@dashai/cli 0.13.0 → 0.14.1

package/dist/bin.js

@@ -865,8 +865,14 @@ npm run dev:next            # next dev on :3000                  (terminal 2)
 - **\`module.json\`** \u2014 manifest (\`module_kind: 'custom'\`, \`runtime.kind: 'machine'\`).
 - **\`middleware.ts\`** \u2014 \`withAuth\` from \`@dashai/sdk/auth/middleware\`. Redirects unauthenticated requests through the DashWise SSO flow.
 - **\`app/layout.tsx\`** \u2014 wraps the tree in \`<AuthProvider>\` from \`@dashai/sdk/auth/client\`.
-- **\`app/page.tsx\`** \u2014 public landing (allowlisted in \`middleware.ts\`).
-- **\`app/dashboard/page.tsx\`** \u2014 Server Component requiring a valid session via \`getServerSession()\`.
+- **\`app/page.tsx\`** \u2014 the app's home at \`/\` (auth-gated; zero-click for platform users via \`autoSignIn\`). **This is where you build your app.**
+- **\`app/dashboard/page.tsx\`** \u2014 an additional example Server Component route, also session-gated via \`getServerSession()\`.
+
+The design is yours: edit the theme tokens in \`app/globals.css\` (they ship
+colored on purpose, as a starting point) and use any Tailwind colors or
+shadcn blocks you like. A manual "Sign in" landing page is only for a
+\`public_access_allowed\` module \u2014 re-add \`'/'\` to \`middleware.ts\` publicPaths
+and drop the home's session guard to build one.
 - **\`app/api/auth/callback/route.ts\`** \u2014 exchanges the SSO one-time code for a session cookie (uses \`exchangeCode()\` from the SDK).
 - **\`app/api/auth/sign-in/route.ts\`** \u2014 one entry point that calls the backend's \`POST /api/module-api/sso/start-url\` (authenticated with your \`dwk_\` key) and 302s the browser to the returned \`redirect_url\`. Same path in dev + prod.
 - **\`app/api/auth/sign-out/route.ts\`** \u2014 clears the session cookie + tells the backend to revoke.
@@ -943,18 +949,28 @@ function middlewareTs() {
 import { withAuth } from '@dashai/sdk/auth/middleware';
 
 export default withAuth({
-  // \`/sign-in-error\` is public so unauthenticated visitors can actually
-  // see the polished SSO error page \u2014 otherwise a sign-in failure would
-  // redirect-loop trying to re-authenticate.
-  publicPaths: ['/', '/about', '/sign-in-error'],
+  // Only the SSO error page is public. The app's home lives at \`/\`
+  // (app/page.tsx) and is auth-gated like the rest of the app \u2014 a
+  // signed-in platform user still lands there with ZERO clicks because
+  // \`autoSignIn\` (below) completes the handshake silently. There is no
+  // public "sign in" wall in front of your app by default.
+  //
+  // \`/sign-in-error\` stays public so a failed sign-in can render its
+  // error page instead of redirect-looping back into re-authentication.
+  //
+  // Building a \`public_access_allowed\` module that wants an ANONYMOUS
+  // landing page (a marketing / manual "Sign in with DashWise" screen)?
+  // Re-add \`'/'\` here AND make app/page.tsx public (drop its
+  // getServerSession guard). See the README's "Design & home" note.
+  publicPaths: ['/sign-in-error'],
   loginPath: '/api/auth/sign-in',
   // Silent sign-in: when a signed-in DashWise user opens the module through
   // the platform (in-app embed or the module subdomain), the SSO handshake
-  // completes with zero clicks \u2014 they land straight in the app, landing page
-  // included. It never touches:
+  // completes with zero clicks \u2014 they land straight on the page they asked
+  // for, the home at \`/\` included. It never touches:
   //   - anonymous visitors on public installs (no platform-session hint),
-  //   - local \`dashwise dev\` (no platform proxy \u2192 no hint header) \u2014 the
-  //     landing's "Sign in with DashWise" button stays your dev flow,
+  //   - local \`dashwise dev\` (no platform proxy \u2192 no hint header) \u2014 a
+  //     manual sign-in through /api/auth/sign-in stays your dev flow,
   //   - anything within 60s of a failed silent attempt (no redirect loops).
   autoSignIn: true,
 });
@@ -996,84 +1012,118 @@ export default function RootLayout({ children }: { children: React.ReactNode })
 `;
 }
 function appPageCustomTsx(opts) {
-  return `// Public landing page \u2014 listed in middleware.ts publicPaths.
+  return `// app/page.tsx \u2014 the app's REAL home, served at \`/\`. THIS IS YOUR APP.
+// Build it here.
 //
-// NOTE: signed-in DashWise users usually never see this page \u2014 the
-// middleware's \`autoSignIn\` signs them in silently and they land on the
-// page they asked for. This landing serves anonymous visitors (public
-// installs), local \`dashwise dev\`, and the rare failed silent attempt \u2014
-// its "Sign in with DashWise" button is the manual fallback that kicks
-// off the same SSO flow (via /api/auth/sign-in). After signing in, the
-// user lands on /dashboard (Server Component, session-validated).
+// A signed-in DashWise user who opens this module through the platform
+// (in-app embed or the module subdomain) lands on THIS page with zero
+// clicks: the middleware's \`autoSignIn\` completes the SSO handshake
+// silently, so there is no sign-in wall in front of your app. The guard
+// below mirrors app/dashboard/page.tsx \u2014 no session \u2192 bounce through the
+// SSO flow and come right back to \`/\`.
 //
-// Styling: shadcn/ui primitives (\`<Button>\`, \`<Card>\`) on Tailwind 4
-// theme tokens. Add more blocks via \`npx shadcn add @shadcn-studio/...\`
-// (see README's "Adding UI blocks" section).
+// A public, anonymous sign-in landing page is only for a
+// \`public_access_allowed\` module that wants an unauthenticated entry
+// point. To build one, re-add \`'/'\` to middleware.ts publicPaths and drop
+// the getServerSession guard here (see the README's "Design & home" note).
+//
+// The design is YOURS to own. These shadcn primitives sit on the theme
+// tokens in app/globals.css \u2014 edit the hues freely \u2014 and the full
+// Tailwind palette (bg-indigo-600, text-emerald-500, \u2026) is available too.
+// This colored starter look is a starting point, not a mandate.
 import Link from 'next/link';
-import { LogIn, LayoutDashboard } from 'lucide-react';
+import { getServerSession } from '@dashai/sdk/auth/server';
+import { redirect } from 'next/navigation';
+import { ArrowRight, Table2, Database, PenLine } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import {
   Card,
-  CardContent,
   CardDescription,
   CardHeader,
   CardTitle,
 } from '@/components/ui/card';
 
-export default function Page() {
+// force-dynamic: this page calls getServerSession() at render, which
+// reads DASHWISE_API_URL/KEY. \`next build\` statically PRERENDERS pages by
+// default and runs with NO DashWise env, so the SDK would throw
+// "missing apiBaseUrl" and the platform's first publish would fail with
+// an opaque BUILD_FAILED. Opting into dynamic rendering skips prerender.
+export const dynamic = 'force-dynamic';
+
+export default async function Home() {
+  const session = await getServerSession();
+  if (!session) {
+    redirect('/api/auth/sign-in?return_to=/');
+  }
   return (
-    <main className="flex min-h-dvh flex-col items-center justify-center gap-12 px-6 py-16">
-      <section className="flex max-w-2xl flex-col items-center gap-6 text-center">
-        <h1 className="text-balance text-4xl font-semibold tracking-tight sm:text-5xl">
+    <main className="mx-auto flex min-h-dvh max-w-4xl flex-col gap-10 px-6 py-12">
+      {/* Primary-colored hero \u2014 the default look is colored on purpose,
+          to signal the design is yours to change. */}
+      <section className="flex flex-col gap-4 rounded-2xl bg-primary px-8 py-12 text-primary-foreground shadow-sm">
+        <p className="text-sm font-medium uppercase tracking-wide opacity-80">
           ${escapeHtml(opts.name)}
+        </p>
+        <h1 className="text-balance text-4xl font-semibold tracking-tight sm:text-5xl">
+          Your app starts here.
         </h1>
-        <p className="text-balance text-lg text-muted-foreground">
-          A DashWise module. Sign in with your DashWise account to access the
-          dashboard and start using the workspace's data through the typed SDK.
+        <p className="max-w-xl text-pretty text-lg opacity-90">
+          Signed in as{' '}
+          <span className="font-medium">{session.user.email}</span>. This is the
+          real home of your module \u2014 edit{' '}
+          <code className="rounded bg-primary-foreground/15 px-1.5 py-0.5 font-mono">
+            app/page.tsx
+          </code>{' '}
+          to build it.
         </p>
-        <div className="flex flex-wrap items-center justify-center gap-3">
-          <Button asChild size="lg">
-            <Link href="/api/auth/sign-in?return_to=/dashboard">
-              <LogIn aria-hidden="true" />
-              Sign in with DashWise
-            </Link>
-          </Button>
-          <Button asChild variant="ghost" size="lg">
+        <div className="flex flex-wrap gap-3 pt-2">
+          <Button asChild size="lg" variant="secondary">
             <Link href="/dashboard">
-              <LayoutDashboard aria-hidden="true" />
-              Go to dashboard
+              See the example route
+              <ArrowRight aria-hidden="true" />
             </Link>
           </Button>
         </div>
       </section>
 
-      <Card className="w-full max-w-2xl">
-        <CardHeader>
-          <CardTitle>What you can do here</CardTitle>
-          <CardDescription>
-            This is a custom DashWise module \u2014 a full Next.js app authenticated
-            against the DashWise SSO. Edit \`app/page.tsx\` to replace this
-            landing page; everything else is yours to customize.
-          </CardDescription>
-        </CardHeader>
-        <CardContent className="text-sm text-muted-foreground">
-          <ul className="space-y-2">
-            <li>
-              Edit <code className="rounded bg-muted px-1.5 py-0.5">module.json</code>
-              {' '}to declare tables, dependencies, and runtime config.
-            </li>
-            <li>
-              Run <code className="rounded bg-muted px-1.5 py-0.5">dashwise dev</code>
-              {' '}for a one-command local loop with auth env vars auto-injected.
-            </li>
-            <li>
-              Import typed table clients from{' '}
-              <code className="rounded bg-muted px-1.5 py-0.5">@dashai/generated</code>
-              {' '}\u2014 the SDK regenerates on every manifest save.
-            </li>
-          </ul>
-        </CardContent>
-      </Card>
+      {/* A few colored pointers to get moving. */}
+      <section className="grid gap-4 sm:grid-cols-3">
+        <Card className="border-l-4 border-l-chart-1">
+          <CardHeader>
+            <Table2 className="size-5 text-chart-1" aria-hidden="true" />
+            <CardTitle className="text-base">Declare your data</CardTitle>
+            <CardDescription>
+              Add tables to{' '}
+              <code className="rounded bg-muted px-1 py-0.5 font-mono">module.json</code>{' '}
+              (or run{' '}
+              <code className="rounded bg-muted px-1 py-0.5 font-mono">dashwise table create</code>).
+            </CardDescription>
+          </CardHeader>
+        </Card>
+        <Card className="border-l-4 border-l-chart-2">
+          <CardHeader>
+            <Database className="size-5 text-chart-2" aria-hidden="true" />
+            <CardTitle className="text-base">Read it, typed</CardTitle>
+            <CardDescription>
+              Import{' '}
+              <code className="rounded bg-muted px-1 py-0.5 font-mono">db</code>{' '}
+              from{' '}
+              <code className="rounded bg-muted px-1 py-0.5 font-mono">@dashai/generated</code>{' '}
+              \u2014 regenerated on every manifest save.
+            </CardDescription>
+          </CardHeader>
+        </Card>
+        <Card className="border-l-4 border-l-chart-3">
+          <CardHeader>
+            <PenLine className="size-5 text-chart-3" aria-hidden="true" />
+            <CardTitle className="text-base">Write via server actions</CardTitle>
+            <CardDescription>
+              Mutate data from Server Actions / route handlers so the scoped{' '}
+              <code className="rounded bg-muted px-1 py-0.5 font-mono">dwk_</code>{' '}
+              key stays server-side.
+            </CardDescription>
+          </CardHeader>
+        </Card>
+      </section>
     </main>
   );
 }
@@ -1093,18 +1143,25 @@ import {
 } from '@/components/ui/card';
 
 /**
- * Auth-gated Server Component. The middleware ensures the user has
- * a session cookie before this page renders; \`getServerSession()\`
+ * An ADDITIONAL example route \u2014 your real home is app/page.tsx (\`/\`).
+ * This \`/dashboard\` page is here to show a second auth-gated Server
+ * Component: keep it, rename it, or delete it. The middleware ensures the
+ * user has a session cookie before this page renders; \`getServerSession()\`
  * validates the cookie against the backend's \`/api/auth/sessions/me\`
  * endpoint, returning the decoded \`Session\` (or \`null\` if stale).
  *
  * On a successful render, this is the polished session card \u2014 replace
  * the contents with whatever your module actually needs to show.
  */
+// force-dynamic: same reason as app/page.tsx \u2014 this route calls
+// getServerSession() at render, which needs DASHWISE_API_URL/KEY. Static
+// prerender during \`next build\` runs with no env \u2192 BUILD_FAILED. Opt out.
+export const dynamic = 'force-dynamic';
+
 export default async function Dashboard() {
   const session = await getServerSession();
   if (!session) {
-    redirect('/api/auth/sign-in?return_to=/dashboard');
+    redirect('/api/auth/sign-in?return_to=/');
   }
   return (
     <main className="mx-auto flex min-h-dvh max-w-3xl flex-col gap-6 px-6 py-12">
@@ -1157,7 +1214,9 @@ export default async function Dashboard() {
         <CardHeader>
           <CardTitle>Next steps</CardTitle>
           <CardDescription>
-            Replace this dashboard with your module's actual UI.
+            This is an extra example route \u2014 your real home is{' '}
+            <code className="rounded bg-muted px-1.5 py-0.5">app/page.tsx</code>.
+            Keep, rename, or delete this one.
           </CardDescription>
         </CardHeader>
         <CardContent className="space-y-2 text-sm text-muted-foreground">
@@ -1548,7 +1607,12 @@ export default config;
 `;
 }
 function globalsCss() {
-  return `@import "tailwindcss";
+  return `/* These theme tokens are a STARTING POINT \u2014 change the hues freely.
+   The default \`--primary\` is a violet/indigo and the \`--chart-*\` ramp is
+   a 5-hue set; swap them for your brand. The full Tailwind color palette
+   (bg-indigo-600, text-emerald-500, \u2026) is also available on top of these
+   tokens. This is YOUR design to own. */
+@import "tailwindcss";
 @import "tw-animate-css";
 @import "shadcn/tailwind.css";
 
@@ -1561,20 +1625,33 @@ function globalsCss() {
   --card-foreground: oklch(0.14 0 0);
   --popover: oklch(1 0 0);
   --popover-foreground: oklch(0.14 0 0);
-  --primary: oklch(0.2 0 0);
-  --primary-foreground: oklch(0.99 0 0);
-  --secondary: oklch(0.97 0 0);
-  --secondary-foreground: oklch(0.2 0 0);
-  --muted: oklch(0.97 0 0);
-  --muted-foreground: oklch(0.56 0 0);
-  --accent: oklch(0.97 0 0);
-  --accent-foreground: oklch(0.2 0 0);
+  /* Colored primary (violet/indigo, ~indigo-600). White foreground reads
+     cleanly on it (~5:1). Change the hue (275) to re-brand. */
+  --primary: oklch(0.55 0.22 275);
+  --primary-foreground: oklch(0.985 0 0);
+  /* secondary + muted stay near-neutral (clean UI) but carry a faint
+     violet tint so nothing is pure grayscale. */
+  --secondary: oklch(0.97 0.005 275);
+  --secondary-foreground: oklch(0.25 0.02 275);
+  --muted: oklch(0.97 0.005 275);
+  --muted-foreground: oklch(0.55 0.02 275);
+  /* accent = a soft, low-chroma wash of the primary hue. */
+  --accent: oklch(0.96 0.03 275);
+  --accent-foreground: oklch(0.4 0.1 275);
   --destructive: oklch(0.58 0.24 28.48);
   --border: oklch(0.92 0 0);
   --input: oklch(0.92 0 0);
-  --ring: oklch(0.71 0 0);
+  --ring: oklch(0.55 0.2 275);
   --radius: 0.625rem;
 
+  /* 5-hue chart ramp \u2014 distinct, readable hues for data viz + accents.
+     Wired to \`bg-chart-1\` \u2026 \`text-chart-5\` via the @theme block below. */
+  --chart-1: oklch(0.55 0.2 275);
+  --chart-2: oklch(0.6 0.13 195);
+  --chart-3: oklch(0.7 0.16 70);
+  --chart-4: oklch(0.65 0.17 145);
+  --chart-5: oklch(0.6 0.22 15);
+
   --font-sans:
     ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont,
     "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
@@ -1590,18 +1667,37 @@ function globalsCss() {
   --card-foreground: oklch(0.99 0 0);
   --popover: oklch(0.2 0 0);
   --popover-foreground: oklch(0.99 0 0);
-  --primary: oklch(0.92 0 0);
-  --primary-foreground: oklch(0.2 0 0);
-  --secondary: oklch(0.27 0 0);
+  /* Slightly lighter violet so it pops on the dark background; white
+     foreground stays readable (~4.8:1). */
+  --primary: oklch(0.58 0.21 275);
+  --primary-foreground: oklch(0.985 0 0);
+  --secondary: oklch(0.27 0.01 275);
   --secondary-foreground: oklch(0.99 0 0);
-  --muted: oklch(0.27 0 0);
-  --muted-foreground: oklch(0.71 0 0);
-  --accent: oklch(0.27 0 0);
-  --accent-foreground: oklch(0.99 0 0);
+  --muted: oklch(0.27 0.01 275);
+  --muted-foreground: oklch(0.71 0.02 275);
+  --accent: oklch(0.3 0.04 275);
+  --accent-foreground: oklch(0.97 0.01 275);
   --destructive: oklch(0.7 0.19 22.23);
   --border: oklch(0.27 0 0);
   --input: oklch(0.27 0 0);
-  --ring: oklch(0.56 0 0);
+  --ring: oklch(0.58 0.19 275);
+
+  --chart-1: oklch(0.62 0.19 275);
+  --chart-2: oklch(0.67 0.13 195);
+  --chart-3: oklch(0.75 0.15 70);
+  --chart-4: oklch(0.7 0.16 145);
+  --chart-5: oklch(0.67 0.2 15);
+}
+
+/* Wire the chart tokens into Tailwind's color namespace so \`bg-chart-1\`,
+   \`text-chart-2\`, \`border-l-chart-3\`, \u2026 resolve. (\`@import "shadcn/tailwind.css"\`
+   already maps the core tokens like \`--primary\`; this covers the ramp.) */
+@theme inline {
+  --color-chart-1: var(--chart-1);
+  --color-chart-2: var(--chart-2);
+  --color-chart-3: var(--chart-3);
+  --color-chart-4: var(--chart-4);
+  --color-chart-5: var(--chart-5);
 }
 
 * {
@@ -1872,13 +1968,13 @@ export default async function SignInErrorPage({ searchParams }: SignInErrorPageP
           )}
           <div className="flex flex-wrap gap-2 pt-2">
             <Button asChild>
-              <Link href="/api/auth/sign-in?return_to=/dashboard">
+              <Link href="/api/auth/sign-in?return_to=/">
                 <RefreshCw aria-hidden="true" />
                 Try again
               </Link>
             </Button>
             <Button asChild variant="ghost">
-              <Link href="/">Back to landing</Link>
+              <Link href="/">Back to home</Link>
             </Button>
           </div>
         </CardContent>
@@ -1960,10 +2056,10 @@ dashwise field remove <table> <slug>
 dashwise field set-type <table> <slug> <type>
 \`\`\`
 
-Allowed field types: \`text\`, \`long_text\`, \`number\`, \`boolean\`,
+Allowed field types (18): \`text\`, \`long_text\`, \`number\`, \`boolean\`,
 \`date\`, \`datetime\`, \`single_select\`, \`multi_select\`,
 \`link_row\`, \`file\`, \`multi_file\`, \`email\`, \`url\`,
-\`phone\`, \`formula\`, \`ai\`.
+\`phone\`, \`formula\`, \`ai\`, \`uuid\`, \`jsonb\`.
 
 ## Read + write data via the generated SDK
 
@@ -1978,8 +2074,10 @@ import { db, qb } from '@dashai/generated';
 const rows = await db.<table>.list();
 await db.<table>.create({ /* fields */ });
 
-// Query builder (joins, aggregates)
-const stats = await qb.from('<table>').where({ /* ... */ }).execute();
+// Query builder \u2014 a per-table getter (NOT a \`.from()\` call); \`.where()\`
+// takes a single clause object (field \u2192 value or field \u2192 operator), and
+// \`.execute()\` runs it. Chain \`.orderBy()\` / \`.limit()\` / \`.count()\` etc.
+const open = await qb.<table>.where({ status: { equal: 'open' } }).execute();
 \`\`\`
 
 The data plane authenticates via the per-module scoped \`dwk_\` API key
@@ -2025,7 +2123,37 @@ In Server Components: \`await getServerSession()\` (from
 In Client Components: \`useSession()\` (from
 \`@dashai/sdk/auth/client\`), wrapped in \`<AuthProvider>\` (already
 in \`app/layout.tsx\`).
-
+${isCustom ? `
+## Design & home
+
+You OWN the UI \u2014 layout, components, and colors. Edit the theme tokens in
+\`app/globals.css\` freely (they're a starting point, not a mandate), reach
+for any Tailwind color (\`bg-indigo-600\`, \`text-emerald-500\`, \u2026), and pull
+in more shadcn blocks (see the README's "Adding UI blocks").
+
+The app's **home is \`app/page.tsx\`, served at \`/\`** \u2014 build the real app
+there. It's auth-gated: a platform user lands on it zero-click (the
+middleware's \`autoSignIn\` signs them in silently), and \`app/dashboard/page.tsx\`
+is just an extra example route. A manual "Sign in with DashWise" landing
+page belongs ONLY to a \`public_access_allowed\` module that wants an
+anonymous entry point (re-add \`'/'\` to \`middleware.ts\` publicPaths + drop
+the home's session guard to build one).
+
+## Before you publish
+
+Add \`export const dynamic = 'force-dynamic'\` to the top of ANY page that
+reads the session or data at render (calls \`getServerSession()\` or a
+\`dwk_\`-authenticated data call). Without it, \`next build\` statically
+prerenders the page with NO DashWise env vars, the SDK throws
+\`missing apiBaseUrl\`, and the platform's first publish fails with an
+opaque \`BUILD_FAILED\`. The scaffolded \`app/page.tsx\` + \`app/dashboard/page.tsx\`
+already have it \u2014 any new session-gated page you add needs it too.
+
+A passing local \`npm run build\` is NOT proof: your \`.env.local\` supplies
+the env the platform build won't have, so it masks the failure. \`GET\` route
+handlers under \`app/api/*\` are dynamic by default in Next 15, so they don't
+hit this trap.
+` : ""}
 ## Local dev lifecycle
 
 \`\`\`
@@ -9943,7 +10071,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 })();
 function getVersion() {
-  return "0.13.0";
+  return "0.14.1";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);