@nbt-dev/nbt 0.1.0 → 0.1.2

package/package.json

@@ -1,13 +1,15 @@
 {
   "name": "@nbt-dev/nbt",
-  "version": "0.1.0",
-  "description": "The nbt CLI and console daemon for the nbt-dev console — a fixed-target OS for web development. Linux/x64 prebuilt binaries.",
+  "version": "0.1.2",
+  "description": "The nbt CLI and runtime for nbt-dev — a schema-first backend platform for web development. Linux/x64 + macOS prebuilt binaries.",
   "bin": {
     "nbt": "dist/nbt.js"
   },
   "files": [
     "dist/",
     "vendor/linux-x64/",
+    "vendor/darwin-arm64/",
+    "vendor/darwin-x64/",
     "stdlib/",
     "README.md",
     "LICENSE",
@@ -19,10 +21,12 @@
     "prepack": "node scripts/build.mjs"
   },
   "os": [
-    "linux"
+    "linux",
+    "darwin"
   ],
   "cpu": [
-    "x64"
+    "x64",
+    "arm64"
   ],
   "engines": {
     "node": ">=16"

package/stdlib/auth/schema.nbt

@@ -67,9 +67,9 @@ entity Account {
   userId: string
   providerId: string
   password: string
-  accessToken: string
-  refreshToken: string
-  idToken: string
+  accessToken: string @secret
+  refreshToken: string @secret
+  idToken: string @secret
   accessTokenExpiresAt: DateTime
   refreshTokenExpiresAt: DateTime
   scope: string
@@ -99,6 +99,9 @@ entity ApiKey {
   key: string
   permissions: string
   roles: string
+
+  @@index([key])
+  @@index([projectId])
 }
 
 # Console-operator SSH public keys. The console daemon authenticates SSH

package/stdlib/dns/schema.nbt

@@ -21,7 +21,7 @@ entity DnsProvider {
   updatedAt: DateTime @updatedAt
   type: string               # "cloudflare"
   label: string              # user-facing name ("my CF account")
-  apiToken: string           # provider API token (stored as-is)
+  apiToken: string @secret   # provider API token (sealed at rest)
   accountId: string          # CF account_id, needed for add_zone + registrar calls (optional)
   status: string             # "ACTIVE" | "INVALID" | "DISCONNECTED"
   lastCheckedAt: u64         # ms epoch — updated on connect + test

package/stdlib/ingest/schema.nbt

@@ -10,7 +10,7 @@ entity Endpoint {
   name: string
   slug: string
   status: string
-  secret: string
+  secret: string @secret
   payloadCount: u64
   errorCount: u64
 

package/stdlib/phone/schema.nbt

@@ -24,7 +24,7 @@ entity TwilioAccount {
   updatedAt: DateTime @updatedAt
   name: string               # operator-facing label
   subAccountSid: string      # AC... — populated by provision()
-  authToken: string          # subaccount auth token (stored as-is)
+  authToken: string @secret  # subaccount auth token (sealed at rest)
   publicUrlBase: string      # e.g. "https://acme.console.app"
   status: string             # PENDING | ACTIVE | SUSPENDED | CLOSED
   retentionDays: s32         # 0 = keep message bodies forever; N = null body after N days

package/stdlib/registry/schema.nbt

@@ -31,7 +31,7 @@ entity GsheetSync {
   createdAt: DateTime @default(now())
   updatedAt: DateTime @updatedAt
   spreadsheetId: string     # parsed from the operator-provided sheet URL
-  serviceAccountJson: string  # SECRET — service-account key JSON
+  serviceAccountJson: string @secret  # SECRET — service-account key JSON (sealed at rest)
   saEmail: string           # service-account client_email (shown in devtools)
   intervalSeconds: u32      # poll cadence
   enabled: bool             # sync on/off

package/stdlib/secrets/schema.nbt

@@ -0,0 +1,16 @@
+# Secrets cart — storage substrate for named, per-environment config secrets
+# (STRIPE_KEY, OPENAI_KEY, ...). The console daemon is the single writer
+# (modules/api/secrets.jai); the generated CRUD is not the intended interface —
+# operators set values via POST /_console/secrets (or `nbt secret set`).
+#
+# `value` is @secret: sealed (AEAD) at rest, replicated as ciphertext, and never
+# returned by any read path. The row id is "<env>:<name>" so set/get are
+# idempotent without a secondary index.
+entity Secret {
+  id: string @id            # "<env>:<name>"
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  name: string              # slot name, e.g. STRIPE_KEY
+  env: string               # "dev" | "staging" | "prod"
+  value: string @secret     # sealed config value
+}

package/stdlib/workflows/schema.nbt

@@ -22,14 +22,21 @@ entity WorkflowExecution {
   createdAt: DateTime @default(now())
   updatedAt: DateTime @updatedAt
   status: string          # RUNNING (incl. async host call in flight) | SUSPENDED | COMPLETED | FAILED | CANCELLED
+  workflowId?: string     # OPTIONAL caller-chosen id (Phase 9b) for start dedup; the PK stays an auto-ULID (FK-safe). Unset on cron/event/most starts.
   workflowName: string
   args?: string           # JSON arguments passed to runWorkflow
   result?: string         # JSON return value (COMPLETED)
   error?: string          # message + stack (FAILED)
   cursor: u32
+  wakeAt: u64             # durable timer (Phase 9a): ms-epoch when a parked sleep is due (0 = not sleeping). The leader reconcile resumes the instance once wall-clock passes it.
+  parentExec?: string     # child workflow (Phase 9e): the parent execution id to resume with this child's result on completion
+  parentSeq?: u32         # the parent's host-call ordinal awaiting this child's result
   lane?: string           # fairness lane; per-lane concurrency is capped so a burst of one lane can't starve others (default "default")
   deployVersion: u32      # the bundle version this instance pins for its entire life (journal-header pin); replay always runs against this exact version
   events: WorkflowExecutionEvent[]
+  signals: WorkflowSignal[]   # buffered signals awaiting delivery (Phase 9d)
+  @@unique([workflowId])  # start dedup: a provided workflowId is unique (NULLs distinct, so unset starts never collide)
+  @@index([workflowId])
 }
 
 # A recurring trigger: fire `workflowName` whenever the cron expression matches.
@@ -62,6 +69,26 @@ entity WorkflowEvent {
   processed: bool         # set true once the leader has fired this emission's triggers
 }
 
+# A durable, buffered signal for an execution (Phase 9d). A signal that arrives
+# before the workflow reaches the matching wait() — or for a name other than the
+# one currently awaited — is stored here instead of being rejected; when the
+# workflow parks on wait(name) it drains the oldest unconsumed matching signal and
+# delivers it as the wait's result. id is a ULID so unconsumed signals drain in
+# arrival order. A signal that arrives WHILE parked on the matching wait is
+# delivered immediately (fast path) and never buffered.
+entity WorkflowSignal {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  execution: WorkflowExecution @relation(onDelete: Cascade)   # the target instance
+  name: string            # signal name, matched against wait(name)
+  payload?: string        # JSON value delivered as the wait result
+  idempotencyKey?: string # optional caller dedup key; a re-POST with the same key is a no-op
+  consumed: bool          # set true once delivered to a wait
+  @@index([execution])
+  @@unique([idempotencyKey])   # NULLs distinct (null-skip), so unkeyed signals never collide
+}
+
 enum WorkflowExecutionEventKind {
   HOST_CALL_INTENT        # recorded BEFORE a side effect is performed (durability)
   HOST_CALL_RESULT        # the resolved value of a host command (replay source)

package/vendor/linux-x64/cartridges/auth/schema.nbt

@@ -67,9 +67,9 @@ entity Account {
   userId: string
   providerId: string
   password: string
-  accessToken: string
-  refreshToken: string
-  idToken: string
+  accessToken: string @secret
+  refreshToken: string @secret
+  idToken: string @secret
   accessTokenExpiresAt: DateTime
   refreshTokenExpiresAt: DateTime
   scope: string
@@ -99,6 +99,9 @@ entity ApiKey {
   key: string
   permissions: string
   roles: string
+
+  @@index([key])
+  @@index([projectId])
 }
 
 # Console-operator SSH public keys. The console daemon authenticates SSH

package/vendor/linux-x64/cartridges/dns/schema.nbt

@@ -21,7 +21,7 @@ entity DnsProvider {
   updatedAt: DateTime @updatedAt
   type: string               # "cloudflare"
   label: string              # user-facing name ("my CF account")
-  apiToken: string           # provider API token (stored as-is)
+  apiToken: string @secret   # provider API token (sealed at rest)
   accountId: string          # CF account_id, needed for add_zone + registrar calls (optional)
   status: string             # "ACTIVE" | "INVALID" | "DISCONNECTED"
   lastCheckedAt: u64         # ms epoch — updated on connect + test

package/vendor/linux-x64/cartridges/ingest/schema.nbt

@@ -10,7 +10,7 @@ entity Endpoint {
   name: string
   slug: string
   status: string
-  secret: string
+  secret: string @secret
   payloadCount: u64
   errorCount: u64
 

package/vendor/linux-x64/cartridges/phone/schema.nbt

@@ -24,7 +24,7 @@ entity TwilioAccount {
   updatedAt: DateTime @updatedAt
   name: string               # operator-facing label
   subAccountSid: string      # AC... — populated by provision()
-  authToken: string          # subaccount auth token (stored as-is)
+  authToken: string @secret  # subaccount auth token (sealed at rest)
   publicUrlBase: string      # e.g. "https://acme.console.app"
   status: string             # PENDING | ACTIVE | SUSPENDED | CLOSED
   retentionDays: s32         # 0 = keep message bodies forever; N = null body after N days

package/vendor/linux-x64/cartridges/registry/schema.nbt

@@ -31,7 +31,7 @@ entity GsheetSync {
   createdAt: DateTime @default(now())
   updatedAt: DateTime @updatedAt
   spreadsheetId: string     # parsed from the operator-provided sheet URL
-  serviceAccountJson: string  # SECRET — service-account key JSON
+  serviceAccountJson: string @secret  # SECRET — service-account key JSON (sealed at rest)
   saEmail: string           # service-account client_email (shown in devtools)
   intervalSeconds: u32      # poll cadence
   enabled: bool             # sync on/off

package/vendor/linux-x64/cartridges/secrets/schema.nbt

@@ -0,0 +1,16 @@
+# Secrets cart — storage substrate for named, per-environment config secrets
+# (STRIPE_KEY, OPENAI_KEY, ...). The console daemon is the single writer
+# (modules/api/secrets.jai); the generated CRUD is not the intended interface —
+# operators set values via POST /_console/secrets (or `nbt secret set`).
+#
+# `value` is @secret: sealed (AEAD) at rest, replicated as ciphertext, and never
+# returned by any read path. The row id is "<env>:<name>" so set/get are
+# idempotent without a secondary index.
+entity Secret {
+  id: string @id            # "<env>:<name>"
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  name: string              # slot name, e.g. STRIPE_KEY
+  env: string               # "dev" | "staging" | "prod"
+  value: string @secret     # sealed config value
+}

package/vendor/linux-x64/cartridges/workflows/schema.nbt

@@ -22,14 +22,21 @@ entity WorkflowExecution {
   createdAt: DateTime @default(now())
   updatedAt: DateTime @updatedAt
   status: string          # RUNNING (incl. async host call in flight) | SUSPENDED | COMPLETED | FAILED | CANCELLED
+  workflowId?: string     # OPTIONAL caller-chosen id (Phase 9b) for start dedup; the PK stays an auto-ULID (FK-safe). Unset on cron/event/most starts.
   workflowName: string
   args?: string           # JSON arguments passed to runWorkflow
   result?: string         # JSON return value (COMPLETED)
   error?: string          # message + stack (FAILED)
   cursor: u32
+  wakeAt: u64             # durable timer (Phase 9a): ms-epoch when a parked sleep is due (0 = not sleeping). The leader reconcile resumes the instance once wall-clock passes it.
+  parentExec?: string     # child workflow (Phase 9e): the parent execution id to resume with this child's result on completion
+  parentSeq?: u32         # the parent's host-call ordinal awaiting this child's result
   lane?: string           # fairness lane; per-lane concurrency is capped so a burst of one lane can't starve others (default "default")
   deployVersion: u32      # the bundle version this instance pins for its entire life (journal-header pin); replay always runs against this exact version
   events: WorkflowExecutionEvent[]
+  signals: WorkflowSignal[]   # buffered signals awaiting delivery (Phase 9d)
+  @@unique([workflowId])  # start dedup: a provided workflowId is unique (NULLs distinct, so unset starts never collide)
+  @@index([workflowId])
 }
 
 # A recurring trigger: fire `workflowName` whenever the cron expression matches.
@@ -62,6 +69,26 @@ entity WorkflowEvent {
   processed: bool         # set true once the leader has fired this emission's triggers
 }
 
+# A durable, buffered signal for an execution (Phase 9d). A signal that arrives
+# before the workflow reaches the matching wait() — or for a name other than the
+# one currently awaited — is stored here instead of being rejected; when the
+# workflow parks on wait(name) it drains the oldest unconsumed matching signal and
+# delivers it as the wait's result. id is a ULID so unconsumed signals drain in
+# arrival order. A signal that arrives WHILE parked on the matching wait is
+# delivered immediately (fast path) and never buffered.
+entity WorkflowSignal {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  execution: WorkflowExecution @relation(onDelete: Cascade)   # the target instance
+  name: string            # signal name, matched against wait(name)
+  payload?: string        # JSON value delivered as the wait result
+  idempotencyKey?: string # optional caller dedup key; a re-POST with the same key is a no-op
+  consumed: bool          # set true once delivered to a wait
+  @@index([execution])
+  @@unique([idempotencyKey])   # NULLs distinct (null-skip), so unkeyed signals never collide
+}
+
 enum WorkflowExecutionEventKind {
   HOST_CALL_INTENT        # recorded BEFORE a side effect is performed (durability)
   HOST_CALL_RESULT        # the resolved value of a host command (replay source)

package/stdlib/design/migrations/20260501210107_initial/migration.nbt

@@ -1,19 +0,0 @@
-migration initial {
-  add_entity Design
-  add_field Design name string default("")
-  add_field Design slug string default("")
-  add_field Design description string default("")
-  add_field Design headVersionId string default("")
-  add_field Design headVersion u32 default(0)
-  add_unique Design [slug]
-  add_entity DesignVersion
-  add_field DesignVersion designId string default("")
-  add_field DesignVersion version u32 default(0)
-  add_field DesignVersion body document default(0)
-  add_field DesignVersion source string default("")
-  add_field DesignVersion note string default("")
-  add_field DesignVersion createdBy string default("")
-  add_field DesignVersion parseErrors string default("")
-  add_index DesignVersion [designId]
-  add_unique DesignVersion [designId, version]
-}

package/stdlib/design/migrations/20260501210107_initial/schema_snapshot.nbt

@@ -1,21 +0,0 @@
-entity Design {
-  name: string
-  slug: string
-  description: string
-  headVersionId: string
-  headVersion: u32
-  @@unique([slug])
-}
-
-entity DesignVersion {
-  designId: string
-  version: u32
-  body: document
-  source: string
-  note: string
-  createdBy: string
-  parseErrors: string
-  @@index([designId])
-  @@unique([designId, version])
-}
-

package/stdlib/design/migrations/20260610130000_design_system/migration.nbt

@@ -1,50 +0,0 @@
-migration design_system {
-  add_field Design designerId string default("")
-  add_entity Designer
-  add_field Designer name string default("")
-  add_field Designer handle string default("")
-  add_field Designer url string default("")
-  add_field Designer bio string default("")
-  add_unique Designer [handle]
-  add_entity Token
-  add_field Token designId string default("")
-  add_field Token name string default("")
-  add_field Token kind string default("")
-  add_field Token value string default("")
-  add_field Token darkValue string default("")
-  add_index Token [designId]
-  add_unique Token [designId, name]
-  add_entity Component
-  add_field Component designId string default("")
-  add_field Component name string default("")
-  add_field Component version u32 default(0)
-  add_field Component designerId string default("")
-  add_field Component propsSpec string default("")
-  add_field Component notes string default("")
-  add_index Component [designId]
-  add_unique Component [designId, name]
-  add_entity Block
-  add_field Block designId string default("")
-  add_field Block name string default("")
-  add_field Block version u32 default(0)
-  add_field Block designerId string default("")
-  add_field Block components string default("")
-  add_field Block slotsSpec string default("")
-  add_field Block defaults string default("")
-  add_index Block [designId]
-  add_unique Block [designId, name]
-  add_entity Rule
-  add_field Rule designId string default("")
-  add_field Rule subject string default("")
-  add_field Rule kind string default("")
-  add_field Rule rule string default("")
-  add_field Rule note string default("")
-  add_index Rule [designId]
-  add_entity Page
-  add_field Page designId string default("")
-  add_field Page slug string default("")
-  add_field Page title string default("")
-  add_field Page blocks string default("")
-  add_index Page [designId]
-  add_unique Page [designId, slug]
-}

package/stdlib/design/migrations/20260610130000_design_system/schema_snapshot.nbt

@@ -1,80 +0,0 @@
-entity Design {
-  name: string
-  slug: string
-  description: string
-  designerId: string
-  headVersionId: string
-  headVersion: u32
-  @@unique([slug])
-}
-
-entity DesignVersion {
-  designId: string
-  version: u32
-  body: document
-  source: string
-  note: string
-  createdBy: string
-  parseErrors: string
-  @@index([designId])
-  @@unique([designId, version])
-}
-
-entity Designer {
-  name: string
-  handle: string
-  url: string
-  bio: string
-  @@unique([handle])
-}
-
-entity Token {
-  designId: string
-  name: string
-  kind: string
-  value: string
-  darkValue: string
-  @@index([designId])
-  @@unique([designId, name])
-}
-
-entity Component {
-  designId: string
-  name: string
-  version: u32
-  designerId: string
-  propsSpec: string
-  notes: string
-  @@index([designId])
-  @@unique([designId, name])
-}
-
-entity Block {
-  designId: string
-  name: string
-  version: u32
-  designerId: string
-  components: string
-  slotsSpec: string
-  defaults: string
-  @@index([designId])
-  @@unique([designId, name])
-}
-
-entity Rule {
-  designId: string
-  subject: string
-  kind: string
-  rule: string
-  note: string
-  @@index([designId])
-}
-
-entity Page {
-  designId: string
-  slug: string
-  title: string
-  blocks: string
-  @@index([designId])
-  @@unique([designId, slug])
-}

package/stdlib/design/schema.nbt

@@ -1,140 +0,0 @@
-# Published designs are world-readable (a site's frontend stitches itself from
-# them before any session exists); writes stay behind the auth gate.
-@public_route "GET /api/design/Design"
-@public_route "GET /api/design/Designer"
-@public_route "GET /api/design/Token"
-@public_route "GET /api/design/Component"
-@public_route "GET /api/design/Block"
-@public_route "GET /api/design/Rule"
-@public_route "GET /api/design/Page"
-
-#--- Entities ---
-# A Design is a named DESIGN.md file. Its body lives in DesignVersion rows so
-# the full revision history is preserved. Design.headVersionId points at the
-# latest version for O(1) current-state reads.
-
-entity Design {
-  id: ulid
-  createdAt: DateTime @default(now())
-  updatedAt: DateTime @updatedAt
-  name: string
-  slug: string
-  description: string
-  designerId: string        # who made this design system
-  headVersionId: string
-  headVersion: u32
-
-  @@unique([slug])
-}
-
-entity DesignVersion {
-  id: ulid
-  createdAt: DateTime @default(now())
-  updatedAt: DateTime @updatedAt
-  designId: string
-  version: u32              # domain revision counter (1, 2, 3 …)
-  body: document @scope(designId)
-  source: string
-  note: string
-  createdBy: string
-  parseErrors: string
-
-  @@index([designId])
-  @@unique([designId, version])
-}
-
-#--- Design system ---
-# The product thesis: frontends are stitched from REAL designer-made designs.
-# Tokens/Components/Blocks carry designer attribution so anything rendered on a
-# site traces back to the person who designed it. JSON-shaped payloads
-# (propsSpec, slotsSpec, defaults, blocks, rule) are plain JSON strings the
-# renderer parses — no docstore ceremony for prototype-sized payloads.
-
-# Attribution-only profile: enough to say "this designer made X". No profile
-# pages, no auth linkage — just the name behind the work.
-entity Designer {
-  id: ulid
-  createdAt: DateTime @default(now())
-  updatedAt: DateTime @updatedAt
-  name: string              # "Jane Doe"
-  handle: string            # "jane"
-  url: string               # portfolio link, may be empty
-  bio: string
-
-  @@unique([handle])
-}
-
-entity Token {
-  id: ulid
-  createdAt: DateTime @default(now())
-  updatedAt: DateTime @updatedAt
-  designId: string
-  name: string              # "surface/brand", "text/primary", "font/body", "space/section"
-  kind: string              # color | font | size | space | radius
-  value: string             # "#0A0A0A", "Inter", "6rem"
-  darkValue: string         # empty = same as value
-
-  @@index([designId])
-  @@unique([designId, name])
-}
-
-entity Component {
-  id: ulid
-  createdAt: DateTime @default(now())
-  updatedAt: DateTime @updatedAt
-  designId: string
-  name: string              # "button", "nav", "hero", "feature-card", "footer"
-  version: u32
-  designerId: string        # real attribution — the trace-to-designer anchor
-  propsSpec: string         # JSON: [{"name":"label","type":"string","default":"..."}]
-  notes: string
-
-  @@index([designId])
-  @@unique([designId, name])
-}
-
-entity Block {
-  id: ulid
-  createdAt: DateTime @default(now())
-  updatedAt: DateTime @updatedAt
-  designId: string
-  name: string              # "nav", "hero", "feature-grid", "cta", "footer"
-  version: u32
-  designerId: string
-  components: string        # JSON array of component names this block stitches
-  slotsSpec: string         # JSON: [{"name":"headline","type":"string"}, ...]
-  defaults: string          # JSON: default slot content
-
-  @@index([designId])
-  @@unique([designId, name])
-}
-
-entity Rule {
-  id: ulid
-  createdAt: DateTime @default(now())
-  updatedAt: DateTime @updatedAt
-  designId: string
-  subject: string           # block/component name, or "page"
-  kind: string              # ordering | count | pairing
-  rule: string              # machine-checkable JSON, e.g. {"first":"nav"} / {"max":1,"of":"hero"}
-  note: string              # designer's human rationale
-
-  @@index([designId])
-}
-
-entity Page {
-  id: ulid
-  createdAt: DateTime @default(now())
-  updatedAt: DateTime @updatedAt
-  designId: string
-  slug: string              # "landing"
-  title: string
-  blocks: string            # JSON: [{"block":"nav","props":{...}}, ...]
-
-  @@index([designId])
-  @@unique([designId, slug])
-}
-
-# Behavior (former Design.create/save_version/get_head/list_versions actions +
-# tasks/parse.nbt @task) moved to hand-written Jai over the generated ORM,
-# which also registers the HTTP routes.

package/vendor/linux-x64/cartridges/design/migrations/20260501210107_initial/migration.nbt

@@ -1,19 +0,0 @@
-migration initial {
-  add_entity Design
-  add_field Design name string default("")
-  add_field Design slug string default("")
-  add_field Design description string default("")
-  add_field Design headVersionId string default("")
-  add_field Design headVersion u32 default(0)
-  add_unique Design [slug]
-  add_entity DesignVersion
-  add_field DesignVersion designId string default("")
-  add_field DesignVersion version u32 default(0)
-  add_field DesignVersion body document default(0)
-  add_field DesignVersion source string default("")
-  add_field DesignVersion note string default("")
-  add_field DesignVersion createdBy string default("")
-  add_field DesignVersion parseErrors string default("")
-  add_index DesignVersion [designId]
-  add_unique DesignVersion [designId, version]
-}

package/vendor/linux-x64/cartridges/design/migrations/20260501210107_initial/schema_snapshot.nbt

@@ -1,21 +0,0 @@
-entity Design {
-  name: string
-  slug: string
-  description: string
-  headVersionId: string
-  headVersion: u32
-  @@unique([slug])
-}
-
-entity DesignVersion {
-  designId: string
-  version: u32
-  body: document
-  source: string
-  note: string
-  createdBy: string
-  parseErrors: string
-  @@index([designId])
-  @@unique([designId, version])
-}
-