flowdular 0.6.0 → 0.6.2

package/dist/index.js

@@ -1861,7 +1861,7 @@ var EXPRESSIONS = new Map(
 );
 
 // ../contracts/src/index.ts
-var PLATFORM_API_VERSION = "0.2.3";
+var PLATFORM_API_VERSION = "0.2.4";
 
 // src/module-templates.ts
 function packageSuffix(id) {
@@ -4394,6 +4394,14 @@ import * as nodeCrypto2 from "node:crypto";
 import * as nodeCrypto from "node:crypto";
 var KEYRING_KEY_BYTES = 32;
 var KEYRING_MAX_PREVIOUS_KEYS = 8;
+var KeyringError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "KeyringError";
+    this.code = code;
+  }
+};
 function keyFingerprint(key) {
   return nodeCrypto.createHash("sha256").update(key).digest("hex").slice(0, 16);
 }
@@ -4842,17 +4850,27 @@ function createModuleRegistry(input) {
   });
 }
 
+// ../kernel/src/variable-registry.ts
+var VariableResolutionError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "VariableResolutionError";
+  }
+  code;
+};
+
 // src/module-install.ts
 import {
-  lstat as lstat2,
+  lstat,
   mkdir,
-  readFile as readFile6,
+  readFile as readFile4,
   readdir as readdir3,
   rename,
   rm,
   writeFile
 } from "node:fs/promises";
-import { dirname as dirname5, join as join5, relative as relative5 } from "node:path";
+import { dirname as dirname5, join as join4, relative as relative5 } from "node:path";
 
 // src/module-artifact.ts
 import { parse as parseYaml2 } from "yaml";
@@ -5010,167 +5028,156 @@ function validateModuleArtifact(value) {
   return artifact;
 }
 
-// src/sdk.ts
+// ../kernel/src/module-manifests.ts
+import { lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { createRequire } from "node:module";
-import { readFile as readFile3 } from "node:fs/promises";
-import { dirname as dirname3, join as join2 } from "node:path";
-var SDK_VERSION = "0.6.0";
-var LIBRARIES = /* @__PURE__ */ new Set([
-  "ai-provider",
-  "cli-protocol",
-  "client",
-  "contracts",
-  "database",
-  "database-pglite",
-  "database-testing",
-  "dev-console",
-  "harness",
-  "kernel",
-  "server",
-  "storage",
-  "ui"
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join2, relative as relative3, resolve as resolve2 } from "node:path";
+var SDK_INDEX = "@flowdular/sdk/modules.json";
+var SDK_IMPORT = /^@flowdular\/sdk\/modules\/[a-z0-9-]+$/;
+var SDK_INDEX_LIMIT = 256;
+var UNRESOLVED = /* @__PURE__ */ new Set([
+  "MODULE_NOT_FOUND",
+  "ERR_PACKAGE_PATH_NOT_EXPORTED"
 ]);
-var CORE_MODULES = /* @__PURE__ */ new Set([
-  "agents",
-  "auth",
-  "automations",
-  "profile",
-  "sandbox",
-  "system",
-  "users",
-  "workflows"
+var SKIPPED_DIRECTORIES2 = /* @__PURE__ */ new Set([
+  ".git",
+  ".flowdular",
+  ".vercel",
+  "node_modules",
+  "dist"
 ]);
-function sdkSpecifier(name) {
-  const suffix = name.slice("@flowdular/".length);
-  if (!name.startsWith("@flowdular/")) return name;
-  if (LIBRARIES.has(suffix)) return `@flowdular/sdk/${suffix}`;
-  if (suffix.startsWith("module-") && CORE_MODULES.has(suffix.slice(7)))
-    return `@flowdular/sdk/modules/${suffix.slice(7)}`;
-  return name;
+function errorCode(error) {
+  return error.code ?? "";
 }
-function sdkSource(source) {
-  return source.replace(/@flowdular\/[a-z0-9-]+/g, sdkSpecifier);
+function insideRealPath(root, path, shown = path) {
+  const canonicalRoot = realpathSync(root);
+  const canonical2 = realpathSync(path);
+  const fromRoot = relative3(canonicalRoot, canonical2);
+  if (fromRoot.startsWith("..") || isAbsolute2(fromRoot)) {
+    throw new Error(`Path escapes the workspace through a link: ${shown}`);
+  }
+  return canonical2;
 }
-function npmPackage(specifier) {
-  return specifier.startsWith("@") ? specifier.split("/").slice(0, 2).join("/") : specifier.split("/")[0];
+function manifestPackage(path) {
+  try {
+    const manifest2 = JSON.parse(readFileSync(path, "utf8"));
+    return typeof manifest2.package === "string" ? manifest2.package : void 0;
+  } catch {
+    return void 0;
+  }
 }
-async function sdkModules(workspace) {
-  const require2 = createRequire(join2(workspace.root, "platform/package.json"));
+function moduleRootDirectories(workspaceRoot, roots2) {
+  const configured = roots2 ?? ["modules"];
+  if (!Array.isArray(configured) || configured.length === 0 || configured.some(
+    (root) => typeof root !== "string" || !root || root.startsWith(".") || root.includes("\\") || root.split("/").some((part) => part === ".." || !part)
+  )) {
+    throw new Error(
+      "Invalid modules.roots. Use relative workspace directories."
+    );
+  }
+  return configured.map((root) => {
+    const path = resolve2(workspaceRoot, root);
+    if (!relative3(workspaceRoot, path)) {
+      throw new Error("The workspace root cannot be a module root.");
+    }
+    return path;
+  });
+}
+function sdkModuleManifests(workspaceRoot) {
+  const require2 = createRequire(join2(workspaceRoot, "platform/package.json"));
   let indexPath;
   try {
-    indexPath = require2.resolve("@flowdular/sdk/modules.json");
+    indexPath = require2.resolve(SDK_INDEX);
   } catch (error) {
-    if (["MODULE_NOT_FOUND", "ERR_PACKAGE_PATH_NOT_EXPORTED"].includes(
-      error.code ?? ""
-    ))
-      return /* @__PURE__ */ new Map();
+    if (UNRESOLVED.has(errorCode(error))) return /* @__PURE__ */ new Map();
     throw error;
   }
-  const index = JSON.parse(await readFile3(indexPath, "utf8"));
-  if (index.schemaVersion !== 1 || !Array.isArray(index.modules) || index.modules.length > 256)
+  const index = JSON.parse(readFileSync(indexPath, "utf8"));
+  if (index.schemaVersion !== 1 || !Array.isArray(index.modules) || index.modules.length > SDK_INDEX_LIMIT) {
     throw new Error("Invalid SDK module index.");
+  }
+  const sdkRoot = dirname3(indexPath);
   const result2 = /* @__PURE__ */ new Map();
   for (const entry of index.modules) {
-    if (!/^@flowdular\/sdk\/modules\/[a-z0-9-]+$/.test(entry.import))
+    if (typeof entry?.import !== "string" || !SDK_IMPORT.test(entry.import)) {
       throw new Error("Invalid SDK module entrypoint.");
-    const path = await resolveExistingInside(
-      dirname3(indexPath),
-      entry.manifest
-    );
+    }
+    if (typeof entry.manifest !== "string") {
+      throw new Error("Invalid SDK module manifest path.");
+    }
+    const lexical = resolve2(sdkRoot, entry.manifest);
+    const fromRoot = relative3(sdkRoot, lexical);
+    if (fromRoot.startsWith("..") || isAbsolute2(fromRoot)) {
+      throw new Error(`Path escapes the workspace: ${entry.manifest}`);
+    }
+    const path = insideRealPath(sdkRoot, lexical, entry.manifest);
     if (result2.has(path)) throw new Error("Duplicate SDK module path.");
     result2.set(path, entry.import);
   }
   return result2;
 }
-function sdkScaffold(files) {
-  return new Map(
-    [...files].map(([path, source]) => {
-      if (path === "spec/module.yaml" || path === "module.json")
-        return [path, source];
-      if (path !== "package.json") return [path, sdkSource(source)];
-      const pkg = JSON.parse(source);
-      for (const section of [pkg.dependencies, pkg.devDependencies])
-        if (section) {
-          for (const name of Object.keys(section))
-            if (sdkSpecifier(name) !== name) delete section[name];
-        }
-      pkg.dependencies ??= {};
-      pkg.dependencies["@flowdular/sdk"] = SDK_VERSION;
-      return [path, JSON.stringify(pkg, null, "	") + "\n"];
-    })
-  );
-}
-
-// src/module-files.ts
-import { createRequire as createRequire2 } from "node:module";
-import { lstat, readFile as readFile4 } from "node:fs/promises";
-import { join as join3, relative as relative3 } from "node:path";
-function moduleRoots(workspace) {
-  const roots2 = workspace.config.modules?.roots ?? ["modules"];
-  if (!Array.isArray(roots2) || !roots2.length || roots2.some(
-    (root) => typeof root !== "string" || !root || root.startsWith(".") || root.includes("\\") || root.split("/").some((part) => part === ".." || !part)
-  ))
-    throw new Error(
-      "Invalid modules.roots. Use relative workspace directories."
-    );
-  return roots2.map((root) => {
-    const path = resolveInside(workspace.root, root);
-    if (!relative3(workspace.root, path))
-      throw new Error("The workspace root cannot be a module root.");
-    return path;
-  });
-}
-async function findModuleFiles(workspace) {
+function findModuleManifests(workspaceRoot, roots2) {
   const files = /* @__PURE__ */ new Set();
-  for (const root of moduleRoots(workspace)) {
+  for (const root of moduleRootDirectories(workspaceRoot, roots2)) {
     try {
-      await lstat(root);
+      lstatSync(root);
     } catch (error) {
-      if (error.code === "ENOENT") continue;
+      if (errorCode(error) === "ENOENT") continue;
       throw error;
     }
-    await resolveExistingInside(workspace.root, root);
-    for (const file of await findNamedFiles(root, "module.json")) {
-      if (relative3(root, file).split("/").length === 2) files.add(file);
+    insideRealPath(workspaceRoot, root);
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+      if (!entry.isDirectory() || SKIPPED_DIRECTORIES2.has(entry.name)) continue;
+      const path = join2(root, entry.name, "module.json");
+      try {
+        if (!lstatSync(path).isDirectory()) files.add(path);
+      } catch (error) {
+        if (errorCode(error) !== "ENOENT") throw error;
+      }
     }
   }
   const packages = /* @__PURE__ */ new Set();
-  for (const file of files)
-    packages.add(
-      JSON.parse(await readFile4(file, "utf8")).package
-    );
-  for (const file of (await sdkModules(workspace)).keys()) {
-    const manifest2 = JSON.parse(await readFile4(file, "utf8"));
-    if (!packages.has(manifest2.package)) files.add(file);
+  for (const file of files) {
+    const name = manifestPackage(file);
+    if (name) packages.add(name);
+  }
+  for (const file of sdkModuleManifests(workspaceRoot).keys()) {
+    const name = manifestPackage(file);
+    if (!name || !packages.has(name)) files.add(file);
   }
-  const platformPackage = join3(workspace.root, "platform/package.json");
+  const platformPackage = join2(workspaceRoot, "platform/package.json");
+  let dependencies = {};
   try {
-    const pkg = JSON.parse(await readFile4(platformPackage, "utf8"));
-    const require2 = createRequire2(platformPackage);
-    for (const name of Object.keys(pkg.dependencies ?? {}).sort()) {
-      if (!name.startsWith("@flowdular/module-") || packages.has(name))
-        continue;
-      let file;
-      try {
-        file = require2.resolve(name + "/module.json");
-      } catch (error) {
-        if (["MODULE_NOT_FOUND", "ERR_PACKAGE_PATH_NOT_EXPORTED"].includes(
-          error.code ?? ""
-        ))
-          continue;
-        throw error;
-      }
-      files.add(file);
-    }
+    dependencies = JSON.parse(readFileSync(platformPackage, "utf8")).dependencies ?? {};
   } catch (error) {
-    if (error.code !== "ENOENT") throw error;
+    if (errorCode(error) !== "ENOENT") throw error;
+  }
+  const require2 = createRequire(platformPackage);
+  for (const name of Object.keys(dependencies).sort()) {
+    if (!name.startsWith("@flowdular/module-") || packages.has(name)) continue;
+    try {
+      files.add(require2.resolve(`${name}/module.json`));
+    } catch (error) {
+      if (!UNRESOLVED.has(errorCode(error))) throw error;
+    }
   }
   return [...files].sort();
 }
 
+// src/module-files.ts
+function configuredRoots(workspace) {
+  return workspace.config.modules?.roots;
+}
+function moduleRoots(workspace) {
+  return [...moduleRootDirectories(workspace.root, configuredRoots(workspace))];
+}
+async function findModuleFiles(workspace) {
+  return [...findModuleManifests(workspace.root, configuredRoots(workspace))];
+}
+
 // src/module-validate.ts
-import { access as access2, readFile as readFile5, readdir as readdir2 } from "node:fs/promises";
-import { dirname as dirname4, join as join4, relative as relative4 } from "node:path";
+import { access as access2, readFile as readFile3, readdir as readdir2 } from "node:fs/promises";
+import { dirname as dirname4, join as join3, relative as relative4 } from "node:path";
 import { parse as parseYaml3 } from "yaml";
 
 // ../cli-protocol/src/index.ts
@@ -5887,8 +5894,8 @@ function migrationIdentifierIssues(sql) {
 }
 
 // ../kernel/src/runtime-config.ts
-import { lstatSync } from "node:fs";
-import { resolve as resolve2 } from "node:path";
+import { lstatSync as lstatSync2 } from "node:fs";
+import { resolve as resolve3 } from "node:path";
 var UnsafeLocalStatePathError = class extends Error {
   code = "UNSAFE_LOCAL_STATE_PATH";
   constructor(path, expected) {
@@ -5897,9 +5904,9 @@ var UnsafeLocalStatePathError = class extends Error {
   }
 };
 function flowdularStateDirectory(workspaceRoot) {
-  const directory = resolve2(workspaceRoot, ".flowdular");
+  const directory = resolve3(workspaceRoot, ".flowdular");
   try {
-    const info = lstatSync(directory);
+    const info = lstatSync2(directory);
     if (info.isSymbolicLink() || !info.isDirectory()) {
       throw new UnsafeLocalStatePathError(directory, "directory");
     }
@@ -5910,8 +5917,8 @@ function flowdularStateDirectory(workspaceRoot) {
 }
 
 // ../database/src/provider.ts
-import { readFileSync } from "node:fs";
-import { resolve as resolve3 } from "node:path";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
 
 // ../database/src/postgresql.ts
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -6409,7 +6416,7 @@ function postgresTlsAuthority(environment) {
   if (!path) return inline || void 0;
   let contents;
   try {
-    contents = readFileSync(path, "utf8");
+    contents = readFileSync2(path, "utf8");
   } catch (error) {
     throw new Error(
       `FD_DATABASE_TLS_CA_FILE could not be read: ${error instanceof Error ? error.message : String(error)}`
@@ -6433,7 +6440,7 @@ function databaseProviderConfigFromEnvironment(environment = process.env, worksp
       workspaceRoot,
       environment,
       pglite: {
-        dataDirectory: environment.NODE_ENV === "test" ? void 0 : configured ?? resolve3(
+        dataDirectory: environment.NODE_ENV === "test" ? void 0 : configured ?? resolve4(
           flowdularStateDirectory(workspaceRoot),
           "data",
           "pglite"
@@ -6546,11 +6553,28 @@ function databaseProviderConfigFromEnvironment(environment = process.env, worksp
     }
   };
 }
+function reportIdleConnectionError(error) {
+  const code = error.code;
+  console.warn(
+    `An idle pooled PostgreSQL connection failed (${typeof code === "string" ? `${code}: ` : ""}${error.message}). The pool discards it and the next query opens a new one.`
+  );
+}
+function ignoreLeasedClientError() {
+}
 function postgresDriverPool(pool) {
+  const guardedClients = /* @__PURE__ */ new WeakSet();
+  const guard = (client) => {
+    if (!client.on || guardedClients.has(client)) return;
+    guardedClients.add(client);
+    client.on("error", ignoreLeasedClientError);
+  };
+  pool.on?.("error", reportIdleConnectionError);
+  pool.on?.("connect", guard);
   return {
     cancellation: "before-start",
     async connect() {
       const client = await pool.connect();
+      guard(client);
       return {
         async query({ text, values: values2 }) {
           const result2 = await client.query({
@@ -7038,15 +7062,15 @@ async function exists(path) {
   }
 }
 async function readJson(path) {
-  return JSON.parse(await readFile5(path, "utf8"));
+  return JSON.parse(await readFile3(path, "utf8"));
 }
 async function clientSourceFiles(moduleRoot) {
-  const clientRoot = join4(moduleRoot, "src/client");
+  const clientRoot = join3(moduleRoot, "src/client");
   if (!await exists(clientRoot)) return [];
   return (await readdir2(clientRoot, {
     recursive: true,
     withFileTypes: true
-  })).filter((entry) => entry.isFile() && /\.(?:ts|tsx|tsrx)$/.test(entry.name)).map((entry) => join4(entry.parentPath, entry.name));
+  })).filter((entry) => entry.isFile() && /\.(?:ts|tsx|tsrx)$/.test(entry.name)).map((entry) => join3(entry.parentPath, entry.name));
 }
 async function platformIssues(moduleRoot, manifest2) {
   const issues = [];
@@ -7054,7 +7078,7 @@ async function platformIssues(moduleRoot, manifest2) {
   let packageName;
   let packageVersion;
   try {
-    const pkg = await readJson(join4(moduleRoot, "package.json"));
+    const pkg = await readJson(join3(moduleRoot, "package.json"));
     exports = pkg.exports ?? {};
     packageName = pkg.name;
     packageVersion = pkg.version;
@@ -7096,7 +7120,7 @@ async function platformIssues(moduleRoot, manifest2) {
     );
   }
   if (manifest2.platform?.server === true) {
-    if (!await exists(join4(moduleRoot, "src/platform.ts"))) {
+    if (!await exists(join3(moduleRoot, "src/platform.ts"))) {
       issues.push(
         issue(
           "PLATFORM_SERVER_ENTRY_MISSING",
@@ -7116,7 +7140,7 @@ async function platformIssues(moduleRoot, manifest2) {
     }
   }
   if (manifest2.platform?.client === true) {
-    if (!await exists(join4(moduleRoot, "src/client/index.ts"))) {
+    if (!await exists(join3(moduleRoot, "src/client/index.ts"))) {
       issues.push(
         issue(
           "PLATFORM_CLIENT_ENTRY_MISSING",
@@ -7138,11 +7162,11 @@ async function platformIssues(moduleRoot, manifest2) {
   return issues;
 }
 async function specIssues(moduleRoot, manifest2, specDirectory2) {
-  const specPath = join4(specDirectory2, "module.yaml");
+  const specPath = join3(specDirectory2, "module.yaml");
   let spec;
   try {
     spec = parseYaml3(
-      await readFile5(join4(moduleRoot, specPath), "utf8")
+      await readFile3(join3(moduleRoot, specPath), "utf8")
     );
   } catch (error) {
     return [
@@ -7217,7 +7241,7 @@ async function translationIssues(moduleRoot, manifest2, projectLocales) {
   const referenceBundleKeys = /* @__PURE__ */ new Set();
   for (const locale of manifest2.locales) {
     const path = `translations/${locale}.json`;
-    if (!await exists(join4(moduleRoot, path))) {
+    if (!await exists(join3(moduleRoot, path))) {
       issues.push(
         issue(
           "TRANSLATION_FILE_MISSING",
@@ -7228,7 +7252,7 @@ async function translationIssues(moduleRoot, manifest2, projectLocales) {
       continue;
     }
     try {
-      const bundle = await readJson(join4(moduleRoot, path));
+      const bundle = await readJson(join3(moduleRoot, path));
       if (!bundle || typeof bundle !== "object" || Array.isArray(bundle)) {
         throw new Error("Expected a JSON object.");
       }
@@ -7283,7 +7307,7 @@ async function translationIssues(moduleRoot, manifest2, projectLocales) {
     const missing = /* @__PURE__ */ new Map();
     const pattern = /\bt\s*\(\s*(['"])([a-zA-Z0-9._-]+)\1/g;
     for (const file of files) {
-      const source = await readFile5(file, "utf8");
+      const source = await readFile3(file, "utf8");
       for (const match of source.matchAll(pattern)) {
         const fullKey = match[2];
         if (!fullKey.startsWith(prefix) || fullKey.endsWith(".")) continue;
@@ -7325,7 +7349,7 @@ function filtersTags(source) {
 async function userInterfaceIssues(moduleRoot) {
   const issues = [];
   for (const file of await clientSourceFiles(moduleRoot)) {
-    const source = await readFile5(file, "utf8");
+    const source = await readFile3(file, "utf8");
     const path = relative4(moduleRoot, file);
     if (/<table\b/.test(source)) {
       issues.push(
@@ -7370,11 +7394,11 @@ async function userInterfaceIssues(moduleRoot) {
   return issues;
 }
 async function migrationIssues(moduleRoot) {
-  const directory = join4(moduleRoot, "migrations");
+  const directory = join3(moduleRoot, "migrations");
   if (!await exists(directory)) return [];
   const issues = [];
   for (const name of (await readdir2(directory)).filter((entry) => entry.endsWith(".up.sql")).sort()) {
-    const sql = await readFile5(join4(directory, name), "utf8");
+    const sql = await readFile3(join3(directory, name), "utf8");
     for (const found of migrationIdentifierIssues(sql))
       issues.push(issue(found.code, found.message, `migrations/${name}`));
   }
@@ -7479,7 +7503,7 @@ var LOCK = "flowdular.modules.lock.json";
 var TRANSACTION = ".flowdular-module-install";
 async function exists2(path) {
   try {
-    await lstat2(path);
+    await lstat(path);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -7493,10 +7517,10 @@ async function safeParents(workspace, path) {
   ).split("/");
   let current = workspace.root;
   for (const part of parts) {
-    current = join5(current, part);
+    current = join4(current, part);
     if (!await exists2(current)) break;
     distributionAssert(
-      !(await lstat2(current)).isSymbolicLink(),
+      !(await lstat(current)).isSymbolicLink(),
       "MODULE_DESTINATION_LINK",
       "Module installation paths cannot contain links."
     );
@@ -7536,11 +7560,11 @@ function validateLock(workspace, value) {
   return lock;
 }
 async function readLock(workspace) {
-  const path = join5(workspace.root, LOCK);
+  const path = join4(workspace.root, LOCK);
   await safeParents(workspace, path);
   if (!await exists2(path))
     return { lock: { schemaVersion: 1, modules: [] }, raw: null };
-  const raw = await readFile6(path, "utf8");
+  const raw = await readFile4(path, "utf8");
   return { lock: validateLock(workspace, JSON.parse(raw)), raw };
 }
 async function directoryHashes(root) {
@@ -7556,14 +7580,14 @@ async function directoryHashes(root) {
       );
       const path = prefix + entry.name;
       if (entry.isDirectory())
-        await visit(join5(directory, entry.name), path + "/");
+        await visit(join4(directory, entry.name), path + "/");
       else {
         distributionAssert(
           entry.isFile(),
           "MODULE_LOCAL_CHANGES",
           "Installed module contains a special file."
         );
-        hashes[path] = hashBytes(await readFile6(join5(directory, entry.name)));
+        hashes[path] = hashBytes(await readFile4(join4(directory, entry.name)));
       }
     }
   }
@@ -7592,8 +7616,8 @@ async function validateInstalledModules(workspace) {
   for (const entry of lock.modules) {
     await assertUnmodified(workspace, entry);
     const manifest2 = JSON.parse(
-      await readFile6(
-        join5(workspace.root, entry.directory, "module.json"),
+      await readFile4(
+        join4(workspace.root, entry.directory, "module.json"),
         "utf8"
       )
     );
@@ -7606,7 +7630,7 @@ async function validateInstalledModules(workspace) {
   return lock;
 }
 async function rollback(workspace, journal) {
-  const transaction = join5(workspace.root, TRANSACTION);
+  const transaction = join4(workspace.root, TRANSACTION);
   validateLock(workspace, {
     schemaVersion: 1,
     modules: journal.entries.map((entry) => entry.installed)
@@ -7617,8 +7641,8 @@ async function rollback(workspace, journal) {
       entry.installed.directory
     );
     await safeParents(workspace, destination);
-    const backup = join5(transaction, `backup-${index}`);
-    const moved = !await exists2(join5(transaction, `stage-${index}`));
+    const backup = join4(transaction, `backup-${index}`);
+    const moved = !await exists2(join4(transaction, `stage-${index}`));
     if (moved && await exists2(destination)) {
       const hashes = await directoryHashes(destination);
       if (equalHashes(hashes, entry.installed.files))
@@ -7640,9 +7664,9 @@ async function rollback(workspace, journal) {
       await rename(backup, destination);
     }
   }
-  const lockPath = join5(workspace.root, LOCK);
+  const lockPath = join4(workspace.root, LOCK);
   await safeParents(workspace, lockPath);
-  const current = await exists2(lockPath) ? await readFile6(lockPath, "utf8") : null;
+  const current = await exists2(lockPath) ? await readFile4(lockPath, "utf8") : null;
   distributionAssert(
     current === journal.previous || current === journal.next,
     "MODULE_RECOVERY_CONFLICT",
@@ -7652,13 +7676,13 @@ async function rollback(workspace, journal) {
   else await writeFile(lockPath, journal.previous);
 }
 async function recoverModuleInstall(workspace, apply) {
-  const transaction = join5(workspace.root, TRANSACTION);
+  const transaction = join4(workspace.root, TRANSACTION);
   await safeParents(workspace, transaction);
   if (!await exists2(transaction)) return { recovered: false, pending: false };
-  const hasJournal = await exists2(join5(transaction, "journal.json"));
+  const hasJournal = await exists2(join4(transaction, "journal.json"));
   const journal = JSON.parse(
-    await readFile6(
-      join5(transaction, hasJournal ? "journal.json" : "owner.json"),
+    await readFile4(
+      join4(transaction, hasJournal ? "journal.json" : "owner.json"),
       "utf8"
     )
   );
@@ -7684,7 +7708,7 @@ async function recoverModuleInstall(workspace, apply) {
   return { recovered: true, pending: false };
 }
 async function installPlannedModule(workspace, options) {
-  const transaction = join5(workspace.root, TRANSACTION);
+  const transaction = join4(workspace.root, TRANSACTION);
   await safeParents(workspace, transaction);
   distributionAssert(
     !await exists2(transaction),
@@ -7701,7 +7725,7 @@ async function installPlannedModule(workspace, options) {
   for (const root of moduleRoots(workspace)) await safeParents(workspace, root);
   const files = await findModuleFiles(workspace);
   for (const file of files)
-    manifests.push(JSON.parse(await readFile6(file, "utf8")));
+    manifests.push(JSON.parse(await readFile4(file, "utf8")));
   const id = options.target.split("@")[0];
   const previous = snapshot.lock.modules.find((entry) => entry.id === id);
   distributionAssert(
@@ -7764,7 +7788,7 @@ async function installPlannedModule(workspace, options) {
       "Catalog and artifact manifest differ."
     );
     const old = snapshot.lock.modules.find((entry) => entry.id === release.manifest.id) ?? null;
-    const destination = old ? resolveInside(workspace.root, old.directory) : join5(
+    const destination = old ? resolveInside(workspace.root, old.directory) : join4(
       moduleRoots(workspace)[0],
       release.manifest.package.replace("@flowdular/module-", "")
     );
@@ -7839,14 +7863,14 @@ async function installPlannedModule(workspace, options) {
   let journalWritten = false;
   try {
     await writeFile(
-      join5(transaction, "owner.json"),
+      join4(transaction, "owner.json"),
       JSON.stringify({ schemaVersion: 1, pid: process.pid })
     );
     for (const [index, entry] of entries.entries()) {
-      const stage = join5(transaction, `stage-${index}`);
+      const stage = join4(transaction, `stage-${index}`);
       await mkdir(stage);
       for (const file of entry.artifact.files) {
-        const path = join5(stage, file.path);
+        const path = join4(stage, file.path);
         await mkdir(dirname5(path), { recursive: true });
         await writeFile(path, Buffer.from(file.content, "base64"), {
           flag: "wx"
@@ -7859,10 +7883,10 @@ async function installPlannedModule(workspace, options) {
         `Invalid module layout: ${issues.map((issue2) => issue2.message).join("; ")}`
       );
     }
-    await writeFile(join5(transaction, "journal.tmp"), JSON.stringify(journal));
+    await writeFile(join4(transaction, "journal.tmp"), JSON.stringify(journal));
     await rename(
-      join5(transaction, "journal.tmp"),
-      join5(transaction, "journal.json")
+      join4(transaction, "journal.tmp"),
+      join4(transaction, "journal.json")
     );
     journalWritten = true;
     distributionAssert(
@@ -7878,7 +7902,7 @@ async function installPlannedModule(workspace, options) {
       await safeParents(workspace, destination);
       if (entry.previous) {
         await assertUnmodified(workspace, entry.previous);
-        await rename(destination, join5(transaction, `backup-${index}`));
+        await rename(destination, join4(transaction, `backup-${index}`));
       } else
         distributionAssert(
           !await exists2(destination),
@@ -7886,43 +7910,325 @@ async function installPlannedModule(workspace, options) {
           `Destination appeared during installation: ${entry.installed.directory}`
         );
       await mkdir(dirname5(destination), { recursive: true });
-      await rename(join5(transaction, `stage-${index}`), destination);
+      await rename(join4(transaction, `stage-${index}`), destination);
     }
-    await writeFile(join5(transaction, "next-lock.json"), journal.next);
+    await writeFile(join4(transaction, "next-lock.json"), journal.next);
     await rename(
-      join5(transaction, "next-lock.json"),
-      join5(workspace.root, LOCK)
+      join4(transaction, "next-lock.json"),
+      join4(workspace.root, LOCK)
+    );
+  } catch (error) {
+    if (journalWritten) await rollback(workspace, journal);
+    await rm(transaction, { recursive: true });
+    throw error;
+  }
+  await rm(transaction, { recursive: true });
+  return {
+    applied: true,
+    modules: entries.map((entry) => entry.installed),
+    activationRequired: true
+  };
+}
+
+// ../database-pglite/src/driver.ts
+import { PGlite } from "@electric-sql/pglite";
+import { mkdir as mkdir2, readFile as readFile5, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join5, resolve as resolve5 } from "node:path";
+var ROLE = /^[a-z_][a-z0-9_]{0,62}$/;
+var LOCK_FILE = "flowdular.lock";
+var LocalDatabaseLockedError = class extends Error {
+  constructor(directory, pid) {
+    super(
+      `The local database in ${directory} is already open in process ${pid}. Stop that Flowdular first, or point this one at another directory with FD_DATABASE_PGLITE_DIRECTORY.`
+    );
+    this.directory = directory;
+    this.pid = pid;
+    this.name = "LocalDatabaseLockedError";
+  }
+  directory;
+  pid;
+  code = "LOCAL_DATABASE_LOCKED";
+};
+var LocalDatabaseUnreadableError = class extends Error {
+  constructor(directory, cause) {
+    super(
+      `The local database in ${directory} could not be opened. A process killed mid write leaves it this way. Restore a backup of that directory, recreate the workspace with "pnpm flowdular setup quick --apply --confirm reset-local-auth", or point somewhere else with FD_DATABASE_PGLITE_DIRECTORY.`,
+      { cause }
+    );
+    this.directory = directory;
+    this.name = "LocalDatabaseUnreadableError";
+  }
+  directory;
+  code = "LOCAL_DATABASE_UNREADABLE";
+};
+function running(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+async function claimDirectory(directory) {
+  const path = join5(directory, LOCK_FILE);
+  let held;
+  try {
+    held = await readFile5(path, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const pid = Number(held?.split("\n")[0]);
+  if (Number.isInteger(pid) && pid > 0 && pid !== process.pid && running(pid)) {
+    throw new LocalDatabaseLockedError(directory, pid);
+  }
+  await writeFile2(path, `${process.pid}
+${(/* @__PURE__ */ new Date()).toISOString()}
+`, {
+    mode: 384
+  });
+}
+async function releaseDirectory(directory) {
+  const path = join5(directory, LOCK_FILE);
+  try {
+    const held = await readFile5(path, "utf8");
+    if (Number(held.split("\n")[0]) !== process.pid) return;
+    await rm2(path, { force: true });
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR" || code === "EACCES") return;
+    throw error;
+  }
+}
+var INT8_OID = 20;
+var SERVER_PARSERS = Object.freeze({ [INT8_OID]: (value) => value });
+var ConnectionQueue = class {
+  #tail = Promise.resolve();
+  acquire() {
+    let release;
+    const held = new Promise((resolve11) => {
+      release = resolve11;
+    });
+    const waited = this.#tail.then(() => release);
+    this.#tail = this.#tail.then(() => held);
+    return waited;
+  }
+};
+function result(rows, affected) {
+  return {
+    rows,
+    rowCount: rows.length > 0 ? rows.length : affected
+  };
+}
+async function openDatabase(directory, bootstrap) {
+  if (directory) {
+    await mkdir2(directory, { recursive: true, mode: 448 });
+    await claimDirectory(directory);
+  }
+  let created;
+  try {
+    created = directory ? await PGlite.create({
+      dataDir: directory,
+      parsers: SERVER_PARSERS
+    }) : await PGlite.create({ parsers: SERVER_PARSERS });
+  } catch (error) {
+    if (!directory) throw error;
+    await releaseDirectory(directory);
+    throw new LocalDatabaseUnreadableError(directory, error);
+  }
+  try {
+    if (bootstrap) await created.exec(bootstrap);
+  } catch (error) {
+    try {
+      await created.close();
+    } catch (closeError) {
+      throw new AggregateError(
+        [error, closeError],
+        "PGlite bootstrap failed and cleanup also failed."
+      );
+    }
+    throw error;
+  }
+  return created;
+}
+var OPEN_DIRECTORIES = /* @__PURE__ */ Symbol.for("flowdular.database-pglite.directories");
+function openDirectories() {
+  const host = globalThis;
+  host[OPEN_DIRECTORIES] ??= { open: /* @__PURE__ */ new Map(), closing: /* @__PURE__ */ new Map() };
+  return host[OPEN_DIRECTORIES];
+}
+function attachDatabase(directory, bootstrap) {
+  if (!directory) {
+    return {
+      queue: new ConnectionQueue(),
+      instance: openDatabase(void 0, bootstrap),
+      holders: 1
+    };
+  }
+  const key = resolve5(directory);
+  const directories = openDirectories();
+  let database = directories.open.get(key);
+  if (!database) {
+    const previousClose = directories.closing.get(key) ?? Promise.resolve();
+    const opening = {
+      queue: new ConnectionQueue(),
+      instance: previousClose.then(() => openDatabase(directory, bootstrap)),
+      holders: 0
+    };
+    opening.instance.catch(() => {
+      if (directories.open.get(key) === opening) directories.open.delete(key);
+    });
+    directories.open.set(key, opening);
+    database = opening;
+  }
+  database.holders += 1;
+  return database;
+}
+async function detachDatabase(directory, database) {
+  database.holders -= 1;
+  if (database.holders > 0) return;
+  const directories = openDirectories();
+  const key = directory ? resolve5(directory) : void 0;
+  const current = key ? directories.open.get(key) : void 0;
+  if (key && current === database) directories.open.delete(key);
+  const ownsDirectory = directory !== void 0 && (current === void 0 || current === database);
+  const closed = (async () => {
+    const instance = await database.instance.catch(() => void 0);
+    await instance?.close();
+    if (ownsDirectory) await releaseDirectory(directory);
+  })();
+  if (key && ownsDirectory) {
+    const settled = closed.catch(() => void 0);
+    directories.closing.set(key, settled);
+    void settled.then(() => {
+      if (directories.closing.get(key) === settled)
+        directories.closing.delete(key);
+    });
+  }
+  await closed;
+}
+function createPgliteCluster(options = {}) {
+  let database;
+  let closing;
+  let issued = 0;
+  let ended = 0;
+  const close = () => {
+    const attached = database;
+    if (!attached) return closing ?? Promise.resolve();
+    database = void 0;
+    closing = detachDatabase(options.dataDirectory, attached);
+    return closing;
+  };
+  const pool = (role) => {
+    if (role !== void 0 && !ROLE.test(role)) {
+      throw new Error(`"${role}" is not a usable PostgreSQL role name.`);
+    }
+    issued += 1;
+    return {
+      cancellation: "before-start",
+      async connect() {
+        database ??= attachDatabase(options.dataDirectory, options.bootstrap);
+        const attached = database;
+        const release = await attached.queue.acquire();
+        let instance;
+        try {
+          instance = await attached.instance;
+          if (role) await instance.exec(`SET ROLE ${role}`);
+        } catch (error) {
+          release();
+          throw error;
+        }
+        let released = false;
+        const run = async ({
+          text,
+          values: values2
+        }) => {
+          if (values2 === void 0 || values2.length === 0) {
+            const answers = await instance.exec(text);
+            const last = answers[answers.length - 1];
+            return last ? result(last.rows, last.affectedRows ?? 0) : result([], 0);
+          }
+          const answer = await instance.query(text, [...values2]);
+          return result(answer.rows, answer.affectedRows ?? 0);
+        };
+        return {
+          query: run,
+          release() {
+            if (released) return;
+            released = true;
+            const reset = role ? instance.exec("RESET ROLE").catch(() => void 0) : Promise.resolve();
+            void reset.finally(release);
+          }
+        };
+      },
+      async end() {
+        ended += 1;
+        if (ended < issued) return;
+        await close();
+      }
+    };
+  };
+  return { pool, close };
+}
+
+// ../kernel/src/legacy-local-state.ts
+var LEGACY_DATA_DIRECTORY = ".octane-erp";
+var LegacyLocalStateError = class extends Error {
+  constructor(fileName) {
+    super(
+      `Legacy local state exists for ${fileName}. Stop Flowdular and run "flowdular setup migrate-state" before starting it again.`
     );
-  } catch (error) {
-    if (journalWritten) await rollback(workspace, journal);
-    await rm(transaction, { recursive: true });
-    throw error;
+    this.fileName = fileName;
+    this.name = "LegacyLocalStateError";
   }
-  await rm(transaction, { recursive: true });
-  return {
-    applied: true,
-    modules: entries.map((entry) => entry.installed),
-    activationRequired: true
-  };
+  fileName;
+  code = "LEGACY_LOCAL_STATE_REQUIRES_MIGRATION";
+};
+
+// src/command-failure.ts
+var STABLE_CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
+var PLATFORM_ERRORS = [
+  ModuleDistributionError,
+  RegistryError,
+  KeyringError,
+  LegacyLocalStateError,
+  UnsafeLocalStatePathError,
+  VariableResolutionError,
+  DatabaseMigrationError,
+  DatabaseError,
+  LocalDatabaseLockedError,
+  LocalDatabaseUnreadableError
+];
+function isModuleRefusal(error) {
+  return typeof error.status === "number";
+}
+function commandFailure(error) {
+  if (!(error instanceof Error))
+    return failure("COMMAND_FAILED", String(error));
+  const code = error.code;
+  const known = PLATFORM_ERRORS.some((type) => error instanceof type) || isModuleRefusal(error);
+  return failure(
+    known && typeof code === "string" && STABLE_CODE.test(code) ? code : "COMMAND_FAILED",
+    error.message
+  );
 }
 
 // src/module-plans.ts
 import {
-  readFile as readFile9,
+  readFile as readFile8,
   readdir as readdir4,
-  mkdir as mkdir3,
+  mkdir as mkdir4,
   rename as rename3,
-  writeFile as writeFile3,
-  rm as rm3,
-  lstat as lstat4
+  writeFile as writeFile4,
+  rm as rm4,
+  lstat as lstat3
 } from "node:fs/promises";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { join as join7, relative as relative6 } from "node:path";
 import { parse as parseYaml4 } from "yaml";
 
 // src/module-catalog.ts
-import { readFile as readFile7, stat } from "node:fs/promises";
-import { dirname as dirname6, resolve as resolve4 } from "node:path";
+import { readFile as readFile6, stat } from "node:fs/promises";
+import { dirname as dirname6, resolve as resolve6 } from "node:path";
 function platformAdmits(manifest2) {
   try {
     assertModuleCompatibility(manifest2);
@@ -7938,7 +8244,7 @@ async function boundedRead(location, limit, fetcher = fetch) {
       "MODULE_DOWNLOAD_LIMIT",
       "Module metadata/artifact exceeds the size limit."
     );
-    const result2 = await readFile7(location);
+    const result2 = await readFile6(location);
     distributionAssert(
       result2.length <= limit,
       "MODULE_DOWNLOAD_LIMIT",
@@ -8030,7 +8336,7 @@ async function releaseLocation(source, release) {
     "An offline catalog must use local artifacts."
   );
   return resolveExistingInside(
-    dirname6(resolve4(source.location)),
+    dirname6(resolve6(source.location)),
     release.artifact
   );
 }
@@ -8141,16 +8447,16 @@ async function readRelease(source, release, fetcher = fetch) {
 import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import {
-  lstat as lstat3,
-  mkdir as mkdir2,
+  lstat as lstat2,
+  mkdir as mkdir3,
   mkdtemp,
-  readFile as readFile8,
+  readFile as readFile7,
   rename as rename2,
-  rm as rm2,
-  writeFile as writeFile2
+  rm as rm3,
+  writeFile as writeFile3
 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute2, join as join6, resolve as resolve5 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join6, resolve as resolve7 } from "node:path";
 import { promisify } from "node:util";
 var exec = promisify(execFile);
 var SOURCES_FILE = "flowdular.module-sources.json";
@@ -8188,13 +8494,13 @@ function validateSource(source) {
 async function readModuleSources(workspace) {
   let raw;
   try {
-    const info = await lstat3(sourcePath(workspace));
+    const info = await lstat2(sourcePath(workspace));
     distributionAssert(
       info.isFile() && !info.isSymbolicLink() && info.size <= 64 * 1024,
       "MODULE_SOURCE_INVALID",
       "Module source list is not a bounded regular file."
     );
-    raw = await readFile8(sourcePath(workspace), "utf8");
+    raw = await readFile7(sourcePath(workspace), "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -8252,7 +8558,7 @@ async function updateSources(workspace, apply, change) {
   const destination = sourcePath(workspace);
   const lock = destination + ".lock";
   try {
-    await mkdir2(lock);
+    await mkdir3(lock);
   } catch (error) {
     if (error.code === "EEXIST")
       distributionAssert(
@@ -8265,7 +8571,7 @@ async function updateSources(workspace, apply, change) {
   try {
     const sources = change(await readModuleSources(workspace));
     const temp = destination + "." + randomUUID() + ".tmp";
-    await writeFile2(
+    await writeFile3(
       temp,
       JSON.stringify({ schemaVersion: 1, sources }, null, "	") + "\n",
       { flag: "wx" }
@@ -8273,11 +8579,11 @@ async function updateSources(workspace, apply, change) {
     try {
       await rename2(temp, destination);
     } finally {
-      await rm2(temp, { force: true });
+      await rm3(temp, { force: true });
     }
     return { sources, applied: true };
   } finally {
-    await rm2(lock, { recursive: true, force: true });
+    await rm3(lock, { recursive: true, force: true });
   }
 }
 async function git(directory, ...arguments_) {
@@ -8295,12 +8601,12 @@ async function git(directory, ...arguments_) {
 async function withModuleSource(workspace, source, work) {
   validateSource(source);
   if (source.kind === "catalog") {
-    const location = source.location.startsWith("https://") ? source.location : resolve5(workspace.root, source.location);
+    const location = source.location.startsWith("https://") ? source.location : resolve7(workspace.root, source.location);
     return work(await loadModuleCatalog(location));
   }
   const checkout = await mkdtemp(join6(tmpdir(), "flowdular-module-source-"));
   try {
-    const location = source.location.startsWith("https://") ? source.location : isAbsolute2(source.location) ? source.location : resolve5(workspace.root, source.location);
+    const location = source.location.startsWith("https://") ? source.location : isAbsolute3(source.location) ? source.location : resolve7(workspace.root, source.location);
     await git(checkout, "init", "-q");
     await git(
       checkout,
@@ -8322,7 +8628,7 @@ async function withModuleSource(workspace, source, work) {
     );
     return await work(await loadModuleCatalog(catalogPath));
   } finally {
-    await rm2(checkout, { recursive: true, force: true });
+    await rm3(checkout, { recursive: true, force: true });
   }
 }
 
@@ -8347,7 +8653,7 @@ function checkedPlanFiles(files) {
 async function planCollectionBytes(directory, files) {
   let total = 0;
   for (const file of files) {
-    const info = await lstat4(join7(directory, file));
+    const info = await lstat3(join7(directory, file));
     distributionAssert(
       info.isFile() && !info.isSymbolicLink() && info.size <= MAX_PLAN_BYTES,
       "MODULE_PLAN_INVALID",
@@ -8359,7 +8665,7 @@ async function planCollectionBytes(directory, files) {
 }
 async function checkedPlanDirectory(workspace) {
   const directory = planDirectory(workspace);
-  const info = await lstat4(directory);
+  const info = await lstat3(directory);
   distributionAssert(
     info.isDirectory() && !info.isSymbolicLink(),
     "MODULE_PLAN_INVALID",
@@ -8370,7 +8676,7 @@ async function checkedPlanDirectory(workspace) {
 async function lockDigest(workspace) {
   try {
     return hashBytes(
-      await readFile9(join7(workspace.root, "flowdular.modules.lock.json"))
+      await readFile8(join7(workspace.root, "flowdular.modules.lock.json"))
     );
   } catch (error) {
     if (error.code === "ENOENT") return null;
@@ -8383,7 +8689,7 @@ async function workspaceDigest(workspace) {
   for (const file of files)
     manifests.push([
       relative6(workspace.root, file),
-      hashBytes(await readFile9(file))
+      hashBytes(await readFile8(file))
     ]);
   return hashBytes(
     JSON.stringify(manifests.sort(([a], [b]) => a.localeCompare(b)))
@@ -8416,7 +8722,7 @@ function permissions(artifact) {
 async function plannedReleases(workspace, source, target, update) {
   const manifests = [];
   for (const file of await findModuleFiles(workspace))
-    manifests.push(JSON.parse(await readFile9(file, "utf8")));
+    manifests.push(JSON.parse(await readFile8(file, "utf8")));
   const targetId = target.split("@")[0];
   if (update) {
     const lock = await validateInstalledModules(workspace);
@@ -8531,7 +8837,7 @@ async function createModulePlan(workspace, options) {
     );
     const lock = planDirectory(workspace) + ".lock";
     try {
-      await mkdir3(lock);
+      await mkdir4(lock);
     } catch (error) {
       if (error.code === "EEXIST")
         distributionAssert(
@@ -8543,7 +8849,7 @@ async function createModulePlan(workspace, options) {
     }
     try {
       const directory = planDirectory(workspace);
-      await mkdir3(directory, { recursive: true });
+      await mkdir4(directory, { recursive: true });
       await checkedPlanDirectory(workspace);
       const files = await readdir4(directory);
       checkedPlanFiles(files);
@@ -8560,10 +8866,10 @@ async function createModulePlan(workspace, options) {
         "The workspace has 8 MiB of module plans. Remove an obsolete plan first."
       );
       const temp = join7(lock, `${randomUUID2()}.tmp`);
-      await writeFile3(temp, serialized, { flag: "wx" });
+      await writeFile4(temp, serialized, { flag: "wx" });
       await rename3(temp, join7(directory, name));
     } finally {
-      await rm3(lock, { recursive: true, force: true });
+      await rm4(lock, { recursive: true, force: true });
     }
   }
   return plan;
@@ -8575,13 +8881,13 @@ async function readModulePlan(workspace, id) {
     "Invalid module plan id."
   );
   const path = join7(await checkedPlanDirectory(workspace), `${id}.json`);
-  const info = await lstat4(path);
+  const info = await lstat3(path);
   distributionAssert(
     info.isFile() && !info.isSymbolicLink() && info.size <= MAX_PLAN_BYTES,
     "MODULE_PLAN_INVALID",
     "Module plan is not a bounded regular file."
   );
-  const raw = await readFile9(path, "utf8");
+  const raw = await readFile8(path, "utf8");
   const plan = JSON.parse(raw);
   distributionAssert(
     plan && typeof plan === "object",
@@ -8620,7 +8926,7 @@ async function listModulePlans(workspace) {
 }
 async function removeModulePlan(workspace, id, apply) {
   await readModulePlan(workspace, id);
-  if (apply) await rm3(join7(planDirectory(workspace), `${id}.json`));
+  if (apply) await rm4(join7(planDirectory(workspace), `${id}.json`));
   return { id, applied: apply };
 }
 async function applyModulePlan(workspace, id, apply) {
@@ -8657,15 +8963,78 @@ async function applyModulePlan(workspace, id, apply) {
 }
 
 // src/web-mounts.ts
-import { readFile as readFile11 } from "node:fs/promises";
+import { readFile as readFile10 } from "node:fs/promises";
+
+// src/sdk.ts
+var SDK_VERSION = "0.6.2";
+var LIBRARIES = /* @__PURE__ */ new Set([
+  "ai-provider",
+  "cli-protocol",
+  "client",
+  "contracts",
+  "database",
+  "database-pglite",
+  "database-testing",
+  "dev-console",
+  "harness",
+  "kernel",
+  "server",
+  "storage",
+  "ui"
+]);
+var CORE_MODULES = /* @__PURE__ */ new Set([
+  "agents",
+  "auth",
+  "automations",
+  "profile",
+  "sandbox",
+  "system",
+  "users",
+  "workflows"
+]);
+function sdkSpecifier(name) {
+  const suffix = name.slice("@flowdular/".length);
+  if (!name.startsWith("@flowdular/")) return name;
+  if (LIBRARIES.has(suffix)) return `@flowdular/sdk/${suffix}`;
+  if (suffix.startsWith("module-") && CORE_MODULES.has(suffix.slice(7)))
+    return `@flowdular/sdk/modules/${suffix.slice(7)}`;
+  return name;
+}
+function sdkSource(source) {
+  return source.replace(/@flowdular\/[a-z0-9-]+/g, sdkSpecifier);
+}
+function npmPackage(specifier) {
+  return specifier.startsWith("@") ? specifier.split("/").slice(0, 2).join("/") : specifier.split("/")[0];
+}
+async function sdkModules(workspace) {
+  return sdkModuleManifests(workspace.root);
+}
+function sdkScaffold(files) {
+  return new Map(
+    [...files].map(([path, source]) => {
+      if (path === "spec/module.yaml" || path === "module.json")
+        return [path, source];
+      if (path !== "package.json") return [path, sdkSource(source)];
+      const pkg = JSON.parse(source);
+      for (const section of [pkg.dependencies, pkg.devDependencies])
+        if (section) {
+          for (const name of Object.keys(section))
+            if (sdkSpecifier(name) !== name) delete section[name];
+        }
+      pkg.dependencies ??= {};
+      pkg.dependencies["@flowdular/sdk"] = SDK_VERSION;
+      return [path, JSON.stringify(pkg, null, "	") + "\n"];
+    })
+  );
+}
 
 // src/module-sync.ts
 import { spawnSync } from "node:child_process";
-import { access as access3, mkdir as mkdir4, readFile as readFile10, rm as rm4, writeFile as writeFile4 } from "node:fs/promises";
+import { access as access3, mkdir as mkdir5, readFile as readFile9, rm as rm5, writeFile as writeFile5 } from "node:fs/promises";
 import { dirname as dirname7, join as join9 } from "node:path";
 
 // src/format.ts
-import { createRequire as createRequire3 } from "node:module";
+import { createRequire as createRequire2 } from "node:module";
 import { join as join8 } from "node:path";
 import { pathToFileURL } from "node:url";
 var DEFAULT_OPTIONS = {
@@ -8677,7 +9046,7 @@ var TSRX_PLUGIN = "@tsrx/prettier-plugin";
 function resolveFrom(workspaceRoot, specifier) {
   for (const base of [join8(workspaceRoot, "package.json"), import.meta.url]) {
     try {
-      return createRequire3(base).resolve(specifier);
+      return createRequire2(base).resolve(specifier);
     } catch {
     }
   }
@@ -8721,7 +9090,7 @@ async function writeProjectConfig(workspace, config) {
   const raw = JSON.stringify(config, null, "	") + "\n";
   const formatter = await loadWorkspaceFormatter(workspace.root);
   const output = formatter ? await formatter.format(workspace.configPath, raw) : raw;
-  await writeFile4(workspace.configPath, output);
+  await writeFile5(workspace.configPath, output);
 }
 var PROTECTED_MODULES = ["system.core", "auth.core"];
 var GENERATED_FILES = {
@@ -8793,7 +9162,7 @@ async function loadManifests(workspace) {
   const descriptors = /* @__PURE__ */ new Map();
   for (const file of files) {
     const manifest2 = JSON.parse(
-      await readFile10(file, "utf8")
+      await readFile9(file, "utf8")
     );
     if (!validators.module(manifest2))
       throw new Error(`Invalid module manifest: ${file}`);
@@ -8898,7 +9267,7 @@ async function takeSnapshots(paths) {
   return Promise.all(
     paths.map(async (path) => {
       try {
-        return { path, content: await readFile10(path, "utf8") };
+        return { path, content: await readFile9(path, "utf8") };
       } catch (error) {
         if (error.code === "ENOENT") {
           return { path, content: void 0 };
@@ -8911,11 +9280,11 @@ async function takeSnapshots(paths) {
 async function restoreSnapshots(snapshots) {
   for (const snapshot of [...snapshots].reverse()) {
     if (snapshot.content === void 0) {
-      await rm4(snapshot.path, { force: true });
+      await rm5(snapshot.path, { force: true });
       continue;
     }
-    await mkdir4(dirname7(snapshot.path), { recursive: true });
-    await writeFile4(snapshot.path, snapshot.content);
+    await mkdir5(dirname7(snapshot.path), { recursive: true });
+    await writeFile5(snapshot.path, snapshot.content);
   }
 }
 async function syncPlatformModules(workspace, apply, enabledOverride) {
@@ -8956,13 +9325,13 @@ async function syncPlatformModules(workspace, apply, enabledOverride) {
     const absolute = join9(workspace.root, target.path);
     let current = "";
     try {
-      current = await readFile10(absolute, "utf8");
+      current = await readFile9(absolute, "utf8");
     } catch {
     }
     const changed = current !== target.content;
     if (apply && changed) {
-      await mkdir4(dirname7(absolute), { recursive: true });
-      await writeFile4(absolute, target.content);
+      await mkdir5(dirname7(absolute), { recursive: true });
+      await writeFile5(absolute, target.content);
     }
     files.push({ path: target.path, changed });
   }
@@ -8987,7 +9356,7 @@ async function enableModule(workspace, id, apply) {
   const configChanged = !equalIds(current, enabled);
   const platformPackagePath = join9(workspace.root, "platform/package.json");
   const platformPackage = JSON.parse(
-    await readFile10(platformPackagePath, "utf8")
+    await readFile9(platformPackagePath, "utf8")
   );
   const dependencies = platformPackage.dependencies ?? {};
   const platformDependenciesAdded = modules.map((module) => npmPackage(module.package)).filter((packageName) => !(packageName in dependencies)).sort((left, right) => left.localeCompare(right));
@@ -9032,7 +9401,7 @@ async function enableModule(workspace, id, apply) {
     try {
       if (configChanged) {
         const config = JSON.parse(
-          await readFile10(workspace.configPath, "utf8")
+          await readFile9(workspace.configPath, "utf8")
         );
         const configModules = config.modules ?? {};
         configModules.enabled = enabled;
@@ -9040,7 +9409,7 @@ async function enableModule(workspace, id, apply) {
         await writeProjectConfig(workspace, config);
       }
       if (platformDependencyAdded) {
-        await writeFile4(
+        await writeFile5(
           platformPackagePath,
           JSON.stringify(platformPackage, null, "	") + "\n"
         );
@@ -9114,7 +9483,7 @@ async function disableModule(workspace, id, apply) {
   const enabled = orderedCurrent.filter((module) => module.id !== id).map((module) => module.id);
   const platformPackagePath = join9(workspace.root, "platform/package.json");
   const platformPackage = JSON.parse(
-    await readFile10(platformPackagePath, "utf8")
+    await readFile9(platformPackagePath, "utf8")
   );
   const packageName = npmPackage(manifests.get(id).package);
   const dependencyRemoved = Boolean(
@@ -9133,14 +9502,14 @@ async function disableModule(workspace, id, apply) {
     ]);
     try {
       const config = JSON.parse(
-        await readFile10(workspace.configPath, "utf8")
+        await readFile9(workspace.configPath, "utf8")
       );
       const modules = config.modules ?? {};
       modules.enabled = enabled;
       config.modules = modules;
       await writeProjectConfig(workspace, config);
       if (dependencyRemoved)
-        await writeFile4(
+        await writeFile5(
           platformPackagePath,
           JSON.stringify(platformPackage, null, "	") + "\n"
         );
@@ -9237,7 +9606,7 @@ function planUnmount(workspace, id) {
 }
 async function writeMounts(workspace, mounts) {
   const config = JSON.parse(
-    await readFile11(workspace.configPath, "utf8")
+    await readFile10(workspace.configPath, "utf8")
   );
   if (mounts.length === 0) delete config.web;
   else config.web = { ...config.web, mounts };
@@ -9246,8 +9615,8 @@ async function writeMounts(workspace, mounts) {
 }
 
 // src/runner.ts
-import { readFile as readFile24 } from "node:fs/promises";
-import { join as join21, relative as relative14 } from "node:path";
+import { readFile as readFile22 } from "node:fs/promises";
+import { join as join20, relative as relative14 } from "node:path";
 import { parse as parseYaml7 } from "yaml";
 
 // src/capabilities.ts
@@ -9481,196 +9850,6 @@ function capability(id) {
   return capabilities.find((entry) => entry.id === id);
 }
 
-// ../database-pglite/src/driver.ts
-import { PGlite } from "@electric-sql/pglite";
-import { mkdir as mkdir5, readFile as readFile12, rm as rm5, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join10 } from "node:path";
-var ROLE = /^[a-z_][a-z0-9_]{0,62}$/;
-var LOCK_FILE = "flowdular.lock";
-var LocalDatabaseLockedError = class extends Error {
-  constructor(directory, pid) {
-    super(
-      `The local database in ${directory} is already open in process ${pid}. Stop that Flowdular first, or point this one at another directory with FD_DATABASE_PGLITE_DIRECTORY.`
-    );
-    this.directory = directory;
-    this.pid = pid;
-    this.name = "LocalDatabaseLockedError";
-  }
-  directory;
-  pid;
-  code = "LOCAL_DATABASE_LOCKED";
-};
-var LocalDatabaseUnreadableError = class extends Error {
-  constructor(directory, cause) {
-    super(
-      `The local database in ${directory} could not be opened. A process killed mid write leaves it this way. Restore a backup of that directory, recreate the workspace with "pnpm flowdular setup quick --apply --confirm reset-local-auth", or point somewhere else with FD_DATABASE_PGLITE_DIRECTORY.`,
-      { cause }
-    );
-    this.directory = directory;
-    this.name = "LocalDatabaseUnreadableError";
-  }
-  directory;
-  code = "LOCAL_DATABASE_UNREADABLE";
-};
-function running(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
-}
-async function claimDirectory(directory) {
-  const path = join10(directory, LOCK_FILE);
-  let held;
-  try {
-    held = await readFile12(path, "utf8");
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-  const pid = Number(held?.split("\n")[0]);
-  if (Number.isInteger(pid) && pid > 0 && pid !== process.pid && running(pid)) {
-    throw new LocalDatabaseLockedError(directory, pid);
-  }
-  await writeFile5(path, `${process.pid}
-${(/* @__PURE__ */ new Date()).toISOString()}
-`, {
-    mode: 384
-  });
-}
-async function releaseDirectory(directory) {
-  const path = join10(directory, LOCK_FILE);
-  try {
-    const held = await readFile12(path, "utf8");
-    if (Number(held.split("\n")[0]) !== process.pid) return;
-    await rm5(path, { force: true });
-  } catch (error) {
-    const code = error.code;
-    if (code === "ENOENT" || code === "ENOTDIR" || code === "EACCES") return;
-    throw error;
-  }
-}
-var INT8_OID = 20;
-var SERVER_PARSERS = Object.freeze({ [INT8_OID]: (value) => value });
-var ConnectionQueue = class {
-  #tail = Promise.resolve();
-  acquire() {
-    let release;
-    const held = new Promise((resolve9) => {
-      release = resolve9;
-    });
-    const waited = this.#tail.then(() => release);
-    this.#tail = this.#tail.then(() => held);
-    return waited;
-  }
-};
-function result(rows, affected) {
-  return {
-    rows,
-    rowCount: rows.length > 0 ? rows.length : affected
-  };
-}
-function createPgliteCluster(options = {}) {
-  const queue = new ConnectionQueue();
-  let databasePromise;
-  let closePromise;
-  let issued = 0;
-  let ended = 0;
-  const close = () => {
-    closePromise ??= (async () => {
-      if (!databasePromise) return;
-      const instance = await databasePromise.catch(() => void 0);
-      databasePromise = void 0;
-      await instance?.close();
-      if (options.dataDirectory) await releaseDirectory(options.dataDirectory);
-    })();
-    return closePromise;
-  };
-  const database = async () => {
-    databasePromise ??= (async () => {
-      const directory = options.dataDirectory;
-      if (directory) {
-        await mkdir5(directory, { recursive: true, mode: 448 });
-        await claimDirectory(directory);
-      }
-      let created;
-      try {
-        created = directory ? await PGlite.create({
-          dataDir: directory,
-          parsers: SERVER_PARSERS
-        }) : await PGlite.create({ parsers: SERVER_PARSERS });
-      } catch (error) {
-        if (!directory) throw error;
-        await releaseDirectory(directory);
-        throw new LocalDatabaseUnreadableError(directory, error);
-      }
-      try {
-        if (options.bootstrap) await created.exec(options.bootstrap);
-      } catch (error) {
-        try {
-          await created.close();
-        } catch (closeError) {
-          throw new AggregateError(
-            [error, closeError],
-            "PGlite bootstrap failed and cleanup also failed."
-          );
-        }
-        throw error;
-      }
-      return created;
-    })();
-    return databasePromise;
-  };
-  const pool = (role) => {
-    if (role !== void 0 && !ROLE.test(role)) {
-      throw new Error(`"${role}" is not a usable PostgreSQL role name.`);
-    }
-    issued += 1;
-    return {
-      cancellation: "before-start",
-      async connect() {
-        const release = await queue.acquire();
-        let instance;
-        try {
-          instance = await database();
-          if (role) await instance.exec(`SET ROLE ${role}`);
-        } catch (error) {
-          release();
-          throw error;
-        }
-        let released = false;
-        const run = async ({
-          text,
-          values: values2
-        }) => {
-          if (values2 === void 0 || values2.length === 0) {
-            const answers = await instance.exec(text);
-            const last = answers[answers.length - 1];
-            return last ? result(last.rows, last.affectedRows ?? 0) : result([], 0);
-          }
-          const answer = await instance.query(text, [...values2]);
-          return result(answer.rows, answer.affectedRows ?? 0);
-        };
-        return {
-          query: run,
-          release() {
-            if (released) return;
-            released = true;
-            const reset = role ? instance.exec("RESET ROLE").catch(() => void 0) : Promise.resolve();
-            void reset.finally(release);
-          }
-        };
-      },
-      async end() {
-        ended += 1;
-        if (ended < issued) return;
-        await close();
-      }
-    };
-  };
-  return { pool, close };
-}
-
 // src/database.ts
 import { Pool } from "pg";
 function enabledNamespaces(workspace) {
@@ -9762,14 +9941,14 @@ import {
   cp,
   mkdir as mkdir6,
   mkdtemp as mkdtemp2,
-  readFile as readFile13,
+  readFile as readFile11,
   readdir as readdir5,
   rename as rename4,
   rm as rm6,
   writeFile as writeFile6
 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { delimiter, dirname as dirname8, isAbsolute as isAbsolute3, join as join11, resolve as resolve6 } from "node:path";
+import { delimiter, dirname as dirname8, isAbsolute as isAbsolute4, join as join10, resolve as resolve8 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var POSTGRES_DUMP_FILE = "database.dump";
 var PGLITE_PAYLOAD_DIRECTORY = "pglite";
@@ -9797,12 +9976,12 @@ function platformVersion(workspace) {
   return typeof declared === "string" ? declared : "unknown";
 }
 function backupDirectory(workspace, value) {
-  return isAbsolute3(value) ? resolve6(value) : resolve6(workspace.root, value);
+  return isAbsolute4(value) ? resolve8(value) : resolve8(workspace.root, value);
 }
 async function resolveTool(name, environment) {
   for (const directory of (environment.PATH ?? "").split(delimiter)) {
     if (!directory) continue;
-    const candidate = resolve6(directory, name);
+    const candidate = resolve8(directory, name);
     try {
       await access4(candidate, constants.X_OK);
       return candidate;
@@ -9839,11 +10018,11 @@ async function withPostgresConnection(config, run) {
     "\\n",
     "\n"
   ).trim();
-  const temporaryDirectory = !authorityFile && inlineAuthority ? await mkdtemp2(join11(tmpdir2(), "flowdular-backup-")) : void 0;
+  const temporaryDirectory = !authorityFile && inlineAuthority ? await mkdtemp2(join10(tmpdir2(), "flowdular-backup-")) : void 0;
   try {
     let certificate = authorityFile;
     if (temporaryDirectory) {
-      certificate = join11(temporaryDirectory, "ca.pem");
+      certificate = join10(temporaryDirectory, "ca.pem");
       await writeFile6(certificate, `${inlineAuthority}
 `, {
         encoding: "utf8",
@@ -9912,7 +10091,7 @@ async function databaseBackup(workspace, output, apply) {
     return failure("DATABASE_CONFIGURATION_INVALID", reason(error));
   }
   const directory = backupDirectory(workspace, output);
-  const manifestPath = join11(directory, BACKUP_MANIFEST_FILE);
+  const manifestPath = join10(directory, BACKUP_MANIFEST_FILE);
   if (await exists3(manifestPath)) {
     return failure(
       "BACKUP_TARGET_EXISTS",
@@ -9937,7 +10116,7 @@ async function databaseBackup(workspace, output, apply) {
         "pg_dump was not found on PATH. Install the PostgreSQL client tools matching the server version."
       );
     }
-    const payload2 = join11(directory, POSTGRES_DUMP_FILE);
+    const payload2 = join10(directory, POSTGRES_DUMP_FILE);
     const plan2 = {
       adapter: config.adapter,
       applied: apply,
@@ -9975,7 +10154,7 @@ async function databaseBackup(workspace, output, apply) {
       source ? `The embedded database directory ${source} does not exist yet.` : "The embedded database runs in memory under NODE_ENV=test, so there is nothing to copy."
     );
   }
-  const payload = join11(directory, PGLITE_PAYLOAD_DIRECTORY);
+  const payload = join10(directory, PGLITE_PAYLOAD_DIRECTORY);
   const plan = {
     adapter: config.adapter,
     applied: apply,
@@ -10002,7 +10181,7 @@ async function databaseBackup(workspace, output, apply) {
 async function restrictTree(root) {
   await chmod(root, 448);
   for (const entry of await readdir5(root, { withFileTypes: true })) {
-    const path = join11(root, entry.name);
+    const path = join10(root, entry.name);
     if (entry.isDirectory()) await restrictTree(path);
     else if (entry.isFile()) await chmod(path, 384);
   }
@@ -10013,7 +10192,7 @@ function restoreTarget(config) {
     return decodeURIComponent(url.pathname.slice(1));
   }
   const directory = config.pglite?.dataDirectory;
-  return directory === void 0 ? void 0 : resolve6(config.workspaceRoot, directory);
+  return directory === void 0 ? void 0 : resolve8(config.workspaceRoot, directory);
 }
 function describeKeyMismatch(divergent) {
   return divergent.map((key) => `${key.variable} (${key.status})`).join(", ");
@@ -10072,7 +10251,7 @@ function productionRefusal(options, config) {
     );
   }
   const expected = restoreTarget(config);
-  const target = config.adapter === "pglite" ? resolve6(config.workspaceRoot, options.target) : options.target;
+  const target = config.adapter === "pglite" ? resolve8(config.workspaceRoot, options.target) : options.target;
   if (target !== expected) {
     return failure(
       "RESTORE_TARGET_MISMATCH",
@@ -10107,11 +10286,11 @@ async function databaseRestore(workspace, input, apply, production) {
     return failure("DATABASE_CONFIGURATION_INVALID", reason(error));
   }
   const directory = backupDirectory(workspace, input);
-  const manifestPath = join11(directory, BACKUP_MANIFEST_FILE);
+  const manifestPath = join10(directory, BACKUP_MANIFEST_FILE);
   let manifest2;
   try {
     manifest2 = parseBackupManifest(
-      JSON.parse(await readFile13(manifestPath, "utf8"))
+      JSON.parse(await readFile11(manifestPath, "utf8"))
     );
   } catch (error) {
     return error.code === "ENOENT" ? failure(
@@ -10156,7 +10335,7 @@ async function databaseRestore(workspace, input, apply, production) {
         "pg_restore was not found on PATH. Install the PostgreSQL client tools matching the server version."
       );
     }
-    const payload2 = join11(directory, POSTGRES_DUMP_FILE);
+    const payload2 = join10(directory, POSTGRES_DUMP_FILE);
     if (!await exists3(payload2)) {
       return failure(
         "BACKUP_PAYLOAD_MISSING",
@@ -10194,7 +10373,7 @@ async function databaseRestore(workspace, input, apply, production) {
     }
     return success(plan2, { evidence: [manifestPath, payload2], warnings });
   }
-  const payload = join11(directory, PGLITE_PAYLOAD_DIRECTORY);
+  const payload = join10(directory, PGLITE_PAYLOAD_DIRECTORY);
   if (!await exists3(payload)) {
     return failure(
       "BACKUP_PAYLOAD_MISSING",
@@ -10230,12 +10409,12 @@ async function databaseRestore(workspace, input, apply, production) {
 }
 
 // src/migration-new.ts
-import { readFile as readFile14 } from "node:fs/promises";
+import { readFile as readFile12 } from "node:fs/promises";
 import { dirname as dirname9 } from "node:path";
 
 // src/migration-scaffold.ts
 import { mkdir as mkdir7, readdir as readdir6, writeFile as writeFile7 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join11 } from "node:path";
 var NAME = /^[a-z][a-z0-9_]{2,48}$/;
 function nextNumber(existing) {
   const highest = existing.filter((entry) => entry.endsWith(".up.sql")).map((entry) => Number.parseInt(entry.slice(0, 4), 10)).filter((value) => Number.isSafeInteger(value)).reduce((left, right) => Math.max(left, right), 0);
@@ -10262,7 +10441,7 @@ async function scaffoldMigration(moduleDirectory, moduleStem, name, apply) {
       `"${name}" must be lowercase letters, digits and underscores, 3 to 49 characters.`
     );
   }
-  const directory = join12(moduleDirectory, "migrations");
+  const directory = join11(moduleDirectory, "migrations");
   let existing = [];
   try {
     existing = await readdir6(directory);
@@ -10273,11 +10452,11 @@ async function scaffoldMigration(moduleDirectory, moduleStem, name, apply) {
   const table = `${moduleStem}_${name}`;
   const files = [
     {
-      path: join12(directory, `${id}.up.sql`),
+      path: join11(directory, `${id}.up.sql`),
       body: tenantTable(table)
     },
     {
-      path: join12(directory, `${id}.down.sql`),
+      path: join11(directory, `${id}.down.sql`),
       body: `DROP POLICY IF EXISTS ${table}_tenant_policy ON ${table};
 DROP INDEX IF EXISTS ${table}_tenant_created_idx;
 DROP TABLE IF EXISTS ${table};
@@ -10298,7 +10477,7 @@ async function migrationScaffold(workspace, moduleId, name, apply) {
   const manifests = await findModuleFiles(workspace);
   for (const manifestPath of manifests) {
     const manifest2 = JSON.parse(
-      await readFile14(manifestPath, "utf8")
+      await readFile12(manifestPath, "utf8")
     );
     if (manifest2.id !== moduleId) continue;
     const stem = moduleId.split(".")[0].replaceAll("-", "_");
@@ -10328,8 +10507,8 @@ async function migrationScaffold(workspace, moduleId, name, apply) {
 }
 
 // src/doctor.ts
-import { access as access5, readFile as readFile15 } from "node:fs/promises";
-import { join as join13, relative as relative7 } from "node:path";
+import { access as access5, readFile as readFile13 } from "node:fs/promises";
+import { join as join12, relative as relative7 } from "node:path";
 async function exists4(path) {
   try {
     await access5(path);
@@ -10358,20 +10537,20 @@ async function runDoctor(workspace) {
     ["policy.capabilities", agentResource(workspace, "policy")],
     ["policy.model-routing", agentResource(workspace, "modelRouting")],
     ["blueprints.root", agentResource(workspace, "blueprints")],
-    ["modules.root", join13(workspace.root, "modules")],
-    ...(await sdkModules(workspace)).size ? [] : [["packages.root", join13(workspace.root, "packages")]],
-    ["platform.root", join13(workspace.root, "platform")]
+    ["modules.root", join12(workspace.root, "modules")],
+    ...(await sdkModules(workspace)).size ? [] : [["packages.root", join12(workspace.root, "packages")]],
+    ["platform.root", join12(workspace.root, "platform")]
   ]) {
     const path = relative7(workspace.root, resource);
     checks.push({
       id,
-      status: await exists4(join13(workspace.root, path)) ? "pass" : "fail",
-      message: await exists4(join13(workspace.root, path)) ? `${path} is present.` : `${path} is missing.`,
+      status: await exists4(join12(workspace.root, path)) ? "pass" : "fail",
+      message: await exists4(join12(workspace.root, path)) ? `${path} is present.` : `${path} is missing.`,
       evidence: path
     });
   }
   const packageJson2 = JSON.parse(
-    await readFile15(join13(workspace.root, "package.json"), "utf8")
+    await readFile13(join12(workspace.root, "package.json"), "utf8")
   );
   checks.push({
     id: "workspace.pnpm",
@@ -10386,11 +10565,11 @@ async function runDoctor(workspace) {
     message: blueprints.length > 0 ? `${blueprints.length} blueprint(s) discoverable.` : 'No blueprint.json was found; "blueprint validate --all" would pass vacuously.',
     evidence: blueprints.map((file) => relative7(workspace.root, file)).join(", ")
   });
-  const entryPath = join13(workspace.root, "platform/src/App.tsrx");
+  const entryPath = join12(workspace.root, "platform/src/App.tsrx");
   if (await exists4(entryPath)) {
-    const entry = await readFile15(entryPath, "utf8");
-    const pagePath = join13(workspace.root, "platform/index.html");
-    const page = await exists4(pagePath) ? await readFile15(pagePath, "utf8") : "";
+    const entry = await readFile13(entryPath, "utf8");
+    const pagePath = join12(workspace.root, "platform/index.html");
+    const page = await exists4(pagePath) ? await readFile13(pagePath, "utf8") : "";
     const renders = entry.includes("configureBrandingFromPage");
     const staticHead = /<meta[^>]+name="theme-color"|<link[^>]+rel="icon"/.test(
       page
@@ -10426,16 +10605,16 @@ async function runDoctor(workspace) {
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { randomUUID as randomUUID5 } from "node:crypto";
 import {
-  lstat as lstat6,
+  lstat as lstat5,
   mkdir as mkdir9,
   open as open2,
-  readFile as readFile17,
+  readFile as readFile15,
   realpath as realpath2,
   rename as rename6,
   rm as rm8,
   writeFile as writeFile9
 } from "node:fs/promises";
-import { isAbsolute as isAbsolute4, join as join15, relative as relative9 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join14, relative as relative9 } from "node:path";
 import { parse as parseYaml5 } from "yaml";
 
 // src/vercel-launch.ts
@@ -10444,17 +10623,17 @@ import { createHash as createHash6, randomBytes as randomBytes2, randomUUID as r
 import {
   chmod as chmod2,
   copyFile,
-  lstat as lstat5,
+  lstat as lstat4,
   mkdir as mkdir8,
   mkdtemp as mkdtemp3,
   open,
-  readFile as readFile16,
+  readFile as readFile14,
   rename as rename5,
   rm as rm7,
   writeFile as writeFile8
 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname10, join as join14, relative as relative8 } from "node:path";
+import { dirname as dirname10, join as join13, relative as relative8 } from "node:path";
 import { Client } from "pg";
 
 // src/database-roles.ts
@@ -10699,7 +10878,7 @@ ${run.stdout}`.split("\n").map((line) => line.trim()).filter(Boolean);
 }
 function runVercel(context, args, mode = {}) {
   const fullArgs = context.options.scope ? [...args, "--scope", context.options.scope] : [...args];
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve11, reject) => {
     const child = spawn("vercel", fullArgs, {
       cwd: mode.cwd ?? context.root,
       stdio: mode.interactive ? "inherit" : [mode.input === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
@@ -10726,7 +10905,7 @@ function runVercel(context, args, mode = {}) {
           if (rest) process.stderr.write(`${redact(context, rest)}
 `);
       }
-      resolve9({ status: code ?? 1, ...captured });
+      resolve11({ status: code ?? 1, ...captured });
     });
   });
 }
@@ -10737,17 +10916,17 @@ function unexpected(command) {
   );
 }
 async function readProjectLink(root) {
-  const path = join14(root, ".vercel/project.json");
+  const path = join13(root, ".vercel/project.json");
   let link;
   try {
-    const entry = await lstat5(path);
+    const entry = await lstat4(path);
     if (!entry.isFile() || entry.size > 16 * 1024) {
       throw new LaunchError(
         "VERCEL_LINK_INVALID",
         ".vercel/project.json must be a regular file. Remove .vercel and rerun to link again."
       );
     }
-    link = JSON.parse(await readFile16(path, "utf8"));
+    link = JSON.parse(await readFile14(path, "utf8"));
   } catch (error) {
     if (error.code === "ENOENT") return null;
     if (error instanceof LaunchError) throw error;
@@ -10834,14 +11013,14 @@ async function setProductionVariable(context, name, value, exists5) {
 }
 async function readPrivateFile(root, path, maxKiB, code) {
   try {
-    const entry = await lstat5(path);
+    const entry = await lstat4(path);
     if (!entry.isFile() || entry.size > maxKiB * 1024) {
       throw new LaunchError(
         code,
         `${relative8(root, path)} must be a regular file of at most ${maxKiB} KiB.`
       );
     }
-    const text = await readFile16(path, "utf8");
+    const text = await readFile14(path, "utf8");
     await chmod2(path, 384);
     return text;
   } catch (error) {
@@ -10850,7 +11029,7 @@ async function readPrivateFile(root, path, maxKiB, code) {
   }
 }
 async function readKeyBackup(root, project) {
-  const path = join14(root, ".flowdular/deploy", `vercel-${project.id}.env`);
+  const path = join13(root, ".flowdular/deploy", `vercel-${project.id}.env`);
   const values2 = /* @__PURE__ */ new Map();
   const text = await readPrivateFile(root, path, 64, "KEY_BACKUP_INVALID");
   for (const line of text?.split("\n") ?? []) {
@@ -10874,8 +11053,8 @@ async function writeKeyBackup(root, project, backup) {
 async function writePrivateFile(root, path, contents) {
   const directory = dirname10(path);
   await mkdir8(directory, { recursive: true, mode: 448 });
-  for (const path2 of [join14(root, ".flowdular"), directory]) {
-    if (!(await lstat5(path2)).isDirectory()) {
+  for (const path2 of [join13(root, ".flowdular"), directory]) {
+    if (!(await lstat4(path2)).isDirectory()) {
       throw new LaunchError(
         "KEY_BACKUP_INVALID",
         `${relative8(root, path2)} must be a directory inside the workspace.`
@@ -10898,7 +11077,7 @@ async function writePrivateFile(root, path, contents) {
   }
 }
 function setupTokenPath(root, project) {
-  return join14(root, ".flowdular/deploy", `vercel-${project.id}.setup-token`);
+  return join13(root, ".flowdular/deploy", `vercel-${project.id}.setup-token`);
 }
 async function saveSetupToken(context, project) {
   const path = setupTokenPath(context.root, project);
@@ -10971,9 +11150,9 @@ function roleUrl(owner, role, password) {
   return `postgresql://${encodeURIComponent(APPLICATION_ROLES[role])}:${encodeURIComponent(password)}@${owner.host}${owner.pathname}`;
 }
 async function pullProductionValue(context, name) {
-  const directory = await mkdtemp3(join14(tmpdir3(), "flowdular-vercel-env-"));
+  const directory = await mkdtemp3(join13(tmpdir3(), "flowdular-vercel-env-"));
   try {
-    const file = join14(directory, "production.env");
+    const file = join13(directory, "production.env");
     await writeFile8(file, "", { mode: 384, flag: "wx" });
     const run = await runVercel(context, [
       "env",
@@ -10990,7 +11169,7 @@ async function pullProductionValue(context, name) {
       );
     }
     const prefix = `${name}="`;
-    const line = (await readFile16(file, "utf8")).split("\n").find((entry) => entry.startsWith(prefix) && entry.endsWith('"'));
+    const line = (await readFile14(file, "utf8")).split("\n").find((entry) => entry.startsWith(prefix) && entry.endsWith('"'));
     const value = line?.slice(prefix.length, -1);
     return value && value !== "[SENSITIVE]" ? remember(context, value) : void 0;
   } finally {
@@ -10999,12 +11178,12 @@ async function pullProductionValue(context, name) {
 }
 async function provisionNeon(context) {
   progress("Provisioning Neon PostgreSQL through the Vercel Marketplace");
-  const directory = await mkdtemp3(join14(tmpdir3(), "flowdular-vercel-neon-"));
+  const directory = await mkdtemp3(join13(tmpdir3(), "flowdular-vercel-neon-"));
   try {
-    await mkdir8(join14(directory, ".vercel"), { mode: 448 });
+    await mkdir8(join13(directory, ".vercel"), { mode: 448 });
     await copyFile(
-      join14(context.root, ".vercel/project.json"),
-      join14(directory, ".vercel/project.json")
+      join13(context.root, ".vercel/project.json"),
+      join13(directory, ".vercel/project.json")
     );
     const run = await runVercel(
       context,
@@ -11519,6 +11698,8 @@ function defaultVercelHost() {
         application_name: "flowdular-deploy",
         connectionTimeoutMillis: 15e3
       });
+      client.on("error", () => {
+      });
       await client.connect();
       return {
         query: (text) => client.query(text),
@@ -11534,7 +11715,7 @@ function defaultVercelHost() {
           )
         );
       }
-      return new Promise((resolve9, reject) => {
+      return new Promise((resolve11, reject) => {
         const child = spawn(
           process.execPath,
           [...process.execArgv, entry, ...args, "--json"],
@@ -11550,7 +11731,7 @@ function defaultVercelHost() {
         child.once("error", reject);
         child.once("close", () => {
           try {
-            resolve9(JSON.parse(stdout));
+            resolve11(JSON.parse(stdout));
           } catch {
             reject(
               new Error("The flowdular child command printed no envelope.")
@@ -11560,7 +11741,7 @@ function defaultVercelHost() {
       });
     },
     fetch: (url, init) => fetch(url, init),
-    wait: (ms) => new Promise((resolve9) => setTimeout(resolve9, ms))
+    wait: (ms) => new Promise((resolve11) => setTimeout(resolve11, ms))
   };
 }
 
@@ -11604,23 +11785,23 @@ var deploymentAdapters = [
 ];
 var DEPLOYMENT_HISTORY_LIMIT = 64;
 async function recordDeployment(root, record) {
-  const directory = join15(root, ".flowdular");
+  const directory = join14(root, ".flowdular");
   await mkdir9(directory, { recursive: true, mode: 448 });
-  if (!(await lstat6(directory)).isDirectory()) {
+  if (!(await lstat5(directory)).isDirectory()) {
     throw new Error(
       "Deployment audit directory must be a directory inside the workspace."
     );
   }
-  const path = join15(directory, "deployments.json");
+  const path = join14(directory, "deployments.json");
   let history = [];
   try {
-    const entry = await lstat6(path);
+    const entry = await lstat5(path);
     if (!entry.isFile() || entry.size > 128 * 1024) {
       throw new Error(
         "Deployment audit journal is not a bounded regular file."
       );
     }
-    history = JSON.parse(await readFile17(path, "utf8"));
+    history = JSON.parse(await readFile15(path, "utf8"));
     if (!Array.isArray(history))
       throw new Error("Deployment audit journal is invalid.");
   } catch (error) {
@@ -11645,12 +11826,12 @@ async function recordDeployment(root, record) {
 }
 async function workspaceFile(root, path) {
   try {
-    const file = join15(root, path);
-    if (!(await lstat6(file)).isFile()) return false;
+    const file = join14(root, path);
+    if (!(await lstat5(file)).isFile()) return false;
     const canonicalRoot = await realpath2(root);
     const canonicalFile = await realpath2(file);
     const pathFromRoot = relative9(canonicalRoot, canonicalFile);
-    return pathFromRoot !== "" && !pathFromRoot.startsWith("..") && !isAbsolute4(pathFromRoot);
+    return pathFromRoot !== "" && !pathFromRoot.startsWith("..") && !isAbsolute5(pathFromRoot);
   } catch {
     return false;
   }
@@ -11682,9 +11863,9 @@ async function renderBlueprintIssue(root) {
     return "render.yaml must be a regular file at the repository root.";
   let blueprint;
   try {
-    if ((await lstat6(join15(root, path))).size > 128 * 1024)
+    if ((await lstat5(join14(root, path))).size > 128 * 1024)
       return "render.yaml exceeds the 128 KiB preflight limit.";
-    blueprint = parseYaml5(await readFile17(join15(root, path), "utf8"));
+    blueprint = parseYaml5(await readFile15(join14(root, path), "utf8"));
   } catch {
     return "render.yaml must contain valid YAML.";
   }
@@ -11840,10 +12021,10 @@ async function vercelArtifactIssue(root) {
   }
   let config;
   try {
-    const path = join15(root, "vercel.json");
-    if ((await lstat6(path)).size > 16 * 1024)
+    const path = join14(root, "vercel.json");
+    if ((await lstat5(path)).size > 16 * 1024)
       return "vercel.json exceeds the 16 KiB preflight limit.";
-    config = JSON.parse(await readFile17(path, "utf8"));
+    config = JSON.parse(await readFile15(path, "utf8"));
   } catch {
     return "vercel.json must contain valid JSON.";
   }
@@ -11852,15 +12033,15 @@ async function vercelArtifactIssue(root) {
   return null;
 }
 async function vercelUploadIgnoreIssue(root) {
-  const path = join15(root, ".vercelignore");
+  const path = join14(root, ".vercelignore");
   if (!await workspaceFile(root, ".vercelignore"))
     return ".vercelignore must exist so vercel deploy does not upload .env files or the key backup under .flowdular.";
   let patterns;
   try {
-    if ((await lstat6(path)).size > 16 * 1024)
+    if ((await lstat5(path)).size > 16 * 1024)
       return ".vercelignore exceeds the 16 KiB preflight limit.";
     patterns = new Set(
-      (await readFile17(path, "utf8")).split("\n").map((line) => line.trim().replace(/^\*\*\//, ""))
+      (await readFile15(path, "utf8")).split("\n").map((line) => line.trim().replace(/^\*\*\//, ""))
     );
   } catch {
     return ".vercelignore must be readable.";
@@ -12032,15 +12213,15 @@ async function runDeployment(workspace, action, target, arguments_, terminal = {
       }
     );
   }
-  const directory = join15(workspace.root, ".flowdular");
+  const directory = join14(workspace.root, ".flowdular");
   await mkdir9(directory, { recursive: true, mode: 448 });
-  if (!(await lstat6(directory)).isDirectory()) {
+  if (!(await lstat5(directory)).isDirectory()) {
     return failure(
       "DEPLOY_AUDIT_FAILED",
       "The local audit directory is invalid."
     );
   }
-  const lockPath = join15(directory, "deployment.lock");
+  const lockPath = join14(directory, "deployment.lock");
   let lock;
   try {
     lock = await open2(lockPath, "wx", 384);
@@ -12082,7 +12263,7 @@ async function launchDocker(workspace, arguments_, record) {
   );
   const result2 = spawnSync3(
     process.execPath,
-    [join15(workspace.root, "infra/docker/start.mjs"), ...flags],
+    [join14(workspace.root, "infra/docker/start.mjs"), ...flags],
     {
       cwd: workspace.root,
       stdio: "inherit"
@@ -12111,13 +12292,13 @@ async function launchDocker(workspace, arguments_, record) {
 }
 
 // src/extensions.ts
-import { readFile as readFile18 } from "node:fs/promises";
+import { readFile as readFile16 } from "node:fs/promises";
 import { dirname as dirname12, relative as relative10 } from "node:path";
 
 // src/module-import.ts
-import { readFileSync as readFileSync2, realpathSync } from "node:fs";
+import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
 import {
-  createRequire as createRequire4,
+  createRequire as createRequire3,
   registerHooks,
   stripTypeScriptTypes
 } from "node:module";
@@ -12126,11 +12307,11 @@ import { fileURLToPath, pathToFileURL as pathToFileURL2 } from "node:url";
 var roots = /* @__PURE__ */ new Set();
 var registered = false;
 async function importModuleSource(entry, moduleRoot) {
-  roots.add(realpathSync(moduleRoot));
+  roots.add(realpathSync2(moduleRoot));
   try {
-    const require2 = createRequire4(pathToFileURL2(entry));
+    const require2 = createRequire3(pathToFileURL2(entry));
     roots.add(
-      realpathSync(dirname11(require2.resolve("@flowdular/sdk/package.json")))
+      realpathSync2(dirname11(require2.resolve("@flowdular/sdk/package.json")))
     );
   } catch (error) {
     if (!["MODULE_NOT_FOUND", "ERR_PACKAGE_PATH_NOT_EXPORTED"].includes(
@@ -12143,12 +12324,12 @@ async function importModuleSource(entry, moduleRoot) {
       load(url, context, nextLoad) {
         if (!url.startsWith("file:") || !fileURLToPath(url).endsWith(".ts"))
           return nextLoad(url, context);
-        const path = realpathSync(fileURLToPath(url));
+        const path = realpathSync2(fileURLToPath(url));
         if (![...roots].some((root) => path.startsWith(root + sep2)))
           return nextLoad(url, context);
         return {
           format: "module",
-          source: stripTypeScriptTypes(readFileSync2(path, "utf8"), {
+          source: stripTypeScriptTypes(readFileSync3(path, "utf8"), {
             mode: "transform",
             sourceUrl: url
           }),
@@ -12252,7 +12433,7 @@ async function loadCliExtensions(workspace) {
   const loaded = [];
   for (const manifestPath of manifests) {
     const manifest2 = JSON.parse(
-      await readFile18(manifestPath, "utf8")
+      await readFile16(manifestPath, "utf8")
     );
     if (!enabled.has(manifest2.id) || !manifest2.cli) continue;
     const moduleRoot = dirname12(manifestPath);
@@ -12268,7 +12449,7 @@ async function loadCliExtensions(workspace) {
       );
     }
     const catalog = JSON.parse(
-      await readFile18(catalogPath, "utf8")
+      await readFile16(catalogPath, "utf8")
     );
     validateCliCatalog(catalog, manifest2);
     for (const command of catalog.commands) {
@@ -12292,12 +12473,12 @@ async function loadCliExtensions(workspace) {
 }
 
 // src/migration.ts
-import { readFile as readFile20, stat as stat2 } from "node:fs/promises";
-import { dirname as dirname13, join as join17 } from "node:path";
+import { readFile as readFile18, stat as stat2 } from "node:fs/promises";
+import { dirname as dirname13, join as join16 } from "node:path";
 
 // src/migration-audit.ts
-import { readdir as readdir7, readFile as readFile19 } from "node:fs/promises";
-import { join as join16 } from "node:path";
+import { readdir as readdir7, readFile as readFile17 } from "node:fs/promises";
+import { join as join15 } from "node:path";
 function statementsOf2(sql) {
   return sql.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/--[^\n]*\n/g, "\n");
 }
@@ -12368,13 +12549,13 @@ async function scripts(directory) {
   for (const entry of entries.filter((name) => name.endsWith(".up.sql"))) {
     found.set(
       entry.slice(0, -".up.sql".length),
-      await readFile19(join16(directory, entry), "utf8")
+      await readFile17(join15(directory, entry), "utf8")
     );
   }
   return found;
 }
 async function moduleMigrationAudit(moduleId, moduleDirectory, declared) {
-  const found = await scripts(join16(moduleDirectory, "migrations"));
+  const found = await scripts(join15(moduleDirectory, "migrations"));
   const issues = [];
   const declaredIds = new Set(declared.map((migration) => migration.id));
   for (const migrationId of [...declaredIds].sort()) {
@@ -12458,11 +12639,11 @@ async function loadMigrationModules(workspace, moduleId) {
   const unmanaged = [];
   for (const manifestPath of manifests) {
     const manifest2 = JSON.parse(
-      await readFile20(manifestPath, "utf8")
+      await readFile18(manifestPath, "utf8")
     );
     if (!enabled.has(manifest2.id)) continue;
     if (moduleId && manifest2.id !== moduleId) continue;
-    const entry = join17(dirname13(manifestPath), "src/services/migration.ts");
+    const entry = join16(dirname13(manifestPath), "src/services/migration.ts");
     try {
       await stat2(entry);
     } catch (error) {
@@ -12704,12 +12885,12 @@ import {
   access as access6,
   mkdir as mkdir10,
   readdir as readdir8,
-  readFile as readFile21,
+  readFile as readFile19,
   realpath as realpath3,
   rm as rm9,
   writeFile as writeFile10
 } from "node:fs/promises";
-import { dirname as dirname14, join as join18, relative as relative11, resolve as resolve7 } from "node:path";
+import { dirname as dirname14, join as join17, relative as relative11, resolve as resolve9 } from "node:path";
 import { parse as parseYaml6 } from "yaml";
 var IGNORED_ENTRIES = /* @__PURE__ */ new Set(["node_modules", "dist"]);
 function ownedByAuthor(path) {
@@ -12719,7 +12900,7 @@ async function listFiles(directory) {
   const files = [];
   for (const entry of await readdir8(directory, { withFileTypes: true })) {
     if (IGNORED_ENTRIES.has(entry.name)) continue;
-    const path = join18(directory, entry.name);
+    const path = join17(directory, entry.name);
     if (entry.isDirectory()) files.push(...await listFiles(path));
     else files.push(path);
   }
@@ -12746,9 +12927,9 @@ async function inspectTarget(workspaceRoot, moduleDirectory, specPath, specSourc
     );
   }
   if (present.has("spec/module.yaml")) {
-    const existingSpecPath = join18(moduleDirectory, "spec/module.yaml");
-    const sameFile = resolve7(specPath) === await realpath3(existingSpecPath);
-    if (!sameFile && await readFile21(existingSpecPath, "utf8") !== specSource) {
+    const existingSpecPath = join17(moduleDirectory, "spec/module.yaml");
+    const sameFile = resolve9(specPath) === await realpath3(existingSpecPath);
+    if (!sameFile && await readFile19(existingSpecPath, "utf8") !== specSource) {
       throw new Error(
         `${relative11(workspaceRoot, existingSpecPath)} holds a different specification than ${relative11(workspaceRoot, specPath)}.`
       );
@@ -12762,7 +12943,7 @@ async function writeScaffold(moduleDirectory, files, target) {
   try {
     for (const [path, source] of files) {
       if (target.present.has(path)) continue;
-      const absolute = join18(moduleDirectory, path);
+      const absolute = join17(moduleDirectory, path);
       const created = await mkdir10(dirname14(absolute), { recursive: true });
       if (created) createdDirectories.push(created);
       await writeFile10(absolute, source, { encoding: "utf8", flag: "wx" });
@@ -12796,7 +12977,7 @@ async function scaffoldModule(workspace, request) {
       `Module specification is invalid: ${specReport.issues.filter((issue2) => issue2.severity === "error").map((issue2) => issue2.message).join("; ")}`
     );
   }
-  const specSource = await readFile21(specPath, "utf8");
+  const specSource = await readFile19(specPath, "utf8");
   const spec = parseYaml6(specSource);
   if (spec.id !== request.id)
     throw new Error(
@@ -12808,7 +12989,7 @@ async function scaffoldModule(workspace, request) {
     );
   const existingManifests = (await findNamedFiles(workspace.root, "module.json")).filter((path) => path.includes("/modules/"));
   for (const path of existingManifests) {
-    const existing = JSON.parse(await readFile21(path, "utf8"));
+    const existing = JSON.parse(await readFile19(path, "utf8"));
     if (existing.id === request.id) {
       throw new Error(
         `Module id "${request.id}" is already registered by ${relative11(workspace.root, path)}.`
@@ -12817,7 +12998,7 @@ async function scaffoldModule(workspace, request) {
   }
   const moduleDirectory = resolveInside(
     workspace.root,
-    join18("modules", packageSuffix(request.id))
+    join17("modules", packageSuffix(request.id))
   );
   const target = await inspectTarget(
     workspace.root,
@@ -12839,8 +13020,8 @@ async function scaffoldModule(workspace, request) {
     applied: request.apply,
     formatted,
     moduleDirectory: moduleRelative,
-    files: [...planned.keys()].map((path) => join18(moduleRelative, path)),
-    skipped: [...planned.keys()].filter((path) => target.present.has(path)).map((path) => join18(moduleRelative, path))
+    files: [...planned.keys()].map((path) => join17(moduleRelative, path)),
+    skipped: [...planned.keys()].filter((path) => target.present.has(path)).map((path) => join17(moduleRelative, path))
   };
 }
 async function formatFiles(moduleDirectory, files, formatter) {
@@ -12848,7 +13029,7 @@ async function formatFiles(moduleDirectory, files, formatter) {
   for (const [path, source] of files) {
     formatted.set(
       path,
-      await formatter.format(join18(moduleDirectory, path), source)
+      await formatter.format(join17(moduleDirectory, path), source)
     );
   }
   return formatted;
@@ -12859,20 +13040,15 @@ import { constants as constants2 } from "node:fs";
 import {
   chmod as chmod3,
   copyFile as copyFile2,
-  lstat as lstat7,
+  lstat as lstat6,
   mkdir as mkdir11,
   readdir as readdir9,
-  readFile as readFile22,
+  readFile as readFile20,
   rm as rm10,
   stat as stat3
 } from "node:fs/promises";
-import { dirname as dirname15, join as join19, relative as relative12 } from "node:path";
+import { dirname as dirname15, join as join18, relative as relative12 } from "node:path";
 import { createHash as createHash7 } from "node:crypto";
-
-// ../kernel/src/legacy-local-state.ts
-var LEGACY_DATA_DIRECTORY = ".octane-erp";
-
-// src/state-migration.ts
 var STATE_FILES = [
   "agent-credential.key",
   "agent-run-grant.key",
@@ -12886,7 +13062,7 @@ function isMissing(error) {
 }
 async function pathState(path) {
   try {
-    return await lstat7(path);
+    return await lstat6(path);
   } catch (error) {
     if (isMissing(error)) return void 0;
     throw error;
@@ -12896,9 +13072,9 @@ function relativePath(workspace, path) {
   return relative12(workspace.root, path);
 }
 async function migrationPlan(workspace) {
-  const sourceDirectory = join19(workspace.root, LEGACY_DATA_DIRECTORY);
+  const sourceDirectory = join18(workspace.root, LEGACY_DATA_DIRECTORY);
   const stateDirectory = flowdularStateDirectory(workspace.root);
-  const destinationDirectory = join19(stateDirectory, "data");
+  const destinationDirectory = join18(stateDirectory, "data");
   const destinationLabel = relativePath(workspace, destinationDirectory);
   const blockers = [];
   const missing = [];
@@ -12936,8 +13112,8 @@ async function migrationPlan(workspace) {
     if (isLegacyDatabase(name)) unsupported.push(name);
   }
   for (const name of STATE_FILES) {
-    const source = join19(sourceDirectory, name);
-    const destination = join19(destinationDirectory, name);
+    const source = join18(sourceDirectory, name);
+    const destination = join18(destinationDirectory, name);
     const sourceFile = await pathState(source);
     if (!sourceFile) {
       missing.push(name);
@@ -12963,7 +13139,7 @@ async function migrationPlan(workspace) {
   };
 }
 async function digest(path) {
-  return createHash7("sha256").update(await readFile22(path)).digest("hex");
+  return createHash7("sha256").update(await readFile20(path)).digest("hex");
 }
 async function ensurePrivateDirectory(path) {
   try {
@@ -12972,7 +13148,7 @@ async function ensurePrivateDirectory(path) {
     if (!(error instanceof Error && "code" in error && error.code === "EEXIST"))
       throw error;
   }
-  const state = await lstat7(path);
+  const state = await lstat6(path);
   if (state.isSymbolicLink() || !state.isDirectory()) {
     throw new Error(`${path} is not a safe local state directory.`);
   }
@@ -12984,7 +13160,7 @@ async function copyPlan(plan) {
   const created = [];
   try {
     for (const file of plan.files) {
-      const sourceState = await lstat7(file.source);
+      const sourceState = await lstat6(file.source);
       if (sourceState.isSymbolicLink() || !sourceState.isFile()) {
         throw new Error(`${file.name} is no longer a regular file.`);
       }
@@ -13064,7 +13240,7 @@ async function migrateLegacyState(workspace, apply) {
   }
   return success(data(plan, true), {
     evidence: plan.files.map(
-      (file) => relativePath(workspace, join19(plan.destinationDirectory, file.name))
+      (file) => relativePath(workspace, join18(plan.destinationDirectory, file.name))
     ),
     warnings: [
       ...unsupportedWarnings(plan),
@@ -13074,8 +13250,8 @@ async function migrateLegacyState(workspace, apply) {
 }
 
 // src/module-version.ts
-import { readFile as readFile23, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname16, join as join20, relative as relative13 } from "node:path";
+import { readFile as readFile21, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname16, join as join19, relative as relative13 } from "node:path";
 var LOCK2 = "flowdular.modules.lock.json";
 var LEVELS = ["patch", "minor", "major"];
 function specDirectory(workspace) {
@@ -13085,7 +13261,7 @@ function specDirectory(workspace) {
 async function loadModules(workspace) {
   const modules = [];
   for (const file of await findModuleFiles(workspace)) {
-    const manifest2 = JSON.parse(await readFile23(file, "utf8"));
+    const manifest2 = JSON.parse(await readFile21(file, "utf8"));
     modules.push({ file, root: dirname16(file), manifest: manifest2 });
   }
   return modules;
@@ -13093,7 +13269,7 @@ async function loadModules(workspace) {
 async function installerManaged(workspace, id) {
   try {
     const lock = JSON.parse(
-      await readFile23(join20(workspace.root, LOCK2), "utf8")
+      await readFile21(join19(workspace.root, LOCK2), "utf8")
     );
     return (lock.modules ?? []).some((entry) => entry.id === id);
   } catch (error) {
@@ -13136,7 +13312,7 @@ function specRangeEdit(source, id, range) {
 }
 async function readOptional(path) {
   try {
-    return await readFile23(path, "utf8");
+    return await readFile21(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
@@ -13168,7 +13344,7 @@ async function bumpModuleVersion(workspace, options) {
   const files = [];
   const manual = [];
   const rel = (path) => relative13(workspace.root, path);
-  const manifestSource = await readFile23(target.file, "utf8");
+  const manifestSource = await readFile21(target.file, "utf8");
   const manifestNext = versionKeyEdit(manifestSource, previous, next);
   if (!manifestNext)
     return failure(
@@ -13180,7 +13356,7 @@ async function bumpModuleVersion(workspace, options) {
     path: rel(target.file),
     change: `version ${previous} -> ${next}`
   });
-  const packagePath = join20(target.root, "package.json");
+  const packagePath = join19(target.root, "package.json");
   const packageSource = await readOptional(packagePath);
   if (packageSource) {
     const edited = versionKeyEdit(packageSource, previous, next);
@@ -13192,7 +13368,7 @@ async function bumpModuleVersion(workspace, options) {
       });
     } else manual.push(`${rel(packagePath)}: version is not ${previous}`);
   }
-  const specPath = join20(target.root, spec, "module.yaml");
+  const specPath = join19(target.root, spec, "module.yaml");
   const specSource = await readOptional(specPath);
   if (specSource) {
     const edited = specVersionEdit(specSource, previous, next);
@@ -13221,7 +13397,7 @@ async function bumpModuleVersion(workspace, options) {
       continue;
     }
     if (range === dependency.range) continue;
-    const source = await readFile23(dependent.file, "utf8");
+    const source = await readFile21(dependent.file, "utf8");
     const edited = manifestRangeEdit(source, options.id, range);
     if (!edited) {
       manual.push(
@@ -13234,7 +13410,7 @@ async function bumpModuleVersion(workspace, options) {
       path: rel(dependent.file),
       change: `${options.id} ${dependency.range} -> ${range}`
     });
-    const dependentSpecPath = join20(dependent.root, spec, "module.yaml");
+    const dependentSpecPath = join19(dependent.root, spec, "module.yaml");
     const dependentSpec = await readOptional(dependentSpecPath);
     if (!dependentSpec) continue;
     const specEdited = specRangeEdit(dependentSpec, options.id, range);
@@ -13379,7 +13555,7 @@ async function runExtensionCommand(workspace, extension, arguments_) {
         { report }
       );
     }
-    const spec = parseYaml7(await readFile24(specPath, "utf8"));
+    const spec = parseYaml7(await readFile22(specPath, "utf8"));
     if (spec.status !== "approved") {
       return failure(
         "SPEC_NOT_APPROVED",
@@ -13595,7 +13771,7 @@ async function runCommand(arguments_) {
       if (arguments_.flags.has("all")) {
         const platformRoot = workspace.config.specs?.platformRoot ?? "specs";
         const platformSpecs = await listPlatformSpecs(
-          join21(workspace.root, platformRoot)
+          join20(workspace.root, platformRoot)
         );
         reports.push(
           ...await Promise.all(
@@ -14012,7 +14188,7 @@ async function runCommand(arguments_) {
                   ["apply", true]
                 ])
               }
-            );
+            ).catch(commandFailure);
             if (!granted.ok) {
               return failure(
                 "MODULE_SCOPES_SYNC_FAILED",
@@ -14088,23 +14264,20 @@ async function runCommand(arguments_) {
       `Unknown command: ${arguments_.positionals.join(" ")}`
     );
   } catch (error) {
-    return failure(
-      error instanceof ModuleDistributionError || error instanceof RegistryError || error instanceof DatabaseMigrationError ? error.code : "COMMAND_FAILED",
-      error instanceof Error ? error.message : String(error)
-    );
+    return commandFailure(error);
   }
 }
 
 // src/program.ts
 import { loadEnvFile } from "node:process";
-import { resolve as resolve8 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 async function runProgram(arguments_) {
   try {
     const workspace = await findWorkspace(
       stringFlag(arguments_, "root") ?? process.cwd()
     );
     try {
-      loadEnvFile(resolve8(workspace.root, ".env"));
+      loadEnvFile(resolve10(workspace.root, ".env"));
     } catch (error) {
       if (error.code !== "ENOENT")
         return failure(
@@ -14126,20 +14299,20 @@ import { stat as stat4 } from "node:fs/promises";
 
 // src/setup-environment.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { lstat as lstat8, open as open3, readFile as readFile25, rename as rename7, rm as rm11, writeFile as writeFile12 } from "node:fs/promises";
-import { join as join22 } from "node:path";
+import { lstat as lstat7, open as open3, readFile as readFile23, rename as rename7, rm as rm11, writeFile as writeFile12 } from "node:fs/promises";
+import { join as join21 } from "node:path";
 async function readSetupEnvironment(root) {
   try {
-    return await readFile25(join22(root, ".env"), "utf8");
+    return await readFile23(join21(root, ".env"), "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return "";
     throw error;
   }
 }
 async function saveSetupEnvironment(root, before, updates) {
-  const path = join22(root, ".env");
+  const path = join21(root, ".env");
   try {
-    if (!(await lstat8(path)).isFile())
+    if (!(await lstat7(path)).isFile())
       throw new Error("Setup requires .env to be a regular file.");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
@@ -14161,8 +14334,8 @@ async function saveSetupEnvironment(root, before, updates) {
     return false;
   });
   const source = lines.join("\n").trimEnd() + "\n" + Object.entries(updates).map(([key, value]) => `${key}='${value}'`).join("\n") + "\n";
-  const temporary = join22(root, `.env.setup-${randomUUID6()}.tmp`);
-  const lockPath = join22(root, ".env.setup.lock");
+  const temporary = join21(root, `.env.setup-${randomUUID6()}.tmp`);
+  const lockPath = join21(root, ".env.setup.lock");
   const lock = await open3(lockPath, "wx", 384);
   try {
     await writeFile12(temporary, source, { mode: 384, flag: "wx" });