@dashai/cli 0.14.2 → 0.16.0

package/dist/bin.js

@@ -3,9 +3,9 @@ import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, watch, read
 import { tmpdir, platform, homedir } from 'os';
 import { resolve, join, relative, dirname, basename, sep } from 'path';
 import pc from 'picocolors';
+import { spawn, spawnSync } from 'child_process';
 import { intro, log, select, isCancel, cancel, spinner, outro, text, multiselect, confirm } from '@clack/prompts';
 import { Command, Option } from 'commander';
-import { spawn, spawnSync } from 'child_process';
 import open from 'open';
 import AdmZip from 'adm-zip';
 import * as tar from 'tar';
@@ -447,6 +447,15 @@ async function listWorkspaceInstallations(workspaceId, options = {}) {
     options
   );
 }
+async function uninstallModuleInstallation(installationId, opts = {}, options = {}) {
+  const qs = opts.parkConsumers ? "?park_consumers=true" : "";
+  await apiRequest(
+    "DELETE",
+    `/api/modules/installations/${installationId}${qs}`,
+    void 0,
+    options
+  );
+}
 async function applyDraftManifest(moduleId, manifest, options = {}) {
   return apiRequest(
     "PUT",
@@ -512,6 +521,79 @@ var init_output = __esm({
   "src/lib/output.ts"() {
   }
 });
+
+// src/lib/connect-status.ts
+async function reportConnectStatus(opts) {
+  const [deps, bindings] = await Promise.all([
+    safeGet(
+      () => getInstallationDependencies(opts.installationId, opts.requestOptions)
+    ),
+    safeGet(
+      () => getInstallationBindings(opts.installationId, opts.requestOptions)
+    )
+  ]);
+  if (deps === null && bindings === null) return;
+  const depList = deps ?? [];
+  const bindList = bindings ?? [];
+  if (depList.length === 0 && bindList.length === 0) return;
+  const unboundDeps = depList.filter((d) => d.status === "unbound").length;
+  const unboundUses = bindList.filter((b) => b.status === "unbound").length;
+  info(
+    `Connect status for ${code(opts.moduleSlug)} ${dim(
+      `(${depList.length} dep${depList.length === 1 ? "" : "s"}, ${bindList.length} uses slot${bindList.length === 1 ? "" : "s"})`
+    )}:`
+  );
+  for (const d of depList) renderDep(d);
+  for (const b of bindList) renderBinding(b);
+  const hints = [];
+  if (unboundDeps > 0) {
+    hints.push(
+      `${code("dashwise deps bind <provider-slug>")} once the provider is installed`
+    );
+  }
+  if (unboundUses > 0) {
+    hints.push(`${code("dashwise bind <uses-slug> --table <name>")} to connect a table`);
+  }
+  if (hints.length > 0) {
+    info(`Connect parked items with ${hints.join("; ")}.`);
+  }
+  out("");
+}
+function renderDep(d) {
+  if (d.status === "resolved") {
+    const providerLine = d.provider ? ` ${dim(`\u2192 install #${d.provider.installation_id} @ v${d.provider.version}`)}` : "";
+    out(`  ${pc.green("\u25CF resolved")} ${dim("dep")} ${code(d.slug)}@${d.range ?? "*"}${providerLine}`);
+  } else {
+    out(
+      `  ${pc.yellow("\u25CB unbound")}  ${dim("dep")} ${code(d.slug)}@${d.range ?? "*"} ${dim(`reason: ${d.reason ?? "(unspecified)"}`)}`
+    );
+  }
+}
+function renderBinding(b) {
+  if (b.status === "bound") {
+    const tableLine = b.table ? ` ${dim(`\u2192 ${b.table.name} (id ${b.table.id})`)}` : "";
+    out(`  ${pc.green("\u25CF bound")}    ${dim("uses")} ${code(b.uses_slug)}${tableLine}`);
+  } else if (b.status === "declined") {
+    out(`  ${pc.dim("\u2298 declined")} ${dim("uses")} ${code(b.uses_slug)}`);
+  } else {
+    out(
+      `  ${pc.yellow("\u25CB unbound")}  ${dim("uses")} ${code(b.uses_slug)} ${dim(`reason: ${b.reason ?? "(unspecified)"}`)}`
+    );
+  }
+}
+async function safeGet(fn) {
+  try {
+    return await fn();
+  } catch (err) {
+    return null;
+  }
+}
+var init_connect_status = __esm({
+  "src/lib/connect-status.ts"() {
+    init_api_client();
+    init_output();
+  }
+});
 function manifestPath(dir) {
   return join(resolve(dir ?? process.cwd()), "module.json");
 }
@@ -545,137 +627,751 @@ var init_manifest_io = __esm({
   }
 });
 
-// src/lib/scaffold.ts
-function isDeployTarget(value) {
-  return DEPLOY_TARGETS.includes(value);
+// src/lib/manifest-merge.ts
+function tablesBySlug(manifest) {
+  const map = /* @__PURE__ */ new Map();
+  const owns = manifest?.owns;
+  if (!owns || typeof owns !== "object") return map;
+  const tables = owns.tables;
+  if (!Array.isArray(tables)) return map;
+  for (const t of tables) {
+    if (t && typeof t === "object" && typeof t.slug === "string") {
+      map.set(t.slug, t);
+    }
+  }
+  return map;
+}
+function mergeRemoteManifest(local, remote) {
+  const preserved = [];
+  const merged = { ...remote };
+  if (!local || typeof local !== "object" || Array.isArray(local)) {
+    return { merged, preserved };
+  }
+  for (const [key, value] of Object.entries(local)) {
+    if (!(key in remote)) {
+      merged[key] = value;
+      preserved.push(key);
+    }
+  }
+  const localTables = tablesBySlug(local);
+  const remoteOwns = remote.owns;
+  if (remoteOwns && typeof remoteOwns === "object" && Array.isArray(remoteOwns.tables)) {
+    const remoteTables = remoteOwns.tables;
+    let touched = false;
+    const mergedTables = remoteTables.map((t) => {
+      if (!t || typeof t !== "object") return t;
+      const slug = t.slug;
+      if (typeof slug !== "string") return t;
+      const localTable = localTables.get(slug);
+      if (localTable && Array.isArray(localTable.indexes) && t.indexes === void 0) {
+        preserved.push(`owns.tables[${slug}].indexes`);
+        touched = true;
+        return { ...t, indexes: localTable.indexes };
+      }
+      return t;
+    });
+    if (touched) {
+      merged.owns = { ...remoteOwns, tables: mergedTables };
+    }
+  }
+  return { merged, preserved };
 }
-function manifestJson(opts) {
-  const kind = opts.kind ?? "hand_authored";
-  const manifest = {
-    schema_version: 2,
-    module: {
-      slug: opts.slug,
-      name: opts.name,
-      version: "0.0.1"
-    },
-    module_kind: kind,
-    owns: {
-      tables: [
-        {
-          // NOTE: no `name` key here — the backend manifest validator
-          // (POST /api/installations/dev) is strict and rejects unrecognized
-          // table keys, and it derives the display name from the slug. A
-          // `name` here would fail provisioning's table materialization (#4).
-          slug: "items",
-          fields: [
-            { slug: "title", type: "text" },
-            { slug: "done", type: "boolean" }
-          ]
-        }
-      ]
+function fieldSlugs(table) {
+  const set = /* @__PURE__ */ new Set();
+  const fields = table?.fields;
+  if (!Array.isArray(fields)) return set;
+  for (const f of fields) {
+    if (f && typeof f === "object" && typeof f.slug === "string") {
+      set.add(f.slug);
     }
-  };
-  if (kind === "custom") {
-    manifest.runtime = {
-      type: "nextjs",
-      kind: "machine",
-      machine_size: "shared-cpu-1x",
-      server_actions: true
-    };
   }
-  if (opts.repositoryUrl) {
-    manifest.repository = { type: "git", url: opts.repositoryUrl };
+  return set;
+}
+function computeDestructiveDelta(local, remote) {
+  const tablesRemoved = [];
+  const fieldsRemoved = [];
+  const localTables = tablesBySlug(local);
+  const remoteTables = tablesBySlug(remote);
+  for (const [slug, remoteTable] of remoteTables) {
+    const localTable = localTables.get(slug);
+    if (!localTable) {
+      tablesRemoved.push(slug);
+      continue;
+    }
+    const localFields = fieldSlugs(localTable);
+    for (const field of fieldSlugs(remoteTable)) {
+      if (!localFields.has(field)) fieldsRemoved.push(`${slug}.${field}`);
+    }
   }
-  return JSON.stringify(manifest, null, 2) + "\n";
+  return { tablesRemoved, fieldsRemoved };
 }
-function packageJson(opts) {
-  return JSON.stringify(
-    {
-      name: opts.slug,
-      version: "0.0.1",
-      private: true,
-      type: "module",
-      scripts: {
-        dev: "dashwise module dev",
-        "dev:next": "next dev",
-        "dashwise:generate": "dashwise module generate",
-        build: "next build",
-        start: "next start"
-      },
-      dependencies: {
-        "@dashai/sdk": "^2.0.0",
-        next: "^15.0.0",
-        react: "^19.0.0",
-        "react-dom": "^19.0.0"
-      },
-      devDependencies: {
-        "@types/node": "^22.0.0",
-        "@types/react": "^19.0.0",
-        "@types/react-dom": "^19.0.0",
-        typescript: "^5.5.0"
+var PRESERVED_BLOCKS_NOTICE;
+var init_manifest_merge = __esm({
+  "src/lib/manifest-merge.ts"() {
+    PRESERVED_BLOCKS_NOTICE = "[sync] preserved local-only manifest blocks (rbac/indexes) \u2014 run `dashwise schema push` to apply them to the dev install";
+  }
+});
+function startManifestPollLoop(opts) {
+  const {
+    manifestPath: manifestPath2,
+    requestOptions,
+    intervalMs,
+    onUpdate,
+    onError
+  } = opts;
+  let lastSeenRemoteJson = null;
+  let timer = null;
+  let stopped = false;
+  let preservedNoticeShown = false;
+  const tick = async () => {
+    if (stopped) return;
+    try {
+      const { manifest } = await getInstallationSchema(requestOptions);
+      const remoteJson = JSON.stringify(manifest, null, 2) + "\n";
+      const currentLocal = existsSync(manifestPath2) ? readFileSync(manifestPath2, "utf-8") : "";
+      if (remoteJson === currentLocal) {
+        lastSeenRemoteJson = remoteJson;
+      } else if (remoteJson === lastSeenRemoteJson) {
+      } else {
+        const localParsed = (() => {
+          try {
+            return currentLocal ? JSON.parse(currentLocal) : null;
+          } catch {
+            return null;
+          }
+        })();
+        const { merged, preserved } = mergeRemoteManifest(localParsed, manifest);
+        const mergedJson = JSON.stringify(merged, null, 2) + "\n";
+        lastSeenRemoteJson = remoteJson;
+        if (mergedJson !== currentLocal) {
+          writeFileSync(manifestPath2, mergedJson, "utf-8");
+          if (onUpdate) {
+            const delta = Buffer.byteLength(mergedJson, "utf8") - Buffer.byteLength(currentLocal, "utf8");
+            const deltaStr = delta === 0 ? "0 bytes" : `${delta > 0 ? "+" : ""}${delta} bytes`;
+            onUpdate(
+              `Backend manifest changed \u2014 synced to module.json (${deltaStr}).`
+            );
+            if (preserved.length > 0 && !preservedNoticeShown) {
+              preservedNoticeShown = true;
+              onUpdate(PRESERVED_BLOCKS_NOTICE);
+            }
+          }
+        }
+      }
+    } catch (err) {
+      if (onError) {
+        const message = err instanceof ApiError ? `${err.code} (HTTP ${err.status}): ${err.message}` : err.message;
+        onError(new Error(message));
+      }
+    } finally {
+      if (!stopped) {
+        timer = setTimeout(() => void tick(), intervalMs);
+      }
+    }
+  };
+  timer = setTimeout(() => void tick(), intervalMs);
+  return {
+    stop: () => {
+      if (stopped) return;
+      stopped = true;
+      if (timer) {
+        clearTimeout(timer);
+        timer = null;
       }
     },
-    null,
-    2
-  ) + "\n";
-}
-function tsconfigJson() {
-  return JSON.stringify(
-    {
-      compilerOptions: {
-        target: "ES2022",
-        lib: ["dom", "dom.iterable", "ES2022"],
-        module: "ESNext",
-        moduleResolution: "Bundler",
-        jsx: "preserve",
-        strict: true,
-        skipLibCheck: true,
-        resolveJsonModule: true,
-        esModuleInterop: true,
-        isolatedModules: true,
-        allowJs: false,
-        noEmit: true,
-        incremental: true,
-        plugins: [{ name: "next" }],
-        paths: { "@/*": ["./*"] }
-      },
-      include: ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-      exclude: ["node_modules"]
-    },
-    null,
-    2
-  ) + "\n";
-}
-function nextConfig() {
-  return `/** @type {import("next").NextConfig} */
-//
-// Phase 2 two-var contract: the deploy env supplies exactly
-// DASHWISE_API_URL + DASHWISE_API_KEY. The browser needs the API URL
-// too (the SDK's <AuthProvider> calls /api/auth/sessions/me on it), so
-// we DERIVE NEXT_PUBLIC_DASHWISE_API_URL here from DASHWISE_API_URL at
-// build/start time \u2014 you never set the NEXT_PUBLIC_ var yourself. If
-// you already have one set (e.g. a custom setup), it wins.
-const apiUrl = process.env.DASHWISE_API_URL;
-
-const nextConfig = {
-  // Required for the platform-hosted (per-install Lambda) runtime: the
-  // injected wrapper probes [.next/standalone/server.js, server.js] and
-  // exit(1)s the cold start if neither exists. Without this the built
-  // Lambda FATALs. Harmless for local \`next dev\` / \`next start\`.
-  output: 'standalone',
-  typescript: { ignoreBuildErrors: true },
-  eslint: { ignoreDuringBuilds: true },
-  env: {
-    NEXT_PUBLIC_DASHWISE_API_URL:
-      process.env.NEXT_PUBLIC_DASHWISE_API_URL ?? apiUrl,
-  },
-};
-export default nextConfig;
-`;
+    isRunning: () => !stopped
+  };
 }
-function nextEnvDts() {
-  return `/// <reference types="next" />
-/// <reference types="next/image-types/global" />
+var init_manifest_poll = __esm({
+  "src/lib/manifest-poll.ts"() {
+    init_api_client();
+    init_manifest_merge();
+  }
+});
+async function devCommand(options) {
+  if (options.sdkOnly && options.nextOnly) {
+    fail(
+      `Cannot pass both ${code("--sdk-only")} and ${code("--next-only")} \u2014 they're mutually exclusive.`
+    );
+    return 1;
+  }
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const manifestPath2 = `${projectRoot}/module.json`;
+  if (!existsSync(manifestPath2)) {
+    fail(`No ${code("module.json")} found in ${code(projectRoot)}.`);
+    info(`Run ${code("dashwise module init <slug>")} to scaffold a new module first.`);
+    return 1;
+  }
+  const manifestSlug = (() => {
+    try {
+      return readManifest(projectRoot)?.module?.slug;
+    } catch {
+      return void 0;
+    }
+  })();
+  const savedConfig = (() => {
+    try {
+      return readConfig();
+    } catch {
+      return null;
+    }
+  })();
+  const apiToken = process.env.DASHWISE_API_TOKEN ?? savedConfig?.token;
+  if (!apiToken) {
+    fail(`Not authenticated. Run ${code("dashwise login")} first.`);
+    info(
+      "The unified dev loop reads your CLI token from ~/.config/dashwise/auth.json and injects it into both child processes so the SDK can authenticate without you editing .env.local."
+    );
+    return 1;
+  }
+  const apiUrl = options.apiUrl ?? process.env.DASHWISE_API_URL ?? savedConfig?.apiUrl ?? "http://localhost:3000";
+  let port;
+  try {
+    port = await resolveDevPort(options.port);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const explicitInstallationId = options.installationId ?? process.env.DASHWISE_INSTALLATION_ID;
+  const reuseDevSessionId = process.env.DASHWISE_DEV_SESSION_ID;
+  let moduleEntry = manifestSlug !== void 0 ? readModuleEntry(manifestSlug) : null;
+  const healed = manifestSlug !== void 0 ? await resolveModuleApiKey(manifestSlug, moduleEntry, apiUrl, apiToken) : null;
+  if (healed) moduleEntry = healed;
+  const apiKeyEnv = process.env.DASHWISE_API_KEY ?? moduleEntry?.apiKey;
+  let installationIdEnv;
+  let revokeDevSession;
+  let devHandoffEnv = {};
+  if (explicitInstallationId && explicitInstallationId !== "local") {
+    installationIdEnv = explicitInstallationId;
+  } else if (reuseDevSessionId) ; else {
+    const effectiveWorkspace = options.workspace ?? moduleEntry?.workspaceId?.toString();
+    let workspaceContext;
+    try {
+      workspaceContext = await resolveTargetWorkspace(
+        apiUrl,
+        apiToken,
+        effectiveWorkspace
+      );
+    } catch (err) {
+      fail(err.message);
+      return 1;
+    }
+    const callbackOrigins = computeCallbackOrigins(port, options.callbackOrigin ?? []);
+    try {
+      const session = await registerDevSession(apiUrl, apiToken, {
+        target_workspace_id: workspaceContext.id,
+        callback_origins: callbackOrigins
+      });
+      revokeDevSession = () => revokeDevSessionBestEffort(apiUrl, apiToken, session.id);
+      devHandoffEnv = devSessionHandoffEnv(session);
+      info(`  ${dim("dev session")} ${session.id}`);
+      info(`  ${dim("workspace")}   ${workspaceContext.name} (id=${workspaceContext.id}, slug=${workspaceContext.slug})`);
+      info(`  ${dim("callbacks")}   ${callbackOrigins.join(", ")}`);
+      info(`  ${dim("expires")}     ${session.expires_at}`);
+      info(
+        `  ${dim("sign-in")}     ${Object.keys(devHandoffEnv).length > 0 ? "zero-click (server-side dev handoff armed)" : "browser SSO (backend issued no handoff secret \u2014 pre-2026-07-15 backend)"}`
+      );
+    } catch (err) {
+      if (err instanceof ApiError) {
+        fail(`Failed to register dev session: ${err.code} \u2014 ${err.message}`);
+      } else {
+        fail(`Failed to register dev session: ${err.message}`);
+      }
+      return 1;
+    }
+  }
+  const childEnv = {
+    ...process.env,
+    DASHWISE_API_URL: apiUrl,
+    NEXT_PUBLIC_DASHWISE_API_URL: apiUrl,
+    ...apiKeyEnv !== void 0 ? { DASHWISE_API_KEY: apiKeyEnv } : {},
+    ...devHandoffEnv
+  };
+  info(`Dev loop starting \u2014 Ctrl-C to stop.`);
+  info(`  ${dim("api")}         ${apiUrl}`);
+  if (installationIdEnv !== void 0) {
+    info(`  ${dim("installation")} ${installationIdEnv} (prod-mode SSO)`);
+  } else {
+    info(`  ${dim("mode")}        dev (dev SSO session registered)`);
+  }
+  info(`  ${dim("cli token")}   ${maskedToken(apiToken)} ${dim(`(from ${apiToken === savedConfig?.token ? "~/.config/dashwise/auth.json" : "$DASHWISE_API_TOKEN"})`)}`);
+  if (apiKeyEnv !== void 0) {
+    const source = process.env.DASHWISE_API_KEY === apiKeyEnv ? "$DASHWISE_API_KEY" : `~/.config/dashwise/auth.json#modules[${manifestSlug}]`;
+    const installId = moduleEntry?.installationId;
+    info(
+      `  ${dim("api key")}     ${maskedToken(apiKeyEnv)} ${dim(`(from ${source}${installId ? `, install id=${installId}` : ""})`)}`
+    );
+  } else if (manifestSlug !== void 0 && installationIdEnv === void 0) {
+    fail(
+      `No ${code("dwk_")} API key for module ${code(manifestSlug)} \u2014 the module will run with NO token.`
+    );
+    info(
+      `  Data-plane calls (db, qb) AND sign-in will fail until you provision a dev install:
+    ${code(`dashwise init ${manifestSlug} --workspace <your-workspace-slug>`)}
+  (Ensure you're logged into the right backend: ${code(`dashwise login --api-url ${apiUrl}`)}.)`
+    );
+  }
+  info("");
+  if (moduleEntry !== null && manifestSlug !== void 0) {
+    await reportConnectStatus({
+      installationId: moduleEntry.installationId,
+      moduleSlug: manifestSlug,
+      requestOptions: { baseUrl: apiUrl, auth: { token: apiToken } }
+    });
+  }
+  const children = [];
+  if (!options.nextOnly) {
+    const sdkChild = spawnSdkWatcher(projectRoot, childEnv);
+    children.push({ name: "sdk", child: sdkChild, prefix: PREFIX_SDK });
+  }
+  if (!options.sdkOnly) {
+    const nextChild = spawnNextDev(projectRoot, childEnv, port);
+    children.push({ name: "next", child: nextChild, prefix: PREFIX_NEXT });
+  }
+  for (const { child, prefix } of children) {
+    pipeWithPrefix(child.stdout, process.stdout, prefix);
+    pipeWithPrefix(child.stderr, process.stderr, prefix);
+  }
+  let manifestPoll = null;
+  const pollEntry = moduleEntry;
+  const enablePoll = !options.noRemotePoll && pollEntry !== null && apiKeyEnv !== void 0 && manifestSlug !== void 0;
+  if (enablePoll && pollEntry !== null) {
+    const intervalSec = Math.max(
+      MIN_REMOTE_POLL_INTERVAL_SEC,
+      options.remotePollIntervalSec ?? DEFAULT_REMOTE_POLL_INTERVAL_SEC
+    );
+    manifestPoll = startManifestPollLoop({
+      manifestPath: manifestPath2,
+      requestOptions: {
+        baseUrl: apiUrl,
+        // The `dwk_` key resolves the install server-side.
+        auth: { token: apiKeyEnv }
+      },
+      intervalMs: intervalSec * 1e3,
+      onUpdate: (msg) => {
+        process.stdout.write(`${PREFIX_POLL}${msg}
+`);
+      },
+      onError: (err) => {
+        process.stderr.write(`${PREFIX_POLL}${err.message}
+`);
+      }
+    });
+    info(
+      `  ${dim("poll")}        backend manifest every ${intervalSec}s ${dim("(--no-remote-poll to disable)")}`
+    );
+    info("");
+  }
+  let shuttingDown = false;
+  const forwardSignal = (sig) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    if (manifestPoll) {
+      manifestPoll.stop();
+      manifestPoll = null;
+    }
+    info(`
+Received ${sig}, stopping children\u2026`);
+    for (const { child } of children) {
+      if (child.exitCode === null && child.signalCode === null) {
+        child.kill(sig);
+      }
+    }
+    if (revokeDevSession) {
+      revokeDevSession().catch(() => {
+      });
+    }
+  };
+  process.on("SIGINT", () => forwardSignal("SIGINT"));
+  process.on("SIGTERM", () => forwardSignal("SIGTERM"));
+  const results = await Promise.all(
+    children.map(
+      ({ name, child }) => new Promise(
+        (resolveExit) => {
+          child.on("exit", (exitCode2, signal) => {
+            const killed = signal !== null;
+            const finalCode = exitCode2 ?? (killed ? 0 : 1);
+            resolveExit({ name, code: finalCode, killed });
+          });
+        }
+      )
+    )
+  );
+  const crashed = results.find((r) => !r.killed && r.code !== 0);
+  if (crashed && !shuttingDown) {
+    warn(`[${crashed.name}] exited with code ${crashed.code} \u2014 stopping others.`);
+    for (const { child } of children) {
+      if (child.exitCode === null && child.signalCode === null) {
+        child.kill("SIGTERM");
+      }
+    }
+  }
+  if (manifestPoll) {
+    manifestPoll.stop();
+    manifestPoll = null;
+  }
+  const exitCode = Math.max(0, ...results.map((r) => r.code));
+  if (exitCode === 0) {
+    success("Dev loop stopped cleanly.");
+  }
+  return exitCode;
+}
+function spawnSdkWatcher(projectRoot, env) {
+  const child = spawn(
+    process.execPath,
+    [process.argv[1], "module", "dev", "--dir", projectRoot],
+    {
+      cwd: projectRoot,
+      env,
+      stdio: ["ignore", "pipe", "pipe"]
+    }
+  );
+  return child;
+}
+function spawnNextDev(projectRoot, env, port) {
+  const portArgs = port !== void 0 ? ["--", "--port", String(port)] : [];
+  const hasDevNextScript = hasNpmScript(projectRoot, "dev:next");
+  const [cmd, args] = hasDevNextScript ? ["npm", ["run", "dev:next", ...portArgs]] : ["npx", ["next", "dev", ...port !== void 0 ? ["--port", String(port)] : []]];
+  const child = spawn(cmd, args, {
+    cwd: projectRoot,
+    env,
+    stdio: ["ignore", "pipe", "pipe"],
+    // Windows requires `shell: true` for `npm` / `npx` because they're
+    // `.cmd` shims, not real binaries.
+    shell: process.platform === "win32"
+  });
+  return child;
+}
+function hasNpmScript(projectRoot, scriptName) {
+  try {
+    const pkgPath = `${projectRoot}/package.json`;
+    if (!existsSync(pkgPath)) return false;
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    return typeof pkg.scripts?.[scriptName] === "string";
+  } catch {
+    return false;
+  }
+}
+function pipeWithPrefix(src, dst, prefix) {
+  if (!src) return;
+  let leftover = "";
+  src.on("data", (chunk) => {
+    const text4 = typeof chunk === "string" ? chunk : chunk.toString("utf-8");
+    const combined = leftover + text4;
+    const lines = combined.split("\n");
+    leftover = lines.pop() ?? "";
+    for (const line of lines) {
+      dst.write(`${prefix}${line}
+`);
+    }
+  });
+  src.on("end", () => {
+    if (leftover.length > 0) {
+      dst.write(`${prefix}${leftover}
+`);
+    }
+  });
+}
+function maskedToken(token) {
+  if (token.length <= 12) return "****";
+  const prefix = token.slice(0, 4);
+  const tail = token.slice(-4);
+  return `${prefix}\u2026${tail}`;
+}
+async function resolveModuleApiKey(slug, entry, apiUrl, cliBearer) {
+  if (process.env.DASHWISE_API_KEY) return null;
+  if (!entry) return null;
+  if (entry.apiKey) return null;
+  if (!entry.installationId) return null;
+  info(
+    `No usable ${code("dwk_")} API key cached for ${code(slug)} \u2014 minting a fresh one against dev install ${entry.installationId} (a stale CLI can cache an empty key)\u2026`
+  );
+  let minted;
+  try {
+    minted = await createApiKey(
+      entry.installationId,
+      { name: "local-dev" },
+      { baseUrl: apiUrl, auth: { token: cliBearer } }
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.code === "INSTALLATION_NOT_FOUND") {
+      warn(
+        `Could not upgrade credentials for ${code(slug)}: its dev install no longer exists. Run ${code(`dashwise init ${slug}`)} to re-provision (a clean re-register; files are preserved).`
+      );
+      return null;
+    }
+    const reason = err instanceof ApiError ? `${err.code}: ${err.message}` : err.message;
+    warn(
+      `Could not upgrade credentials for ${code(slug)} (${reason}). Data-plane calls may fail; run ${code(`dashwise init ${slug}`)} to refresh (files are preserved).`
+    );
+    return null;
+  }
+  const upgraded = {
+    apiKey: minted.raw_key,
+    apiKeyId: minted.api_key.id,
+    installationId: entry.installationId,
+    expiresAt: minted.api_key.expires_at ?? entry.expiresAt
+  };
+  try {
+    upsertModuleEntry(slug, upgraded);
+  } catch (err) {
+    warn(
+      `Minted a new API key for ${code(slug)} but failed to cache it: ${err.message}
+  API key (save manually): ${minted.raw_key}`
+    );
+  }
+  success(`Upgraded ${code(slug)} to a dwk_ API key (id=${minted.api_key.id}).`);
+  return upgraded;
+}
+function devSessionHandoffEnv(session) {
+  const secret = session.handoff_secret;
+  if (typeof secret !== "string" || secret.length === 0) return {};
+  return {
+    DASHWISE_DEV_SESSION_ID: session.id,
+    DASHWISE_DEV_HANDOFF_SECRET: secret
+  };
+}
+function computeCallbackOrigins(port, extra) {
+  const def = `http://localhost:${port}`;
+  return Array.from(/* @__PURE__ */ new Set([def, ...extra]));
+}
+async function resolveDevPort(requested) {
+  if (requested !== void 0) {
+    if (await isPortFree(requested)) return requested;
+    const suggestion = await findFirstFreePort(requested + 1, PORT_PROBE_LIMIT);
+    const suggestionHint = suggestion !== null ? `Try \`dashwise dev --port ${suggestion}\`.` : `No free port found between ${requested + 1} and ${requested + PORT_PROBE_LIMIT} either \u2014 check what's listening with \`lsof -i :${requested}\`.`;
+    throw new Error(
+      `Port ${requested} is already in use. ${suggestionHint}`
+    );
+  }
+  const found = await findFirstFreePort(DEFAULT_NEXT_PORT, PORT_PROBE_LIMIT);
+  if (found === null) {
+    throw new Error(
+      `No free port found between ${DEFAULT_NEXT_PORT} and ${DEFAULT_NEXT_PORT + PORT_PROBE_LIMIT - 1}. Free a port (e.g. \`lsof -i :${DEFAULT_NEXT_PORT}\`) or pass \`--port <N>\` explicitly.`
+    );
+  }
+  return found;
+}
+async function isPortFree(port) {
+  const { createServer } = await import('net');
+  return new Promise((resolve13) => {
+    const server = createServer();
+    server.once("error", () => {
+      resolve13(false);
+    });
+    server.once("listening", () => {
+      server.close(() => resolve13(true));
+    });
+    server.listen(port, "0.0.0.0");
+  });
+}
+async function findFirstFreePort(start, limit) {
+  for (let i = 0; i < limit; i++) {
+    const port = start + i;
+    if (await isPortFree(port)) return port;
+  }
+  return null;
+}
+async function resolveTargetWorkspace(apiUrl, apiToken, flag) {
+  const workspaces = await apiRequest(
+    "GET",
+    "/api/workspaces",
+    void 0,
+    { baseUrl: apiUrl, auth: { token: apiToken } }
+  );
+  if (workspaces.length === 0) {
+    throw new Error(
+      "No workspaces found for your account. Create a workspace at the DashWise dashboard first."
+    );
+  }
+  if (flag === void 0) {
+    if (workspaces.length === 1) {
+      return workspaces[0];
+    }
+    const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id}, name="${w.name}")`).join("\n");
+    throw new Error(
+      `You have ${workspaces.length} workspaces. Re-run with --workspace <slug-or-id> to pick one:
+${list}`
+    );
+  }
+  const asNumber = Number.parseInt(flag, 10);
+  const isNumeric = !Number.isNaN(asNumber) && String(asNumber) === flag;
+  const match = isNumeric ? workspaces.find((w) => w.id === asNumber) : workspaces.find((w) => w.slug === flag);
+  if (!match) {
+    const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id})`).join("\n");
+    throw new Error(
+      `No workspace matching --workspace=${flag}. Available:
+${list}`
+    );
+  }
+  return match;
+}
+async function registerDevSession(apiUrl, apiToken, body) {
+  return apiRequest(
+    "POST",
+    "/api/auth/dev/sessions",
+    body,
+    { baseUrl: apiUrl, auth: { token: apiToken } }
+  );
+}
+async function revokeDevSessionBestEffort(apiUrl, apiToken, id) {
+  await apiRequest(
+    "DELETE",
+    `/api/auth/dev/sessions/${encodeURIComponent(id)}`,
+    void 0,
+    { baseUrl: apiUrl, auth: { token: apiToken } }
+  );
+}
+var DEFAULT_NEXT_PORT, PREFIX_SDK, PREFIX_NEXT, PREFIX_POLL, DEFAULT_REMOTE_POLL_INTERVAL_SEC, MIN_REMOTE_POLL_INTERVAL_SEC, PORT_PROBE_LIMIT;
+var init_dev = __esm({
+  "src/commands/dev.ts"() {
+    init_api_client();
+    init_connect_status();
+    init_config();
+    init_manifest_io();
+    init_manifest_poll();
+    init_output();
+    DEFAULT_NEXT_PORT = 3e3;
+    PREFIX_SDK = `\x1B[36m[sdk]\x1B[0m `;
+    PREFIX_NEXT = `\x1B[35m[next]\x1B[0m `;
+    PREFIX_POLL = `\x1B[33m[poll]\x1B[0m `;
+    DEFAULT_REMOTE_POLL_INTERVAL_SEC = 5;
+    MIN_REMOTE_POLL_INTERVAL_SEC = 1;
+    PORT_PROBE_LIMIT = 10;
+  }
+});
+
+// src/lib/scaffold.ts
+function isDeployTarget(value) {
+  return DEPLOY_TARGETS.includes(value);
+}
+function manifestJson(opts) {
+  const kind = opts.kind ?? "hand_authored";
+  const manifest = {
+    schema_version: 2,
+    module: {
+      slug: opts.slug,
+      name: opts.name,
+      version: "0.0.1"
+    },
+    module_kind: kind,
+    owns: {
+      tables: [
+        {
+          // NOTE: no `name` key here — the backend manifest validator
+          // (POST /api/installations/dev) is strict and rejects unrecognized
+          // table keys, and it derives the display name from the slug. A
+          // `name` here would fail provisioning's table materialization (#4).
+          slug: "items",
+          fields: [
+            { slug: "title", type: "text" },
+            { slug: "done", type: "boolean" }
+          ]
+        }
+      ]
+    }
+  };
+  if (kind === "custom") {
+    manifest.runtime = {
+      type: "nextjs",
+      kind: "machine",
+      machine_size: "shared-cpu-1x",
+      server_actions: true
+    };
+  }
+  if (opts.repositoryUrl) {
+    manifest.repository = { type: "git", url: opts.repositoryUrl };
+  }
+  return JSON.stringify(manifest, null, 2) + "\n";
+}
+function packageJson(opts) {
+  return JSON.stringify(
+    {
+      name: opts.slug,
+      version: "0.0.1",
+      private: true,
+      type: "module",
+      scripts: {
+        dev: "dashwise module dev",
+        "dev:next": "next dev",
+        "dashwise:generate": "dashwise module generate",
+        build: "next build",
+        start: "next start"
+      },
+      dependencies: {
+        "@dashai/sdk": "^2.3.0",
+        next: "^15.0.0",
+        react: "^19.0.0",
+        "react-dom": "^19.0.0"
+      },
+      devDependencies: {
+        "@types/node": "^22.0.0",
+        "@types/react": "^19.0.0",
+        "@types/react-dom": "^19.0.0",
+        typescript: "^5.5.0"
+      }
+    },
+    null,
+    2
+  ) + "\n";
+}
+function tsconfigJson() {
+  return JSON.stringify(
+    {
+      compilerOptions: {
+        target: "ES2022",
+        lib: ["dom", "dom.iterable", "ES2022"],
+        module: "ESNext",
+        moduleResolution: "Bundler",
+        jsx: "preserve",
+        strict: true,
+        skipLibCheck: true,
+        resolveJsonModule: true,
+        esModuleInterop: true,
+        isolatedModules: true,
+        allowJs: false,
+        noEmit: true,
+        incremental: true,
+        plugins: [{ name: "next" }],
+        paths: { "@/*": ["./*"] }
+      },
+      include: ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+      exclude: ["node_modules"]
+    },
+    null,
+    2
+  ) + "\n";
+}
+function nextConfig() {
+  return `/** @type {import("next").NextConfig} */
+//
+// Phase 2 two-var contract: the deploy env supplies exactly
+// DASHWISE_API_URL + DASHWISE_API_KEY. The browser needs the API URL
+// too (the SDK's <AuthProvider> calls /api/auth/sessions/me on it), so
+// we DERIVE NEXT_PUBLIC_DASHWISE_API_URL here from DASHWISE_API_URL at
+// build/start time \u2014 you never set the NEXT_PUBLIC_ var yourself. If
+// you already have one set (e.g. a custom setup), it wins.
+const apiUrl = process.env.DASHWISE_API_URL;
+
+const nextConfig = {
+  // Required for the platform-hosted (per-install Lambda) runtime: the
+  // injected wrapper probes [.next/standalone/server.js, server.js] and
+  // exit(1)s the cold start if neither exists. Without this the built
+  // Lambda FATALs. Harmless for local \`next dev\` / \`next start\`.
+  output: 'standalone',
+  typescript: { ignoreBuildErrors: true },
+  eslint: { ignoreDuringBuilds: true },
+  env: {
+    NEXT_PUBLIC_DASHWISE_API_URL:
+      process.env.NEXT_PUBLIC_DASHWISE_API_URL ?? apiUrl,
+  },
+};
+export default nextConfig;
+`;
+}
+function nextEnvDts() {
+  return `/// <reference types="next" />
+/// <reference types="next/image-types/global" />
 `;
 }
 function gitignore() {
@@ -1271,8 +1967,20 @@ function appApiAuthSignInTs() {
 // 302 back to callback_url?code=<one-time>. The /api/auth/callback route
 // exchanges that code for a session cookie.
 //
-// No dev-vs-prod branching, no installation id, no dev-session id \u2014 the
-// single dwk_ key drives both local dev and production.
+// ZERO-CLICK LOCAL DEV (CLI \u2265 0.16.0 + backend \u2265 2026-07-15): when
+// \`dashwise dev\` injected BOTH DASHWISE_DEV_SESSION_ID and
+// DASHWISE_DEV_HANDOFF_SECRET, this route first presents the handoff
+// secret to the backend SERVER-SIDE (POST /api/auth/dev/sso/authorize)
+// and 302s the browser straight to the returned callback URL \u2014 the user
+// NEVER sees a login page and no platform browser session is needed. On
+// ANY failure it logs one server-side warn line and falls back to the
+// browser flow above unchanged (that path still matters for signing in
+// as a DIFFERENT workspace member and for stale dev sessions). The
+// secret is server-env-only: never in a URL, response body, or the
+// client bundle.
+//
+// No dev-vs-prod branching for the browser flow \u2014 the single dwk_ key
+// drives both local dev and production.
 import { NextResponse } from 'next/server';
 import { getPublicOrigin } from '@/lib/request-origin';
 
@@ -1292,6 +2000,30 @@ export async function GET(request: Request) {
       status: 500,
     });
   }
+
+  // \`getPublicOrigin\` reads \`X-Forwarded-Host\` when present so URLs
+  // point at the public domain, not the internal Node origin behind
+  // reverse proxies (Railway/Vercel/Fly).
+  const moduleOrigin = getPublicOrigin(request);
+
+  // \u2500\u2500 Zero-click dev handoff (server-side; runs BEFORE the dwk_-key
+  // guard \u2014 the authorize endpoint authenticates with the handoff
+  // secret, not the key). Both env vars must be present: \`dashwise dev\`
+  // injects them together, and only when the backend issued a secret.
+  const devSessionId = process.env.DASHWISE_DEV_SESSION_ID;
+  const devHandoffSecret = process.env.DASHWISE_DEV_HANDOFF_SECRET;
+  if (devSessionId && devHandoffSecret) {
+    const callbackUrl = await tryDevHandoff(
+      apiBaseUrl,
+      devSessionId,
+      devHandoffSecret,
+      returnTo,
+      moduleOrigin,
+    );
+    if (callbackUrl) return NextResponse.redirect(callbackUrl);
+    // null \u2192 warned server-side already; fall through to the browser flow.
+  }
+
   if (!apiKey) {
     return new NextResponse(
       'DASHWISE_API_KEY must be set in the environment. Run \`dashwise dev\` ' +
@@ -1301,12 +2033,9 @@ export async function GET(request: Request) {
   }
 
   // Absolute callback URL so the backend knows which host to bounce back
-  // to. \`getPublicOrigin\` reads \`X-Forwarded-Host\` when present so the
-  // URL points at the public domain, not the internal Node origin behind
-  // reverse proxies (Railway/Vercel/Fly). The callback path is fixed at
-  // /api/auth/callback by SDK convention; we tuck \`return_to\` onto it so
-  // the callback route can resume the user's original destination.
-  const moduleOrigin = getPublicOrigin(request);
+  // to. The callback path is fixed at /api/auth/callback by SDK
+  // convention; we tuck \`return_to\` onto it so the callback route can
+  // resume the user's original destination.
   const callback = new URL('/api/auth/callback', moduleOrigin);
   callback.searchParams.set('return_to', returnTo);
 
@@ -1359,6 +2088,74 @@ export async function GET(request: Request) {
   }
   return NextResponse.redirect(body.redirect_url);
 }
+
+/**
+ * Zero-click dev sign-in (CLI \u2265 0.16.0 + backend \u2265 2026-07-15).
+ *
+ * SERVER-SIDE ONLY: presents the dev session's one-time handoff secret
+ * to \`POST /api/auth/dev/sso/authorize\`. On 200 the backend mints a
+ * single-use 60s exchange code for the DEV'S OWN user and returns
+ * \`{ callback_url }\` (= \`<origin>/api/auth/callback?code=\u2026&return_to=\u2026\`)
+ * \u2014 the caller 302s the browser straight there; the normal callback
+ * route exchanges the code exactly like the browser flow.
+ *
+ * Returns the callback URL, or \`null\` on ANY failure (404
+ * DEV_SESSION_NOT_FOUND, 401 DEV_HANDOFF_INVALID, 400 INVALID_RETURN_TO,
+ * 403 WORKSPACE_NOT_MEMBER, network) after logging a one-line warn \u2014
+ * the caller then falls back to the browser SSO flow, which remains the
+ * path for signing in as a DIFFERENT workspace member and for stale dev
+ * sessions. The secret must never appear in a URL or response body.
+ */
+async function tryDevHandoff(
+  apiBaseUrl: string,
+  devSessionId: string,
+  devHandoffSecret: string,
+  returnTo: string,
+  moduleOrigin: string,
+): Promise<string | null> {
+  // Same root-relative-only rule as the callback's safeReturnTo \u2014 an
+  // absolute/protocol-relative return_to must not steer the handoff.
+  const path =
+    returnTo.startsWith('/') && !returnTo.startsWith('//') ? returnTo : '/';
+  // \`return_to\` is the user's ABSOLUTE destination on this module's own
+  // (loopback) origin; the backend validates origin allowlist + loopback
+  // and builds the callback URL from it.
+  const destination = new URL(path, moduleOrigin);
+  let res: Response;
+  try {
+    res = await fetch(\`\${apiBaseUrl}/api/auth/dev/sso/authorize\`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+      body: JSON.stringify({
+        dev_session_id: devSessionId,
+        handoff_secret: devHandoffSecret,
+        return_to: destination.toString(),
+      }),
+    });
+  } catch (err) {
+    console.warn(
+      \`[auth] dev handoff failed (\${(err as Error).message}) \u2014 falling back to browser SSO\`,
+    );
+    return null;
+  }
+  if (!res.ok) {
+    const body = (await res.json().catch(() => null)) as { code?: string } | null;
+    console.warn(
+      \`[auth] dev handoff rejected (\${body?.code ?? \`HTTP \${res.status}\`}) \u2014 falling back to browser SSO\`,
+    );
+    return null;
+  }
+  const body = (await res.json().catch(() => null)) as
+    | { callback_url?: string }
+    | null;
+  if (!body?.callback_url) {
+    console.warn(
+      '[auth] dev handoff response missing callback_url \u2014 falling back to browser SSO',
+    );
+    return null;
+  }
+  return body.callback_url;
+}
 `;
 }
 function appApiAuthCallbackTs() {
@@ -1367,7 +2164,14 @@ function appApiAuthCallbackTs() {
 // SSO flow failed. Two paths:
 //
 //   1. Success path: exchange \`?code\` for a session cookie via
-//      \`exchangeCode()\`, then redirect to \`return_to\`.
+//      \`exchangeCode()\`, then redirect to \`return_to\`. SDK \u2265 2.3.0:
+//      the result's \`cookieWritten\` flag surfaces a cookie store that
+//      rejected the write \u2014 without it the exchange "succeeds", the
+//      browser has no session, and the user silently bounces back to
+//      sign-in. We render /sign-in-error?code=cookie_write_failed
+//      instead. \`requestUrl\` lets the SDK fall back to the actual
+//      request protocol for the cookie's Secure attribute when no
+//      x-forwarded-proto header is present (plain-http \`next start\`).
 //   2. Error path: SSO returned \`?error=\` \u2014 redirect to the polished
 //      sign-in-error page so the user sees a real error UI instead of
 //      a raw 4xx page. The error code maps to known SSO error codes
@@ -1404,7 +2208,17 @@ export async function GET(request: Request) {
     return NextResponse.redirect(target);
   }
   try {
-    await exchangeCode(code); // sets the dashwise.session cookie
+    // Sets the dashwise.session cookie. \`requestUrl\` = the Secure-attr
+    // protocol fallback when no x-forwarded-proto header is present.
+    const result = await exchangeCode(code, { requestUrl: request.url });
+    if (!result.cookieWritten) {
+      // The exchange succeeded but the cookie store rejected the write \u2014
+      // the browser has NO session. Surface it instead of redirecting
+      // into an unauthenticated loop (SDK \u2265 2.3.0).
+      const target = new URL('/sign-in-error', publicOrigin);
+      target.searchParams.set('code', 'cookie_write_failed');
+      return NextResponse.redirect(target);
+    }
   } catch (err) {
     const target = new URL('/sign-in-error', publicOrigin);
     target.searchParams.set('code', 'exchange_failed');
@@ -1441,7 +2255,12 @@ import { signOut } from '@dashai/sdk/auth/server';
 import { getPublicOrigin } from '@/lib/request-origin';
 
 export async function POST(request: Request) {
-  await signOut();
+  // Pass requestUrl so the cookie-CLEAR resolves its Secure attribute the
+  // SAME way the sign-in SET did (exchangeCode also gets request.url) \u2014
+  // otherwise a plain-http localhost dev server sets a non-Secure cookie
+  // but tries to clear a Secure one, which the browser ignores, leaving a
+  // stale (backend-revoked, but client-present) cookie after sign-out.
+  await signOut({ requestUrl: request.url });
   // Build the redirect against the public origin so we don't land
   // the user on \`http://localhost:<PORT>/\` when running behind a
   // reverse proxy (Railway/Vercel/Fly).
@@ -1528,7 +2347,7 @@ function packageJsonCustom(opts) {
         start: "next start"
       },
       dependencies: {
-        "@dashai/sdk": "^2.0.0",
+        "@dashai/sdk": "^2.3.0",
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0",
@@ -1689,15 +2508,40 @@ function globalsCss() {
   --chart-5: oklch(0.67 0.2 15);
 }
 
-/* Wire the chart tokens into Tailwind's color namespace so \`bg-chart-1\`,
-   \`text-chart-2\`, \`border-l-chart-3\`, \u2026 resolve. (\`@import "shadcn/tailwind.css"\`
-   already maps the core tokens like \`--primary\`; this covers the ramp.) */
+/* Wire EVERY design token into Tailwind's namespace. In Tailwind 4,
+   utilities like \`bg-primary\` / \`text-muted-foreground\` / \`rounded-lg\`
+   only exist if @theme defines the matching \`--color-*\` / \`--radius-*\`
+   variable \u2014 the \`shadcn\` npm package's tailwind.css maps NONE of them
+   (it ships only keyframes + variants), so without this block every
+   semantic-token utility silently compiles to nothing. */
 @theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --color-card: var(--card);
+  --color-card-foreground: var(--card-foreground);
+  --color-popover: var(--popover);
+  --color-popover-foreground: var(--popover-foreground);
+  --color-primary: var(--primary);
+  --color-primary-foreground: var(--primary-foreground);
+  --color-secondary: var(--secondary);
+  --color-secondary-foreground: var(--secondary-foreground);
+  --color-muted: var(--muted);
+  --color-muted-foreground: var(--muted-foreground);
+  --color-accent: var(--accent);
+  --color-accent-foreground: var(--accent-foreground);
+  --color-destructive: var(--destructive);
+  --color-border: var(--border);
+  --color-input: var(--input);
+  --color-ring: var(--ring);
   --color-chart-1: var(--chart-1);
   --color-chart-2: var(--chart-2);
   --color-chart-3: var(--chart-3);
   --color-chart-4: var(--chart-4);
   --color-chart-5: var(--chart-5);
+  --radius-sm: calc(var(--radius) - 4px);
+  --radius-md: calc(var(--radius) - 2px);
+  --radius-lg: var(--radius);
+  --radius-xl: calc(var(--radius) + 4px);
 }
 
 * {
@@ -1897,6 +2741,90 @@ export function ThemeProvider({
 }
 `;
 }
+function appErrorTsx() {
+  return `"use client";
+
+/**
+ * Root error boundary. Next.js renders this when anything below the
+ * layout throws during render or data loading.
+ *
+ * - \`error.digest\` is the server-side correlation id \u2014 surface it so a
+ *   bug report can be matched to the runtime logs.
+ * - \`reset()\` re-renders the segment; for transient failures (network
+ *   blip, expired session mid-flight) a retry often just works.
+ */
+import { Button } from "@/components/ui/button";
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from "@/components/ui/card";
+
+export default function Error({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  return (
+    <div className="flex min-h-screen items-center justify-center bg-background p-6">
+      <Card className="w-full max-w-md">
+        <CardHeader>
+          <CardTitle>Something went wrong</CardTitle>
+          <CardDescription>
+            An unexpected error occurred while rendering this page.
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          {error.digest ? (
+            <p className="text-sm text-muted-foreground">
+              Error digest:{" "}
+              <code className="rounded bg-muted px-1.5 py-0.5 font-mono text-xs">
+                {error.digest}
+              </code>
+            </p>
+          ) : null}
+          <Button onClick={() => reset()}>Try again</Button>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}
+`;
+}
+function seedMjs() {
+  return `/**
+ * seed.mjs \u2014 OPTIONAL seed/maintenance script template.
+ *
+ * Run it with the module's DashWise env injected (DASHWISE_API_URL +
+ * DASHWISE_API_KEY resolved like \`dashwise query\`: explicit env \u2192
+ * .env.local \u2192 the dwk_ key cached by your CLI login):
+ *
+ *   dashwise run -- node seed.mjs
+ *
+ * (Requires \`dashwise module generate\` to have run at least once so
+ * \`@dashai/generated\` exists \u2014 \`dashwise dev\` does this for you.)
+ *
+ * \u26A0 PUBLISH WARNING: \`dashwise module publish\` packs the ENTIRE project
+ * tree (it does NOT read .gitignore). Delete this file \u2014 or publish with
+ * \`--exclude seed.mjs\` \u2014 before publishing, so seed data/logic doesn't
+ * ship inside your module bundle.
+ */
+
+// Uncomment to use (the scaffold's example \`items\` table):
+//
+// import { db } from '@dashai/generated';
+//
+// const created = await db.items.create({ title: 'Seeded item', done: false });
+// console.log('created items row', created.id);
+//
+// const rows = await db.items.list({ limit: 10 });
+// console.log('items now:', rows.length);
+`;
+}
 function appSignInErrorPageTsx() {
   return `import Link from 'next/link';
 import { AlertTriangle, RefreshCw } from 'lucide-react';
@@ -1920,6 +2848,8 @@ const ERROR_MESSAGES: Record<string, string> = {
     'The callback URL was missing the expected exchange code. This usually means the SSO flow was interrupted.',
   exchange_failed:
     "The exchange code couldn't be redeemed for a session. The code may have expired (they're single-use and short-lived) \u2014 try signing in again.",
+  cookie_write_failed:
+    'Sign-in completed, but the session cookie could not be written, so the session would have been lost. This means exchangeCode ran outside a Route Handler / Server Action context (Next can only set cookies there) or next/headers was unavailable \u2014 verify /api/auth/callback is a standard route handler and check the module server logs.',
 };
 
 interface SignInErrorPageProps {
@@ -2417,15 +3347,23 @@ async function moduleInitCommand(slugArg, options) {
   }
   const name = options.name ?? humanizeSlug(slug);
   const dir = resolve(options.dir ?? slug);
-  if (existsSync(dir)) {
+  const manifestExists = existsSync(join(dir, "module.json"));
+  if (options.provisionOnly && !manifestExists) {
+    fail(
+      `Provision-only mode needs an existing ${code("module.json")} in ${code(dir)} \u2014 there is nothing to provision against. Run ${code(`dashwise init ${slug}`)} to scaffold first.`
+    );
+    return 1;
+  }
+  if (!options.provisionOnly && existsSync(dir)) {
     const entries = readdirSync(dir);
-    if (entries.length > 0 && !options.force) {
+    if (entries.length > 0 && !options.force && !manifestExists) {
       fail(
         `Directory ${code(dir)} is not empty. Pass ${code("--force")} to scaffold anyway (existing files will be overwritten).`
       );
       return 1;
     }
   }
+  const writeMode = options.provisionOnly ? "none" : manifestExists && !options.force ? "missing-only" : "all";
   if (options.simple && options.custom) {
     fail(
       `Cannot pass both ${code("--simple")} and ${code("--custom")} \u2014 they're mutually exclusive. ${code("--simple")} selects the legacy minimal scaffold; the default (no flag) is the full Next.js scaffold (formerly ${code("--custom")}).`
@@ -2464,7 +3402,11 @@ async function moduleInitCommand(slugArg, options) {
     // Example data-plane route (both flavors) — exercises the generated
     // SDK against the seeded `items` table. Ships for simple + custom
     // since both produce `@dashai/generated`.
-    ["app/api/items/route.ts", appApiItemsRouteTs()]
+    ["app/api/items/route.ts", appApiItemsRouteTs()],
+    // C12/D5 (Wave 2) — commented-out seed-script template. Pairs with
+    // `dashwise run -- node seed.mjs`; carries the publish-packs-
+    // everything warning so it never ships inside a bundle by accident.
+    ["seed.mjs", seedMjs()]
   ];
   if (kind === "custom") {
     files.push(
@@ -2480,6 +3422,10 @@ async function moduleInitCommand(slugArg, options) {
       ["components/ui/card.tsx", componentsUiCardTsx()],
       ["app/layout.tsx", appLayoutCustomTsx(scaffoldOpts)],
       ["app/page.tsx", appPageCustomTsx(scaffoldOpts)],
+      // C10 (Wave 2) — root error boundary: branded card, error.digest,
+      // reset() retry, semantic tokens (which resolve now that
+      // globals.css maps them in @theme).
+      ["app/error.tsx", appErrorTsx()],
       ["app/dashboard/page.tsx", appDashboardPageTsx()],
       ["app/sign-in-error/page.tsx", appSignInErrorPageTsx()],
       ["app/api/auth/sign-in/route.ts", appApiAuthSignInTs()],
@@ -2509,17 +3455,36 @@ async function moduleInitCommand(slugArg, options) {
         break;
     }
   }
-  for (const [relPath, content] of files) {
-    const absPath = join(dir, relPath);
-    const parentDir = join(absPath, "..");
-    if (!existsSync(parentDir)) {
-      mkdirSync(parentDir, { recursive: true });
+  let written = 0;
+  let skipped = 0;
+  if (writeMode !== "none") {
+    for (const [relPath, content] of files) {
+      const absPath = join(dir, relPath);
+      if (writeMode === "missing-only" && existsSync(absPath)) {
+        skipped++;
+        continue;
+      }
+      const parentDir = join(absPath, "..");
+      if (!existsSync(parentDir)) {
+        mkdirSync(parentDir, { recursive: true });
+      }
+      writeFileSync(absPath, content, "utf-8");
+      written++;
     }
-    writeFileSync(absPath, content, "utf-8");
   }
-  success(
-    `Scaffolded ${code(slug)} (${kind === "custom" ? "custom Next.js" : "simple module"}) in ${code(dir)}`
-  );
+  if (writeMode === "none") {
+    info(
+      `Existing scaffold in ${code(dir)} left untouched (provision-only) \u2014 re-provisioning the backend dev install.`
+    );
+  } else if (writeMode === "missing-only") {
+    success(
+      `Existing module project in ${code(dir)} \u2014 wrote ${written} missing file(s), preserved ${skipped} existing file(s). ${dim("(Pass --force to overwrite everything.)")}`
+    );
+  } else {
+    success(
+      `Scaffolded ${code(slug)} (${kind === "custom" ? "custom Next.js" : "simple module"}) in ${code(dir)}`
+    );
+  }
   let devInstall = null;
   const wantsProvision = options.provision !== false;
   if (wantsProvision) {
@@ -2530,12 +3495,16 @@ async function moduleInitCommand(slugArg, options) {
         return void 0;
       }
     })();
+    const manifestKind = (() => {
+      const mk = manifest?.module_kind;
+      return mk === "ai_builder" || mk === "hand_authored" || mk === "custom" ? mk : void 0;
+    })();
     devInstall = await tryProvisionDevInstall({
       slug,
       name,
       description: options.description,
       workspaceFlag: options.workspace,
-      moduleKind: kind,
+      moduleKind: manifestKind ?? kind,
       ...manifest !== void 0 ? { manifest } : {}
     });
   } else {
@@ -2550,7 +3519,8 @@ async function moduleInitCommand(slugArg, options) {
     );
     info(
       `Fix it by re-running provisioning once the cause above is resolved:
-    ${code(`dashwise init ${slug} --force --workspace <your-workspace-slug>`)}
+    ${code(`dashwise init ${slug} --workspace <your-workspace-slug>`)}
+  (Existing files are preserved \u2014 a re-run only provisions + fills in missing files.)
   Confirm success: the line ${code("\u2713 Provisioned dev install id=\u2026 API key cached")} must appear,
   and ${code("cat ~/.config/dashwise/auth.json")} must show a non-empty ${code(`modules.${slug}.apiKey`)} starting with ${code("dwk_")}.`
     );
@@ -2576,7 +3546,7 @@ ${devInstall ? `
 async function tryProvisionDevInstall(args) {
   if (!isLoggedIn()) {
     warn(
-      `Not logged in \u2014 skipping dev-install provisioning. Run ${code("dashwise login")} then ${code(`dashwise init ${args.slug} --force`)} to retry.`
+      `Not logged in \u2014 skipping dev-install provisioning. Run ${code("dashwise login")} then ${code(`dashwise init ${args.slug}`)} to retry (existing files are preserved).`
     );
     return null;
   }
@@ -2678,7 +3648,7 @@ function surfaceProvisionApiError(err, slug) {
   switch (err.code) {
     case "UNAUTHENTICATED":
       warn(
-        `Auth rejected by backend. Your CLI token may be stale \u2014 run ${code("dashwise login")} then ${code(`dashwise init ${slug} --force`)}.`
+        `Auth rejected by backend. Your CLI token may be stale \u2014 run ${code("dashwise login")} then ${code(`dashwise init ${slug}`)} (existing files are preserved).`
       );
       return;
     case "FORBIDDEN":
@@ -2686,11 +3656,30 @@ function surfaceProvisionApiError(err, slug) {
         `Not authorized to create a module in that workspace. Confirm you're a member at the DashWise dashboard.`
       );
       return;
-    case "SLUG_ALREADY_EXISTS":
+    case "DEV_INSTALL_ALREADY_EXISTS": {
+      const cached = readModuleEntry(slug);
       warn(
-        `A module with slug ${code(slug)} already exists. Pick a different slug, or destroy the existing dev install (LDI-9 coming soon) and re-run.`
+        `Module ${code(slug)} already has a live dev install${cached?.installationId ? ` (cached id=${cached.installationId})` : ""} \u2014 only ONE dev install per module can exist.
+  Run ${code("dashwise module reset-dev-install")} for a clean slate (keeps ALL local files), or ${code("dashwise module destroy-dev-install")} then re-run init.`
       );
       return;
+    }
+    case "SLUG_ALREADY_EXISTS": {
+      const cached = readModuleEntry(slug);
+      if (cached) {
+        warn(
+          `A module with slug ${code(slug)} already exists, and you have its dev install cached (id=${cached.installationId}).
+  For a clean slate run ${code("dashwise module reset-dev-install")} (keeps all local files), or ${code("dashwise module destroy-dev-install")} then re-run init.`
+        );
+      } else {
+        warn(
+          `A module with slug ${code(slug)} already exists.
+    - If it belongs to ANOTHER workspace: module slugs are globally unique \u2014 pick a NEW slug (duplicate the code if needed).
+    - If it's YOUR OWN published module: backends \u2265 2026-07-15 re-provision a dev install from this exact command (${code(`dashwise init ${slug} --workspace <ws>`)} \u2014 the dev install coexists with the production install), so this 409 means the backend predates that. Older-backend fallback (production repair): ${code("dashwise api-keys create local-dev --install <id> --full-access")} + ${code("dashwise origins add http://localhost:3000 --install <id>")} (id via ${code(`dashwise module status ${slug}`)}), then run bare ${code("next dev")} \u2014 and CLEAN UP after (revoke the key, remove the origin).`
+        );
+      }
+      return;
+    }
     case "RUNTIME_DATA_API_DISABLED":
       warn(
         `Backend has the local-dev API turned off (BUILDER_SESSION_TOKEN_SECRET unset). Contact the operator.`
@@ -2737,7 +3726,7 @@ function loadSchemaCommandContext(opts) {
   const entry = readModuleEntry(slug);
   if (!entry) {
     throw new Error(
-      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug}\` to provision one (existing files are preserved).`
     );
   }
   const token = resolveSchemaAuthToken(entry, slug);
@@ -2758,7 +3747,7 @@ function loadSchemaCommandContext(opts) {
 function resolveSchemaAuthToken(entry, slug) {
   if (entry.apiKey) return entry.apiKey;
   throw new Error(
-    `The cached credential for "${slug}" is a legacy runtime token, which the schema endpoints no longer accept. Run \`dashwise dev\` once (it mints a dwk_ API key and updates your config), or \`dashwise init ${slug} --force\` to re-provision.`
+    `The cached credential for "${slug}" is a legacy runtime token, which the schema endpoints no longer accept. Run \`dashwise dev\` once (it mints a dwk_ API key and updates your config), or \`dashwise init ${slug}\` to re-provision (existing files are preserved).`
   );
 }
 var init_schema_command_context = __esm({
@@ -2767,1187 +3756,1013 @@ var init_schema_command_context = __esm({
     init_manifest_io();
   }
 });
-
-// src/commands/module/destroy-dev-install.ts
-var destroy_dev_install_exports = {};
-__export(destroy_dev_install_exports, {
-  destroyDevInstallCommand: () => destroyDevInstallCommand
-});
-async function destroyDevInstallCommand(options) {
-  let slug = options.module;
-  if (!slug) {
-    const projectRoot = resolve(options.dir ?? process.cwd());
-    const manifest = (() => {
-      try {
-        return readManifest(projectRoot);
-      } catch {
-        return null;
-      }
-    })();
-    slug = manifest?.module?.slug;
-    if (!slug) {
-      fail(
-        `No module slug \u2014 pass ${code("--module <slug>")} or run from a directory with a valid module.json.`
-      );
-      return 1;
-    }
-  }
-  const cfg = readConfig();
-  if (!cfg) {
-    fail("Not logged in. Run `dashwise login` first.");
-    return 1;
-  }
-  const entry = readModuleEntry(slug);
-  if (!entry) {
-    warn(
-      `No cached dev install for ${code(slug)} in auth.json. Nothing to do.`
-    );
-    return 0;
-  }
-  if (!options.yes && process.stdout.isTTY) {
-    const choice = await confirm({
-      message: `Destroy dev install ${code(`${slug} (id=${entry.installationId})`)}? Tables and rows will be soft-deleted (recoverable for 30 days via dashboard trash).`
-    });
-    if (isCancel(choice) || !choice) {
-      info("Aborted.");
-      return 130;
-    }
-  }
-  let backendCleaned = false;
-  try {
-    const response = await destroyDevInstallation(entry.installationId, {
-      baseUrl: resolveApiUrl(),
-      auth: { token: cfg.token }
-    });
-    backendCleaned = true;
-    success(
-      `Destroyed dev install ${code(`${slug} (id=${response.installation_id})`)}${response.module_also_dropped ? " \u2014 module also dropped (no other installs, unpublished)." : " (module kept \u2014 other installs reference it or it has a published version)."}`
-    );
-  } catch (err) {
-    if (err instanceof ApiError && err.code === "INSTALLATION_NOT_FOUND") {
-      warn(
-        `Install ${entry.installationId} not found on the backend \u2014 already destroyed elsewhere. Cleaning up local cache.`
-      );
-      backendCleaned = true;
-    } else {
-      return surfaceDestroyError(err);
-    }
-  }
-  if (backendCleaned) {
-    try {
-      removeModuleEntry(slug);
-      info(`Removed ${code(slug)} entry from auth.json.`);
-    } catch (err) {
-      warn(
-        `Backend cleanup succeeded but failed to update auth.json: ${err.message}. Edit ${code("~/.config/dashwise/auth.json")} manually to remove the ${code(`modules["${slug}"]`)} entry.`
-      );
-    }
-  }
-  return 0;
-}
-function surfaceDestroyError(err) {
-  if (err instanceof ApiError) {
-    switch (err.code) {
-      case "INSTALLATION_KIND_NOT_LOCAL":
-        fail(
-          `Refusing to destroy: the install isn't kind=local (it may have been promoted to production). Use the dashboard's uninstall flow instead.`
-        );
-        break;
-      case "NOT_WORKSPACE_MEMBER":
-        fail(
-          `You're not a member of the install's workspace. Contact a workspace admin.`
-        );
-        break;
-      case "UNAUTHENTICATED":
-        fail(
-          `Auth rejected by backend \u2014 your CLI bearer may be stale. Re-run ${code("dashwise login")} and try again.`
-        );
-        break;
-      default:
-        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
-    }
-    return 1;
-  }
-  fail(`Unexpected error: ${err.message}`);
-  return 1;
-}
-var init_destroy_dev_install = __esm({
-  "src/commands/module/destroy-dev-install.ts"() {
-    init_api_client();
-    init_config();
-    init_manifest_io();
-    init_output();
-  }
-});
-
-// src/commands/module/reset-dev-install.ts
-var reset_dev_install_exports = {};
-__export(reset_dev_install_exports, {
-  resetDevInstallCommand: () => resetDevInstallCommand
-});
-async function resetDevInstallCommand(options) {
-  const projectRoot = resolve(options.dir ?? process.cwd());
-  const manifest = (() => {
-    try {
-      return readManifest(projectRoot);
-    } catch {
-      return null;
-    }
-  })();
-  const slug = options.module ?? manifest?.module?.slug;
-  if (!slug) {
-    fail(
-      `No module slug \u2014 pass ${code("--module <slug>")} or run from a directory with a valid module.json.`
-    );
-    return 1;
-  }
-  const name = manifest?.module?.name ?? slug;
-  info(`Resetting dev install for ${code(slug)} \u2014 phase 1/2: destroy\u2026`);
-  const destroyExit = await destroyDevInstallCommand({
-    ...options.dir !== void 0 ? { dir: options.dir } : {},
-    module: slug,
-    ...options.yes !== void 0 ? { yes: options.yes } : {}
-  });
-  if (destroyExit !== 0) {
-    fail(
-      `Destroy phase failed (exit ${destroyExit}); aborting reset. Fix the underlying error and re-run.`
-    );
-    return destroyExit;
-  }
-  info(`Reset phase 2/2: re-provisioning\u2026`);
-  return moduleInitCommand(slug, {
-    name,
-    ...options.dir !== void 0 ? { dir: options.dir } : { dir: projectRoot },
-    // `--force` so init doesn't refuse to overwrite the existing
-    // module.json (we're keeping the local scaffold; only the
-    // backend install is being recreated).
-    force: true,
-    // Keep the current scaffold layout — don't try to detect or
-    // change `simple` vs `custom`. The user can re-init manually
-    // with `dashwise init` if they want to swap scaffolds.
-    provision: true,
-    ...options.workspace !== void 0 ? { workspace: options.workspace } : {}
-  });
-}
-var init_reset_dev_install = __esm({
-  "src/commands/module/reset-dev-install.ts"() {
-    init_destroy_dev_install();
-    init_init();
-    init_manifest_io();
-    init_output();
-  }
-});
-
-// src/lib/field-spec.ts
-function parseFieldSpec(spec) {
-  const parts = spec.split(":");
-  if (parts.length < 2) {
-    throw new FieldSpecError(
-      `Field spec ${quote(spec)} is malformed \u2014 expected ${quote("<slug>:<type>[:flags]")}.`
-    );
-  }
-  const [slug, type, ...flagParts] = parts;
-  if (!SLUG_REGEX.test(slug)) {
-    throw new FieldSpecError(
-      `Field slug ${quote(slug)} must match ${quote(SLUG_REGEX.source)} (snake_case, 2+ chars).`
-    );
-  }
-  if (!FIELD_TYPES.includes(type)) {
-    throw new FieldSpecError(
-      `Field type ${quote(type)} is not a known type. Allowed: ${FIELD_TYPES.join(", ")}.`
-    );
-  }
-  const result = { slug, type };
-  if (flagParts.length > 0) {
-    const flags = flagParts.flatMap((segment) => segment.split(",")).map((f) => f.trim()).filter((f) => f.length > 0);
-    for (const flag of flags) {
-      if (!KNOWN_FLAGS.has(flag)) {
-        throw new FieldSpecError(
-          `Unknown flag ${quote(flag)} in field spec ${quote(spec)}. Known flags: ${[...KNOWN_FLAGS].join(", ")}. For options/target/default, use ${quote("--field-json")} instead.`
-        );
-      }
-      if (flag === "required") result.required = true;
-    }
-  }
-  if ((type === "single_select" || type === "multi_select") && result.options === void 0) {
-    throw new FieldSpecError(
-      `Type ${quote(type)} requires an ${quote("options")} list. Use ${quote("--field-json")} for this field \u2014 e.g. ${quote(`'{"slug":"${slug}","type":"${type}","options":["a","b"]}'`)}.`
-    );
-  }
-  if (type === "link_row" && result.target === void 0) {
-    throw new FieldSpecError(
-      `Type ${quote("link_row")} requires a ${quote("target")}. Use ${quote("--field-json")}.`
-    );
-  }
-  if (type === "formula" || type === "ai") {
-    throw new FieldSpecError(
-      `Type ${quote(type)} requires extra config (${quote("formula")} or ${quote("prompt")}). Use ${quote("--field-json")}.`
-    );
-  }
-  return result;
-}
-function parseFieldJson(json) {
-  let parsed;
-  try {
-    parsed = JSON.parse(json);
-  } catch (err) {
-    throw new FieldSpecError(
-      `--field-json value is not valid JSON: ${err.message}`
-    );
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new FieldSpecError("--field-json must be a JSON object.");
-  }
-  const o = parsed;
-  if (typeof o.slug !== "string" || !SLUG_REGEX.test(o.slug)) {
-    throw new FieldSpecError(
-      `--field-json missing or invalid ${quote("slug")}. Must match ${quote(SLUG_REGEX.source)}.`
-    );
-  }
-  if (typeof o.type !== "string" || !FIELD_TYPES.includes(o.type)) {
-    throw new FieldSpecError(
-      `--field-json missing or invalid ${quote("type")}. Allowed: ${FIELD_TYPES.join(", ")}.`
-    );
+function hydrateEnvFromDotenvLocal(projectRoot) {
+  const envFile = join(projectRoot, ".env.local");
+  if (!existsSync(envFile)) return;
+  const raw = readFileSync(envFile, "utf-8");
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (process.env[key] === void 0) {
+      process.env[key] = value;
+    }
   }
-  return o;
-}
-function quote(s) {
-  return `\`${s}\``;
 }
-var FIELD_TYPES, SLUG_REGEX, KNOWN_FLAGS, FieldSpecError;
-var init_field_spec = __esm({
-  "src/lib/field-spec.ts"() {
-    FIELD_TYPES = [
-      "text",
-      "long_text",
-      "number",
-      "boolean",
-      "date",
-      "datetime",
-      "single_select",
-      "multi_select",
-      "link_row",
-      "file",
-      "multi_file",
-      "email",
-      "url",
-      "phone",
-      "formula",
-      "ai"
-    ];
-    SLUG_REGEX = /^[a-z][a-z0-9_]*[a-z0-9]$/;
-    KNOWN_FLAGS = /* @__PURE__ */ new Set(["required", "unique"]);
-    FieldSpecError = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "FieldSpecError";
-      }
-    };
+var init_dotenv_local = __esm({
+  "src/lib/dotenv-local.ts"() {
   }
 });
 
-// src/commands/table/create.ts
-var create_exports = {};
-__export(create_exports, {
-  surfaceFailure: () => surfaceFailure,
-  syncLocalManifest: () => syncLocalManifest,
-  tableCreateCommand: () => tableCreateCommand
+// src/commands/run.ts
+var run_exports = {};
+__export(run_exports, {
+  runCommand: () => runCommand
 });
-async function tableCreateCommand(slug, options) {
-  if (!slug) {
-    fail("Usage: `dashwise table create <slug> --field <slug>:<type>[:required] [...]`");
+async function runCommand(cmdArgs, options) {
+  if (!cmdArgs || cmdArgs.length === 0) {
+    fail(
+      `Usage: ${code("dashwise run -- <command\u2026>")} (e.g. ${code("dashwise run -- node seed.mjs")})`
+    );
     return 1;
   }
-  const fields = [];
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  let manifestSlug;
   try {
-    for (const spec of options.field ?? []) {
-      fields.push(parseFieldSpec(spec));
-    }
-    for (const json of options.fieldJson ?? []) {
-      fields.push(parseFieldJson(json));
-    }
+    manifestSlug = readManifestOrThrow(projectRoot).module?.slug;
   } catch (err) {
-    if (err instanceof FieldSpecError) {
-      fail(err.message);
-      return 1;
+    fail(err.message);
+    return 1;
+  }
+  if (!manifestSlug) {
+    fail(`module.json has no ${code("module.slug")} \u2014 the manifest is malformed.`);
+    return 1;
+  }
+  hydrateEnvFromDotenvLocal(projectRoot);
+  const cfg = (() => {
+    try {
+      return readConfig();
+    } catch {
+      return null;
     }
-    throw err;
+  })();
+  const apiUrl = process.env.DASHWISE_API_URL ?? cfg?.apiUrl ?? "http://localhost:3000";
+  let apiKey = process.env.DASHWISE_API_KEY;
+  if (!apiKey) {
+    let entry = readModuleEntry(manifestSlug);
+    if (cfg) {
+      const healed = await resolveModuleApiKey(
+        manifestSlug,
+        entry,
+        apiUrl,
+        cfg.token
+      );
+      if (healed) entry = healed;
+    }
+    apiKey = entry?.apiKey;
   }
-  if (fields.length === 0) {
+  if (!apiKey) {
     fail(
-      `At least one field is required. Use ${code("--field <slug>:<type>")} (repeatable) or ${code("--field-json '{...}'")} for fields with options/target/default.`
+      `No ${code("dwk_")} API key for module ${code(manifestSlug)} \u2014 the command would run with NO token.`
+    );
+    info(
+      `Provision a dev install first (${code(`dashwise init ${manifestSlug} --workspace <your-workspace-slug>`)}), or set ${code("DASHWISE_API_KEY")} explicitly.`
     );
     return 1;
   }
-  const seen = /* @__PURE__ */ new Set();
-  for (const f of fields) {
-    if (seen.has(f.slug)) {
-      fail(`Duplicate field slug ${code(f.slug)} in --field flags.`);
+  const [cmd, ...rest] = cmdArgs;
+  info(
+    `${dim("run")} ${cmd} ${rest.join(" ")} ${dim(`(DASHWISE_API_URL=${apiUrl}, DASHWISE_API_KEY injected)`)}`
+  );
+  const child = spawn(cmd, rest, {
+    cwd: projectRoot,
+    stdio: "inherit",
+    env: {
+      ...process.env,
+      DASHWISE_API_URL: apiUrl,
+      DASHWISE_API_KEY: apiKey
+    },
+    // Windows needs shell:true for .cmd shims (npm / npx).
+    shell: process.platform === "win32"
+  });
+  return new Promise((resolveExit) => {
+    child.on("error", (err) => {
+      fail(`Could not spawn ${code(cmd)}: ${err.message}`);
+      resolveExit(1);
+    });
+    child.on("exit", (exitCode, signal) => {
+      resolveExit(exitCode ?? (signal !== null ? 1 : 0));
+    });
+  });
+}
+var init_run = __esm({
+  "src/commands/run.ts"() {
+    init_config();
+    init_dotenv_local();
+    init_manifest_io();
+    init_output();
+    init_dev();
+  }
+});
+
+// src/commands/module/destroy-dev-install.ts
+var destroy_dev_install_exports = {};
+__export(destroy_dev_install_exports, {
+  destroyDevInstallCommand: () => destroyDevInstallCommand
+});
+async function destroyDevInstallCommand(options) {
+  let slug = options.module;
+  if (!slug) {
+    const projectRoot = resolve(options.dir ?? process.cwd());
+    const manifest = (() => {
+      try {
+        return readManifest(projectRoot);
+      } catch {
+        return null;
+      }
+    })();
+    slug = manifest?.module?.slug;
+    if (!slug) {
+      fail(
+        `No module slug \u2014 pass ${code("--module <slug>")} or run from a directory with a valid module.json.`
+      );
       return 1;
     }
-    seen.add(f.slug);
   }
-  let ctx;
-  try {
-    ctx = loadSchemaCommandContext({
-      ...options.dir !== void 0 ? { dir: options.dir } : {}
-    });
-  } catch (err) {
-    fail(err.message);
+  const cfg = readConfig();
+  if (!cfg) {
+    fail("Not logged in. Run `dashwise login` first.");
     return 1;
   }
-  info(`Creating table ${code(slug)} in installation ${ctx.entry.installationId}\u2026`);
-  try {
-    const result = await createTable(
-      { slug, fields },
-      ctx.requestOptions
-    );
-    success(
-      `Created table ${code(slug)} (physical_table_id=${result.physical_table_id}, manifest_version=${result.manifest_version})`
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    warn(
+      `No cached dev install for ${code(slug)} in auth.json. Nothing to do.`
     );
-  } catch (err) {
-    return surfaceFailure(err);
+    return 0;
   }
-  return syncLocalManifest(ctx);
-}
-async function syncLocalManifest(ctx) {
+  if (!options.yes && process.stdout.isTTY) {
+    const choice = await confirm({
+      message: `Destroy dev install ${code(`${slug} (id=${entry.installationId})`)}? Tables and rows will be soft-deleted (recoverable for 30 days via dashboard trash).`
+    });
+    if (isCancel(choice) || !choice) {
+      info("Aborted.");
+      return 130;
+    }
+  }
+  let backendCleaned = false;
   try {
-    const { manifest } = await getInstallationSchema(ctx.requestOptions);
-    writeManifest(manifest, ctx.projectRoot);
-    return 0;
+    const response = await destroyDevInstallation(entry.installationId, {
+      baseUrl: resolveApiUrl(),
+      auth: { token: cfg.token }
+    });
+    backendCleaned = true;
+    success(
+      `Destroyed dev install ${code(`${slug} (id=${response.installation_id})`)}${response.module_also_dropped ? " \u2014 module also dropped (no other installs, unpublished)." : " (module kept \u2014 other installs reference it or it has a published version)."}`
+    );
   } catch (err) {
-    if (err instanceof ApiError) {
+    if (err instanceof ApiError && err.code === "INSTALLATION_NOT_FOUND") {
       warn(
-        `Schema sync to local module.json failed (${err.code} ${err.status}): ${err.message}. The mutation succeeded server-side; re-run your next command to retry the local sync.`
+        `Install ${entry.installationId} not found on the backend \u2014 already destroyed elsewhere. Cleaning up local cache.`
       );
+      backendCleaned = true;
     } else {
+      return surfaceDestroyError(err);
+    }
+  }
+  if (backendCleaned) {
+    try {
+      removeModuleEntry(slug);
+      info(`Removed ${code(slug)} entry from auth.json.`);
+    } catch (err) {
       warn(
-        `Schema sync to local module.json failed: ${err.message}. The mutation succeeded server-side.`
+        `Backend cleanup succeeded but failed to update auth.json: ${err.message}. Edit ${code("~/.config/dashwise/auth.json")} manually to remove the ${code(`modules["${slug}"]`)} entry.`
       );
     }
-    return 0;
   }
+  return 0;
 }
-function surfaceFailure(err) {
+function surfaceDestroyError(err) {
   if (err instanceof ApiError) {
     switch (err.code) {
-      case "TABLE_SLUG_EXISTS":
-        fail(`A table with this slug already exists in the manifest.`);
-        break;
-      case "FIELD_SLUG_EXISTS":
-        fail(`A field with this slug already exists on the table.`);
-        break;
-      case "TABLE_NOT_FOUND":
-        fail(`Table not found in the manifest.`);
-        break;
-      case "FIELD_NOT_FOUND":
-        fail(`Field not found on the table.`);
-        break;
-      case "UNAUTHENTICATED":
+      case "INSTALLATION_KIND_NOT_LOCAL":
         fail(
-          `API key rejected by backend. The cached key may be expired or revoked \u2014 re-run \`dashwise init <slug> --force\` to mint a fresh one.`
+          `Refusing to destroy: the install isn't kind=local (it may have been promoted to production). Use the dashboard's uninstall flow instead.`
         );
         break;
-      case "SCHEMA_LOCKED":
+      case "NOT_WORKSPACE_MEMBER":
         fail(
-          `Schema mutations require a local-dev install (kind=local). The cached API key belongs to a non-local install \u2014 schema is locked. Run \`dashwise init <slug> --force\` for a local dev install.`
+          `You're not a member of the install's workspace. Contact a workspace admin.`
         );
         break;
-      case "INSTALL_MISMATCH":
+      case "UNAUTHENTICATED":
         fail(
-          `API key is bound to a different installation than the URL. The cached install id may be stale \u2014 re-run \`dashwise init <slug> --force\`.`
+          `Auth rejected by backend \u2014 your CLI bearer may be stale. Re-run ${code("dashwise login")} and try again.`
         );
         break;
       default:
-        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
-    }
-    return 1;
-  }
-  fail(`Unexpected error: ${err.message}`);
-  return 1;
-}
-var init_create = __esm({
-  "src/commands/table/create.ts"() {
-    init_manifest_io();
-    init_api_client();
-    init_schema_command_context();
-    init_field_spec();
-    init_output();
-  }
-});
-
-// src/commands/table/delete.ts
-var delete_exports = {};
-__export(delete_exports, {
-  tableDeleteCommand: () => tableDeleteCommand
-});
-async function tableDeleteCommand(slug, options) {
-  if (!slug) {
-    fail("Usage: `dashwise table delete <slug>`");
-    return 1;
-  }
-  let ctx;
-  try {
-    ctx = loadSchemaCommandContext({
-      ...options.dir !== void 0 ? { dir: options.dir } : {}
-    });
-  } catch (err) {
-    fail(err.message);
-    return 1;
-  }
-  info(`Dropping table ${code(slug)} from installation ${ctx.entry.installationId}\u2026`);
-  try {
-    const result = await dropTable(slug, ctx.requestOptions);
-    success(
-      `Dropped table ${code(slug)} (manifest_version=${result.manifest_version}). Physical table soft-deleted; recoverable for 30 days via the dashboard's trash.`
-    );
-  } catch (err) {
-    return surfaceFailure(err);
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+    }
+    return 1;
   }
-  return syncLocalManifest(ctx);
+  fail(`Unexpected error: ${err.message}`);
+  return 1;
 }
-var init_delete = __esm({
-  "src/commands/table/delete.ts"() {
+var init_destroy_dev_install = __esm({
+  "src/commands/module/destroy-dev-install.ts"() {
     init_api_client();
-    init_schema_command_context();
+    init_config();
+    init_manifest_io();
     init_output();
-    init_create();
   }
 });
 
-// src/commands/field/add.ts
-var add_exports = {};
-__export(add_exports, {
-  fieldAddCommand: () => fieldAddCommand
+// src/commands/module/reset-dev-install.ts
+var reset_dev_install_exports = {};
+__export(reset_dev_install_exports, {
+  resetDevInstallCommand: () => resetDevInstallCommand
 });
-async function fieldAddCommand(tableSlug, fieldSpec, options) {
-  if (!tableSlug) {
+async function resetDevInstallCommand(options) {
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const manifest = (() => {
+    try {
+      return readManifest(projectRoot);
+    } catch {
+      return null;
+    }
+  })();
+  const slug = options.module ?? manifest?.module?.slug;
+  if (!slug) {
     fail(
-      "Usage: `dashwise field add <table-slug> <field-slug>:<type>[:required]` or `dashwise field add <table-slug> --field-json '{...}'`"
+      `No module slug \u2014 pass ${code("--module <slug>")} or run from a directory with a valid module.json.`
     );
     return 1;
   }
-  const hasPositional = fieldSpec !== void 0;
-  const hasJson = options.fieldJson !== void 0;
-  if (!hasPositional && !hasJson) {
+  const name = manifest?.module?.name ?? slug;
+  info(`Resetting dev install for ${code(slug)} \u2014 phase 1/2: destroy\u2026`);
+  const destroyExit = await destroyDevInstallCommand({
+    ...options.dir !== void 0 ? { dir: options.dir } : {},
+    module: slug,
+    ...options.yes !== void 0 ? { yes: options.yes } : {}
+  });
+  if (destroyExit !== 0) {
     fail(
-      `Pass either a field spec (e.g. ${code("title:text:required")}) or ${code("--field-json")} with the field's JSON definition.`
+      `Destroy phase failed (exit ${destroyExit}); aborting reset. Fix the underlying error and re-run.`
     );
+    return destroyExit;
+  }
+  info(`Reset phase 2/2: re-provisioning\u2026`);
+  return moduleInitCommand(slug, {
+    name,
+    ...options.dir !== void 0 ? { dir: options.dir } : { dir: projectRoot },
+    // Provision-only: write NO files — every local file (module.json
+    // included) stays exactly as-is; only the backend dev install +
+    // the auth.json credentials entry are recreated. This is what the
+    // command's "keeps local module.json intact" contract always
+    // promised (pre-fix `force: true` re-scaffolded over user code).
+    provisionOnly: true,
+    provision: true,
+    ...options.workspace !== void 0 ? { workspace: options.workspace } : {}
+  });
+}
+var init_reset_dev_install = __esm({
+  "src/commands/module/reset-dev-install.ts"() {
+    init_destroy_dev_install();
+    init_init();
+    init_manifest_io();
+    init_output();
+  }
+});
+
+// src/commands/schema/push.ts
+var push_exports = {};
+__export(push_exports, {
+  schemaPushCommand: () => schemaPushCommand
+});
+async function schemaPushCommand(options) {
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  let manifest;
+  try {
+    manifest = readManifestOrThrow(projectRoot);
+  } catch (err) {
+    fail(err.message);
     return 1;
   }
-  if (hasPositional && hasJson) {
-    fail(
-      `Pass only ONE of the field spec or ${code("--field-json")} \u2014 they're mutually exclusive.`
-    );
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    fail(`module.json has no ${code("module.slug")} \u2014 the manifest is malformed.`);
     return 1;
   }
-  let field;
+  const cfg = readConfig();
+  if (!cfg) {
+    fail(`Not logged in. Run ${code("dashwise login")} first.`);
+    return 1;
+  }
+  const auth = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
+  let moduleId;
   try {
-    field = hasJson ? parseFieldJson(options.fieldJson) : parseFieldSpec(fieldSpec);
+    moduleId = (await getModuleBySlug(slug, auth)).id;
   } catch (err) {
-    if (err instanceof FieldSpecError) {
-      fail(err.message);
+    if (err instanceof ApiError && err.status === 404) {
+      fail(
+        `Module ${code(slug)} isn't registered on the backend yet. Run ${code("dashwise init")} (or ${code("dashwise module register")}) first.`
+      );
       return 1;
     }
-    throw err;
-  }
-  let ctx;
-  try {
-    ctx = loadSchemaCommandContext({
-      ...options.dir !== void 0 ? { dir: options.dir } : {}
-    });
-  } catch (err) {
-    fail(err.message);
+    fail(`Could not resolve module ${code(slug)}: ${err.message}`);
     return 1;
   }
-  info(
-    `Adding field ${code(`${tableSlug}.${field.slug}`)} (${field.type}) to installation ${ctx.entry.installationId}\u2026`
-  );
-  try {
-    const result = await addField(
-      { table_slug: tableSlug, field },
-      ctx.requestOptions
+  const entry = readModuleEntry(slug);
+  const dwkAuth = entry?.apiKey ? { baseUrl: resolveApiUrl(), auth: { token: entry.apiKey } } : null;
+  let remote = null;
+  let previewUnavailableReason = null;
+  if (!dwkAuth) {
+    previewUnavailableReason = `no dev-install ${code("dwk_")} key is cached for ${code(slug)} in auth.json`;
+  } else {
+    try {
+      remote = (await getInstallationSchema(dwkAuth)).manifest;
+    } catch (err) {
+      const detail = err instanceof ApiError ? `${err.code} ${err.status}: ${err.message}` : err.message;
+      previewUnavailableReason = `reading the dev-install manifest failed (${detail}) \u2014 the cached key may be expired or revoked`;
+    }
+  }
+  if (remote) {
+    const delta = computeDestructiveDelta(
+      manifest,
+      remote
     );
-    success(
-      `Added field ${code(`${tableSlug}.${field.slug}`)} (manifest_version=${result.manifest_version})`
+    if (delta.tablesRemoved.length > 0 || delta.fieldsRemoved.length > 0) {
+      warn(`This push REMOVES schema from the dev install (live DDL):`);
+      for (const t of delta.tablesRemoved) {
+        out(`  - table ${code(t)} ${dim("(soft-deleted; rows recoverable for 30 days via trash)")}`);
+      }
+      for (const f of delta.fieldsRemoved) {
+        out(`  - field ${code(f)} ${dim("(column dropped)")}`);
+      }
+      if (!options.yes) {
+        if (!process.stdout.isTTY) {
+          fail(
+            `Refusing the destructive push without confirmation. Re-run with ${code("--yes")} to apply the removals.`
+          );
+          return 1;
+        }
+        const answer = await select({
+          message: `Apply these removals to the dev install?`,
+          options: [
+            { value: "apply", label: "Apply \u2014 remove the tables/fields listed above" },
+            { value: "cancel", label: "Cancel \u2014 nothing is changed" }
+          ],
+          initialValue: "cancel"
+        });
+        if (isCancel(answer) || answer === "cancel") {
+          fail("Aborted. Nothing was changed.");
+          return 130;
+        }
+      }
+    }
+  } else {
+    warn(
+      `Cannot preview what this push would change: ${previewUnavailableReason}.
+  Without the preview there is no way to know whether the push REMOVES tables/fields (live DDL on the dev install).`
+    );
+    if (!options.yes) {
+      fail(
+        `Refusing to push without the destructive-change preview. Re-run with ${code("--yes")} to push anyway (the backend still validates the apply).`
+      );
+      return 1;
+    }
+    info(
+      dim(
+        `--yes passed \u2014 pushing WITHOUT the destructive-change preview.`
+      )
+    );
+  }
+  info(`Pushing module.json to the dev install of ${code(slug)} (module id=${moduleId})\u2026`);
+  let applied;
+  try {
+    applied = await applyDraftManifest(
+      moduleId,
+      manifest,
+      auth
     );
   } catch (err) {
-    return surfaceFailure(err);
+    return surfaceSchemaPushError(err, slug);
   }
-  return syncLocalManifest(ctx);
+  printApplySummary(applied);
+  if (dwkAuth) {
+    try {
+      const { manifest: canonical } = await getInstallationSchema(dwkAuth);
+      const localNow = (() => {
+        try {
+          return readManifest(projectRoot);
+        } catch {
+          return null;
+        }
+      })();
+      const { merged, preserved } = mergeRemoteManifest(localNow, canonical);
+      writeManifest(merged, projectRoot);
+      if (preserved.length > 0) {
+        info(
+          dim(
+            `[sync] kept local-only manifest blocks the backend does not echo (${preserved.join(", ")}) \u2014 they were part of this push and stay in module.json.`
+          )
+        );
+      }
+    } catch (err) {
+      warn(
+        `Push succeeded but the local sync-back failed: ${err.message}. Local module.json is what you pushed; the next sync reconciles.`
+      );
+    }
+  }
+  return 0;
 }
-var init_add = __esm({
-  "src/commands/field/add.ts"() {
-    init_api_client();
-    init_schema_command_context();
-    init_field_spec();
-    init_output();
-    init_create();
+function printApplySummary(applied) {
+  const created = asArray(applied.tables_created);
+  const updated = asArray(applied.tables_updated);
+  const removed = asArray(applied.tables_removed);
+  success(`Manifest applied to the dev install.`);
+  if (created.length === 0 && updated.length === 0 && removed.length === 0) {
+    info(dim("No table changes (metadata-only or already in sync)."));
+    return;
   }
-});
-
-// src/commands/field/remove.ts
-var remove_exports = {};
-__export(remove_exports, {
-  fieldRemoveCommand: () => fieldRemoveCommand
-});
-async function fieldRemoveCommand(tableSlug, fieldSlug, options) {
-  if (!tableSlug || !fieldSlug) {
-    fail("Usage: `dashwise field remove <table-slug> <field-slug>`");
-    return 1;
+  for (const t of created) {
+    const slug = strProp(t, "slug") ?? "(table)";
+    const fields = asArray(t.fields_created);
+    out(`  + table ${code(slug)}${fields.length > 0 ? dim(` (${fields.length} field${fields.length === 1 ? "" : "s"})`) : ""}`);
   }
-  let ctx;
-  try {
-    ctx = loadSchemaCommandContext({
-      ...options.dir !== void 0 ? { dir: options.dir } : {}
-    });
-  } catch (err) {
-    fail(err.message);
-    return 1;
+  for (const t of updated) {
+    const slug = strProp(t, "slug") ?? "(table)";
+    const added = asArray(t.fields_added);
+    const dropped = asArray(t.fields_removed);
+    const bits = [];
+    if (added.length > 0) bits.push(`+${added.length} field${added.length === 1 ? "" : "s"}`);
+    if (dropped.length > 0) bits.push(`-${dropped.length} field${dropped.length === 1 ? "" : "s"}`);
+    out(`  ~ table ${code(slug)}${bits.length > 0 ? dim(` (${bits.join(", ")})`) : ""}`);
   }
-  info(
-    `Removing field ${code(`${tableSlug}.${fieldSlug}`)} from installation ${ctx.entry.installationId}\u2026`
-  );
-  try {
-    const result = await removeField(
-      tableSlug,
-      fieldSlug,
-      ctx.requestOptions
-    );
-    success(
-      `Removed field ${code(`${tableSlug}.${fieldSlug}`)} (manifest_version=${result.manifest_version})`
-    );
-  } catch (err) {
-    return surfaceFailure(err);
+  for (const t of removed) {
+    out(`  - table ${code(typeof t === "string" ? t : JSON.stringify(t))}`);
   }
-  return syncLocalManifest(ctx);
 }
-var init_remove = __esm({
-  "src/commands/field/remove.ts"() {
+function asArray(v) {
+  return Array.isArray(v) ? v : [];
+}
+function strProp(v, key) {
+  if (v && typeof v === "object" && typeof v[key] === "string") {
+    return v[key];
+  }
+  return void 0;
+}
+function surfaceSchemaPushError(err, slug) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "MANIFEST_INVALID":
+        fail(`Manifest rejected by the backend validator: ${err.message}`);
+        for (const issue of extractIssues2(err.context)) {
+          out(`    ${dim("-")} ${issue}`);
+        }
+        return 1;
+      case "DRAFT_INSTALLATION_MISSING":
+        fail(
+          `Module ${code(slug)} has no dev (local/sandbox) install in its owner workspace \u2014 production installs have NO draft plane, so there is nothing to push onto.
+  This happens after ${code("dashwise module install --replace-dev-install")}. Schema changes now ship as published versions: edit module.json, ${code("dashwise module publish --bump <patch|minor|major>")}, then ${code("dashwise module install")} to upgrade.`
+        );
+        return 1;
+      case "UNIQUE_INDEX_BACKFILL_CONFLICT":
+        fail(
+          `Cannot create a UNIQUE index \u2014 existing live rows already violate it: ${err.message}
+  De-duplicate the conflicting rows (only live rows count; trashed rows don't block since indexes are partial over live rows), then re-run ${code("dashwise schema push")}.`
+        );
+        return 1;
+      case "CHECK_CONSTRAINT_BACKFILL_CONFLICT":
+        fail(
+          `Cannot add the CHECK constraint \u2014 existing rows violate its expression: ${err.message}
+  Fix or remove the violating rows, then re-run ${code("dashwise schema push")}.`
+        );
+        return 1;
+      case "UNAUTHENTICATED":
+        fail(
+          `Auth rejected by the backend \u2014 your CLI token may be stale. Re-run ${code("dashwise login")} and try again.`
+        );
+        return 1;
+      case "FORBIDDEN":
+      case "NOT_WORKSPACE_MEMBER":
+        fail(
+          `Not authorized: pushing a draft manifest requires membership of the module's owner workspace.`
+        );
+        return 1;
+      default:
+        if (err.status === 400) {
+          fail(`Manifest rejected: ${err.message}`);
+          for (const issue of extractIssues2(err.context)) {
+            out(`    ${dim("-")} ${issue}`);
+          }
+          return 1;
+        }
+        fail(`Schema push failed (${err.code} ${err.status}): ${err.message}`);
+        return 1;
+    }
+  }
+  fail(`Schema push failed: ${err.message}`);
+  return 1;
+}
+function extractIssues2(context) {
+  if (!context) return [];
+  const raw = context.issues;
+  if (!Array.isArray(raw)) return [];
+  return raw.map((i) => {
+    if (typeof i === "string") return i;
+    if (i && typeof i === "object") {
+      const o = i;
+      const path = typeof o.path === "string" ? o.path : "";
+      const message = typeof o.message === "string" ? o.message : JSON.stringify(i);
+      return path ? `${path}: ${message}` : message;
+    }
+    return String(i);
+  });
+}
+var init_push = __esm({
+  "src/commands/schema/push.ts"() {
     init_api_client();
-    init_schema_command_context();
+    init_config();
+    init_manifest_io();
+    init_manifest_merge();
     init_output();
-    init_create();
   }
 });
 
-// src/commands/field/set-type.ts
-var set_type_exports = {};
-__export(set_type_exports, {
-  fieldSetTypeCommand: () => fieldSetTypeCommand
-});
-async function fieldSetTypeCommand(tableSlug, fieldSlug, newType, options) {
-  if (!tableSlug || !fieldSlug || !newType) {
-    fail(
-      "Usage: `dashwise field set-type <table-slug> <field-slug> <new-type>`"
+// src/lib/field-spec.ts
+function parseFieldSpec(spec) {
+  const parts = spec.split(":");
+  if (parts.length < 2) {
+    throw new FieldSpecError(
+      `Field spec ${quote(spec)} is malformed \u2014 expected ${quote("<slug>:<type>[:flags]")}.`
     );
-    return 1;
   }
-  if (!FIELD_TYPES.includes(newType)) {
-    fail(
-      `Type ${code(newType)} is not a known type. Allowed: ${FIELD_TYPES.join(", ")}.`
+  const [slug, type, ...flagParts] = parts;
+  if (!SLUG_REGEX.test(slug)) {
+    throw new FieldSpecError(
+      `Field slug ${quote(slug)} must match ${quote(SLUG_REGEX.source)} (snake_case, 2+ chars).`
     );
-    return 1;
-  }
-  let ctx;
-  try {
-    ctx = loadSchemaCommandContext({
-      ...options.dir !== void 0 ? { dir: options.dir } : {}
-    });
-  } catch (err) {
-    fail(err.message);
-    return 1;
   }
-  info(
-    `Setting type of ${code(`${tableSlug}.${fieldSlug}`)} \u2192 ${code(newType)} on installation ${ctx.entry.installationId}\u2026`
-  );
-  try {
-    const result = await updateField(
-      tableSlug,
-      fieldSlug,
-      { type: newType },
-      ctx.requestOptions
-    );
-    success(
-      `Updated ${code(`${tableSlug}.${fieldSlug}`)} \u2192 ${code(newType)} (manifest_version=${result.manifest_version})`
+  if (!FIELD_TYPES.includes(type)) {
+    throw new FieldSpecError(
+      `Field type ${quote(type)} is not a known type. Allowed: ${FIELD_TYPES.join(", ")}.`
     );
-  } catch (err) {
-    return surfaceFailure(err);
   }
-  return syncLocalManifest(ctx);
-}
-var init_set_type = __esm({
-  "src/commands/field/set-type.ts"() {
-    init_api_client();
-    init_schema_command_context();
-    init_field_spec();
-    init_output();
-    init_create();
+  const result = { slug, type };
+  if (flagParts.length > 0) {
+    const flags = flagParts.flatMap((segment) => segment.split(",")).map((f) => f.trim()).filter((f) => f.length > 0);
+    for (const flag of flags) {
+      if (flag === "unique") {
+        throw new FieldSpecError(
+          `The ${quote("unique")} flag is not supported on field specs \u2014 uniqueness is a TABLE-level index. Declare it in module.json as ${quote(`owns.tables[].indexes: [{ "fields": ["${slug}"], "unique": true }]`)} and apply it with ${quote("dashwise schema push")}.`
+        );
+      }
+      if (!KNOWN_FLAGS.has(flag)) {
+        throw new FieldSpecError(
+          `Unknown flag ${quote(flag)} in field spec ${quote(spec)}. Known flags: ${[...KNOWN_FLAGS].join(", ")}. For options/target/default, use ${quote("--field-json")} instead.`
+        );
+      }
+      if (flag === "required") result.required = true;
+    }
   }
-});
-
-// src/commands/dev.ts
-init_api_client();
-
-// src/lib/connect-status.ts
-init_api_client();
-init_output();
-async function reportConnectStatus(opts) {
-  const [deps, bindings] = await Promise.all([
-    safeGet(
-      () => getInstallationDependencies(opts.installationId, opts.requestOptions)
-    ),
-    safeGet(
-      () => getInstallationBindings(opts.installationId, opts.requestOptions)
-    )
-  ]);
-  if (deps === null && bindings === null) return;
-  const depList = deps ?? [];
-  const bindList = bindings ?? [];
-  if (depList.length === 0 && bindList.length === 0) return;
-  const unboundDeps = depList.filter((d) => d.status === "unbound").length;
-  const unboundUses = bindList.filter((b) => b.status === "unbound").length;
-  info(
-    `Connect status for ${code(opts.moduleSlug)} ${dim(
-      `(${depList.length} dep${depList.length === 1 ? "" : "s"}, ${bindList.length} uses slot${bindList.length === 1 ? "" : "s"})`
-    )}:`
-  );
-  for (const d of depList) renderDep(d);
-  for (const b of bindList) renderBinding(b);
-  const hints = [];
-  if (unboundDeps > 0) {
-    hints.push(
-      `${code("dashwise deps bind <provider-slug>")} once the provider is installed`
+  if ((type === "single_select" || type === "multi_select") && result.options === void 0) {
+    throw new FieldSpecError(
+      `Type ${quote(type)} requires an ${quote("options")} list. Use ${quote("--field-json")} for this field \u2014 e.g. ${quote(`'{"slug":"${slug}","type":"${type}","options":["a","b"]}'`)}.`
     );
   }
-  if (unboundUses > 0) {
-    hints.push(`${code("dashwise bind <uses-slug> --table <name>")} to connect a table`);
-  }
-  if (hints.length > 0) {
-    info(`Connect parked items with ${hints.join("; ")}.`);
-  }
-  out("");
-}
-function renderDep(d) {
-  if (d.status === "resolved") {
-    const providerLine = d.provider ? ` ${dim(`\u2192 install #${d.provider.installation_id} @ v${d.provider.version}`)}` : "";
-    out(`  ${pc.green("\u25CF resolved")} ${dim("dep")} ${code(d.slug)}@${d.range ?? "*"}${providerLine}`);
-  } else {
-    out(
-      `  ${pc.yellow("\u25CB unbound")}  ${dim("dep")} ${code(d.slug)}@${d.range ?? "*"} ${dim(`reason: ${d.reason ?? "(unspecified)"}`)}`
+  if (type === "link_row" && result.target === void 0) {
+    throw new FieldSpecError(
+      `Type ${quote("link_row")} requires a ${quote("target")}. Use ${quote("--field-json")}.`
     );
   }
-}
-function renderBinding(b) {
-  if (b.status === "bound") {
-    const tableLine = b.table ? ` ${dim(`\u2192 ${b.table.name} (id ${b.table.id})`)}` : "";
-    out(`  ${pc.green("\u25CF bound")}    ${dim("uses")} ${code(b.uses_slug)}${tableLine}`);
-  } else if (b.status === "declined") {
-    out(`  ${pc.dim("\u2298 declined")} ${dim("uses")} ${code(b.uses_slug)}`);
-  } else {
-    out(
-      `  ${pc.yellow("\u25CB unbound")}  ${dim("uses")} ${code(b.uses_slug)} ${dim(`reason: ${b.reason ?? "(unspecified)"}`)}`
+  if (type === "formula" || type === "ai") {
+    throw new FieldSpecError(
+      `Type ${quote(type)} requires extra config (${quote("formula")} or ${quote("prompt")}). Use ${quote("--field-json")}.`
     );
   }
+  return result;
 }
-async function safeGet(fn) {
+function parseFieldJson(json) {
+  let parsed;
   try {
-    return await fn();
+    parsed = JSON.parse(json);
   } catch (err) {
-    return null;
+    throw new FieldSpecError(
+      `--field-json value is not valid JSON: ${err.message}`
+    );
   }
-}
-
-// src/commands/dev.ts
-init_config();
-init_manifest_io();
-
-// src/lib/manifest-poll.ts
-init_api_client();
-function startManifestPollLoop(opts) {
-  const {
-    manifestPath: manifestPath2,
-    requestOptions,
-    intervalMs,
-    onUpdate,
-    onError
-  } = opts;
-  let lastSeenJson = existsSync(manifestPath2) ? readFileSync(manifestPath2, "utf-8") : "";
-  let timer = null;
-  let stopped = false;
-  const tick = async () => {
-    if (stopped) return;
-    try {
-      const { manifest } = await getInstallationSchema(requestOptions);
-      const remoteJson = JSON.stringify(manifest, null, 2) + "\n";
-      const currentLocal = existsSync(manifestPath2) ? readFileSync(manifestPath2, "utf-8") : "";
-      if (remoteJson === currentLocal) {
-        lastSeenJson = remoteJson;
-      } else if (remoteJson !== lastSeenJson) {
-        writeFileSync(manifestPath2, remoteJson, "utf-8");
-        lastSeenJson = remoteJson;
-        if (onUpdate) {
-          const delta = Buffer.byteLength(remoteJson, "utf8") - Buffer.byteLength(currentLocal, "utf8");
-          const deltaStr = delta === 0 ? "0 bytes" : `${delta > 0 ? "+" : ""}${delta} bytes`;
-          onUpdate(
-            `Backend manifest changed \u2014 synced to module.json (${deltaStr}).`
-          );
-        }
-      }
-    } catch (err) {
-      if (onError) {
-        const message = err instanceof ApiError ? `${err.code} (HTTP ${err.status}): ${err.message}` : err.message;
-        onError(new Error(message));
-      }
-    } finally {
-      if (!stopped) {
-        timer = setTimeout(() => void tick(), intervalMs);
-      }
-    }
-  };
-  timer = setTimeout(() => void tick(), intervalMs);
-  return {
-    stop: () => {
-      if (stopped) return;
-      stopped = true;
-      if (timer) {
-        clearTimeout(timer);
-        timer = null;
-      }
-    },
-    isRunning: () => !stopped
-  };
-}
-
-// src/commands/dev.ts
-init_output();
-var DEFAULT_NEXT_PORT = 3e3;
-var PREFIX_SDK = `\x1B[36m[sdk]\x1B[0m `;
-var PREFIX_NEXT = `\x1B[35m[next]\x1B[0m `;
-var PREFIX_POLL = `\x1B[33m[poll]\x1B[0m `;
-var DEFAULT_REMOTE_POLL_INTERVAL_SEC = 5;
-var MIN_REMOTE_POLL_INTERVAL_SEC = 1;
-async function devCommand(options) {
-  if (options.sdkOnly && options.nextOnly) {
-    fail(
-      `Cannot pass both ${code("--sdk-only")} and ${code("--next-only")} \u2014 they're mutually exclusive.`
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new FieldSpecError("--field-json must be a JSON object.");
+  }
+  const o = parsed;
+  if (typeof o.slug !== "string" || !SLUG_REGEX.test(o.slug)) {
+    throw new FieldSpecError(
+      `--field-json missing or invalid ${quote("slug")}. Must match ${quote(SLUG_REGEX.source)}.`
     );
-    return 1;
   }
-  const projectRoot = resolve(options.dir ?? process.cwd());
-  const manifestPath2 = `${projectRoot}/module.json`;
-  if (!existsSync(manifestPath2)) {
-    fail(`No ${code("module.json")} found in ${code(projectRoot)}.`);
-    info(`Run ${code("dashwise module init <slug>")} to scaffold a new module first.`);
-    return 1;
+  if (typeof o.type !== "string" || !FIELD_TYPES.includes(o.type)) {
+    throw new FieldSpecError(
+      `--field-json missing or invalid ${quote("type")}. Allowed: ${FIELD_TYPES.join(", ")}.`
+    );
+  }
+  return o;
+}
+function quote(s) {
+  return `\`${s}\``;
+}
+var FIELD_TYPES, SLUG_REGEX, KNOWN_FLAGS, FieldSpecError;
+var init_field_spec = __esm({
+  "src/lib/field-spec.ts"() {
+    FIELD_TYPES = [
+      "text",
+      "long_text",
+      "number",
+      "boolean",
+      "date",
+      "datetime",
+      "single_select",
+      "multi_select",
+      "link_row",
+      "file",
+      "multi_file",
+      "email",
+      "url",
+      "phone",
+      "formula",
+      "ai"
+    ];
+    SLUG_REGEX = /^[a-z][a-z0-9_]*[a-z0-9]$/;
+    KNOWN_FLAGS = /* @__PURE__ */ new Set(["required"]);
+    FieldSpecError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "FieldSpecError";
+      }
+    };
   }
-  const manifestSlug = (() => {
-    try {
-      return readManifest(projectRoot)?.module?.slug;
-    } catch {
-      return void 0;
-    }
-  })();
-  const savedConfig = (() => {
-    try {
-      return readConfig();
-    } catch {
-      return null;
-    }
-  })();
-  const apiToken = process.env.DASHWISE_API_TOKEN ?? savedConfig?.token;
-  if (!apiToken) {
-    fail(`Not authenticated. Run ${code("dashwise login")} first.`);
-    info(
-      "The unified dev loop reads your CLI token from ~/.config/dashwise/auth.json and injects it into both child processes so the SDK can authenticate without you editing .env.local."
-    );
+});
+
+// src/commands/table/create.ts
+var create_exports = {};
+__export(create_exports, {
+  surfaceFailure: () => surfaceFailure,
+  syncLocalManifest: () => syncLocalManifest,
+  tableCreateCommand: () => tableCreateCommand
+});
+async function tableCreateCommand(slug, options) {
+  if (!slug) {
+    fail("Usage: `dashwise table create <slug> --field <slug>:<type>[:required] [...]`");
     return 1;
   }
-  const apiUrl = options.apiUrl ?? process.env.DASHWISE_API_URL ?? savedConfig?.apiUrl ?? "http://localhost:3000";
-  let port;
+  const fields = [];
   try {
-    port = await resolveDevPort(options.port);
+    for (const spec of options.field ?? []) {
+      fields.push(parseFieldSpec(spec));
+    }
+    for (const json of options.fieldJson ?? []) {
+      fields.push(parseFieldJson(json));
+    }
   } catch (err) {
-    fail(err.message);
-    return 1;
-  }
-  const explicitInstallationId = options.installationId ?? process.env.DASHWISE_INSTALLATION_ID;
-  const reuseDevSessionId = process.env.DASHWISE_DEV_SESSION_ID;
-  let moduleEntry = manifestSlug !== void 0 ? readModuleEntry(manifestSlug) : null;
-  const healed = manifestSlug !== void 0 ? await resolveModuleApiKey(manifestSlug, moduleEntry, apiUrl, apiToken) : null;
-  if (healed) moduleEntry = healed;
-  const apiKeyEnv = process.env.DASHWISE_API_KEY ?? moduleEntry?.apiKey;
-  let installationIdEnv;
-  let revokeDevSession;
-  if (explicitInstallationId && explicitInstallationId !== "local") {
-    installationIdEnv = explicitInstallationId;
-  } else if (reuseDevSessionId) ; else {
-    const effectiveWorkspace = options.workspace ?? moduleEntry?.workspaceId?.toString();
-    let workspaceContext;
-    try {
-      workspaceContext = await resolveTargetWorkspace(
-        apiUrl,
-        apiToken,
-        effectiveWorkspace
-      );
-    } catch (err) {
+    if (err instanceof FieldSpecError) {
       fail(err.message);
       return 1;
     }
-    const callbackOrigins = computeCallbackOrigins(port, options.callbackOrigin ?? []);
-    try {
-      const session = await registerDevSession(apiUrl, apiToken, {
-        target_workspace_id: workspaceContext.id,
-        callback_origins: callbackOrigins
-      });
-      revokeDevSession = () => revokeDevSessionBestEffort(apiUrl, apiToken, session.id);
-      info(`  ${dim("dev session")} ${session.id}`);
-      info(`  ${dim("workspace")}   ${workspaceContext.name} (id=${workspaceContext.id}, slug=${workspaceContext.slug})`);
-      info(`  ${dim("callbacks")}   ${callbackOrigins.join(", ")}`);
-      info(`  ${dim("expires")}     ${session.expires_at}`);
-    } catch (err) {
-      if (err instanceof ApiError) {
-        fail(`Failed to register dev session: ${err.code} \u2014 ${err.message}`);
-      } else {
-        fail(`Failed to register dev session: ${err.message}`);
-      }
+    throw err;
+  }
+  if (fields.length === 0) {
+    fail(
+      `At least one field is required. Use ${code("--field <slug>:<type>")} (repeatable) or ${code("--field-json '{...}'")} for fields with options/target/default.`
+    );
+    return 1;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const f of fields) {
+    if (seen.has(f.slug)) {
+      fail(`Duplicate field slug ${code(f.slug)} in --field flags.`);
       return 1;
     }
+    seen.add(f.slug);
   }
-  const childEnv = {
-    ...process.env,
-    DASHWISE_API_URL: apiUrl,
-    NEXT_PUBLIC_DASHWISE_API_URL: apiUrl,
-    ...apiKeyEnv !== void 0 ? { DASHWISE_API_KEY: apiKeyEnv } : {}
-  };
-  info(`Dev loop starting \u2014 Ctrl-C to stop.`);
-  info(`  ${dim("api")}         ${apiUrl}`);
-  if (installationIdEnv !== void 0) {
-    info(`  ${dim("installation")} ${installationIdEnv} (prod-mode SSO)`);
-  } else {
-    info(`  ${dim("mode")}        dev (dev SSO session registered)`);
+  let ctx;
+  try {
+    ctx = loadSchemaCommandContext({
+      ...options.dir !== void 0 ? { dir: options.dir } : {}
+    });
+  } catch (err) {
+    fail(err.message);
+    return 1;
   }
-  info(`  ${dim("cli token")}   ${maskedToken(apiToken)} ${dim(`(from ${apiToken === savedConfig?.token ? "~/.config/dashwise/auth.json" : "$DASHWISE_API_TOKEN"})`)}`);
-  if (apiKeyEnv !== void 0) {
-    const source = process.env.DASHWISE_API_KEY === apiKeyEnv ? "$DASHWISE_API_KEY" : `~/.config/dashwise/auth.json#modules[${manifestSlug}]`;
-    const installId = moduleEntry?.installationId;
-    info(
-      `  ${dim("api key")}     ${maskedToken(apiKeyEnv)} ${dim(`(from ${source}${installId ? `, install id=${installId}` : ""})`)}`
-    );
-  } else if (manifestSlug !== void 0 && installationIdEnv === void 0) {
-    fail(
-      `No ${code("dwk_")} API key for module ${code(manifestSlug)} \u2014 the module will run with NO token.`
+  info(`Creating table ${code(slug)} in installation ${ctx.entry.installationId}\u2026`);
+  try {
+    const result = await createTable(
+      { slug, fields },
+      ctx.requestOptions
     );
-    info(
-      `  Data-plane calls (db, qb) AND sign-in will fail until you provision a dev install:
-    ${code(`dashwise init ${manifestSlug} --force --workspace <your-workspace-slug>`)}
-  (Ensure you're logged into the right backend: ${code(`dashwise login --api-url ${apiUrl}`)}.)`
+    success(
+      `Created table ${code(slug)} (physical_table_id=${result.physical_table_id}, manifest_version=${result.manifest_version})`
     );
+  } catch (err) {
+    return surfaceFailure(err);
   }
-  info("");
-  if (moduleEntry !== null && manifestSlug !== void 0) {
-    await reportConnectStatus({
-      installationId: moduleEntry.installationId,
-      moduleSlug: manifestSlug,
-      requestOptions: { baseUrl: apiUrl, auth: { token: apiToken } }
-    });
+  return syncLocalManifest(ctx);
+}
+async function syncLocalManifest(ctx) {
+  try {
+    const { manifest } = await getInstallationSchema(ctx.requestOptions);
+    const local = (() => {
+      try {
+        return readManifest(ctx.projectRoot);
+      } catch {
+        return null;
+      }
+    })();
+    const { merged, preserved } = mergeRemoteManifest(local, manifest);
+    writeManifest(merged, ctx.projectRoot);
+    if (preserved.length > 0) {
+      info(PRESERVED_BLOCKS_NOTICE);
+    }
+    return 0;
+  } catch (err) {
+    if (err instanceof ApiError) {
+      warn(
+        `Schema sync to local module.json failed (${err.code} ${err.status}): ${err.message}. The mutation succeeded server-side; re-run your next command to retry the local sync.`
+      );
+    } else {
+      warn(
+        `Schema sync to local module.json failed: ${err.message}. The mutation succeeded server-side.`
+      );
+    }
+    return 0;
   }
-  const children = [];
-  if (!options.nextOnly) {
-    const sdkChild = spawnSdkWatcher(projectRoot, childEnv);
-    children.push({ name: "sdk", child: sdkChild, prefix: PREFIX_SDK });
+}
+function surfaceFailure(err) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "TABLE_SLUG_EXISTS":
+        fail(`A table with this slug already exists in the manifest.`);
+        break;
+      case "FIELD_SLUG_EXISTS":
+        fail(`A field with this slug already exists on the table.`);
+        break;
+      case "TABLE_NOT_FOUND":
+        fail(`Table not found in the manifest.`);
+        break;
+      case "FIELD_NOT_FOUND":
+        fail(`Field not found on the table.`);
+        break;
+      case "UNAUTHENTICATED":
+        fail(
+          `API key rejected by backend. The cached key may be expired or revoked \u2014 re-run \`dashwise init <slug>\` to mint a fresh one (existing files are preserved).`
+        );
+        break;
+      case "SCHEMA_LOCKED":
+        fail(
+          `Schema mutations require a local-dev install (kind=local). The cached API key belongs to a non-local install \u2014 schema is locked. Run \`dashwise init <slug>\` for a local dev install (existing files are preserved).`
+        );
+        break;
+      case "INSTALL_MISMATCH":
+        fail(
+          `API key is bound to a different installation than the URL. The cached install id may be stale \u2014 re-run \`dashwise init <slug>\`.`
+        );
+        break;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+    }
+    return 1;
   }
-  if (!options.sdkOnly) {
-    const nextChild = spawnNextDev(projectRoot, childEnv, port);
-    children.push({ name: "next", child: nextChild, prefix: PREFIX_NEXT });
+  fail(`Unexpected error: ${err.message}`);
+  return 1;
+}
+var init_create = __esm({
+  "src/commands/table/create.ts"() {
+    init_manifest_io();
+    init_api_client();
+    init_manifest_merge();
+    init_schema_command_context();
+    init_field_spec();
+    init_output();
   }
-  for (const { child, prefix } of children) {
-    pipeWithPrefix(child.stdout, process.stdout, prefix);
-    pipeWithPrefix(child.stderr, process.stderr, prefix);
+});
+
+// src/commands/table/delete.ts
+var delete_exports = {};
+__export(delete_exports, {
+  tableDeleteCommand: () => tableDeleteCommand
+});
+async function tableDeleteCommand(slug, options) {
+  if (!slug) {
+    fail("Usage: `dashwise table delete <slug>`");
+    return 1;
   }
-  let manifestPoll = null;
-  const pollEntry = moduleEntry;
-  const enablePoll = !options.noRemotePoll && pollEntry !== null && apiKeyEnv !== void 0 && manifestSlug !== void 0;
-  if (enablePoll && pollEntry !== null) {
-    const intervalSec = Math.max(
-      MIN_REMOTE_POLL_INTERVAL_SEC,
-      options.remotePollIntervalSec ?? DEFAULT_REMOTE_POLL_INTERVAL_SEC
-    );
-    manifestPoll = startManifestPollLoop({
-      manifestPath: manifestPath2,
-      requestOptions: {
-        baseUrl: apiUrl,
-        // The `dwk_` key resolves the install server-side.
-        auth: { token: apiKeyEnv }
-      },
-      intervalMs: intervalSec * 1e3,
-      onUpdate: (msg) => {
-        process.stdout.write(`${PREFIX_POLL}${msg}
-`);
-      },
-      onError: (err) => {
-        process.stderr.write(`${PREFIX_POLL}${err.message}
-`);
-      }
+  let ctx;
+  try {
+    ctx = loadSchemaCommandContext({
+      ...options.dir !== void 0 ? { dir: options.dir } : {}
     });
-    info(
-      `  ${dim("poll")}        backend manifest every ${intervalSec}s ${dim("(--no-remote-poll to disable)")}`
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  info(`Dropping table ${code(slug)} from installation ${ctx.entry.installationId}\u2026`);
+  try {
+    const result = await dropTable(slug, ctx.requestOptions);
+    success(
+      `Dropped table ${code(slug)} (manifest_version=${result.manifest_version}). Physical table soft-deleted; recoverable for 30 days via the dashboard's trash.`
     );
-    info("");
+  } catch (err) {
+    return surfaceFailure(err);
   }
-  let shuttingDown = false;
-  const forwardSignal = (sig) => {
-    if (shuttingDown) return;
-    shuttingDown = true;
-    if (manifestPoll) {
-      manifestPoll.stop();
-      manifestPoll = null;
-    }
-    info(`
-Received ${sig}, stopping children\u2026`);
-    for (const { child } of children) {
-      if (child.exitCode === null && child.signalCode === null) {
-        child.kill(sig);
-      }
-    }
-    if (revokeDevSession) {
-      revokeDevSession().catch(() => {
-      });
-    }
-  };
-  process.on("SIGINT", () => forwardSignal("SIGINT"));
-  process.on("SIGTERM", () => forwardSignal("SIGTERM"));
-  const results = await Promise.all(
-    children.map(
-      ({ name, child }) => new Promise(
-        (resolveExit) => {
-          child.on("exit", (exitCode2, signal) => {
-            const killed = signal !== null;
-            const finalCode = exitCode2 ?? (killed ? 0 : 1);
-            resolveExit({ name, code: finalCode, killed });
-          });
-        }
-      )
-    )
-  );
-  const crashed = results.find((r) => !r.killed && r.code !== 0);
-  if (crashed && !shuttingDown) {
-    warn(`[${crashed.name}] exited with code ${crashed.code} \u2014 stopping others.`);
-    for (const { child } of children) {
-      if (child.exitCode === null && child.signalCode === null) {
-        child.kill("SIGTERM");
-      }
-    }
+  return syncLocalManifest(ctx);
+}
+var init_delete = __esm({
+  "src/commands/table/delete.ts"() {
+    init_api_client();
+    init_schema_command_context();
+    init_output();
+    init_create();
   }
-  if (manifestPoll) {
-    manifestPoll.stop();
-    manifestPoll = null;
+});
+
+// src/commands/field/add.ts
+var add_exports = {};
+__export(add_exports, {
+  fieldAddCommand: () => fieldAddCommand
+});
+async function fieldAddCommand(tableSlug, fieldSpec, options) {
+  if (!tableSlug) {
+    fail(
+      "Usage: `dashwise field add <table-slug> <field-slug>:<type>[:required]` or `dashwise field add <table-slug> --field-json '{...}'`"
+    );
+    return 1;
   }
-  const exitCode = Math.max(0, ...results.map((r) => r.code));
-  if (exitCode === 0) {
-    success("Dev loop stopped cleanly.");
+  const hasPositional = fieldSpec !== void 0;
+  const hasJson = options.fieldJson !== void 0;
+  if (!hasPositional && !hasJson) {
+    fail(
+      `Pass either a field spec (e.g. ${code("title:text:required")}) or ${code("--field-json")} with the field's JSON definition.`
+    );
+    return 1;
   }
-  return exitCode;
-}
-function spawnSdkWatcher(projectRoot, env) {
-  const child = spawn(
-    process.execPath,
-    [process.argv[1], "module", "dev", "--dir", projectRoot],
-    {
-      cwd: projectRoot,
-      env,
-      stdio: ["ignore", "pipe", "pipe"]
+  if (hasPositional && hasJson) {
+    fail(
+      `Pass only ONE of the field spec or ${code("--field-json")} \u2014 they're mutually exclusive.`
+    );
+    return 1;
+  }
+  let field;
+  try {
+    field = hasJson ? parseFieldJson(options.fieldJson) : parseFieldSpec(fieldSpec);
+  } catch (err) {
+    if (err instanceof FieldSpecError) {
+      fail(err.message);
+      return 1;
     }
-  );
-  return child;
-}
-function spawnNextDev(projectRoot, env, port) {
-  const portArgs = port !== void 0 ? ["--", "--port", String(port)] : [];
-  const hasDevNextScript = hasNpmScript(projectRoot, "dev:next");
-  const [cmd, args] = hasDevNextScript ? ["npm", ["run", "dev:next", ...portArgs]] : ["npx", ["next", "dev", ...port !== void 0 ? ["--port", String(port)] : []]];
-  const child = spawn(cmd, args, {
-    cwd: projectRoot,
-    env,
-    stdio: ["ignore", "pipe", "pipe"],
-    // Windows requires `shell: true` for `npm` / `npx` because they're
-    // `.cmd` shims, not real binaries.
-    shell: process.platform === "win32"
-  });
-  return child;
-}
-function hasNpmScript(projectRoot, scriptName) {
+    throw err;
+  }
+  let ctx;
   try {
-    const pkgPath = `${projectRoot}/package.json`;
-    if (!existsSync(pkgPath)) return false;
-    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-    return typeof pkg.scripts?.[scriptName] === "string";
-  } catch {
-    return false;
+    ctx = loadSchemaCommandContext({
+      ...options.dir !== void 0 ? { dir: options.dir } : {}
+    });
+  } catch (err) {
+    fail(err.message);
+    return 1;
   }
-}
-function pipeWithPrefix(src, dst, prefix) {
-  if (!src) return;
-  let leftover = "";
-  src.on("data", (chunk) => {
-    const text3 = typeof chunk === "string" ? chunk : chunk.toString("utf-8");
-    const combined = leftover + text3;
-    const lines = combined.split("\n");
-    leftover = lines.pop() ?? "";
-    for (const line of lines) {
-      dst.write(`${prefix}${line}
-`);
-    }
-  });
-  src.on("end", () => {
-    if (leftover.length > 0) {
-      dst.write(`${prefix}${leftover}
-`);
-    }
-  });
-}
-function maskedToken(token) {
-  if (token.length <= 12) return "****";
-  const prefix = token.slice(0, 4);
-  const tail = token.slice(-4);
-  return `${prefix}\u2026${tail}`;
-}
-async function resolveModuleApiKey(slug, entry, apiUrl, cliBearer) {
-  if (process.env.DASHWISE_API_KEY) return null;
-  if (!entry) return null;
-  if (entry.apiKey) return null;
-  if (!entry.installationId) return null;
   info(
-    `No usable ${code("dwk_")} API key cached for ${code(slug)} \u2014 minting a fresh one against dev install ${entry.installationId} (a stale CLI can cache an empty key)\u2026`
+    `Adding field ${code(`${tableSlug}.${field.slug}`)} (${field.type}) to installation ${ctx.entry.installationId}\u2026`
   );
-  let minted;
   try {
-    minted = await createApiKey(
-      entry.installationId,
-      { name: "local-dev" },
-      { baseUrl: apiUrl, auth: { token: cliBearer } }
+    const result = await addField(
+      { table_slug: tableSlug, field },
+      ctx.requestOptions
     );
-  } catch (err) {
-    if (err instanceof ApiError && err.code === "INSTALLATION_NOT_FOUND") {
-      warn(
-        `Could not upgrade credentials for ${code(slug)}: its dev install no longer exists. Run ${code(`dashwise init ${slug} --force`)} to re-provision (a clean re-register).`
-      );
-      return null;
-    }
-    const reason = err instanceof ApiError ? `${err.code}: ${err.message}` : err.message;
-    warn(
-      `Could not upgrade credentials for ${code(slug)} (${reason}). Data-plane calls may fail; run ${code(`dashwise init ${slug} --force`)} to refresh.`
+    success(
+      `Added field ${code(`${tableSlug}.${field.slug}`)} (manifest_version=${result.manifest_version})`
     );
-    return null;
+  } catch (err) {
+    return surfaceFailure(err);
   }
-  const upgraded = {
-    apiKey: minted.raw_key,
-    apiKeyId: minted.api_key.id,
-    installationId: entry.installationId,
-    expiresAt: minted.api_key.expires_at ?? entry.expiresAt
-  };
+  return syncLocalManifest(ctx);
+}
+var init_add = __esm({
+  "src/commands/field/add.ts"() {
+    init_api_client();
+    init_schema_command_context();
+    init_field_spec();
+    init_output();
+    init_create();
+  }
+});
+
+// src/commands/field/remove.ts
+var remove_exports = {};
+__export(remove_exports, {
+  fieldRemoveCommand: () => fieldRemoveCommand
+});
+async function fieldRemoveCommand(tableSlug, fieldSlug, options) {
+  if (!tableSlug || !fieldSlug) {
+    fail("Usage: `dashwise field remove <table-slug> <field-slug>`");
+    return 1;
+  }
+  let ctx;
   try {
-    upsertModuleEntry(slug, upgraded);
+    ctx = loadSchemaCommandContext({
+      ...options.dir !== void 0 ? { dir: options.dir } : {}
+    });
   } catch (err) {
-    warn(
-      `Minted a new API key for ${code(slug)} but failed to cache it: ${err.message}
-  API key (save manually): ${minted.raw_key}`
+    fail(err.message);
+    return 1;
+  }
+  info(
+    `Removing field ${code(`${tableSlug}.${fieldSlug}`)} from installation ${ctx.entry.installationId}\u2026`
+  );
+  try {
+    const result = await removeField(
+      tableSlug,
+      fieldSlug,
+      ctx.requestOptions
+    );
+    success(
+      `Removed field ${code(`${tableSlug}.${fieldSlug}`)} (manifest_version=${result.manifest_version})`
     );
+  } catch (err) {
+    return surfaceFailure(err);
   }
-  success(`Upgraded ${code(slug)} to a dwk_ API key (id=${minted.api_key.id}).`);
-  return upgraded;
-}
-function computeCallbackOrigins(port, extra) {
-  const def = `http://localhost:${port}`;
-  return Array.from(/* @__PURE__ */ new Set([def, ...extra]));
+  return syncLocalManifest(ctx);
 }
-var PORT_PROBE_LIMIT = 10;
-async function resolveDevPort(requested) {
-  if (requested !== void 0) {
-    if (await isPortFree(requested)) return requested;
-    const suggestion = await findFirstFreePort(requested + 1, PORT_PROBE_LIMIT);
-    const suggestionHint = suggestion !== null ? `Try \`dashwise dev --port ${suggestion}\`.` : `No free port found between ${requested + 1} and ${requested + PORT_PROBE_LIMIT} either \u2014 check what's listening with \`lsof -i :${requested}\`.`;
-    throw new Error(
-      `Port ${requested} is already in use. ${suggestionHint}`
+var init_remove = __esm({
+  "src/commands/field/remove.ts"() {
+    init_api_client();
+    init_schema_command_context();
+    init_output();
+    init_create();
+  }
+});
+
+// src/commands/field/set-type.ts
+var set_type_exports = {};
+__export(set_type_exports, {
+  fieldSetTypeCommand: () => fieldSetTypeCommand
+});
+async function fieldSetTypeCommand(tableSlug, fieldSlug, newType, options) {
+  if (!tableSlug || !fieldSlug || !newType) {
+    fail(
+      "Usage: `dashwise field set-type <table-slug> <field-slug> <new-type>`"
     );
+    return 1;
   }
-  const found = await findFirstFreePort(DEFAULT_NEXT_PORT, PORT_PROBE_LIMIT);
-  if (found === null) {
-    throw new Error(
-      `No free port found between ${DEFAULT_NEXT_PORT} and ${DEFAULT_NEXT_PORT + PORT_PROBE_LIMIT - 1}. Free a port (e.g. \`lsof -i :${DEFAULT_NEXT_PORT}\`) or pass \`--port <N>\` explicitly.`
+  if (!FIELD_TYPES.includes(newType)) {
+    fail(
+      `Type ${code(newType)} is not a known type. Allowed: ${FIELD_TYPES.join(", ")}.`
     );
+    return 1;
   }
-  return found;
-}
-async function isPortFree(port) {
-  const { createServer } = await import('net');
-  return new Promise((resolve13) => {
-    const server = createServer();
-    server.once("error", () => {
-      resolve13(false);
-    });
-    server.once("listening", () => {
-      server.close(() => resolve13(true));
+  let ctx;
+  try {
+    ctx = loadSchemaCommandContext({
+      ...options.dir !== void 0 ? { dir: options.dir } : {}
     });
-    server.listen(port, "0.0.0.0");
-  });
-}
-async function findFirstFreePort(start, limit) {
-  for (let i = 0; i < limit; i++) {
-    const port = start + i;
-    if (await isPortFree(port)) return port;
+  } catch (err) {
+    fail(err.message);
+    return 1;
   }
-  return null;
-}
-async function resolveTargetWorkspace(apiUrl, apiToken, flag) {
-  const workspaces = await apiRequest(
-    "GET",
-    "/api/workspaces",
-    void 0,
-    { baseUrl: apiUrl, auth: { token: apiToken } }
+  info(
+    `Setting type of ${code(`${tableSlug}.${fieldSlug}`)} \u2192 ${code(newType)} on installation ${ctx.entry.installationId}\u2026`
   );
-  if (workspaces.length === 0) {
-    throw new Error(
-      "No workspaces found for your account. Create a workspace at the DashWise dashboard first."
-    );
-  }
-  if (flag === void 0) {
-    if (workspaces.length === 1) {
-      return workspaces[0];
-    }
-    const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id}, name="${w.name}")`).join("\n");
-    throw new Error(
-      `You have ${workspaces.length} workspaces. Re-run with --workspace <slug-or-id> to pick one:
-${list}`
+  try {
+    const result = await updateField(
+      tableSlug,
+      fieldSlug,
+      { type: newType },
+      ctx.requestOptions
     );
-  }
-  const asNumber = Number.parseInt(flag, 10);
-  const isNumeric = !Number.isNaN(asNumber) && String(asNumber) === flag;
-  const match = isNumeric ? workspaces.find((w) => w.id === asNumber) : workspaces.find((w) => w.slug === flag);
-  if (!match) {
-    const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id})`).join("\n");
-    throw new Error(
-      `No workspace matching --workspace=${flag}. Available:
-${list}`
+    success(
+      `Updated ${code(`${tableSlug}.${fieldSlug}`)} \u2192 ${code(newType)} (manifest_version=${result.manifest_version})`
     );
+  } catch (err) {
+    return surfaceFailure(err);
   }
-  return match;
-}
-async function registerDevSession(apiUrl, apiToken, body) {
-  return apiRequest(
-    "POST",
-    "/api/auth/dev/sessions",
-    body,
-    { baseUrl: apiUrl, auth: { token: apiToken } }
-  );
-}
-async function revokeDevSessionBestEffort(apiUrl, apiToken, id) {
-  await apiRequest(
-    "DELETE",
-    `/api/auth/dev/sessions/${encodeURIComponent(id)}`,
-    void 0,
-    { baseUrl: apiUrl, auth: { token: apiToken } }
-  );
+  return syncLocalManifest(ctx);
 }
+var init_set_type = __esm({
+  "src/commands/field/set-type.ts"() {
+    init_api_client();
+    init_schema_command_context();
+    init_field_spec();
+    init_output();
+    init_create();
+  }
+});
+
+// src/bin.ts
+init_dev();
 
 // src/commands/login.ts
 init_api_client();
@@ -5534,6 +6349,7 @@ async function moduleInstallCommand(slugArg, options) {
   if (isInstallGated(result)) {
     if (options.json) {
       out(JSON.stringify(result));
+      if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
       return 0;
     }
     success(
@@ -5542,6 +6358,7 @@ async function moduleInstallCommand(slugArg, options) {
     info(
       `This module requires author approval before it installs. Once approved, check with ${code(`dashwise module status ${mod.slug} --workspace ${workspace2.slug}`)}.`
     );
+    if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
     return 0;
   }
   let row;
@@ -5566,6 +6383,7 @@ async function moduleInstallCommand(slugArg, options) {
         verified
       })
     );
+    if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
     return 0;
   }
   if (!verified) {
@@ -5575,6 +6393,7 @@ async function moduleInstallCommand(slugArg, options) {
     info(
       `The verification read failed \u2014 run ${code(`dashwise module status ${mod.slug} --workspace ${workspace2.slug}`)} to see the deploy state and public URL.`
     );
+    if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
     return 0;
   }
   if (runtimeProvisioned && publicUrl) {
@@ -5599,8 +6418,21 @@ async function moduleInstallCommand(slugArg, options) {
       `No public URL yet \u2014 runtime provisioning didn't complete. Re-running ${code("dashwise module install")} is idempotent and repairs a failed provision.`
     );
   }
+  if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
   return 0;
 }
+function publishedModuleLocalDevGuidance(slug) {
+  return `Re-provision local dev any time with ${code(`dashwise init ${slug} --workspace <ws>`)} (or ${code("dashwise module reset-dev-install")}) \u2014 requires backend \u2265 2026-07-15; the fresh dev install COEXISTS with the production install.
+    Older backends 409 SLUG_ALREADY_EXISTS on that path (no re-provision anywhere). Fallback for them (production repair):
+    - Develop against the production install with a scoped key: ${code(`dashwise api-keys create local-dev --install <id> --full-access`)} + ${code(`dashwise origins add http://localhost:3000 --install <id>`)} (id via ${code(`dashwise module status ${slug}`)}), then run bare ${code("next dev")} \u2014 and CLEAN UP after (revoke the key, remove the origin).
+    - Or duplicate the code under a NEW slug for greenfield iteration.`;
+}
+function printDevInstallAftermath(slug, workspaceSlug) {
+  warn(
+    `Local dev for ${code(slug)} is DISCONNECTED (the dev install in ${code(workspaceSlug)} and its ${code("dwk_")} key were destroyed).
+  ${publishedModuleLocalDevGuidance(slug)}`
+  );
+}
 function resolveSlug(slugArg, dir) {
   if (slugArg) return slugArg;
   try {
@@ -5621,11 +6453,14 @@ async function resolveDevInstallCollision(existing, slug, workspaceSlug, options
     return 1;
   }
   const explanation = `Workspace ${code(workspaceSlug)} already has the DEV install of ${code(slug)} (kind=local, id=${existing.id}) created by ${code("dashwise init")}.
-  Only ONE install per (workspace, module) can exist, and ${code("kind")} is immutable: a plain install would upgrade that row in place \u2014 the runtime would provision, but it would STAY a dev install, hidden from the app sidebar.
+  Install ${code("kind")} is immutable: a plain install could land on that row's upgrade path \u2014 the runtime would provision, but it would STAY a dev install, hidden from the app sidebar.
   Options:
-    - ${code("--replace-dev-install")} \u2014 destroy the dev install, then fresh production install. Recommended when development is done. Note: this revokes the module's cached local-dev credentials, so local ${code("dashwise dev")} against this workspace needs a fresh ${code("dashwise init --force")} afterwards (which in turn cannot coexist with the production install here).
+    - ${code("--replace-dev-install")} \u2014 destroy the dev install, then fresh production install. Recommended when development is done. Local dev can be re-provisioned afterwards with ${code(`dashwise init ${slug} --workspace <ws>`)} on backends \u2265 2026-07-15 (dev + production installs coexist); on OLDER backends this is one-way \u2014 no re-provision anywhere once published (interim: a scoped key on the production install via ${code("api-keys create --install <id> --full-access")}, or duplicate the code under a NEW slug).
     - ${code("--workspace <other>")} \u2014 deploy to a separate test/client workspace and keep this dev install. Recommended for ongoing development.`;
-  if (options.replaceDevInstall) return "replace";
+  if (options.replaceDevInstall) {
+    info(explanation);
+    return "replace";
+  }
   if (process.stdout.isTTY && !options.yes) {
     info(explanation);
     const answer = await select({
@@ -5634,7 +6469,7 @@ async function resolveDevInstallCollision(existing, slug, workspaceSlug, options
         {
           value: "replace",
           label: "Replace \u2014 destroy the dev install, then production-install",
-          hint: "local `dashwise dev` here will need `dashwise init --force` afterwards"
+          hint: "revokes local-dev credentials; re-provision later via `dashwise init` (backend \u2265 2026-07-15 \u2014 older backends: scoped-key repair only)"
         },
         { value: "cancel", label: "Cancel \u2014 I will deploy to another workspace" }
       ],
@@ -5670,9 +6505,7 @@ async function replaceDevInstall(existing, slug, auth) {
   if (entry && entry.installationId === existing.id) {
     try {
       removeModuleEntry(slug);
-      info(
-        `Removed ${code(slug)} from auth.json \u2014 its local-dev credentials are revoked. Local ${code("dashwise dev")} needs ${code("dashwise init --force")} (ideally against a different workspace).`
-      );
+      info(`Removed ${code(slug)} from auth.json \u2014 its local-dev credentials are revoked.`);
     } catch (err) {
       warn(
         `Dev install destroyed but auth.json cleanup failed: ${err.message}. Remove the ${code(`modules["${slug}"]`)} entry from ${code("~/.config/dashwise/auth.json")} manually.`
@@ -5721,7 +6554,8 @@ function surfaceInstallError(err, slug, workspaceSlug, devInstallReplaced) {
   }
   if (devInstallReplaced) {
     warn(
-      `Note: the dev install was already removed (that is not rolled back). Re-run ${code("dashwise module install")} to complete the production install, or ${code("dashwise init --force")} to restore local dev.`
+      `Note: the dev install was already removed (that is not rolled back). Re-run ${code("dashwise module install")} to complete the production install.
+  ${publishedModuleLocalDevGuidance(slug)}`
     );
   }
   return 1;
@@ -6214,7 +7048,131 @@ async function moduleStatusCommand(slugArg, options) {
   }
   if (!slug) {
     fail(
-      `No module slug \u2014 pass one (${code("dashwise module status <slug>")}) or run from a directory with a valid module.json.`
+      `No module slug \u2014 pass one (${code("dashwise module status <slug>")}) or run from a directory with a valid module.json.`
+    );
+    return 1;
+  }
+  if (!isLoggedIn()) {
+    fail(`Not logged in. Run ${code("dashwise login")} first.`);
+    return 1;
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    fail(`CLI config missing. Run ${code("dashwise login")}.`);
+    return 1;
+  }
+  const auth = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
+  let mod;
+  try {
+    mod = await getModuleBySlug(slug, auth);
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      fail(`Module ${code(slug)} not found on the backend.`);
+      return 1;
+    }
+    fail(`Could not resolve module ${code(slug)}: ${err.message}`);
+    return 1;
+  }
+  let workspace2;
+  try {
+    workspace2 = await resolveWorkspaceWithFallback({
+      userFlag: options.workspace,
+      cachedWorkspaceId: readModuleEntry(slug)?.workspaceId,
+      configDefault: cfg.workspaceSlug,
+      apiUrl: resolveApiUrl(),
+      apiToken: cfg.token
+    });
+  } catch (err) {
+    fail(`Workspace selection failed: ${err.message}`);
+    return 1;
+  }
+  let row;
+  try {
+    const installs = await listWorkspaceInstallations(workspace2.id, auth);
+    row = installs.find((r) => r.module_id === mod.id);
+  } catch (err) {
+    fail(`Could not read workspace installations: ${err.message}`);
+    return 1;
+  }
+  const latestVersion = row?.module?.current_version ?? mod.current_version;
+  if (!row) {
+    if (options.json) {
+      out(
+        JSON.stringify({
+          installed: false,
+          module: mod.slug,
+          workspace: { id: workspace2.id, slug: workspace2.slug },
+          latest_version: latestVersion
+        })
+      );
+      return 0;
+    }
+    info(
+      `${code(mod.slug)} is not installed in workspace ${code(workspace2.slug)}.` + (latestVersion ? ` Deploy it with ${code(`dashwise module install ${mod.slug} --workspace ${workspace2.slug}`)}.` : ` It has no published version yet \u2014 run ${code("dashwise module publish")} first.`)
+    );
+    return 0;
+  }
+  const runtimeProvisioned = isRealRuntimeUrl(row.runtime_url);
+  const state = runtimeProvisioned && row.public_url ? "live" : runtimeProvisioned ? "deployed" : "not_deployed";
+  const installedVersion = row.module_version?.version ?? null;
+  const updateAvailable = isUpdateAvailable(installedVersion, latestVersion);
+  if (options.json) {
+    out(
+      JSON.stringify({
+        installed: true,
+        module: mod.slug,
+        workspace: { id: workspace2.id, slug: workspace2.slug },
+        installation_id: row.id,
+        kind: row.kind ?? null,
+        version: installedVersion,
+        latest_version: latestVersion,
+        update_available: updateAvailable,
+        runtime_provisioned: runtimeProvisioned,
+        runtime_url: row.runtime_url,
+        public_url: row.public_url,
+        state
+      })
+    );
+    return 0;
+  }
+  const stateLabel = state === "live" ? "Live" : state === "deployed" ? "Deployed" : "Not deployed \u2014 runtime not provisioned";
+  out("");
+  kv("Module:", `${mod.slug} ${dim(`(id ${mod.id})`)}`);
+  kv("Workspace:", `${workspace2.slug} ${dim(`(id ${workspace2.id})`)}`);
+  kv("Install:", `#${row.id} ${dim(`(kind=${row.kind ?? "unknown"})`)}`);
+  kv(
+    "Version:",
+    `${installedVersion ?? dim("(unknown)")}${updateAvailable ? `  ${code(`update available: v${latestVersion} \u2014 run \`dashwise module install ${mod.slug}\``)}` : latestVersion ? `  ${dim(`(latest published: v${latestVersion})`)}` : ""}`
+  );
+  kv(
+    "Runtime:",
+    runtimeProvisioned ? `provisioned ${dim(`(${row.runtime_url})`)}` : "not provisioned"
+  );
+  kv("Public URL:", row.public_url ?? dim("(none)"));
+  kv("State:", stateLabel);
+  out("");
+  if (row.kind === "local") {
+    info(
+      `This is the ${code("kind=local")} dev install \u2014 hidden from the app sidebar. A production deploy needs ${code("dashwise module install --replace-dev-install")} (or ${code("--workspace <other>")}).`
+    );
+  } else if (state === "not_deployed") {
+    info(
+      `Re-run ${code(`dashwise module install ${mod.slug} --workspace ${workspace2.slug}`)} to (re-)provision the runtime \u2014 the install POST is idempotent.`
+    );
+  }
+  return 0;
+}
+
+// src/commands/module/uninstall.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+async function moduleUninstallCommand(slugArg, options) {
+  const slug = resolveSlug2(slugArg, options.dir);
+  if (!slug) {
+    fail(
+      `No module slug \u2014 pass one (${code("dashwise module uninstall <slug>")}) or run from a directory with a valid module.json.`
     );
     return 1;
   }
@@ -6233,7 +7191,7 @@ async function moduleStatusCommand(slugArg, options) {
     mod = await getModuleBySlug(slug, auth);
   } catch (err) {
     if (err instanceof ApiError && err.status === 404) {
-      fail(`Module ${code(slug)} not found on the backend.`);
+      fail(`Module ${code(slug)} not found on the backend \u2014 nothing to uninstall.`);
       return 1;
     }
     fail(`Could not resolve module ${code(slug)}: ${err.message}`);
@@ -6260,74 +7218,119 @@ async function moduleStatusCommand(slugArg, options) {
     fail(`Could not read workspace installations: ${err.message}`);
     return 1;
   }
-  const latestVersion = row?.module?.current_version ?? mod.current_version;
   if (!row) {
-    if (options.json) {
-      out(
-        JSON.stringify({
-          installed: false,
-          module: mod.slug,
-          workspace: { id: workspace2.id, slug: workspace2.slug },
-          latest_version: latestVersion
-        })
+    fail(
+      `${code(mod.slug)} is not installed in workspace ${code(workspace2.slug)} \u2014 nothing to uninstall.`
+    );
+    return 1;
+  }
+  if (row.kind === "local") {
+    fail(
+      `Install ${code(`#${row.id}`)} of ${code(mod.slug)} in ${code(workspace2.slug)} is the ${code("kind=local")} DEV install backing local development.
+  Use ${code("dashwise module destroy-dev-install")} (or ${code("dashwise module reset-dev-install")} for a clean re-provision) instead \u2014 it also revokes the cached local-dev credentials.`
+    );
+    return 1;
+  }
+  const scriptedOk = options.yes === true && options.workspace !== void 0;
+  if (!scriptedOk) {
+    if (!process.stdout.isTTY) {
+      fail(
+        `Refusing to uninstall without confirmation. In scripts, pass BOTH ${code("--yes")} AND an explicit ${code("--workspace <slug-or-id>")} (a bare ${code("--yes")} never uninstalls from an implicitly-resolved workspace).`
       );
-      return 0;
+      return 1;
     }
     info(
-      `${code(mod.slug)} is not installed in workspace ${code(workspace2.slug)}.` + (latestVersion ? ` Deploy it with ${code(`dashwise module install ${mod.slug} --workspace ${workspace2.slug}`)}.` : ` It has no published version yet \u2014 run ${code("dashwise module publish")} first.`)
+      `Uninstalling ${code(mod.slug)} (install ${code(`#${row.id}`)}, kind=${row.kind ?? "production"}${row.module_version?.version ? `, v${row.module_version.version}` : ""}) from workspace ${code(workspace2.slug)}.
+  The app is soft-deleted, recoverable ONLY by a PLATFORM OPERATOR (contact support/HQ) within ~7 days \u2014 it does NOT appear in your dashboard trash.
+  An operator restore KEEPS the public URL${row.public_url ? ` ${code(row.public_url)}` : ""}; a REINSTALL mints a NEW one \u2014 deep links to the old URL break.`
     );
-    return 0;
+    const answer = await select({
+      message: `Uninstall ${code(mod.slug)} from ${code(workspace2.slug)}?`,
+      options: [
+        { value: "uninstall", label: "Uninstall \u2014 soft-delete the app (operator-restorable ~7 days)" },
+        { value: "cancel", label: "Cancel \u2014 nothing is changed" }
+      ],
+      initialValue: "cancel"
+    });
+    if (isCancel(answer) || answer === "cancel") {
+      fail("Aborted. Nothing was changed.");
+      return 130;
+    }
+    const typed = await text({
+      message: `Type the module slug (${code(mod.slug)}) to confirm:`
+    });
+    if (isCancel(typed) || typed !== mod.slug) {
+      fail(
+        `Confirmation did not match ${code(mod.slug)}. Aborted \u2014 nothing was changed.`
+      );
+      return 130;
+    }
   }
-  const runtimeProvisioned = isRealRuntimeUrl(row.runtime_url);
-  const state = runtimeProvisioned && row.public_url ? "live" : runtimeProvisioned ? "deployed" : "not_deployed";
-  const installedVersion = row.module_version?.version ?? null;
-  const updateAvailable = isUpdateAvailable(installedVersion, latestVersion);
-  if (options.json) {
-    out(
-      JSON.stringify({
-        installed: true,
-        module: mod.slug,
-        workspace: { id: workspace2.id, slug: workspace2.slug },
-        installation_id: row.id,
-        kind: row.kind ?? null,
-        version: installedVersion,
-        latest_version: latestVersion,
-        update_available: updateAvailable,
-        runtime_provisioned: runtimeProvisioned,
-        runtime_url: row.runtime_url,
-        public_url: row.public_url,
-        state
-      })
+  try {
+    await uninstallModuleInstallation(
+      row.id,
+      { ...options.parkConsumers ? { parkConsumers: true } : {} },
+      auth
     );
-    return 0;
+  } catch (err) {
+    return surfaceUninstallError(err, mod.slug, workspace2.slug);
   }
-  const stateLabel = state === "live" ? "Live" : state === "deployed" ? "Deployed" : "Not deployed \u2014 runtime not provisioned";
-  out("");
-  kv("Module:", `${mod.slug} ${dim(`(id ${mod.id})`)}`);
-  kv("Workspace:", `${workspace2.slug} ${dim(`(id ${workspace2.id})`)}`);
-  kv("Install:", `#${row.id} ${dim(`(kind=${row.kind ?? "unknown"})`)}`);
-  kv(
-    "Version:",
-    `${installedVersion ?? dim("(unknown)")}${updateAvailable ? `  ${code(`update available: v${latestVersion} \u2014 run \`dashwise module install ${mod.slug}\``)}` : latestVersion ? `  ${dim(`(latest published: v${latestVersion})`)}` : ""}`
+  success(
+    `Uninstalled ${code(mod.slug)} (install ${code(`#${row.id}`)}) from workspace ${code(workspace2.slug)}.`
   );
-  kv(
-    "Runtime:",
-    runtimeProvisioned ? `provisioned ${dim(`(${row.runtime_url})`)}` : "not provisioned"
+  info(
+    `The app was soft-deleted. If this was a mistake: only a PLATFORM OPERATOR can restore it (contact support/HQ) within ~7 days \u2014 it does NOT appear in your dashboard trash. An operator restore keeps the same public URL.
+  Reinstalling instead (${code(`dashwise module install ${mod.slug} --workspace ${workspace2.slug}`)}) mints a NEW public URL.`
   );
-  kv("Public URL:", row.public_url ?? dim("(none)"));
-  kv("State:", stateLabel);
-  out("");
-  if (row.kind === "local") {
-    info(
-      `This is the ${code("kind=local")} dev install \u2014 hidden from the app sidebar. A production deploy needs ${code("dashwise module install --replace-dev-install")} (or ${code("--workspace <other>")}).`
-    );
-  } else if (state === "not_deployed") {
+  if (options.parkConsumers) {
     info(
-      `Re-run ${code(`dashwise module install ${mod.slug} --workspace ${workspace2.slug}`)} to (re-)provision the runtime \u2014 the install POST is idempotent.`
+      `Consumer modules that depended on this install were parked (reason PROVIDER_UNINSTALLED) \u2014 they keep running with the dependency unbound until re-bound.`
     );
   }
   return 0;
 }
+function resolveSlug2(slugArg, dir) {
+  if (slugArg) return slugArg;
+  try {
+    const manifest = readManifest(dir);
+    const slug = manifest?.module?.slug;
+    return typeof slug === "string" && slug.length > 0 ? slug : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function surfaceUninstallError(err, slug, workspaceSlug) {
+  if (err instanceof ApiError) {
+    if (err.status === 404 || err.code === "NOT_FOUND" || err.code === "INSTALLATION_NOT_FOUND") {
+      warn(`The install is already gone server-side \u2014 nothing to do.`);
+      return 0;
+    }
+    switch (err.code) {
+      case "PROVIDER_HAS_CONSUMERS":
+        fail(
+          `${code(slug)} provides data to other installed modules \u2014 uninstalling it would break them.
+  Re-run with ${code("--park-consumers")} to uninstall anyway: each consumer's dependency is parked (reason PROVIDER_UNINSTALLED) and the consumers keep running with that dependency unbound.`
+        );
+        break;
+      case "NOT_WORKSPACE_ADMIN":
+      case "FORBIDDEN":
+        fail(
+          `You must be an ADMIN of workspace ${code(workspaceSlug)} to uninstall modules from it.`
+        );
+        break;
+      case "UNAUTHENTICATED":
+        fail(
+          `Auth rejected by the backend \u2014 your CLI token may be stale. Re-run ${code("dashwise login")} and try again.`
+        );
+        break;
+      default:
+        fail(`Uninstall failed (${err.code} ${err.status}): ${err.message}`);
+    }
+    return 1;
+  }
+  fail(`Uninstall failed: ${err.message}`);
+  return 1;
+}
 
 // src/commands/module/pull-data.ts
 init_api_client();
@@ -7099,7 +8102,7 @@ function loadContext(opts) {
   const entry = readModuleEntry(slug);
   if (!entry) {
     throw new Error(
-      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug}\` to provision one (existing files are preserved).`
     );
   }
   return {
@@ -7324,7 +8327,7 @@ function loadContext2(opts) {
   const entry = readModuleEntry(slug);
   if (!entry) {
     throw new Error(
-      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug}\` to provision one (existing files are preserved).`
     );
   }
   return {
@@ -7916,7 +8919,7 @@ function loadContext3(opts) {
   const entry = readModuleEntry(moduleSlug);
   if (!entry) {
     throw new Error(
-      `No dev install cached for module "${moduleSlug}". Run \`dashwise init ${moduleSlug} --force\` to provision one.`
+      `No dev install cached for module "${moduleSlug}". Run \`dashwise init ${moduleSlug}\` to provision one (existing files are preserved).`
     );
   }
   return {
@@ -8112,17 +9115,17 @@ function surfacePullFailure(err) {
     switch (err.code) {
       case "UNAUTHENTICATED":
         fail(
-          `Runtime token rejected. The cached token for this module may be expired \u2014 re-run \`dashwise init <slug> --force\` to mint a fresh one.`
+          `Runtime token rejected. The cached token for this module may be expired \u2014 re-run \`dashwise init <slug>\` to mint a fresh one (existing files are preserved).`
         );
         break;
       case "SANDBOX_TOKEN_NOT_ACCEPTED":
         fail(
-          `Schema-read endpoint requires a local-dev runtime token (kind=local). The cached token is the wrong kind \u2014 re-run \`dashwise init <slug> --force\`.`
+          `Schema-read endpoint requires a local-dev runtime token (kind=local). The cached token is the wrong kind \u2014 re-run \`dashwise init <slug>\`.`
         );
         break;
       case "INSTALL_MISMATCH":
         fail(
-          `Runtime token is bound to a different installation than expected. The cached install id may be stale \u2014 re-run \`dashwise init <slug> --force\`.`
+          `Runtime token is bound to a different installation than expected. The cached install id may be stale \u2014 re-run \`dashwise init <slug>\`.`
         );
         break;
       case "INSTALLATION_NOT_FOUND":
@@ -8148,6 +9151,32 @@ init_config();
 init_manifest_io();
 init_output();
 function loadContext4(opts) {
+  const cfg = readConfig();
+  if (!cfg) {
+    throw new Error("Not logged in. Run `dashwise login` first.");
+  }
+  const requestOptions = {
+    baseUrl: resolveApiUrl(),
+    auth: { token: cfg.token }
+  };
+  if (opts.install !== void 0) {
+    if (!Number.isInteger(opts.install) || opts.install <= 0) {
+      throw new Error(
+        `--install expects a positive integer installation id (got "${opts.install}").`
+      );
+    }
+    let slug2;
+    try {
+      slug2 = readManifest(opts.dir)?.module?.slug;
+    } catch {
+    }
+    return {
+      installationId: opts.install,
+      slug: slug2 ?? `install#${opts.install}`,
+      installOverride: true,
+      requestOptions
+    };
+  }
   const manifest = readManifestOrThrow(opts.dir);
   const slug = manifest.module?.slug;
   if (!slug) {
@@ -8155,25 +9184,36 @@ function loadContext4(opts) {
       `module.json has no module.slug \u2014 the manifest is malformed.`
     );
   }
-  const cfg = readConfig();
-  if (!cfg) {
-    throw new Error("Not logged in. Run `dashwise login` first.");
-  }
   const entry = readModuleEntry(slug);
   if (!entry) {
     throw new Error(
-      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug}\` to provision one (existing files are preserved), or pass \`--install <id>\` to target any installation (production included) \u2014 find ids via \`dashwise module status ${slug}\`.`
     );
   }
   return {
     installationId: entry.installationId,
     slug,
-    requestOptions: {
-      baseUrl: resolveApiUrl(),
-      auth: { token: cfg.token }
-    }
+    installOverride: false,
+    requestOptions
   };
 }
+async function resolveInstallKind(ctx) {
+  if (!ctx.installOverride) return "local";
+  const entry = readModuleEntry(ctx.slug);
+  if (entry && entry.installationId === ctx.installationId) return "local";
+  if (entry?.workspaceId !== void 0) {
+    try {
+      const rows = await listWorkspaceInstallations(
+        entry.workspaceId,
+        ctx.requestOptions
+      );
+      const row = rows.find((r) => r.id === ctx.installationId);
+      if (row) return row.kind ?? "production";
+    } catch {
+    }
+  }
+  return void 0;
+}
 async function apiKeysListCommand(options) {
   let ctx;
   try {
@@ -8201,6 +9241,7 @@ async function apiKeysListCommand(options) {
     );
     return 0;
   }
+  const installKind = await resolveInstallKind(ctx);
   info(`API keys for ${code(ctx.slug)} (install id=${ctx.installationId}):`);
   for (const k of filtered) {
     const status = formatKeyStatus(k);
@@ -8216,7 +9257,8 @@ async function apiKeysListCommand(options) {
 `);
       }
     } else if (k.grants !== void 0) {
-      process.stdout.write(`      ${dim("full install access (no grants)")}
+      const label = installKind === "local" ? "full own-table access (local dev install)" : "NO access \u2014 grantless key on a non-local install (mint with --grant or --full-access)";
+      process.stdout.write(`      ${dim(label)}
 `);
     }
   }
@@ -8228,6 +9270,12 @@ async function apiKeysCreateCommand(nameArg, options) {
     fail("Usage: `dashwise api-keys create <name>` (e.g. `dashwise api-keys create production`)");
     return 1;
   }
+  if (options.fullAccess && options.grant && options.grant.length > 0) {
+    fail(
+      `${code("--full-access")} and ${code("--grant")} are mutually exclusive \u2014 pass one or the other.`
+    );
+    return 1;
+  }
   let grants;
   try {
     grants = parseGrants(options.grant);
@@ -8249,8 +9297,18 @@ async function apiKeysCreateCommand(nameArg, options) {
     fail(err.message);
     return 1;
   }
+  const installKind = await resolveInstallKind(ctx);
+  const grantless = grants === void 0 && options.fullAccess !== true;
+  if (grantless && installKind !== "local") {
+    warn(
+      `MINTING A DENY-ALL KEY: install ${code(String(ctx.installationId))} is ${installKind ? `kind=${installKind}` : "not the local dev install"}, and a grantless key on a non-local install can access NOTHING \u2014 every data-plane call will 403.
+  Pass ${code("--full-access")} for full-CRUD over the module's own tables, or ${code("--grant <spec>")} for least-privilege scopes.
+  (Grantless = full own-table access is a ${code("kind=local")} dev-install convenience only.)`
+    );
+  }
   const body = { name };
   if (grants !== void 0) body.grants = grants;
+  if (options.fullAccess === true) body.full_own_tables = true;
   if (expiresAt !== void 0) body.expires_at = expiresAt;
   let resp;
   try {
@@ -8274,8 +9332,12 @@ async function apiKeysCreateCommand(nameArg, options) {
   if (grantLines.length > 0) {
     info(`  ${dim("scope:")} scoped to`);
     for (const line of grantLines) info(`    ${line}`);
+  } else if (installKind === "local") {
+    info(`  ${dim("scope:")} full own-table access (grantless key on the local dev install)`);
   } else {
-    info(`  ${dim("scope:")} full install access (no grants)`);
+    info(
+      `  ${dim("scope:")} NO access \u2014 grantless key on a non-local install (re-mint with ${code("--full-access")} or ${code("--grant")})`
+    );
   }
   info("");
   warn(
@@ -8347,6 +9409,11 @@ function surfaceApiKeysError(err) {
           `A --grant referenced a table/app the backend rejected (${err.message}). Data Hub grants need a table or app that exists in this workspace; module grants need a table your manifest owns.`
         );
         return 1;
+      case "GRANTS_CONFLICT":
+        fail(
+          `--full-access and --grant are mutually exclusive \u2014 pass one or the other.`
+        );
+        return 1;
       case "INSTALLATION_NOT_FOUND":
         fail(
           `Installation not found. It may have been destroyed; re-provision via ${code("dashwise init <slug>")}.`
@@ -8501,6 +9568,31 @@ init_config();
 init_manifest_io();
 init_output();
 function loadContext5(opts) {
+  const cfg = readConfig();
+  if (!cfg) {
+    throw new Error("Not logged in. Run `dashwise login` first.");
+  }
+  const requestOptions = {
+    baseUrl: resolveApiUrl(),
+    auth: { token: cfg.token }
+  };
+  if (opts.install !== void 0) {
+    if (!Number.isInteger(opts.install) || opts.install <= 0) {
+      throw new Error(
+        `--install expects a positive integer installation id (got "${opts.install}").`
+      );
+    }
+    let slug2;
+    try {
+      slug2 = readManifest(opts.dir)?.module?.slug;
+    } catch {
+    }
+    return {
+      installationId: opts.install,
+      slug: slug2 ?? `install#${opts.install}`,
+      requestOptions
+    };
+  }
   const manifest = readManifestOrThrow(opts.dir);
   const slug = manifest.module?.slug;
   if (!slug) {
@@ -8508,23 +9600,16 @@ function loadContext5(opts) {
       `module.json has no module.slug \u2014 the manifest is malformed.`
     );
   }
-  const cfg = readConfig();
-  if (!cfg) {
-    throw new Error("Not logged in. Run `dashwise login` first.");
-  }
   const entry = readModuleEntry(slug);
   if (!entry) {
     throw new Error(
-      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug}\` to provision one (existing files are preserved), or pass \`--install <id>\` to target any installation (production included) \u2014 find ids via \`dashwise module status ${slug}\`.`
     );
   }
   return {
     installationId: entry.installationId,
     slug,
-    requestOptions: {
-      baseUrl: resolveApiUrl(),
-      auth: { token: cfg.token }
-    }
+    requestOptions
   };
 }
 function normalizeOrigin(raw) {
@@ -8719,7 +9804,7 @@ async function envExportCommand(options) {
   const entry = readModuleEntry(slug);
   if (!entry) {
     fail(
-      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug}\` to provision one (existing files are preserved).`
     );
     return 1;
   }
@@ -8826,12 +9911,16 @@ function shellQuote(value) {
 }
 
 // src/commands/query.ts
+init_config();
+init_dotenv_local();
 init_manifest_io();
 init_output();
+init_dev();
 async function queryCommand(options) {
   const projectRoot = resolve(options.dir ?? process.cwd());
+  let manifestSlug;
   try {
-    readManifestOrThrow(projectRoot);
+    manifestSlug = readManifestOrThrow(projectRoot).module?.slug;
   } catch (err) {
     fail(err.message);
     return 1;
@@ -8849,6 +9938,32 @@ async function queryCommand(options) {
     return 1;
   }
   hydrateEnvFromDotenvLocal(projectRoot);
+  if (!process.env.DASHWISE_API_KEY && manifestSlug) {
+    const cfg = (() => {
+      try {
+        return readConfig();
+      } catch {
+        return null;
+      }
+    })();
+    const apiUrl = process.env.DASHWISE_API_URL ?? cfg?.apiUrl ?? "http://localhost:3000";
+    let entry = readModuleEntry(manifestSlug);
+    if (cfg) {
+      const healed = await resolveModuleApiKey(
+        manifestSlug,
+        entry,
+        apiUrl,
+        cfg.token
+      );
+      if (healed) entry = healed;
+    }
+    if (entry?.apiKey) {
+      process.env.DASHWISE_API_KEY = entry.apiKey;
+      if (!process.env.DASHWISE_API_URL) {
+        process.env.DASHWISE_API_URL = apiUrl;
+      }
+    }
+  }
   const modes = [
     options.inline !== void 0 ? "inline" : null,
     options.file !== void 0 ? "file" : null,
@@ -9025,25 +10140,6 @@ function generatedEntryUrl(generatedDir) {
 async function dynamicImportFromPath(generatedDir) {
   return await import(generatedEntryUrl(generatedDir));
 }
-function hydrateEnvFromDotenvLocal(projectRoot) {
-  const envFile = join(projectRoot, ".env.local");
-  if (!existsSync(envFile)) return;
-  const raw = readFileSync(envFile, "utf-8");
-  for (const line of raw.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq <= 0) continue;
-    const key = trimmed.slice(0, eq).trim();
-    let value = trimmed.slice(eq + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-      value = value.slice(1, -1);
-    }
-    if (process.env[key] === void 0) {
-      process.env[key] = value;
-    }
-  }
-}
 
 // src/commands/module/query-log.ts
 init_api_client();
@@ -9487,7 +10583,7 @@ var initOptions = (cmd) => cmd.option("--dir <path>", "Override the target direc
   "Target workspace for the dev installation (slug or numeric id). When omitted in a TTY, the CLI prompts; in non-interactive mode it auto-picks when you have one workspace and errors out otherwise."
 ).option(
   "--no-provision",
-  "Skip the `POST /api/installations/dev` step. Local scaffold is still written; you can provision later by re-running `dashwise init --force` (or, once it ships, `dashwise module provision-dev-install`)."
+  "Skip the `POST /api/installations/dev` step. Local scaffold is still written; provision later by re-running `dashwise init <slug>` in the project dir (existing files are preserved \u2014 only missing ones are written)."
 ).addOption(
   new Option(
     "--deploy-target <platform>",
@@ -9754,6 +10850,14 @@ program.command("query").description(
     });
   }
 );
+program.command("run [cmd...]").description(
+  "Run a command with the module's DashWise env injected \u2014 resolves DASHWISE_API_URL + DASHWISE_API_KEY through the same chain as `dashwise query` (explicit env \u2192 .env.local \u2192 the cached dwk_ key) and spawns the command with them overlaid, inheriting stdio and propagating the exit code. Example: `dashwise run -- node seed.mjs`."
+).option("--dir <path>", "Project root containing `module.json` (default: current directory).").action(async (cmdArgs, cmdOpts) => {
+  const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_run(), run_exports));
+  process.exitCode = await runCommand2(cmdArgs ?? [], {
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {}
+  });
+});
 program.command("pull").description(
   "Sync local module.json from the backend. Fetches the canonical manifest for the current install and writes it to disk. Inverse of `dashwise table/field` commands."
 ).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option("--dry-run", "Fetch + report drift but do not write to module.json.").action(async (cmdOpts) => {
@@ -9767,20 +10871,32 @@ var apiKeysCmd = program.command("api-keys").description(
 );
 apiKeysCmd.command("list").description(
   "List API keys for the current module's installation. Active only by default; pass --all for revoked too."
-).option("--dir <path>", "Project root (default: current directory).").option("--all", "Include revoked + expired keys in the output.").option("--json", "Emit JSON instead of the human-friendly table.").action(async (cmdOpts) => {
+).option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).option("--all", "Include revoked + expired keys in the output.").option("--json", "Emit JSON instead of the human-friendly table.").action(async (cmdOpts) => {
   process.exitCode = await apiKeysListCommand({
     ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
     ...cmdOpts.all !== void 0 ? { all: cmdOpts.all } : {},
     ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
   });
 });
 apiKeysCmd.command("create [name]").description(
   "Mint a new API key. The plaintext key is displayed ONCE \u2014 save it then."
-).option("--dir <path>", "Project root (default: current directory).").option("--name <name>", "Override the positional name arg (e.g. for scripted use).").option(
+).option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).option("--name <name>", "Override the positional name arg (e.g. for scripted use).").option(
   "--grant <spec>",
-  "Scoped grant (repeatable). `module:<tableSlug>:<ops>`, `datahub:table=<id>:<ops>`, `datahub:app=<id>:<ops>`, or `datahub:workspace:<ops>` where <ops> is a comma list of create,read,update,delete. Any grant mints a scoped (default-deny) key (workspace-admin required). Omit for a full-access key.",
+  "Scoped grant (repeatable). `module:<tableSlug>:<ops>`, `datahub:table=<id>:<ops>`, `datahub:app=<id>:<ops>`, or `datahub:workspace:<ops>` where <ops> is a comma list of create,read,update,delete. Any grant mints a scoped (default-deny) key (workspace-admin required). Mutually exclusive with --full-access.",
   collectRepeated,
   []
+).option(
+  "--full-access",
+  "Mint with server-enumerated full-CRUD grants over every table the pinned manifest owns \u2014 the honest deploy-key default (a grantless key on a NON-local install is deny-all). Mutually exclusive with --grant."
 ).option(
   "--expires <days>",
   "Days until the key expires (converted to an absolute timestamp). Default: never expires.",
@@ -9792,8 +10908,10 @@ apiKeysCmd.command("create [name]").description(
   async (nameArg, cmdOpts) => {
     process.exitCode = await apiKeysCreateCommand(nameArg, {
       ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
       ...cmdOpts.name !== void 0 ? { name: cmdOpts.name } : {},
       ...cmdOpts.grant !== void 0 && cmdOpts.grant.length > 0 ? { grant: cmdOpts.grant } : {},
+      ...cmdOpts.fullAccess !== void 0 ? { fullAccess: cmdOpts.fullAccess } : {},
       ...cmdOpts.expires !== void 0 ? { expires: cmdOpts.expires } : {},
       ...cmdOpts.rawOnly !== void 0 ? { rawOnly: cmdOpts.rawOnly } : {}
     });
@@ -9801,10 +10919,15 @@ apiKeysCmd.command("create [name]").description(
 );
 apiKeysCmd.command("revoke [key-id]").description(
   "Soft-revoke an API key. Backend keeps the row for audit; further requests return 401."
-).option("--dir <path>", "Project root (default: current directory).").option("-y, --yes", "Skip the per-key confirmation message (for CI / scripts).").action(
+).option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).option("-y, --yes", "Skip the per-key confirmation message (for CI / scripts).").action(
   async (keyIdArg, cmdOpts) => {
     process.exitCode = await apiKeysRevokeCommand(keyIdArg, {
       ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
       ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
     });
   }
@@ -9812,22 +10935,37 @@ apiKeysCmd.command("revoke [key-id]").description(
 var originsCmd = program.command("origins").description(
   "Manage the current module install's SSO callback-origin allowlist. Local dev (localhost) is always allowed; add deployed domains here."
 );
-originsCmd.command("list").description("Show the SSO callback origins configured for the current module install.").option("--dir <path>", "Project root (default: current directory).").option("--json", "Emit a JSON array instead of the human-friendly list.").action(async (cmdOpts) => {
+originsCmd.command("list").description("Show the SSO callback origins configured for the current module install.").option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).option("--json", "Emit a JSON array instead of the human-friendly list.").action(async (cmdOpts) => {
   process.exitCode = await originsListCommand({
     ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
     ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
   });
 });
 originsCmd.command("add <url>").description(
   "Add an SSO callback origin (e.g. https://app.example.com). Idempotent; non-localhost origins must be https://."
-).option("--dir <path>", "Project root (default: current directory).").action(async (url, cmdOpts) => {
+).option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).action(async (url, cmdOpts) => {
   process.exitCode = await originsAddCommand(url, {
-    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {}
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {}
   });
 });
-originsCmd.command("remove <url>").description("Remove an SSO callback origin from the allowlist.").option("--dir <path>", "Project root (default: current directory).").action(async (url, cmdOpts) => {
+originsCmd.command("remove <url>").description("Remove an SSO callback origin from the allowlist.").option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).action(async (url, cmdOpts) => {
   process.exitCode = await originsRemoveCommand(url, {
-    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {}
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {}
   });
 });
 var envCmd = program.command("env").description("Environment-variable helpers for deploying a module.");
@@ -9881,7 +11019,7 @@ moduleCmd.command("install [slug]").alias("deploy").description(
   "Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently. Refuses to silently land on a dev install: use --replace-dev-install or --workspace <other>."
 ).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--version <semver>", "Install a specific published version (default: latest).").option("--force", "Proceed even when the upgrade breaks consumer modules (UPGRADE_BREAKS_CONSUMERS).").option(
   "--replace-dev-install",
-  "Destroy the workspace's kind=local dev install first, then fresh production install. Revokes the module's cached local-dev credentials (re-run `dashwise init --force` for local dev afterwards)."
+  "Destroy the workspace's kind=local dev install first, then fresh production install. PERMANENTLY disables local dev for this module in this workspace (credentials revoked; a published module cannot be re-provisioned here) \u2014 continue development in a different workspace."
 ).option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use).").option("--json", "Emit the final result as machine-readable JSON.").action(
   async (slug, cmdOpts) => {
     process.exitCode = await moduleInstallCommand(slug, {
@@ -9895,6 +11033,21 @@ moduleCmd.command("install [slug]").alias("deploy").description(
     });
   }
 );
+moduleCmd.command("uninstall [slug]").description(
+  "Uninstall a module from a workspace. The app is soft-deleted \u2014 recoverable ONLY by a platform operator (contact support/HQ) within ~7 days; it does NOT appear in your dashboard trash. An operator restore keeps the public URL; a reinstall mints a NEW one. Refuses the kind=local dev install: use `dashwise module destroy-dev-install` for that. Interactive runs confirm twice (including typing the slug); scripts must pass BOTH --yes and an explicit --workspace."
+).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option(
+  "--park-consumers",
+  "Uninstall even when live consumer modules depend on this install \u2014 their dependencies are parked (PROVIDER_UNINSTALLED) instead of blocking with PROVIDER_HAS_CONSUMERS."
+).option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("-y, --yes", "Skip the confirmation prompts. Only honored together with an explicit --workspace.").action(
+  async (slug, cmdOpts) => {
+    process.exitCode = await moduleUninstallCommand(slug, {
+      ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+      ...cmdOpts.parkConsumers !== void 0 ? { parkConsumers: cmdOpts.parkConsumers } : {},
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
+    });
+  }
+);
 moduleCmd.command("status [slug]").description(
   "Show a module's deploy state in a workspace: install kind, installed vs latest published version, runtime provisioning, and the public URL."
 ).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("--json", "Emit machine-readable JSON.").action(
@@ -9978,7 +11131,7 @@ moduleCmd.command("destroy-dev-install").description(
   }
 );
 moduleCmd.command("reset-dev-install").description(
-  "Destroy + re-provision the local-dev install in one shot. Useful for nuking accumulated test data, refreshing a compromised runtime token, or recovering from a wedged schema state. Keeps local module.json intact."
+  "Destroy + re-provision the local-dev install in one shot. Useful for nuking accumulated test data, refreshing a compromised runtime token, or recovering from a wedged schema state. Provision-only re-init: ALL local files (module.json, app code) are left untouched \u2014 only the backend install + cached credentials are recreated."
 ).option("--dir <path>", "Project root (default: current directory).").option(
   "--module <slug>",
   "Override the module slug (default: from local module.json)."
@@ -9996,6 +11149,18 @@ moduleCmd.command("reset-dev-install").description(
     });
   }
 );
+var schemaCmd = program.command("schema").description(
+  "Whole-manifest schema commands. `schema push` applies the local module.json to the dev install (the missing write half of the sync loop \u2014 hand-edited rbac/indexes/table blocks finally reach the backend)."
+);
+schemaCmd.command("push").description(
+  "Apply the LOCAL module.json to the dev install via PUT /api/modules/:id/draft/manifest (greenfield or delta). Destructive removals (tables/fields) are previewed and require confirmation unless --yes. Afterwards the canonical manifest is synced back with merge semantics (local-only rbac/indexes blocks survive)."
+).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option("-y, --yes", "Skip the destructive-change confirmation (CI / scripted runs).").action(async (cmdOpts) => {
+  const { schemaPushCommand: schemaPushCommand2 } = await Promise.resolve().then(() => (init_push(), push_exports));
+  process.exitCode = await schemaPushCommand2({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
+  });
+});
 var tableCmd = program.command("table").description(
   "Schema commands for the current module \u2014 create/delete tables in the dev installation. Requires a per-module dev install (run `dashwise init` first)."
 );
@@ -10033,7 +11198,7 @@ var fieldCmd = program.command("field").description(
   "Schema commands for fields within the current module \u2014 add/remove/change-type. Field rename is deferred to v1.1 per the plan."
 );
 fieldCmd.command("add <table-slug> [field-spec]").description(
-  'Add a field to a table. Pass the spec as `<slug>:<type>[:required]` OR use --field-json for fields with options/target/default. Example: `dashwise field add tasks priority --field-json \'{"slug":"priority","type":"single_select","options":["low","medium","high"]}\'`.'
+  'Add a field to a table. Pass the spec as `<slug>:<type>[:required]` OR use --field-json for fields with options/target/default (never both \u2014 the slug lives inside the JSON). Examples: `dashwise field add tasks priority:text` or `dashwise field add tasks --field-json \'{"slug":"priority","type":"single_select","options":["low","medium","high"]}\'`.'
 ).option("--dir <path>", "Project root (default: current directory).").option(
   "--field-json <json>",
   "Field as a JSON object. Mutually exclusive with the positional field spec."
@@ -10083,7 +11248,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 })();
 function getVersion() {
-  return "0.14.2";
+  return "0.16.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);