pi-roundtable 0.8.0 → 0.9.0

package/src/cli/checks/database.ts

@@ -1,3 +1,4 @@
+import type { SQL } from "bun";
 import { nested, openPool, runMigrations } from "../../core/db/migrations.ts";
 import { MigrationError } from "../../core/errors.ts";
 import type { RoundtablePlugin } from "../../core/plugin.ts";
@@ -12,6 +13,8 @@ export interface DatabasePort {
 			| readonly Pick<RoundtablePlugin, "name" | "migrations">[]
 			| undefined,
 	): Promise<void>;
+	/** Runs `use` on a pool of the database at `url`, closed after; `use` only reads. */
+	read<T>(url: string, use: (sql: SQL) => Promise<T>): Promise<T>;
 }
 
 class Rollback extends Error {}
@@ -39,6 +42,14 @@ export const postgres: DatabasePort = {
 			await pool.close();
 		}
 	},
+	async read(url, use) {
+		const pool = openPool(url);
+		try {
+			return await use(pool);
+		} finally {
+			await pool.close();
+		}
+	},
 };
 
 /** The address without its password, safe to print. */

package/src/cli/checks/identity.ts

@@ -0,0 +1,225 @@
+import type { SQL } from "bun";
+import { LEGACY_ACCESS } from "../../core/config/access.ts";
+import type { ResolvedConfig } from "../../core/config/config.ts";
+import type { AccessRules } from "../../core/identity/access-policy.ts";
+import { identityOf, parseIdentity } from "../../core/identity/actor-facts.ts";
+import { declaredConflict } from "../../core/identity/config-owner.ts";
+import { backfillLine } from "../../core/identity/identity-plugin.ts";
+import {
+	type BackfillSummary,
+	backfillPrincipals,
+} from "../../core/identity/identity-schema.ts";
+import {
+	type DeclaredIdentity,
+	declaredIdentities,
+} from "../../core/identity/plugin-identities.ts";
+import { PgPrincipalStore } from "../../core/identity/principal-store.ts";
+import type { Project } from "../project.ts";
+import { fail, ok, type Result, skipped, warn } from "../report.ts";
+import type { DatabasePort } from "./database.ts";
+
+const list = (items: readonly string[]): string =>
+	new Intl.ListFormat("en").format(items);
+
+const message = (error: unknown): string =>
+	error instanceof Error ? error.message : String(error);
+
+/**
+ * The chat surfaces the host talks through, as `everyone` names them: Discord when it is
+ * configured, and each web chat plugin's surface, read from its name (`webchat` is `web`,
+ * `webchat-<surface>` is `<surface>`). A surface another plugin adds at setup is not seen here.
+ */
+export function surfacesOf(
+	config: Pick<ResolvedConfig, "discord">,
+	plugins: readonly { name: string }[],
+): string[] {
+	const surfaces = config.discord ? ["discord"] : [];
+	for (const { name } of plugins) {
+		if (name === "webchat") surfaces.push("web");
+		else if (name.startsWith("webchat-"))
+			surfaces.push(name.slice("webchat-".length));
+	}
+	return surfaces;
+}
+
+/**
+ * Whom the configuration serves: the owners by name, a warning when `everyone: true` admits
+ * everyone on every surface of a host with more than one, and a note when it is written in the
+ * deprecated 0.8 form. It reads no database, so `start` runs it too.
+ */
+export async function checkAccess(project: Project): Promise<Result> {
+	const assembled = await project.assembled();
+	if (!assembled.ok) return skipped("the configuration is not valid yet");
+	const { config, defined } = assembled.value;
+	const surfaces = surfacesOf(config, defined.plugins);
+	const broad = (["admins", "members"] as const).filter(
+		(tier) => config.access[tier]?.everyone === true,
+	);
+	if (broad.length > 0 && surfaces.length > 1)
+		return warn(
+			`${list(broad.map((tier) => `access.${tier}.everyone`))} ${broad.length === 1 ? "is" : "are"} true, which admits everyone on every surface: ${list(surfaces)}.`,
+			`Name the surfaces where everyone may talk, such as everyone: ["discord"], and admit the others by identity or by role, such as roles: ["web:role:<name>"].`,
+		);
+	const owners = config.access.owners;
+	const legacy = config.deprecations.includes(LEGACY_ACCESS)
+		? "; written as the 0.8 owner and speakers, which roundtable upgrade rewrites as access"
+		: "";
+	return ok(
+		`${owners.length} ${owners.length === 1 ? "owner" : "owners"}, ${list(owners.map((owner) => owner.name))}${legacy}`,
+	);
+}
+
+/** What the database says about the configured owners, and what the next start's backfill would make. */
+export interface PrincipalFindings {
+	summary: BackfillSummary;
+	/** A configured owner's identity linked to another principal, which stops the start, and how to fix it. */
+	conflicts: { problem: string; identity: string; fix: string }[];
+	/** Configured owners whose principal is disabled. */
+	disabled: { index: number; id: string; name: string }[];
+	/** Whether any owner, configured or granted by the CLI, can reach the host. */
+	reachable: boolean;
+}
+
+/**
+ * Reads, without writing, what the identity plugin would do at the next start: the backfill as a
+ * dry run, and the configured owners' identity links as its sync checks them. `declaredBy` holds
+ * each identity the plugins declare, with the plugin and the principal it names.
+ */
+export async function principalFindings(
+	sql: SQL,
+	rules: AccessRules,
+	declaredBy: ReadonlyMap<string, DeclaredIdentity> = new Map(),
+): Promise<PrincipalFindings> {
+	const summary = await backfillPrincipals(sql, rules, { dryRun: true });
+	const [tables] = await sql`
+		SELECT to_regclass('principal_identities') IS NOT NULL
+			AND to_regclass('principal_roles') IS NOT NULL AS made`;
+	// Before the first start on 0.9, the start makes every configured owner, enabled.
+	if (tables?.made !== true)
+		return { summary, conflicts: [], disabled: [], reachable: true };
+	const store = await PgPrincipalStore.attach(sql);
+	const conflicts: PrincipalFindings["conflicts"] = [];
+	// The primary owner's principal, undefined when the start makes it.
+	let primary: string | undefined;
+	const disabled: PrincipalFindings["disabled"] = [];
+	let reachable = false;
+	for (const [index, owner] of rules.owners.entries()) {
+		let id = owner.principal;
+		const links = await Promise.all(
+			owner.identities.map(async (identity) => {
+				const ref = parseIdentity(identity);
+				const link = ref && (await store.identity(ref.provider, ref.subject));
+				// A plugin's link no plugin declares any more is unlinked by the start before the owners are synced.
+				return link?.source === "plugin" && !declaredBy.has(identityOf(link))
+					? undefined
+					: link;
+			}),
+		);
+		const unlink = (identity: string) =>
+			`Unlink it with roundtable principal unlink ${identity}, or fix access.owners in roundtable.config.ts`;
+		// As at the start, a plugin's link never tells who the owner is.
+		for (const [i, link] of links.entries()) {
+			if (!link || link.source === "plugin") continue;
+			id ??= link.principalId;
+			const identity = owner.identities[i] ?? "";
+			if (link.principalId !== id)
+				conflicts.push({
+					problem: `access.owners[${index}].identities[${i}]: ${identity} is linked to principal ${link.principalId}, not to this owner's ${id}`,
+					identity,
+					fix: unlink(identity),
+				});
+		}
+		// As at the start, an identity a plugin declares is bound to this owner on this start, or it stops it.
+		for (const [i, identity] of owner.identities.entries()) {
+			const ref = parseIdentity(identity);
+			const declared = ref && declaredBy.get(identityOf(ref));
+			if (!declared) continue;
+			const conflict = declaredConflict({
+				index,
+				i,
+				identity,
+				id,
+				link: links[i],
+				declared,
+				primary,
+				first: index === 0,
+			});
+			if (conflict) conflicts.push({ ...conflict, identity });
+		}
+		if (index === 0) primary = id;
+		const principal = id === undefined ? undefined : await store.get(id);
+		if (principal?.disabled)
+			disabled.push({ index, id: principal.id, name: owner.name });
+		else reachable = true;
+	}
+	for (const holder of await store.holders("owner"))
+		if (
+			holder.source === "cli" &&
+			(await store.get(holder.principalId))?.disabled === false
+		)
+			reachable = true;
+	return { summary, conflicts, disabled, reachable };
+}
+
+/**
+ * The principals the next start would make from the people 0.8 stored, as a dry run printed as the
+ * start logs it; a configured owner's identity linked to another principal, which stops the
+ * start; and a disabled configured owner, or no owner left who can reach the host.
+ */
+export async function checkPrincipals(
+	project: Project,
+	database: DatabasePort,
+): Promise<Result> {
+	const url = await project.text("database", "url");
+	if (!url) return skipped("database.url has no value");
+	const assembled = await project.assembled();
+	if (!assembled.ok) return skipped("the configuration is not valid yet");
+	const rules = assembled.value.config.access;
+	let declaredBy: Map<string, DeclaredIdentity>;
+	try {
+		declaredBy = new Map(
+			declaredIdentities(assembled.value.defined.plugins).map((declared) => [
+				declared.identity,
+				declared,
+			]),
+		);
+	} catch (error) {
+		return skipped(
+			`the plugins' identities are not valid yet (${message(error)})`,
+		);
+	}
+	let findings: PrincipalFindings;
+	try {
+		findings = await database.read(url, (sql) =>
+			principalFindings(sql, rules, declaredBy),
+		);
+	} catch (error) {
+		return skipped(`PostgreSQL did not answer (${message(error)})`);
+	}
+	const dryRun = `dry run, nothing written: ${backfillLine(findings.summary)}`;
+	if (findings.conflicts.length > 0)
+		return fail(
+			`${findings.conflicts.map((conflict) => conflict.problem).join("; ")}; the host does not start until this is fixed.`,
+			findings.conflicts.map((conflict) => conflict.fix).join("\n"),
+		);
+	if (findings.disabled.length > 0) {
+		const who = list(
+			findings.disabled.map(
+				(owner) =>
+					`access.owners[${owner.index}] ${owner.name} (principal ${owner.id})`,
+			),
+		);
+		return warn(
+			findings.reachable
+				? `${who} ${findings.disabled.length === 1 ? "is" : "are"} disabled, so the host does not serve them.`
+				: `no owner can reach the host: ${who} ${findings.disabled.length === 1 ? "is" : "are"} disabled.`,
+			[
+				...findings.disabled.map(
+					(owner) => `Enable with roundtable principal enable ${owner.id}`,
+				),
+				dryRun,
+			].join("\n"),
+		);
+	}
+	return ok(dryRun);
+}

package/src/cli/checks/model.ts

@@ -1,8 +1,17 @@
 import { parseModelRef } from "../../core/models.ts";
+import {
+	BRIDGE_MEMORY_FIX,
+	bridgeMemoryProblem,
+	configuredCrowd,
+	onClaudeBridge,
+} from "../../core/runtime/bridge-guard.ts";
 import type { Ports, Project } from "../project.ts";
-import { fail, ok, type Result, skipped } from "../report.ts";
+import { fail, ok, type Result, skipped, warn } from "../report.ts";
 
-/** A login exists for the provider of the configured model: an API key variable or a stored login. */
+/**
+ * A login exists for the provider of the configured model: an API key variable or a stored login;
+ * with a non-failing warning for bridge's shared private-memory replay risk.
+ */
 export async function checkModelLogin(
 	project: Project,
 	ports: Pick<Ports, "login">,
@@ -15,12 +24,21 @@ export async function checkModelLogin(
 			`the model ${JSON.stringify(model)} is not written <provider>/<id>.`,
 			"Write it like anthropic/claude-sonnet-5-5 in MODEL in .env.",
 		);
+	// Admission warns of risk; each shared turn checks actual private history.
+	let risk: Result | undefined;
+	const assembled = await project.assembled();
+	if (assembled.ok) {
+		const { config } = assembled.value;
+		const crowd = configuredCrowd(config.access, config.plugins);
+		if (config.memory && crowd && onClaudeBridge(ref))
+			risk = warn(bridgeMemoryProblem(model, crowd), BRIDGE_MEMORY_FIX);
+	}
 	const dir = await project.text("agentDir");
 	const dataDir = await project.text("dataDir");
 	const agentDir = dir ?? (dataDir ? `${dataDir}/pi` : undefined);
 	if (!agentDir) return skipped("dataDir has no value");
 	const source = await ports.login(agentDir, ref.provider);
-	if (source) return ok(`${ref.provider} login from ${source}`);
+	if (source) return risk ?? ok(`${ref.provider} login from ${source}`);
 	return fail(
 		`no login for ${ref.provider}, the provider of ${model}.`,
 		`Set the provider's API key in .env (ANTHROPIC_API_KEY for anthropic, OPENAI_API_KEY for openai), or sign in with Pi so ${agentDir}/auth.json holds it.`,

package/src/cli/cli.ts

@@ -1,7 +1,9 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { resolveConfig } from "../core/config/config.ts";
 import type { DefinedRoundtable } from "../core/define-roundtable.ts";
 import { Roundtable } from "../core/host.ts";
+import { declaredIdentities } from "../core/identity/plugin-identities.ts";
 import { addPackage } from "./add-package.ts";
 import { addPlugin } from "./add-plugin.ts";
 import type { BunFacts } from "./checks/bun.ts";
@@ -10,11 +12,24 @@ import { doctor } from "./doctor.ts";
 import { fetchHttp } from "./http.ts";
 import { init } from "./init.ts";
 import { type PackagePorts, piPackagePorts } from "./pi-packages.ts";
-import { loadConfigFile, type Ports } from "./project.ts";
+import {
+	type Configured,
+	type ConfiguredIdentities,
+	PRINCIPAL_USAGE,
+	principalCommand,
+} from "./principal.ts";
+import {
+	CONFIG_FILE,
+	loadConfigFile,
+	loadDefault,
+	type Ports,
+	Project,
+} from "./project.ts";
 import { formatOutcomes } from "./report.ts";
 import { assemble, providerLogin } from "./runtime.ts";
 import { start } from "./start.ts";
 import { ADAPTERS, isAdapter, OFFICIAL_PLUGINS } from "./templates.ts";
+import { upgrade } from "./upgrade.ts";
 
 /** What the command line reads from its surroundings; tests replace every part. */
 export interface CliEnvironment {
@@ -42,6 +57,12 @@ const USAGE = `roundtable: a Discord agent server on Pi
                                 which are copied in ready to run instead of the template
   roundtable add package <spec> install a Pi package with bun add, and add plugins/<name>.ts that
                                 loads it and gives its tools to every agent turn
+  roundtable upgrade [--write [--unchecked]]
+                                show roundtable.config.ts rewritten in the 0.9 form (owner and
+                                speakers as access, discord as an adapter); --write writes it once
+                                it is checked to serve the same people, which needs the
+                                environment the host runs with; --unchecked writes it unchecked
+${PRINCIPAL_USAGE}
 `;
 
 /** The package's own version and the Bun range it needs, from the package.json beside the source. */
@@ -201,9 +222,102 @@ export async function runCli(
 		}
 		return 0;
 	}
+	if (command === "upgrade") {
+		const write = rest.includes("--write");
+		const unchecked = rest.includes("--unchecked");
+		if (rest.some((arg) => arg !== "--write" && arg !== "--unchecked"))
+			return usage(io, "upgrade takes only --write and --unchecked");
+		if (unchecked && !write) return usage(io, "--unchecked goes with --write");
+		return runUpgrade(io, write, unchecked);
+	}
+	if (command === "principal") {
+		const project = new Project(resolve(io.cwd), io.ports);
+		const raw = await project.raw();
+		if (!raw.ok) {
+			for (const line of formatOutcomes([
+				{ name: "configuration", result: raw.failure },
+			]))
+				io.err(line);
+			return 1;
+		}
+		const url = await project.text("database", "url");
+		if (!url) {
+			io.err(
+				`database.url has no value in ${CONFIG_FILE}; the principals live in the host's database. Set DATABASE_URL in .env.`,
+			);
+			return 1;
+		}
+		return principalCommand(url, rest, io, configured(raw.value));
+	}
 	return usage(io, `unknown command ${JSON.stringify(command)}`);
 }
 
+/**
+ * The owners the configuration lists and the identities its plugins declare, read by its schema
+ * alone: its plugins and model runtime are not assembled, so their failures do not pass for a
+ * configuration that does not load. Identities the start would refuse are unknown.
+ */
+function configured(value: unknown): Configured {
+	let config: ReturnType<typeof resolveConfig>;
+	try {
+		config = resolveConfig(value);
+	} catch {
+		return { owners: undefined, identities: undefined };
+	}
+	let identities: ConfiguredIdentities;
+	try {
+		identities = declaredIdentities(config.plugins);
+	} catch {
+		identities = undefined;
+	}
+	return { owners: config.access.owners, identities };
+}
+
+async function runUpgrade(
+	io: CliEnvironment,
+	write: boolean,
+	unchecked: boolean,
+): Promise<number> {
+	const report = await upgrade({
+		cwd: resolve(io.cwd),
+		write,
+		unchecked,
+		load: loadDefault,
+	});
+	if (!report.ok) {
+		for (const line of report.problems) io.err(line);
+		io.err(`${CONFIG_FILE} was not changed.`);
+		return 1;
+	}
+	if (report.changes.length === 0) {
+		io.out(
+			`${CONFIG_FILE} is already in the 0.9 form; there is nothing to change.`,
+		);
+		return 0;
+	}
+	io.out(`${CONFIG_FILE} in the 0.9 form:`);
+	for (const change of report.changes) io.out(`  - ${change}`);
+	io.out("");
+	for (const line of report.diff) io.out(line);
+	io.out("");
+	for (const note of report.notes) io.out(`Note: ${note}.`);
+	io.out(
+		"same" in report.verified
+			? "Checked: the rewrite serves the same owners, admins, and members, with the same Discord settings."
+			: `Not checked: ${report.verified.skipped}.`,
+	);
+	if (report.written && "skipped" in report.verified)
+		io.err(
+			`Warning: written without the check, as --unchecked asked. Nothing confirmed that the host serves the same owners, admins, and members as before; read the diff above, and run roundtable doctor with the environment the host runs with.`,
+		);
+	io.out(
+		report.written
+			? `Wrote ${CONFIG_FILE}; no other file was changed.`
+			: `Nothing was written. Run roundtable upgrade --write to write it.`,
+	);
+	return 0;
+}
+
 function usage(io: CliEnvironment, message: string): number {
 	io.err(message);
 	io.err(USAGE);

package/src/cli/config-edit.ts

@@ -1,7 +1,7 @@
 import { parse } from "@babel/parser";
 
 /** The parts of a syntax node this edit reads; the parser's own types are not needed beyond these. */
-interface Node {
+export interface Node {
 	type: string;
 	start: number;
 	end: number;
@@ -20,7 +20,7 @@ const WRAPPERS = new Set([
 	"ParenthesizedExpression",
 ]);
 
-const child = (node: Node, key: string): Node | undefined => {
+export const child = (node: Node, key: string): Node | undefined => {
 	const value = node[key];
 	return typeof value === "object" && value !== null
 		? (value as Node)
@@ -28,35 +28,53 @@ const child = (node: Node, key: string): Node | undefined => {
 };
 
 /** The expression under `satisfies`, `as`, `!`, and parentheses. */
-function unwrap(node: Node | undefined): Node | undefined {
+export function unwrap(node: Node | undefined): Node | undefined {
 	let current = node;
 	while (current && WRAPPERS.has(current.type))
 		current = child(current, "expression");
 	return current;
 }
 
-function parseModule(source: string, file: string): Node[] {
+/** A parsed module: its top-level statements, and every comment in it. */
+export interface ParsedModule {
+	body: Node[];
+	comments: Node[];
+}
+
+/** The module parsed, or a ConfigEditError saying it does not parse and what to do by hand, `instead`. */
+export function parseConfig(
+	source: string,
+	file: string,
+	instead: string,
+): ParsedModule {
 	try {
-		// SAFETY: every node the parser builds has a type, start, and end, which is all Node states.
-		return parse(source, {
+		const parsed = parse(source, {
 			sourceType: "module",
 			plugins: ["typescript"],
-		}).program.body as unknown as Node[];
+		});
+		// SAFETY: every node the parser builds has a type, start, and end, which is all Node states.
+		return {
+			body: parsed.program.body as unknown as Node[],
+			comments: (parsed.comments ?? []) as unknown as Node[],
+		};
 	} catch (error) {
 		throw new ConfigEditError(
-			`${file} does not parse (${error instanceof Error ? error.message : String(error)}). Fix it, or add the plugin to its list by hand.`,
+			`${file} does not parse (${error instanceof Error ? error.message : String(error)}). Fix it, or ${instead}.`,
 		);
 	}
 }
 
-const nameOf = (node: Node | undefined): string | undefined => {
+const parseModule = (source: string, file: string): Node[] =>
+	parseConfig(source, file, "add the plugin to its list by hand").body;
+
+export const nameOf = (node: Node | undefined): string | undefined => {
 	if (node?.type === "Identifier") return node.name as string;
 	if (node?.type === "StringLiteral") return node.value as string;
 	return undefined;
 };
 
 /** Every name the module already binds at its top level, so an import cannot shadow one. */
-function boundNames(body: readonly Node[]): Set<string> {
+export function boundNames(body: readonly Node[]): Set<string> {
 	const names = new Set<string>();
 	for (const statement of body) {
 		const declaration =
@@ -80,7 +98,7 @@ function boundNames(body: readonly Node[]): Set<string> {
 }
 
 /** The object the config exports: the default export itself, or the top-level constant it names. */
-function exportedObject(body: readonly Node[]): Node | undefined {
+export function exportedObject(body: readonly Node[]): Node | undefined {
 	const exported = body.find(
 		(node) => node.type === "ExportDefaultDeclaration",
 	);
@@ -112,7 +130,7 @@ function pluginList(object: Node): Node | undefined {
 	return undefined;
 }
 
-interface Insertion {
+export interface Insertion {
 	at: number;
 	text: string;
 	/** How many characters from `at` the text replaces; none when it only inserts. */
@@ -162,7 +180,11 @@ function expandedList(
 }
 
 /** The text to add so `ident` joins the list, in the list's own layout. */
-function listInsertion(source: string, list: Node, ident: string): Insertion {
+export function listInsertion(
+	source: string,
+	list: Node,
+	ident: string,
+): Insertion {
 	const elements = (list.elements as (Node | null)[]).filter(
 		(element): element is Node => element !== null,
 	);
@@ -205,6 +227,54 @@ function importInsertion(
 		: { at: 0, text: `${line}\n\n` };
 }
 
+/** Where an import of a package goes: after the package imports that sort before it, else first. */
+export function packageImport(
+	body: readonly Node[],
+	specifier: string,
+	line: string,
+): Insertion {
+	const imports = body.filter((node) => node.type === "ImportDeclaration");
+	const from = (node: Node) => String(child(node, "source")?.value ?? "");
+	const before = imports
+		.filter((node) => !from(node).startsWith(".") && from(node) < specifier)
+		.at(-1);
+	if (before) return { at: before.end, text: `\n${line}` };
+	const first = imports[0];
+	return first
+		? { at: first.start, text: `${line}\n` }
+		: { at: 0, text: `${line}\n\n` };
+}
+
+/** Whether the module imports `name` from `specifier` under that same name. */
+export function importsName(
+	body: readonly Node[],
+	specifier: string,
+	name: string,
+): boolean {
+	return body.some(
+		(node) =>
+			node.type === "ImportDeclaration" &&
+			child(node, "source")?.value === specifier &&
+			(node.specifiers as Node[]).some(
+				(imported) =>
+					imported.type === "ImportSpecifier" &&
+					nameOf(child(imported, "imported")) === name &&
+					nameOf(child(imported, "local")) === name,
+			),
+	);
+}
+
+/** Whether the file imports anything from `specifier`. */
+export const importsFrom = (
+	body: readonly Node[],
+	specifier: string,
+): boolean =>
+	body.some(
+		(node) =>
+			node.type === "ImportDeclaration" &&
+			child(node, "source")?.value === specifier,
+	);
+
 /**
  * Adds the plugin's import line and lists it in the `plugins` array of the default export, in the
  * file's own layout; a one-line list that would pass 80 columns is put one element a line. It

package/src/cli/doctor.ts

@@ -9,6 +9,7 @@ import {
 	Discord,
 } from "./checks/discord.ts";
 import { checkEnvironment } from "./checks/environment.ts";
+import { checkAccess, checkPrincipals } from "./checks/identity.ts";
 import { checkImageProvider } from "./checks/images.ts";
 import { checkModelLogin } from "./checks/model.ts";
 import { checkPublicUrl } from "./checks/public-url.ts";
@@ -64,6 +65,7 @@ export function buildChecks(
 			run: () => checkConfiguration(project),
 		},
 		{ name: "plugins", offline: true, run: () => checkPlugins(project) },
+		{ name: "access", offline: true, run: () => checkAccess(project) },
 		{
 			name: "image provider",
 			offline: true,
@@ -74,6 +76,11 @@ export function buildChecks(
 			offline: false,
 			run: () => checkDatabase(project, database),
 		},
+		{
+			name: "principals",
+			offline: false,
+			run: () => checkPrincipals(project, database),
+		},
 		{
 			name: "Discord token",
 			offline: false,