@nodii/dev 0.6.12 → 0.6.14

package/README.md

@@ -147,6 +147,7 @@ prints them without creating anything.
 nodii-dev figma file add FILE_KEY --name TEXT --kind design-system|surfaces|prototype [--module M]
 nodii-dev figma lock FILE_KEY --title TEXT [--scope KIND:ID ...]
 nodii-dev figma scope add CHANGE_SET --scope KIND:ID [--scope ...]
+nodii-dev figma scope set CHANGE_SET --scope KIND:ID [--scope ...]
 nodii-dev figma publish-plan FILE_KEY
 nodii-dev figma check FILE_KEY
 nodii-dev figma log-write CHANGE_SET --tool TOOL --nodes NODE[,NODE]
@@ -190,10 +191,21 @@ refuses an overlap with `SCOPE_CONFLICT`; the CLI prints Dev's message, then
 the set holding the overlapping scope. `figma lock` without `--scope` locks the
 whole file, as older CLIs do, and that conflicts with every other set.
 `figma scope add` widens a set you hold, with the same check; nothing is ever
-widened silently.
+widened silently. `figma scope set` narrows a set you hold to exactly the
+scopes you give, and releases the rest for other sets: for example, a set
+migrated as a whole-file lock can keep just its page. It only narrows. Each
+scope must sit inside one the set holds (the whole file holds everything, and
+a page holds its components and creates); anything else is
+`SCOPE_NOT_NARROWER`. Dev refuses with `WRITE_OUT_OF_SCOPE` when a logged
+write or a submitted node would fall outside the narrower scopes, so keep a
+scope that holds them.
 
 Every write must fall inside the set's scopes (MW1-57.7). The post-hook
-logs each write's node ids as before. When Dev answers `WRITE_OUT_OF_SCOPE`,
+logs each write's node ids, in colon form. It also logs the variable,
+collection and style ids (`VariableID:…`, `VariableCollectionId:…`, `S:…`)
+that a write returns, including those in a `use_figma` script's JSON
+result, so Dev can tell a foundations write. Dev checks containment at
+`submit`, `resubmit` and `apply`. When Dev answers `WRITE_OUT_OF_SCOPE`,
 the hook exits `2`, so Claude Code shows the agent why: a write that
 returned no node ids (return them from the script, then run `figma log-write`),
 or ids outside the scopes. Dev refuses `figma submit` and `figma resubmit`
@@ -205,11 +217,14 @@ base version.
 Scopes release when a set reaches `awaiting_publish`. One library publish
 then covers every set awaiting publish. Before you publish in Figma,
 `figma publish-plan FILE_KEY` lists the components changed since the last
-publish in two groups. **publish** belongs to sets awaiting publish. **leave
+publish in two groups, and warns about any component that sets from both
+groups changed. **publish** belongs to sets awaiting publish. **leave
 unchecked** belongs to sets still editing or in review: untick those in
 Figma's publish dialog. Then `figma published FILE_KEY --figma-version VERSION`
-marks every awaiting set published, and Dev flags any published component
-from an unfinished set. `figma published CS-123 ...` keeps the per-set route.
+marks every set applied before that version as published (pass the
+library publish's version id). Dev holds back a set whose component an
+unfinished set now holds, and flags any published component from an
+unfinished set. `figma published CS-123 ...` keeps the per-set route.
 
 `figma withdraw` moves a change set you hold from `in_review` back to
 `editing`, as long as no item has been decided (Dev's

package/dist/api.js

@@ -102,7 +102,7 @@ export const GROUPS = {
   composite: "Composite", "service-edges": "ServiceEdges", lanes: "Lanes",
   swaps: "Swaps", ideas: "Ideas", terminology: "Terminology", credentials: "Credentials",
   rulebook: "ad-documents", "ad-decisions": "ad-decisions", domains: "ad-domains", standardizations: "standardizations",
-  archive: "archive", harness: "harness",
+  archive: "archive", harness: "harness", utils: "utils",
   // DEC-0020 rule delivery; `rules core|report|cap` are first-class (upload.js).
   rules: "rulebook",
 };

package/dist/cli.js

@@ -31,6 +31,7 @@ import {
   figmaChangeSetText,
   figmaFileKey,
   figmaFilePublished,
+  figmaFilePublishedText,
   figmaLock,
   figmaLockCheck,
   figmaLockText,
@@ -39,6 +40,8 @@ import {
   figmaPublishPlanText,
   figmaResubmit,
   figmaScopeAdd,
+  figmaScopeSet,
+  figmaScopeSetText,
   figmaSubmit,
   isChangeSetId,
   scopeText,
@@ -91,6 +94,7 @@ Usage: nodii-dev <command> [options] [--json]
                                         # scopes: component:NODE page:NODE foundations create:PAGE:NAME;
                                         # no --scope locks the whole file (DEC-0032)
   figma scope add CHANGE_SET --scope KIND:ID [--scope ...]   # widen a held set's scopes
+  figma scope set CHANGE_SET --scope KIND:ID [--scope ...]   # narrow to exactly these; the rest frees
   figma publish-plan FILE_KEY           # what to publish, and what to leave unchecked in Figma's dialog
   figma published FILE_KEY|CHANGE_SET --figma-version V   # a file key marks every awaiting set published
   figma check|log-write|submit|apply|abandon|release
@@ -139,7 +143,7 @@ contracts, sagas, outbox-topics, tables, libraries, workers, projects, issues,
 backlogs, builds, changes, deploy-reports, runtime, people, agents, inbox,
 gate, design, runbooks, doctrine, changelog, health-verdicts, approval-kinds,
 notification-registry, skills, open-questions, decisions, drift, requests,
-rulebook, ad-decisions, domains, standardizations, archive, and harness.
+rulebook, ad-decisions, domains, standardizations, archive, harness, and utils.
 
 Run a command with --help or see the package README for all flags.`;
 
@@ -605,7 +609,8 @@ export async function main(argv = process.argv.slice(2)) {
     if (action === "lock")
       return emit(await figmaLock(rest[0], requireFlag(f, "title"), { scopes: scopesFrom(f) }), json, (p) => figmaLockText(p.data));
     if (action === "scope") {
-      if (rest[0] !== "add" || !rest[1] || rest.length > 2) throw new CliError("USAGE", "figma scope add CHANGE_SET --scope KIND:ID [--scope ...]", 2);
+      if (!["add", "set"].includes(rest[0]) || !rest[1] || rest.length > 2) throw new CliError("USAGE", "figma scope add|set CHANGE_SET --scope KIND:ID [--scope ...]", 2);
+      if (rest[0] === "set") return emit(await figmaScopeSet(rest[1], scopesFrom(f)), json, (p) => figmaScopeSetText(rest[1], p.data));
       return emit(await figmaScopeAdd(rest[1], scopesFrom(f)), json, (p) =>
         `${rest[1]} holds ${p.data?.scopes?.length ?? "its"} scope(s)${p.data?.scopes?.length ? `: ${p.data.scopes.map(scopeText).join(", ")}` : ""}`);
     }
@@ -616,9 +621,7 @@ export async function main(argv = process.argv.slice(2)) {
     // One publish covers every set awaiting publish on the file (MW1-57.8); a
     // change set id keeps the per-set route.
     if (action === "published" && rest[0] && !isChangeSetId(rest[0]))
-      return emit(await figmaFilePublished(rest[0], f.file ? JSON.parse(await readFile(f.file, "utf8")) : { figmaVersion: requireFlag(f, "figma-version") }), json, (p) =>
-        `Published ${p.data.published?.length ?? 0} change set(s): ${(p.data.published ?? []).join(", ") || "none awaiting publish"}` +
-        (p.data.flagged?.length ? `\nFLAGGED: published components from unfinished sets: ${JSON.stringify(p.data.flagged)}` : ""));
+      return emit(await figmaFilePublished(rest[0], f.file ? JSON.parse(await readFile(f.file, "utf8")) : { figmaVersion: requireFlag(f, "figma-version") }), json, (p) => figmaFilePublishedText(p.data));
     if (action === "submit") {
       const payload = f.file ? JSON.parse(await readFile(f.file, "utf8")) : { figmaVersion: requireFlag(f, "figma-version") };
       return emit(await figmaSubmit(rest[0], payload), json);
@@ -670,7 +673,7 @@ export async function main(argv = process.argv.slice(2)) {
       return emit(
         await devRequest(
           "POST",
-          `/api/v1/design/files/${encode(rest[0])}/lock/release`,
+          `/api/v1/design/files/${encode(figmaFileKey(rest[0]))}/lock/release`,
           {},
         ),
         json,

package/dist/core.js

@@ -4,7 +4,7 @@ import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 
-export const VERSION = "0.6.12";
+export const VERSION = "0.6.14";
 export const configPath = () =>
   process.env.NODII_DEV_CONFIG_PATH ??
   join(homedir(), ".config/nodii-dev/config.json");
@@ -105,20 +105,42 @@ export function requestUrl(config, path) {
   return `${config.edgeUrl.replace(/\/$/, "")}/devops${path}`;
 }
 
+const staleCode = (raw) => {
+  try {
+    return JSON.parse(raw)?.code === "token_stale";
+  } catch {
+    return false;
+  }
+};
+
 async function devFetch(method, path, bodyText, contentType, accept) {
   const config = await readConfig();
   const auth = await authProvider();
-  const headers = { accept };
-  if (bodyText !== undefined) headers["content-type"] = contentType;
-  Object.assign(headers, await auth.headers({ method, path, body: bodyText ?? "" }));
   const url = requestUrl(config, path);
-  let response;
-  try {
-    response = await fetch(url, { method, headers, body: bodyText });
-  } catch (error) {
-    throw new CliError("DEV_UNREACHABLE", `Cannot reach Dev at ${new URL(url).origin}: ${error.message}`);
+  // The edge refuses a token minted before the principal's claims epoch with
+  // 401 token_stale (refresh and retry once). The request never reached Dev,
+  // so it is sent again: with a token another process cached since, or with
+  // one refresh. A token_stale after that refresh is surfaced.
+  let refreshed = false;
+  let adopted = false;
+  for (;;) {
+    const headers = { accept };
+    if (bodyText !== undefined) headers["content-type"] = contentType;
+    Object.assign(headers, await auth.headers({ method, path, body: bodyText ?? "" }));
+    let response;
+    try {
+      response = await fetch(url, { method, headers, body: bodyText });
+    } catch (error) {
+      throw new CliError("DEV_UNREACHABLE", `Cannot reach Dev at ${new URL(url).origin}: ${error.message}`);
+    }
+    const raw = await response.text();
+    if (response.status !== 401 || typeof auth.refreshStale !== "function" || !staleCode(raw)) return { response, raw };
+    if (refreshed) return { response, raw };
+    // A cached token that is stale too is not adopted twice: the next one is refreshed.
+    const used = String(headers.authorization ?? "").replace(/^Bearer /, "");
+    if ((await auth.refreshStale(used, { force: adopted })) === "refreshed") refreshed = true;
+    else adopted = true;
   }
-  return { response, raw: await response.text() };
 }
 
 export async function devRawRequest(method, path, bodyText, contentType = "application/json") {