nymbal 1.1.0 → 1.2.0

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { defineCommand as defineCommand10, runMain } from "citty";
+import { defineCommand as defineCommand15, runMain } from "citty";
 
 // src/utils/version.ts
 import { readFileSync } from "fs";
@@ -56,9 +56,9 @@ function run(command, args, options = {}) {
     shell: false,
     ...options
   });
-  const done = new Promise((resolve6, reject) => {
+  const done = new Promise((resolve10, reject) => {
     child2.on("error", reject);
-    child2.on("exit", (code) => resolve6(code ?? 0));
+    child2.on("exit", (code) => resolve10(code ?? 0));
   });
   return { child: child2, done };
 }
@@ -73,16 +73,16 @@ async function runOrFail(command, args, options = {}) {
 // src/utils/port.ts
 import { createServer } from "net";
 async function isPortFree(port, host) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve10) => {
     const server = createServer();
     server.once("error", (err2) => {
       if (err2.code !== "EADDRINUSE" && err2.code !== "EACCES") {
         console.error(`[dev] unexpected error probing port ${port}:`, err2.message);
       }
-      resolve6(false);
+      resolve10(false);
     });
     server.once("listening", () => {
-      server.close(() => resolve6(true));
+      server.close(() => resolve10(true));
     });
     if (host) {
       server.listen(port, host);
@@ -243,8 +243,8 @@ async function runShutdown(steps, opts) {
     pending = void 0;
   })();
   let timer;
-  const bound = new Promise((resolve6) => {
-    timer = setTimeout(() => resolve6("bound"), opts.boundMs);
+  const bound = new Promise((resolve10) => {
+    timer = setTimeout(() => resolve10("bound"), opts.boundMs);
   });
   const outcome = await Promise.race([work.then(() => "done"), bound]);
   clearTimeout(timer);
@@ -441,7 +441,8 @@ var devCommand = defineCommand2({
           documentStore: platform.documentStore,
           eventBus: platform.eventBus,
           logger: platform.logger,
-          version
+          version,
+          search: app.adapters.search
         });
       }
     }
@@ -456,7 +457,9 @@ var devCommand = defineCommand2({
     await http.start();
     const apiUrl = `http://localhost:${config.http.port}`;
     const printSummary = (storefront) => {
-      console.log(renderDevSummary(summaryInfo(config, app, apiUrl, storefront, adminRoot !== null)));
+      console.log(
+        renderDevSummary(summaryInfo(config, app, apiUrl, storefront, adminRoot !== null))
+      );
     };
     const stopApi = [
       { name: "http.stop", run: () => http.stop() },
@@ -546,10 +549,28 @@ import { defineCommand as defineCommand4 } from "citty";
 import { createPlatform, resolvePrimitives, runSeed as runSeed2 } from "@nymbalhq/platform";
 var seedCommand = defineCommand4({
   meta: { name: "seed", description: "Re-seed demo content (products, categories)" },
-  async run() {
+  args: {
+    localImages: {
+      type: "boolean",
+      // citty registers the camelCase key only; the alias maps the kebab flag onto it (see `dev --api-only`).
+      alias: "local-images",
+      description: "Write the product images through the store's media slot instead of linking a placeholder host",
+      default: false
+    },
+    mediaRoot: {
+      type: "string",
+      alias: "media-root",
+      description: "Where local-fs media is written (default: public/imported-media)"
+    }
+  },
+  async run({ args }) {
     const { config, projectRoot } = await loadProject();
     await migrateProject(config, projectRoot);
-    const platform = createPlatform(config, await resolvePrimitives(config));
+    const mediaRoot = typeof args.mediaRoot === "string" && args.mediaRoot !== "" ? args.mediaRoot : void 0;
+    const platform = createPlatform(
+      config,
+      await resolvePrimitives(config, mediaRoot === void 0 ? {} : { mediaRoot })
+    );
     try {
       const result = await runSeed2({
         config,
@@ -557,7 +578,8 @@ var seedCommand = defineCommand4({
         documentStore: platform.documentStore,
         eventBus: platform.eventBus,
         logger: platform.logger,
-        version: getCliVersion()
+        version: getCliVersion(),
+        ...args.localImages && { media: platform.media }
       });
       console.log(
         result.alreadySeeded ? "\u2713 demo content already present, nothing to seed" : `\u2713 seeded ${result.products} products across ${result.categories} categories`
@@ -572,7 +594,7 @@ var seedCommand = defineCommand4({
 import { defineCommand as defineCommand5 } from "citty";
 import { intro, outro, text, select, spinner, isCancel, cancel } from "@clack/prompts";
 import p from "picocolors";
-import { createApp as createApp2 } from "@nymbalhq/platform";
+import { createApp as createApp2, newCorrelationId, runAsActor, runWithCorrelation } from "@nymbalhq/platform";
 import { runWooCommerceImport, writeReport } from "@nymbalhq/importers";
 import { join as join3 } from "path";
 var importCommand = defineCommand5({
@@ -700,35 +722,38 @@ var importCommand = defineCommand5({
     const app = await createApp2(config, { version: getCliVersion() });
     loadSpin.stop("Platform ready");
     try {
-      const report = await runWooCommerceImport(
-        {
-          credentials: { url: storeUrl, consumerKey, consumerSecret },
-          entities: entityList,
-          ai: aiEnabled,
-          gdpr: gdprEnabled,
-          fresh: args.fresh,
-          concurrency,
-          projectRoot,
-          currency: config.store.currency,
-          statePath
-        },
-        {
-          services: app.services,
-          repos: app.repos,
-          adapters: { ai: app.adapters.ai, reviews: app.adapters.reviews },
-          media: app.platform.media,
-          onProgress(event) {
-            if (event.kind === "phase") {
-              console.log(p.cyan(`  \u2192 ${event.phase}`));
-            } else if (event.kind === "progress") {
-              const pct = Math.round(event.done / event.total * 100);
-              process.stdout.write(`\r  ${event.entity}: ${event.done}/${event.total} (${pct}%)  `);
-              if (event.done === event.total) process.stdout.write("\n");
-            } else if (event.kind === "error") {
-              console.log(p.red(`  \u2717 ${event.phase} [${event.id}]: ${event.message}`));
+      const report = await runWithCorrelation(
+        newCorrelationId("import:woocommerce"),
+        () => runAsActor({ kind: "import", id: "woocommerce" }, () => runWooCommerceImport(
+          {
+            credentials: { url: storeUrl, consumerKey, consumerSecret },
+            entities: entityList,
+            ai: aiEnabled,
+            gdpr: gdprEnabled,
+            fresh: args.fresh,
+            concurrency,
+            projectRoot,
+            currency: config.store.currency,
+            statePath
+          },
+          {
+            services: app.services,
+            repos: app.repos,
+            adapters: { ai: app.adapters.ai, reviews: app.adapters.reviews },
+            media: app.platform.media,
+            onProgress(event) {
+              if (event.kind === "phase") {
+                console.log(p.cyan(`  \u2192 ${event.phase}`));
+              } else if (event.kind === "progress") {
+                const pct = Math.round(event.done / event.total * 100);
+                process.stdout.write(`\r  ${event.entity}: ${event.done}/${event.total} (${pct}%)  `);
+                if (event.done === event.total) process.stdout.write("\n");
+              } else if (event.kind === "error") {
+                console.log(p.red(`  \u2717 ${event.phase} [${event.id}]: ${event.message}`));
+              }
             }
           }
-        }
+        ))
       );
       const reportPath = await writeReport(report, projectRoot, config.store.name);
       outro(
@@ -792,7 +817,9 @@ import { existsSync as existsSync5 } from "fs";
 import { readFile } from "fs/promises";
 import { createRequire as createRequire2 } from "module";
 import { dirname as dirname5, join as join4, resolve as resolve5 } from "path";
+import { pathToFileURL } from "url";
 var RECIPE_HOLDERS = {
+  cloudflare: "@nymbalhq/security-cloudflare",
   postgres: "@nymbalhq/platform",
   redis: "@nymbalhq/doc-store-redis",
   s3: "@nymbalhq/media-s3",
@@ -845,6 +872,34 @@ async function readRecipe(name, projectRoot) {
   if (malformed) throw new Error(`${file} is not a ${name} recipe`);
   return recipe;
 }
+function entryOf(dir, manifest) {
+  const exportsField = manifest["exports"];
+  const root = typeof exportsField === "object" ? exportsField["."] : exportsField;
+  const entry = typeof root === "string" ? root : typeof root === "object" && root !== null ? root["import"] ?? root["default"] : manifest["module"] ?? manifest["main"];
+  return typeof entry === "string" ? join4(dir, entry) : null;
+}
+async function settingsEnv(packages, projectRoot) {
+  const names = /* @__PURE__ */ new Set();
+  for (const pkg of packages.filter((p2) => p2.startsWith("@nymbalhq/"))) {
+    const dir = packageDir(pkg, projectRoot);
+    if (dir === null) continue;
+    const manifest = JSON.parse(await readFile(join4(dir, "package.json"), "utf8"));
+    const entry = entryOf(dir, manifest);
+    if (entry === null || !existsSync5(entry)) continue;
+    let mod;
+    try {
+      mod = await import(pathToFileURL(entry).href);
+    } catch (error) {
+      if (error.code === "ERR_MODULE_NOT_FOUND") continue;
+      throw error;
+    }
+    if (!Array.isArray(mod.settings)) continue;
+    for (const setting of mod.settings) {
+      if (typeof setting?.env === "string") names.add(setting.env);
+    }
+  }
+  return names;
+}
 
 // src/recipes/config-edit.ts
 import { parseModule } from "magicast";
@@ -853,7 +908,8 @@ var SCAFFOLD_DEFAULTS = [
   "in-memory",
   "in-process",
   "local-fs",
-  "native"
+  "native",
+  "middleware"
 ];
 var CONFIG_MODULE = "@nymbalhq/config";
 var child = (node, key) => node[key];
@@ -1384,7 +1440,12 @@ async function add(opts, cwd = process.cwd()) {
   if (unset.length > 0 || recipe.next.length > 0) {
     out();
     out("Next:");
-    for (const v of unset) out(`  - set ${v.name} in .env`);
+    const fromSettings = unset.length > 0 ? await settingsEnv(recipe.install, root) : /* @__PURE__ */ new Set();
+    for (const v of unset) {
+      out(
+        fromSettings.has(v.name) ? `  - set ${v.name} in .env or in the admin's Settings` : `  - set ${v.name} in .env`
+      );
+    }
     for (const line of recipe.next) out(`  - ${line}`);
   }
   return 0;
@@ -1430,6 +1491,7 @@ import { errorText, HEALTH_CHECK_TIMEOUT_MS } from "@nymbalhq/types";
 
 // src/commands/doctor-report.ts
 import pc4 from "picocolors";
+import { scrub as scrubSettings } from "@nymbalhq/platform";
 import { connectionSecrets, displayUrl as displayUrl2, SECRET_MIN_LENGTH } from "@nymbalhq/types";
 var TEXT_STATUS = {
   ok: "ok",
@@ -1454,7 +1516,8 @@ function addSecret(into, value) {
 function collectFromConfig(value, key, into, seen) {
   if (typeof value === "string") {
     if (SECRET_KEY.test(key)) addSecret(into, value);
-    if (value.includes("://")) for (const s of connectionSecrets(value, { user: false })) addSecret(into, s);
+    if (value.includes("://"))
+      for (const s of connectionSecrets(value, { user: false })) addSecret(into, s);
     return;
   }
   if (value === null || typeof value !== "object" || seen.has(value)) return;
@@ -1467,12 +1530,13 @@ function secretsOf(config, env) {
   for (const [name, value] of Object.entries(env)) {
     if (value === void 0) continue;
     if (SECRET_ENV.test(name)) addSecret(found, value);
-    if (value.includes("://")) for (const s of connectionSecrets(value, { user: false })) addSecret(found, s);
+    if (value.includes("://"))
+      for (const s of connectionSecrets(value, { user: false })) addSecret(found, s);
   }
   return [...found].sort((a, b) => b.length - a.length);
 }
 function scrub(detail, secrets) {
-  let text2 = detail.replace(URL_IN_TEXT, (match) => {
+  let text2 = scrubSettings(detail).replace(URL_IN_TEXT, (match) => {
     const trailing = TRAILING_PUNCTUATION.exec(match)?.[0] ?? "";
     return displayUrl2(match.slice(0, match.length - trailing.length)) + trailing;
   });
@@ -1489,7 +1553,11 @@ function formatDoctorReport(report, options) {
   if (options.json) {
     return JSON.stringify(
       {
-        checks: checks.map((c) => ({ name: c.name, status: JSON_STATUS[c.status], detail: c.detail }))
+        checks: checks.map((c) => ({
+          name: c.name,
+          status: JSON_STATUS[c.status],
+          detail: c.detail
+        }))
       },
       null,
       2
@@ -1501,7 +1569,9 @@ function formatDoctorReport(report, options) {
     return `${COLOUR[status](status.padEnd(4))}  ${c.name.padEnd(width)}  ${c.detail}`.trimEnd();
   });
   const count = (s) => checks.filter((c) => TEXT_STATUS[c.status] === s).length;
-  return [...lines, "", `${count("down")} down, ${count("warn")} warn, ${count("ok")} ok`].join("\n");
+  return [...lines, "", `${count("down")} down, ${count("warn")} warn, ${count("ok")} ok`].join(
+    "\n"
+  );
 }
 
 // src/commands/doctor.ts
@@ -1558,19 +1628,849 @@ var doctorCommand = defineCommand8({
   }
 });
 
-// src/commands/test.ts
+// src/commands/secrets.ts
 import { defineCommand as defineCommand9 } from "citty";
-import { loadConfig as loadConfig3 } from "@nymbalhq/config";
-var testCommand = defineCommand9({
+import pc5 from "picocolors";
+import {
+  createCommandStore as createCommandStore2,
+  createSettingsRepository,
+  decrypt,
+  encrypt,
+  isMissingSettingsTable,
+  keyProblem,
+  readSecretsKey,
+  SECRETS_KEY_ENV,
+  SECRETS_KEY_OLD_ENV,
+  settingAad
+} from "@nymbalhq/platform";
+var RotationRefused = class extends Error {
+};
+function refuse(message) {
+  process.stderr.write(`${pc5.red(`\u2717 ${message}`)}
+`);
+  process.exitCode = 2;
+}
+async function rotateSecrets(env = process.env) {
+  const oldKey = readSecretsKey(env, SECRETS_KEY_OLD_ENV);
+  if (!oldKey.ok) throw new RotationRefused(keyProblem(oldKey.reason, SECRETS_KEY_OLD_ENV));
+  const newKey = readSecretsKey(env, SECRETS_KEY_ENV);
+  if (!newKey.ok) throw new RotationRefused(keyProblem(newKey.reason, SECRETS_KEY_ENV));
+  const { config } = await loadProject();
+  const store = createCommandStore2(config);
+  try {
+    const repo = createSettingsRepository(store);
+    return await store.transaction(async (tx) => {
+      const rows = await repo.list(tx);
+      const rotated = [];
+      for (const row2 of rows) {
+        if (row2.ciphertext === null) continue;
+        const field = `${row2.slot}.${row2.path}`;
+        if (row2.keyId !== oldKey.id) {
+          throw new RotationRefused(
+            `${field} is under key ${row2.keyId ?? "(none)"}, not ${SECRETS_KEY_OLD_ENV} (key ${oldKey.id}); nothing was rotated`
+          );
+        }
+        let value;
+        try {
+          value = decrypt(oldKey.key, settingAad(row2.slot, row2.path), row2);
+        } catch {
+          throw new RotationRefused(
+            `${field} does not decrypt under ${SECRETS_KEY_OLD_ENV}; nothing was rotated`
+          );
+        }
+        const sealed = encrypt(newKey.key, settingAad(row2.slot, row2.path), value);
+        rotated.push({ ...row2, ...sealed, keyId: newKey.id, updatedAt: /* @__PURE__ */ new Date() });
+      }
+      for (const row2 of rotated) await repo.put(tx, row2);
+      return rotated.length;
+    });
+  } finally {
+    await store.close();
+  }
+}
+async function clearSecrets(filter) {
+  const { config } = await loadProject();
+  const store = createCommandStore2(config);
+  try {
+    const repo = createSettingsRepository(store);
+    return await store.transaction((tx) => repo.clear(tx, filter));
+  } catch (error) {
+    if (isMissingSettingsTable(error)) return 0;
+    throw error;
+  } finally {
+    await store.close();
+  }
+}
+var rotateCommand = defineCommand9({
+  meta: {
+    name: "rotate",
+    description: `Re-encrypt every saved secret from ${SECRETS_KEY_OLD_ENV} to ${SECRETS_KEY_ENV}, all or none`
+  },
+  async run() {
+    try {
+      const count = await rotateSecrets();
+      process.stdout.write(
+        `${pc5.green(`\u2713 rotated ${count} secret${count === 1 ? "" : "s"} to ${SECRETS_KEY_ENV}`)}
+`
+      );
+    } catch (error) {
+      refuse(error instanceof Error ? error.message : String(error));
+    }
+  }
+});
+var clearCommand = defineCommand9({
+  meta: {
+    name: "clear",
+    description: "Delete saved settings (all, or one slot or path); needs no key"
+  },
+  args: {
+    slot: { type: "string", description: "Only this slot" },
+    path: { type: "string", description: "Only this path" }
+  },
+  async run({ args }) {
+    const count = await clearSecrets({
+      ...args.slot !== void 0 && { slot: args.slot },
+      ...args.path !== void 0 && { path: args.path }
+    });
+    process.stdout.write(
+      `${pc5.green(`\u2713 cleared ${count} setting${count === 1 ? "" : "s"}`)}; restart the store to apply
+`
+    );
+  }
+});
+var secretsCommand = defineCommand9({
+  meta: { name: "secrets", description: "Manage the values saved in the admin's Settings" },
+  subCommands: { rotate: rotateCommand, clear: clearCommand }
+});
+
+// src/commands/events.ts
+import { existsSync as existsSync8 } from "fs";
+import { resolve as resolve6 } from "path";
+import { defineCommand as defineCommand10 } from "citty";
+import {
+  createCommandStore as createCommandStore3,
+  createEventLogRepository,
+  sqliteFile as sqliteFile2
+} from "@nymbalhq/platform";
+import { errorText as errorText2, isValidCorrelationId } from "@nymbalhq/types";
+var POLL_MS = 500;
+var TAIL_PAGE = 1e3;
+var EventsError = class extends Error {
+};
+function formatEvent(row2, opts) {
+  const { event } = row2;
+  if (!opts.json) {
+    const correlationId = isValidCorrelationId(event.correlationId) ? event.correlationId : JSON.stringify(event.correlationId);
+    return `${row2.seq} ${event.timestamp} ${event.type} ${correlationId} ${event.id}`;
+  }
+  const { payload, ...envelope } = event;
+  return JSON.stringify({
+    ...envelope,
+    ...opts.payload && { payload },
+    seq: row2.seq,
+    deliveredAt: row2.deliveredAt
+  });
+}
+function timeFlag(name, value) {
+  if (value === void 0) return void 0;
+  const at = new Date(value);
+  if (value.trim() === "" || Number.isNaN(at.getTime())) {
+    throw new EventsError(`--${name} must be an ISO 8601 time, got "${value}"`);
+  }
+  return at;
+}
+function countFlag(name, value, min) {
+  if (value === void 0) return void 0;
+  const n = Number(value);
+  if (value.trim() === "" || !Number.isInteger(n) || n < min) {
+    throw new EventsError(`--${name} must be a whole number of at least ${min}, got "${value}"`);
+  }
+  return n;
+}
+function typesFlag(value) {
+  if (value === void 0) return {};
+  if (value.trim() === "") throw new EventsError("--type must not be empty");
+  return { types: [value] };
+}
+async function openLog() {
+  const { config } = await loadProject();
+  if (config.infrastructure.commandStore === "sqlite") {
+    const path = sqliteFile2();
+    if (!existsSync8(resolve6(path))) {
+      throw new EventsError(`no database at ${path}: run \`nymbal migrate\``);
+    }
+  }
+  const store = createCommandStore3(config, { readOnly: true });
+  return { store, eventLog: createEventLogRepository(store) };
+}
+async function guarded(body) {
+  try {
+    await body();
+  } catch (error) {
+    process.stderr.write(`nymbal events: ${errorText2(error)}
+`);
+    process.exitCode = 2;
+  }
+}
+function write(lines) {
+  if (lines.length === 0) return Promise.resolve();
+  return new Promise((done) => process.stdout.write(`${lines.join("\n")}
+`, () => done()));
+}
+var outputArgs = {
+  json: {
+    type: "boolean",
+    description: "One envelope per line, with seq and deliveredAt",
+    default: false
+  },
+  payload: {
+    type: "boolean",
+    description: "Include each event\u2019s payload (it may hold customer data)",
+    default: false
+  }
+};
+var queryCommand = defineCommand10({
+  meta: { name: "query", description: "Print one correlation id\u2019s events, in seq order" },
+  args: {
+    correlation: { type: "string", description: "The correlation id (required)" },
+    type: {
+      type: "string",
+      description: "Only types matching this glob; * matches anything (order.*)"
+    },
+    since: { type: "string", description: "Only events appended at or after this ISO time" },
+    until: { type: "string", description: "Only events appended before this ISO time" },
+    limit: { type: "string", description: "At most this many events (default 1000)" },
+    ...outputArgs
+  },
+  run: ({ args }) => guarded(async () => {
+    const correlationId = args.correlation;
+    if (correlationId === void 0 || correlationId === "") {
+      throw new EventsError("--correlation <id> is required");
+    }
+    const since = timeFlag("since", args.since);
+    const until = timeFlag("until", args.until);
+    const filter = {
+      ...typesFlag(args.type),
+      ...since !== void 0 && { since },
+      ...until !== void 0 && { until },
+      limit: countFlag("limit", args.limit, 1) ?? 1e3
+    };
+    const { store, eventLog } = await openLog();
+    try {
+      const rows = await store.read(
+        (tx) => eventLog.queryByCorrelation(tx, correlationId, filter)
+      );
+      await write(rows.map((row2) => formatEvent(row2, args)));
+    } finally {
+      await store.close();
+    }
+  })
+});
+var tailCommand = defineCommand10({
+  meta: {
+    name: "tail",
+    description: "Print events as they are appended, until interrupted. Exact for serially committed events; on Postgres an event whose lower seq commits after a higher one has been printed is skipped."
+  },
+  args: {
+    type: {
+      type: "string",
+      description: "Only types matching this glob; * matches anything (order.*)"
+    },
+    from: {
+      type: "string",
+      description: "Print events above this seq (default: the current maximum)"
+    },
+    ...outputArgs
+  },
+  run: ({ args }) => guarded(async () => {
+    const types = typesFlag(args.type);
+    const from = countFlag("from", args.from, 0);
+    const { store, eventLog } = await openLog();
+    let stopped = false;
+    let wake;
+    const stop = () => {
+      stopped = true;
+      wake?.();
+    };
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+    try {
+      let cursor = from ?? await store.read((tx) => eventLog.maxSeq(tx));
+      process.stderr.write(`tailing from seq ${cursor}
+`);
+      while (!stopped) {
+        const after = cursor;
+        const rows = await store.read(
+          (tx) => eventLog.listAfter(tx, after, { ...types, limit: TAIL_PAGE })
+        );
+        await write(rows.map((row2) => formatEvent(row2, args)));
+        if (rows.length > 0) cursor = rows[rows.length - 1].seq;
+        if (rows.length === TAIL_PAGE) continue;
+        await new Promise((done) => {
+          const timer = setTimeout(done, POLL_MS);
+          wake = () => {
+            clearTimeout(timer);
+            done();
+          };
+        });
+        wake = void 0;
+      }
+    } finally {
+      process.off("SIGINT", stop);
+      process.off("SIGTERM", stop);
+      await store.close();
+    }
+  })
+});
+var eventsCommand = defineCommand10({
+  meta: { name: "events", description: "Read the event log without changing it" },
+  subCommands: { query: queryCommand, tail: tailCommand }
+});
+
+// src/commands/audit.ts
+import { createWriteStream, existsSync as existsSync9 } from "fs";
+import { resolve as resolve7 } from "path";
+import { once } from "events";
+import { defineCommand as defineCommand11 } from "citty";
+import {
+  auditEntriesInOrder,
+  createCommandStore as createCommandStore4,
+  sqliteFile as sqliteFile3
+} from "@nymbalhq/platform";
+import { errorText as errorText3 } from "@nymbalhq/types";
+var AuditError = class extends Error {
+};
+function timeFlag2(name, value) {
+  if (value === void 0) return void 0;
+  const at = new Date(value);
+  if (value.trim() === "" || Number.isNaN(at.getTime())) {
+    throw new AuditError(`--${name} must be an ISO 8601 time, got "${value}"`);
+  }
+  return at;
+}
+async function write2(out2, text2) {
+  if (!out2.write(text2)) await once(out2, "drain");
+}
+var exportCommand = defineCommand11({
+  meta: {
+    name: "export",
+    description: "Print audit entries as NDJSON, oldest first: ids only, no event payloads or customer data"
+  },
+  args: {
+    since: { type: "string", description: "Only entries at or after this ISO time" },
+    until: { type: "string", description: "Only entries before this ISO time" },
+    correlation: { type: "string", description: "Only the entries of this correlation id" },
+    out: { type: "string", description: "Write the lines to this file instead of stdout" }
+  },
+  async run({ args }) {
+    try {
+      const since = timeFlag2("since", args.since);
+      const until = timeFlag2("until", args.until);
+      const filter = {
+        ...since !== void 0 && { since },
+        ...until !== void 0 && { until },
+        ...args.correlation !== void 0 && { correlation: args.correlation }
+      };
+      const { config } = await loadProject();
+      if (config.infrastructure.commandStore === "sqlite") {
+        const path = sqliteFile3();
+        if (!existsSync9(resolve7(path))) {
+          throw new AuditError(`no database at ${path}: run \`nymbal migrate\``);
+        }
+      }
+      const store = createCommandStore4(config, { readOnly: true });
+      const out2 = args.out === void 0 ? process.stdout : createWriteStream(args.out);
+      try {
+        for await (const entry of auditEntriesInOrder(store, filter)) {
+          await write2(out2, `${JSON.stringify(entry)}
+`);
+        }
+      } finally {
+        await store.close();
+        if (out2 !== process.stdout) {
+          out2.end();
+          await once(out2, "finish");
+        }
+      }
+    } catch (error) {
+      process.stderr.write(`nymbal audit: ${errorText3(error)}
+`);
+      process.exitCode = 2;
+    }
+  }
+});
+var auditCommand = defineCommand11({
+  meta: { name: "audit", description: "Read the audit trail" },
+  subCommands: { export: exportCommand }
+});
+
+// src/commands/replay.ts
+import { existsSync as existsSync10 } from "fs";
+import { resolve as resolve8 } from "path";
+import { defineCommand as defineCommand12 } from "citty";
+import {
+  createLogger as createLogger3,
+  diffReadModel,
+  openReadModels,
+  READ_MODEL_NAMES,
+  rebuild,
+  sqliteFile as sqliteFile4
+} from "@nymbalhq/platform";
+import { errorText as errorText4 } from "@nymbalhq/types";
+var ReplayError = class extends Error {
+};
+function modelsOf(to) {
+  const choices = `${READ_MODEL_NAMES.join(", ")} or all`;
+  if (to === void 0 || to === "") throw new ReplayError(`--to <model> is required: ${choices}`);
+  if (to === "all") return READ_MODEL_NAMES;
+  const name = READ_MODEL_NAMES.find((n) => n === to);
+  if (name === void 0) throw new ReplayError(`--to must be ${choices}, got "${to}"`);
+  return [name];
+}
+var plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+function formatRebuildReport(report) {
+  const lines = [];
+  for (const entry of report) {
+    const caught = plural(entry.caughtUpEvents, "event");
+    lines.push(
+      entry.failures.length === 0 ? `${entry.model}: swapped in ${entry.ms} ms, ${caught} caught up` : `${entry.model}: swapped in ${entry.ms} ms, but ${plural(entry.failures.length, "catch-up event")} failed (the model is swapped without them: fix the cause and replay it again)`
+    );
+    for (const c of entry.collections) lines.push(`  ${c.name} ${c.documents}`);
+    for (const f of entry.failures) {
+      lines.push(`  failed: seq ${f.seq} ${f.type} (${f.handler}): ${f.error}`);
+    }
+    if (entry.note !== void 0) lines.push(`  note: ${entry.note}`);
+  }
+  return lines.join("\n");
+}
+function formatDiff(diffs) {
+  const lines = [];
+  for (const diff of diffs) {
+    lines.push(`${diff.model} (dry run, nothing written):`);
+    if (diff.skipped !== void 0) lines.push(`  skipped: ${diff.skipped}`);
+    for (const c of diff.collections) {
+      lines.push(`  ${c.name}: ${c.added} added, ${c.changed} changed, ${c.removed} removed`);
+    }
+  }
+  return lines.join("\n");
+}
+var differs = (diffs) => diffs.some((d) => d.collections.some((c) => c.added + c.changed + c.removed > 0));
+function write3(stream, text2) {
+  return new Promise((done) => stream.write(`${text2}
+`, () => done()));
+}
+var replayCommand = defineCommand12({
+  meta: {
+    name: "replay",
+    description: "Rebuild a derived read model from the command store and swap it in: catalogue, orders, customers, search or all"
+  },
+  args: {
+    to: {
+      type: "string",
+      description: "The read model: catalogue, orders, customers, search or all"
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "Rebuild into memory and count what differs from the live read model; exits 1 if anything does",
+      default: false
+    }
+  },
+  async run({ args }) {
+    try {
+      const names = modelsOf(args.to);
+      const { config, adapters } = await loadProject();
+      const shared = names.filter((n) => n !== "search");
+      if (config.infrastructure.documentStore === "in-memory" && shared.length > 0) {
+        throw new ReplayError(
+          `the ${shared.join(", ")} read model${shared.length === 1 ? "" : "s"} live in the server's own process (documentStore: in-memory), out of reach of this one; a restart of the server rebuilds them. With documentStore redis or postgres-jsonb the read models are shared, and replay rebuilds them in place. --to search works here: the native index lives in the command store.`
+        );
+      }
+      if (config.infrastructure.commandStore === "sqlite" && !existsSync10(resolve8(sqliteFile4()))) {
+        throw new ReplayError(`no database at ${sqliteFile4()}: run \`nymbal migrate\``);
+      }
+      const { deps, close } = await openReadModels(config, {
+        // The report says what happened; log lines would repeat it.
+        logger: createLogger3({ level: "silent", pretty: false }),
+        ...adapters !== void 0 && { adapters }
+      });
+      try {
+        if (args["dry-run"]) {
+          const diffs = [];
+          for (const name of names) diffs.push(await diffReadModel(name, deps));
+          await write3(process.stdout, formatDiff(diffs));
+          process.exitCode = differs(diffs) ? 1 : 0;
+          return;
+        }
+        const report = await rebuild(names, deps);
+        await write3(process.stdout, formatRebuildReport(report));
+        process.exitCode = report.some((e) => e.failures.length > 0) ? 2 : 0;
+      } finally {
+        await close();
+      }
+    } catch (error) {
+      await write3(process.stderr, `nymbal replay: ${errorText4(error)}`);
+      process.exitCode = 2;
+    }
+  }
+});
+
+// src/commands/security.ts
+import { defineCommand as defineCommand13 } from "citty";
+import { createLogger as createLogger4, importProviderPackage } from "@nymbalhq/platform";
+import {
+  errorText as errorText5
+} from "@nymbalhq/types";
+var failure = (...stderr) => ({ code: 2, stdout: [], stderr });
+var isEmpty = (plan) => plan.phases.every((p2) => p2.add.length + p2.change.length + p2.remove.length === 0);
+function formatPlan(plan) {
+  const lines = [];
+  for (const { phase, add: add2, change, remove } of plan.phases) {
+    if (add2.length + change.length + remove.length === 0) continue;
+    lines.push(
+      `${phase}: ${add2.length} to add, ${change.length} to change, ${remove.length} to remove`
+    );
+    for (const rule of add2) lines.push(`  + ${rule.ref}  ${rule.action}  ${rule.expression}`);
+    for (const { ref, to } of change) lines.push(`  ~ ${ref}  ${to.action}  ${to.expression}`);
+    for (const rule of remove) lines.push(`  - ${rule.ref}`);
+  }
+  return lines;
+}
+function invalid(result) {
+  return failure(
+    "The security config cannot go onto the zone:",
+    ...result.errors.map((e) => `  ${e.code}  ${e.message}`)
+  );
+}
+function edgeNotes(security, mod) {
+  const notes = Object.keys(security.rateLimit).filter((key) => key.startsWith("/") && mod.hasSingleStar(key)).map(
+    (key) => `note: '${key}' matches one path segment per * in process, but any number at the edge (Cloudflare's * crosses /)`
+  );
+  if (security.botProtection.mode !== "off") {
+    notes.push(
+      "note: botProtection is left as the zone has it: Bot Fight Mode is a zone setting, not a ruleset rule"
+    );
+  }
+  return notes;
+}
+function finish(outcome, secrets) {
+  const masked = (lines) => lines.map((line) => secrets.reduce((text2, secret) => text2.split(secret).join("***"), line)).map((line) => `${line}
+`).join("");
+  process.stderr.write(
+    masked(outcome.stderr),
+    () => process.stdout.write(masked(outcome.stdout), () => process.exit(outcome.code))
+  );
+}
+async function runEdge(command, body) {
+  const secrets = [process.env["CLOUDFLARE_API_TOKEN"]];
+  let outcome;
+  try {
+    const { config } = await loadProject();
+    const security = config.security;
+    secrets.push(security.cloudflare?.apiToken);
+    if (security.adapter !== "cloudflare") {
+      outcome = failure(
+        `security.adapter is '${security.adapter}', which has no edge rules for nymbal ${command}: set security.adapter to 'cloudflare' (nymbal add cloudflare) to manage them on a Cloudflare zone`
+      );
+    } else {
+      const mod = await importProviderPackage(
+        "security",
+        "cloudflare",
+        process.env
+      );
+      const adapter = await mod.createAdapter({
+        slot: "security",
+        config: security.cloudflare ?? {},
+        logger: createLogger4({ level: "silent", pretty: false }),
+        env: process.env
+      });
+      outcome = await body(adapter, security, mod);
+    }
+  } catch (error) {
+    outcome = failure(`nymbal ${command} failed: ${errorText5(error)}`);
+  }
+  finish(
+    outcome,
+    secrets.filter((s) => typeof s === "string" && s !== "")
+  );
+}
+var json = {
+  type: "boolean",
+  description: "Print the result as one JSON document",
+  default: false
+};
+var securityPlanCommand = defineCommand13({
+  meta: {
+    name: "security:plan",
+    description: "Show what security:apply would change on the Cloudflare zone"
+  },
+  args: { json },
+  run: ({ args }) => runEdge("security:plan", async (adapter, security, mod) => {
+    const check = await adapter.validate(security);
+    if (!check.valid) return invalid(check);
+    const plan = await adapter.plan(security);
+    const notes = edgeNotes(security, mod);
+    if (args.json) return { code: 0, stdout: [JSON.stringify(plan, null, 2)], stderr: notes };
+    const lines = isEmpty(plan) ? ["No changes: the zone holds every Nymbal rule."] : formatPlan(plan);
+    return { code: 0, stdout: [...lines, ...notes], stderr: [] };
+  })
+});
+var securityApplyCommand = defineCommand13({
+  meta: {
+    name: "security:apply",
+    description: "Write the store's security rules to the Cloudflare zone, leaving the zone's own rules"
+  },
+  run: () => runEdge("security:apply", async (adapter, security) => {
+    const check = await adapter.validate(security);
+    if (!check.valid) return invalid(check);
+    const done = await adapter.apply(security);
+    const lines = isEmpty(done) ? ["Nothing to write: the zone already holds every Nymbal rule."] : ["Applied:", ...formatPlan(done)];
+    return { code: 0, stdout: lines, stderr: [] };
+  })
+});
+var securityDriftCommand = defineCommand13({
+  meta: {
+    name: "security:drift",
+    description: "Report where the zone's Nymbal rules differ from the config (exit 1 on drift)"
+  },
+  args: { json },
+  run: ({ args }) => runEdge("security:drift", async (adapter, security) => {
+    const report = await adapter.drift(security);
+    const code = report.drift ? 1 : 0;
+    if (args.json) return { code, stdout: [JSON.stringify(report, null, 2)], stderr: [] };
+    if (!report.drift)
+      return { code, stdout: ["In sync: the zone holds every Nymbal rule."], stderr: [] };
+    const lines = report.differences.map(
+      (d) => `  ${d.path}  configured ${JSON.stringify(d.configured) ?? "nothing"}, live ${JSON.stringify(d.actual) ?? "nothing"}`
+    );
+    return {
+      code,
+      stdout: [
+        `Drift: ${report.differences.length} difference(s); security:apply restores them`,
+        ...lines
+      ],
+      stderr: []
+    };
+  })
+});
+var securityInspectCommand = defineCommand13({
+  meta: {
+    name: "security:inspect",
+    description: "List the Nymbal rules live on the Cloudflare zone"
+  },
+  run: () => runEdge("security:inspect", async (adapter) => {
+    const { rulesApplied } = await adapter.inspect();
+    const lines = rulesApplied.length === 0 ? ["No Nymbal rules are live on the zone."] : rulesApplied;
+    return { code: 0, stdout: lines, stderr: [] };
+  })
+});
+
+// src/commands/test.ts
+import { defineCommand as defineCommand14 } from "citty";
+import { loadConfig as loadConfig4 } from "@nymbalhq/config";
+
+// src/commands/test-contracts.ts
+import { mkdirSync, realpathSync, writeFileSync as writeFileSync2 } from "fs";
+import { createRequire as createRequire3 } from "module";
+import { dirname as dirname7, join as join6, resolve as resolve9 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import { isDeepStrictEqual } from "util";
+import { findConfigFile as findConfigFile3, loadConfig as loadConfig3 } from "@nymbalhq/config";
+var CertifyError = class extends Error {
+};
+var firstLine = (text2) => text2.split("\n")[0].trim();
+var messageOf = (err2) => firstLine(err2 instanceof Error ? err2.message : String(err2));
+function resolveFrom(project, specifier, name, install) {
+  try {
+    return createRequire3(join6(project, "package.json")).resolve(specifier);
+  } catch (err2) {
+    if (err2.code === "MODULE_NOT_FOUND") {
+      throw new CertifyError(`${name} is not installed in ${project}: ${install}`);
+    }
+    throw new CertifyError(`${name} could not be resolved from ${project}: ${messageOf(err2)}`);
+  }
+}
+async function slotOptions(project, pkg, slot) {
+  if (findConfigFile3(project) === null) return void 0;
+  let commerce;
+  try {
+    commerce = (await loadConfig3(project)).config.commerce;
+  } catch (err2) {
+    throw new CertifyError(`the project's config could not be loaded: ${messageOf(err2)}`);
+  }
+  const naming = Object.entries(commerce).filter(([, block2]) => {
+    const b = block2;
+    return b.provider === "custom" && b.package === pkg;
+  });
+  const picked = slot === void 0 ? naming : naming.filter(([name]) => name === slot);
+  if (slot !== void 0 && picked.length === 0) {
+    throw new CertifyError(`no commerce slot '${slot}' with provider 'custom' names ${pkg}`);
+  }
+  if (picked.length > 1) {
+    throw new CertifyError(
+      `${pkg} is named by the ${picked.map(([name]) => name).join(", ")} slots: pick one with --slot`
+    );
+  }
+  const block = picked[0]?.[1];
+  return block === void 0 ? void 0 : block.config ?? {};
+}
+function withoutUndefined(value, path = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value !== "object" || path.has(value)) return value;
+  const proto = Object.getPrototypeOf(value);
+  if (!Array.isArray(value) && proto !== Object.prototype && proto !== null) return value;
+  path.add(value);
+  const out2 = Array.isArray(value) ? value.map((item) => withoutUndefined(item, path)) : Object.fromEntries(
+    Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => [k, withoutUndefined(v, path)])
+  );
+  path.delete(value);
+  return out2;
+}
+function survivesJson(value) {
+  try {
+    return isDeepStrictEqual(JSON.parse(JSON.stringify(value)), value);
+  } catch {
+    return false;
+  }
+}
+async function closeProbe(adapter) {
+  const close = adapter?.close;
+  if (typeof close === "function") await close.call(adapter);
+}
+function countCases(files) {
+  let passed = 0;
+  let failed = 0;
+  const visit = (task) => {
+    if (task.type === "test") {
+      if (task.result?.state === "pass") passed += 1;
+      else if (task.mode !== "skip" && task.mode !== "todo") failed += 1;
+    }
+    for (const child2 of task.tasks ?? []) visit(child2);
+  };
+  for (const file of files) visit(file);
+  return { passed, failed };
+}
+async function certifyPackage(input) {
+  const { pkg, slot } = input;
+  const config = findConfigFile3(input.cwd);
+  const project = realpathSync(config === null ? resolve9(input.cwd) : dirname7(config));
+  const vitestNode = resolveFrom(project, "vitest/node", "vitest", "npm install --save-dev vitest");
+  const kindsEntry = resolveFrom(
+    project,
+    "@nymbalhq/contract-tests/kinds",
+    "@nymbalhq/contract-tests",
+    "npm install --save-dev @nymbalhq/contract-tests"
+  );
+  if (!isInstalled(pkg, project)) {
+    throw new CertifyError(`${pkg} is not installed in ${project}: npm install ${pkg}`);
+  }
+  const contracts = join6(project, ".nymbal", "contracts");
+  const slug = pkg.replace(/[^a-z0-9]+/gi, "-").replace(/^-|-$/g, "");
+  mkdirSync(contracts, { recursive: true });
+  const shim = join6(contracts, `${slug}.adapter.mjs`);
+  writeFileSync2(shim, `export * from ${JSON.stringify(pkg)}
+`);
+  let mod;
+  try {
+    mod = await import(pathToFileURL2(shim).href);
+  } catch (err2) {
+    throw new CertifyError(`${pkg} could not be loaded: ${messageOf(err2)}`);
+  }
+  if (typeof mod.createAdapter !== "function") {
+    throw new CertifyError(`${pkg} exports no createAdapter(options) function to certify`);
+  }
+  const createAdapter = mod.createAdapter;
+  const extra = mod.contractOptions ?? {};
+  const slotConfig = await slotOptions(project, pkg, slot);
+  const fromSlot = slotConfig === void 0 ? void 0 : withoutUndefined(slotConfig);
+  const options = fromSlot ?? extra.options ?? {};
+  if (fromSlot !== void 0 && !survivesJson(fromSlot)) {
+    throw new CertifyError(
+      `the config of the slot naming ${pkg} holds a value JSON cannot carry (a function, Date, BigInt or cycle): certify it with plain data`
+    );
+  }
+  let kind;
+  try {
+    const probe = await createAdapter(options);
+    const own = probe?.kind;
+    kind = typeof own === "string" ? own : extra.kind;
+    await closeProbe(probe);
+  } catch (err2) {
+    throw new CertifyError(`createAdapter from ${pkg} threw: ${messageOf(err2)}`);
+  }
+  if (kind === void 0) {
+    throw new CertifyError(
+      `${pkg}'s adapter has no kind: a primitive names its own in contractOptions.kind`
+    );
+  }
+  const { CONTRACT_KINDS } = await import(pathToFileURL2(kindsEntry).href);
+  if (!CONTRACT_KINDS.includes(kind)) {
+    throw new CertifyError(
+      `no contract suite for kind '${kind}' (${pkg}); the kinds with one are ${CONTRACT_KINDS.join(", ")}`
+    );
+  }
+  const file = `${slug}.contract.test.mjs`;
+  writeFileSync2(
+    join6(contracts, file),
+    [
+      `// Written by \`nymbal test:contracts --package ${pkg}\`, and again on every run.`,
+      `import * as adapter from ${JSON.stringify(pkg)}`,
+      `import { contractSuites } from '@nymbalhq/contract-tests'`,
+      ``,
+      fromSlot === void 0 ? `const options = adapter.contractOptions?.options ?? {}` : `const options = ${JSON.stringify(fromSlot)}`,
+      `const unreachable = adapter.contractOptions?.unreachable`,
+      ``,
+      `async function build(config) {`,
+      `  const built = await adapter.createAdapter(config)`,
+      `  if (typeof built?.initialize === 'function') await built.initialize(config)`,
+      `  return built`,
+      `}`,
+      ``,
+      `contractSuites[${JSON.stringify(kind)}](${JSON.stringify(pkg)}, () => build(options), {`,
+      `  ...(unreachable !== undefined && { unreachable: () => build(unreachable) }),`,
+      `})`,
+      ``
+    ].join("\n")
+  );
+  const { startVitest } = await import(pathToFileURL2(vitestNode).href);
+  const vitest = await startVitest(
+    "test",
+    [],
+    {
+      config: false,
+      root: contracts,
+      include: [file],
+      watch: false,
+      testTimeout: 6e4,
+      hookTimeout: 6e4
+    },
+    { cacheDir: join6(contracts, ".vite") }
+  );
+  if (vitest === void 0) throw new CertifyError(`vitest did not start for ${pkg}`);
+  const files = vitest.state.getFiles();
+  const { passed, failed } = countCases(files);
+  const broken = files.some((f) => f.result?.state === "fail") || vitest.state.getUnhandledErrors().length > 0;
+  await vitest.close();
+  const total = passed + failed;
+  if (failed === 0 && total > 0 && !broken) {
+    process.stdout.write(`certified ${pkg} (${kind}): ${passed} cases passed
+`);
+    return 0;
+  }
+  process.stdout.write(`not certified ${pkg} (${kind}): ${failed} of ${total} cases failed
+`);
+  return 1;
+}
+
+// src/commands/test.ts
+var testCommand = defineCommand14({
   meta: { name: "test", description: "Run unit + integration tests (vitest)" },
   async run() {
     await runOrFail("pnpm", ["vitest", "run"]);
   }
 });
-var testE2eCommand = defineCommand9({
+var testE2eCommand = defineCommand14({
   meta: { name: "test:e2e", description: "Run Playwright E2E against the configured template" },
   async run() {
-    const { config } = await loadConfig3();
+    const { config } = await loadConfig4();
     await runOrFail("pnpm", [
       "--filter",
       "@nymbalhq/e2e",
@@ -1584,7 +2484,7 @@ var testE2eCommand = defineCommand9({
     ]);
   }
 });
-var testVisualCommand = defineCommand9({
+var testVisualCommand = defineCommand14({
   meta: { name: "test:visual", description: "Run visual regression tests (Playwright toHaveScreenshot)" },
   args: {
     "update-baselines": {
@@ -1594,7 +2494,7 @@ var testVisualCommand = defineCommand9({
     }
   },
   async run({ args }) {
-    const { config } = await loadConfig3();
+    const { config } = await loadConfig4();
     const isCI = !!process.env.CI;
     const updateBaselines = args["update-baselines"];
     if (updateBaselines && !isCI) {
@@ -1629,12 +2529,35 @@ var testVisualCommand = defineCommand9({
     }
   }
 });
-var testContractsCommand = defineCommand9({
-  meta: { name: "test:contracts", description: "Run adapter contract tests" },
+var testContractsCommand = defineCommand14({
+  meta: { name: "test:contracts", description: "Run adapter contract tests, or certify an adapter package" },
   args: {
-    adapter: { type: "string", description: "Run only contracts for a specific adapter (e.g. payments, email)" }
+    adapter: { type: "string", description: "Run only contracts for a specific adapter (e.g. payments, email)" },
+    package: {
+      type: "string",
+      description: "Certify an installed adapter package against the published suite for its kind"
+    },
+    slot: { type: "string", description: "With --package: the commerce slot whose config builds it" }
   },
   async run({ args }) {
+    if (args.package) {
+      const code = await certifyPackage({
+        pkg: String(args.package),
+        ...args.slot !== void 0 && { slot: String(args.slot) },
+        cwd: process.cwd()
+      }).catch((err2) => {
+        const message = err2 instanceof Error ? err2.message : String(err2);
+        const line = err2 instanceof CertifyError ? message : `test:contracts: ${message}`;
+        process.stderr.write(`${line.split("\n")[0]}
+`);
+        return 1;
+      });
+      await Promise.all([
+        new Promise((done) => process.stdout.write("", done)),
+        new Promise((done) => process.stderr.write("", done))
+      ]);
+      process.exit(code);
+    }
     const vArgs = [
       "vitest",
       "run",
@@ -1647,10 +2570,10 @@ var testContractsCommand = defineCommand9({
     await runOrFail("pnpm", vArgs);
   }
 });
-var testPerformanceCommand = defineCommand9({
+var testPerformanceCommand = defineCommand14({
   meta: { name: "test:performance", description: "Run Lighthouse CI against the configured template" },
   async run() {
-    const { config } = await loadConfig3();
+    const { config } = await loadConfig4();
     const port = config.template === "nextjs" ? 3e3 : 4321;
     await runOrFail("pnpm", ["lhci", "autorun"], {
       env: {
@@ -1661,7 +2584,7 @@ var testPerformanceCommand = defineCommand9({
     });
   }
 });
-var testAllCommand = defineCommand9({
+var testAllCommand = defineCommand14({
   meta: { name: "test:all", description: "Run unit, contract, e2e, visual, and performance tests" },
   async run() {
     const steps = [
@@ -1676,7 +2599,7 @@ var testAllCommand = defineCommand9({
         process.exit(code);
       }
     }
-    const { config } = await loadConfig3();
+    const { config } = await loadConfig4();
     await runOrFail("pnpm", [
       "--filter",
       "@nymbalhq/e2e",
@@ -1706,7 +2629,7 @@ var testAllCommand = defineCommand9({
 });
 
 // src/index.ts
-var main = defineCommand10({
+var main = defineCommand15({
   meta: {
     name: "nymbal",
     version: getCliVersion(),
@@ -1721,6 +2644,14 @@ var main = defineCommand10({
     "config:validate": configValidateCommand,
     add: addCommand,
     doctor: doctorCommand,
+    "security:plan": securityPlanCommand,
+    "security:apply": securityApplyCommand,
+    "security:drift": securityDriftCommand,
+    "security:inspect": securityInspectCommand,
+    secrets: secretsCommand,
+    events: eventsCommand,
+    audit: auditCommand,
+    replay: replayCommand,
     test: testCommand,
     "test:e2e": testE2eCommand,
     "test:visual": testVisualCommand,