changes historical migration ${path}.`
-          );
-    }
-    entries.push({
-      release,
-      artifact,
-      previous: old,
-      installed: {
-        id: release.manifest.id,
-        version: release.manifest.version,
-        directory: relative5(workspace.root, destination),
-        artifact: release.artifact,
-        sha256: release.sha256,
-        sourceCommit: release.sourceCommit,
-        files: hashes
-      }
-    });
-  }
-  const nextLock = {
-    schemaVersion: 1,
-    modules: [
-      ...snapshot.lock.modules.filter(
-        (entry) => !entries.some((next) => next.installed.id === entry.id)
-      ),
-      ...entries.map((entry) => entry.installed)
-    ].sort((a, b) => a.id.localeCompare(b.id))
-  };
-  validateLock(workspace, nextLock);
-  if (!options.apply)
-    return {
-      applied: false,
-      modules: entries.map((entry) => entry.installed),
-      activationRequired: true
-    };
-  await mkdir(transaction);
-  const journal = {
-    schemaVersion: 1,
-    pid: process.pid,
-    previous: snapshot.raw,
-    next: JSON.stringify(nextLock, null, "	") + "\n",
-    entries: entries.map((entry) => ({
-      installed: entry.installed,
-      previous: entry.previous
-    }))
-  };
-  let journalWritten = false;
-  try {
-    await writeFile(
-      join6(transaction, "owner.json"),
-      JSON.stringify({ schemaVersion: 1, pid: process.pid })
-    );
-    for (const [index, entry] of entries.entries()) {
-      const stage = join6(transaction, `stage-${index}`);
-      await mkdir(stage);
-      for (const file of entry.artifact.files) {
-        const path = join6(stage, file.path);
-        await mkdir(dirname6(path), { recursive: true });
-        await writeFile(path, Buffer.from(file.content, "base64"), {
-          flag: "wx"
-        });
-      }
-      const issues = await moduleLayoutIssues(stage, entry.artifact.manifest);
-      distributionAssert(
-        !issues.some((issue2) => issue2.severity === "error"),
-        "MODULE_LAYOUT_INVALID",
-        `Invalid module layout: ${issues.map((issue2) => issue2.message).join("; ")}`
-      );
-    }
-    await writeFile(join6(transaction, "journal.tmp"), JSON.stringify(journal));
-    await rename(
-      join6(transaction, "journal.tmp"),
-      join6(transaction, "journal.json")
-    );
-    journalWritten = true;
-    distributionAssert(
-      (await readLock(workspace)).raw === snapshot.raw,
-      "MODULE_CONCURRENT_CHANGE",
-      "Module lock changed during planning."
-    );
-    for (const [index, entry] of entries.entries()) {
-      const destination = resolveInside(
-        workspace.root,
-        entry.installed.directory
-      );
-      await safeParents(workspace, destination);
-      if (entry.previous) {
-        await assertUnmodified(workspace, entry.previous);
-        await rename(destination, join6(transaction, `backup-${index}`));
-      } else
-        distributionAssert(
-          !await exists2(destination),
-          "MODULE_DESTINATION_EXISTS",
-          `Destination appeared during installation: ${entry.installed.directory}`
-        );
-      await mkdir(dirname6(destination), { recursive: true });
-      await rename(join6(transaction, `stage-${index}`), destination);
-    }
-    await writeFile(join6(transaction, "next-lock.json"), journal.next);
-    await rename(
-      join6(transaction, "next-lock.json"),
-      join6(workspace.root, LOCK)
-    );
-  } catch (error) {
-    if (journalWritten) await rollback(workspace, journal);
-    await rm(transaction, { recursive: true });
-    throw error;
-  }
-  await rm(transaction, { recursive: true });
-  return {
-    applied: true,
-    modules: entries.map((entry) => entry.installed),
-    activationRequired: true
-  };
-}
 
 // src/module-sync.ts
 import { spawnSync } from "node:child_process";
-import { access as access3, mkdir as mkdir2, readFile as readFile9, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname7, join as join8 } from "node:path";
+import { access as access2, mkdir as mkdir2, readFile as readFile8, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname5, join as join7 } from "node:path";
 
 // src/format.ts
 import { createRequire as createRequire3 } from "node:module";
-import { join as join7 } from "node:path";
+import { join as join6 } from "node:path";
 import { pathToFileURL } from "node:url";
 var DEFAULT_OPTIONS = {
   useTabs: true,
@@ -3351,7 +2825,7 @@ var DEFAULT_OPTIONS = {
 };
 var TSRX_PLUGIN = "@tsrx/prettier-plugin";
 function resolveFrom(workspaceRoot, specifier) {
-  for (const base of [join7(workspaceRoot, "package.json"), import.meta.url]) {
+  for (const base of [join6(workspaceRoot, "package.json"), import.meta.url]) {
     try {
       return createRequire3(base).resolve(specifier);
     } catch {
@@ -3379,7 +2853,7 @@ async function loadWorkspaceFormatter(workspaceRoot) {
     return null;
   }
   const configured = await prettier.resolveConfig(
-    join7(workspaceRoot, "package.json"),
+    join6(workspaceRoot, "package.json"),
     { editorconfig: false }
   );
   const { plugins: _ignored, ...options } = configured ?? DEFAULT_OPTIONS;
@@ -3468,7 +2942,7 @@ async function loadManifests(workspace) {
   const descriptors = /* @__PURE__ */ new Map();
   for (const file of files) {
     const manifest = JSON.parse(
-      await readFile9(file, "utf8")
+      await readFile8(file, "utf8")
     );
     if (!validators.module(manifest))
       throw new Error(`Invalid module manifest: ${file}`);
@@ -3573,7 +3047,7 @@ async function takeSnapshots(paths) {
   return Promise.all(
     paths.map(async (path) => {
       try {
-        return { path, content: await readFile9(path, "utf8") };
+        return { path, content: await readFile8(path, "utf8") };
       } catch (error) {
         if (error.code === "ENOENT") {
           return { path, content: void 0 };
@@ -3589,7 +3063,7 @@ async function restoreSnapshots(snapshots) {
       await rm2(snapshot.path, { force: true });
       continue;
     }
-    await mkdir2(dirname7(snapshot.path), { recursive: true });
+    await mkdir2(dirname5(snapshot.path), { recursive: true });
     await writeFile2(snapshot.path, snapshot.content);
   }
 }
@@ -3619,7 +3093,7 @@ async function syncPlatformModules(workspace, apply, enabledOverride) {
         content: generateClientComposition(modules, sdk, applicationPath)
       }
     ].map(async (target) => {
-      const absolute = join8(workspace.root, target.path);
+      const absolute = join7(workspace.root, target.path);
       return {
         ...target,
         content: formatter ? await formatter.format(absolute, target.content) : target.content
@@ -3628,15 +3102,15 @@ async function syncPlatformModules(workspace, apply, enabledOverride) {
   );
   const files = [];
   for (const target of targets) {
-    const absolute = join8(workspace.root, target.path);
+    const absolute = join7(workspace.root, target.path);
     let current = "";
     try {
-      current = await readFile9(absolute, "utf8");
+      current = await readFile8(absolute, "utf8");
     } catch {
     }
     const changed = current !== target.content;
     if (apply && changed) {
-      await mkdir2(dirname7(absolute), { recursive: true });
+      await mkdir2(dirname5(absolute), { recursive: true });
       await writeFile2(absolute, target.content);
     }
     files.push({ path: target.path, changed });
@@ -3660,9 +3134,9 @@ async function enableModule(workspace, id, apply) {
   const currentSet = new Set(current);
   const newlyEnabled = enabled.filter((moduleId) => !currentSet.has(moduleId));
   const configChanged = !equalIds(current, enabled);
-  const platformPackagePath = join8(workspace.root, "platform/package.json");
+  const platformPackagePath = join7(workspace.root, "platform/package.json");
   const platformPackage = JSON.parse(
-    await readFile9(platformPackagePath, "utf8")
+    await readFile8(platformPackagePath, "utf8")
   );
   const dependencies = platformPackage.dependencies ?? {};
   const platformDependenciesAdded = modules.map((module) => npmPackage(module.package)).filter((packageName) => !(packageName in dependencies)).sort((left, right) => left.localeCompare(right));
@@ -3679,8 +3153,8 @@ async function enableModule(workspace, id, apply) {
   }
   const linked = async (module) => {
     try {
-      await access3(
-        join8(
+      await access2(
+        join7(
           workspace.root,
           "platform/node_modules",
           npmPackage(module.package)
@@ -3698,16 +3172,16 @@ async function enableModule(workspace, id, apply) {
   if (apply) {
     const snapshots = await takeSnapshots([
       workspace.configPath,
-      join8(workspace.root, "pnpm-lock.yaml"),
+      join7(workspace.root, "pnpm-lock.yaml"),
       platformPackagePath,
       ...Object.values(GENERATED_FILES).map(
-        (path) => join8(workspace.root, path)
+        (path) => join7(workspace.root, path)
       )
     ]);
     try {
       if (configChanged) {
         const config = JSON.parse(
-          await readFile9(workspace.configPath, "utf8")
+          await readFile8(workspace.configPath, "utf8")
         );
         const configModules = config.modules ?? {};
         configModules.enabled = enabled;
@@ -3762,7 +3236,6 @@ ${output}` : ""}`
 export {
   enableModule,
   hashBytes,
-  installModule,
   loadModuleCatalog,
   packModule,
   readModuleSource,