@descix/cli 2.0.3 → 3.0.0

package/README.md

@@ -183,48 +183,6 @@ build variables the server returns injected into its environment:
 }
 ```
 
-## Airdrop Admin Operations (WS-ADMIN-B1)
-
-Admin-only commands for triggering airdrop migration batch runs. Per CEO-D-MANUAL-TRIGGER-NO-CRON (2026-04-20), Cloud Scheduler cron was dropped from Round B in favor of operator-invoked manual triggers via this CLI.
-
-**Access:** requires platform-admin membership (enforced server-side via `isPlatformAdmin(user)`).
-
-### `descix airdrop execute-queue`
-
-Manually trigger the server-side `airdrop_execute_queue` command on the target environment. Assembles `pending_migrations` rows into per-community batches and (when `BATCH_UPDATE_BALANCES_BROADCAST_ENABLED=true`) broadcasts to the Powch HD wallet. When the broadcast flag is off (default for DEV), batches are assembled but the downstream Powch handler returns `stopped_at_broadcast_boundary` — useful for verifying queue shape without spending MATIC.
-
-**Read-only is the default.** Without `--apply`, the command runs as a dry run.
-
-**Options:**
-
-- `--dry-run`: Read-only preview — encode calldata, estimate gas, validate the net-zero invariant. No PK, no transaction, no state mutation. Mutually exclusive with `--apply`.
-- `--apply`: Live execution. Requires `--signer-pk-file` or the interactive prompt, and requires `--community`.
-- `--community <slug>`: Community slug for per-community batch scoping. **Required for `--apply`**; optional in dry-run mode, where omitting it returns an aggregate preview across communities.
-- `--signer-pk-file <path>`: Path to a file containing the admin signer PK (`0x` + 64 hex). Used for `--apply`; when omitted, the PK is requested at an interactive no-echo prompt. Inline PK flags and environment variables are rejected on security grounds (process-listing leak).
-- `--batch-size <n>`: Cap on users processed this run (server caps at `AIRDROP_MAX_RUN_USERS`; a larger `--batch-size` is clamped).
-
-**Examples:**
-
-```bash
-# Dry run against DEV — safe to run repeatedly; no PK, no tx, no state mutation
-descix airdrop execute-queue --env dev --dry-run
-
-# Dry run scoped to one community
-descix airdrop execute-queue --env dev --dry-run --community smile
-
-# Live execution, capped at 10 users this invocation (prompts for the signer PK)
-descix airdrop execute-queue --env dev --apply --community smile --batch-size 10
-
-# Live execution reading the signer PK from a file
-descix airdrop execute-queue --env dev --apply --community smile --signer-pk-file ./signer.key
-```
-
-**Testing:**
-
-```bash
-cd DeSciX_Core/descix-cli && npm test
-```
-
 ## Documentation
 
 For full documentation, please refer to the [DeSciX SDK Documentation](./SERVICE_README_sdk.md).

package/bin/descix.js

@@ -7,7 +7,7 @@
  * Combines CLI and MCP functionality with unified authentication.
  */
 
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
 import chalk from 'chalk';
 import { DeSciXApiClient } from '../lib/api-client.js';
 import { requireAuth } from '../lib/auth-guard.js';
@@ -28,7 +28,6 @@ import * as authCommands from '../lib/commands/auth.js';
 import * as configCommands from '../lib/commands/config.js';
 import * as buyCommands from '../lib/commands/buy.js';
 import * as creditsCommands from '../lib/commands/credits.js';
-import * as airdropCommands from '../lib/commands/airdrop.js';
 import { MICROSERVICE_AUTH_MODEL } from '../lib/commands/microservice-auth-model.js';
 import { runInit } from '../lib/commands/init.js';
 // "May I prompt?" has ONE OWNER. No command in this file derives it.
@@ -430,30 +429,6 @@ creditsCommand
     }
   });
 
-// ============ Airdrop Commands (WS-ADMIN-B1 manual-trigger) ============
-// Per CEO-D-MANUAL-TRIGGER-NO-CRON (2026-04-20), airdrop batch execution is operator-triggered
-// via this CLI command group rather than Cloud Scheduler cron. Server-side access is gated on
-// platform-admin membership (`isPlatformAdmin(user)`); the server emits an on_chain_log row
-// with `caller.operator_email` for audit.
-
-const airdropCommand = program
-  .command('airdrop')
-  .description('Admin airdrop migration operations (WS-ADMIN-B1)');
-
-airdropCommand
-  .command('execute-queue')
-  .description('DRY-RUN ONLY preview of the airdrop migration queue (admin-only). Execution lives in daita-sam (act plan + the role holder\'s own wallet) — the apply leg is removed.')
-  .option('--community <slug>', 'Community slug for per-community batch scoping')
-  .option('--dry-run', 'Read-only preview: encode calldata, estimate gas, validate net-zero invariant. No PK, no tx, no state mutation. (The default; the flag is accepted for scripts.)')
-  .option('--batch-size <n>', 'Cap on users processed this run (server caps at AIRDROP_MAX_RUN_USERS)')
-  .action(async (options) => {
-    try {
-      await airdropCommands.executeQueue(options);
-    } catch (error) {
-      fail(error);
-    }
-  });
-
 // ============ Sync Commands: REMOVED ============
 // `sync assets`, `sync site` and `sync kb` are all gone, so the `sync` GROUP is gone with
 // them: a registered verb with no working children is dead weight. Every retired verb is
@@ -1688,7 +1663,8 @@ appCommand
 // ============ App: set-default-model (WS-CONFIG-BOOTSTRAP-FIX item #10) ============
 //
 // Updates Community/{c}/Apps/{a}.default_app_model. Per CEO inheritance chain:
-//   options.model > kb.kb_model_override > app.default_app_model > levelConfig.model > DEFAULT_AI_MODEL
+//   request intelligence_level > kb.kb_model_override > app.default_app_model > the level's model
+// (there is no separate default model: the default is the model of DEFAULT_INTELLIGENCE_LEVEL)
 //
 // --clear deletes the field via FieldValue.delete() (NOT null) so the resolver falls through
 // cleanly to per-level platform defaults.
@@ -1697,13 +1673,13 @@ appCommand
   .command('set-default-model')
   .description('Set or clear App.default_app_model (model used when no KB override is set)')
   .requiredOption('-a, --app <app_id>', 'App ID (e.g. unk-cos)')
-  .option('-m, --model <model_name>', 'Gemini model name (e.g. gemini-3.1-flash-lite). Mutually exclusive with --clear.')
+  .option('-m, --model <model_name>', 'Model name (e.g. gemini-3.8-flash). Mutually exclusive with --clear.')
   .option('--clear', 'Delete App.default_app_model via FieldValue.delete() (resets to platform-default inheritance)')
   .addHelpText('after', `
-NOTE: Pinning a "Pro" model (e.g., gemini-2.5-pro, gemini-3.1-pro-preview) as
-an app or KB override will fail at L1 — these models require thinking mode and
-reject L1's thinkingBudget=0. If you intend an L1-compatible override, use a
-"Flash" model (gemini-2.5-flash, gemini-3.1-flash-lite, gemini-3-flash-preview).
+NOTE: A pinned model is paired with a thinking_level, and which levels exist is a
+property of the MODEL. The server refuses, by name, a (model, thinking_level) pair
+it does not support. The current intelligence levels (each names its own model and
+thinking_level) are printed under "Per-level" after this command runs.
 `)
   .action(async (options) => {
     try {
@@ -1845,12 +1821,12 @@ kbCommand
   .description('Set KB.kb_model_override (per-KB model selection)')
   .requiredOption('-a, --app <app_id>', 'App ID')
   .requiredOption('-k, --kb <kb_name>', 'KB name')
-  .requiredOption('-m, --model <model_name>', 'Gemini model name (e.g. gemini-2.5-pro)')
+  .requiredOption('-m, --model <model_name>', 'Model name (e.g. gemini-3.8-flash)')
   .addHelpText('after', `
-NOTE: Pinning a "Pro" model (e.g., gemini-2.5-pro, gemini-3.1-pro-preview) as
-an app or KB override will fail at L1 — these models require thinking mode and
-reject L1's thinkingBudget=0. If you intend an L1-compatible override, use a
-"Flash" model (gemini-2.5-flash, gemini-3.1-flash-lite, gemini-3-flash-preview).
+NOTE: A pinned model is paired with a thinking_level, and which levels exist is a
+property of the MODEL. The server refuses, by name, a (model, thinking_level) pair
+it does not support. The current intelligence levels (each names its own model and
+thinking_level) are printed under "Per-level" after this command runs.
 `)
   .action(async (options) => {
     try {
@@ -2372,7 +2348,11 @@ siteCommand
 
       console.log(chalk.cyan(`\n  Site Upload: ${appId} → GCS\n`));
       console.log(chalk.gray(`  Source: ${sourceLabel}`));
-      console.log(chalk.gray(`  Target: ${communityId}/${appId}`));
+      // The write prefix is server-owned and FLAT ({env}/{appId}/site/ — community_id is
+      // derived server-side from Products/{app_id} and a caller-supplied one is ignored).
+      // Printing a locally-guessed community here once read as a changed write target and
+      // held up a prod upload (FRAQTL wall, 2026-10-12) — say only what this client knows.
+      console.log(chalk.gray(`  Target: {env}/${appId}/site/ (flat; community resolved server-side)`));
       if (options.preview) console.log(chalk.yellow(`  Mode: PREVIEW`));
       if (gitStatus.isGitRepo) {
         console.log(chalk.gray(`  Git: ${gitStatus.branch} @ ${gitStatus.shortHash}`));
@@ -3381,11 +3361,15 @@ program
   .option('--apps <ids>', 'Comma-separated app IDs for cross-app query')
   .option('--level <n>', 'Intelligence level (1-5)', parseInt)
   .option('--model <name>', 'Explicit model override')
-  .option('--thinking <budget>', 'Thinking token budget (-1=dynamic, 0=off, N=fixed)', parseInt)
+  .option('--thinking-level <level>', 'Thinking level for this call: minimal, low, medium or high. The server refuses a level the resolved model does not support.')
+  .addOption(new Option('--thinking <budget>').hideHelp())
   .option('--tokens', 'Show token usage in response footer')
   .option('--new', 'Start a new conversation (clear session)')
   .action(async (questionArgs, options) => {
     try {
+      if (options.thinking !== undefined) {
+        throw new Error('--thinking (a token budget) was removed. Use --thinking-level <level>, one of minimal, low, medium, high.');
+      }
       const apiClient = new DeSciXApiClient();
       await requireAuth(apiClient);
 
@@ -3411,7 +3395,7 @@ program
           user_input: question,
           intelligence_level: options.level,
           model: options.model,
-          thinking_budget: options.thinking,
+          thinking_level: options.thinkingLevel,
           streaming: false
         });
         const result = response.message || response;
@@ -3518,7 +3502,7 @@ program
         streaming: false,
         intelligence_level: options.level,
         model: options.model,
-        thinking_budget: options.thinking,
+        thinking_level: options.thinkingLevel,
       };
 
       if (useMultiKb) {

package/lib/agent-files.js

@@ -12,6 +12,7 @@ import * as path from 'path';
 import { fileURLToPath } from 'url';
 import { readIdentity, isIdentityNamed } from './workspace-identity.js';
 import { mcpServerEntry } from './invocation.js';
+import { CLI_VERSION } from './cli-version.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -71,7 +72,7 @@ async function loadContext(workspaceRoot) {
   // Friendly name: capitalize app_id or use as-is
   const appName = appId.charAt(0).toUpperCase() + appId.slice(1);
 
-  return { appId, communityId, apiUrl: originLine, appName, originSource };
+  return { appId, communityId, apiUrl: originLine, appName, originSource, cliVersion: CLI_VERSION };
 }
 
 /**
@@ -82,7 +83,9 @@ function render(template, vars) {
     .replace(/\{\{appId\}\}/g, vars.appId)
     .replace(/\{\{communityId\}\}/g, vars.communityId)
     .replace(/\{\{apiUrl\}\}/g, vars.apiUrl)
-    .replace(/\{\{appName\}\}/g, vars.appName);
+    .replace(/\{\{appName\}\}/g, vars.appName)
+    .replace(/\{\{originSource\}\}/g, vars.originSource)
+    .replace(/\{\{cliVersion\}\}/g, vars.cliVersion);
 }
 
 /**

package/lib/app-scaffold.js

@@ -0,0 +1,68 @@
+/**
+ * THE ONE OWNER of the files `descix app init` stamps into an app repo beyond the workspace and
+ * the agent instruction files (proposal 2026-10-09-standard-app-repo-form, items 3 and 5):
+ *
+ *   .descix/manifests/site.json   the deployable site set (`descix site upload` reads it)
+ *   .claude-plugin/plugin.json    the Claude plugin stub
+ *   site/index.html               the front-page template (templates/scaffolds/frontpage/)
+ *
+ * ONLY-IF-ABSENT: a file that exists is never read-modified, never overwritten, never reported as
+ * written. The agent files (CLAUDE.md …) stay with lib/agent-files.js; this module does not write
+ * them.
+ */
+import fs from 'fs/promises';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const FRONTPAGE_TEMPLATE = path.join(
+  path.dirname(fileURLToPath(import.meta.url)), '..', 'templates', 'scaffolds', 'frontpage', 'index.html',
+);
+
+const escapeHtml = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+async function writeIfAbsent(file, content) {
+  await fs.mkdir(path.dirname(file), { recursive: true });
+  try {
+    await fs.writeFile(file, content, { encoding: 'utf8', flag: 'wx' });
+    return true;
+  } catch (err) {
+    if (err.code === 'EEXIST') return false;
+    throw err;
+  }
+}
+
+/**
+ * @param {string} appPath the app repo root
+ * @param {{appId: string, communityId: string}} identity
+ * @returns {Promise<string[]>} repo-relative paths actually created
+ */
+export async function scaffoldAppRepo(appPath, { appId, communityId }) {
+  if (!appId || !communityId) {
+    throw new Error('scaffoldAppRepo: appId and communityId are required (no default would be true).');
+  }
+  const siteManifest = {
+    _purpose: `Deployable site set for the ${appId} app; sources are uploaded by descix site upload.`,
+    sources: [{ path: 'site' }],
+    buildCommand: null,
+  };
+  const plugin = {
+    name: appId,
+    description: `${appId}, an app of the ${communityId} community on DeSciX.`,
+    version: '0.1.0',
+    author: { name: communityId },
+  };
+  const frontpage = (await fs.readFile(FRONTPAGE_TEMPLATE, 'utf8'))
+    .replace(/\{\{APP_ID\}\}/g, escapeHtml(appId))
+    .replace(/\{\{COMMUNITY_ID\}\}/g, escapeHtml(communityId));
+
+  const files = [
+    ['.descix/manifests/site.json', JSON.stringify(siteManifest, null, 2) + '\n'],
+    ['.claude-plugin/plugin.json', JSON.stringify(plugin, null, 2) + '\n'],
+    ['site/index.html', frontpage],
+  ];
+  const created = [];
+  for (const [rel, content] of files) {
+    if (await writeIfAbsent(path.join(appPath, rel), content)) created.push(rel);
+  }
+  return created;
+}

package/lib/commands/appInit.js

@@ -15,6 +15,7 @@ import path from 'path';
 import { WorkspaceConfig, assertNoParentWorkspace } from '../workspace-config.js';
 import { refreshCommunityIdentity, printIdentityReceipt } from './communityIdentity.js';
 import { generateAgentFiles } from '../agent-files.js';
+import { scaffoldAppRepo } from '../app-scaffold.js';
 
 /**
  * @param {Object} apiClient an authenticated DeSciXApiClient
@@ -130,6 +131,7 @@ export async function runAppInit(apiClient, options) {
     await fs.writeFile(descPath, `# ${appId}\n\nApplication description goes here.\n`);
   }
   console.log(chalk.gray(`  Created: site/, microservice/, assets/`));
+  for (const f of await scaffoldAppRepo(appPath, { appId, communityId })) console.log(chalk.green(`  ✓ ${f}`));
 
   // 3. The default KB — CREATE leg only (see the adopt block above: map never creates).
   let kbResult = null;

package/lib/commands/model-config.js

@@ -7,8 +7,9 @@
  *   - descix kb set-override-model -a <app_id> -k <kb_name> -m <model_name> [--env=dev|demo|prod]
  *   - descix kb clear-override-model -a <app_id> -k <kb_name> [--env=dev|demo|prod]
  *
- * Per CEO 2026-05-26 inheritance chain:
- *   options.model || kb.kb_model_override || app.default_app_model || levelConfig.model || utils.DEFAULT_AI_MODEL
+ * Resolver order (the server owns it; this CLI prints the chain the server reports):
+ *   request intelligence_level > kb.kb_model_override (+ its thinking_level) > app.default_app_model > the level's model
+ * There is no separate default model: the default is the model of the platform's default intelligence level.
  *
  * --clear flows use FieldValue.delete() server-side (NOT null) per tripwire #2.
  *
@@ -110,12 +111,10 @@ function identityFromApiClient(apiClient) {
 function printResolution({ app_id, resolution }) {
     if (!resolution) return;
     const dam = resolution.default_app_model === null ? 'null' : `"${resolution.default_app_model}"`;
-    const dai = resolution.default_ai_model ? `"${resolution.default_ai_model}"` : 'null';
 
     console.log(chalk.cyan('\nResolution chain that will apply going forward:'));
     console.log(chalk.gray(`  ${resolution.chain}`));
     console.log(chalk.gray(`  app.default_app_model = ${dam}`));
-    console.log(chalk.gray(`  utils.DEFAULT_AI_MODEL = ${dai}`));
 
     const levels = resolution.intelligence_levels || {};
     const levelKeys = Object.keys(levels).sort();

package/lib/commands/retired-verbs.js

@@ -24,6 +24,11 @@ const kbSyncRefusal = (invocation) =>
   `\`${CANONICAL_KB_CREATE}\`.`;
 const KB_SYNC_DESCRIPTION = `REMOVED — use \`${CANONICAL_KB_SYNC}\``;
 
+const AIRDROP_QUEUE_REFUSAL = (invocation) =>
+  `❌ \`${invocation}\` has been REMOVED: the pending_migrations queue it previewed (lane B) no longer ` +
+  `exists, and neither does the server command behind it.\n\n` +
+  `Distributions run through the offers rail on daita-sam (act plan + the role holder's own wallet signs).`;
+
 /**
  * Every retired verb. `invocation` is what a user types; `parent` is the id of the commander
  * parent it hangs off (a root passed to registerAllRetiredVerbs, or an earlier row); `refusal`
@@ -52,6 +57,12 @@ export const RETIRED_VERBS = Object.freeze([
     refusal: () =>
       '"descix microservice register-delegate" has been removed: there is no per-app microservice ' +
       'delegate key.\n' + MICROSERVICE_AUTH_MODEL },
+  // Lane B (the pending_migrations queue) is struck (CEO word Unkamon 1530eb6, daita-sam#4).
+  { id: 'airdrop', parent: 'program', name: 'airdrop', invocation: 'descix airdrop',
+    description: 'removed — see error text', refusal: (invocation) => AIRDROP_QUEUE_REFUSAL(invocation) },
+  { id: 'airdrop.execute-queue', parent: 'airdrop', name: 'execute-queue',
+    invocation: 'descix airdrop execute-queue', description: 'removed — see error text',
+    refusal: (invocation) => AIRDROP_QUEUE_REFUSAL(invocation) },
 ]);
 
 /** Implementations deleted with the KB sync surfaces. No exported symbol survives without a caller. */

package/lib/verb-invokes.generated.json

@@ -2,9 +2,6 @@
   "admin-login": [
     "admin_bootstrap_login"
   ],
-  "airdrop execute-queue": [
-    "airdrop_execute_queue"
-  ],
   "app delete": [
     "delete_app"
   ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@descix/cli",
-  "version": "2.0.3",
+  "version": "3.0.0",
   "description": "DeSciX CLI and MCP Server - Unified command-line interface for DeSciX platform",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "googleapis": "^170.1.0",
     "inquirer": "^12.1.0",
     "ora": "^9.0.0",
-    "@descix/platform-api": "^2.0.0"
+    "@descix/platform-api": "^4.0.0"
   },
   "devDependencies": {
     "acorn": "^8.18.0"

package/templates/agent-claude.md

@@ -1,3 +1,9 @@
+## DeSciX lane
+LANE: app          ENV: {{apiUrl}} (origin source: {{originSource}}; this repo's own .descix/workspace.json env.apiUrl and wallet — `descix whoami` must agree, never an environment variable)
+SDK: ONLY the published packages, as an external developer, invoked as `npx -y -p @descix/cli@{{cliVersion}} descix …` (an `npx` call without `-p @descix/cli` resolves the wrong package); never platform source
+HANDBOOK: 1 `descix tell-me-how "<question>"`  2 the docs shipped inside the published packages (@descix/cli agent-assets/, @descix/app-sdk README.md)  3 the app-developer runbook, live at https://descix.net/prod/daita-docs/site/app-sdk/app-developer-runbook.html
+PLATFORM WALL: when the handbook does not answer — stop, write the question with evidence (command, output, the CLI's origin banner line) and hand it to Sam to open a platform session. Never open platform source to answer it.
+
 # DeSciX App Development
 
 <!-- BOOTSTRAP MODE: This file was auto-generated by DeSciX.
@@ -282,7 +288,7 @@ You are bonded to cloud knowledge bases. **BEFORE starting any task**, query the
 
 **Multi-app query (preferred — richer context):**
 ```bash
-descix chat --apps APP1,APP2 -q "YOUR SPECIFIC QUESTION" --level 3 --thinking -1 --tokens
+descix chat --apps APP1,APP2 -q "YOUR SPECIFIC QUESTION" --level 3 --thinking-level low --tokens
 ```
 
 **Single-app query:**
@@ -297,7 +303,7 @@ ask_question_to_app({ app_id: "APP_ID", user_input: "YOUR SPECIFIC QUESTION" })
 
 **Query parameters:**
 - `--level 1-5` — intelligence (1=fast lookup, 3=balanced, 5=deep reasoning)
-- `--thinking -1` — dynamic thinking budget; `0`=off, `N`=fixed tokens
+- `--thinking-level minimal|low|medium|high` — how much the model thinks; the server refuses a level the resolved model does not support
 - `--tokens` — show token usage in response
 - Omit `--new` to continue the session thread (Gemini remembers context)
 

package/templates/scaffolds/README.md

@@ -39,6 +39,10 @@ A complete Express microservice with:
 descix microservice init
 ```
 
+### Front page (`frontpage/`)
+
+The shared front-page template (`index.html`: head styles, `<nav class="nav">`, `<header class="hero" id="top">`, `<section class="sec" id="…">` blocks, `<footer>`). It is stamped by `descix app init` as `site/index.html`, ONLY if that file is absent, with `{{APP_ID}}` / `{{COMMUNITY_ID}}` filled by `lib/app-scaffold.js`. It is not a `site init` scaffold type. Each repo owns its own divergence after the stamp; no repo reads this template across repositories.
+
 ## Usage
 
 Run scaffold commands from your app directory (auto-detects context):

package/templates/scaffolds/frontpage/index.html

@@ -0,0 +1,124 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+<title>{{APP_ID}} — a {{COMMUNITY_ID}} app on DeSciX</title>
+<meta name="description" content="{{APP_ID}}, an app of the {{COMMUNITY_ID}} community on DeSciX. Replace this description with what the app is for.">
+<style>
+:root{
+  --bg:#0b0f14; --bg2:#10161e; --panel:#151d27; --line:#233040; --line2:#2f3f52;
+  --ink:#e9eef3; --ink2:#b3bfcc; --mute:#7f8ea0;
+  --cyan:#5fcbe6; --cyan2:#3aa9c6; --cyan-ink:#06202a;
+  --serif:Georgia,"Times New Roman",serif;
+  --sans:"Helvetica Neue",Arial,sans-serif;
+  --mono:ui-monospace,SFMono-Regular,Menlo,monospace;
+  color-scheme:dark;
+}
+*{box-sizing:border-box}
+[hidden]{display:none!important}
+body{margin:0;background:var(--bg);color:var(--ink);font-family:var(--sans);font-size:17px;line-height:1.55;-webkit-font-smoothing:antialiased}
+a{color:var(--cyan);text-decoration:none}
+a:hover{text-decoration:underline}
+a:focus-visible,button:focus-visible{outline:2px solid var(--cyan);outline-offset:2px}
+img{max-width:100%;display:block}
+h1,h2,h3{font-family:var(--serif);font-weight:500;line-height:1.08;margin:0;text-wrap:balance;letter-spacing:-.01em}
+h2{font-size:clamp(30px,4.2vw,46px)}
+h3{font-size:22px}
+p{margin:0}
+.wrap{max-width:1120px;margin:0 auto;padding-inline:20px}
+.eyebrow{font-family:var(--mono);font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--cyan)}
+.sec{padding-block:88px;border-top:1px solid var(--line)}
+.sec-head{display:grid;gap:14px;max-width:760px;margin-bottom:44px}
+.lede{font-size:19px;color:var(--ink2);max-width:62ch}
+.btn{display:inline-flex;align-items:center;gap:10px;padding:14px 22px;border-radius:4px;font-family:var(--sans);font-weight:600;font-size:16px;border:1px solid transparent;cursor:pointer;text-decoration:none!important}
+.btn-primary{background:var(--cyan);color:var(--cyan-ink)}
+.btn-primary:hover{background:#7ad6ec}
+.btn-ghost{background:transparent;color:var(--ink);border-color:var(--line2)}
+.btn-ghost:hover{border-color:var(--cyan);color:var(--cyan)}
+code{font-family:var(--mono);font-size:.92em;color:var(--cyan);background:rgba(95,203,230,.08);padding:2px 6px;border-radius:3px}
+
+/* nav */
+.nav{position:sticky;top:env(safe-area-inset-top,0px);z-index:20;background:rgba(11,15,20,.86);backdrop-filter:blur(10px);border-bottom:1px solid var(--line)}
+.nav .wrap{display:flex;align-items:center;justify-content:space-between;gap:20px;height:64px}
+.brand{display:flex;align-items:baseline;gap:10px;color:var(--ink);text-decoration:none!important}
+.brand b{font-family:var(--serif);font-weight:600;font-size:20px;letter-spacing:.01em}
+.brand span{font-family:var(--mono);font-size:11px;letter-spacing:.14em;text-transform:uppercase;color:var(--mute)}
+.navlinks{display:flex;gap:26px;font-size:15px}
+.navlinks a{color:var(--ink2)}
+.navlinks a:hover{color:var(--cyan);text-decoration:none}
+@media (max-width:820px){.navlinks{display:none}}
+
+/* hero */
+.hero{position:relative;overflow:hidden;border-bottom:1px solid var(--line)}
+.hero .wrap{position:relative;padding-block:96px 84px;display:grid;gap:26px}
+.hero h1{font-size:clamp(40px,6.4vw,78px);font-weight:300;max-width:12ch}
+.hero h1 em{font-style:italic;font-weight:500;color:var(--cyan)}
+.hero .lede{font-size:20px;max-width:56ch}
+.cta-row{display:flex;flex-wrap:wrap;gap:12px;margin-top:6px}
+
+/* skeleton cards */
+.cards{display:grid;grid-template-columns:repeat(3,1fr);gap:18px}
+.card{border:1px solid var(--line);border-radius:6px;background:var(--bg2);padding:24px 22px;display:grid;gap:10px;align-content:start}
+.card p{font-size:15px;color:var(--ink2)}
+@media (max-width:820px){.cards{grid-template-columns:1fr}}
+
+/* footer */
+footer{border-top:1px solid var(--line);padding-block:44px 60px;color:var(--mute);font-size:14px}
+footer .wrap{display:grid;gap:22px}
+footer .row{display:flex;flex-wrap:wrap;gap:8px 24px}
+footer .row a{color:var(--ink2)}
+footer .legal{max-width:80ch;font-size:13px}
+</style>
+</head>
+<body>
+
+<nav class="nav"><div class="wrap">
+  <a class="brand" href="#top"><b>{{APP_ID}}</b><span>{{COMMUNITY_ID}}</span></a>
+  <div class="navlinks">
+    <a href="#about">About</a><a href="#next">Next steps</a>
+  </div>
+</div></nav>
+
+<header class="hero" id="top">
+  <div class="wrap">
+    <p class="eyebrow">A {{COMMUNITY_ID}} app on DeSciX</p>
+    <h1>{{APP_ID}}, <em>in one sentence.</em></h1>
+    <p class="lede">This is the scaffold front page <code>descix app init</code> stamped for {{APP_ID}}. It is yours: replace this paragraph with what the app does and who it is for.</p>
+    <div class="cta-row">
+      <a class="btn btn-primary" href="#about">Learn more</a>
+      <a class="btn btn-ghost" href="#next">Make this page yours</a>
+    </div>
+  </div>
+</header>
+
+<section class="sec" id="about"><div class="wrap">
+  <div class="sec-head">
+    <p class="eyebrow">About</p>
+    <h2>What {{APP_ID}} is for.</h2>
+  </div>
+  <p class="lede">Placeholder copy from the scaffold. Say what {{APP_ID}} offers to the {{COMMUNITY_ID}} community, in the app's own words.</p>
+</div></section>
+
+<section class="sec" id="next"><div class="wrap">
+  <div class="sec-head">
+    <p class="eyebrow">Next steps</p>
+    <h2>Make this page yours.</h2>
+  </div>
+  <div class="cards">
+    <div class="card"><h3>Edit it</h3><p>This file is <code>site/index.html</code> in your repository. Nothing regenerates it; your edits are kept.</p></div>
+    <div class="card"><h3>Upload it</h3><p>Deploy the site set with <code>descix site upload</code>.</p></div>
+    <div class="card"><h3>Ask the handbook</h3><p>Run <code>descix tell-me-how</code> for every capability the CLI offers.</p></div>
+  </div>
+</div></section>
+
+<footer><div class="wrap">
+  <div class="brand"><b>{{APP_ID}}</b><span>{{COMMUNITY_ID}}</span></div>
+  <div class="row">
+    <a href="#about">About</a><a href="#next">Next steps</a>
+  </div>
+  <p class="legal">{{APP_ID}} is an app of the {{COMMUNITY_ID}} community on DeSciX. Replace this line with your own legal text.</p>
+</div></footer>
+
+</body>
+</html>

package/lib/commands/airdrop.js

@@ -1,149 +0,0 @@
-/**
- * Airdrop Commands — DRY-RUN ONLY.
- *
- *   descix airdrop execute-queue [--community <slug>] [--dry-run] [--batch-size <n>]
- *
- * The apply leg (an admin PK forwarded through the server to Powch's broadcast) is REMOVED,
- * CLI and server both (CEO 2026-10-10, daita-sam M2 envelope constraint 6): migration batches
- * execute in daita-sam — act plan + typed confirm + the role holder's own wallet, client-signed.
- *
- * Access: requires an authenticated session (`requireAuth`); the server additionally requires
- * platform admin for the preview.
- */
-
-import chalk from 'chalk';
-import { DeSciXApiClient } from '../api-client.js';
-import { requireAuth } from '../auth-guard.js';
-
-/**
- * Preview (dry-run) the airdrop migration batch queue on the target environment.
- *
- * @param {Object} options
- * @param {string} [options.community] - Community slug scoping the preview (omitted = aggregate).
- * @param {boolean} [options.dryRun] - Accepted for scripts; dry-run is the only mode.
- * @param {number} [options.batchSize] - Optional cap on number of users processed this run.
- * @param {Object} [options.apiClient] - Optional injected API client (for tests).
- */
-export async function executeQueue(options) {
-    // THE APPLY LEG IS STRUCK — refused before auth, before any network touch (CEO 2026-10-10, daita-sam M2 envelope constraint 6; the server
-    // refuses it too): migration batches execute in daita-sam — act plan + the role holder's own
-    // wallet signs, client-side. No PK ever transits this CLI again.
-    if (options.apply || options.signerPkFile) {
-        throw new Error(
-            'airdrop execute-queue is DRY-RUN ONLY: the apply leg (admin PK forwarded through the ' +
-            'server) is removed. Execute migration batches in daita-sam (act plan + your own wallet).'
-        );
-    }
-    const isDryRun = true;
-
-    const apiClient = options.apiClient || new DeSciXApiClient();
-    await requireAuth(apiClient);
-
-    const params = {};
-    if (options.community) params.community = options.community;
-    params.mode = 'dry-run';
-    if (options.batchSize !== undefined && options.batchSize !== null) {
-        const bs = Number(options.batchSize);
-        if (!Number.isFinite(bs) || bs <= 0) {
-            throw new Error(`--batch-size must be a positive integer, got: ${options.batchSize}`);
-        }
-        params.batch_size = bs;
-    }
-    // Legacy boolean dry_run parameter (preserved for backwards-compat with existing scripts).
-    if (isDryRun && !options.community) {
-        params.dry_run = true;
-    }
-
-    const envLabel = process.env.DESCIX_API_URL || '(workspace default)';
-    console.log(chalk.cyan(`\nairdrop execute-queue [${chalk.yellow('DRY-RUN')}] target=${envLabel}`));
-    if (options.community) {
-        console.log(chalk.gray(`  community:        ${options.community}`));
-    }
-    if (params.batch_size) {
-        console.log(chalk.gray(`  batch_size:       ${params.batch_size}`));
-    }
-    console.log('');
-
-    let response;
-    try {
-        response = await apiClient.invoke('airdrop_execute_queue', params);
-    } catch (error) {
-        // Auth/permission errors surface as HTTP-level failures with readable messages.
-        // CRITICAL: ensure no echo of params.signer_pk_hex into any error message we print.
-        const safeMsg = String(error.message || '').replace(/0x[a-fA-F0-9]{64}/g, '0x[REDACTED]');
-        console.error(chalk.red(`\nairdrop_execute_queue failed: ${safeMsg}\n`));
-        if (/platform-admin|service-account/i.test(error.message)) {
-            console.error(chalk.gray('  This command requires a platform-admin account.'));
-            console.error(chalk.gray('  Verify your membership in the DESCIX_ADMIN_GROUP Google Group.\n'));
-        }
-        throw error;
-    }
-
-    const result = response?.message || response;
-    if (!result || typeof result !== 'object') {
-        throw new Error('airdrop_execute_queue returned no result');
-    }
-
-    if (isDryRun && result.mode === 'dry-run') {
-        // Render the §4.F dry-run summary table.
-        console.log(chalk.bold('Dry-Run Summary:'));
-        console.log(`  community:                ${chalk.cyan(result.community || '(all)')}`);
-        if (result.token_symbol) console.log(`  token_symbol:             ${result.token_symbol}`);
-        if (result.token_contract_address) console.log(`  token_contract:           ${result.token_contract_address}`);
-        if (result.abi_source) console.log(`  abi_source:               ${result.abi_source.doc_id} (v${result.abi_source.version || '?'})`);
-        console.log(`  transfers_total:          ${chalk.yellow(result.transfers_total)}`);
-        console.log(`  batches_total:            ${result.batches_total}`);
-        console.log(`  debit_total:              ${result.debit_total}`);
-        console.log(`  credit_total:             ${result.credit_total}`);
-        const nz = result.net_zero_assertion || {};
-        const nzLabel = nz.passes ? chalk.green('PASS') : chalk.red('FAIL');
-        console.log(`  net_zero_assertion:       ${nzLabel} (Σ=${nz.sum})`);
-        const pbc = result.pre_batch_checks || {};
-        console.log(`  pre_batch_checks:         ${pbc.passes ? chalk.green('PASS') : chalk.red('FAIL — an execute would refuse')}`);
-        for (const r of (pbc.refusals || [])) {
-            console.log(chalk.red(`    ${r.kind} ${r.wallet} (${r.community_id}) holds ${r.held}, needs ${r.required} base units — rows ${(r.pending_ids || []).join(', ')}`));
-        }
-        console.log(`  unique_source_wallets:    ${result.unique_source_wallets}`);
-        console.log(`  unique_master_wallets:    ${result.unique_master_wallets}`);
-        console.log(`  prospective_batch_id:     ${result.prospective_batch_id}`);
-        if (result.gas_estimate) {
-            console.log(`  gas_estimate:             ${result.gas_estimate.units || '?'} units @ ${result.gas_estimate.gas_price_gwei || '?'} gwei`);
-            if (result.gas_estimate.matic_cost_estimate) {
-                console.log(`  estimated_cost:           ~${result.gas_estimate.matic_cost_estimate} MATIC`);
-            }
-        }
-        console.log('');
-        console.log(chalk.gray('No tx submitted. No DB rows mutated.'));
-        console.log(chalk.gray('To execute migration batches: daita-sam (act plan + your own wallet).'));
-        console.log('');
-        return result;
-    }
-
-    console.log(chalk.bold('Result:'));
-    console.log(`  batches_executed: ${chalk.yellow(result.batches_executed ?? 0)}`);
-    console.log(`  total_users:      ${chalk.yellow(result.total_users ?? 0)}`);
-    console.log(`  dry_run:          ${result.dry_run ? chalk.yellow('true') : chalk.gray('false')}`);
-
-    const perCommunity = result.per_community || {};
-    const communityKeys = Object.keys(perCommunity);
-    if (communityKeys.length) {
-        console.log(`  per_community:`);
-        for (const cid of communityKeys) {
-            console.log(`    ${cid}: ${perCommunity[cid]}`);
-        }
-    } else {
-        console.log(`  per_community:    ${chalk.gray('{}')}`);
-    }
-
-    if (result.caller) {
-        const who = result.caller.operator_email || result.caller.service_account || '(unknown)';
-        console.log(chalk.gray(`  caller:           ${who}`));
-    }
-
-    console.log('');
-    console.log(chalk.gray('Dry-run complete. No broadcast attempted. No on_chain_log broadcast row written.'));
-    console.log('');
-    return result;
-}
-
-export default { executeQueue };