@nodii/dev 0.4.0 → 0.5.0

package/dist/nodii-dev.js

@@ -1,626 +1,4 @@
 #!/usr/bin/env node
-import { readFile } from "node:fs/promises";
-import { stdin, stdout } from "node:process";
-import {
-  CliError,
-  DEFAULT_HUB_URL,
-  OPERATOR_AGENT_ID,
-  VERSION,
-  deleteCredentials,
-  encode,
-  hubRawRequest,
-  hubRequest,
-  parseArgs,
-  query,
-  readConfig,
-  requestHash,
-  requireFlag,
-  secretFromAws,
-  storeSecret,
-  writeConfig,
-} from "./core.js";
-import {
-  DEFAULT_AUTH_URL,
-  DEFAULT_CLIENT_ID,
-  DEFAULT_EDGE_URL,
-  PLATFORM_TENANT,
-  deviceLogin,
-  revokeOAuth,
-} from "./oauth.js";
-import { heartbeatCurrentLane, postHook, preHook, settingsSnippet, workflowSuggestion } from "./hooks.js";
-import { setupCommand } from "./setup.js";
-import {
-  ALIASES,
-  GROUPS,
-  buildOperationRequest,
-  callOperation,
-  findFirstClass,
-  flagsToOperation,
-  loadOpenApi,
-  operationsFrom,
-  parseParams,
-  readBody,
-} from "./api.js";
-import {
-  agentWorkflowCommand,
-  builtCommand,
-  laneCommand,
-  machineCommand,
-  nextCommand,
-  peopleCommand,
-} from "./lanes.js";
+import { fail, main } from "./cli.js";
 
-const HELP = `nodii-dev ${VERSION}
-
-Usage: nodii-dev <command> [options] [--json]
-
-  login | logout | whoami | config show
-  agent register --name NAME [--service ID] | agent heartbeat
-  issues list|show|create|update|claim|release
-  inbox list|show
-  drift file | request file
-  decisions list|get|search
-  design entries|entry|guide
-  figma lock|check|log-write|submit|apply|published|abandon|release
-  hook claude-figma-pre|claude-figma-post|print-settings
-  setup [--yes|--check]                 # dry-run by default
-
-  lane start <key> --title TEXT --kind KIND --side SIDE [--repo REPO] [--issue ISSUE]
-  lane step <key> --side SIDE --start|--done|--block <step>
-  lane evidence <key> --pr|--commit|--figma|--deploy|--dev-check REF
-  lane heartbeat|review|land|verify|prioritize|deprioritize|stop <key>
-  lane list [--kind KIND] [--status STATUS] [--mine] [--cursor CURSOR]
-  lane show <key> | next <key>
-  built list | built ack <key...>
-  machine list|show|set-coordinator|assign|report
-  agent lane-limit|grant|revoke
-  people reveal <id> --reason TEXT | people refresh-names
-
-  api list [--tag TAG]
-  api <operationId> [--param k=v] [--body @file|-|JSON]
-  <resource> <action> [ID ...] [--field VALUE]
-
-Resource commands cover every OpenAPI tag, including services, feature-docs,
-contracts, sagas, outbox-topics, tables, libraries, workers, projects, issues,
-backlogs, builds, changes, deploy-reports, runtime, people, agents, inbox,
-gate, design, runbooks, doctrine, changelog, health-verdicts, approval-kinds,
-notification-registry, skills, open-questions, decisions, drift, and requests.
-
-Run a command with --help or see the package README for all flags.`;
-
-async function stdinText() {
-  let value = "";
-  for await (const chunk of stdin) value += chunk;
-  return value;
-}
-const bodyFlag = async (f, name = "body") =>
-  f[`${name}-file`] ? readFile(f[`${name}-file`], "utf8") : f[name];
-function emit(payload, json, human) {
-  if (json) console.log(JSON.stringify(payload));
-  else
-    console.log(
-      typeof human === "function"
-        ? human(payload)
-        : (human ?? JSON.stringify(payload.data ?? payload, null, 2)),
-    );
-}
-const qsFlags = (f, mapping) =>
-  Object.fromEntries(
-    Object.entries(mapping).map(([to, from]) => [to, f[from]]),
-  );
-
-async function login(flags, json) {
-  const previous = await readConfig(false);
-  const configuredClientId = flags["client-id"] ?? process.env.NODII_DEV_OAUTH_CLIENT_ID ?? previous?.clientId ?? DEFAULT_CLIENT_ID;
-  if (configuredClientId && !flags.hmac) {
-    const result = await deviceLogin({
-      clientId: configuredClientId,
-      authUrl: flags["auth-url"] ?? process.env.NODII_DEV_AUTH_URL ?? DEFAULT_AUTH_URL,
-      edgeUrl: flags["edge-url"] ?? process.env.NODII_DEV_EDGE_URL ?? DEFAULT_EDGE_URL,
-      tenantHint:
-        flags["tenant-hint"] ??
-        process.env.NODII_DEV_PLATFORM_TENANT_ID ??
-        PLATFORM_TENANT,
-      noBrowser: Boolean(flags["no-browser"]),
-      scope: flags.scope,
-      output: json ? console.error : console.log,
-    });
-    return emit({ loggedIn: true, provider: "oauth", credentialStorage: result.storage }, json,
-      `OAuth login complete; refresh credential stored in ${result.storage}. Run \`nodii-dev agent register --name NAME\` next.`);
-  }
-  const hubUrl = flags["hub-url"] ?? DEFAULT_HUB_URL;
-  const agentId = flags["agent-id"] ?? OPERATOR_AGENT_ID;
-  const person = requireFlag(flags, "person");
-  if (flags["secret-stdin"] && flags["from-aws"])
-    throw new CliError(
-      "USAGE",
-      "Choose either --secret-stdin or --from-aws, not both.",
-      2,
-    );
-  if (
-    !flags["secret-stdin"] &&
-    !flags["from-aws"] &&
-    !process.env.PLANNING_HUB_HMAC_SECRET
-  )
-    throw new CliError(
-      "USAGE",
-      "Provide --secret-stdin, --from-aws, or PLANNING_HUB_HMAC_SECRET.",
-      2,
-    );
-  const secret = flags["secret-stdin"]
-    ? (await stdinText()).trim()
-    : flags["from-aws"]
-      ? await secretFromAws()
-      : process.env.PLANNING_HUB_HMAC_SECRET;
-  if (!secret)
-    throw new CliError("EMPTY_SECRET", "The supplied secret is empty.", 2);
-  const storage = await storeSecret(secret);
-  await writeConfig({ hubUrl, agentId, person });
-  emit(
-    { hubUrl, agentId, person, secretStorage: storage },
-    json,
-    `Logged in as ${person} (${agentId}); secret stored in ${storage}.`,
-  );
-}
-
-async function issues(action, args, f, json) {
-  if (action === "list") {
-    const payload = await hubRequest(
-      "GET",
-      `/api/v1/issues${query(qsFlags(f, { serviceId: "service", project: "project", status: "status", kind: "kind", priority: "priority", claimed: "claimed", limit: "limit", cursor: "cursor" }))}`,
-    );
-    return emit(
-      payload,
-      json,
-      (p) =>
-        p.data
-          .map((x) => `${x.key}\t${x.status}\t${x.priority}\t${x.title}`)
-          .join("\n") || "No issues.",
-    );
-  }
-  const ref = args[0];
-  if (!ref && action !== "create")
-    throw new CliError("USAGE", `${action} needs an issue key or id`, 2);
-  if (action === "show")
-    return emit(await hubRequest("GET", `/api/v1/issues/${encode(ref)}`), json);
-  const config = await readConfig();
-  if (action === "create" || action === "update") {
-    const bodyMd = await bodyFlag(f);
-    const payload = {
-      ...(action === "create"
-        ? {
-            serviceId: requireFlag(f, "service"),
-            title: requireFlag(f, "title"),
-          }
-        : {}),
-      ...Object.fromEntries(
-        [
-          ["title", f.title],
-          ["kind", f.kind],
-          ["priority", f.priority],
-          ["project", f.project],
-          ["bodyMd", bodyMd],
-          ["onBehalfOf", config.person],
-        ].filter(([, v]) => v !== undefined),
-      ),
-    };
-    const result = await hubRequest(
-      action === "create" ? "POST" : "PATCH",
-      action === "create" ? "/api/v1/issues" : `/api/v1/issues/${encode(ref)}`,
-      payload,
-    );
-    return emit(
-      result,
-      json,
-      (p) => `${p.data.key} ${p.data.status} — ${p.data.title}`,
-    );
-  }
-  if (action === "claim")
-    return emit(
-      await hubRequest("POST", `/api/v1/issues/${encode(ref)}/claim`, {
-        onBehalfOf: config.person,
-        ...(f.ttl ? { ttlMinutes: Number(f.ttl) } : {}),
-      }),
-      json,
-    );
-  if (action === "release")
-    return emit(
-      await hubRequest("POST", `/api/v1/issues/${encode(ref)}/release`, {
-        onBehalfOf: config.person,
-        ...(f.note ? { note: f.note } : {}),
-      }),
-      json,
-    );
-  throw new CliError("USAGE", `Unknown issues action: ${action}`, 2);
-}
-
-async function main(argv = process.argv.slice(2)) {
-  if (argv.length === 1 && ["--version", "-v"].includes(argv[0]))
-    return console.log(VERSION);
-  if (argv.length === 1 && ["--help", "-h"].includes(argv[0]))
-    return console.log(HELP);
-  const { args, flags: f } = parseArgs(argv);
-  const json = Boolean(f.json);
-  const [command, action, ...rest] = args;
-  if (!command || f.help || command === "help") return console.log(HELP);
-  if (command === "api") {
-    const operations = operationsFrom(await loadOpenApi());
-    if (action === "list") {
-      const selected = f.tag === undefined || f.tag === true
-        ? operations
-        : operations.filter((x) => x.tags.some((t) => t.toLowerCase() === String(f.tag).toLowerCase()));
-      return emit(selected.map(({ operationId, method, path, tags }) => ({ operationId, method, path, tags })), json,
-        (rows) => rows.map((x) => `${x.operationId}\t${x.method}\t${x.path}\t${x.tags.join(",")}`).join("\n"));
-    }
-    if (!action) throw new CliError("USAGE", "api needs an operationId or list", 2);
-    const entry = operations.find((x) => x.operationId === action);
-    if (!entry) throw new CliError("UNKNOWN_OPERATION", `No OpenAPI operationId: ${action}`, 2);
-    const parsed = await readBody(f.body);
-    const request = buildOperationRequest(entry, parseParams(f.param), parsed?.value);
-    return emit(await hubRawRequest(request.method, request.path, parsed?.text), json);
-  }
-  if (command === "login") return login(f, json);
-  if (command === "logout") {
-    const c = await readConfig(false);
-    if (c?.authProvider === "oauth") {
-      try { await revokeOAuth(c); } finally { await deleteCredentials(); }
-    } else await deleteCredentials();
-    return emit({ loggedOut: true }, json, "Logged out.");
-  }
-  if (command === "config" && action === "show") {
-    const c = await readConfig();
-    if (c.authProvider === "oauth")
-      return emit({ provider: "oauth", authUrl: c.authUrl, edgeUrl: c.edgeUrl, clientId: c.clientId, tenantHint: c.tenantHint, agentId: c.agentId }, json,
-        `${c.edgeUrl}\nprovider: oauth\napp: ${c.clientId}\nagent: ${c.agentId ?? "not registered"}`);
-    return emit(
-      c,
-      json,
-      `${c.hubUrl}\nagent: ${c.agentId}\nperson: ${c.person}`,
-    );
-  }
-  if (command === "whoami") {
-    const c = await readConfig();
-    if (c.authProvider === "oauth") {
-      try { return emit(await hubRequest("GET", "/api/v1/whoami"), json); }
-      catch (error) {
-        if (!["HTTP_404", "NOT_FOUND"].includes(error.code)) throw error;
-        return emit({ data: { person: c.person, app: c.clientId, installation: c.installationId, agent: c.agentId } }, json);
-      }
-    }
-    const remote = await hubRequest(
-      "GET",
-      `/api/v1/agents/${encode(c.agentId)}`,
-    );
-    return emit({ data: { ...c, agent: remote.data } }, json);
-  }
-  const emitCommand = async (result) => emit(result.payload, json, result.human);
-  if (command === "setup") return emitCommand(await setupCommand(f));
-  if (command === "lane") return emitCommand(await laneCommand(action, rest, f));
-  if (command === "next") return emitCommand(await nextCommand(action, f));
-  if (command === "built") return emitCommand(await builtCommand(action, rest, f));
-  if (command === "machine") return emitCommand(await machineCommand(action, rest, f));
-  if (command === "people" && ["reveal", "refresh-names"].includes(action))
-    return emitCommand(await peopleCommand(action, rest, f));
-  if (command === "state" && action === "diff") {
-    const [health, services, decisions, docs, requests, drift] = await Promise.all([
-      hubRequest("GET", "/api/v1/health"), hubRequest("GET", "/api/v1/services"),
-      hubRequest("GET", "/api/v1/decisions"), hubRequest("GET", "/api/v1/feature-docs"),
-      hubRequest("GET", "/api/v1/requests"), hubRequest("GET", "/api/v1/drift"),
-    ]);
-    const count = (x) => Array.isArray(x.data) ? x.data.length : undefined;
-    return emit({ data: { health: health.data ?? health, counts: { services: count(services), decisions: count(decisions), featureDocs: count(docs), requests: count(requests), drift: count(drift) } } }, json);
-  }
-  if (command === "heartbeat" && action === "audit") {
-    const ids = rest[0] ? [rest[0]] : (await hubRequest("GET", "/api/v1/services?limit=1000")).data.map((x) => x.id);
-    const rows = await Promise.all(ids.map(async (id) => ({ serviceId: id, ...(await hubRequest("GET", `/api/v1/services/${encode(id)}/unblock-surface`)).data })));
-    const failed = rows.some((x) => (x.openDriftCount ?? 0) > 0 || (x.openInboxRequestCount ?? 0) > 0);
-    emit({ data: rows, clean: !failed }, json, (p) => p.data.map((x) => `${x.serviceId}\t${(x.openDriftCount ?? 0) || (x.openInboxRequestCount ?? 0) ? "ATTENTION" : "PASS"}\tdrift=${x.openDriftCount ?? 0}\tinbox=${x.openInboxRequestCount ?? 0}`).join("\n"));
-    if (failed) process.exitCode = 1;
-    return;
-  }
-  if (command === "agents" && action === "spawn") {
-    const serviceId = rest[0] ?? requireFlag(f, "service");
-    const docs = await hubRequest("GET", `/api/v1/feature-docs${query({ serviceId, status: "approved", limit: 200 })}`);
-    if (!docs.data?.length) throw new CliError("NO_APPROVED_WORK", `No approved feature docs for ${serviceId}`, 1);
-    const repo = `${f["repo-root"] ?? `${process.env.HOME}/Projects`}/${serviceId}`;
-    return emit({ data: { serviceId, repo, approvedFeatureDocs: docs.data.length, next: `cd ${repo} && nodii-dev agent register --name <name> --service ${serviceId}` } }, json);
-  }
-  if (command === "agents" && action === "cowork-tick") {
-    if (f.plist) {
-      const interval = Number(f.interval ?? 1800);
-      return console.log(`<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>com.nodii.cowork</string><key>ProgramArguments</key><array><string>nodii-dev</string><string>agents</string><string>cowork-tick</string></array><key>StartInterval</key><integer>${interval}</integer><key>RunAtLoad</key><true/></dict></plist>`);
-    }
-    const docs = await hubRequest("GET", "/api/v1/feature-docs?status=implementing&limit=1000");
-    const claims = docs.data.filter((x) => x.claimedByAgentId && (!x.claimExpiresAt || Date.parse(x.claimExpiresAt) > Date.now()));
-    return emit({ data: claims, dryRun: true, note: "Wakeup execution is workstation-local and has no hub endpoint; this tick reports eligible claims without invoking an external agent runtime." }, json,
-      (p) => p.data.map((x) => `${x.serviceId}/${x.docKey}\t${x.claimedByAgentId}`).join("\n") || "No active claims.");
-  }
-  if (command === "agent") {
-    if (["lane-limit", "grant", "revoke"].includes(action))
-      return emitCommand(await agentWorkflowCommand(action, rest, f));
-    const c = await readConfig();
-    if (action === "register") {
-      const result = await hubRequest("POST", c.authProvider === "oauth" ? "/api/v1/agents/register" : "/api/v1/agents", {
-        sessionId: f.session ?? crypto.randomUUID(),
-        serviceId: f.service ?? "nodii-planning-hub",
-        name: requireFlag(f, "name"),
-        ...(c.authProvider === "oauth" ? {} : { personId: c.person }),
-      });
-      await writeConfig({ ...c, agentId: result.data.id });
-      await hubRequest(
-        "POST",
-        `/api/v1/agents/${encode(result.data.id)}/heartbeat`,
-        {},
-      );
-      return emit(
-        result,
-        json,
-        `Registered ${result.data.name}: ${result.data.id}`,
-      );
-    }
-    if (action === "heartbeat")
-      return emit(
-        await hubRequest(
-          "POST",
-          `/api/v1/agents/${encode(c.agentId)}/heartbeat`,
-          {},
-        ),
-        json,
-        "Heartbeat recorded.",
-      );
-  }
-  if (command === "issues") return issues(action, rest, f, json);
-  if (command === "inbox") {
-    if (action === "list")
-      return emit(
-        await hubRequest(
-          "GET",
-          `/api/v1/inbox${query({ serviceId: f.service, kind: f.kind, limit: f.limit, cursor: f.cursor })}`,
-        ),
-        json,
-      );
-    if (action === "show") {
-      const [kind, id] = rest;
-      if (!kind || !id)
-        throw new CliError(
-          "USAGE",
-          "inbox show needs <drift|request|question> <id>",
-          2,
-        );
-      return emit(
-        await hubRequest(
-          "GET",
-          `/api/v1/${kind === "question" ? "open-questions" : `${kind}s`}/${encode(id)}`,
-        ),
-        json,
-      );
-    }
-  }
-  if (command === "drift" && action === "file") {
-    const service = requireFlag(f, "service");
-    const bodyMd = await bodyFlag(f);
-    return emit(
-      await hubRequest("POST", `/api/v1/services/${encode(service)}/drift`, {
-        severity: requireFlag(f, "severity"),
-        summary: requireFlag(f, "summary"),
-        bodyMd: bodyMd ?? "",
-        relatedArtifactType: f["related-artifact-type"] ?? null,
-        relatedArtifactId: f["related-artifact-id"] ?? null,
-      }),
-      json,
-    );
-  }
-  if (command === "request" && action === "file") {
-    const specMd = f["spec-file"]
-      ? await readFile(f["spec-file"], "utf8")
-      : requireFlag(f, "spec");
-    const body = {
-      fromService: requireFlag(f, "from"),
-      toService: requireFlag(f, "to"),
-      kind: requireFlag(f, "kind"),
-      specMd,
-      requestHash: requestHash({ toService: f.to, kind: f.kind, specMd }),
-      ...(f["required-capability"]
-        ? { requiredCapability: f["required-capability"] }
-        : {}),
-      targetArtifactType: f["target-artifact-type"] ?? null,
-      targetArtifactId: f["target-artifact-id"] ?? null,
-    };
-    return emit(await hubRequest("POST", "/api/v1/requests", body), json);
-  }
-  if (command === "requests" && action === "file") {
-    const specMd = f["spec-file"] ? await readFile(f["spec-file"], "utf8") : requireFlag(f, "spec");
-    f.fromService = requireFlag(f, "from"); f.toService = requireFlag(f, "to"); f.specMd = specMd;
-    f.requestHash = requestHash({ toService: f.toService, kind: requireFlag(f, "kind"), specMd });
-  }
-  if (command === "decisions") {
-    if (action === "get")
-      return emit(
-        await hubRequest("GET", `/api/v1/decisions/${encode(rest[0])}`),
-        json,
-      );
-    const q = action === "search" ? rest.join(" ") || f.q : undefined;
-    const payload = await hubRequest(
-      "GET",
-      `/api/v1/decisions${query({ status: f.status, module: f.module, tag: f.tag, limit: f.limit ?? 200 })}`,
-    );
-    if (q)
-      payload.data = payload.data.filter((x) =>
-        `${x.id} ${x.title} ${(x.topicTags ?? []).join(" ")}`
-          .toLowerCase()
-          .includes(q.toLowerCase()),
-      );
-    return emit(
-      payload,
-      json,
-      (p) =>
-        p.data.map((x) => `${x.id}\t${x.status}\t${x.title}`).join("\n") ||
-        "No decisions.",
-    );
-  }
-  if (command === "design") {
-    if (action === "entries")
-      return emit(
-        await hubRequest(
-          "GET",
-          `/api/v1/design/entries${query({ kind: f.kind, group: f.group, q: f.q, limit: f.limit })}`,
-        ),
-        json,
-      );
-    if (action === "entry")
-      return emit(
-        await hubRequest("GET", `/api/v1/design/entries/${encode(rest[0])}`),
-        json,
-      );
-    if (action === "guide")
-      return emit(
-        await hubRequest("GET", `/api/v1/design/guides/${encode(rest[0])}`),
-        json,
-      );
-  }
-  if (command === "figma") {
-    if (action === "lock")
-      return emit(
-        await hubRequest(
-          "POST",
-          `/api/v1/design/files/${encode(rest[0])}/lock`,
-          { changeSetTitle: requireFlag(f, "title") },
-        ),
-        json,
-      );
-    if (action === "check") {
-      const c = await readConfig();
-      const result = await hubRequest(
-        "GET",
-        `/api/v1/design/files/${encode(rest[0])}/lock/check?agentId=${encode(c.agentId)}`,
-      );
-      emit(
-        result,
-        json,
-        (p) =>
-          `${p.data.allowed ? "allowed" : "denied"}: ${p.data.reason ?? "lock held"}`,
-      );
-      if (!result.data.allowed) process.exitCode = 3;
-      return;
-    }
-    if (action === "log-write")
-      return emit(
-        await hubRequest(
-          "POST",
-          `/api/v1/design/change-sets/${encode(rest[0])}/writes`,
-          {
-            tool: requireFlag(f, "tool"),
-            nodeIds: requireFlag(f, "nodes").split(",").filter(Boolean),
-          },
-        ),
-        json,
-      );
-    if (["submit", "apply", "published", "abandon"].includes(action)) {
-      const payload = f.file
-        ? JSON.parse(await readFile(f.file, "utf8"))
-        : action === "abandon"
-          ? {}
-          : { figmaVersion: requireFlag(f, "figma-version") };
-      return emit(
-        await hubRequest(
-          "POST",
-          `/api/v1/design/change-sets/${encode(rest[0])}/${action}`,
-          payload,
-        ),
-        json,
-      );
-    }
-    if (action === "release")
-      return emit(
-        await hubRequest(
-          "POST",
-          `/api/v1/design/files/${encode(rest[0])}/lock/release`,
-          {},
-        ),
-        json,
-      );
-  }
-  if (command === "hook") {
-    if (action === "print-settings")
-      return console.log(JSON.stringify(settingsSnippet(), null, 2));
-    if (action === "claude-figma-pre") {
-      // Fail closed: Claude Code only blocks a tool call on exit code 2, and
-      // treats any other non-zero exit as a non-blocking error that lets the
-      // write through. Every failure here (bad stdin, missing config, hub
-      // error, lock denied) must therefore exit 2.
-      try {
-        const payload = JSON.parse(await stdinText());
-        return emit(await preHook(payload), json, "allowed");
-      } catch (error) {
-        throw new CliError(
-          error?.code ?? "FIGMA_HOOK_FAILED",
-          `Blocked Figma write: ${error?.message ?? String(error)}`,
-          2,
-          error?.details,
-        );
-      }
-    }
-    if (action === "lane-heartbeat") {
-      const result = await heartbeatCurrentLane();
-      return emit(result, json, result.heartbeated ? `Heartbeat recorded for ${result.key}.` : "No current-branch lane; no heartbeat sent.");
-    }
-    const payload = JSON.parse(await stdinText());
-    if (action === "workflow-post") {
-      const suggestion = workflowSuggestion(payload);
-      if (suggestion) console.log(suggestion);
-      return;
-    }
-    if (action === "claude-figma-post") {
-      try {
-        return emit(await postHook(payload), json, "logged");
-      } catch (error) {
-        console.error(
-          `nodii-dev post hook: ${error.code ?? "ERROR"}: ${error.message}`,
-        );
-        return;
-      }
-    }
-  }
-  if (Object.hasOwn(GROUPS, command)) {
-    const operations = operationsFrom(await loadOpenApi());
-    let entry = findFirstClass(operations, command, action);
-    if (command === "drift" && action === "resolve" && f.status === "accepted-as-canonical")
-      entry = operations.find((x) => x.operationId === "acceptDrift");
-    if (command === "contracts") {
-      const [kind, verb, ...ids] = [action, ...rest];
-      const type = { grpc: "GrpcInterface", rest: "RestInterface", outbox: "OutboxTopic", saga: "Saga", table: "Table" }[kind];
-      const op = verb === "publish" ? `create${type}` : verb === "status" && f.status === "implemented" ? `implement${type}` : null;
-      if (!op) throw new CliError("USAGE", "contracts: use <grpc|rest|outbox|saga|table> publish|status; status currently supports --status implemented", 2);
-      entry = operations.find((x) => x.operationId === op);
-      rest.splice(0, rest.length, ...ids);
-    }
-    if (!entry) {
-      const tags = Array.isArray(GROUPS[command]) ? GROUPS[command] : [GROUPS[command]];
-      const available = operations.filter((x) => x.tags.some((t) => tags.includes(t))).map((x) => x.operationId).join(", ");
-      throw new CliError("USAGE", `Unknown ${command} action: ${action}. OpenAPI operations: ${available}`, 2);
-    }
-    const built = flagsToOperation(entry, rest, f);
-    if (command === "requests" && action === "answer")
-      Object.assign(built.params, { kind: "request", id: rest[0] });
-    if (command === "drift" && entry.operationId === "acceptDrift" && !built.body?.relatedDecisionId && !built.body?.newDecision)
-      throw new CliError("USAGE", "accepted-as-canonical drift requires --related-decision-id or --new-decision JSON", 2);
-    const explicit = await readBody(f.body);
-    return emit(await callOperation(entry, built.params, explicit?.value ?? built.body), json);
-  }
-  throw new CliError(
-    "USAGE",
-    `Unknown command: ${[command, action].filter(Boolean).join(" ")}`,
-    2,
-  );
-}
-
-main().catch((error) => {
-  const e =
-    error instanceof CliError
-      ? error
-      : new CliError("UNEXPECTED", error?.message ?? String(error));
-  console.error(
-    `${e.code}: ${e.message}${e.details ? `\n${JSON.stringify(e.details)}` : ""}`,
-  );
-  process.exitCode = e.exitCode;
-});
+main().catch(fail);

package/dist/oauth.js

@@ -19,7 +19,7 @@ export const FORBIDDEN_SCOPE = "devops.releases.promote";
  * The scope sent at device authorization. By default none is sent, and
  * nodii-auth grants the app's provisioned ceiling (every live devops.* key
  * except promotion, D1368). An explicit --scope narrows it; promotion is
- * refused locally as well as by auth and the hub.
+ * refused locally as well as by auth and by Dev.
  */
 export function requestedScope(scope) {
   const keys = (scope ?? "").split(/[\s,]+/).filter(Boolean);

package/dist/setup.js

@@ -1,6 +1,6 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
-import { CliError, hubRequest } from "./core.js";
+import { CliError, checkLogin } from "./core.js";
 
 export const SKILL_PATH = ".claude/skills/nodii-build-workflow/SKILL.md";
 const START = "<!-- nodii-dev build workflow:start -->";
@@ -13,7 +13,7 @@ description: Drive every Nodii build lane through nodii-dev from start to verifi
 
 # Nodii build workflow
 
-Use \`nodii-dev\` as the control plane. The canonical policy is \`docs/planning/global/rulebook/build-workflow.md\` §§1–8 (operator rulings A-020/A-021). Never edit hub lane state by another route.
+Use \`nodii-dev\` as the control plane. It talks only to Dev, through the platform edge, signed in with \`nodii-dev login\` as the platform tenant's OAuth app. The canonical policy is the build-workflow rulebook in Dev (\`nodii-dev rulebook list\`), §§1–8 (operator rulings A-020/A-021). Never change lane state in Dev by another route.
 
 1. Start: \`nodii-dev lane start KEY --title "..." --kind dev_fix|new_build|docs_change|uat_fix|prod_fix --side backend|frontend|both [--issue ISSUE]\`.
 2. Ask \`nodii-dev next KEY\`; start, complete, or block the reported API step with \`nodii-dev lane step\`.
@@ -27,14 +27,14 @@ Use \`nodii-dev\` as the control plane. The canonical policy is \`docs/planning/
 - Dev fix, frontend: approved Figma (unless the rulebook exception applies) → components → adopt and local test → deploy without CI → dev check.
 - Dev fix, both: run both API step tracks; neither side may be skipped.
 - New build: feature docs alongside Figma concepts → approvals → backend/design-system build → local test → deploy without CI → dev check.
-- Docs change: draft against code → operator review → land on main → publish in the hub.
-- UAT/prod fixes remain blocked until the hub/rulebook enables per-push green CI and promotion by commit.
+- Docs change: draft against code → operator review → land on main → publish in Dev.
+- UAT/prod fixes remain blocked until the Dev rulebook enables per-push green CI and promotion by commit.
 
 ## Gates and landing
 
-Acquire the repo's heavy slot for heavy work. Run, in order: typecheck → lint and format → scoped touched tests on the real stack → review loop until CLEAN. A reviewer error is not CLEAN. On dev only, the approved no-CI hotfix path is DOOR B (\`[skip-ci-gate]\`) or DOOR C (weekly-cadence marker); still deploy and verify. UAT/prod never use that path. Land through a GitHub PR, never by merging a local/shared main. If the hub is down, merging may continue and the skipped lane gate must be recorded when service returns.
+Acquire the repo's heavy slot for heavy work. Run, in order: typecheck → lint and format → scoped touched tests on the real stack → review loop until CLEAN. A reviewer error is not CLEAN. On dev only, the approved no-CI hotfix path is DOOR B (\`[skip-ci-gate]\`) or DOOR C (weekly-cadence marker); still deploy and verify. UAT/prod never use that path. Land through a GitHub PR, never by merging a local/shared main. If Dev is unreachable, merging may continue and the skipped lane gate must be recorded when service returns.
 
-Do not guess authorization locally: send the request and show the hub refusal unchanged. Stop and Built acknowledgement are staff-only. Machine create/update/coordinator changes are staff-only; coordinators assign agents with \`nodii-dev machine assign MACHINE AGENT --home-repo REPO\`. The target machine coordinator or staff may change lane limits and repository grants. Agents or coordinators report capacity with \`nodii-dev machine report MACHINE --host-facts JSON --memory-facts JSON --heavy-slot-total N\`. Agent registration never sets machine, role, home repo, or lane limit.
+Do not guess authorization locally: send the request and show Dev's refusal unchanged. Stop and Built acknowledgement are staff-only. Machine create/update/coordinator changes are staff-only; coordinators assign agents with \`nodii-dev machine assign MACHINE AGENT --home-repo REPO\`. The target machine coordinator or staff may change lane limits and repository grants. Agents or coordinators report capacity with \`nodii-dev machine report MACHINE --host-facts JSON --memory-facts JSON --heavy-slot-total N\`. Agent registration never sets machine, role, home repo, or lane limit.
 `;
 
 export const managedBlock = `${START}
@@ -94,7 +94,7 @@ export async function setupPlan(root = process.cwd()) {
   return changes;
 }
 
-export async function setupCommand(flags, { root = process.cwd(), authCheck = () => hubRequest("GET", "/api/v1/whoami") } = {}) {
+export async function setupCommand(flags, { root = process.cwd(), authCheck = checkLogin } = {}) {
   const changes = await setupPlan(root);
   let authenticated = true;
   try { await authCheck(); } catch { authenticated = false; }