@dashai/cli 0.15.0 → 0.17.0

package/dist/bin.js

@@ -464,6 +464,19 @@ async function applyDraftManifest(moduleId, manifest, options = {}) {
     options
   );
 }
+async function getRuntimeLogs(installationId, opts = {}, options = {}) {
+  const params = new URLSearchParams();
+  if (opts.since !== void 0 && opts.since !== "") params.set("since", opts.since);
+  if (opts.limit !== void 0) params.set("limit", String(opts.limit));
+  if (opts.tail) params.set("tail", "true");
+  const qs = params.toString();
+  return apiRequest(
+    "GET",
+    `/api/modules/installations/${installationId}/runtime-logs${qs ? `?${qs}` : ""}`,
+    void 0,
+    options
+  );
+}
 var ApiError;
 var init_api_client = __esm({
   "src/lib/api-client.ts"() {
@@ -840,6 +853,7 @@ async function devCommand(options) {
   const apiKeyEnv = process.env.DASHWISE_API_KEY ?? moduleEntry?.apiKey;
   let installationIdEnv;
   let revokeDevSession;
+  let devHandoffEnv = {};
   if (explicitInstallationId && explicitInstallationId !== "local") {
     installationIdEnv = explicitInstallationId;
   } else if (reuseDevSessionId) ; else {
@@ -862,10 +876,14 @@ async function devCommand(options) {
         callback_origins: callbackOrigins
       });
       revokeDevSession = () => revokeDevSessionBestEffort(apiUrl, apiToken, session.id);
+      devHandoffEnv = devSessionHandoffEnv(session);
       info(`  ${dim("dev session")} ${session.id}`);
       info(`  ${dim("workspace")}   ${workspaceContext.name} (id=${workspaceContext.id}, slug=${workspaceContext.slug})`);
       info(`  ${dim("callbacks")}   ${callbackOrigins.join(", ")}`);
       info(`  ${dim("expires")}     ${session.expires_at}`);
+      info(
+        `  ${dim("sign-in")}     ${Object.keys(devHandoffEnv).length > 0 ? "zero-click (server-side dev handoff armed)" : "browser SSO (backend issued no handoff secret \u2014 pre-2026-07-15 backend)"}`
+      );
     } catch (err) {
       if (err instanceof ApiError) {
         fail(`Failed to register dev session: ${err.code} \u2014 ${err.message}`);
@@ -879,7 +897,8 @@ async function devCommand(options) {
     ...process.env,
     DASHWISE_API_URL: apiUrl,
     NEXT_PUBLIC_DASHWISE_API_URL: apiUrl,
-    ...apiKeyEnv !== void 0 ? { DASHWISE_API_KEY: apiKeyEnv } : {}
+    ...apiKeyEnv !== void 0 ? { DASHWISE_API_KEY: apiKeyEnv } : {},
+    ...devHandoffEnv
   };
   info(`Dev loop starting \u2014 Ctrl-C to stop.`);
   info(`  ${dim("api")}         ${apiUrl}`);
@@ -1117,6 +1136,14 @@ async function resolveModuleApiKey(slug, entry, apiUrl, cliBearer) {
   success(`Upgraded ${code(slug)} to a dwk_ API key (id=${minted.api_key.id}).`);
   return upgraded;
 }
+function devSessionHandoffEnv(session) {
+  const secret = session.handoff_secret;
+  if (typeof secret !== "string" || secret.length === 0) return {};
+  return {
+    DASHWISE_DEV_SESSION_ID: session.id,
+    DASHWISE_DEV_HANDOFF_SECRET: secret
+  };
+}
 function computeCallbackOrigins(port, extra) {
   const def = `http://localhost:${port}`;
   return Array.from(/* @__PURE__ */ new Set([def, ...extra]));
@@ -1285,7 +1312,7 @@ function packageJson(opts) {
         start: "next start"
       },
       dependencies: {
-        "@dashai/sdk": "^2.0.0",
+        "@dashai/sdk": "^2.3.0",
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0"
@@ -1953,8 +1980,20 @@ function appApiAuthSignInTs() {
 // 302 back to callback_url?code=<one-time>. The /api/auth/callback route
 // exchanges that code for a session cookie.
 //
-// No dev-vs-prod branching, no installation id, no dev-session id \u2014 the
-// single dwk_ key drives both local dev and production.
+// ZERO-CLICK LOCAL DEV (CLI \u2265 0.16.0 + backend \u2265 2026-07-15): when
+// \`dashwise dev\` injected BOTH DASHWISE_DEV_SESSION_ID and
+// DASHWISE_DEV_HANDOFF_SECRET, this route first presents the handoff
+// secret to the backend SERVER-SIDE (POST /api/auth/dev/sso/authorize)
+// and 302s the browser straight to the returned callback URL \u2014 the user
+// NEVER sees a login page and no platform browser session is needed. On
+// ANY failure it logs one server-side warn line and falls back to the
+// browser flow above unchanged (that path still matters for signing in
+// as a DIFFERENT workspace member and for stale dev sessions). The
+// secret is server-env-only: never in a URL, response body, or the
+// client bundle.
+//
+// No dev-vs-prod branching for the browser flow \u2014 the single dwk_ key
+// drives both local dev and production.
 import { NextResponse } from 'next/server';
 import { getPublicOrigin } from '@/lib/request-origin';
 
@@ -1974,6 +2013,30 @@ export async function GET(request: Request) {
       status: 500,
     });
   }
+
+  // \`getPublicOrigin\` reads \`X-Forwarded-Host\` when present so URLs
+  // point at the public domain, not the internal Node origin behind
+  // reverse proxies (Railway/Vercel/Fly).
+  const moduleOrigin = getPublicOrigin(request);
+
+  // \u2500\u2500 Zero-click dev handoff (server-side; runs BEFORE the dwk_-key
+  // guard \u2014 the authorize endpoint authenticates with the handoff
+  // secret, not the key). Both env vars must be present: \`dashwise dev\`
+  // injects them together, and only when the backend issued a secret.
+  const devSessionId = process.env.DASHWISE_DEV_SESSION_ID;
+  const devHandoffSecret = process.env.DASHWISE_DEV_HANDOFF_SECRET;
+  if (devSessionId && devHandoffSecret) {
+    const callbackUrl = await tryDevHandoff(
+      apiBaseUrl,
+      devSessionId,
+      devHandoffSecret,
+      returnTo,
+      moduleOrigin,
+    );
+    if (callbackUrl) return NextResponse.redirect(callbackUrl);
+    // null \u2192 warned server-side already; fall through to the browser flow.
+  }
+
   if (!apiKey) {
     return new NextResponse(
       'DASHWISE_API_KEY must be set in the environment. Run \`dashwise dev\` ' +
@@ -1983,12 +2046,9 @@ export async function GET(request: Request) {
   }
 
   // Absolute callback URL so the backend knows which host to bounce back
-  // to. \`getPublicOrigin\` reads \`X-Forwarded-Host\` when present so the
-  // URL points at the public domain, not the internal Node origin behind
-  // reverse proxies (Railway/Vercel/Fly). The callback path is fixed at
-  // /api/auth/callback by SDK convention; we tuck \`return_to\` onto it so
-  // the callback route can resume the user's original destination.
-  const moduleOrigin = getPublicOrigin(request);
+  // to. The callback path is fixed at /api/auth/callback by SDK
+  // convention; we tuck \`return_to\` onto it so the callback route can
+  // resume the user's original destination.
   const callback = new URL('/api/auth/callback', moduleOrigin);
   callback.searchParams.set('return_to', returnTo);
 
@@ -2041,6 +2101,74 @@ export async function GET(request: Request) {
   }
   return NextResponse.redirect(body.redirect_url);
 }
+
+/**
+ * Zero-click dev sign-in (CLI \u2265 0.16.0 + backend \u2265 2026-07-15).
+ *
+ * SERVER-SIDE ONLY: presents the dev session's one-time handoff secret
+ * to \`POST /api/auth/dev/sso/authorize\`. On 200 the backend mints a
+ * single-use 60s exchange code for the DEV'S OWN user and returns
+ * \`{ callback_url }\` (= \`<origin>/api/auth/callback?code=\u2026&return_to=\u2026\`)
+ * \u2014 the caller 302s the browser straight there; the normal callback
+ * route exchanges the code exactly like the browser flow.
+ *
+ * Returns the callback URL, or \`null\` on ANY failure (404
+ * DEV_SESSION_NOT_FOUND, 401 DEV_HANDOFF_INVALID, 400 INVALID_RETURN_TO,
+ * 403 WORKSPACE_NOT_MEMBER, network) after logging a one-line warn \u2014
+ * the caller then falls back to the browser SSO flow, which remains the
+ * path for signing in as a DIFFERENT workspace member and for stale dev
+ * sessions. The secret must never appear in a URL or response body.
+ */
+async function tryDevHandoff(
+  apiBaseUrl: string,
+  devSessionId: string,
+  devHandoffSecret: string,
+  returnTo: string,
+  moduleOrigin: string,
+): Promise<string | null> {
+  // Same root-relative-only rule as the callback's safeReturnTo \u2014 an
+  // absolute/protocol-relative return_to must not steer the handoff.
+  const path =
+    returnTo.startsWith('/') && !returnTo.startsWith('//') ? returnTo : '/';
+  // \`return_to\` is the user's ABSOLUTE destination on this module's own
+  // (loopback) origin; the backend validates origin allowlist + loopback
+  // and builds the callback URL from it.
+  const destination = new URL(path, moduleOrigin);
+  let res: Response;
+  try {
+    res = await fetch(\`\${apiBaseUrl}/api/auth/dev/sso/authorize\`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+      body: JSON.stringify({
+        dev_session_id: devSessionId,
+        handoff_secret: devHandoffSecret,
+        return_to: destination.toString(),
+      }),
+    });
+  } catch (err) {
+    console.warn(
+      \`[auth] dev handoff failed (\${(err as Error).message}) \u2014 falling back to browser SSO\`,
+    );
+    return null;
+  }
+  if (!res.ok) {
+    const body = (await res.json().catch(() => null)) as { code?: string } | null;
+    console.warn(
+      \`[auth] dev handoff rejected (\${body?.code ?? \`HTTP \${res.status}\`}) \u2014 falling back to browser SSO\`,
+    );
+    return null;
+  }
+  const body = (await res.json().catch(() => null)) as
+    | { callback_url?: string }
+    | null;
+  if (!body?.callback_url) {
+    console.warn(
+      '[auth] dev handoff response missing callback_url \u2014 falling back to browser SSO',
+    );
+    return null;
+  }
+  return body.callback_url;
+}
 `;
 }
 function appApiAuthCallbackTs() {
@@ -2049,7 +2177,14 @@ function appApiAuthCallbackTs() {
 // SSO flow failed. Two paths:
 //
 //   1. Success path: exchange \`?code\` for a session cookie via
-//      \`exchangeCode()\`, then redirect to \`return_to\`.
+//      \`exchangeCode()\`, then redirect to \`return_to\`. SDK \u2265 2.3.0:
+//      the result's \`cookieWritten\` flag surfaces a cookie store that
+//      rejected the write \u2014 without it the exchange "succeeds", the
+//      browser has no session, and the user silently bounces back to
+//      sign-in. We render /sign-in-error?code=cookie_write_failed
+//      instead. \`requestUrl\` lets the SDK fall back to the actual
+//      request protocol for the cookie's Secure attribute when no
+//      x-forwarded-proto header is present (plain-http \`next start\`).
 //   2. Error path: SSO returned \`?error=\` \u2014 redirect to the polished
 //      sign-in-error page so the user sees a real error UI instead of
 //      a raw 4xx page. The error code maps to known SSO error codes
@@ -2086,7 +2221,17 @@ export async function GET(request: Request) {
     return NextResponse.redirect(target);
   }
   try {
-    await exchangeCode(code); // sets the dashwise.session cookie
+    // Sets the dashwise.session cookie. \`requestUrl\` = the Secure-attr
+    // protocol fallback when no x-forwarded-proto header is present.
+    const result = await exchangeCode(code, { requestUrl: request.url });
+    if (!result.cookieWritten) {
+      // The exchange succeeded but the cookie store rejected the write \u2014
+      // the browser has NO session. Surface it instead of redirecting
+      // into an unauthenticated loop (SDK \u2265 2.3.0).
+      const target = new URL('/sign-in-error', publicOrigin);
+      target.searchParams.set('code', 'cookie_write_failed');
+      return NextResponse.redirect(target);
+    }
   } catch (err) {
     const target = new URL('/sign-in-error', publicOrigin);
     target.searchParams.set('code', 'exchange_failed');
@@ -2123,7 +2268,12 @@ import { signOut } from '@dashai/sdk/auth/server';
 import { getPublicOrigin } from '@/lib/request-origin';
 
 export async function POST(request: Request) {
-  await signOut();
+  // Pass requestUrl so the cookie-CLEAR resolves its Secure attribute the
+  // SAME way the sign-in SET did (exchangeCode also gets request.url) \u2014
+  // otherwise a plain-http localhost dev server sets a non-Secure cookie
+  // but tries to clear a Secure one, which the browser ignores, leaving a
+  // stale (backend-revoked, but client-present) cookie after sign-out.
+  await signOut({ requestUrl: request.url });
   // Build the redirect against the public origin so we don't land
   // the user on \`http://localhost:<PORT>/\` when running behind a
   // reverse proxy (Railway/Vercel/Fly).
@@ -2210,7 +2360,7 @@ function packageJsonCustom(opts) {
         start: "next start"
       },
       dependencies: {
-        "@dashai/sdk": "^2.0.0",
+        "@dashai/sdk": "^2.3.0",
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0",
@@ -2711,6 +2861,8 @@ const ERROR_MESSAGES: Record<string, string> = {
     'The callback URL was missing the expected exchange code. This usually means the SSO flow was interrupted.',
   exchange_failed:
     "The exchange code couldn't be redeemed for a session. The code may have expired (they're single-use and short-lived) \u2014 try signing in again.",
+  cookie_write_failed:
+    'Sign-in completed, but the session cookie could not be written, so the session would have been lost. This means exchangeCode ran outside a Route Handler / Server Action context (Next can only set cookies there) or next/headers was unavailable \u2014 verify /api/auth/callback is a standard route handler and check the module server logs.',
 };
 
 interface SignInErrorPageProps {
@@ -3517,6 +3669,14 @@ function surfaceProvisionApiError(err, slug) {
         `Not authorized to create a module in that workspace. Confirm you're a member at the DashWise dashboard.`
       );
       return;
+    case "DEV_INSTALL_ALREADY_EXISTS": {
+      const cached = readModuleEntry(slug);
+      warn(
+        `Module ${code(slug)} already has a live dev install${cached?.installationId ? ` (cached id=${cached.installationId})` : ""} \u2014 only ONE dev install per module can exist.
+  Run ${code("dashwise module reset-dev-install")} for a clean slate (keeps ALL local files), or ${code("dashwise module destroy-dev-install")} then re-run init.`
+      );
+      return;
+    }
     case "SLUG_ALREADY_EXISTS": {
       const cached = readModuleEntry(slug);
       if (cached) {
@@ -3526,9 +3686,9 @@ function surfaceProvisionApiError(err, slug) {
         );
       } else {
         warn(
-          `A module with slug ${code(slug)} already exists (published and/or production-installed). Local development for an already-published module is not currently possible \u2014 module slugs are GLOBAL, so this 409s in every workspace (a platform fix is planned). Interim options:
-    - Develop against the production install with a scoped key: ${code("dashwise api-keys create local-dev --install <id> --full-access")} + ${code("dashwise origins add http://localhost:3000 --install <id>")} (id via ${code(`dashwise module status ${slug}`)}), then run bare ${code("next dev")} \u2014 and CLEAN UP after (revoke the key, remove the origin).
-    - Or pick a NEW slug (duplicate the code) for greenfield iteration.`
+          `A module with slug ${code(slug)} already exists.
+    - If it belongs to ANOTHER workspace: module slugs are globally unique \u2014 pick a NEW slug (duplicate the code if needed).
+    - If it's YOUR OWN published module: backends \u2265 2026-07-15 re-provision a dev install from this exact command (${code(`dashwise init ${slug} --workspace <ws>`)} \u2014 the dev install coexists with the production install), so this 409 means the backend predates that. Older-backend fallback (production repair): ${code("dashwise api-keys create local-dev --install <id> --full-access")} + ${code("dashwise origins add http://localhost:3000 --install <id>")} (id via ${code(`dashwise module status ${slug}`)}), then run bare ${code("next dev")} \u2014 and CLEAN UP after (revoke the key, remove the origin).`
         );
       }
       return;
@@ -4177,9 +4337,29 @@ function parseFieldSpec(spec) {
           `The ${quote("unique")} flag is not supported on field specs \u2014 uniqueness is a TABLE-level index. Declare it in module.json as ${quote(`owns.tables[].indexes: [{ "fields": ["${slug}"], "unique": true }]`)} and apply it with ${quote("dashwise schema push")}.`
         );
       }
+      if (DECIMALS_FLAG_REGEX.test(flag)) {
+        if (type !== "number") {
+          throw new FieldSpecError(
+            `Decimal places (${quote(flag)}) are only valid on ${quote("number")} fields, not ${quote(type)}. Field spec ${quote(spec)} sets a scale on a non-number type.`
+          );
+        }
+        if (result.decimal_places !== void 0) {
+          throw new FieldSpecError(
+            `Decimal places specified twice in field spec ${quote(spec)}.`
+          );
+        }
+        const places = Number.parseInt(flag, 10);
+        if (places < 0 || places > MAX_DECIMAL_PLACES) {
+          throw new FieldSpecError(
+            `Decimal places must be between 0 and ${MAX_DECIMAL_PLACES} (got ${quote(flag)}) in field spec ${quote(spec)}.`
+          );
+        }
+        result.decimal_places = places;
+        continue;
+      }
       if (!KNOWN_FLAGS.has(flag)) {
         throw new FieldSpecError(
-          `Unknown flag ${quote(flag)} in field spec ${quote(spec)}. Known flags: ${[...KNOWN_FLAGS].join(", ")}. For options/target/default, use ${quote("--field-json")} instead.`
+          `Unknown flag ${quote(flag)} in field spec ${quote(spec)}. Known flags: ${[...KNOWN_FLAGS].join(", ")}${type === "number" ? ` (plus a bare 0\u2013${MAX_DECIMAL_PLACES} integer for decimal places, e.g. ${quote(`${slug}:number:2`)})` : ""}. For options/target/default, use ${quote("--field-json")} instead.`
         );
       }
       if (flag === "required") result.required = true;
@@ -4230,7 +4410,7 @@ function parseFieldJson(json) {
 function quote(s) {
   return `\`${s}\``;
 }
-var FIELD_TYPES, SLUG_REGEX, KNOWN_FLAGS, FieldSpecError;
+var FIELD_TYPES, SLUG_REGEX, KNOWN_FLAGS, DECIMALS_FLAG_REGEX, MAX_DECIMAL_PLACES, FieldSpecError;
 var init_field_spec = __esm({
   "src/lib/field-spec.ts"() {
     FIELD_TYPES = [
@@ -4253,6 +4433,8 @@ var init_field_spec = __esm({
     ];
     SLUG_REGEX = /^[a-z][a-z0-9_]*[a-z0-9]$/;
     KNOWN_FLAGS = /* @__PURE__ */ new Set(["required"]);
+    DECIMALS_FLAG_REGEX = /^\d+$/;
+    MAX_DECIMAL_PLACES = 10;
     FieldSpecError = class extends Error {
       constructor(message) {
         super(message);
@@ -6275,13 +6457,14 @@ async function moduleInstallCommand(slugArg, options) {
   return 0;
 }
 function publishedModuleLocalDevGuidance(slug) {
-  return `Local development for an already-published module is not currently possible \u2014 in ANY workspace (module slugs are global; a platform fix is planned). Interim options:
+  return `Re-provision local dev any time with ${code(`dashwise init ${slug} --workspace <ws>`)} (or ${code("dashwise module reset-dev-install")}) \u2014 requires backend \u2265 2026-07-15; the fresh dev install COEXISTS with the production install.
+    Older backends 409 SLUG_ALREADY_EXISTS on that path (no re-provision anywhere). Fallback for them (production repair):
     - Develop against the production install with a scoped key: ${code(`dashwise api-keys create local-dev --install <id> --full-access`)} + ${code(`dashwise origins add http://localhost:3000 --install <id>`)} (id via ${code(`dashwise module status ${slug}`)}), then run bare ${code("next dev")} \u2014 and CLEAN UP after (revoke the key, remove the origin).
     - Or duplicate the code under a NEW slug for greenfield iteration.`;
 }
 function printDevInstallAftermath(slug, workspaceSlug) {
   warn(
-    `Local dev for ${code(slug)} is now DISABLED (the dev install in ${code(workspaceSlug)} and its ${code("dwk_")} key were destroyed).
+    `Local dev for ${code(slug)} is DISCONNECTED (the dev install in ${code(workspaceSlug)} and its ${code("dwk_")} key were destroyed).
   ${publishedModuleLocalDevGuidance(slug)}`
   );
 }
@@ -6305,9 +6488,9 @@ async function resolveDevInstallCollision(existing, slug, workspaceSlug, options
     return 1;
   }
   const explanation = `Workspace ${code(workspaceSlug)} already has the DEV install of ${code(slug)} (kind=local, id=${existing.id}) created by ${code("dashwise init")}.
-  Only ONE install per (workspace, module) can exist, and ${code("kind")} is immutable: a plain install would upgrade that row in place \u2014 the runtime would provision, but it would STAY a dev install, hidden from the app sidebar.
+  Install ${code("kind")} is immutable: a plain install could land on that row's upgrade path \u2014 the runtime would provision, but it would STAY a dev install, hidden from the app sidebar.
   Options:
-    - ${code("--replace-dev-install")} \u2014 destroy the dev install, then fresh production install. Recommended when development is done. Note: this PERMANENTLY disables local dev for ${code(slug)} \u2014 module slugs are global, so a dev install cannot be re-provisioned in ANY workspace once the module is published (interim: a scoped key on the production install via ${code("api-keys create --install <id> --full-access")}, or duplicate the code under a NEW slug).
+    - ${code("--replace-dev-install")} \u2014 destroy the dev install, then fresh production install. Recommended when development is done. Local dev can be re-provisioned afterwards with ${code(`dashwise init ${slug} --workspace <ws>`)} on backends \u2265 2026-07-15 (dev + production installs coexist); on OLDER backends this is one-way \u2014 no re-provision anywhere once published (interim: a scoped key on the production install via ${code("api-keys create --install <id> --full-access")}, or duplicate the code under a NEW slug).
     - ${code("--workspace <other>")} \u2014 deploy to a separate test/client workspace and keep this dev install. Recommended for ongoing development.`;
   if (options.replaceDevInstall) {
     info(explanation);
@@ -6321,7 +6504,7 @@ async function resolveDevInstallCollision(existing, slug, workspaceSlug, options
         {
           value: "replace",
           label: "Replace \u2014 destroy the dev install, then production-install",
-          hint: "local dev for this module is permanently disabled afterwards (interim repair: scoped key on the production install)"
+          hint: "revokes local-dev credentials; re-provision later via `dashwise init` (backend \u2265 2026-07-15 \u2014 older backends: scoped-key repair only)"
         },
         { value: "cancel", label: "Cancel \u2014 I will deploy to another workspace" }
       ],
@@ -7093,13 +7276,13 @@ async function moduleUninstallCommand(slugArg, options) {
     }
     info(
       `Uninstalling ${code(mod.slug)} (install ${code(`#${row.id}`)}, kind=${row.kind ?? "production"}${row.module_version?.version ? `, v${row.module_version.version}` : ""}) from workspace ${code(workspace2.slug)}.
-  The app is soft-deleted, recoverable ONLY by a PLATFORM OPERATOR (contact support/HQ) within ~7 days \u2014 it does NOT appear in your dashboard trash.
-  An operator restore KEEPS the public URL${row.public_url ? ` ${code(row.public_url)}` : ""}; a REINSTALL mints a NEW one \u2014 deep links to the old URL break.`
+  The app is soft-deleted and appears in your workspace trash \u2014 a workspace admin can self-serve restore its DATA (~30 days). Reviving a running module within ~7 days is a platform-operator action.
+  A REINSTALL now KEEPS the same public URL${row.public_url ? ` ${code(row.public_url)}` : ""}, so deep links survive. (On backends older than 2026-07-15: restore is operator-only and a reinstall mints a new URL.)`
     );
     const answer = await select({
       message: `Uninstall ${code(mod.slug)} from ${code(workspace2.slug)}?`,
       options: [
-        { value: "uninstall", label: "Uninstall \u2014 soft-delete the app (operator-restorable ~7 days)" },
+        { value: "uninstall", label: "Uninstall \u2014 soft-delete the app (data restorable from workspace trash ~30 days)" },
         { value: "cancel", label: "Cancel \u2014 nothing is changed" }
       ],
       initialValue: "cancel"
@@ -7131,8 +7314,8 @@ async function moduleUninstallCommand(slugArg, options) {
     `Uninstalled ${code(mod.slug)} (install ${code(`#${row.id}`)}) from workspace ${code(workspace2.slug)}.`
   );
   info(
-    `The app was soft-deleted. If this was a mistake: only a PLATFORM OPERATOR can restore it (contact support/HQ) within ~7 days \u2014 it does NOT appear in your dashboard trash. An operator restore keeps the same public URL.
-  Reinstalling instead (${code(`dashwise module install ${mod.slug} --workspace ${workspace2.slug}`)}) mints a NEW public URL.`
+    `The app was soft-deleted. If this was a mistake: restore its DATA yourself from your workspace trash (~30 days); to bring the running module back within ~7 days, contact a platform operator (support/HQ).
+  Reinstalling (${code(`dashwise module install ${mod.slug} --workspace ${workspace2.slug}`)}) now KEEPS the same public URL. (Older backends, < 2026-07-15: restore is operator-only and reinstall mints a new URL.)`
   );
   if (options.parkConsumers) {
     info(
@@ -10341,6 +10524,319 @@ function mapAndPrintError(err, json) {
   return 1;
 }
 
+// src/commands/module/logs.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+var POLL_INTERVAL_MS3 = 2e3;
+var DURATION_UNIT_MS = {
+  s: 1e3,
+  m: 6e4,
+  h: 36e5,
+  d: 864e5
+};
+function resolveSince(raw) {
+  if (raw === void 0) return void 0;
+  const trimmed = raw.trim();
+  if (trimmed === "") return void 0;
+  const m = /^(\d+)\s*(s|m|h|d)$/i.exec(trimmed);
+  if (m) {
+    const n = Number.parseInt(m[1], 10);
+    const unitMs = DURATION_UNIT_MS[m[2].toLowerCase()];
+    return new Date(Date.now() - n * unitMs).toISOString();
+  }
+  return trimmed;
+}
+async function moduleLogsCommand(slugArg, options) {
+  if (options.follow && options.json) {
+    fail("`--follow` and `--json` are mutually exclusive.");
+    return 1;
+  }
+  if (!isLoggedIn()) {
+    fail(`Not logged in. Run ${code("dashwise login")} first.`);
+    return 1;
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    fail(`CLI config missing. Run ${code("dashwise login")}.`);
+    return 1;
+  }
+  const auth = {
+    baseUrl: resolveApiUrl(),
+    auth: { token: cfg.token }
+  };
+  const since = resolveSince(options.since);
+  let installationId;
+  let label;
+  if (options.install !== void 0) {
+    if (!Number.isInteger(options.install) || options.install <= 0) {
+      fail(
+        `--install expects a positive integer installation id (got "${options.install}").`
+      );
+      return 1;
+    }
+    installationId = options.install;
+    label = `install #${installationId}`;
+  } else {
+    const resolved = await resolveInstallationFromSlug(slugArg, options, cfg, auth);
+    if (typeof resolved === "number") return resolved;
+    installationId = resolved.installationId;
+    label = resolved.label;
+  }
+  if (options.follow) {
+    return runFollow(installationId, label, { since, limit: options.limit }, auth);
+  }
+  return runOnce3(installationId, label, options, since, auth);
+}
+async function resolveInstallationFromSlug(slugArg, options, cfg, auth) {
+  let slug = slugArg;
+  if (!slug) {
+    try {
+      const fromManifest = readManifest(options.dir)?.module?.slug;
+      if (typeof fromManifest === "string" && fromManifest.length > 0) {
+        slug = fromManifest;
+      }
+    } catch {
+    }
+  }
+  if (!slug) {
+    fail(
+      `No module slug \u2014 pass one (${code("dashwise module logs <slug>")}), run from a directory with a valid module.json, or target an install directly with ${code("--install <id>")}.`
+    );
+    return 1;
+  }
+  let modId;
+  let modSlug;
+  try {
+    const mod = await getModuleBySlug(slug, auth);
+    modId = mod.id;
+    modSlug = mod.slug;
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      fail(`Module ${code(slug)} not found on the backend.`);
+      return 1;
+    }
+    fail(`Could not resolve module ${code(slug)}: ${err.message}`);
+    return 1;
+  }
+  let workspace2;
+  try {
+    workspace2 = await resolveWorkspaceWithFallback({
+      userFlag: options.workspace,
+      cachedWorkspaceId: readModuleEntry(slug)?.workspaceId,
+      configDefault: cfg.workspaceSlug,
+      apiUrl: resolveApiUrl(),
+      apiToken: cfg.token
+    });
+  } catch (err) {
+    fail(`Workspace selection failed: ${err.message}`);
+    return 1;
+  }
+  let row;
+  try {
+    const installs = await listWorkspaceInstallations(workspace2.id, auth);
+    const matches = installs.filter((r) => r.module_id === modId);
+    row = matches.find((r) => !isDevInstallKind(r.kind) && isRealRuntimeUrl(r.runtime_url)) ?? matches.find((r) => !isDevInstallKind(r.kind)) ?? matches[0];
+  } catch (err) {
+    fail(`Could not read workspace installations: ${err.message}`);
+    return 1;
+  }
+  if (!row) {
+    info(
+      `${code(modSlug)} is not installed in workspace ${code(workspace2.slug)} \u2014 nothing to read logs from. Deploy it with ${code(`dashwise module install ${modSlug} --workspace ${workspace2.slug}`)}.`
+    );
+    return 0;
+  }
+  return {
+    installationId: row.id,
+    label: `${modSlug} in ${workspace2.slug} (install #${row.id})`
+  };
+}
+async function runOnce3(installationId, label, options, since, auth) {
+  let body;
+  try {
+    body = await getRuntimeLogs(
+      installationId,
+      {
+        ...since !== void 0 && !options.tail ? { since } : {},
+        ...options.limit !== void 0 ? { limit: options.limit } : {},
+        ...options.tail ? { tail: true } : {}
+      },
+      auth
+    );
+  } catch (err) {
+    return mapLogsError(err, options.json);
+  }
+  if (options.json) {
+    out(JSON.stringify(body));
+    return 0;
+  }
+  if (body.entries.length === 0) {
+    info(`No runtime log entries for ${label} in the requested window.`);
+    return 0;
+  }
+  for (const entry of body.entries) out(formatRow2(entry));
+  out("");
+  info(
+    `${body.entries.length} ${body.entries.length === 1 ? "line" : "lines"} (${label}).`
+  );
+  return 0;
+}
+async function runFollow(installationId, label, opts, auth) {
+  info(`Following runtime logs for ${label} (every ${POLL_INTERVAL_MS3 / 1e3}s). Ctrl-C to stop.`);
+  out("");
+  let stopped = false;
+  const onSigint = () => {
+    stopped = true;
+  };
+  process.on("SIGINT", onSigint);
+  let lastTs;
+  let seenAtLastTs = /* @__PURE__ */ new Set();
+  let firstPoll = true;
+  try {
+    while (!stopped) {
+      const query = {};
+      if (opts.limit !== void 0) query.limit = opts.limit;
+      if (firstPoll) {
+        if (opts.since !== void 0) query.since = opts.since;
+        else query.tail = true;
+      } else if (lastTs !== void 0) {
+        query.since = new Date(lastTs).toISOString();
+      }
+      let body;
+      try {
+        body = await getRuntimeLogs(installationId, query, auth);
+      } catch (err) {
+        if (isFatalFollowError(err)) {
+          return mapLogsError(err, false);
+        }
+        info(dim(`(follow: transient error \u2014 ${err.message})`));
+        await sleep4(POLL_INTERVAL_MS3, () => stopped);
+        firstPoll = false;
+        continue;
+      }
+      const fresh = [];
+      for (const entry of body.entries) {
+        if (lastTs !== void 0 && entry.ts < lastTs) continue;
+        if (lastTs !== void 0 && entry.ts === lastTs && seenAtLastTs.has(entryKey(entry))) {
+          continue;
+        }
+        fresh.push(entry);
+      }
+      fresh.sort((a, b) => a.ts - b.ts);
+      for (const entry of fresh) out(formatRow2(entry));
+      if (fresh.length > 0) {
+        const newMax = fresh[fresh.length - 1].ts;
+        if (newMax !== lastTs) seenAtLastTs = /* @__PURE__ */ new Set();
+        lastTs = newMax;
+        for (const entry of fresh) {
+          if (entry.ts === lastTs) seenAtLastTs.add(entryKey(entry));
+        }
+      }
+      firstPoll = false;
+      await sleep4(POLL_INTERVAL_MS3, () => stopped);
+    }
+  } finally {
+    process.off("SIGINT", onSigint);
+  }
+  out("");
+  return 0;
+}
+function isFatalFollowError(err) {
+  if (!(err instanceof ApiError)) return false;
+  if (err.status === 401 || err.status === 403 || err.status === 404) return true;
+  return err.code === "INSTALLATION_NOT_FOUND" || err.code === "RUNTIME_NOT_PROVISIONED" || err.code === "INVALID_SINCE";
+}
+function formatTs(ts) {
+  if (!Number.isFinite(ts)) return "--:--:--";
+  return new Date(ts).toISOString().slice(11, 19);
+}
+function colorLevel(level) {
+  const padded = level.toUpperCase().padEnd(5);
+  switch (level) {
+    case "error":
+      return pc.red(padded);
+    case "warn":
+      return pc.yellow(padded);
+    case "info":
+      return pc.green(padded);
+    case "debug":
+    default:
+      return dim(padded);
+  }
+}
+function formatRow2(entry) {
+  const time = dim(formatTs(entry.ts));
+  const level = colorLevel(entry.level);
+  const reqId = entry.request_id ? `  ${dim(`[${entry.request_id}]`)}` : "";
+  return `${time}  ${level}  ${entry.message}${reqId}`;
+}
+function entryKey(entry) {
+  return `${entry.ts}\0${entry.request_id ?? ""}\0${entry.message}`;
+}
+function mapLogsError(err, json) {
+  if (err instanceof ApiError) {
+    const emit = (code_, message2) => {
+      if (json) out(JSON.stringify({ ok: false, error: { code: code_, message: message2 } }));
+      else fail(message2);
+    };
+    if (err.status === 401 || err.code === "UNAUTHENTICATED") {
+      emit("NOT_LOGGED_IN", `Not logged in. Run ${code("dashwise login")} first.`);
+      return 1;
+    }
+    if (err.status === 403) {
+      emit(
+        "FORBIDDEN",
+        `Reading runtime logs requires workspace-admin on this install's workspace.`
+      );
+      return 1;
+    }
+    if (err.status === 404 || err.code === "INSTALLATION_NOT_FOUND") {
+      emit(
+        "INSTALLATION_NOT_FOUND",
+        `Installation not found. Check the id (${code("dashwise module status <slug>")}) \u2014 it may have been uninstalled.`
+      );
+      return 1;
+    }
+    if (err.code === "RUNTIME_NOT_PROVISIONED") {
+      emit(
+        "RUNTIME_NOT_PROVISIONED",
+        `This install has no running runtime yet \u2014 deploy it first (${code("dashwise module install <slug>")}). The ${code("kind=local")} dev install never provisions a machine runtime, so it has no runtime logs.`
+      );
+      return 1;
+    }
+    if (err.code === "INVALID_SINCE") {
+      emit(
+        "INVALID_SINCE",
+        `${code("--since")} must be an ISO-8601 timestamp (e.g. ${code("2026-07-15T09:00:00Z")}) or a duration like ${code("15m")} / ${code("2h")} / ${code("2d")}.`
+      );
+      return 1;
+    }
+    if (err.code.startsWith("RUNTIME_")) {
+      emit(
+        err.code,
+        `The runtime host rejected the log read (${err.code}): ${err.message}. This is a host-side error \u2014 retry, or check the runtime with ${code("dashwise module status <slug>")}.`
+      );
+      return 1;
+    }
+    emit(err.code, `Could not read runtime logs: ${err.code} ${err.status} \u2014 ${err.message}`);
+    return 1;
+  }
+  const message = `Could not read runtime logs: ${err.message}`;
+  if (json) out(JSON.stringify({ ok: false, error: { code: "FETCH_FAILED", message } }));
+  else fail(message);
+  return 1;
+}
+async function sleep4(ms, aborted) {
+  const slice = 100;
+  let waited = 0;
+  while (waited < ms && !aborted()) {
+    await new Promise((resolve13) => setTimeout(resolve13, Math.min(slice, ms - waited)));
+    waited += slice;
+  }
+}
+
 // src/bin.ts
 init_output();
 var program = new Command();
@@ -10967,6 +11463,29 @@ moduleCmd.command("action-log").description(
     });
   }
 );
+moduleCmd.command("logs [slug]").description(
+  "Read a deployed module install's runtime logs (the host's log group). Resolves the install from the slug + workspace like `module status`, or target any install directly with `--install <id>`. `--since 15m|2h|<iso>` sets a lower bound; `--tail` shows the most-recent page; `--follow`/`-f` streams new lines every ~2s (Ctrl-C to stop). Workspace-admin."
+).option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option(
+  "--install <id>",
+  "Target a specific installation id directly (deployed installs included). Find ids via `dashwise module status <slug>`. Skips slug + workspace resolution.",
+  parseIntOption
+).option(
+  "--since <iso-or-duration>",
+  'Only lines newer than this. Accepts an ISO-8601 timestamp or a duration like "15m", "2h", "2d". Ignored with --tail.'
+).option("--limit <n>", "Max lines per fetch (1-1000, backend-clamped, default 100).", parseIntOption).option("--tail", "Show the most-recent page (ignores --since).").option("-f, --follow", "Poll every ~2s for new lines. Ctrl-C to stop. Mutually exclusive with --json.").option("--json", "Emit the raw `{ entries }` JSON response. Ignored with --follow.").action(
+  async (slug, cmdOpts) => {
+    process.exitCode = await moduleLogsCommand(slug, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+      ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
+      ...cmdOpts.since !== void 0 ? { since: cmdOpts.since } : {},
+      ...cmdOpts.limit !== void 0 ? { limit: cmdOpts.limit } : {},
+      ...cmdOpts.tail !== void 0 ? { tail: cmdOpts.tail } : {},
+      ...cmdOpts.follow !== void 0 ? { follow: cmdOpts.follow } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    });
+  }
+);
 moduleCmd.command("destroy-dev-install").description(
   "Destroy the local-dev install for the current module. Tears down the install row + dashboard tile; if the module had no other installs and was never published, drops the module too. Local module.json is preserved (only the cached runtime token + install id in auth.json get cleared)."
 ).option("--dir <path>", "Project root (default: current directory).").option(
@@ -11100,7 +11619,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 })();
 function getVersion() {
-  return "0.15.0";
+  return "0.17.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);