@nbt-dev/nbt 0.1.1 → 0.1.3

package/README.md

@@ -1,6 +1,6 @@
 # @nbt-dev/nbt
 
-The `nbt` CLI and `console` daemon for the nbt-dev console — a fixed-target platform for web development.
+The `nbt` CLI and runtime for nbt-dev — a schema-first backend platform for web development.
 
 ## Install
 
@@ -16,12 +16,13 @@ npx nbt list                         # list available standard modules
 npx nbt add crm email                # vendor standard cartridges into nbt/
 npx nbt update crm email             # refresh vendored modules without deleting migrations
 # ...edit nbt/<cart>/schema.nbt (entities, indexes, @route decls)…
-npx nbt dev                          # boot the console + live-reload local carts on save
-npx nbt migrate create billing --baseline # first migration from the schema
+npx nbt dev                          # boot the runtime + live-reload local carts on save
+npx nbt migrate create billing -m "initial" --baseline # first migration from the schema
+npx nbt status                       # what persistent changes are unrecorded?
 npx nbt generate                     # typed TS clients for the local cartridge set
 
-npx nbt migrate deploy               # upload local source + apply migrations
-npx nbt migrate deploy --env prod    # target another configured environment
+npx nbt deploy                       # build + ship the whole project as one release
+npx nbt deploy --env prod            # target another configured environment
 ```
 
 Commands read `nbt.json` for paths and the target instance; `--host`/`--port`/`--root`/`--out`
@@ -29,7 +30,7 @@ flags override it. Run from anywhere inside the project — `nbt` walks up to fi
 
 Standard cartridges use a shadcn-style ownership model: `nbt add <name>` copies their source into
 your configured carts directory. The local copy is visible and editable, `nbt generate` follows
-that local cartridge set, and `nbt migrate deploy` uploads it to the configured console.
+that local cartridge set, and `nbt deploy` ships it to the configured runtime as one release.
 
 ```bash
 npx nbt up                                  # boot using nbt.json dev port

package/dist/nbt.js

@@ -3134,9 +3134,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path4) {
-    if (path4 === void 0) return this._executableDir;
-    this._executableDir = path4;
+  executableDir(path3) {
+    if (path3 === void 0) return this._executableDir;
+    this._executableDir = path3;
     return this;
   }
   /**
@@ -3393,48 +3393,33 @@ var program = new Command();
 
 // src/nbt.ts
 var import_node_child_process2 = require("node:child_process");
-var net = __toESM(require("node:net"));
-var path3 = __toESM(require("node:path"));
-var fs2 = __toESM(require("node:fs"));
-var readline = __toESM(require("node:readline/promises"));
-
-// src/bundler.ts
-var import_esbuild = __toESM(require("esbuild"));
 var path2 = __toESM(require("node:path"));
-var import_node_url = require("node:url");
-async function bundleWorkflows(options) {
-  import_esbuild.default.buildSync({
-    entryPoints: options.entryPoints,
-    outfile: options.outfile,
-    bundle: true,
-    format: "cjs",
-    platform: "node"
-  });
-  const g = globalThis;
-  delete g.__nbt_bundler__;
-  await import((0, import_node_url.pathToFileURL)(path2.resolve(options.outfile)).href);
-  const bundler = g.__nbt_bundler__;
-  console.log(bundler.workflows, bundler.steps, bundler.actions);
-}
-
-// src/nbt.ts
-if (process.platform !== "linux" || process.arch !== "x64") {
+var fs2 = __toESM(require("node:fs"));
+var os = __toESM(require("node:os"));
+var VENDOR_DIRS = {
+  "linux-x64": "linux-x64",
+  "darwin-arm64": "darwin-arm64",
+  "darwin-x64": "darwin-x64"
+};
+var PLATFORM_KEY = `${process.platform}-${process.arch}`;
+var VENDOR_SUBDIR = VENDOR_DIRS[PLATFORM_KEY];
+if (!VENDOR_SUBDIR) {
   console.error(
-    `@nbt-dev/nbt ships linux/x64 prebuilt binaries only; this is ${process.platform}/${process.arch}.`
+    `@nbt-dev/nbt has no prebuilt binaries for ${PLATFORM_KEY} (supported: ${Object.keys(VENDOR_DIRS).join(", ")}).`
   );
   process.exit(1);
 }
-var VENDOR = path3.join(__dirname, "..", "vendor", "linux-x64");
-var STDLIB = path3.join(__dirname, "..", "stdlib");
-var NBT_BIN = path3.join(VENDOR, "nbt");
-var CONSOLE_BIN = path3.join(VENDOR, "console");
+var IS_MAC = process.platform === "darwin";
+var VENDOR = path2.join(__dirname, "..", "vendor", VENDOR_SUBDIR);
+var NBT_BIN = path2.join(VENDOR, "nbt");
+var CONSOLE_BIN = path2.join(VENDOR, "console");
 function nativeEnv() {
   return { ...process.env };
 }
 function corsOriginsFromNbtJson() {
   let dir = process.cwd();
   for (let i = 0; i < 32; i++) {
-    const candidate = path3.join(dir, "nbt.json");
+    const candidate = path2.join(dir, "nbt.json");
     if (fs2.existsSync(candidate)) {
       try {
         const cfg = JSON.parse(fs2.readFileSync(candidate, "utf8"));
@@ -3446,7 +3431,7 @@ function corsOriginsFromNbtJson() {
       }
       return [];
     }
-    const parent = path3.dirname(dir);
+    const parent = path2.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -3460,15 +3445,49 @@ function consoleEnv() {
   }
   return env;
 }
+function projectUpPort() {
+  let dir = process.cwd();
+  for (let i = 0; i < 32; i++) {
+    const candidate = path2.join(dir, "nbt.json");
+    if (fs2.existsSync(candidate)) {
+      try {
+        const cfg = JSON.parse(fs2.readFileSync(candidate, "utf8"));
+        return Number(cfg?.environments?.dev?.port) || 8080;
+      } catch {
+        break;
+      }
+    }
+    const parent = path2.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return 8080;
+}
+function withProjectUpDefaults(argv2) {
+  const hasPort = argv2.some(
+    (arg) => arg === "--port" || arg === "-p" || arg.startsWith("--port=")
+  );
+  if (hasPort) return argv2;
+  return [...argv2, "--port", String(projectUpPort())];
+}
 function forwardToNative(argv2) {
-  const isConsole = consoleCommands.has(argv2[0]);
+  const cmd = argv2[0];
+  const isConsole = consoleCommands.has(cmd);
   const bin = isConsole ? CONSOLE_BIN : NBT_BIN;
-  const env = isConsole ? consoleEnv() : nativeEnv();
-  const nativeArgv = argv2[0] === "up" ? withProjectUpDefaults(argv2) : argv2;
+  const bootsDaemon = isConsole || cmd === "dev";
+  const env = bootsDaemon ? consoleEnv() : nativeEnv();
+  const nativeArgv = cmd === "up" ? withProjectUpDefaults(argv2) : argv2;
   if (!fs2.existsSync(bin)) {
-    console.error(
-      `@nbt-dev/nbt: bundled binary not found at ${bin} (broken install?)`
-    );
+    if (isConsole && IS_MAC) {
+      console.error(
+        `@nbt-dev/nbt: \`${cmd}\` runs the console daemon, which is Linux-only on macOS.
+Run it in Docker, then point the CLI at it with NBT_CONSOLE_URL.`
+      );
+    } else {
+      console.error(
+        `@nbt-dev/nbt: bundled binary not found at ${bin} (broken install?)`
+      );
+    }
     process.exit(1);
   }
   try {
@@ -3485,417 +3504,167 @@ function forwardToNative(argv2) {
   }
   process.exit(r.status === null ? 1 : r.status);
 }
-function packageVersion() {
+function resolveAgentEntry() {
+  const rel = path2.join(
+    "packages",
+    "coding-agent",
+    "dist",
+    "cli.js"
+  );
+  const candidates = [
+    path2.join(__dirname, "..", "agent", rel),
+    // published: agent vendored under this package
+    path2.join(__dirname, "..", "..", "agent", rel)
+    // dev monorepo: npm/agent
+  ];
+  for (const c of candidates) if (fs2.existsSync(c)) return c;
   try {
-    const pkg = JSON.parse(
-      fs2.readFileSync(path3.join(__dirname, "..", "package.json"), "utf8")
-    );
-    return typeof pkg?.version === "string" ? pkg.version : "unknown";
+    return require.resolve("@nbt-dev/agent/dist/cli.js");
   } catch {
-    return "unknown";
-  }
-}
-var program2 = new Command();
-program2.name("nbt").description("nbt.dev CLI").version(packageVersion(), "-v, --version", "Print the @nbt-dev/nbt version");
-var NBT = [
-  ["install", "Install a cartridge on a live instance"],
-  ["generate", "Generate a typed client from contracts"],
-  ["migrate", "Create migrations and deploy local cartridges"],
-  ["lsp", "Run the NBT language server over stdio (editors)"],
-  ["editor", "Install the NBT VS Code extension (editor install)"]
-];
-var CONSOLE = [
-  ["up", "Boot the console daemon"],
-  ["gen-cluster-key", "Generate a cluster signing key (copy to every node)"]
-];
-var consoleCommands = new Set(CONSOLE.map(([n]) => n));
-for (const [name, summary] of [...NBT, ...CONSOLE]) {
-  program2.command(name).description(`${summary} (native)`);
-}
-var customCommands = /* @__PURE__ */ new Set();
-customCommands.add("init");
-program2.command("init").description("Scaffold an nbt project (nbt.json, nbt/, generated/)").argument(
-  "[dir]",
-  "directory to create the project in (default: current directory)"
-).option("-y, --yes", "skip prompts; include the hello-world example").option("--no-example", "skip the hello-world example cartridge").action(
-  (dir, opts) => {
-    runInit(dir, opts).catch((e) => {
-      console.error(`nbt init: ${e?.message ?? e}`);
-      process.exit(1);
-    });
-  }
-);
-var NBT_JSON_TEMPLATE = `{
-  "carts": "nbt",
-  "generated": "generated",
-  "environments": {
-    "dev": { "host": "127.0.0.1", "port": 8080 }
-  }
-}
-`;
-var HELLO_SCHEMA = `# A minimal entity. CRUD routes are generated automatically:
-#   GET    /api/hello/note        list
-#   POST   /api/hello/note        create
-#   GET    /api/hello/note/:id    get
-#   PUT    /api/hello/note/:id    update
-#   DELETE /api/hello/note/:id    delete
-entity Note {
-  id: ulid
-  createdAt: DateTime @default(now())
-  updatedAt: DateTime @updatedAt
-  title: string
-  body: string
-
-  @@index([title])
-}
-`;
-async function runInit(dir, opts) {
-  const root = dir ? path3.resolve(process.cwd(), dir) : process.cwd();
-  if (dir) fs2.mkdirSync(root, { recursive: true });
-  if (fs2.existsSync(path3.join(root, "nbt.json"))) {
-    throw new Error(
-      `nbt.json already exists ${dir ? `in ${dir}` : "here"} \u2014 this is already an nbt project`
-    );
-  }
-  if (!fs2.existsSync(path3.join(STDLIB, "auth", "schema.nbt"))) {
-    throw new Error("bundled auth cartridge is missing (broken install)");
-  }
-  if (fs2.existsSync(path3.join(root, "nbt", "auth"))) {
-    throw new Error(
-      "nbt/auth already exists; refusing to overwrite it during init"
-    );
-  }
-  fs2.writeFileSync(path3.join(root, "nbt.json"), NBT_JSON_TEMPLATE);
-  fs2.mkdirSync(path3.join(root, "nbt"), { recursive: true });
-  fs2.mkdirSync(path3.join(root, "generated"), { recursive: true });
-  addStandardCartridge("auth", path3.join(root, "nbt"), false);
-  console.log("Created project:");
-  console.log("  nbt.json    (dev environment configured)");
-  console.log("  nbt/auth/   (local core auth cartridge)");
-  console.log("  generated/  (typed client output \u2014 nbt generate)");
-  const example = opts.example !== false && (opts.yes === true || await wantExample());
-  if (example) {
-    scaffoldHelloCart(path3.join(root, "nbt", "hello"));
-    console.log("\nCreated example cartridge nbt/hello/ (entity Note).");
-    console.log("\nNext:");
-    if (dir) console.log(`  cd ${dir}`);
-    console.log(
-      "  nbt dev            # boot the console + live-reload on save"
-    );
-  } else {
-    if (dir)
-      console.log(
-        `
-Next: cd ${dir}, then run \`nbt dev\` or add a standard cartridge with \`nbt add <name>\`.`
-      );
-    else
-      console.log(
-        "\nNext: run `nbt dev`, or add another standard cartridge with `nbt add <name>`."
-      );
-  }
-}
-async function wantExample() {
-  if (!process.stdin.isTTY) return true;
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  try {
-    const ans = (await rl.question("Add a hello-world example cartridge? [Y/n] ")).trim().toLowerCase();
-    return ans === "" || ans === "y" || ans === "yes";
-  } finally {
-    rl.close();
-  }
-}
-function scaffoldHelloCart(dir) {
-  fs2.mkdirSync(path3.join(dir, "migrations"), { recursive: true });
-  fs2.writeFileSync(path3.join(dir, "schema.nbt"), HELLO_SCHEMA);
-}
-customCommands.add("add");
-program2.command("add").description("Vendor standard-library cartridges into this project").argument("<cartridge...>", "standard cartridge name(s)").option("--overwrite", "replace an existing local cartridge").action((cartridges, opts) => {
-  try {
-    const proj = loadNbtProject();
-    for (const name of cartridges) {
-      const dest = addStandardCartridge(
-        name,
-        proj.cartsDir,
-        opts.overwrite === true
-      );
-      console.log(`Added ${name} -> ${path3.relative(proj.rootDir, dest)}`);
-    }
-    console.log(
-      "Run `nbt migrate deploy` to deploy the local cartridge set."
-    );
-  } catch (e) {
-    console.error(`nbt add: ${e?.message ?? e}`);
-    process.exit(1);
-  }
-});
-function addStandardCartridge(name, cartsDir, overwrite) {
-  if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) {
-    throw new Error(`invalid cartridge name '${name}'`);
-  }
-  const src = path3.join(STDLIB, name);
-  if (!fs2.existsSync(path3.join(src, "schema.nbt"))) {
-    const available = fs2.existsSync(STDLIB) ? fs2.readdirSync(STDLIB, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort().join(", ") : "";
-    throw new Error(
-      `unknown standard cartridge '${name}'${available ? ` (available: ${available})` : " (broken install: stdlib missing)"}`
-    );
-  }
-  const dest = path3.join(cartsDir, name);
-  if (fs2.existsSync(dest)) {
-    if (!overwrite)
-      throw new Error(`${dest} already exists; use --overwrite to replace it`);
-    fs2.rmSync(dest, { recursive: true, force: true });
+    return null;
   }
-  fs2.mkdirSync(cartsDir, { recursive: true });
-  fs2.cpSync(src, dest, { recursive: true });
-  return dest;
 }
-customCommands.add("list");
-program2.command("list").description("List available standard-library modules").action(() => {
-  if (!fs2.existsSync(STDLIB)) {
-    console.error("nbt list: bundled stdlib missing (broken install)");
-    process.exit(1);
-  }
-  const proj = loadNbtProject();
-  const names = fs2.readdirSync(STDLIB, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).filter((n) => fs2.existsSync(path3.join(STDLIB, n, "schema.nbt"))).sort();
-  for (const n of names) {
-    const installed = fs2.existsSync(
-      path3.join(proj.cartsDir, n, "schema.nbt")
-    );
-    console.log(installed ? `${n} (installed)` : n);
-  }
-});
-customCommands.add("update");
-program2.command("update").description(
-  "Update vendored standard-library modules from the bundled stdlib"
-).argument("<module...>", "standard module name(s)").action((modules) => {
-  try {
-    const proj = loadNbtProject();
-    for (const name of modules) {
-      const src = path3.join(STDLIB, name);
-      if (!fs2.existsSync(path3.join(src, "schema.nbt"))) {
-        throw new Error(`unknown standard module '${name}' (see: nbt list)`);
-      }
-      const dest = path3.join(proj.cartsDir, name);
-      if (!fs2.existsSync(path3.join(dest, "schema.nbt"))) {
-        throw new Error(
-          `'${name}' is not installed in this project \u2014 run: nbt add ${name}`
-        );
+function projectConsoleUrl() {
+  if (process.env.NBT_CONSOLE_URL) return process.env.NBT_CONSOLE_URL;
+  let dir = process.cwd();
+  for (let i = 0; i < 32; i++) {
+    const candidate = path2.join(dir, "nbt.json");
+    if (fs2.existsSync(candidate)) {
+      try {
+        const cfg = JSON.parse(fs2.readFileSync(candidate, "utf8"));
+        const dev = cfg?.environments?.dev ?? {};
+        const explicit = cfg?.agent?.consoleUrl ?? dev?.consoleUrl;
+        if (typeof explicit === "string" && explicit) return explicit;
+        const host = typeof dev?.host === "string" && dev.host ? dev.host : "127.0.0.1";
+        const port = Number(dev?.port) || 8080;
+        return `http://${host}:${port}`;
+      } catch {
+        break;
       }
-      const written = copyStdlibOver(src, dest);
-      for (const f of written)
-        console.log(`  wrote ${path3.relative(proj.rootDir, f)}`);
-      console.log(`Updated ${name}.`);
     }
-    console.log(
-      "Run `nbt migrate create <module>` to capture any schema changes, then `nbt migrate deploy`."
-    );
-  } catch (e) {
-    console.error(`nbt update: ${e?.message ?? e}`);
-    process.exit(1);
+    const parent = path2.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
   }
-});
-function copyStdlibOver(src, dest) {
-  const written = [];
-  const walk = (s, d) => {
-    fs2.mkdirSync(d, { recursive: true });
-    for (const e of fs2.readdirSync(s, { withFileTypes: true })) {
-      const sp = path3.join(s, e.name);
-      const dp = path3.join(d, e.name);
-      if (e.isDirectory()) walk(sp, dp);
-      else {
-        fs2.copyFileSync(sp, dp);
-        written.push(dp);
-      }
-    }
-  };
-  walk(src, dest);
-  return written;
+  return "http://127.0.0.1:8080";
 }
-customCommands.add("dev");
-program2.command("dev").description("Boot the console and live-reload local carts on .nbt change").option(
-  "-p, --port <port>",
-  "console HTTP port (default: nbt.json dev env, else 8080)"
-).option("-d, --data-dir <dir>", "console data dir (default: ./data)").action((opts) => {
-  runDev(opts).catch((e) => {
-    console.error(`nbt dev: ${e?.message ?? e}`);
-    process.exit(1);
-  });
-});
-function loadNbtProject() {
+function projectLlmUrl() {
+  if (process.env.NBT_LLM_URL) return process.env.NBT_LLM_URL;
   let dir = process.cwd();
   for (let i = 0; i < 32; i++) {
-    const candidate = path3.join(dir, "nbt.json");
+    const candidate = path2.join(dir, "nbt.json");
     if (fs2.existsSync(candidate)) {
       try {
         const cfg = JSON.parse(fs2.readFileSync(candidate, "utf8"));
-        const carts = typeof cfg?.carts === "string" ? cfg.carts : "nbt";
-        const port = Number(cfg?.environments?.dev?.port) || 8080;
-        return { rootDir: dir, cartsDir: path3.resolve(dir, carts), port };
+        const dev = cfg?.environments?.dev ?? {};
+        const explicit = cfg?.agent?.llmUrl ?? dev?.llmUrl;
+        if (typeof explicit === "string" && explicit) return explicit;
       } catch {
         break;
       }
+      return void 0;
     }
-    const parent = path3.dirname(dir);
+    const parent = path2.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return {
-    rootDir: process.cwd(),
-    cartsDir: path3.resolve(process.cwd(), "nbt"),
-    port: 8080
-  };
-}
-function withProjectUpDefaults(argv2) {
-  const hasPort = argv2.some(
-    (arg) => arg === "--port" || arg === "-p" || arg.startsWith("--port=")
-  );
-  if (hasPort) return argv2;
-  return [...argv2, "--port", String(loadNbtProject().port)];
-}
-function discoverCarts(cartsDir) {
-  if (!fs2.existsSync(cartsDir)) return [];
-  return fs2.readdirSync(cartsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path3.join(cartsDir, e.name)).filter((d) => fs2.existsSync(path3.join(d, "schema.nbt")));
+  return void 0;
 }
-function newestNbtMtime(dir) {
-  let newest = 0;
-  const walk = (d) => {
-    let entries;
-    try {
-      entries = fs2.readdirSync(d, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const e of entries) {
-      const p = path3.join(d, e.name);
-      if (e.isDirectory()) {
-        if (e.name !== ".dist" && e.name !== "node_modules") walk(p);
-      } else if (e.name.endsWith(".nbt")) {
-        try {
-          const m = fs2.statSync(p).mtimeMs;
-          if (m > newest) newest = m;
-        } catch {
-        }
+function projectBranchId() {
+  if (process.env.NBT_BRANCH_ID) return process.env.NBT_BRANCH_ID;
+  let dir = process.cwd();
+  for (let i = 0; i < 32; i++) {
+    const candidate = path2.join(dir, "nbt.json");
+    if (fs2.existsSync(candidate)) {
+      try {
+        const cfg = JSON.parse(fs2.readFileSync(candidate, "utf8"));
+        const b = cfg?.branch;
+        if (typeof b === "string" && b) return b;
+      } catch {
+        break;
       }
+      return void 0;
     }
-  };
-  walk(dir);
-  return newest;
-}
-function tcpUp(port, host = "127.0.0.1") {
-  return new Promise((resolve3) => {
-    const sock = net.connect({ port, host });
-    sock.once("connect", () => {
-      sock.destroy();
-      resolve3(true);
-    });
-    sock.once("error", () => resolve3(false));
-    sock.setTimeout(500, () => {
-      sock.destroy();
-      resolve3(false);
-    });
-  });
+    const parent = path2.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return void 0;
 }
-var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-function installCart(cartDir, port) {
-  const r = (0, import_node_child_process2.spawnSync)(
-    NBT_BIN,
-    ["install", "--path", cartDir, "--port", String(port)],
-    {
-      stdio: "inherit",
-      env: nativeEnv()
-    }
-  );
-  return r.status === 0;
+function storedApiKey() {
+  try {
+    const p = path2.join(os.homedir(), ".nbt", "credentials.json");
+    const creds = JSON.parse(fs2.readFileSync(p, "utf-8"));
+    const key = creds?.apiKey;
+    return typeof key === "string" && key.length > 0 ? key : void 0;
+  } catch {
+    return void 0;
+  }
 }
-async function runDev(opts) {
-  const proj = loadNbtProject();
-  const port = opts.port ? Number(opts.port) : proj.port;
-  if (!Number.isFinite(port) || port <= 0)
-    throw new Error(`invalid port '${opts.port}'`);
-  const upArgs = ["up", "--port", String(port)];
-  if (opts.dataDir) upArgs.push("--data-dir", opts.dataDir);
-  console.log(`nbt dev: starting console on :${port}`);
-  const daemon = (0, import_node_child_process2.spawn)(CONSOLE_BIN, upArgs, {
-    stdio: "inherit",
-    env: consoleEnv()
-  });
-  let shuttingDown = false;
-  const shutdown = (code = 0) => {
-    if (shuttingDown) return;
-    shuttingDown = true;
-    try {
-      daemon.kill("SIGTERM");
-    } catch {
-    }
-    process.exit(code);
-  };
-  process.on("SIGINT", () => shutdown(0));
-  process.on("SIGTERM", () => shutdown(0));
-  daemon.on("exit", (code) => {
-    if (!shuttingDown) {
-      console.error(`nbt dev: console exited (${code ?? "signal"})`);
-      process.exit(code ?? 1);
-    }
-  });
-  let ready = false;
-  for (let i = 0; i < 60; i++) {
-    if (await tcpUp(port)) {
-      ready = true;
-      break;
-    }
-    await sleep(250);
-  }
-  if (!ready) {
-    console.error("nbt dev: console did not come up in time");
-    return shutdown(1);
-  }
-  const carts = discoverCarts(proj.cartsDir);
-  if (carts.length === 0) {
-    console.warn(
-      `nbt dev: no carts found under ${proj.cartsDir} (nothing to watch)`
+function forwardToAgent(args) {
+  const entry = resolveAgentEntry();
+  if (!entry) {
+    console.error(
+      "@nbt-dev/nbt: coding agent not found (expected agent/packages/coding-agent/dist/cli.js). Build it with `npm run build` in npm/agent."
     );
+    process.exit(1);
   }
-  const applied = /* @__PURE__ */ new Map();
-  for (const c of carts) {
-    console.log(`nbt dev: install ${path3.basename(c)}`);
-    installCart(c, port);
-    applied.set(c, newestNbtMtime(c));
+  const env = nativeEnv();
+  env.NBT_CONSOLE_URL = projectConsoleUrl();
+  const llmUrl = projectLlmUrl();
+  if (llmUrl) env.NBT_LLM_URL = llmUrl;
+  const branchId = projectBranchId();
+  if (branchId) env.NBT_BRANCH_ID = branchId;
+  if (!env.NBT_API_KEY) {
+    const key = storedApiKey();
+    if (key) env.NBT_API_KEY = key;
+  }
+  const r = (0, import_node_child_process2.spawnSync)(process.execPath, [entry, ...args], {
+    stdio: "inherit",
+    env
+  });
+  if (r.error) {
+    console.error(`@nbt-dev/nbt: failed to launch agent: ${r.error.message}`);
+    process.exit(1);
   }
-  console.log(
-    `nbt dev: watching ${proj.cartsDir} \u2014 edit .nbt to reload (Ctrl-C to stop)`
-  );
-  let busy = false;
-  setInterval(async () => {
-    if (busy || shuttingDown) return;
-    busy = true;
-    try {
-      for (const c of discoverCarts(proj.cartsDir)) {
-        const m = newestNbtMtime(c);
-        const prev = applied.get(c) ?? 0;
-        if (m > prev) {
-          await sleep(150);
-          const settled = newestNbtMtime(c);
-          console.log(`nbt dev: reload ${path3.basename(c)}`);
-          installCart(c, port);
-          applied.set(c, settled);
-        }
-      }
-    } finally {
-      busy = false;
-    }
-  }, 400);
+  process.exit(r.status === null ? 1 : r.status);
 }
-customCommands.add("bundle");
-program2.command("bundle").description("Bundle TypeScript workflow code via esbuild").argument("<entry...>", "workflow entry point file(s)").option("-o, --outfile <dir>", "output file").action((entry, opts) => {
-  if (!opts.outfile) {
-    console.log("-o, --outfile missing.");
-    return;
+function packageVersion() {
+  try {
+    const pkg = JSON.parse(
+      fs2.readFileSync(path2.join(__dirname, "..", "package.json"), "utf8")
+    );
+    return typeof pkg?.version === "string" ? pkg.version : "unknown";
+  } catch {
+    return "unknown";
   }
-  bundleWorkflows({ entryPoints: entry, outfile: opts.outfile });
-});
+}
+var program2 = new Command();
+program2.name("nbt").description("nbt.dev CLI").version(packageVersion(), "-v, --version", "Print the @nbt-dev/nbt version");
+var NBT = [
+  ["init", "Scaffold an nbt project"],
+  ["add", "Vendor standard cartridges into this project"],
+  ["list", "List available standard-library cartridges"],
+  ["update", "Refresh vendored cartridges from the stdlib"],
+  ["dev", "Boot the NBT runtime with live reload"],
+  ["build", "Build the frontend (esbuild SPA + SSR)"],
+  ["install", "Install a cartridge on a live instance"],
+  ["generate", "Generate a typed client from contracts"],
+  ["routes", "Generate file-based routes from app/"],
+  ["migrate", "Create migrations and deploy local cartridges"],
+  ["lsp", "Run the NBT language server over stdio (editors)"],
+  ["editor", "Install the NBT VS Code extension (editor install)"]
+];
+var CONSOLE = [
+  ["up", "Boot the NBT runtime"],
+  ["gen-cluster-key", "Generate a cluster signing key (copy to every node)"]
+];
+var consoleCommands = new Set(CONSOLE.map(([n]) => n));
+for (const [name, summary] of [...NBT, ...CONSOLE]) {
+  program2.command(name).description(`${summary} (native)`);
+}
+program2.command("agent").description("Launch the nbt coding agent (defaults to the nbt provider)");
+var customCommands = /* @__PURE__ */ new Set();
 customCommands.add("version");
 program2.command("version").description("Print the @nbt-dev/nbt version").action(() => {
   process.stdout.write(packageVersion() + "\n");
@@ -3942,6 +3711,7 @@ function runCompletion(words) {
   if (words.length <= 1) {
     const prefix = words[0] ?? "";
     const names = [
+      "agent",
       ...NBT.map(([n]) => n),
       ...CONSOLE.map(([n]) => n),
       ...customCommands
@@ -3966,6 +3736,9 @@ var first = argv[0];
 if (first === "__complete__") {
   runCompletion(argv.slice(1));
 }
+if (first === "agent") {
+  forwardToAgent(argv.slice(1));
+}
 if (!first || first === "-h" || first === "--help" || first === "help") {
   program2.outputHelp();
   process.exit(first ? 0 : 1);

package/package.json

@@ -1,13 +1,15 @@
 {
   "name": "@nbt-dev/nbt",
-  "version": "0.1.1",
-  "description": "The nbt CLI and console daemon for the nbt-dev console — a fixed-target OS for web development. Linux/x64 prebuilt binaries.",
+  "version": "0.1.3",
+  "description": "The nbt CLI and runtime for nbt-dev — a schema-first backend platform for web development. Linux/x64 + macOS prebuilt binaries.",
   "bin": {
     "nbt": "dist/nbt.js"
   },
   "files": [
     "dist/",
     "vendor/linux-x64/",
+    "vendor/darwin-arm64/",
+    "vendor/darwin-x64/",
     "stdlib/",
     "README.md",
     "LICENSE",
@@ -19,10 +21,12 @@
     "prepack": "node scripts/build.mjs"
   },
   "os": [
-    "linux"
+    "linux",
+    "darwin"
   ],
   "cpu": [
-    "x64"
+    "x64",
+    "arm64"
   ],
   "engines": {
     "node": ">=16"

package/stdlib/auth/schema.nbt

@@ -67,9 +67,9 @@ entity Account {
   userId: string
   providerId: string
   password: string
-  accessToken: string
-  refreshToken: string
-  idToken: string
+  accessToken: string @secret
+  refreshToken: string @secret
+  idToken: string @secret
   accessTokenExpiresAt: DateTime
   refreshTokenExpiresAt: DateTime
   scope: string
@@ -99,6 +99,9 @@ entity ApiKey {
   key: string
   permissions: string
   roles: string
+
+  @@index([key])
+  @@index([projectId])
 }
 
 # Console-operator SSH public keys. The console daemon authenticates SSH

package/stdlib/dns/schema.nbt

@@ -21,7 +21,7 @@ entity DnsProvider {
   updatedAt: DateTime @updatedAt
   type: string               # "cloudflare"
   label: string              # user-facing name ("my CF account")
-  apiToken: string           # provider API token (stored as-is)
+  apiToken: string @secret   # provider API token (sealed at rest)
   accountId: string          # CF account_id, needed for add_zone + registrar calls (optional)
   status: string             # "ACTIVE" | "INVALID" | "DISCONNECTED"
   lastCheckedAt: u64         # ms epoch — updated on connect + test

package/stdlib/ingest/schema.nbt

@@ -10,7 +10,7 @@ entity Endpoint {
   name: string
   slug: string
   status: string
-  secret: string
+  secret: string @secret
   payloadCount: u64
   errorCount: u64
 

package/stdlib/phone/schema.nbt

@@ -24,7 +24,7 @@ entity TwilioAccount {
   updatedAt: DateTime @updatedAt
   name: string               # operator-facing label
   subAccountSid: string      # AC... — populated by provision()
-  authToken: string          # subaccount auth token (stored as-is)
+  authToken: string @secret  # subaccount auth token (sealed at rest)
   publicUrlBase: string      # e.g. "https://acme.console.app"
   status: string             # PENDING | ACTIVE | SUSPENDED | CLOSED
   retentionDays: s32         # 0 = keep message bodies forever; N = null body after N days

package/stdlib/registry/schema.nbt

@@ -31,7 +31,7 @@ entity GsheetSync {
   createdAt: DateTime @default(now())
   updatedAt: DateTime @updatedAt
   spreadsheetId: string     # parsed from the operator-provided sheet URL
-  serviceAccountJson: string  # SECRET — service-account key JSON
+  serviceAccountJson: string @secret  # SECRET — service-account key JSON (sealed at rest)
   saEmail: string           # service-account client_email (shown in devtools)
   intervalSeconds: u32      # poll cadence
   enabled: bool             # sync on/off

package/stdlib/secrets/schema.nbt

@@ -0,0 +1,16 @@
+# Secrets cart — storage substrate for named, per-environment config secrets
+# (STRIPE_KEY, OPENAI_KEY, ...). The console daemon is the single writer
+# (modules/api/secrets.jai); the generated CRUD is not the intended interface —
+# operators set values via POST /_console/secrets (or `nbt secret set`).
+#
+# `value` is @secret: sealed (AEAD) at rest, replicated as ciphertext, and never
+# returned by any read path. The row id is "<env>:<name>" so set/get are
+# idempotent without a secondary index.
+entity Secret {
+  id: string @id            # "<env>:<name>"
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  name: string              # slot name, e.g. STRIPE_KEY
+  env: string               # "dev" | "staging" | "prod"
+  value: string @secret     # sealed config value
+}

package/stdlib/workflows/schema.nbt

@@ -1,3 +1,18 @@
+# The latest deployed read-only VIEW bundle (the JS artifact serving GET /view/*).
+# Unlike WorkflowBundle there is no per-instance version pinning — views are
+# stateless on-read reductions, so only the newest row matters. It is persisted so
+# a deploy-activated view bundle survives a daemon restart (reloaded by
+# view_serve_init); `version` is a monotonic deploy counter, `contentHash` dedups
+# a redeploy of identical bytes.
+entity ViewBundle {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  version: u32
+  source: string
+  contentHash: string
+}
+
 # An immutable, versioned workflow bundle (the JS artifact). Deploying new code
 # registers a new version; in-flight executions keep replaying against the version
 # they started on (the journal-header pin), so a code change can never corrupt a
@@ -22,14 +37,21 @@ entity WorkflowExecution {
   createdAt: DateTime @default(now())
   updatedAt: DateTime @updatedAt
   status: string          # RUNNING (incl. async host call in flight) | SUSPENDED | COMPLETED | FAILED | CANCELLED
+  workflowId?: string     # OPTIONAL caller-chosen id (Phase 9b) for start dedup; the PK stays an auto-ULID (FK-safe). Unset on cron/event/most starts.
   workflowName: string
   args?: string           # JSON arguments passed to runWorkflow
   result?: string         # JSON return value (COMPLETED)
   error?: string          # message + stack (FAILED)
   cursor: u32
+  wakeAt: u64             # durable timer (Phase 9a): ms-epoch when a parked sleep is due (0 = not sleeping). The leader reconcile resumes the instance once wall-clock passes it.
+  parentExec?: string     # child workflow (Phase 9e): the parent execution id to resume with this child's result on completion
+  parentSeq?: u32         # the parent's host-call ordinal awaiting this child's result
   lane?: string           # fairness lane; per-lane concurrency is capped so a burst of one lane can't starve others (default "default")
   deployVersion: u32      # the bundle version this instance pins for its entire life (journal-header pin); replay always runs against this exact version
   events: WorkflowExecutionEvent[]
+  signals: WorkflowSignal[]   # buffered signals awaiting delivery (Phase 9d)
+  @@unique([workflowId])  # start dedup: a provided workflowId is unique (NULLs distinct, so unset starts never collide)
+  @@index([workflowId])
 }
 
 # A recurring trigger: fire `workflowName` whenever the cron expression matches.
@@ -62,6 +84,26 @@ entity WorkflowEvent {
   processed: bool         # set true once the leader has fired this emission's triggers
 }
 
+# A durable, buffered signal for an execution (Phase 9d). A signal that arrives
+# before the workflow reaches the matching wait() — or for a name other than the
+# one currently awaited — is stored here instead of being rejected; when the
+# workflow parks on wait(name) it drains the oldest unconsumed matching signal and
+# delivers it as the wait's result. id is a ULID so unconsumed signals drain in
+# arrival order. A signal that arrives WHILE parked on the matching wait is
+# delivered immediately (fast path) and never buffered.
+entity WorkflowSignal {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  execution: WorkflowExecution @relation(onDelete: Cascade)   # the target instance
+  name: string            # signal name, matched against wait(name)
+  payload?: string        # JSON value delivered as the wait result
+  idempotencyKey?: string # optional caller dedup key; a re-POST with the same key is a no-op
+  consumed: bool          # set true once delivered to a wait
+  @@index([execution])
+  @@unique([idempotencyKey])   # NULLs distinct (null-skip), so unkeyed signals never collide
+}
+
 enum WorkflowExecutionEventKind {
   HOST_CALL_INTENT        # recorded BEFORE a side effect is performed (durability)
   HOST_CALL_RESULT        # the resolved value of a host command (replay source)

package/vendor/linux-x64/cartridges/auth/schema.nbt

@@ -67,9 +67,9 @@ entity Account {
   userId: string
   providerId: string
   password: string
-  accessToken: string
-  refreshToken: string
-  idToken: string
+  accessToken: string @secret
+  refreshToken: string @secret
+  idToken: string @secret
   accessTokenExpiresAt: DateTime
   refreshTokenExpiresAt: DateTime
   scope: string
@@ -99,6 +99,9 @@ entity ApiKey {
   key: string
   permissions: string
   roles: string
+
+  @@index([key])
+  @@index([projectId])
 }
 
 # Console-operator SSH public keys. The console daemon authenticates SSH

package/vendor/linux-x64/cartridges/dns/schema.nbt

@@ -21,7 +21,7 @@ entity DnsProvider {
   updatedAt: DateTime @updatedAt
   type: string               # "cloudflare"
   label: string              # user-facing name ("my CF account")
-  apiToken: string           # provider API token (stored as-is)
+  apiToken: string @secret   # provider API token (sealed at rest)
   accountId: string          # CF account_id, needed for add_zone + registrar calls (optional)
   status: string             # "ACTIVE" | "INVALID" | "DISCONNECTED"
   lastCheckedAt: u64         # ms epoch — updated on connect + test

package/vendor/linux-x64/cartridges/ingest/schema.nbt

@@ -10,7 +10,7 @@ entity Endpoint {
   name: string
   slug: string
   status: string
-  secret: string
+  secret: string @secret
   payloadCount: u64
   errorCount: u64
 

package/vendor/linux-x64/cartridges/phone/schema.nbt

@@ -24,7 +24,7 @@ entity TwilioAccount {
   updatedAt: DateTime @updatedAt
   name: string               # operator-facing label
   subAccountSid: string      # AC... — populated by provision()
-  authToken: string          # subaccount auth token (stored as-is)
+  authToken: string @secret  # subaccount auth token (sealed at rest)
   publicUrlBase: string      # e.g. "https://acme.console.app"
   status: string             # PENDING | ACTIVE | SUSPENDED | CLOSED
   retentionDays: s32         # 0 = keep message bodies forever; N = null body after N days

package/vendor/linux-x64/cartridges/registry/schema.nbt

@@ -31,7 +31,7 @@ entity GsheetSync {
   createdAt: DateTime @default(now())
   updatedAt: DateTime @updatedAt
   spreadsheetId: string     # parsed from the operator-provided sheet URL
-  serviceAccountJson: string  # SECRET — service-account key JSON
+  serviceAccountJson: string @secret  # SECRET — service-account key JSON (sealed at rest)
   saEmail: string           # service-account client_email (shown in devtools)
   intervalSeconds: u32      # poll cadence
   enabled: bool             # sync on/off

package/vendor/linux-x64/cartridges/secrets/schema.nbt

@@ -0,0 +1,16 @@
+# Secrets cart — storage substrate for named, per-environment config secrets
+# (STRIPE_KEY, OPENAI_KEY, ...). The console daemon is the single writer
+# (modules/api/secrets.jai); the generated CRUD is not the intended interface —
+# operators set values via POST /_console/secrets (or `nbt secret set`).
+#
+# `value` is @secret: sealed (AEAD) at rest, replicated as ciphertext, and never
+# returned by any read path. The row id is "<env>:<name>" so set/get are
+# idempotent without a secondary index.
+entity Secret {
+  id: string @id            # "<env>:<name>"
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  name: string              # slot name, e.g. STRIPE_KEY
+  env: string               # "dev" | "staging" | "prod"
+  value: string @secret     # sealed config value
+}

package/vendor/linux-x64/cartridges/workflows/schema.nbt

@@ -1,3 +1,18 @@
+# The latest deployed read-only VIEW bundle (the JS artifact serving GET /view/*).
+# Unlike WorkflowBundle there is no per-instance version pinning — views are
+# stateless on-read reductions, so only the newest row matters. It is persisted so
+# a deploy-activated view bundle survives a daemon restart (reloaded by
+# view_serve_init); `version` is a monotonic deploy counter, `contentHash` dedups
+# a redeploy of identical bytes.
+entity ViewBundle {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  version: u32
+  source: string
+  contentHash: string
+}
+
 # An immutable, versioned workflow bundle (the JS artifact). Deploying new code
 # registers a new version; in-flight executions keep replaying against the version
 # they started on (the journal-header pin), so a code change can never corrupt a
@@ -22,14 +37,21 @@ entity WorkflowExecution {
   createdAt: DateTime @default(now())
   updatedAt: DateTime @updatedAt
   status: string          # RUNNING (incl. async host call in flight) | SUSPENDED | COMPLETED | FAILED | CANCELLED
+  workflowId?: string     # OPTIONAL caller-chosen id (Phase 9b) for start dedup; the PK stays an auto-ULID (FK-safe). Unset on cron/event/most starts.
   workflowName: string
   args?: string           # JSON arguments passed to runWorkflow
   result?: string         # JSON return value (COMPLETED)
   error?: string          # message + stack (FAILED)
   cursor: u32
+  wakeAt: u64             # durable timer (Phase 9a): ms-epoch when a parked sleep is due (0 = not sleeping). The leader reconcile resumes the instance once wall-clock passes it.
+  parentExec?: string     # child workflow (Phase 9e): the parent execution id to resume with this child's result on completion
+  parentSeq?: u32         # the parent's host-call ordinal awaiting this child's result
   lane?: string           # fairness lane; per-lane concurrency is capped so a burst of one lane can't starve others (default "default")
   deployVersion: u32      # the bundle version this instance pins for its entire life (journal-header pin); replay always runs against this exact version
   events: WorkflowExecutionEvent[]
+  signals: WorkflowSignal[]   # buffered signals awaiting delivery (Phase 9d)
+  @@unique([workflowId])  # start dedup: a provided workflowId is unique (NULLs distinct, so unset starts never collide)
+  @@index([workflowId])
 }
 
 # A recurring trigger: fire `workflowName` whenever the cron expression matches.
@@ -62,6 +84,26 @@ entity WorkflowEvent {
   processed: bool         # set true once the leader has fired this emission's triggers
 }
 
+# A durable, buffered signal for an execution (Phase 9d). A signal that arrives
+# before the workflow reaches the matching wait() — or for a name other than the
+# one currently awaited — is stored here instead of being rejected; when the
+# workflow parks on wait(name) it drains the oldest unconsumed matching signal and
+# delivers it as the wait's result. id is a ULID so unconsumed signals drain in
+# arrival order. A signal that arrives WHILE parked on the matching wait is
+# delivered immediately (fast path) and never buffered.
+entity WorkflowSignal {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  execution: WorkflowExecution @relation(onDelete: Cascade)   # the target instance
+  name: string            # signal name, matched against wait(name)
+  payload?: string        # JSON value delivered as the wait result
+  idempotencyKey?: string # optional caller dedup key; a re-POST with the same key is a no-op
+  consumed: bool          # set true once delivered to a wait
+  @@index([execution])
+  @@unique([idempotencyKey])   # NULLs distinct (null-skip), so unkeyed signals never collide
+}
+
 enum WorkflowExecutionEventKind {
   HOST_CALL_INTENT        # recorded BEFORE a side effect is performed (durability)
   HOST_CALL_RESULT        # the resolved value of a host command (replay source)