nymbal 1.0.0 → 1.2.0

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { defineCommand as defineCommand8, runMain } from "citty";
+import { defineCommand as defineCommand15, runMain } from "citty";
 
 // src/utils/version.ts
 import { readFileSync } from "fs";
@@ -26,8 +26,10 @@ function getCliVersion() {
 }
 
 // src/commands/dev.ts
+import { resolve as resolve4 } from "path";
 import { defineCommand as defineCommand2 } from "citty";
 import pc from "picocolors";
+import { KNOWN_PROVIDERS } from "@nymbalhq/config";
 
 // src/utils/project.ts
 import { existsSync } from "fs";
@@ -43,22 +45,22 @@ async function loadProject(startDir = process.cwd()) {
 }
 
 // src/commands/dev.ts
-import { createApp, runSeed } from "@nymbalhq/platform";
+import { createApp, createLogger, runSeed, sqliteFile } from "@nymbalhq/platform";
 import { createHttpServer } from "@nymbalhq/http";
 
 // src/utils/spawn.ts
 import { spawn } from "child_process";
 function run(command, args, options = {}) {
-  const child = spawn(command, args, {
+  const child2 = spawn(command, args, {
     stdio: "inherit",
     shell: false,
     ...options
   });
-  const done = new Promise((resolve4, reject) => {
-    child.on("error", reject);
-    child.on("exit", (code) => resolve4(code ?? 0));
+  const done = new Promise((resolve10, reject) => {
+    child2.on("error", reject);
+    child2.on("exit", (code) => resolve10(code ?? 0));
   });
-  return { child, done };
+  return { child: child2, done };
 }
 async function runOrFail(command, args, options = {}) {
   const { done } = run(command, args, options);
@@ -71,16 +73,16 @@ async function runOrFail(command, args, options = {}) {
 // src/utils/port.ts
 import { createServer } from "net";
 async function isPortFree(port, host) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve10) => {
     const server = createServer();
-    server.once("error", (err) => {
-      if (err.code !== "EADDRINUSE" && err.code !== "EACCES") {
-        console.error(`[dev] unexpected error probing port ${port}:`, err.message);
+    server.once("error", (err2) => {
+      if (err2.code !== "EADDRINUSE" && err2.code !== "EACCES") {
+        console.error(`[dev] unexpected error probing port ${port}:`, err2.message);
       }
-      resolve4(false);
+      resolve10(false);
     });
     server.once("listening", () => {
-      server.close(() => resolve4(true));
+      server.close(() => resolve10(true));
     });
     if (host) {
       server.listen(port, host);
@@ -233,16 +235,16 @@ async function runShutdown(steps, opts) {
       pending = step.name;
       try {
         await step.run();
-      } catch (err) {
+      } catch (err2) {
         failed = true;
-        opts.logger.error({ err, step: step.name }, `Shutdown step "${step.name}" failed`);
+        opts.logger.error({ err: err2, step: step.name }, `Shutdown step "${step.name}" failed`);
       }
     }
     pending = void 0;
   })();
   let timer;
-  const bound = new Promise((resolve4) => {
-    timer = setTimeout(() => resolve4("bound"), opts.boundMs);
+  const bound = new Promise((resolve10) => {
+    timer = setTimeout(() => resolve10("bound"), opts.boundMs);
   });
   const outcome = await Promise.race([work.then(() => "done"), bound]);
   clearTimeout(timer);
@@ -256,6 +258,63 @@ async function runShutdown(steps, opts) {
   return opts.exit(failed ? 1 : 0);
 }
 
+// src/commands/dev-summary.ts
+import { displayUrl } from "@nymbalhq/types";
+var WIDTH = 100;
+var LABEL = 14;
+var NAME_COLUMN = 20;
+var columns = (text2) => [...text2].length;
+function fit(text2, width = WIDTH) {
+  return columns(text2) <= width ? text2 : `${[...text2].slice(0, width - 1).join("")}\u2026`;
+}
+function row(label, value) {
+  return fit(`  ${label.padEnd(LABEL)} ${value}`);
+}
+function capabilityList(capabilities, width) {
+  if (capabilities.length === 0) return "\u2014";
+  const all = capabilities.join(", ");
+  if (columns(all) <= width) return all;
+  for (let shown = capabilities.length - 1; shown > 0; shown--) {
+    const text2 = `${capabilities.slice(0, shown).join(", ")}, \u2026 (+${capabilities.length - shown})`;
+    if (columns(text2) <= width) return text2;
+  }
+  return `\u2026 (+${capabilities.length})`;
+}
+function renderDevSummary(info) {
+  const slotWidth = Math.min(NAME_COLUMN, Math.max(...info.slots.map((s) => columns(s.slot)), 0));
+  const providerWidth = Math.min(
+    NAME_COLUMN,
+    Math.max(...info.slots.map((s) => columns(s.provider)), 0)
+  );
+  const slotLines = info.slots.map(({ slot, provider, capabilities }) => {
+    const lead = `  ${slot.padEnd(slotWidth)}  ${provider.padEnd(providerWidth)}  `;
+    return fit(`${lead}${capabilityList(capabilities, WIDTH - columns(lead))}`);
+  });
+  const commandStore = info.commandStore.kind === "sqlite" ? `sqlite  ${info.commandStore.path}` : `postgres  ${displayUrl(info.commandStore.url)}`;
+  const lines = [
+    fit(`  ${info.store}`),
+    "",
+    row("API", info.apiUrl),
+    row(
+      "storefront",
+      info.storefront === null ? "not started (--api-only)" : `${info.storefront.url}  (${info.storefront.template})`
+    ),
+    row(
+      "admin",
+      info.admin === null ? "not built \u2014 run pnpm --filter @nymbalhq/admin build" : info.admin.url
+    ),
+    row("command store", commandStore),
+    "",
+    ...slotLines,
+    "",
+    ...info.primitives.map(({ name, provider }) => row(name, provider)),
+    "",
+    "  Debug logs: run with --verbose (or LOG_LEVEL=debug)."
+  ];
+  return `${lines.join("\n")}
+`;
+}
+
 // src/commands/dev.ts
 function defaultStorefrontPort(template) {
   return template === "astro" ? 4321 : 3e3;
@@ -269,13 +328,7 @@ function preferredStorefrontPort(template, flagPort, env) {
   }
   return defaultStorefrontPort(template);
 }
-function storefrontEnv(config, apiUrl, storefrontPort, baseEnv = process.env) {
-  const stubPayments = config.commerce.payments.provider === "stripe" ? {} : {
-    PUBLIC_NYMBAL_PAYMENTS_PROVIDER: "native-stub",
-    // Astro
-    NEXT_PUBLIC_NYMBAL_PAYMENTS_PROVIDER: "native-stub"
-    // Next.js
-  };
+function storefrontEnv(_config, apiUrl, storefrontPort, baseEnv = process.env) {
   return {
     ...baseEnv,
     NYMBAL_API_URL: apiUrl,
@@ -285,8 +338,31 @@ function storefrontEnv(config, apiUrl, storefrontPort, baseEnv = process.env) {
     // Next.js
     // The framework also reads the port flag; the env var keeps the scaffold
     // config (astro.config.mjs) in sync when it honours NYMBAL_STOREFRONT_PORT.
-    NYMBAL_STOREFRONT_PORT: String(storefrontPort),
-    ...stubPayments
+    NYMBAL_STOREFRONT_PORT: String(storefrontPort)
+  };
+}
+function devLogLevel(verbose, env) {
+  const fromEnv = env["LOG_LEVEL"];
+  if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
+  return verbose ? "debug" : "info";
+}
+function summaryInfo(config, app, apiUrl, storefront, adminBuilt) {
+  const report = app.capabilities();
+  return {
+    store: config.store.name,
+    apiUrl,
+    storefront,
+    admin: adminBuilt ? { url: `${apiUrl}/admin/` } : null,
+    commandStore: config.infrastructure.commandStore === "sqlite" ? { kind: "sqlite", path: resolve4(sqliteFile()) } : { kind: "postgres", url: process.env["DATABASE_URL"] ?? "" },
+    slots: Object.keys(KNOWN_PROVIDERS).map((slot) => ({
+      slot,
+      provider: report[slot].provider,
+      capabilities: report[slot].capabilities
+    })),
+    primitives: ["documentStore", "eventBus", "media"].map((name) => ({
+      name,
+      provider: report[name].provider
+    }))
   };
 }
 function apiPort(config, flagPort) {
@@ -328,6 +404,11 @@ var devCommand = defineCommand2({
       type: "string",
       alias: "storefront-port",
       description: "Port for the storefront dev server (default: 4321 Astro / 3000 Next.js). If busy, the next free port is used. Also settable via NYMBAL_STOREFRONT_PORT."
+    },
+    verbose: {
+      type: "boolean",
+      description: "Log at debug (LOG_LEVEL, when set, wins)",
+      default: false
     }
   },
   async run({ args }) {
@@ -337,7 +418,15 @@ var devCommand = defineCommand2({
     const config = { ...loaded.config, http: { ...loaded.config.http, port } };
     const version = getCliVersion();
     await migrateProject(config, projectRoot);
-    const app = await createApp(config, { version });
+    const logger = createLogger({
+      base: { store: config.store.name },
+      level: devLogLevel(args.verbose, process.env)
+    });
+    const app = await createApp(config, {
+      version,
+      logger,
+      ...loaded.adapters !== void 0 && { adapters: loaded.adapters }
+    });
     const { platform } = app;
     if (args.seed) {
       const existing = await platform.documentStore.query("products", {
@@ -352,7 +441,8 @@ var devCommand = defineCommand2({
           documentStore: platform.documentStore,
           eventBus: platform.eventBus,
           logger: platform.logger,
-          version
+          version,
+          search: app.adapters.search
         });
       }
     }
@@ -363,15 +453,14 @@ var devCommand = defineCommand2({
       version
     });
     const adminRoot = resolveAdminRoot();
-    if (adminRoot === null) {
-      console.log(
-        pc.yellow(
-          "\u2192 The admin is not built, so /admin/ answers 404: run `pnpm --filter @nymbalhq/admin build`."
-        )
-      );
-    }
     await app.attachHttp(http.adapter, { adminRoot });
     await http.start();
+    const apiUrl = `http://localhost:${config.http.port}`;
+    const printSummary = (storefront) => {
+      console.log(
+        renderDevSummary(summaryInfo(config, app, apiUrl, storefront, adminRoot !== null))
+      );
+    };
     const stopApi = [
       { name: "http.stop", run: () => http.stop() },
       { name: "app.stop", run: () => app.stop() }
@@ -382,6 +471,7 @@ var devCommand = defineCommand2({
       exit: (code) => process.exit(code)
     });
     if (args.apiOnly) {
+      printSummary(null);
       const shutdown2 = (signal) => {
         platform.logger.info({ signal }, "Shutting down API");
         return shutdownWith(stopApi);
@@ -402,18 +492,12 @@ var devCommand = defineCommand2({
       );
     }
     const launch = planTemplateLaunch(projectRoot, config.template, storefrontPort);
-    const apiUrl = `http://localhost:${config.http.port}`;
     const storefrontUrl = `http://localhost:${storefrontPort}`;
-    console.log(
-      pc.cyan(
-        `\u2192 Starting storefront (${pc.bold(config.template)}, ${launch.mode}) on ${pc.bold(storefrontUrl)}`
-      )
-    );
-    console.log(pc.dim(`  API: ${apiUrl}`));
     const templateProc = run(launch.command, launch.args, {
       cwd: launch.cwd,
       env: storefrontEnv(config, apiUrl, storefrontPort)
     });
+    printSummary({ template: `${config.template}, ${launch.mode}`, url: storefrontUrl });
     let shuttingDown = false;
     const shutdown = (signal) => {
       shuttingDown = true;
@@ -462,13 +546,31 @@ var buildCommand = defineCommand3({
 
 // src/commands/seed.ts
 import { defineCommand as defineCommand4 } from "citty";
-import { createPlatform, runSeed as runSeed2 } from "@nymbalhq/platform";
+import { createPlatform, resolvePrimitives, runSeed as runSeed2 } from "@nymbalhq/platform";
 var seedCommand = defineCommand4({
   meta: { name: "seed", description: "Re-seed demo content (products, categories)" },
-  async run() {
+  args: {
+    localImages: {
+      type: "boolean",
+      // citty registers the camelCase key only; the alias maps the kebab flag onto it (see `dev --api-only`).
+      alias: "local-images",
+      description: "Write the product images through the store's media slot instead of linking a placeholder host",
+      default: false
+    },
+    mediaRoot: {
+      type: "string",
+      alias: "media-root",
+      description: "Where local-fs media is written (default: public/imported-media)"
+    }
+  },
+  async run({ args }) {
     const { config, projectRoot } = await loadProject();
     await migrateProject(config, projectRoot);
-    const platform = createPlatform(config);
+    const mediaRoot = typeof args.mediaRoot === "string" && args.mediaRoot !== "" ? args.mediaRoot : void 0;
+    const platform = createPlatform(
+      config,
+      await resolvePrimitives(config, mediaRoot === void 0 ? {} : { mediaRoot })
+    );
     try {
       const result = await runSeed2({
         config,
@@ -476,7 +578,8 @@ var seedCommand = defineCommand4({
         documentStore: platform.documentStore,
         eventBus: platform.eventBus,
         logger: platform.logger,
-        version: getCliVersion()
+        version: getCliVersion(),
+        ...args.localImages && { media: platform.media }
       });
       console.log(
         result.alreadySeeded ? "\u2713 demo content already present, nothing to seed" : `\u2713 seeded ${result.products} products across ${result.categories} categories`
@@ -490,8 +593,8 @@ var seedCommand = defineCommand4({
 // src/commands/import.ts
 import { defineCommand as defineCommand5 } from "citty";
 import { intro, outro, text, select, spinner, isCancel, cancel } from "@clack/prompts";
-import * as p from "picocolors";
-import { createApp as createApp2 } from "@nymbalhq/platform";
+import p from "picocolors";
+import { createApp as createApp2, newCorrelationId, runAsActor, runWithCorrelation } from "@nymbalhq/platform";
 import { runWooCommerceImport, writeReport } from "@nymbalhq/importers";
 import { join as join3 } from "path";
 var importCommand = defineCommand5({
@@ -619,34 +722,38 @@ var importCommand = defineCommand5({
     const app = await createApp2(config, { version: getCliVersion() });
     loadSpin.stop("Platform ready");
     try {
-      const report = await runWooCommerceImport(
-        {
-          credentials: { url: storeUrl, consumerKey, consumerSecret },
-          entities: entityList,
-          ai: aiEnabled,
-          gdpr: gdprEnabled,
-          fresh: args.fresh,
-          concurrency,
-          projectRoot,
-          currency: config.store.currency,
-          statePath
-        },
-        {
-          services: app.services,
-          repos: app.repos,
-          adapters: { ai: app.adapters.ai, reviews: app.adapters.reviews },
-          onProgress(event) {
-            if (event.kind === "phase") {
-              console.log(p.cyan(`  \u2192 ${event.phase}`));
-            } else if (event.kind === "progress") {
-              const pct = Math.round(event.done / event.total * 100);
-              process.stdout.write(`\r  ${event.entity}: ${event.done}/${event.total} (${pct}%)  `);
-              if (event.done === event.total) process.stdout.write("\n");
-            } else if (event.kind === "error") {
-              console.log(p.red(`  \u2717 ${event.phase} [${event.id}]: ${event.message}`));
+      const report = await runWithCorrelation(
+        newCorrelationId("import:woocommerce"),
+        () => runAsActor({ kind: "import", id: "woocommerce" }, () => runWooCommerceImport(
+          {
+            credentials: { url: storeUrl, consumerKey, consumerSecret },
+            entities: entityList,
+            ai: aiEnabled,
+            gdpr: gdprEnabled,
+            fresh: args.fresh,
+            concurrency,
+            projectRoot,
+            currency: config.store.currency,
+            statePath
+          },
+          {
+            services: app.services,
+            repos: app.repos,
+            adapters: { ai: app.adapters.ai, reviews: app.adapters.reviews },
+            media: app.platform.media,
+            onProgress(event) {
+              if (event.kind === "phase") {
+                console.log(p.cyan(`  \u2192 ${event.phase}`));
+              } else if (event.kind === "progress") {
+                const pct = Math.round(event.done / event.total * 100);
+                process.stdout.write(`\r  ${event.entity}: ${event.done}/${event.total} (${pct}%)  `);
+                if (event.done === event.total) process.stdout.write("\n");
+              } else if (event.kind === "error") {
+                console.log(p.red(`  \u2717 ${event.phase} [${event.id}]: ${event.message}`));
+              }
             }
           }
-        }
+        ))
       );
       const reportPath = await writeReport(report, projectRoot, config.store.name);
       outro(
@@ -680,34 +787,1690 @@ var configValidateCommand = defineCommand6({
       const { config, path } = await loadProject();
       console.log(pc2.green(`\u2713 config valid`) + ` (${path})`);
       console.log(
-        `  template: ${config.template}, cloud: ${config.infrastructure.cloud}, commandStore: ${config.infrastructure.commandStore}`
+        `  template: ${config.template}, commandStore: ${config.infrastructure.commandStore}, documentStore: ${config.infrastructure.documentStore}, eventBus: ${config.infrastructure.eventBus}`
       );
       process.exit(0);
-    } catch (err) {
-      if (err instanceof NymbalError) {
+    } catch (err2) {
+      if (err2 instanceof NymbalError) {
         console.error(pc2.red("\u2717 config invalid"));
-        console.error(err.message);
+        console.error(err2.message);
       } else {
-        console.error(err);
+        console.error(err2);
       }
       process.exit(1);
     }
   }
 });
 
-// src/commands/test.ts
+// src/commands/add.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync6, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
+import { dirname as dirname6, join as join5 } from "path";
+import { parseEnv } from "util";
 import { defineCommand as defineCommand7 } from "citty";
-import { loadConfig as loadConfig2 } from "@nymbalhq/config";
-var testCommand = defineCommand7({
+import pc3 from "picocolors";
+import { findConfigFile as findConfigFile2, loadConfig as loadConfig2 } from "@nymbalhq/config";
+import { installLine } from "@nymbalhq/platform";
+
+// src/recipes/holders.ts
+import { existsSync as existsSync5 } from "fs";
+import { readFile } from "fs/promises";
+import { createRequire as createRequire2 } from "module";
+import { dirname as dirname5, join as join4, resolve as resolve5 } from "path";
+import { pathToFileURL } from "url";
+var RECIPE_HOLDERS = {
+  cloudflare: "@nymbalhq/security-cloudflare",
+  postgres: "@nymbalhq/platform",
+  redis: "@nymbalhq/doc-store-redis",
+  s3: "@nymbalhq/media-s3",
+  stripe: "@nymbalhq/adapter-stripe"
+};
+function knownRecipes() {
+  return Object.keys(RECIPE_HOLDERS).sort();
+}
+function isKnownRecipe(name) {
+  return Object.hasOwn(RECIPE_HOLDERS, name);
+}
+function unknownRecipe(name) {
+  return new Error(`unknown recipe '${name}': the recipes are ${knownRecipes().join(", ")}`);
+}
+function packageDir(pkg, projectRoot) {
+  let dir = resolve5(projectRoot);
+  while (true) {
+    const candidate = join4(dir, "node_modules", pkg);
+    if (existsSync5(join4(candidate, "package.json"))) return candidate;
+    const parent = dirname5(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function recipeFile(name, projectRoot) {
+  const holder = RECIPE_HOLDERS[name];
+  if (holder === void 0 || !isKnownRecipe(name)) throw unknownRecipe(name);
+  const dir = packageDir(holder, projectRoot);
+  if (dir === null) return null;
+  try {
+    return createRequire2(join4(dir, "package.json")).resolve(`${holder}/recipes/${name}.json`);
+  } catch (error) {
+    const code = error.code;
+    if (code === "MODULE_NOT_FOUND" || code === "ERR_PACKAGE_PATH_NOT_EXPORTED") return null;
+    throw error;
+  }
+}
+function isInstalled(pkg, projectRoot) {
+  return packageDir(pkg, projectRoot) !== null;
+}
+async function readRecipe(name, projectRoot) {
+  const file = recipeFile(name, projectRoot);
+  if (file === null) {
+    throw new Error(
+      `${RECIPE_HOLDERS[name]} is not installed in ${projectRoot}, so its ${name} recipe cannot be read`
+    );
+  }
+  const recipe = JSON.parse(await readFile(file, "utf8"));
+  const malformed = recipe === null || typeof recipe !== "object" || recipe.name !== name || !Array.isArray(recipe.install) || !Array.isArray(recipe.set) || !Array.isArray(recipe.env) || !Array.isArray(recipe.next);
+  if (malformed) throw new Error(`${file} is not a ${name} recipe`);
+  return recipe;
+}
+function entryOf(dir, manifest) {
+  const exportsField = manifest["exports"];
+  const root = typeof exportsField === "object" ? exportsField["."] : exportsField;
+  const entry = typeof root === "string" ? root : typeof root === "object" && root !== null ? root["import"] ?? root["default"] : manifest["module"] ?? manifest["main"];
+  return typeof entry === "string" ? join4(dir, entry) : null;
+}
+async function settingsEnv(packages, projectRoot) {
+  const names = /* @__PURE__ */ new Set();
+  for (const pkg of packages.filter((p2) => p2.startsWith("@nymbalhq/"))) {
+    const dir = packageDir(pkg, projectRoot);
+    if (dir === null) continue;
+    const manifest = JSON.parse(await readFile(join4(dir, "package.json"), "utf8"));
+    const entry = entryOf(dir, manifest);
+    if (entry === null || !existsSync5(entry)) continue;
+    let mod;
+    try {
+      mod = await import(pathToFileURL(entry).href);
+    } catch (error) {
+      if (error.code === "ERR_MODULE_NOT_FOUND") continue;
+      throw error;
+    }
+    if (!Array.isArray(mod.settings)) continue;
+    for (const setting of mod.settings) {
+      if (typeof setting?.env === "string") names.add(setting.env);
+    }
+  }
+  return names;
+}
+
+// src/recipes/config-edit.ts
+import { parseModule } from "magicast";
+var SCAFFOLD_DEFAULTS = [
+  "sqlite",
+  "in-memory",
+  "in-process",
+  "local-fs",
+  "native",
+  "middleware"
+];
+var CONFIG_MODULE = "@nymbalhq/config";
+var child = (node, key) => node[key];
+var children = (node, key) => node[key];
+function parse(lf) {
+  return parseModule(lf, { tabWidth: 1 }).$ast;
+}
+var lfCopy = (source) => source.replace(/\r\n/g, "\n");
+function unwrap(node) {
+  let at = node;
+  while (at !== void 0 && (at.type === "TSAsExpression" || at.type === "TSSatisfiesExpression" || at.type === "TSNonNullExpression" || at.type === "ParenthesizedExpression")) {
+    at = child(at, "expression");
+  }
+  return at;
+}
+function nameOf(node) {
+  if (node.type === "Identifier") return node["name"];
+  if (node.type === "StringLiteral") return node["value"];
+  if (node.type === "NumericLiteral") return String(node["value"]);
+  return void 0;
+}
+function configImports(program) {
+  return children(program, "body").filter(
+    (n) => n.type === "ImportDeclaration" && child(n, "source")["value"] === CONFIG_MODULE && n["importKind"] !== "type"
+  );
+}
+function importedAs(program, imported) {
+  for (const decl of configImports(program)) {
+    for (const spec of children(decl, "specifiers")) {
+      if (spec.type !== "ImportSpecifier" || spec["importKind"] === "type") continue;
+      if (nameOf(child(spec, "imported")) === imported)
+        return child(spec, "local")["name"];
+    }
+  }
+  return void 0;
+}
+function bindsEnv(program) {
+  const bound = (id) => id?.type === "Identifier" && id["name"] === "env";
+  return children(program, "body").some((n) => {
+    const decl = n.type === "ExportNamedDeclaration" ? child(n, "declaration") : n;
+    if (decl === null || decl === void 0) return false;
+    if (decl.type === "ImportDeclaration")
+      return children(decl, "specifiers").some((s) => bound(child(s, "local")));
+    if (decl.type === "VariableDeclaration")
+      return children(decl, "declarations").some((d) => bound(child(d, "id")));
+    return bound(child(decl, "id"));
+  });
+}
+function locate(source) {
+  const program = parse(source);
+  const exported = children(program, "body").find((n) => n.type === "ExportDefaultDeclaration");
+  if (exported === void 0) return void 0;
+  let config = unwrap(child(exported, "declaration"));
+  if (config?.type === "CallExpression") {
+    const callee = child(config, "callee");
+    const define = importedAs(program, "defineConfig") ?? "defineConfig";
+    if (callee.type !== "Identifier" || callee["name"] !== define) return void 0;
+    config = unwrap(children(config, "arguments")[0]);
+  }
+  if (config?.type !== "ObjectExpression") return void 0;
+  if (source[config.start] !== "{" || source[config.end - 1] !== "}") return void 0;
+  return {
+    program,
+    config,
+    envName: importedAs(program, "env"),
+    envBound: bindsEnv(program),
+    namedImport: configImports(program).find(
+      (d) => children(d, "specifiers").some((s) => s.type === "ImportSpecifier")
+    )
+  };
+}
+function isEnvRef(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const keys = Object.keys(value);
+  return typeof value.env === "string" && keys.every((k) => k === "env" || k === "default");
+}
+function evaluate(node, envName) {
+  const at = unwrap(node);
+  switch (at.type) {
+    case "StringLiteral":
+    case "NumericLiteral":
+    case "BooleanLiteral":
+      return at["value"];
+    case "TemplateLiteral": {
+      const quasis = children(at, "quasis");
+      return children(at, "expressions").length === 0 ? (quasis[0]?.["value"]).cooked : void 0;
+    }
+    case "ObjectExpression": {
+      const out2 = {};
+      for (const prop of children(at, "properties")) {
+        const key = prop.type === "ObjectProperty" && !prop["computed"] ? nameOf(child(prop, "key")) : void 0;
+        const value = key === void 0 ? void 0 : evaluate(child(prop, "value"), envName);
+        if (key === void 0 || value === void 0) return void 0;
+        out2[key] = value;
+      }
+      return out2;
+    }
+    case "CallExpression": {
+      const callee = child(at, "callee");
+      const args = children(at, "arguments");
+      if (callee.type !== "Identifier" || callee["name"] !== (envName ?? "env")) return void 0;
+      if (args.length < 1 || args.length > 2 || args.some((a) => a.type !== "StringLiteral"))
+        return void 0;
+      return {
+        env: args[0]["value"],
+        ...args[1] !== void 0 && { default: args[1]["value"] }
+      };
+    }
+    default:
+      return void 0;
+  }
+}
+function sameValue(a, b) {
+  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return a === b;
+  const ka = Object.keys(a).sort();
+  const kb = Object.keys(b).sort();
+  return ka.length === kb.length && ka.every(
+    (k, i) => k === kb[i] && sameValue(a[k], b[k])
+  );
+}
+function isScaffoldDefault(value) {
+  if (typeof value === "string") return SCAFFOLD_DEFAULTS.includes(value);
+  const provider = value?.provider;
+  return typeof provider === "string" && SCAFFOLD_DEFAULTS.includes(provider);
+}
+function styleOf(source, mod) {
+  const firstString = /(['"])(?:(?!\1)[^\\\r\n]|\\.)*\1/.exec(source.slice(mod.config.start));
+  const indented = /\n([ \t]+)\S/.exec(source.slice(mod.config.start));
+  return {
+    quote: firstString?.[1] ?? "'",
+    unit: indented?.[1] ?? "  ",
+    envName: mod.envName ?? "env"
+  };
+}
+function quoted(text2, style) {
+  const q = style.quote;
+  const body = text2.replace(/\\/g, "\\\\").replace(new RegExp(q, "g"), `\\${q}`).replace(/\r/g, "\\r").replace(/\n/g, "\\n");
+  return `${q}${body}${q}`;
+}
+function renderKey(key, style) {
+  return /^[A-Za-z_$][\w$]*$/.test(key) ? key : quoted(key, style);
+}
+function render(value, indent, style) {
+  if (typeof value === "string") return quoted(value, style);
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (isEnvRef(value)) {
+    const fallback = value.default === void 0 ? "" : `, ${quoted(value.default, style)}`;
+    return `${style.envName}(${quoted(value.env, style)}${fallback})`;
+  }
+  const entries = Object.entries(value);
+  if (entries.length === 0) return "{}";
+  const inner = indent + style.unit;
+  const lines = entries.map(
+    ([k, v]) => `${inner}${renderKey(k, style)}: ${render(v, inner, style)},`
+  );
+  return `{
+${lines.join("\n")}
+${indent}}`;
+}
+function writesEnv(value) {
+  if (isEnvRef(value)) return true;
+  return typeof value === "object" && Object.values(value).some(writesEnv);
+}
+function indentAt(source, offset) {
+  const lineStart = source.lastIndexOf("\n", offset - 1) + 1;
+  return /^[ \t]*/.exec(source.slice(lineStart))[0];
+}
+function spliced(source, edits) {
+  const crlf = [];
+  for (const m of source.matchAll(/\r\n/g)) crlf.push(m.index - crlf.length);
+  const at = (lf) => lf + crlf.filter((p2) => p2 < lf).length;
+  const lastBreak = /\r?\n(?![\s\S]*\n)/.exec(source)?.[0] ?? "\n";
+  return edits.map((e) => {
+    const start = at(e.at);
+    const end = at(e.at + e.remove);
+    const eol = /\r?\n/.exec(source.slice(end))?.[0] ?? lastBreak;
+    return { start, end, text: e.text.replace(/\n/g, eol) };
+  }).sort((a, b) => b.start - a.start).reduce((s, e) => s.slice(0, e.start) + e.text + s.slice(e.end), source);
+}
+function addProperty(source, object, key, value, style) {
+  const props = children(object, "properties");
+  const close = object.end - 1;
+  const last = props.at(-1);
+  if (last === void 0) {
+    const indent2 = indentAt(source, object.start);
+    const inside = source.slice(object.start + 1, close);
+    const text2 = `${indent2}${style.unit}${renderKey(key, style)}: ${render(value, indent2 + style.unit, style)},`;
+    return inside.trim() === "" ? [
+      {
+        at: object.start + 1,
+        remove: inside.length,
+        text: `
+${text2}
+${indent2}`
+      }
+    ] : [{ at: close, remove: 0, text: `
+${text2}
+${indent2}` }];
+  }
+  const after = /^[ \t]*,/.exec(source.slice(last.end, close));
+  const comma = after === null ? void 0 : last.end + after[0].length;
+  const lineEnd = source.slice(last.end, close).indexOf("\n");
+  const property = (indent2) => `${renderKey(key, style)}: ${render(value, indent2, style)}`;
+  if (lineEnd === -1) {
+    return comma === void 0 ? [{ at: last.end, remove: 0, text: `, ${property(indentAt(source, last.start))}` }] : [{ at: comma, remove: 0, text: ` ${property(indentAt(source, last.start))},` }];
+  }
+  const indent = indentAt(source, last.start);
+  const edits = [
+    {
+      at: last.end + lineEnd,
+      remove: 0,
+      text: `
+${indent}${property(indent)}${comma === void 0 ? "" : ","}`
+    }
+  ];
+  if (comma === void 0) edits.push({ at: last.end, remove: 0, text: "," });
+  return edits;
+}
+function findProperty(object, key) {
+  return children(object, "properties").findLast(
+    (p2) => p2.type === "ObjectProperty" && !p2["computed"] && nameOf(child(p2, "key")) === key
+  );
+}
+function editByHand(recipe, why) {
+  const wanted = recipe.set.map(({ path, value }) => `${path} = ${JSON.stringify(value)}`);
+  return new Error(
+    `nymbal.config.ts ${why}, so the ${recipe.name} recipe cannot edit it: edit by hand and set ${wanted.join("; ")}`
+  );
+}
+function setPath(source, recipe, path, value, force) {
+  const lf = lfCopy(source);
+  const mod = locate(lf);
+  if (mod === void 0)
+    throw editByHand(recipe, "does not export a defineConfig({...}) object literal");
+  const style = styleOf(lf, mod);
+  const keys = path.split(".");
+  let object = mod.config;
+  for (const [i, key] of keys.entries()) {
+    const prop = findProperty(object, key);
+    if (prop === void 0) {
+      const nested = keys.slice(i + 1).reduceRight((v, k) => ({ [k]: v }), value);
+      return {
+        source: spliced(source, addProperty(lf, object, key, nested, style)),
+        wrote: true
+      };
+    }
+    const held = child(prop, "value");
+    if (i === keys.length - 1) {
+      const current = evaluate(held, mod.envName);
+      if (current !== void 0 && sameValue(current, value)) return { source, wrote: false };
+      if (!force && !isScaffoldDefault(current)) {
+        return {
+          conflict: { path, current: current ?? lf.slice(held.start, held.end), wanted: value }
+        };
+      }
+      const text2 = render(value, indentAt(lf, prop.start), style);
+      return {
+        source: spliced(source, [{ at: held.start, remove: held.end - held.start, text: text2 }]),
+        wrote: true
+      };
+    }
+    const inner = unwrap(held);
+    if (inner?.type !== "ObjectExpression") {
+      throw editByHand(
+        recipe,
+        `holds ${keys.slice(0, i + 1).join(".")} as something other than an object literal`
+      );
+    }
+    object = inner;
+  }
+  return { source, wrote: false };
+}
+function importEnv(source, recipe) {
+  const lf = lfCopy(source);
+  const mod = locate(lf);
+  if (mod.envName !== void 0) return source;
+  if (mod.envBound)
+    throw editByHand(recipe, "binds `env` to something other than the env of @nymbalhq/config");
+  const style = styleOf(lf, mod);
+  if (mod.namedImport !== void 0) {
+    const last = children(mod.namedImport, "specifiers").filter((s) => s.type === "ImportSpecifier").at(-1);
+    return spliced(source, [{ at: last.end, remove: 0, text: ", env" }]);
+  }
+  const imports = children(mod.program, "body").filter((n) => n.type === "ImportDeclaration");
+  const line = `import { env } from ${quoted(CONFIG_MODULE, style)}
+`;
+  const lastImport = imports.at(-1);
+  const lineEnd = lastImport === void 0 ? -1 : lf.indexOf("\n", lastImport.end);
+  const edit = lastImport === void 0 ? { at: 0, remove: 0, text: line } : lineEnd === -1 ? { at: lf.length, remove: 0, text: `
+${line}` } : { at: lineEnd + 1, remove: 0, text: line };
+  return spliced(source, [edit]);
+}
+function applyRecipeToConfig(source, recipe, opts) {
+  if (locate(lfCopy(source)) === void 0) {
+    throw editByHand(recipe, "does not export a defineConfig({...}) object literal");
+  }
+  let current = source;
+  const changed = [];
+  let envWritten = false;
+  for (const { path, value } of recipe.set) {
+    const step = setPath(current, recipe, path, value, opts.force);
+    if ("conflict" in step) return step;
+    if (!step.wrote) continue;
+    current = step.source;
+    changed.push(path);
+    envWritten ||= writesEnv(value);
+  }
+  if (envWritten) current = importEnv(current, recipe);
+  return { source: current, changed };
+}
+function envCalls(source) {
+  const lf = lfCopy(source);
+  const mod = locate(lf);
+  const envName = mod === void 0 ? importedAs(parse(lf), "env") : mod.envName;
+  if (envName === void 0) return [];
+  const defaulted = /* @__PURE__ */ new Map();
+  const visit = (node) => {
+    if (Array.isArray(node)) return node.forEach(visit);
+    if (typeof node !== "object" || node === null || typeof node.type !== "string") return;
+    const n = node;
+    if (n.type === "CallExpression") {
+      const callee = child(n, "callee");
+      const args = children(n, "arguments");
+      const first = args[0];
+      if (callee.type === "Identifier" && callee["name"] === envName && first?.type === "StringLiteral") {
+        const name = first["value"];
+        defaulted.set(name, (defaulted.get(name) ?? true) && args.length > 1);
+      }
+    }
+    for (const [key, value] of Object.entries(n)) {
+      if (key !== "loc" && key !== "comments" && key !== "extra" && key !== "original") visit(value);
+    }
+  };
+  visit(mod?.program ?? parse(lf));
+  return [...defaulted].map(([name, all]) => ({ name, defaulted: all }));
+}
+
+// src/recipes/env-example.ts
+var escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+function declares(lines, name) {
+  const re = new RegExp(`^(#\\s*)?${escapeRegExp(name)}=`);
+  return lines.some((line) => re.test(line.trim()));
+}
+function missingEnv(example, recipe) {
+  const lines = example.split(/\r?\n/);
+  return recipe.env.filter(
+    (v, i) => !declares(lines, v.name) && recipe.env.findIndex((w) => w.name === v.name) === i
+  );
+}
+function appendRecipeEnv(example, recipe) {
+  const eol = example.includes("\r\n") ? "\r\n" : "\n";
+  const missing = missingEnv(example, recipe);
+  if (missing.length === 0) return example;
+  const block = [`# ${recipe.name} (nymbal add ${recipe.name})`];
+  for (const v of missing) {
+    if (v.comment !== "") block.push(`# ${v.comment}`);
+    block.push(`${v.required ? "" : "# "}${v.name}=${v.example}`);
+  }
+  let head = example;
+  if (head !== "" && !head.endsWith("\n")) head += eol;
+  const last = head.split(/\r?\n/).at(-2);
+  const gap = last === void 0 || last.trim() === "" ? "" : eol;
+  return `${head}${gap}${block.join(eol)}${eol}`;
+}
+
+// src/commands/add.ts
+var out = (line = "") => void process.stdout.write(`${line}
+`);
+var err = (line) => void process.stderr.write(`${line}
+`);
+function fail(message) {
+  err(pc3.red(`\u2717 ${message}`));
+  return 1;
+}
+function runInstall(line, root) {
+  out(pc3.dim(`$ ${line}`));
+  const [command, ...args] = line.split(" ");
+  const result = spawnSync(command, args, {
+    cwd: root,
+    stdio: "inherit",
+    shell: process.platform === "win32"
+  });
+  return result.status === 0;
+}
+function dotEnv(root) {
+  const file = join5(root, ".env");
+  return existsSync6(file) ? parseEnv(readFileSync2(file, "utf8")) : {};
+}
+var isSet = (name, fromFile) => (process.env[name] ?? "") !== "" || (fromFile[name] ?? "") !== "";
+async function problemsWith(candidate, recipe, root, fromFile) {
+  const problems = [];
+  const missing = recipe.install.filter((pkg) => !isInstalled(pkg, root));
+  if (missing.length > 0) {
+    problems.push(
+      `${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not installed: ${installLine(missing, process.env, root)}`
+    );
+  }
+  const saved = /* @__PURE__ */ new Map();
+  for (const { name, defaulted } of envCalls(candidate)) {
+    if ((process.env[name] ?? "") !== "") continue;
+    const value = fromFile[name] || (defaulted ? void 0 : `nymbal-add-placeholder-${name}`);
+    if (value === void 0) continue;
+    saved.set(name, process.env[name]);
+    process.env[name] = value;
+  }
+  const dir = mkdtempSync(join5(root, ".nymbal-add-"));
+  try {
+    writeFileSync(join5(dir, "nymbal.config.ts"), candidate);
+    await loadConfig2(dir);
+  } catch (error) {
+    problems.push(error.message);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+    for (const [name, value] of saved) {
+      if (value === void 0) delete process.env[name];
+      else process.env[name] = value;
+    }
+  }
+  return problems;
+}
+function lineDiff(before, after) {
+  const a = before.split("\n");
+  const b = after.split("\n");
+  const t = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
+  for (let i2 = a.length - 1; i2 >= 0; i2--)
+    for (let j2 = b.length - 1; j2 >= 0; j2--)
+      t[i2][j2] = a[i2] === b[j2] ? t[i2 + 1][j2 + 1] + 1 : Math.max(t[i2 + 1][j2], t[i2][j2 + 1]);
+  const lines = [];
+  let i = 0;
+  let j = 0;
+  while (i < a.length || j < b.length) {
+    if (i < a.length && j < b.length && a[i] === b[j]) {
+      i++;
+      j++;
+    } else if (j < b.length && (i === a.length || t[i][j + 1] >= t[i + 1][j])) {
+      lines.push(pc3.green(`+ ${b[j++]}`));
+    } else {
+      lines.push(pc3.red(`- ${a[i++]}`));
+    }
+  }
+  return lines;
+}
+var show = (value) => typeof value === "string" ? `'${value}'` : JSON.stringify(value);
+async function add(opts, cwd = process.cwd()) {
+  const name = opts.recipe;
+  if (!isKnownRecipe(name)) {
+    return fail(`unknown recipe '${name}'. The recipes are: ${knownRecipes().join(", ")}`);
+  }
+  const configPath = findConfigFile2(cwd);
+  if (configPath === null) return fail(`no nymbal.config.ts in ${cwd} or any parent directory`);
+  const root = dirname6(configPath);
+  const holder = RECIPE_HOLDERS[name];
+  const installed = [];
+  if (recipeFile(name, root) === null) {
+    const line = installLine([holder], process.env, root);
+    if (!opts.install || opts.dryRun) {
+      return fail(
+        `the ${name} recipe ships in ${holder}, which is not installed. Install it: ${line}`
+      );
+    }
+    if (!runInstall(line, root)) return fail(`${line} failed`);
+    installed.push(holder);
+  }
+  const recipe = await readRecipe(name, root);
+  const source = readFileSync2(configPath, "utf8");
+  let edited;
+  try {
+    const applied = applyRecipeToConfig(source, recipe, { force: opts.force });
+    if ("conflict" in applied) {
+      const { path, current, wanted } = applied.conflict;
+      return fail(
+        `${path} is ${show(current)} in nymbal.config.ts, and the ${name} recipe sets it to ${show(wanted)}. nymbal.config.ts is unchanged: edit it by hand, or re-run with --force to overwrite it.`
+      );
+    }
+    edited = applied;
+  } catch (error) {
+    return fail(error.message);
+  }
+  const examplePath = join5(root, ".env.example");
+  const example = existsSync6(examplePath) ? readFileSync2(examplePath, "utf8") : "";
+  const nextExample = appendRecipeEnv(example, recipe);
+  if (opts.dryRun) {
+    out(pc3.bold(`nymbal add ${name} --dry-run: nothing is written`));
+    out();
+    out(
+      recipe.install.length > 0 ? `install: ${installLine(recipe.install, process.env, root)}` : "install: nothing"
+    );
+    out();
+    out("nymbal.config.ts:");
+    const diff = lineDiff(source, edited.source);
+    for (const line of diff.length > 0 ? diff : ["(already set)"]) out(`  ${line}`);
+    out();
+    out(".env.example:");
+    const added = nextExample.slice(example.length).split(/\r?\n/).filter((l) => l !== "");
+    for (const line of added.length > 0 ? added : ["(every variable already listed)"])
+      out(`  ${line}`);
+    return 0;
+  }
+  const pending = recipe.install.filter((pkg) => !isInstalled(pkg, root));
+  if (pending.length > 0 && opts.install) {
+    const line = installLine(pending, process.env, root);
+    if (!runInstall(line, root)) return fail(`${line} failed`);
+    installed.push(...pending);
+  }
+  const fromFile = dotEnv(root);
+  const problems = await problemsWith(edited.source, recipe, root, fromFile);
+  if (problems.length > 0) {
+    return fail(
+      `the ${name} recipe would leave a config that does not load, so nymbal.config.ts is unchanged:
+  ${problems.join("\n  ")}`
+    );
+  }
+  const written = [];
+  if (installed.length > 0) written.push(`package.json and its lockfile (${installed.join(", ")})`);
+  if (edited.source !== source) {
+    writeFileSync(configPath, edited.source);
+    written.push(`nymbal.config.ts (${edited.changed.join(", ")})`);
+  }
+  if (nextExample !== example) {
+    writeFileSync(examplePath, nextExample);
+    written.push(
+      `.env.example (${missingEnv(example, recipe).map((v) => v.name).join(", ")})`
+    );
+  }
+  out(pc3.green(`\u2713 ${name}: ${recipe.summary}`));
+  out(written.length > 0 ? `  changed ${written.join(", ")}` : "  already added: nothing changed");
+  const unset = recipe.env.filter((v) => v.required && !isSet(v.name, fromFile));
+  if (unset.length > 0 || recipe.next.length > 0) {
+    out();
+    out("Next:");
+    const fromSettings = unset.length > 0 ? await settingsEnv(recipe.install, root) : /* @__PURE__ */ new Set();
+    for (const v of unset) {
+      out(
+        fromSettings.has(v.name) ? `  - set ${v.name} in .env or in the admin's Settings` : `  - set ${v.name} in .env`
+      );
+    }
+    for (const line of recipe.next) out(`  - ${line}`);
+  }
+  return 0;
+}
+var addCommand = defineCommand7({
+  meta: {
+    name: "add",
+    description: `Put the store on a service: ${knownRecipes().join(", ")}`
+  },
+  args: {
+    recipe: { type: "positional", required: true, description: knownRecipes().join(", ") },
+    install: {
+      type: "boolean",
+      default: true,
+      description: "Install the packages (--no-install: they must already be installed)"
+    },
+    force: {
+      type: "boolean",
+      default: false,
+      description: "Overwrite a config value the recipe conflicts with"
+    },
+    "dry-run": {
+      type: "boolean",
+      default: false,
+      description: "Print the config change, the .env.example lines and the install line, and write nothing"
+    }
+  },
+  async run({ args }) {
+    process.exitCode = await add({
+      recipe: args.recipe,
+      install: args.install,
+      force: args.force,
+      dryRun: args["dry-run"]
+    });
+  }
+});
+
+// src/commands/doctor.ts
+import { existsSync as existsSync7 } from "fs";
+import { defineCommand as defineCommand8 } from "citty";
+import { createLogger as createLogger2, diagnose } from "@nymbalhq/platform";
+import { errorText, HEALTH_CHECK_TIMEOUT_MS } from "@nymbalhq/types";
+
+// src/commands/doctor-report.ts
+import pc4 from "picocolors";
+import { scrub as scrubSettings } from "@nymbalhq/platform";
+import { connectionSecrets, displayUrl as displayUrl2, SECRET_MIN_LENGTH } from "@nymbalhq/types";
+var TEXT_STATUS = {
+  ok: "ok",
+  healthy: "ok",
+  degraded: "warn",
+  down: "down"
+};
+var JSON_STATUS = {
+  ok: "ok",
+  healthy: "ok",
+  degraded: "degraded",
+  down: "down"
+};
+var COLOUR = { ok: pc4.green, warn: pc4.yellow, down: pc4.red };
+var SECRET_KEY = /secret|passw(?:or)?d|^pass$|token|api[-_]?key|private[-_]?key|credential|access[-_]?key/i;
+var SECRET_ENV = /SECRET|PASSWORD|PASSWD|(?:^|_)PASS(?:$|_)|TOKEN|API_KEY|PRIVATE_KEY|CREDENTIAL|ACCESS_KEY/i;
+var URL_IN_TEXT = /\b[a-z][a-z0-9+.-]*:\/\/[^\s'"`<>]+/gi;
+var TRAILING_PUNCTUATION = /[.,;:)\]}]+$/;
+function addSecret(into, value) {
+  if (value.length >= SECRET_MIN_LENGTH) into.add(value);
+}
+function collectFromConfig(value, key, into, seen) {
+  if (typeof value === "string") {
+    if (SECRET_KEY.test(key)) addSecret(into, value);
+    if (value.includes("://"))
+      for (const s of connectionSecrets(value, { user: false })) addSecret(into, s);
+    return;
+  }
+  if (value === null || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  for (const [k, v] of Object.entries(value)) collectFromConfig(v, k, into, seen);
+}
+function secretsOf(config, env) {
+  const found = /* @__PURE__ */ new Set();
+  collectFromConfig(config, "", found, /* @__PURE__ */ new WeakSet());
+  for (const [name, value] of Object.entries(env)) {
+    if (value === void 0) continue;
+    if (SECRET_ENV.test(name)) addSecret(found, value);
+    if (value.includes("://"))
+      for (const s of connectionSecrets(value, { user: false })) addSecret(found, s);
+  }
+  return [...found].sort((a, b) => b.length - a.length);
+}
+function scrub(detail, secrets) {
+  let text2 = scrubSettings(detail).replace(URL_IN_TEXT, (match) => {
+    const trailing = TRAILING_PUNCTUATION.exec(match)?.[0] ?? "";
+    return displayUrl2(match.slice(0, match.length - trailing.length)) + trailing;
+  });
+  for (const secret of secrets) text2 = text2.split(secret).join("***");
+  return text2.replace(/\s*\n\s*(?:•\s*)?/g, " ").trim();
+}
+function formatDoctorReport(report, options) {
+  const secrets = secretsOf(options.config, options.env ?? {});
+  const checks = report.checks.map((check) => ({
+    name: check.name,
+    status: check.status,
+    detail: scrub(check.detail, secrets)
+  }));
+  if (options.json) {
+    return JSON.stringify(
+      {
+        checks: checks.map((c) => ({
+          name: c.name,
+          status: JSON_STATUS[c.status],
+          detail: c.detail
+        }))
+      },
+      null,
+      2
+    );
+  }
+  const width = Math.max(...checks.map((c) => c.name.length), 0);
+  const lines = checks.map((c) => {
+    const status = TEXT_STATUS[c.status];
+    return `${COLOUR[status](status.padEnd(4))}  ${c.name.padEnd(width)}  ${c.detail}`.trimEnd();
+  });
+  const count = (s) => checks.filter((c) => TEXT_STATUS[c.status] === s).length;
+  return [...lines, "", `${count("down")} down, ${count("warn")} warn, ${count("ok")} ok`].join(
+    "\n"
+  );
+}
+
+// src/commands/doctor.ts
+function timeoutOf(flag2) {
+  if (flag2 === void 0 || flag2.trim() === "") return HEALTH_CHECK_TIMEOUT_MS;
+  const ms = Number(flag2);
+  if (!Number.isInteger(ms) || ms < 1) {
+    throw new Error(`--timeout must be a whole number of milliseconds, got "${flag2}"`);
+  }
+  return ms;
+}
+function migrationsOf(projectRoot) {
+  const root = resolveMigrations(projectRoot);
+  return existsSync7(root) ? { migrationsRoot: root } : {};
+}
+var doctorCommand = defineCommand8({
+  meta: {
+    name: "doctor",
+    description: "Check the project without changing it: config, packages, command store, migrations, slots and primitives"
+  },
+  args: {
+    json: { type: "boolean", description: "Print the checks as one JSON document", default: false },
+    timeout: {
+      type: "string",
+      description: `How long each check may take, in ms (default ${HEALTH_CHECK_TIMEOUT_MS})`
+    }
+  },
+  async run({ args }) {
+    const timeoutMs = timeoutOf(args.timeout);
+    let loaded;
+    try {
+      loaded = await loadProject();
+    } catch (error) {
+      loaded = { error };
+    }
+    const report = "error" in loaded ? (
+      // Nothing else can be checked without a config, so it is the only line.
+      { checks: [{ name: "config", status: "down", detail: errorText(loaded.error) }] }
+    ) : await diagnose(loaded.config, {
+      ...loaded.adapters !== void 0 && { adapters: loaded.adapters },
+      // The report carries every failure; a log line would only repeat one, and break `--json`.
+      logger: createLogger2({ level: "silent", pretty: false }),
+      timeoutMs,
+      ...migrationsOf(loaded.projectRoot)
+    });
+    const text2 = formatDoctorReport(report, {
+      json: args.json,
+      config: "error" in loaded ? void 0 : loaded.config,
+      env: process.env
+    });
+    const down = report.checks.some((check) => check.status === "down");
+    process.stdout.write(`${text2}
+`, () => process.exit(down ? 1 : 0));
+  }
+});
+
+// src/commands/secrets.ts
+import { defineCommand as defineCommand9 } from "citty";
+import pc5 from "picocolors";
+import {
+  createCommandStore as createCommandStore2,
+  createSettingsRepository,
+  decrypt,
+  encrypt,
+  isMissingSettingsTable,
+  keyProblem,
+  readSecretsKey,
+  SECRETS_KEY_ENV,
+  SECRETS_KEY_OLD_ENV,
+  settingAad
+} from "@nymbalhq/platform";
+var RotationRefused = class extends Error {
+};
+function refuse(message) {
+  process.stderr.write(`${pc5.red(`\u2717 ${message}`)}
+`);
+  process.exitCode = 2;
+}
+async function rotateSecrets(env = process.env) {
+  const oldKey = readSecretsKey(env, SECRETS_KEY_OLD_ENV);
+  if (!oldKey.ok) throw new RotationRefused(keyProblem(oldKey.reason, SECRETS_KEY_OLD_ENV));
+  const newKey = readSecretsKey(env, SECRETS_KEY_ENV);
+  if (!newKey.ok) throw new RotationRefused(keyProblem(newKey.reason, SECRETS_KEY_ENV));
+  const { config } = await loadProject();
+  const store = createCommandStore2(config);
+  try {
+    const repo = createSettingsRepository(store);
+    return await store.transaction(async (tx) => {
+      const rows = await repo.list(tx);
+      const rotated = [];
+      for (const row2 of rows) {
+        if (row2.ciphertext === null) continue;
+        const field = `${row2.slot}.${row2.path}`;
+        if (row2.keyId !== oldKey.id) {
+          throw new RotationRefused(
+            `${field} is under key ${row2.keyId ?? "(none)"}, not ${SECRETS_KEY_OLD_ENV} (key ${oldKey.id}); nothing was rotated`
+          );
+        }
+        let value;
+        try {
+          value = decrypt(oldKey.key, settingAad(row2.slot, row2.path), row2);
+        } catch {
+          throw new RotationRefused(
+            `${field} does not decrypt under ${SECRETS_KEY_OLD_ENV}; nothing was rotated`
+          );
+        }
+        const sealed = encrypt(newKey.key, settingAad(row2.slot, row2.path), value);
+        rotated.push({ ...row2, ...sealed, keyId: newKey.id, updatedAt: /* @__PURE__ */ new Date() });
+      }
+      for (const row2 of rotated) await repo.put(tx, row2);
+      return rotated.length;
+    });
+  } finally {
+    await store.close();
+  }
+}
+async function clearSecrets(filter) {
+  const { config } = await loadProject();
+  const store = createCommandStore2(config);
+  try {
+    const repo = createSettingsRepository(store);
+    return await store.transaction((tx) => repo.clear(tx, filter));
+  } catch (error) {
+    if (isMissingSettingsTable(error)) return 0;
+    throw error;
+  } finally {
+    await store.close();
+  }
+}
+var rotateCommand = defineCommand9({
+  meta: {
+    name: "rotate",
+    description: `Re-encrypt every saved secret from ${SECRETS_KEY_OLD_ENV} to ${SECRETS_KEY_ENV}, all or none`
+  },
+  async run() {
+    try {
+      const count = await rotateSecrets();
+      process.stdout.write(
+        `${pc5.green(`\u2713 rotated ${count} secret${count === 1 ? "" : "s"} to ${SECRETS_KEY_ENV}`)}
+`
+      );
+    } catch (error) {
+      refuse(error instanceof Error ? error.message : String(error));
+    }
+  }
+});
+var clearCommand = defineCommand9({
+  meta: {
+    name: "clear",
+    description: "Delete saved settings (all, or one slot or path); needs no key"
+  },
+  args: {
+    slot: { type: "string", description: "Only this slot" },
+    path: { type: "string", description: "Only this path" }
+  },
+  async run({ args }) {
+    const count = await clearSecrets({
+      ...args.slot !== void 0 && { slot: args.slot },
+      ...args.path !== void 0 && { path: args.path }
+    });
+    process.stdout.write(
+      `${pc5.green(`\u2713 cleared ${count} setting${count === 1 ? "" : "s"}`)}; restart the store to apply
+`
+    );
+  }
+});
+var secretsCommand = defineCommand9({
+  meta: { name: "secrets", description: "Manage the values saved in the admin's Settings" },
+  subCommands: { rotate: rotateCommand, clear: clearCommand }
+});
+
+// src/commands/events.ts
+import { existsSync as existsSync8 } from "fs";
+import { resolve as resolve6 } from "path";
+import { defineCommand as defineCommand10 } from "citty";
+import {
+  createCommandStore as createCommandStore3,
+  createEventLogRepository,
+  sqliteFile as sqliteFile2
+} from "@nymbalhq/platform";
+import { errorText as errorText2, isValidCorrelationId } from "@nymbalhq/types";
+var POLL_MS = 500;
+var TAIL_PAGE = 1e3;
+var EventsError = class extends Error {
+};
+function formatEvent(row2, opts) {
+  const { event } = row2;
+  if (!opts.json) {
+    const correlationId = isValidCorrelationId(event.correlationId) ? event.correlationId : JSON.stringify(event.correlationId);
+    return `${row2.seq} ${event.timestamp} ${event.type} ${correlationId} ${event.id}`;
+  }
+  const { payload, ...envelope } = event;
+  return JSON.stringify({
+    ...envelope,
+    ...opts.payload && { payload },
+    seq: row2.seq,
+    deliveredAt: row2.deliveredAt
+  });
+}
+function timeFlag(name, value) {
+  if (value === void 0) return void 0;
+  const at = new Date(value);
+  if (value.trim() === "" || Number.isNaN(at.getTime())) {
+    throw new EventsError(`--${name} must be an ISO 8601 time, got "${value}"`);
+  }
+  return at;
+}
+function countFlag(name, value, min) {
+  if (value === void 0) return void 0;
+  const n = Number(value);
+  if (value.trim() === "" || !Number.isInteger(n) || n < min) {
+    throw new EventsError(`--${name} must be a whole number of at least ${min}, got "${value}"`);
+  }
+  return n;
+}
+function typesFlag(value) {
+  if (value === void 0) return {};
+  if (value.trim() === "") throw new EventsError("--type must not be empty");
+  return { types: [value] };
+}
+async function openLog() {
+  const { config } = await loadProject();
+  if (config.infrastructure.commandStore === "sqlite") {
+    const path = sqliteFile2();
+    if (!existsSync8(resolve6(path))) {
+      throw new EventsError(`no database at ${path}: run \`nymbal migrate\``);
+    }
+  }
+  const store = createCommandStore3(config, { readOnly: true });
+  return { store, eventLog: createEventLogRepository(store) };
+}
+async function guarded(body) {
+  try {
+    await body();
+  } catch (error) {
+    process.stderr.write(`nymbal events: ${errorText2(error)}
+`);
+    process.exitCode = 2;
+  }
+}
+function write(lines) {
+  if (lines.length === 0) return Promise.resolve();
+  return new Promise((done) => process.stdout.write(`${lines.join("\n")}
+`, () => done()));
+}
+var outputArgs = {
+  json: {
+    type: "boolean",
+    description: "One envelope per line, with seq and deliveredAt",
+    default: false
+  },
+  payload: {
+    type: "boolean",
+    description: "Include each event\u2019s payload (it may hold customer data)",
+    default: false
+  }
+};
+var queryCommand = defineCommand10({
+  meta: { name: "query", description: "Print one correlation id\u2019s events, in seq order" },
+  args: {
+    correlation: { type: "string", description: "The correlation id (required)" },
+    type: {
+      type: "string",
+      description: "Only types matching this glob; * matches anything (order.*)"
+    },
+    since: { type: "string", description: "Only events appended at or after this ISO time" },
+    until: { type: "string", description: "Only events appended before this ISO time" },
+    limit: { type: "string", description: "At most this many events (default 1000)" },
+    ...outputArgs
+  },
+  run: ({ args }) => guarded(async () => {
+    const correlationId = args.correlation;
+    if (correlationId === void 0 || correlationId === "") {
+      throw new EventsError("--correlation <id> is required");
+    }
+    const since = timeFlag("since", args.since);
+    const until = timeFlag("until", args.until);
+    const filter = {
+      ...typesFlag(args.type),
+      ...since !== void 0 && { since },
+      ...until !== void 0 && { until },
+      limit: countFlag("limit", args.limit, 1) ?? 1e3
+    };
+    const { store, eventLog } = await openLog();
+    try {
+      const rows = await store.read(
+        (tx) => eventLog.queryByCorrelation(tx, correlationId, filter)
+      );
+      await write(rows.map((row2) => formatEvent(row2, args)));
+    } finally {
+      await store.close();
+    }
+  })
+});
+var tailCommand = defineCommand10({
+  meta: {
+    name: "tail",
+    description: "Print events as they are appended, until interrupted. Exact for serially committed events; on Postgres an event whose lower seq commits after a higher one has been printed is skipped."
+  },
+  args: {
+    type: {
+      type: "string",
+      description: "Only types matching this glob; * matches anything (order.*)"
+    },
+    from: {
+      type: "string",
+      description: "Print events above this seq (default: the current maximum)"
+    },
+    ...outputArgs
+  },
+  run: ({ args }) => guarded(async () => {
+    const types = typesFlag(args.type);
+    const from = countFlag("from", args.from, 0);
+    const { store, eventLog } = await openLog();
+    let stopped = false;
+    let wake;
+    const stop = () => {
+      stopped = true;
+      wake?.();
+    };
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+    try {
+      let cursor = from ?? await store.read((tx) => eventLog.maxSeq(tx));
+      process.stderr.write(`tailing from seq ${cursor}
+`);
+      while (!stopped) {
+        const after = cursor;
+        const rows = await store.read(
+          (tx) => eventLog.listAfter(tx, after, { ...types, limit: TAIL_PAGE })
+        );
+        await write(rows.map((row2) => formatEvent(row2, args)));
+        if (rows.length > 0) cursor = rows[rows.length - 1].seq;
+        if (rows.length === TAIL_PAGE) continue;
+        await new Promise((done) => {
+          const timer = setTimeout(done, POLL_MS);
+          wake = () => {
+            clearTimeout(timer);
+            done();
+          };
+        });
+        wake = void 0;
+      }
+    } finally {
+      process.off("SIGINT", stop);
+      process.off("SIGTERM", stop);
+      await store.close();
+    }
+  })
+});
+var eventsCommand = defineCommand10({
+  meta: { name: "events", description: "Read the event log without changing it" },
+  subCommands: { query: queryCommand, tail: tailCommand }
+});
+
+// src/commands/audit.ts
+import { createWriteStream, existsSync as existsSync9 } from "fs";
+import { resolve as resolve7 } from "path";
+import { once } from "events";
+import { defineCommand as defineCommand11 } from "citty";
+import {
+  auditEntriesInOrder,
+  createCommandStore as createCommandStore4,
+  sqliteFile as sqliteFile3
+} from "@nymbalhq/platform";
+import { errorText as errorText3 } from "@nymbalhq/types";
+var AuditError = class extends Error {
+};
+function timeFlag2(name, value) {
+  if (value === void 0) return void 0;
+  const at = new Date(value);
+  if (value.trim() === "" || Number.isNaN(at.getTime())) {
+    throw new AuditError(`--${name} must be an ISO 8601 time, got "${value}"`);
+  }
+  return at;
+}
+async function write2(out2, text2) {
+  if (!out2.write(text2)) await once(out2, "drain");
+}
+var exportCommand = defineCommand11({
+  meta: {
+    name: "export",
+    description: "Print audit entries as NDJSON, oldest first: ids only, no event payloads or customer data"
+  },
+  args: {
+    since: { type: "string", description: "Only entries at or after this ISO time" },
+    until: { type: "string", description: "Only entries before this ISO time" },
+    correlation: { type: "string", description: "Only the entries of this correlation id" },
+    out: { type: "string", description: "Write the lines to this file instead of stdout" }
+  },
+  async run({ args }) {
+    try {
+      const since = timeFlag2("since", args.since);
+      const until = timeFlag2("until", args.until);
+      const filter = {
+        ...since !== void 0 && { since },
+        ...until !== void 0 && { until },
+        ...args.correlation !== void 0 && { correlation: args.correlation }
+      };
+      const { config } = await loadProject();
+      if (config.infrastructure.commandStore === "sqlite") {
+        const path = sqliteFile3();
+        if (!existsSync9(resolve7(path))) {
+          throw new AuditError(`no database at ${path}: run \`nymbal migrate\``);
+        }
+      }
+      const store = createCommandStore4(config, { readOnly: true });
+      const out2 = args.out === void 0 ? process.stdout : createWriteStream(args.out);
+      try {
+        for await (const entry of auditEntriesInOrder(store, filter)) {
+          await write2(out2, `${JSON.stringify(entry)}
+`);
+        }
+      } finally {
+        await store.close();
+        if (out2 !== process.stdout) {
+          out2.end();
+          await once(out2, "finish");
+        }
+      }
+    } catch (error) {
+      process.stderr.write(`nymbal audit: ${errorText3(error)}
+`);
+      process.exitCode = 2;
+    }
+  }
+});
+var auditCommand = defineCommand11({
+  meta: { name: "audit", description: "Read the audit trail" },
+  subCommands: { export: exportCommand }
+});
+
+// src/commands/replay.ts
+import { existsSync as existsSync10 } from "fs";
+import { resolve as resolve8 } from "path";
+import { defineCommand as defineCommand12 } from "citty";
+import {
+  createLogger as createLogger3,
+  diffReadModel,
+  openReadModels,
+  READ_MODEL_NAMES,
+  rebuild,
+  sqliteFile as sqliteFile4
+} from "@nymbalhq/platform";
+import { errorText as errorText4 } from "@nymbalhq/types";
+var ReplayError = class extends Error {
+};
+function modelsOf(to) {
+  const choices = `${READ_MODEL_NAMES.join(", ")} or all`;
+  if (to === void 0 || to === "") throw new ReplayError(`--to <model> is required: ${choices}`);
+  if (to === "all") return READ_MODEL_NAMES;
+  const name = READ_MODEL_NAMES.find((n) => n === to);
+  if (name === void 0) throw new ReplayError(`--to must be ${choices}, got "${to}"`);
+  return [name];
+}
+var plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+function formatRebuildReport(report) {
+  const lines = [];
+  for (const entry of report) {
+    const caught = plural(entry.caughtUpEvents, "event");
+    lines.push(
+      entry.failures.length === 0 ? `${entry.model}: swapped in ${entry.ms} ms, ${caught} caught up` : `${entry.model}: swapped in ${entry.ms} ms, but ${plural(entry.failures.length, "catch-up event")} failed (the model is swapped without them: fix the cause and replay it again)`
+    );
+    for (const c of entry.collections) lines.push(`  ${c.name} ${c.documents}`);
+    for (const f of entry.failures) {
+      lines.push(`  failed: seq ${f.seq} ${f.type} (${f.handler}): ${f.error}`);
+    }
+    if (entry.note !== void 0) lines.push(`  note: ${entry.note}`);
+  }
+  return lines.join("\n");
+}
+function formatDiff(diffs) {
+  const lines = [];
+  for (const diff of diffs) {
+    lines.push(`${diff.model} (dry run, nothing written):`);
+    if (diff.skipped !== void 0) lines.push(`  skipped: ${diff.skipped}`);
+    for (const c of diff.collections) {
+      lines.push(`  ${c.name}: ${c.added} added, ${c.changed} changed, ${c.removed} removed`);
+    }
+  }
+  return lines.join("\n");
+}
+var differs = (diffs) => diffs.some((d) => d.collections.some((c) => c.added + c.changed + c.removed > 0));
+function write3(stream, text2) {
+  return new Promise((done) => stream.write(`${text2}
+`, () => done()));
+}
+var replayCommand = defineCommand12({
+  meta: {
+    name: "replay",
+    description: "Rebuild a derived read model from the command store and swap it in: catalogue, orders, customers, search or all"
+  },
+  args: {
+    to: {
+      type: "string",
+      description: "The read model: catalogue, orders, customers, search or all"
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "Rebuild into memory and count what differs from the live read model; exits 1 if anything does",
+      default: false
+    }
+  },
+  async run({ args }) {
+    try {
+      const names = modelsOf(args.to);
+      const { config, adapters } = await loadProject();
+      const shared = names.filter((n) => n !== "search");
+      if (config.infrastructure.documentStore === "in-memory" && shared.length > 0) {
+        throw new ReplayError(
+          `the ${shared.join(", ")} read model${shared.length === 1 ? "" : "s"} live in the server's own process (documentStore: in-memory), out of reach of this one; a restart of the server rebuilds them. With documentStore redis or postgres-jsonb the read models are shared, and replay rebuilds them in place. --to search works here: the native index lives in the command store.`
+        );
+      }
+      if (config.infrastructure.commandStore === "sqlite" && !existsSync10(resolve8(sqliteFile4()))) {
+        throw new ReplayError(`no database at ${sqliteFile4()}: run \`nymbal migrate\``);
+      }
+      const { deps, close } = await openReadModels(config, {
+        // The report says what happened; log lines would repeat it.
+        logger: createLogger3({ level: "silent", pretty: false }),
+        ...adapters !== void 0 && { adapters }
+      });
+      try {
+        if (args["dry-run"]) {
+          const diffs = [];
+          for (const name of names) diffs.push(await diffReadModel(name, deps));
+          await write3(process.stdout, formatDiff(diffs));
+          process.exitCode = differs(diffs) ? 1 : 0;
+          return;
+        }
+        const report = await rebuild(names, deps);
+        await write3(process.stdout, formatRebuildReport(report));
+        process.exitCode = report.some((e) => e.failures.length > 0) ? 2 : 0;
+      } finally {
+        await close();
+      }
+    } catch (error) {
+      await write3(process.stderr, `nymbal replay: ${errorText4(error)}`);
+      process.exitCode = 2;
+    }
+  }
+});
+
+// src/commands/security.ts
+import { defineCommand as defineCommand13 } from "citty";
+import { createLogger as createLogger4, importProviderPackage } from "@nymbalhq/platform";
+import {
+  errorText as errorText5
+} from "@nymbalhq/types";
+var failure = (...stderr) => ({ code: 2, stdout: [], stderr });
+var isEmpty = (plan) => plan.phases.every((p2) => p2.add.length + p2.change.length + p2.remove.length === 0);
+function formatPlan(plan) {
+  const lines = [];
+  for (const { phase, add: add2, change, remove } of plan.phases) {
+    if (add2.length + change.length + remove.length === 0) continue;
+    lines.push(
+      `${phase}: ${add2.length} to add, ${change.length} to change, ${remove.length} to remove`
+    );
+    for (const rule of add2) lines.push(`  + ${rule.ref}  ${rule.action}  ${rule.expression}`);
+    for (const { ref, to } of change) lines.push(`  ~ ${ref}  ${to.action}  ${to.expression}`);
+    for (const rule of remove) lines.push(`  - ${rule.ref}`);
+  }
+  return lines;
+}
+function invalid(result) {
+  return failure(
+    "The security config cannot go onto the zone:",
+    ...result.errors.map((e) => `  ${e.code}  ${e.message}`)
+  );
+}
+function edgeNotes(security, mod) {
+  const notes = Object.keys(security.rateLimit).filter((key) => key.startsWith("/") && mod.hasSingleStar(key)).map(
+    (key) => `note: '${key}' matches one path segment per * in process, but any number at the edge (Cloudflare's * crosses /)`
+  );
+  if (security.botProtection.mode !== "off") {
+    notes.push(
+      "note: botProtection is left as the zone has it: Bot Fight Mode is a zone setting, not a ruleset rule"
+    );
+  }
+  return notes;
+}
+function finish(outcome, secrets) {
+  const masked = (lines) => lines.map((line) => secrets.reduce((text2, secret) => text2.split(secret).join("***"), line)).map((line) => `${line}
+`).join("");
+  process.stderr.write(
+    masked(outcome.stderr),
+    () => process.stdout.write(masked(outcome.stdout), () => process.exit(outcome.code))
+  );
+}
+async function runEdge(command, body) {
+  const secrets = [process.env["CLOUDFLARE_API_TOKEN"]];
+  let outcome;
+  try {
+    const { config } = await loadProject();
+    const security = config.security;
+    secrets.push(security.cloudflare?.apiToken);
+    if (security.adapter !== "cloudflare") {
+      outcome = failure(
+        `security.adapter is '${security.adapter}', which has no edge rules for nymbal ${command}: set security.adapter to 'cloudflare' (nymbal add cloudflare) to manage them on a Cloudflare zone`
+      );
+    } else {
+      const mod = await importProviderPackage(
+        "security",
+        "cloudflare",
+        process.env
+      );
+      const adapter = await mod.createAdapter({
+        slot: "security",
+        config: security.cloudflare ?? {},
+        logger: createLogger4({ level: "silent", pretty: false }),
+        env: process.env
+      });
+      outcome = await body(adapter, security, mod);
+    }
+  } catch (error) {
+    outcome = failure(`nymbal ${command} failed: ${errorText5(error)}`);
+  }
+  finish(
+    outcome,
+    secrets.filter((s) => typeof s === "string" && s !== "")
+  );
+}
+var json = {
+  type: "boolean",
+  description: "Print the result as one JSON document",
+  default: false
+};
+var securityPlanCommand = defineCommand13({
+  meta: {
+    name: "security:plan",
+    description: "Show what security:apply would change on the Cloudflare zone"
+  },
+  args: { json },
+  run: ({ args }) => runEdge("security:plan", async (adapter, security, mod) => {
+    const check = await adapter.validate(security);
+    if (!check.valid) return invalid(check);
+    const plan = await adapter.plan(security);
+    const notes = edgeNotes(security, mod);
+    if (args.json) return { code: 0, stdout: [JSON.stringify(plan, null, 2)], stderr: notes };
+    const lines = isEmpty(plan) ? ["No changes: the zone holds every Nymbal rule."] : formatPlan(plan);
+    return { code: 0, stdout: [...lines, ...notes], stderr: [] };
+  })
+});
+var securityApplyCommand = defineCommand13({
+  meta: {
+    name: "security:apply",
+    description: "Write the store's security rules to the Cloudflare zone, leaving the zone's own rules"
+  },
+  run: () => runEdge("security:apply", async (adapter, security) => {
+    const check = await adapter.validate(security);
+    if (!check.valid) return invalid(check);
+    const done = await adapter.apply(security);
+    const lines = isEmpty(done) ? ["Nothing to write: the zone already holds every Nymbal rule."] : ["Applied:", ...formatPlan(done)];
+    return { code: 0, stdout: lines, stderr: [] };
+  })
+});
+var securityDriftCommand = defineCommand13({
+  meta: {
+    name: "security:drift",
+    description: "Report where the zone's Nymbal rules differ from the config (exit 1 on drift)"
+  },
+  args: { json },
+  run: ({ args }) => runEdge("security:drift", async (adapter, security) => {
+    const report = await adapter.drift(security);
+    const code = report.drift ? 1 : 0;
+    if (args.json) return { code, stdout: [JSON.stringify(report, null, 2)], stderr: [] };
+    if (!report.drift)
+      return { code, stdout: ["In sync: the zone holds every Nymbal rule."], stderr: [] };
+    const lines = report.differences.map(
+      (d) => `  ${d.path}  configured ${JSON.stringify(d.configured) ?? "nothing"}, live ${JSON.stringify(d.actual) ?? "nothing"}`
+    );
+    return {
+      code,
+      stdout: [
+        `Drift: ${report.differences.length} difference(s); security:apply restores them`,
+        ...lines
+      ],
+      stderr: []
+    };
+  })
+});
+var securityInspectCommand = defineCommand13({
+  meta: {
+    name: "security:inspect",
+    description: "List the Nymbal rules live on the Cloudflare zone"
+  },
+  run: () => runEdge("security:inspect", async (adapter) => {
+    const { rulesApplied } = await adapter.inspect();
+    const lines = rulesApplied.length === 0 ? ["No Nymbal rules are live on the zone."] : rulesApplied;
+    return { code: 0, stdout: lines, stderr: [] };
+  })
+});
+
+// src/commands/test.ts
+import { defineCommand as defineCommand14 } from "citty";
+import { loadConfig as loadConfig4 } from "@nymbalhq/config";
+
+// src/commands/test-contracts.ts
+import { mkdirSync, realpathSync, writeFileSync as writeFileSync2 } from "fs";
+import { createRequire as createRequire3 } from "module";
+import { dirname as dirname7, join as join6, resolve as resolve9 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import { isDeepStrictEqual } from "util";
+import { findConfigFile as findConfigFile3, loadConfig as loadConfig3 } from "@nymbalhq/config";
+var CertifyError = class extends Error {
+};
+var firstLine = (text2) => text2.split("\n")[0].trim();
+var messageOf = (err2) => firstLine(err2 instanceof Error ? err2.message : String(err2));
+function resolveFrom(project, specifier, name, install) {
+  try {
+    return createRequire3(join6(project, "package.json")).resolve(specifier);
+  } catch (err2) {
+    if (err2.code === "MODULE_NOT_FOUND") {
+      throw new CertifyError(`${name} is not installed in ${project}: ${install}`);
+    }
+    throw new CertifyError(`${name} could not be resolved from ${project}: ${messageOf(err2)}`);
+  }
+}
+async function slotOptions(project, pkg, slot) {
+  if (findConfigFile3(project) === null) return void 0;
+  let commerce;
+  try {
+    commerce = (await loadConfig3(project)).config.commerce;
+  } catch (err2) {
+    throw new CertifyError(`the project's config could not be loaded: ${messageOf(err2)}`);
+  }
+  const naming = Object.entries(commerce).filter(([, block2]) => {
+    const b = block2;
+    return b.provider === "custom" && b.package === pkg;
+  });
+  const picked = slot === void 0 ? naming : naming.filter(([name]) => name === slot);
+  if (slot !== void 0 && picked.length === 0) {
+    throw new CertifyError(`no commerce slot '${slot}' with provider 'custom' names ${pkg}`);
+  }
+  if (picked.length > 1) {
+    throw new CertifyError(
+      `${pkg} is named by the ${picked.map(([name]) => name).join(", ")} slots: pick one with --slot`
+    );
+  }
+  const block = picked[0]?.[1];
+  return block === void 0 ? void 0 : block.config ?? {};
+}
+function withoutUndefined(value, path = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value !== "object" || path.has(value)) return value;
+  const proto = Object.getPrototypeOf(value);
+  if (!Array.isArray(value) && proto !== Object.prototype && proto !== null) return value;
+  path.add(value);
+  const out2 = Array.isArray(value) ? value.map((item) => withoutUndefined(item, path)) : Object.fromEntries(
+    Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => [k, withoutUndefined(v, path)])
+  );
+  path.delete(value);
+  return out2;
+}
+function survivesJson(value) {
+  try {
+    return isDeepStrictEqual(JSON.parse(JSON.stringify(value)), value);
+  } catch {
+    return false;
+  }
+}
+async function closeProbe(adapter) {
+  const close = adapter?.close;
+  if (typeof close === "function") await close.call(adapter);
+}
+function countCases(files) {
+  let passed = 0;
+  let failed = 0;
+  const visit = (task) => {
+    if (task.type === "test") {
+      if (task.result?.state === "pass") passed += 1;
+      else if (task.mode !== "skip" && task.mode !== "todo") failed += 1;
+    }
+    for (const child2 of task.tasks ?? []) visit(child2);
+  };
+  for (const file of files) visit(file);
+  return { passed, failed };
+}
+async function certifyPackage(input) {
+  const { pkg, slot } = input;
+  const config = findConfigFile3(input.cwd);
+  const project = realpathSync(config === null ? resolve9(input.cwd) : dirname7(config));
+  const vitestNode = resolveFrom(project, "vitest/node", "vitest", "npm install --save-dev vitest");
+  const kindsEntry = resolveFrom(
+    project,
+    "@nymbalhq/contract-tests/kinds",
+    "@nymbalhq/contract-tests",
+    "npm install --save-dev @nymbalhq/contract-tests"
+  );
+  if (!isInstalled(pkg, project)) {
+    throw new CertifyError(`${pkg} is not installed in ${project}: npm install ${pkg}`);
+  }
+  const contracts = join6(project, ".nymbal", "contracts");
+  const slug = pkg.replace(/[^a-z0-9]+/gi, "-").replace(/^-|-$/g, "");
+  mkdirSync(contracts, { recursive: true });
+  const shim = join6(contracts, `${slug}.adapter.mjs`);
+  writeFileSync2(shim, `export * from ${JSON.stringify(pkg)}
+`);
+  let mod;
+  try {
+    mod = await import(pathToFileURL2(shim).href);
+  } catch (err2) {
+    throw new CertifyError(`${pkg} could not be loaded: ${messageOf(err2)}`);
+  }
+  if (typeof mod.createAdapter !== "function") {
+    throw new CertifyError(`${pkg} exports no createAdapter(options) function to certify`);
+  }
+  const createAdapter = mod.createAdapter;
+  const extra = mod.contractOptions ?? {};
+  const slotConfig = await slotOptions(project, pkg, slot);
+  const fromSlot = slotConfig === void 0 ? void 0 : withoutUndefined(slotConfig);
+  const options = fromSlot ?? extra.options ?? {};
+  if (fromSlot !== void 0 && !survivesJson(fromSlot)) {
+    throw new CertifyError(
+      `the config of the slot naming ${pkg} holds a value JSON cannot carry (a function, Date, BigInt or cycle): certify it with plain data`
+    );
+  }
+  let kind;
+  try {
+    const probe = await createAdapter(options);
+    const own = probe?.kind;
+    kind = typeof own === "string" ? own : extra.kind;
+    await closeProbe(probe);
+  } catch (err2) {
+    throw new CertifyError(`createAdapter from ${pkg} threw: ${messageOf(err2)}`);
+  }
+  if (kind === void 0) {
+    throw new CertifyError(
+      `${pkg}'s adapter has no kind: a primitive names its own in contractOptions.kind`
+    );
+  }
+  const { CONTRACT_KINDS } = await import(pathToFileURL2(kindsEntry).href);
+  if (!CONTRACT_KINDS.includes(kind)) {
+    throw new CertifyError(
+      `no contract suite for kind '${kind}' (${pkg}); the kinds with one are ${CONTRACT_KINDS.join(", ")}`
+    );
+  }
+  const file = `${slug}.contract.test.mjs`;
+  writeFileSync2(
+    join6(contracts, file),
+    [
+      `// Written by \`nymbal test:contracts --package ${pkg}\`, and again on every run.`,
+      `import * as adapter from ${JSON.stringify(pkg)}`,
+      `import { contractSuites } from '@nymbalhq/contract-tests'`,
+      ``,
+      fromSlot === void 0 ? `const options = adapter.contractOptions?.options ?? {}` : `const options = ${JSON.stringify(fromSlot)}`,
+      `const unreachable = adapter.contractOptions?.unreachable`,
+      ``,
+      `async function build(config) {`,
+      `  const built = await adapter.createAdapter(config)`,
+      `  if (typeof built?.initialize === 'function') await built.initialize(config)`,
+      `  return built`,
+      `}`,
+      ``,
+      `contractSuites[${JSON.stringify(kind)}](${JSON.stringify(pkg)}, () => build(options), {`,
+      `  ...(unreachable !== undefined && { unreachable: () => build(unreachable) }),`,
+      `})`,
+      ``
+    ].join("\n")
+  );
+  const { startVitest } = await import(pathToFileURL2(vitestNode).href);
+  const vitest = await startVitest(
+    "test",
+    [],
+    {
+      config: false,
+      root: contracts,
+      include: [file],
+      watch: false,
+      testTimeout: 6e4,
+      hookTimeout: 6e4
+    },
+    { cacheDir: join6(contracts, ".vite") }
+  );
+  if (vitest === void 0) throw new CertifyError(`vitest did not start for ${pkg}`);
+  const files = vitest.state.getFiles();
+  const { passed, failed } = countCases(files);
+  const broken = files.some((f) => f.result?.state === "fail") || vitest.state.getUnhandledErrors().length > 0;
+  await vitest.close();
+  const total = passed + failed;
+  if (failed === 0 && total > 0 && !broken) {
+    process.stdout.write(`certified ${pkg} (${kind}): ${passed} cases passed
+`);
+    return 0;
+  }
+  process.stdout.write(`not certified ${pkg} (${kind}): ${failed} of ${total} cases failed
+`);
+  return 1;
+}
+
+// src/commands/test.ts
+var testCommand = defineCommand14({
   meta: { name: "test", description: "Run unit + integration tests (vitest)" },
   async run() {
     await runOrFail("pnpm", ["vitest", "run"]);
   }
 });
-var testE2eCommand = defineCommand7({
+var testE2eCommand = defineCommand14({
   meta: { name: "test:e2e", description: "Run Playwright E2E against the configured template" },
   async run() {
-    const { config } = await loadConfig2();
+    const { config } = await loadConfig4();
     await runOrFail("pnpm", [
       "--filter",
       "@nymbalhq/e2e",
@@ -721,7 +2484,7 @@ var testE2eCommand = defineCommand7({
     ]);
   }
 });
-var testVisualCommand = defineCommand7({
+var testVisualCommand = defineCommand14({
   meta: { name: "test:visual", description: "Run visual regression tests (Playwright toHaveScreenshot)" },
   args: {
     "update-baselines": {
@@ -731,7 +2494,7 @@ var testVisualCommand = defineCommand7({
     }
   },
   async run({ args }) {
-    const { config } = await loadConfig2();
+    const { config } = await loadConfig4();
     const isCI = !!process.env.CI;
     const updateBaselines = args["update-baselines"];
     if (updateBaselines && !isCI) {
@@ -766,12 +2529,35 @@ var testVisualCommand = defineCommand7({
     }
   }
 });
-var testContractsCommand = defineCommand7({
-  meta: { name: "test:contracts", description: "Run adapter contract tests" },
+var testContractsCommand = defineCommand14({
+  meta: { name: "test:contracts", description: "Run adapter contract tests, or certify an adapter package" },
   args: {
-    adapter: { type: "string", description: "Run only contracts for a specific adapter (e.g. payments, email)" }
+    adapter: { type: "string", description: "Run only contracts for a specific adapter (e.g. payments, email)" },
+    package: {
+      type: "string",
+      description: "Certify an installed adapter package against the published suite for its kind"
+    },
+    slot: { type: "string", description: "With --package: the commerce slot whose config builds it" }
   },
   async run({ args }) {
+    if (args.package) {
+      const code = await certifyPackage({
+        pkg: String(args.package),
+        ...args.slot !== void 0 && { slot: String(args.slot) },
+        cwd: process.cwd()
+      }).catch((err2) => {
+        const message = err2 instanceof Error ? err2.message : String(err2);
+        const line = err2 instanceof CertifyError ? message : `test:contracts: ${message}`;
+        process.stderr.write(`${line.split("\n")[0]}
+`);
+        return 1;
+      });
+      await Promise.all([
+        new Promise((done) => process.stdout.write("", done)),
+        new Promise((done) => process.stderr.write("", done))
+      ]);
+      process.exit(code);
+    }
     const vArgs = [
       "vitest",
       "run",
@@ -784,10 +2570,10 @@ var testContractsCommand = defineCommand7({
     await runOrFail("pnpm", vArgs);
   }
 });
-var testPerformanceCommand = defineCommand7({
+var testPerformanceCommand = defineCommand14({
   meta: { name: "test:performance", description: "Run Lighthouse CI against the configured template" },
   async run() {
-    const { config } = await loadConfig2();
+    const { config } = await loadConfig4();
     const port = config.template === "nextjs" ? 3e3 : 4321;
     await runOrFail("pnpm", ["lhci", "autorun"], {
       env: {
@@ -798,7 +2584,7 @@ var testPerformanceCommand = defineCommand7({
     });
   }
 });
-var testAllCommand = defineCommand7({
+var testAllCommand = defineCommand14({
   meta: { name: "test:all", description: "Run unit, contract, e2e, visual, and performance tests" },
   async run() {
     const steps = [
@@ -813,7 +2599,7 @@ var testAllCommand = defineCommand7({
         process.exit(code);
       }
     }
-    const { config } = await loadConfig2();
+    const { config } = await loadConfig4();
     await runOrFail("pnpm", [
       "--filter",
       "@nymbalhq/e2e",
@@ -843,7 +2629,7 @@ var testAllCommand = defineCommand7({
 });
 
 // src/index.ts
-var main = defineCommand8({
+var main = defineCommand15({
   meta: {
     name: "nymbal",
     version: getCliVersion(),
@@ -856,6 +2642,16 @@ var main = defineCommand8({
     seed: seedCommand,
     import: importCommand,
     "config:validate": configValidateCommand,
+    add: addCommand,
+    doctor: doctorCommand,
+    "security:plan": securityPlanCommand,
+    "security:apply": securityApplyCommand,
+    "security:drift": securityDriftCommand,
+    "security:inspect": securityInspectCommand,
+    secrets: secretsCommand,
+    events: eventsCommand,
+    audit: auditCommand,
+    replay: replayCommand,
     test: testCommand,
     "test:e2e": testE2eCommand,
     "test:visual": testVisualCommand,