@dashai/cli 0.18.3 → 0.20.0

package/dist/bin.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import pc from 'picocolors';
 import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, watch, readdirSync, chmodSync, renameSync, mkdtempSync, statSync } from 'fs';
-import { tmpdir, platform, homedir } from 'os';
-import { resolve, join, relative, dirname, basename, sep } from 'path';
+import { hostname, tmpdir, platform, homedir } from 'os';
+import { resolve, join, relative, dirname, basename, win32, sep } from 'path';
 import { spawn, spawnSync } from 'child_process';
 import { intro, log, select, isCancel, cancel, spinner, outro, text, multiselect, confirm } from '@clack/prompts';
 import { Command, Option } from 'commander';
@@ -110,7 +110,7 @@ function resolveApiUrl() {
   if (fromEnv) return fromEnv.replace(/\/+$/, "");
   const cfg = safeReadConfig();
   if (cfg?.apiUrl) return cfg.apiUrl.replace(/\/+$/, "");
-  return "http://localhost:3000";
+  return DEFAULT_API_URL;
 }
 function readSavedToken() {
   const cfg = safeReadConfig();
@@ -172,11 +172,53 @@ function removeModuleEntry(slug) {
 function isLoggedIn() {
   return readSavedToken() !== null;
 }
-var FILE_NAME, DIR_NAME;
+var FILE_NAME, DIR_NAME, DEFAULT_API_URL, KNOWN_API_URLS;
 var init_config = __esm({
   "src/lib/config.ts"() {
     FILE_NAME = "auth.json";
     DIR_NAME = "dashwise";
+    DEFAULT_API_URL = "https://api.dashwise.dev";
+    KNOWN_API_URLS = {
+      dev: "https://api.dashwise.dev",
+      prod: "https://api.dashwise.net"
+    };
+  }
+});
+
+// src/lib/uses-types.ts
+function abstractTypeForPhysical(physicalType) {
+  return PHYSICAL_TO_ABSTRACT[physicalType] ?? null;
+}
+function slugifyUsesName(name) {
+  return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
+}
+function isUsesSlug(slug) {
+  return slug.length >= USES_SLUG_MIN_LENGTH && slug.length <= USES_SLUG_MAX_LENGTH && USES_SLUG_REGEX.test(slug);
+}
+var PHYSICAL_TO_ABSTRACT, USES_OPERATIONS, USES_SLUG_REGEX, USES_SLUG_MIN_LENGTH, USES_SLUG_MAX_LENGTH, USES_SLUG_RULE;
+var init_uses_types = __esm({
+  "src/lib/uses-types.ts"() {
+    PHYSICAL_TO_ABSTRACT = {
+      text: "text",
+      long_text: "long_text",
+      number: "number",
+      rating: "number",
+      boolean: "boolean",
+      // A date-with-time column has physical registry type `date` (with
+      // `config.includeTime`), NOT a distinct `datetime` type — the backend
+      // registry has no `datetime` key. So introspection only ever reports
+      // `date` here; there is no `datetime` physical entry to fold.
+      date: "date",
+      email: "email",
+      url: "url",
+      single_select: "single_select",
+      multi_select: "multi_select"
+    };
+    USES_OPERATIONS = ["create", "read", "update", "delete"];
+    USES_SLUG_REGEX = /^[a-z][a-z0-9_]*[a-z0-9]$/;
+    USES_SLUG_MIN_LENGTH = 2;
+    USES_SLUG_MAX_LENGTH = 63;
+    USES_SLUG_RULE = `^[a-z][a-z0-9_]*[a-z0-9]$ (snake_case, length ${USES_SLUG_MIN_LENGTH}\u2013${USES_SLUG_MAX_LENGTH})`;
   }
 });
 
@@ -236,10 +278,13 @@ function asEnvelope(v) {
   const env = v;
   const out2 = {};
   if (typeof env.code === "string") out2.code = env.code;
+  else if (typeof env.error === "string" && CODE_SHAPE.test(env.error)) out2.code = env.error;
   if (typeof env.message === "string") out2.message = env.message;
   if (typeof env.retriable === "boolean") out2.retriable = env.retriable;
   if (env.context && typeof env.context === "object") {
     out2.context = env.context;
+  } else if (env.details && typeof env.details === "object") {
+    out2.context = env.details;
   }
   return out2;
 }
@@ -419,8 +464,38 @@ async function declineBinding(installationId, usesSlug, options = {}) {
     options
   );
 }
-function slugifyFieldName(name) {
-  return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+async function listWorkspaceTables(workspaceId, options = {}) {
+  const apps = await apiRequest(
+    "GET",
+    `/api/applications/workspace/${workspaceId}`,
+    void 0,
+    options
+  );
+  const perApp = await Promise.all(
+    apps.map(async (app) => {
+      let tables;
+      try {
+        tables = await apiRequest(
+          "GET",
+          `/api/tables/application/${app.id}`,
+          void 0,
+          options
+        );
+      } catch {
+        return [];
+      }
+      return tables.map((t) => ({
+        table_id: t.id,
+        name: t.name,
+        module_id: t.module_id,
+        application_id: app.id,
+        application_name: app.name
+      }));
+    })
+  );
+  return perApp.flat().sort(
+    (a, b) => a.application_name.localeCompare(b.application_name) || a.name.localeCompare(b.name)
+  );
 }
 async function introspectWorkspaceTable(_installationId, tableNameOrId, options = {}) {
   const ref = String(tableNameOrId).trim();
@@ -512,10 +587,11 @@ async function getRuntimeLogs(installationId, opts = {}, options = {}) {
     options
   );
 }
-var ApiError;
+var ApiError, CODE_SHAPE, slugifyFieldName;
 var init_api_client = __esm({
   "src/lib/api-client.ts"() {
     init_config();
+    init_uses_types();
     ApiError = class extends Error {
       status;
       code;
@@ -532,6 +608,8 @@ var init_api_client = __esm({
         this.retriable = envelope?.retriable ?? status >= 500;
       }
     };
+    CODE_SHAPE = /^[A-Z][A-Z0-9_]*$/;
+    slugifyFieldName = slugifyUsesName;
   }
 });
 
@@ -601,10 +679,109 @@ async function safeGet(fn) {
     return null;
   }
 }
+function isRequiredSlot(b) {
+  return b.if_missing !== "optional";
+}
+function summarizeUsesReadiness(bindings) {
+  const slots = [...bindings];
+  const bound = slots.filter((b) => b.status === "bound");
+  return {
+    slots,
+    bound,
+    settings: {
+      settings_path: firstWireValue(slots.map((b) => b.settings_path)),
+      settings_url: firstWireValue(slots.map((b) => b.settings_url))
+    },
+    pending: slots.filter((b) => b.status === "unbound" && isRequiredSlot(b)),
+    optionalUnbound: slots.filter(
+      (b) => b.status === "unbound" && !isRequiredSlot(b)
+    ),
+    declined: slots.filter((b) => b.status === "declined"),
+    incomplete: bound.filter((b) => (b.missing_fields?.length ?? 0) > 0),
+    setupPending: slots.some((b) => b.status === "unbound" && isRequiredSlot(b))
+  };
+}
+async function fetchUsesReadiness(installationId, requestOptions) {
+  const bindings = await safeGet(
+    () => getInstallationBindings(installationId, requestOptions)
+  );
+  if (bindings === null) return null;
+  return summarizeUsesReadiness(bindings);
+}
+function wireValue(v) {
+  const trimmed = typeof v === "string" ? v.trim() : "";
+  return trimmed.length > 0 ? trimmed : null;
+}
+function firstWireValue(values) {
+  for (const v of values) {
+    const resolved = wireValue(v);
+    if (resolved !== null) return resolved;
+  }
+  return null;
+}
+function resolveSettingsPath(wire) {
+  return wireValue(wire) ?? SETUP_SETTINGS_PATH;
+}
+function resolveSettingsUrl(wire) {
+  const value = wireValue(wire);
+  if (value === null) return null;
+  return /^https?:\/\//i.test(value) ? value : null;
+}
+function renderUsesReadiness(readiness, wire) {
+  if (readiness.slots.length === 0) return;
+  const { slots } = readiness;
+  info(
+    `Data-plane readiness ${dim(
+      `(${readiness.bound.length}/${slots.length} slot${slots.length === 1 ? "" : "s"} bound)`
+    )}:`
+  );
+  for (const b of slots) renderReadinessSlot(b);
+  if (readiness.pending.length > 0) {
+    const names = readiness.pending.map((b) => b.uses_slug);
+    info(
+      `${names.length} required slot${names.length === 1 ? "" : "s"} await${names.length === 1 ? "s" : ""} setup \u2014 until then the module throws ${code("USES_UNBOUND")} on its first data call, which end users see as an error digest.`
+    );
+    for (const b of readiness.pending) {
+      out(`    ${dim("-")} ${code(`dashwise bind ${b.uses_slug} --table <name-or-id>`)}`);
+    }
+    const path = resolveSettingsPath(
+      wireValue(wire?.settings_path) ?? readiness.settings.settings_path
+    );
+    const url = resolveSettingsUrl(wire?.settings_url) ?? resolveSettingsUrl(readiness.settings.settings_url);
+    info(
+      `A workspace admin can do the same in the Dashwise app, under ${code(`Settings \u2192 ${path}`)}, where each declared table slot is bound.`
+    );
+    if (url !== null) out(`    ${dim("\u2192")} ${url}`);
+  }
+  for (const b of readiness.incomplete) {
+    info(
+      `${code(b.uses_slug)} is bound but ${(b.missing_fields ?? []).length} required field(s) are unmapped: ${(b.missing_fields ?? []).join(", ")}. Re-bind with ${code(`dashwise bind ${b.uses_slug} --map <field>=<physical>`)}.`
+    );
+  }
+}
+function renderReadinessSlot(b) {
+  const required = b.if_missing === "optional" ? dim(" (optional)") : "";
+  if (b.status === "bound") {
+    const tableLine = b.table ? ` ${dim(`\u2192 ${b.table.name} (id ${b.table.id})`)}` : "";
+    const gap = (b.missing_fields?.length ?? 0) > 0 ? ` ${pc.yellow(`(${b.missing_fields?.length} field(s) unmapped)`)}` : "";
+    out(`  ${pc.green("\u25CF bound")}    ${code(b.uses_slug)}${tableLine}${gap}`);
+    return;
+  }
+  if (b.status === "declined") {
+    out(`  ${pc.dim("\u2298 declined")} ${code(b.uses_slug)}`);
+    return;
+  }
+  const chip = b.if_missing === "optional" ? pc.dim("\u25CB unbound") : pc.yellow("\u25CB unbound");
+  out(
+    `  ${chip}  ${code(b.uses_slug)}${required} ${dim(`reason: ${b.reason ?? "(unspecified)"}`)}`
+  );
+}
+var SETUP_SETTINGS_PATH;
 var init_connect_status = __esm({
   "src/lib/connect-status.ts"() {
     init_api_client();
     init_output();
+    SETUP_SETTINGS_PATH = "Modules \u2192 Installed modules \u2192 Technical \u2192 Data connections";
   }
 });
 function manifestPath(dir) {
@@ -801,6 +978,33 @@ var init_manifest_poll = __esm({
     init_manifest_merge();
   }
 });
+
+// src/lib/redact.ts
+function maskSecret(value) {
+  if (value.length <= 12) return "****";
+  return `${value.slice(0, 4)}\u2026${value.slice(-4)}`;
+}
+function redactSecrets(line) {
+  let out2 = line;
+  for (const pattern of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    out2 = out2.replace(pattern, (match) => maskSecret(match));
+  }
+  return out2;
+}
+var SECRET_PATTERNS;
+var init_redact = __esm({
+  "src/lib/redact.ts"() {
+    SECRET_PATTERNS = [
+      // A JWT — three base64url segments. The SSO exchange code (C-10), and
+      // any access token that finds its way into a URL or a header dump.
+      /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g,
+      // The Dashwise credential family: dwk_ installation keys, dwc_ CLI
+      // tokens, dwm_ endpoint keys, dwa_/dwr_/dwo_ OAuth tokens.
+      /\bdw[kcmaro]_[A-Za-z0-9_-]{16,}/g
+    ];
+  }
+});
 async function devCommand(options) {
   if (options.sdkOnly && options.nextOnly) {
     fail(
@@ -1074,22 +1278,19 @@ function pipeWithPrefix(src, dst, prefix) {
     const lines = combined.split("\n");
     leftover = lines.pop() ?? "";
     for (const line of lines) {
-      dst.write(`${prefix}${line}
+      dst.write(`${prefix}${redactSecrets(line)}
 `);
     }
   });
   src.on("end", () => {
     if (leftover.length > 0) {
-      dst.write(`${prefix}${leftover}
+      dst.write(`${prefix}${redactSecrets(leftover)}
 `);
     }
   });
 }
 function maskedToken(token) {
-  if (token.length <= 12) return "****";
-  const prefix = token.slice(0, 4);
-  const tail = token.slice(-4);
-  return `${prefix}\u2026${tail}`;
+  return maskSecret(token);
 }
 async function resolveModuleApiKey(slug, entry, apiUrl, cliBearer) {
   if (process.env.DASHWISE_API_KEY) return null;
@@ -1167,13 +1368,13 @@ async function resolveDevPort(requested) {
 }
 async function isPortFree(port) {
   const { createServer } = await import('net');
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     const server = createServer();
     server.once("error", () => {
-      resolve13(false);
+      resolve14(false);
     });
     server.once("listening", () => {
-      server.close(() => resolve13(true));
+      server.close(() => resolve14(true));
     });
     server.listen(port, "0.0.0.0");
   });
@@ -1244,6 +1445,7 @@ var init_dev = __esm({
     init_manifest_io();
     init_manifest_poll();
     init_output();
+    init_redact();
     DEFAULT_NEXT_PORT = 3e3;
     PREFIX_SDK = `\x1B[36m[sdk]\x1B[0m `;
     PREFIX_NEXT = `\x1B[35m[next]\x1B[0m `;
@@ -1253,6 +1455,120 @@ var init_dev = __esm({
     PORT_PROBE_LIMIT = 10;
   }
 });
+async function selectWorkspace(opts) {
+  const workspaces = await apiRequest(
+    "GET",
+    "/api/workspaces",
+    void 0,
+    { baseUrl: opts.apiUrl, auth: { token: opts.apiToken } }
+  );
+  if (workspaces.length === 0) {
+    throw new Error(
+      "No workspaces found for your account. Create a workspace at the Dashwise dashboard first."
+    );
+  }
+  if (opts.flag !== void 0) {
+    return matchWorkspaceOrThrow(workspaces, opts.flag);
+  }
+  if (workspaces.length === 1) {
+    return workspaces[0];
+  }
+  if (opts.interactive && process.stdout.isTTY) {
+    const choice = await select({
+      message: "Which workspace should this module live in?",
+      options: workspaces.map((w) => ({
+        value: w.slug,
+        label: w.name,
+        hint: `slug=${w.slug}, id=${w.id}`
+      }))
+    });
+    if (isCancel(choice)) {
+      throw new Error("Aborted.");
+    }
+    const picked = workspaces.find((w) => w.slug === choice);
+    if (!picked) {
+      throw new Error(`Internal error: selection "${String(choice)}" did not match any workspace.`);
+    }
+    return picked;
+  }
+  const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id}, name="${w.name}")`).join("\n");
+  throw new Error(
+    `You have ${workspaces.length} workspaces. Re-run with --workspace <slug-or-id> to pick one:
+${list}`
+  );
+}
+function matchWorkspaceOrThrow(workspaces, flag) {
+  const asNumber = Number.parseInt(flag, 10);
+  const isNumeric = !Number.isNaN(asNumber) && String(asNumber) === flag;
+  const match = isNumeric ? workspaces.find((w) => w.id === asNumber) : workspaces.find((w) => w.slug === flag);
+  if (!match) {
+    const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id})`).join("\n");
+    throw new Error(`No workspace matching --workspace=${flag}. Available:
+${list}`);
+  }
+  return match;
+}
+var init_workspaces = __esm({
+  "src/lib/workspaces.ts"() {
+    init_api_client();
+  }
+});
+function resolveSdkPackageJson(projectRoot) {
+  let dir = projectRoot;
+  for (; ; ) {
+    const candidate = join(dir, "node_modules", "@dashai", "sdk", "package.json");
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function readInstalledSdk(projectRoot) {
+  const pkgPath = resolveSdkPackageJson(projectRoot);
+  if (pkgPath === null) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    if (typeof parsed.version !== "string" || parsed.version.length === 0) return null;
+    return { version: parsed.version };
+  } catch {
+    return null;
+  }
+}
+function compareVersions(a, b) {
+  const parse = (v) => {
+    const [core = "", pre] = v.trim().replace(/^[^0-9]*/, "").split("-", 2);
+    const nums = core.split(".").map((n) => Number.parseInt(n, 10) || 0);
+    while (nums.length < 3) nums.push(0);
+    return [nums.slice(0, 3), pre !== void 0 && pre.length > 0];
+  };
+  const [an, apre] = parse(a);
+  const [bn, bpre] = parse(b);
+  for (let i = 0; i < 3; i++) {
+    const d = (an[i] ?? 0) - (bn[i] ?? 0);
+    if (d !== 0) return d;
+  }
+  if (apre === bpre) return 0;
+  return apre ? -1 : 1;
+}
+function satisfiesFloor(version, floor) {
+  return compareVersions(version, floor) >= 0;
+}
+function checkSdkFloor(projectRoot, floor) {
+  const installed = readInstalledSdk(projectRoot);
+  if (installed === null) return { ok: true, installed: null, floor };
+  return {
+    ok: satisfiesFloor(installed.version, floor),
+    installed: installed.version,
+    floor
+  };
+}
+var USES_SDK_FLOOR, SCAFFOLD_SDK_RANGE;
+var init_sdk_version = __esm({
+  "src/lib/sdk-version.ts"() {
+    USES_SDK_FLOOR = "2.5.0";
+    SCAFFOLD_SDK_RANGE = "^2.5.0";
+  }
+});
 
 // src/lib/scaffold.ts
 function isDeployTarget(value) {
@@ -1333,7 +1649,12 @@ function packageJson(opts) {
         start: "next start"
       },
       dependencies: {
-        "@dashai/sdk": "^2.3.0",
+        // The floor every scaffold feature can actually run on
+        // (S-02): `uses` needs >= 2.5.0, and a project resolved below
+        // it fails with "every import from @dashai/generated throws"
+        // — a symptom that names nothing. SCAFFOLD_SDK_RANGE is the
+        // single place this is stated.
+        "@dashai/sdk": SCAFFOLD_SDK_RANGE,
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0"
@@ -2359,10 +2680,11 @@ function packageJsonCustom(opts) {
         start: "next start"
       },
       dependencies: {
-        // >=2.4.0 for `@dashai/sdk/platform`, which app/layout.tsx imports. A
-        // ^2.3.0 floor resolves to 2.3.0 until 2.4.0 publishes, failing the
-        // first `next build` with an opaque module-not-found.
-        "@dashai/sdk": "^2.4.0",
+        // >=2.4.0 for `@dashai/sdk/platform`, which app/layout.tsx
+        // imports, and >=2.5.0 for `uses` (S-02) — a project resolved
+        // below that fails with "every import from @dashai/generated
+        // throws", which points nowhere near the cause.
+        "@dashai/sdk": SCAFFOLD_SDK_RANGE,
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0",
@@ -3747,69 +4069,63 @@ primary_region = "iad"
 var DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, MODULE_SLUG_REGEX;
 var init_scaffold = __esm({
   "src/lib/scaffold.ts"() {
+    init_sdk_version();
     DEPLOY_TARGETS = ["railway", "vercel", "fly"];
     SCAFFOLD_DEFAULT_API_URL = "http://localhost:3000";
     MODULE_SLUG_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
   }
 });
-async function selectWorkspace(opts) {
-  const workspaces = await apiRequest(
-    "GET",
-    "/api/workspaces",
-    void 0,
-    { baseUrl: opts.apiUrl, auth: { token: opts.apiToken } }
-  );
-  if (workspaces.length === 0) {
-    throw new Error(
-      "No workspaces found for your account. Create a workspace at the Dashwise dashboard first."
-    );
-  }
-  if (opts.flag !== void 0) {
-    return matchWorkspaceOrThrow(workspaces, opts.flag);
+function resolveTargetDir(slug, dirFlag) {
+  if (dirFlag !== void 0) return { dir: resolve(dirFlag) };
+  const cwd = process.cwd();
+  const nested = resolve(slug);
+  if (basename(cwd) !== slug) return { dir: nested };
+  const manifestPath2 = join(cwd, "module.json");
+  if (existsSync(manifestPath2)) {
+    const existingSlug = readManifestSlug(manifestPath2);
+    if (existingSlug === slug) {
+      return {
+        dir: cwd,
+        notice: `Re-provisioning ${code(slug)} in place \u2014 ${code(cwd)} already holds its ${code("module.json")}.`
+      };
+    }
+    if (existingSlug !== null) {
+      return {
+        dir: cwd,
+        refuse: `${code(cwd)} is the project directory for ${code(existingSlug)}, not ${code(slug)}. Run this from the parent directory, or pass ${code(`--dir <path>`)} to say where ${code(slug)} should go.`
+      };
+    }
+    return {
+      dir: cwd,
+      notice: `Scaffolding into ${code(cwd)} \u2014 it already holds a ${code("module.json")}.`
+    };
   }
-  if (workspaces.length === 1) {
-    return workspaces[0];
+  let entries;
+  try {
+    entries = readdirSync(cwd);
+  } catch {
+    return { dir: nested };
   }
-  if (opts.interactive && process.stdout.isTTY) {
-    const choice = await select({
-      message: "Which workspace should this module live in?",
-      options: workspaces.map((w) => ({
-        value: w.slug,
-        label: w.name,
-        hint: `slug=${w.slug}, id=${w.id}`
-      }))
-    });
-    if (isCancel(choice)) {
-      throw new Error("Aborted.");
-    }
-    const picked = workspaces.find((w) => w.slug === choice);
-    if (!picked) {
-      throw new Error(`Internal error: selection "${String(choice)}" did not match any workspace.`);
-    }
-    return picked;
+  if (entries.length === 0) {
+    return {
+      dir: cwd,
+      notice: `Scaffolding into ${code(cwd)} \u2014 an empty directory already named ${code(slug)}.`
+    };
   }
-  const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id}, name="${w.name}")`).join("\n");
-  throw new Error(
-    `You have ${workspaces.length} workspaces. Re-run with --workspace <slug-or-id> to pick one:
-${list}`
-  );
+  return {
+    dir: nested,
+    nestWarning: `You are inside a directory called ${code(slug)}, so this creates ${code(nested)}. Pass ${code("--dir .")} to scaffold here instead.`
+  };
 }
-function matchWorkspaceOrThrow(workspaces, flag) {
-  const asNumber = Number.parseInt(flag, 10);
-  const isNumeric = !Number.isNaN(asNumber) && String(asNumber) === flag;
-  const match = isNumeric ? workspaces.find((w) => w.id === asNumber) : workspaces.find((w) => w.slug === flag);
-  if (!match) {
-    const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id})`).join("\n");
-    throw new Error(`No workspace matching --workspace=${flag}. Available:
-${list}`);
+function readManifestSlug(manifestPath2) {
+  try {
+    const parsed = JSON.parse(readFileSync(manifestPath2, "utf-8"));
+    const value = parsed.module?.slug;
+    return typeof value === "string" && value.length > 0 ? value : null;
+  } catch {
+    return null;
   }
-  return match;
 }
-var init_workspaces = __esm({
-  "src/lib/workspaces.ts"() {
-    init_api_client();
-  }
-});
 async function moduleInitCommand(slugArg, options) {
   intro("Scaffolding a new Dashwise module");
   let slug = slugArg;
@@ -3834,7 +4150,14 @@ async function moduleInitCommand(slugArg, options) {
     return 1;
   }
   const name = options.name ?? humanizeSlug(slug);
-  const dir = resolve(options.dir ?? slug);
+  const resolved = resolveTargetDir(slug, options.dir);
+  if (resolved.refuse) {
+    fail(resolved.refuse);
+    return 1;
+  }
+  const dir = resolved.dir;
+  if (resolved.notice) info(resolved.notice);
+  if (resolved.nestWarning) warn(resolved.nestWarning);
   const manifestExists = existsSync(join(dir, "module.json"));
   if (options.provisionOnly && !manifestExists) {
     fail(
@@ -5353,26 +5676,86 @@ function installExcessArgumentsGuard(program2) {
 init_output();
 
 // src/program.ts
+init_config();
 init_dev();
 
 // src/commands/login.ts
 init_api_client();
+
+// src/lib/device-code.ts
+init_api_client();
+var DEFAULT_TOKEN_NAME = "dashwise-cli";
+async function requestDeviceCode(args) {
+  return await apiRequest(
+    "POST",
+    "/api/auth/cli/device-code",
+    { name: args.name ?? DEFAULT_TOKEN_NAME },
+    { auth: "public", baseUrl: args.apiUrl }
+  );
+}
+async function pollForApproval(args) {
+  const sleep4 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = args.now ?? (() => Date.now());
+  const pollIntervalMs = Math.max(1e3, args.intervalSeconds * 1e3);
+  const deadline = now() + args.expiresInSeconds * 1e3;
+  while (now() < deadline) {
+    let res;
+    try {
+      res = await apiRequest(
+        "POST",
+        "/api/auth/cli/poll",
+        { deviceCode: args.deviceCode },
+        { auth: "public", baseUrl: args.apiUrl }
+      );
+    } catch (err) {
+      return { status: "error", message: err.message };
+    }
+    switch (res.status) {
+      case "pending":
+      case "slow_down":
+        await sleep4(pollIntervalMs);
+        continue;
+      case "denied":
+        return { status: "denied" };
+      case "expired":
+        return { status: "expired" };
+      case "approved":
+        if (!res.token || !res.tokenId) return { status: "no_token" };
+        return { status: "approved", token: res.token, tokenId: res.tokenId };
+    }
+  }
+  return { status: "timeout" };
+}
+async function fetchProfile(args) {
+  return await apiRequest("GET", "/api/auth/me", void 0, {
+    auth: { token: args.token },
+    baseUrl: args.apiUrl
+  });
+}
+function buildCliConfig(args) {
+  return {
+    apiUrl: args.apiUrl,
+    token: args.token,
+    tokenId: args.tokenId,
+    user: {
+      id: args.me.id,
+      email: args.me.email,
+      username: args.me.username,
+      firstName: args.me.first_name,
+      lastName: args.me.last_name
+    }
+  };
+}
+
+// src/commands/login.ts
 init_config();
 init_output();
-var DEFAULT_TOKEN_NAME = "dashwise-cli";
 async function loginCommand(options) {
   const apiUrl = (options.apiUrl ?? resolveApiUrl()).replace(/\/+$/, "");
   intro(`Logging into ${code(apiUrl)}`);
   let dc;
   try {
-    dc = await apiRequest(
-      "POST",
-      "/api/auth/cli/device-code",
-      {
-        name: options.name ?? DEFAULT_TOKEN_NAME
-      },
-      { auth: "public", baseUrl: apiUrl }
-    );
+    dc = await requestDeviceCode({ apiUrl, name: options.name ?? DEFAULT_TOKEN_NAME });
   } catch (err) {
     fail(formatApiError("Could not start login flow", err));
     return 1;
@@ -5412,85 +5795,50 @@ async function loginCommand(options) {
   }
   const sp = spinner();
   sp.start("Waiting for approval");
-  const overallDeadline = Date.now() + dc.expiresIn * 1e3;
-  let outcome = null;
-  const pollIntervalMs = Math.max(1e3, dc.interval * 1e3);
-  pollLoop: while (Date.now() < overallDeadline) {
-    let res;
-    try {
-      res = await apiRequest(
-        "POST",
-        "/api/auth/cli/poll",
-        { deviceCode: dc.deviceCode },
-        { auth: "public", baseUrl: apiUrl }
-      );
-    } catch (err) {
-      sp.stop(`Poll failed: ${err.message}`);
+  const outcome = await pollForApproval({
+    apiUrl,
+    deviceCode: dc.deviceCode,
+    intervalSeconds: dc.interval,
+    expiresInSeconds: dc.expiresIn
+  });
+  switch (outcome.status) {
+    case "error":
+      sp.stop(`Poll failed: ${outcome.message}`);
       fail("Poll failed mid-flight; you can re-run `dashwise login` to retry.");
       return 1;
-    }
-    switch (res.status) {
-      case "pending":
-      case "slow_down":
-        await sleep(pollIntervalMs);
-        continue pollLoop;
-      case "denied":
-        sp.stop("Login denied by user.");
-        cancel("Aborted.");
-        return 1;
-      case "expired":
-        sp.stop("Login code expired.");
-        fail("The code expired before approval. Run `dashwise login` again.");
-        return 1;
-      case "approved":
-        outcome = res;
-        break pollLoop;
-    }
-  }
-  if (!outcome) {
-    sp.stop("Timed out waiting for approval.");
-    fail("Login took too long to be approved. Run `dashwise login` again.");
-    return 1;
-  }
-  if (!outcome.token || !outcome.tokenId) {
-    sp.stop("Approval received but token missing from response.");
-    fail(
-      "Approval received but the backend did not return a token. Run `dashwise logout` then `dashwise login` to retry."
-    );
-    return 1;
+    case "denied":
+      sp.stop("Login denied by user.");
+      cancel("Aborted.");
+      return 1;
+    case "expired":
+      sp.stop("Login code expired.");
+      fail("The code expired before approval. Run `dashwise login` again.");
+      return 1;
+    case "timeout":
+      sp.stop("Timed out waiting for approval.");
+      fail("Login took too long to be approved. Run `dashwise login` again.");
+      return 1;
+    case "no_token":
+      sp.stop("Approval received but token missing from response.");
+      fail(
+        "Approval received but the backend did not return a token. Run `dashwise logout` then `dashwise login` to retry."
+      );
+      return 1;
   }
   let me;
   try {
-    me = await apiRequest("GET", "/api/auth/me", void 0, {
-      auth: { token: outcome.token },
-      baseUrl: apiUrl
-    });
+    me = await fetchProfile({ apiUrl, token: outcome.token });
   } catch (err) {
     sp.stop("Approval accepted but profile fetch failed.");
     fail(formatApiError("Could not load user profile", err));
     return 1;
   }
-  const cfg = {
-    apiUrl,
-    token: outcome.token,
-    tokenId: outcome.tokenId,
-    user: {
-      id: me.id,
-      email: me.email,
-      username: me.username,
-      firstName: me.first_name,
-      lastName: me.last_name
-    }
-  };
-  writeConfig(cfg);
+  writeConfig(buildCliConfig({ apiUrl, token: outcome.token, tokenId: outcome.tokenId, me }));
   sp.stop("Approved.");
   success(`Logged in as ${code(me.email)}`);
   outro("You can now run `dashwise profile`, `dashwise workspace list`, etc.");
   return 0;
 }
-function sleep(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
-}
 function formatSeconds(seconds) {
   if (seconds < 60) return `${seconds}s`;
   const minutes = Math.round(seconds / 60);
@@ -5655,9 +6003,1261 @@ function toMe(cached) {
   };
 }
 
+// src/commands/mcp.ts
+init_api_client();
+init_config();
+var SESSION_HEADER = "mcp-session-id";
+var PROTOCOL_HEADER = "MCP-Protocol-Version";
+var ACCEPT = "application/json, text/event-stream";
+var PROXY_TOOLS_LIST_ID = "dashwise-cli:tools-list";
+var PROXY_REINITIALIZE_ID = "dashwise-cli:reinitialize";
+function defaultEndpointLabel() {
+  const raw = hostname() || "unknown";
+  const cleaned = raw.replace(/\.local$/i, "").replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[^A-Za-z0-9]+/, "").slice(0, 64);
+  return cleaned.length > 0 ? cleaned : "unknown";
+}
+function redactUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const segments = parsed.pathname.split("/");
+    if (segments.length > 0) segments[segments.length - 1] = "\u2026";
+    return `${parsed.origin}${segments.join("/")}`;
+  } catch {
+    return "<invalid url>";
+  }
+}
+function inspectElement(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const frame = value;
+  const id = typeof frame.id === "string" || typeof frame.id === "number" ? frame.id : null;
+  const method = typeof frame.method === "string" ? frame.method : void 0;
+  let toolName;
+  if (method === "tools/call" && frame.params && typeof frame.params === "object") {
+    const name = frame.params.name;
+    if (typeof name === "string") toolName = name;
+  }
+  return { id, method, toolName };
+}
+function inspectFrame(text4) {
+  let value;
+  try {
+    value = JSON.parse(text4);
+  } catch {
+    return null;
+  }
+  if (Array.isArray(value)) {
+    const elements = value.map(inspectElement).filter((e) => e !== null);
+    return {
+      id: null,
+      method: void 0,
+      toolName: void 0,
+      isBatch: true,
+      elements
+    };
+  }
+  const single = inspectElement(value);
+  if (!single) return null;
+  return { ...single, isBatch: false, elements: [single] };
+}
+function readOnlyToolsFrom(text4) {
+  let value;
+  try {
+    value = JSON.parse(text4);
+  } catch {
+    return null;
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const result = value.result;
+  if (!result || typeof result !== "object") return null;
+  const tools = result.tools;
+  if (!Array.isArray(tools)) return null;
+  const out2 = /* @__PURE__ */ new Set();
+  for (const tool of tools) {
+    if (!tool || typeof tool !== "object") continue;
+    const t = tool;
+    const name = typeof t.name === "string" ? t.name : null;
+    const annotations = t.annotations;
+    if (name && annotations && typeof annotations === "object" && annotations.readOnlyHint === true) {
+      out2.add(name);
+    }
+  }
+  return out2;
+}
+function isReadOnlyRefusal(id, toolName, knownReadTools) {
+  const reason = knownReadTools === null ? `Refused: \`dashwise mcp --read-only\` could not read this server's tool list, so it cannot tell reads from writes and refuses everything. Reconnect without --read-only to use "${toolName}".` : `Refused: "${toolName}" is not a read-only tool and this session was started with \`dashwise mcp --read-only\`. Reconnect without the flag to use it.`;
+  return {
+    jsonrpc: "2.0",
+    id,
+    result: {
+      isError: true,
+      content: [{ type: "text", text: reason }]
+    }
+  };
+}
+function transportErrorFrame(id, message) {
+  return {
+    jsonrpc: "2.0",
+    id,
+    // -32000 is the JSON-RPC "implementation-defined server error" band. A
+    // dead pipe with NO frame is the one outcome worth avoiding above all
+    // others: it leaves Claude Code waiting forever on a request that will
+    // never be answered (`cli-mcp-command.md` §4.4).
+    error: { code: -32e3, message }
+  };
+}
+function startMcpProxy(opts) {
+  const stdin = opts.stdin ?? process.stdin;
+  const stdout = opts.stdout ?? process.stdout;
+  const log2 = opts.log ?? ((line) => process.stderr.write(`${line}
+`));
+  const doFetch = opts.fetchImpl ?? globalThis.fetch;
+  const reconnectMs = opts.reconnectMs ?? 2e3;
+  const verbose = opts.verbose === true;
+  const readOnly = opts.readOnly === true;
+  let session = opts.session;
+  let sessionId = null;
+  let protocolVersion = null;
+  let readTools = null;
+  let reauthAttempt = null;
+  let reauthSpent = false;
+  let stopped = false;
+  let exitCode = 0;
+  let streamTimer = null;
+  let streamAbort = null;
+  let streamUnavailable = false;
+  let streamStarted = false;
+  let resolveDone;
+  const done = new Promise((resolve14) => {
+    resolveDone = resolve14;
+  });
+  const trace = (line) => {
+    if (verbose) log2(line);
+  };
+  const emit = (payload) => {
+    stdout.write(`${JSON.stringify(payload)}
+`);
+  };
+  const emitFrame = (text4, source) => {
+    let parsed;
+    try {
+      parsed = JSON.parse(text4);
+    } catch {
+      log2(
+        `Discarded a non-JSON response from ${redactUrl(session.connectUrl)} (${source}); stdout carries MCP frames only.`
+      );
+      trace(`discarded ${Buffer.byteLength(text4, "utf8")} bytes of non-JSON`);
+      return;
+    }
+    const looksJsonRpc = Array.isArray(parsed) ? parsed.every(
+      (e) => e !== null && typeof e === "object" && "jsonrpc" in e
+    ) : parsed !== null && typeof parsed === "object" && "jsonrpc" in parsed;
+    if (!looksJsonRpc) {
+      log2(
+        `Discarded a JSON response from ${redactUrl(session.connectUrl)} that is not JSON-RPC (${source}).`
+      );
+      return;
+    }
+    if (text4.includes("\n") || text4.includes("\r")) {
+      trace("reflowed a multi-line frame onto one line (stdio is line-delimited)");
+      stdout.write(`${text4.replace(/[\r\n]+/g, " ")}
+`);
+      return;
+    }
+    stdout.write(`${text4}
+`);
+  };
+  const requestHeaders = (isInitialize) => {
+    const headers = {
+      "Content-Type": "application/json",
+      Accept: ACCEPT
+    };
+    if (sessionId) headers["Mcp-Session-Id"] = sessionId;
+    if (protocolVersion && !isInitialize) {
+      headers[PROTOCOL_HEADER] = protocolVersion;
+    }
+    return headers;
+  };
+  const attemptReauth = () => {
+    if (reauthAttempt !== null && !reauthSpent) return reauthAttempt;
+    if (reauthSpent || !opts.reauth) return Promise.resolve(false);
+    const reauth = opts.reauth;
+    reauthAttempt = (async () => {
+      log2("The session key expired or was rotated \u2014 re-authenticating once.");
+      try {
+        session = await reauth();
+        sessionId = null;
+        return true;
+      } catch (err) {
+        log2(`Re-authentication failed: ${err.message}`);
+        return false;
+      } finally {
+        reauthSpent = true;
+      }
+    })();
+    return reauthAttempt;
+  };
+  const reinitialize = async () => {
+    const frame = JSON.stringify({
+      jsonrpc: "2.0",
+      id: PROXY_REINITIALIZE_ID,
+      method: "initialize",
+      params: {
+        // Echo what was negotiated the first time, so the server is not asked
+        // to renegotiate a version the client upstream has already committed
+        // to. The floor is only reached if we never saw a handshake at all.
+        protocolVersion: protocolVersion ?? "2024-11-05",
+        capabilities: {},
+        clientInfo: { name: "dashwise-cli", version: "0" }
+      }
+    });
+    try {
+      const res = await post(frame, true);
+      if (!res || !res.ok) {
+        trace(`re-initialize refused (HTTP ${res?.status ?? "none"}).`);
+        return false;
+      }
+      captureTransportState(res, await res.text());
+      return sessionId !== null;
+    } catch (err) {
+      trace(`re-initialize failed: ${err.message}`);
+      return false;
+    }
+  };
+  const post = async (text4, isInitialize) => {
+    if (stopped) return null;
+    return doFetch(session.connectUrl, {
+      method: "POST",
+      headers: requestHeaders(isInitialize),
+      body: text4
+    });
+  };
+  const captureTransportState = (res, bodyText) => {
+    const returned = res.headers.get(SESSION_HEADER);
+    if (returned) sessionId = returned;
+    if (protocolVersion === null) {
+      try {
+        const parsed = JSON.parse(bodyText);
+        const result = parsed.result;
+        const negotiated = result?.protocolVersion;
+        if (typeof negotiated === "string") protocolVersion = negotiated;
+      } catch {
+      }
+    }
+    const learned = readOnlyToolsFrom(bodyText);
+    if (learned !== null) readTools = learned;
+  };
+  const relay = async (text4, frame) => {
+    const isInitialize = frame?.method === "initialize";
+    let res;
+    try {
+      res = await post(text4, isInitialize);
+    } catch (err) {
+      const message = err.message;
+      log2(`Transport error talking to ${redactUrl(session.connectUrl)}: ${message}`);
+      emit(transportErrorFrame(frame?.id ?? null, `Transport error: ${message}`));
+      return { kind: "failed" };
+    }
+    if (res === null) return { kind: "failed" };
+    if (res.status === 401 && opts.reauth) {
+      const fresh = await attemptReauth();
+      if (!fresh) {
+        emit(
+          transportErrorFrame(
+            frame?.id ?? null,
+            "Re-authentication failed; the Dashwise session could not be renewed."
+          )
+        );
+        exitCode = 1;
+        stop();
+        return { kind: "failed" };
+      }
+      res = await post(text4, isInitialize);
+      if (res === null) return { kind: "failed" };
+    }
+    const bodyText = await res.text();
+    if (!res.ok) {
+      const detail = res.status === 401 ? "the endpoint key is no longer valid (expired, rotated by another `dashwise mcp`, or revoked)" : `HTTP ${res.status}`;
+      log2(`Refused by ${redactUrl(session.connectUrl)}: ${detail}`);
+      emit(transportErrorFrame(frame?.id ?? null, `Dashwise MCP server: ${detail}`));
+      if (res.status === 401) {
+        exitCode = 1;
+        stop();
+      }
+      return { kind: "failed" };
+    }
+    captureTransportState(res, bodyText);
+    if (res.status === 202 || bodyText.trim().length === 0) {
+      return { kind: "empty" };
+    }
+    return { kind: "body", text: bodyText };
+  };
+  const learnReadOnlyTools = async () => {
+    if (!readOnly || readTools !== null || stopped) return;
+    const probe = JSON.stringify({
+      jsonrpc: "2.0",
+      id: PROXY_TOOLS_LIST_ID,
+      method: "tools/list",
+      params: {}
+    });
+    try {
+      const res = await post(probe, false);
+      if (!res || !res.ok) {
+        trace("read-only guard: tools/list probe was refused; failing closed.");
+        return;
+      }
+      const text4 = await res.text();
+      captureTransportState(res, text4);
+      const learned = readOnlyToolsFrom(text4);
+      trace(`read-only guard: ${learned?.size ?? 0} read-only tools learned from tools/list.`);
+    } catch (err) {
+      trace(
+        `read-only guard: tools/list probe failed (${err.message}); failing closed.`
+      );
+    }
+  };
+  const handleLine = async (line) => {
+    const text4 = line.trim();
+    if (text4.length === 0) return;
+    const frame = inspectFrame(text4);
+    trace(
+      `\u2192 ${frame?.method ?? (frame?.isBatch ? "batch" : "frame")} (${Buffer.byteLength(text4, "utf8")} bytes)`
+    );
+    const refusable = readOnly ? (frame?.elements ?? []).filter(
+      (e) => e.toolName !== void 0 && !readTools?.has(e.toolName)
+    ) : [];
+    if (refusable.length > 0) {
+      const names = refusable.map((e) => e.toolName).join(", ");
+      trace(
+        `read-only guard refused ${names}${frame?.isBatch ? " (whole batch)" : ""}`
+      );
+      if (frame?.isBatch) {
+        const replies = frame.elements.filter((e) => e.id !== null).map(
+          (e) => isReadOnlyRefusal(e.id, e.toolName ?? "(batch)", readTools)
+        );
+        if (replies.length > 0) emit(replies);
+      } else {
+        emit(isReadOnlyRefusal(frame.id, refusable[0].toolName, readTools));
+      }
+      return;
+    }
+    const outcome = await relay(text4, frame);
+    if (outcome.kind === "failed") return;
+    if (outcome.kind === "body") {
+      trace(`\u2190 response (${Buffer.byteLength(outcome.text, "utf8")} bytes)`);
+      emitFrame(outcome.text, "POST response");
+    }
+    if (frame?.method === "initialize") {
+      await learnReadOnlyTools();
+    } else if (frame?.method === "notifications/initialized") {
+      openServerStream();
+    }
+  };
+  const scheduleStreamRetry = () => {
+    if (stopped || streamUnavailable) return;
+    streamTimer = setTimeout(() => {
+      streamTimer = null;
+      void runServerStream();
+    }, reconnectMs);
+  };
+  const runServerStream = async () => {
+    if (stopped || streamUnavailable) return;
+    streamAbort = new AbortController();
+    let res;
+    try {
+      res = await doFetch(session.connectUrl, {
+        method: "GET",
+        headers: {
+          Accept: "text/event-stream",
+          ...sessionId ? { "Mcp-Session-Id": sessionId } : {},
+          ...protocolVersion ? { [PROTOCOL_HEADER]: protocolVersion } : {}
+        },
+        signal: streamAbort.signal
+      });
+    } catch (err) {
+      if (stopped) return;
+      trace(`server stream: ${err.message}; retrying.`);
+      scheduleStreamRetry();
+      return;
+    }
+    if (res.status === 405 || res.status === 404) {
+      streamUnavailable = true;
+      trace(
+        `server stream: this server has no server-initiated stream (HTTP ${res.status}); not retrying.`
+      );
+      return;
+    }
+    if (res.status === 401) {
+      const fresh = await attemptReauth();
+      if (fresh) {
+        if (await reinitialize()) {
+          streamUnavailable = false;
+          streamStarted = false;
+          trace("server stream: re-authenticated and re-initialized; reopening.");
+          openServerStream();
+          return;
+        }
+        trace("server stream: re-authenticated but could not re-initialize.");
+      }
+      streamUnavailable = true;
+      log2(
+        `Server stream refused by ${redactUrl(session.connectUrl)}: the session could not be renewed (the endpoint key expired, was rotated, or was revoked).`
+      );
+      emit(
+        transportErrorFrame(
+          null,
+          "Dashwise MCP server: the session could not be renewed; the server stream is closed."
+        )
+      );
+      exitCode = 1;
+      stop();
+      return;
+    }
+    if (!res.ok || !res.body) {
+      streamUnavailable = true;
+      trace(
+        `server stream: HTTP ${res.status}${res.body ? "" : " with no body"}; not retrying.`
+      );
+      return;
+    }
+    trace("server stream: open.");
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer2 = "";
+    try {
+      for (; ; ) {
+        const { done: finished, value } = await reader.read();
+        if (finished) break;
+        buffer2 += decoder.decode(value, { stream: true });
+        let sep3 = buffer2.indexOf("\n\n");
+        while (sep3 !== -1) {
+          const event = buffer2.slice(0, sep3);
+          buffer2 = buffer2.slice(sep3 + 2);
+          const payload = eventData(event);
+          if (payload !== null) emitFrame(payload, "server stream");
+          sep3 = buffer2.indexOf("\n\n");
+        }
+      }
+    } catch (err) {
+      if (!stopped) trace(`server stream dropped: ${err.message}`);
+    }
+    if (!stopped) {
+      trace("server stream closed; reconnecting.");
+      scheduleStreamRetry();
+    }
+  };
+  const openServerStream = () => {
+    if (streamStarted || stopped) return;
+    streamStarted = true;
+    void runServerStream();
+  };
+  let pending = Promise.resolve();
+  let buffer = "";
+  const onData = (chunk) => {
+    buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    let nl = buffer.indexOf("\n");
+    while (nl !== -1) {
+      const line = buffer.slice(0, nl);
+      buffer = buffer.slice(nl + 1);
+      pending = pending.then(() => handleLine(line));
+      nl = buffer.indexOf("\n");
+    }
+  };
+  const onEnd = () => {
+    void pending.then(() => {
+      stop();
+    });
+  };
+  stdin.on("data", onData);
+  stdin.on("end", onEnd);
+  stdin.on("close", onEnd);
+  if (typeof stdin.resume === "function") {
+    stdin.resume();
+  }
+  function stop() {
+    if (stopped) return;
+    stopped = true;
+    if (streamTimer) {
+      clearTimeout(streamTimer);
+      streamTimer = null;
+    }
+    if (streamAbort) {
+      streamAbort.abort();
+      streamAbort = null;
+    }
+    stdin.off("data", onData);
+    stdin.off("end", onEnd);
+    stdin.off("close", onEnd);
+    if (typeof stdin.pause === "function") {
+      stdin.pause();
+    }
+    resolveDone(exitCode);
+  }
+  return {
+    stop,
+    isRunning: () => !stopped,
+    done
+  };
+}
+function eventData(event) {
+  const parts = [];
+  for (const line of event.split("\n")) {
+    if (!line.startsWith("data:")) continue;
+    const chunk = line.slice(5);
+    parts.push(chunk.startsWith(" ") ? chunk.slice(1) : chunk);
+  }
+  if (parts.length === 0) return null;
+  const payload = parts.join("\n").trim();
+  return payload.length > 0 ? payload : null;
+}
+
+// src/lib/mcp-scope.ts
+var MCP_SCOPES_MAX_ITEMS = 64;
+var MAX_ID = 2147483647;
+var SCOPE_PATTERN = /^datahub:(?:(table|app)=([1-9][0-9]{0,9})|(workspace)):([crud]{1,4})$/;
+var MCP_GOVERNANCE_WORKSPACE_READ_SCOPE = "governance:workspace:r";
+var GRAMMAR_HINT = "Expected datahub:table=<id>:<ops>, datahub:app=<id>:<ops>, datahub:workspace:<ops> or governance:workspace:r, where <ops> is one to four of c, r, u and d, each at most once.";
+function isMcpScope(raw) {
+  if (typeof raw !== "string") return false;
+  if (raw === MCP_GOVERNANCE_WORKSPACE_READ_SCOPE) return true;
+  const match = SCOPE_PATTERN.exec(raw);
+  if (!match) return false;
+  const idText = match[2];
+  const opsText = match[4];
+  if (new Set(opsText).size !== opsText.length) return false;
+  if (idText !== void 0) {
+    const id = Number(idText);
+    if (!Number.isSafeInteger(id) || id > MAX_ID) return false;
+  }
+  return true;
+}
+function checkMcpScopes(scopes, flag = "--scope") {
+  if (scopes.length > MCP_SCOPES_MAX_ITEMS) {
+    return {
+      ok: false,
+      message: `At most ${MCP_SCOPES_MAX_ITEMS} ${flag} grants fit one session; got ${scopes.length}.`
+    };
+  }
+  const bad = scopes.findIndex((scope) => !isMcpScope(scope));
+  if (bad !== -1) {
+    return {
+      ok: false,
+      message: `${flag} ${JSON.stringify(scopes[bad])} is not a scope. ${GRAMMAR_HINT}`
+    };
+  }
+  return { ok: true };
+}
+
+// src/commands/mcp.ts
+init_output();
+function fileExists(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function whereOnWindows(cmd, env, isFile) {
+  const extensions = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  for (const dir of (env.PATH ?? env.Path ?? "").split(";")) {
+    if (!dir) continue;
+    for (const ext of extensions) {
+      const candidate = win32.join(dir, `${cmd}${ext.toLowerCase()}`);
+      if (isFile(candidate)) return candidate;
+    }
+  }
+  return void 0;
+}
+function spawnTarget(cmd, args, opts = {}) {
+  const direct = { command: cmd, args, shell: false };
+  if ((opts.platform ?? process.platform) !== "win32") return direct;
+  const found = whereOnWindows(cmd, opts.env ?? process.env, opts.isFile ?? fileExists);
+  if (found === void 0 || !/\.(cmd|bat)$/i.test(found)) return direct;
+  const unsafe = args.find((arg) => /["%\r\n]/.test(arg));
+  if (unsafe !== void 0) {
+    return {
+      refused: `cannot pass ${JSON.stringify(unsafe)} to ${found}: cmd.exe would act on the quote, % or line break in it.`
+    };
+  }
+  return { command: [found, ...args].map((part) => `"${part}"`).join(" "), args: [], shell: true };
+}
+
+// src/commands/mcp.ts
+init_workspaces();
+var SCOPES_NOT_APPLIED = "This Dashwise server minted the session but did not confirm any scopes, so the key is NOT narrowed. The session was not started, and its revocation was requested. Update the backend, or run without --scope.";
+var REVOKE_TIMEOUT_MS = 2e3;
+async function openCliSession(args) {
+  const res = await apiRequest("POST", "/api/mcp-endpoints/cli-session", {
+    workspace: args.workspaceId,
+    label: args.label,
+    // Only when the flag was given: a body without the key is what every
+    // backend accepts, and one before `--scope` refuses the key as unknown.
+    ...args.scopes !== void 0 ? { scopes: args.scopes } : {}
+  });
+  return {
+    connectUrl: res.connect_url,
+    endpointId: res.endpoint_id,
+    expiresAt: res.expires_at,
+    name: res.name,
+    scopes: res.scopes
+  };
+}
+function describeScopes(scopes) {
+  if (scopes === null || scopes === void 0) {
+    return "Scopes: none \u2014 this key reaches what your account can in this workspace (narrow it with --scope).";
+  }
+  if (scopes.length === 0) return "Scopes: deny-all \u2014 no data tool is available to this key.";
+  return `Scopes (as stored by the server): ${scopes.join(", ")}.`;
+}
+async function revokeSession(endpointId) {
+  const attempt = apiRequest("POST", `/api/mcp-endpoints/${endpointId}/revoke`).then(
+    () => true,
+    () => false
+  );
+  const timeout = new Promise(
+    (resolve14) => setTimeout(() => resolve14(false), REVOKE_TIMEOUT_MS).unref()
+  );
+  await Promise.race([attempt, timeout]);
+}
+function describeSessionError(err, apiUrl, scopes) {
+  if (!(err instanceof ApiError)) return err.message;
+  if (err.status === 0) {
+    return `Could not reach the Dashwise backend at ${apiUrl}: ${err.message}`;
+  }
+  if (err.status === 401) {
+    return "Your saved credentials are no longer valid. Run `dashwise login` again.";
+  }
+  if (err.code === "SCOPE_EXCEEDS_CREATOR_ACCESS") {
+    const scope = typeof err.context?.scope === "string" ? err.context.scope : void 0;
+    const lead = scope ? `--scope ${scope} reaches beyond your own access in this workspace` : "A --scope grant reaches beyond your own access in this workspace";
+    return `${lead}; a scope can only narrow what you can already do. ${err.message}`;
+  }
+  if (err.code === "SCOPE_MALFORMED") {
+    const index = typeof err.context?.index === "number" ? err.context.index : void 0;
+    const grant = index !== void 0 ? scopes?.[index] : void 0;
+    return grant !== void 0 ? `The server does not accept --scope ${grant}: ${err.message}` : `The server refused --scope: ${err.message}`;
+  }
+  if (scopes !== void 0 && err.status === 400 && /\bscopes\b/.test(err.message)) {
+    return `The server refused the scopes field (${err.message}). A Dashwise backend older than --scope answers this way; update it, or run without --scope.`;
+  }
+  return err.message;
+}
+async function resolveWorkspace(apiUrl, apiToken, flag) {
+  const cfg = readConfig();
+  const wanted = flag ?? cfg?.workspaceSlug;
+  return selectWorkspace({
+    apiUrl,
+    apiToken,
+    ...wanted !== void 0 ? { flag: wanted } : {},
+    // Never interactive: this command's stdout is a protocol channel and its
+    // stdin belongs to the MCP client. A prompt here would deadlock a client
+    // that launched us as a subprocess.
+    interactive: false
+  });
+}
+async function mcpCommand(options = {}) {
+  const scopes = options.scopes;
+  if (scopes !== void 0) {
+    const checked = checkMcpScopes(scopes);
+    if (!checked.ok) {
+      fail(checked.message);
+      return 1;
+    }
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    fail("Not logged in. Run `dashwise login` first.");
+    return 1;
+  }
+  const apiUrl = resolveApiUrl();
+  let workspace2;
+  try {
+    workspace2 = await resolveWorkspace(apiUrl, cfg.token, options.workspace);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const label = options.endpointName ?? defaultEndpointLabel();
+  let session;
+  try {
+    session = await openCliSession({
+      workspaceId: workspace2.id,
+      label,
+      ...scopes !== void 0 ? { scopes } : {}
+    });
+  } catch (err) {
+    fail(describeSessionError(err, apiUrl, scopes));
+    return 1;
+  }
+  if (scopes !== void 0 && !Array.isArray(session.scopes)) {
+    await revokeSession(session.endpointId);
+    fail(SCOPES_NOT_APPLIED);
+    return 1;
+  }
+  info(
+    `Dashwise MCP \u2014 workspace ${workspace2.slug}, endpoint #${session.endpointId} (${session.name}).`
+  );
+  info(`Session key expires ${dim(session.expiresAt)}.`);
+  info(describeScopes(session.scopes));
+  if (options.readOnly) {
+    warn(
+      "Read-only: write tools are refused by this proxy (a client-side guard, not a server-enforced scope \u2014 for that, use --scope)."
+    );
+  }
+  let ownedEndpointId = session.endpointId;
+  const proxy = startMcpProxy({
+    session,
+    reauth: async () => {
+      const fresh = await openCliSession({
+        workspaceId: workspace2.id,
+        label,
+        ...scopes !== void 0 ? { scopes } : {}
+      });
+      if (scopes !== void 0 && !Array.isArray(fresh.scopes)) {
+        await revokeSession(fresh.endpointId);
+        throw new Error(SCOPES_NOT_APPLIED);
+      }
+      ownedEndpointId = fresh.endpointId;
+      return fresh;
+    },
+    ...options.readOnly !== void 0 ? { readOnly: options.readOnly } : {},
+    ...options.verbose !== void 0 ? { verbose: options.verbose } : {}
+  });
+  const shutdown = () => proxy.stop();
+  process.once("SIGINT", shutdown);
+  process.once("SIGTERM", shutdown);
+  try {
+    const exitCode = await proxy.done;
+    await revokeSession(ownedEndpointId);
+    return exitCode;
+  } finally {
+    process.off("SIGINT", shutdown);
+    process.off("SIGTERM", shutdown);
+  }
+}
+function claudeMcpAddArgv(args) {
+  const argv = [
+    "mcp",
+    "add",
+    args.serverName,
+    "--scope",
+    args.scope,
+    "--",
+    "dashwise",
+    "mcp",
+    "--workspace",
+    args.workspaceSlug
+  ];
+  for (const grant of args.grantScopes ?? []) argv.push("--scope", grant);
+  if (args.readOnly) argv.push("--read-only");
+  if (args.endpointName) argv.push("--endpoint-name", args.endpointName);
+  return argv;
+}
+async function mcpAddCommand(options = {}) {
+  const serverName = options.name ?? "dashwise";
+  const scope = options.scope ?? "local";
+  if (options.grantScopes !== void 0) {
+    const checked = checkMcpScopes(options.grantScopes, "--grant-scope");
+    if (!checked.ok) {
+      fail(checked.message);
+      return 1;
+    }
+  }
+  let workspaceSlug = options.workspace;
+  if (workspaceSlug === void 0) {
+    const cfg = readConfig();
+    if (!cfg) {
+      fail("Not logged in. Run `dashwise login` first, or pass --workspace <slug>.");
+      return 1;
+    }
+    try {
+      workspaceSlug = (await resolveWorkspace(resolveApiUrl(), cfg.token, void 0)).slug;
+    } catch (err) {
+      fail(err.message);
+      return 1;
+    }
+  }
+  const argv = claudeMcpAddArgv({
+    serverName,
+    scope,
+    workspaceSlug,
+    ...options.readOnly !== void 0 ? { readOnly: options.readOnly } : {},
+    ...options.endpointName !== void 0 ? { endpointName: options.endpointName } : {},
+    ...options.grantScopes !== void 0 ? { grantScopes: options.grantScopes } : {}
+  });
+  const printable = `claude ${argv.join(" ")}`;
+  info("Registering the Dashwise MCP server with Claude Code:");
+  out(printable);
+  const target = spawnTarget("claude", argv);
+  if ("refused" in target) {
+    fail(`Could not run \`claude\`: ${target.refused} Run the command above yourself.`);
+    return 1;
+  }
+  return await new Promise((resolve14) => {
+    const child = spawn(target.command, target.args, { shell: target.shell, stdio: "inherit" });
+    let settled = false;
+    child.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      if (err.code === "ENOENT") {
+        fail(
+          `Claude Code is not on your PATH, so nothing was registered. Run the command above once ${code("claude")} is installed.`
+        );
+        resolve14(1);
+        return;
+      }
+      fail(`Could not run \`claude\`: ${err.message}`);
+      resolve14(1);
+    });
+    child.on("close", (codeOut) => {
+      if (settled) return;
+      settled = true;
+      resolve14(codeOut ?? 1);
+    });
+  });
+}
+
+// src/commands/agent.ts
+init_config();
+init_output();
+function claudeConfigDir() {
+  const override = process.env.CLAUDE_CONFIG_DIR;
+  if (override !== void 0 && override.length > 0) return override;
+  return join(homedir(), ".claude");
+}
+function pluginCacheRoot(marketplace, plugin) {
+  return join(claudeConfigDir(), "plugins", "cache", marketplace, plugin);
+}
+function marketplacePluginRoot(marketplace, plugin) {
+  return join(
+    claudeConfigDir(),
+    "plugins",
+    "marketplaces",
+    marketplace,
+    "plugins",
+    plugin
+  );
+}
+function readSkillVersion(skillMdPath) {
+  let text4;
+  try {
+    text4 = readFileSync(skillMdPath, "utf-8");
+  } catch {
+    return null;
+  }
+  const lines = text4.split(/\r?\n/);
+  if (lines[0]?.trim() !== "---") return null;
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.trim() === "---") break;
+    const match = /^version:\s*(.+?)\s*$/.exec(line);
+    if (match) return match[1].replace(/^['"]|['"]$/g, "");
+  }
+  return null;
+}
+function readSkills(skillsDir) {
+  if (!existsSync(skillsDir)) return [];
+  let entries;
+  try {
+    entries = readdirSync(skillsDir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => e.isDirectory()).map((e) => {
+    const dir = join(skillsDir, e.name);
+    return {
+      name: e.name,
+      version: readSkillVersion(join(dir, "SKILL.md")),
+      path: dir
+    };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+}
+function compareDotted(a, b) {
+  const pa = a.split(".");
+  const pb = b.split(".");
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const na = Number.parseInt(pa[i] ?? "0", 10);
+    const nb = Number.parseInt(pb[i] ?? "0", 10);
+    if (Number.isNaN(na) || Number.isNaN(nb)) return a.localeCompare(b);
+    if (na !== nb) return na - nb;
+  }
+  return 0;
+}
+function readInstalledPlugin(marketplace, plugin) {
+  const root = pluginCacheRoot(marketplace, plugin);
+  if (!existsSync(root)) return null;
+  let versions;
+  try {
+    versions = readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return null;
+  }
+  if (versions.length === 0) return null;
+  const version = versions.sort(compareDotted)[versions.length - 1];
+  const path = join(root, version);
+  const skillsPath = join(path, "skills");
+  return {
+    version,
+    path,
+    skillsPath: existsSync(skillsPath) ? skillsPath : null,
+    skills: readSkills(skillsPath)
+  };
+}
+function readMarketplacePlugin(marketplace, plugin) {
+  const root = marketplacePluginRoot(marketplace, plugin);
+  const manifest = join(root, ".claude-plugin", "plugin.json");
+  if (!existsSync(manifest)) return null;
+  let version;
+  try {
+    const parsed = JSON.parse(readFileSync(manifest, "utf-8"));
+    if (typeof parsed.version !== "string" || parsed.version.length === 0) return null;
+    version = parsed.version;
+  } catch {
+    return null;
+  }
+  const skillsPath = join(root, "skills");
+  return {
+    version,
+    path: root,
+    skillsPath: existsSync(skillsPath) ? skillsPath : null,
+    skills: readSkills(skillsPath)
+  };
+}
+function upgradeCommand(plugin, marketplace) {
+  return `claude plugin update ${plugin}@${marketplace}`;
+}
+
+// src/commands/agent.ts
+var PLUGIN_NAME = "dashwise";
+var MARKETPLACE_NAME = "dashwise";
+var DEFAULT_MARKETPLACE_SOURCE = "Intuize/dashwise-cli";
+var defaultRunner = (cmd, args, opts) => new Promise((resolve14) => {
+  const target = spawnTarget(cmd, args);
+  if ("refused" in target) {
+    resolve14({ code: null, stdout: "", stderr: target.refused, missing: false });
+    return;
+  }
+  const child = spawn(target.command, target.args, {
+    shell: target.shell,
+    stdio: opts.capture ? ["ignore", "pipe", "pipe"] : "inherit"
+  });
+  let stdout = "";
+  let stderr = "";
+  child.stdout?.on("data", (chunk) => stdout += chunk.toString());
+  child.stderr?.on("data", (chunk) => stderr += chunk.toString());
+  let settled = false;
+  child.on("error", (err) => {
+    if (settled) return;
+    settled = true;
+    resolve14({
+      code: null,
+      stdout,
+      stderr: stderr || err.message,
+      missing: err.code === "ENOENT"
+    });
+  });
+  child.on("close", (exitCode) => {
+    if (settled) return;
+    settled = true;
+    resolve14({ code: exitCode, stdout, stderr, missing: false });
+  });
+});
+function readSkillsOnDisk() {
+  const installed = readInstalledPlugin(MARKETPLACE_NAME, PLUGIN_NAME);
+  const latest = readMarketplacePlugin(MARKETPLACE_NAME, PLUGIN_NAME);
+  return {
+    skills_path: installed?.skillsPath ?? null,
+    installed_version: installed?.version ?? null,
+    latest_version: latest?.version ?? null,
+    skills: (installed?.skills ?? []).map((sk) => ({
+      name: sk.name,
+      version: sk.version,
+      path: sk.path
+    })),
+    upgrade_command: upgradeCommand(PLUGIN_NAME, MARKETPLACE_NAME)
+  };
+}
+function printSkillsOnDisk(disk) {
+  if (disk.skills_path === null) return;
+  info(
+    `The skills are readable on disk now, without a restart: ${code(disk.skills_path)}`
+  );
+  for (const sk of disk.skills) {
+    out(
+      `    ${dim("skill:")} ${sk.name}${sk.version ? ` ${dim(`v${sk.version}`)}` : ""}`
+    );
+  }
+}
+function parsePluginList(text4) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text4);
+  } catch {
+    return null;
+  }
+  const list = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.plugins) ? parsed.plugins : null;
+  if (!list) return null;
+  return list.flatMap((entry) => {
+    if (!entry || typeof entry !== "object") return [];
+    const e = entry;
+    if (typeof e.id !== "string") return [];
+    return [
+      {
+        id: e.id,
+        ...typeof e.version === "string" ? { version: e.version } : {},
+        ...typeof e.scope === "string" ? { scope: e.scope } : {},
+        ...typeof e.enabled === "boolean" ? { enabled: e.enabled } : {}
+      }
+    ];
+  });
+}
+function parseMarketplaceList(text4) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text4);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed)) return null;
+  return parsed.flatMap((entry) => {
+    if (!entry || typeof entry !== "object") return [];
+    const e = entry;
+    if (typeof e.name !== "string") return [];
+    const where = [e.repo, e.url, e.path, e.source].find((v) => typeof v === "string");
+    return [{ name: e.name, ...typeof where === "string" ? { source: where } : {} }];
+  });
+}
+function manualSteps(source) {
+  return [
+    `claude plugin marketplace add ${source}`,
+    `claude plugin install ${PLUGIN_NAME}@${MARKETPLACE_NAME}`
+  ];
+}
+async function agentSetupCommand(options = {}, deps = {}) {
+  const run = deps.run ?? defaultRunner;
+  const loggedIn = deps.loggedIn ?? isLoggedIn;
+  const json = options.json === true;
+  const source = options.marketplace ?? DEFAULT_MARKETPLACE_SOURCE;
+  const pluginId = `${PLUGIN_NAME}@${MARKETPLACE_NAME}`;
+  const report = {
+    ok: false,
+    action: options.status ? "status" : "setup",
+    claude: { found: false },
+    marketplace: { name: MARKETPLACE_NAME, source, configured: null },
+    plugin: { id: pluginId, installed: null },
+    steps: []
+  };
+  const finish = (exitCode) => {
+    report.ok = exitCode === 0;
+    if (json) out(JSON.stringify(report, null, 2));
+    return exitCode;
+  };
+  const say = (line) => {
+    if (!json) info(line);
+  };
+  const version = await run("claude", ["--version"], { capture: true });
+  if (version.missing && options.status) {
+    report.next = ["Install Claude Code, then run `dashwise agent setup`."];
+    if (!json) {
+      out("Claude Code: not installed (no `claude` on your PATH)");
+      info(`Once it is, ${code("dashwise agent setup")} installs the Dashwise plugin.`);
+    }
+    return finish(0);
+  }
+  if (version.missing) {
+    report.manual_steps = manualSteps(source);
+    if (!json) {
+      warn("Claude Code (`claude`) is not on your PATH, so nothing was installed.");
+      info("Once Claude Code is installed, these two commands add the Dashwise plugin:");
+      for (const line of report.manual_steps) out(line);
+      info(
+        `Or inside Claude Code: ${code(`/plugin marketplace add ${source}`)}, then ${code(`/plugin install ${pluginId}`)}.`
+      );
+    }
+    return finish(0);
+  }
+  if (version.code !== 0) {
+    report.error = `claude --version exited ${version.code}: ${version.stderr.trim()}`;
+    if (!json)
+      fail(
+        `Could not run \`claude --version\`: ${version.stderr.trim() || `exit ${version.code}`}`
+      );
+    return finish(1);
+  }
+  report.claude = { found: true, version: version.stdout.trim() };
+  say(`Claude Code found (${report.claude.version}).`);
+  const listed = await run("claude", ["plugin", "list", "--json"], { capture: true });
+  const plugins = listed.code === 0 ? parsePluginList(listed.stdout) : null;
+  if (plugins) {
+    const ours = plugins.find((p) => p.id.toLowerCase() === pluginId.toLowerCase());
+    const others = plugins.filter((p) => p !== ours && p.id.toLowerCase().startsWith(`${PLUGIN_NAME}@`)).map((p) => p.id);
+    report.plugin = {
+      id: pluginId,
+      installed: ours !== void 0,
+      ...ours?.version !== void 0 ? { version: ours.version } : {},
+      ...ours?.scope !== void 0 ? { scope: ours.scope } : {},
+      ...ours?.enabled !== void 0 ? { enabled: ours.enabled } : {},
+      ...others.length > 0 ? { others } : {}
+    };
+  }
+  const markets = await run("claude", ["plugin", "marketplace", "list", "--json"], {
+    capture: true
+  });
+  const marketplaces = markets.code === 0 ? parseMarketplaceList(markets.stdout) : null;
+  const existing = marketplaces?.find((m) => m.name === MARKETPLACE_NAME);
+  if (marketplaces) {
+    report.marketplace.configured = existing !== void 0;
+    if (existing?.source !== void 0) report.marketplace.configured_source = existing.source;
+  }
+  if (options.status) {
+    if (!json) printStatus(report);
+    if (plugins === null) {
+      report.error = `claude plugin list --json gave nothing this command can read (exit ${listed.code}).`;
+      if (!json) fail(report.error);
+      return finish(1);
+    }
+    return finish(0);
+  }
+  if (report.plugin.installed === true) {
+    if (!json) {
+      success(
+        `${pluginId} is already installed${report.plugin.version ? ` (${report.plugin.version})` : ""}.`
+      );
+      info(`To update it: ${code(`claude plugin update ${pluginId}`)}, then restart Claude Code.`);
+    }
+    return finish(0);
+  }
+  if (existing) {
+    say(
+      `The ${MARKETPLACE_NAME} marketplace is already configured` + (existing.source ? ` (from ${existing.source}).` : ".")
+    );
+    if (options.marketplace !== void 0 && existing.source !== void 0 && existing.source !== source) {
+      if (!json) {
+        warn(
+          `--marketplace ${source} was not used: a marketplace named ${MARKETPLACE_NAME} already points at ${existing.source}. To switch, run ${code(`claude plugin marketplace remove ${MARKETPLACE_NAME}`)} and try again.`
+        );
+      }
+    }
+  } else {
+    const added = await step(run, ["plugin", "marketplace", "add", source], json, report);
+    if (added !== 0) return failed(report, source, json, finish, added);
+    report.marketplace.configured = true;
+    report.marketplace.configured_source = source;
+  }
+  const installed = await step(run, ["plugin", "install", pluginId], json, report);
+  if (installed !== 0) return failed(report, source, json, finish, installed);
+  report.plugin.installed = true;
+  const disk = readSkillsOnDisk();
+  report.on_disk = disk;
+  if (disk.installed_version !== null) report.plugin.version = disk.installed_version;
+  report.next = ["Restart Claude Code so it loads the plugin."];
+  if (disk.skills_path !== null) {
+    report.next.push(`Or read the skills now, without restarting: ${disk.skills_path}`);
+  }
+  if (!loggedIn())
+    report.next.push("Run `dashwise login` once, so the plugin\u2019s MCP server can start.");
+  if (!json) {
+    success(
+      `Installed ${pluginId}${disk.installed_version ? ` v${disk.installed_version}` : ""}.`
+    );
+    info("Restart Claude Code so it loads the plugin.");
+    printSkillsOnDisk(disk);
+    if (!loggedIn())
+      info("Run `dashwise login` once, so the plugin\u2019s MCP server can start.");
+  }
+  return finish(0);
+}
+async function step(run, args, json, report) {
+  const printable = `claude ${args.join(" ")}`;
+  if (!json) info(`Running: ${printable}`);
+  const result = await run("claude", args, { capture: json });
+  const exitCode = result.code ?? 1;
+  report.steps.push({ command: printable, exit_code: result.code });
+  if (exitCode !== 0 && json)
+    report.error = result.stderr.trim() || `${printable} exited ${exitCode}`;
+  return exitCode;
+}
+function failed(report, source, json, finish, exitCode) {
+  report.manual_steps = manualSteps(source);
+  if (!json) {
+    const last = report.steps[report.steps.length - 1];
+    fail(
+      `\`${last?.command}\` failed (exit ${last?.exit_code ?? "none"}). Nothing after it was run.`
+    );
+    info("To finish by hand:");
+    for (const line of report.manual_steps) out(line);
+  }
+  return finish(exitCode);
+}
+function printStatus(report) {
+  out(`Claude Code: ${report.claude.version ?? "found"}`);
+  const m = report.marketplace;
+  out(
+    `Marketplace ${m.name}: ` + (m.configured === null ? "could not tell" : m.configured ? `configured${m.configured_source ? ` (${m.configured_source})` : ""}` : `not configured (setup would add ${m.source})`)
+  );
+  const p = report.plugin;
+  const detail = [
+    p.version,
+    p.scope && `${p.scope} scope`,
+    p.enabled === false ? "disabled" : p.enabled ? "enabled" : void 0
+  ].filter(Boolean).join(", ");
+  out(
+    `Plugin ${p.id}: ` + (p.installed === null ? "could not tell" : p.installed ? `installed${detail ? ` (${detail})` : ""}` : "not installed")
+  );
+  if (p.others?.length) out(`Also installed from other marketplaces: ${p.others.join(", ")}`);
+}
+async function agentStatusCommand(options = {}) {
+  const installed = readInstalledPlugin(MARKETPLACE_NAME, PLUGIN_NAME);
+  const latest = readMarketplacePlugin(MARKETPLACE_NAME, PLUGIN_NAME);
+  const upgrade = upgradeCommand(PLUGIN_NAME, MARKETPLACE_NAME);
+  const report = {
+    plugin: `${PLUGIN_NAME}@${MARKETPLACE_NAME}`,
+    marketplace: MARKETPLACE_NAME,
+    installed_version: installed?.version ?? null,
+    latest_version: latest?.version ?? null,
+    up_to_date: installed && latest ? installed.version === latest.version : null,
+    skills_path: installed?.skillsPath ?? null,
+    skills: (installed?.skills ?? []).map((sk) => ({
+      name: sk.name,
+      version: sk.version,
+      path: sk.path
+    })),
+    latest_skills: (latest?.skills ?? []).map((sk) => ({
+      name: sk.name,
+      version: sk.version
+    })),
+    upgrade_command: upgrade
+  };
+  if (options.json === true) {
+    out(JSON.stringify(report, null, 2));
+    return 0;
+  }
+  if (installed === null) {
+    out(`Plugin ${report.plugin}: not installed`);
+    info(`Install it with ${code("dashwise agent setup")}.`);
+    return 0;
+  }
+  out(`Plugin ${report.plugin}: ${installed.version} installed`);
+  out(
+    `Marketplace copy: ${latest === null ? "could not tell (no marketplace clone on this machine)" : `${latest.version}${report.up_to_date ? " \u2014 up to date" : ""}`}`
+  );
+  if (report.skills_path !== null) out(`Skills: ${report.skills_path}`);
+  for (const sk of report.skills) {
+    const newer = report.latest_skills.find((l) => l.name === sk.name);
+    const drift = newer && newer.version && sk.version && newer.version !== sk.version ? ` ${dim(`\u2192 ${newer.version} available`)}` : "";
+    out(`  - ${sk.name}${sk.version ? ` v${sk.version}` : dim(" (unversioned)")}${drift}`);
+  }
+  if (report.up_to_date === false) {
+    info(`A newer plugin is available. Upgrade with ${code(upgrade)}.`);
+  } else if (report.up_to_date === null) {
+    info(`To check for a newer version: ${code(upgrade)}.`);
+  }
+  return 0;
+}
+
 // src/commands/workspace.ts
 init_api_client();
 init_config();
+init_workspaces();
 init_output();
 async function workspaceListCommand(options = {}) {
   const cfg = readConfig();
@@ -5724,33 +7324,138 @@ async function workspaceUseCommand(slug) {
     fail("Not logged in. Run `dashwise login` first.");
     return 1;
   }
-  if (typeof slug !== "string" || slug.length === 0) {
-    fail("Usage: `dashwise workspace use <slug>`");
-    return 1;
+  if (typeof slug !== "string" || slug.length === 0) {
+    fail("Usage: `dashwise workspace use <slug>`");
+    return 1;
+  }
+  let workspaces = [];
+  try {
+    workspaces = await apiRequest("GET", "/api/workspaces");
+  } catch (err) {
+    fail(`Could not validate the workspace (${err.message}).`);
+    return 1;
+  }
+  const match = workspaces.find(
+    (w) => w.slug === slug || `id:${w.id}` === slug || String(w.id) === slug
+  );
+  if (!match) {
+    fail(`Workspace ${code(slug)} not found in your accessible workspaces.`);
+    out("");
+    info("Run `dashwise workspace list` to see what you can choose.");
+    return 1;
+  }
+  const matchedSlug = match.slug ?? `id:${match.id}`;
+  writeConfig({ ...cfg, workspaceSlug: matchedSlug });
+  success(`Default workspace set to ${code(matchedSlug)}`);
+  kv("Name", match.name);
+  if (match.role ?? match.permissions) {
+    kv("Role", String(match.role ?? match.permissions));
+  }
+  return 0;
+}
+async function workspaceTablesCommand(options = {}) {
+  const cfg = readConfig();
+  if (!cfg) {
+    if (options.json) {
+      out(
+        JSON.stringify({
+          ok: false,
+          error: { code: "NOT_LOGGED_IN", message: "Run `dashwise login` first." }
+        })
+      );
+    } else {
+      fail("Not logged in. Run `dashwise login` first.");
+    }
+    return 1;
+  }
+  let workspace2;
+  try {
+    workspace2 = await selectWorkspace({
+      apiUrl: resolveApiUrl(),
+      apiToken: cfg.token,
+      ...options.workspace !== void 0 ? { flag: options.workspace } : cfg.workspaceSlug !== void 0 ? { flag: cfg.workspaceSlug } : {},
+      // A table listing is a read; prompting for a workspace mid-script
+      // would be worse than saying which flag to pass.
+      interactive: false
+    });
+  } catch (err) {
+    if (options.json) {
+      out(
+        JSON.stringify({
+          ok: false,
+          error: { code: "WORKSPACE_UNRESOLVED", message: err.message }
+        })
+      );
+    } else {
+      fail(err.message);
+    }
+    return 1;
+  }
+  let tables;
+  try {
+    tables = await listWorkspaceTables(workspace2.id, {
+      baseUrl: resolveApiUrl(),
+      auth: { token: cfg.token }
+    });
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      if (options.json) {
+        out(
+          JSON.stringify({
+            ok: false,
+            error: { code: "TOKEN_INVALID", message: "Saved token is no longer valid." }
+          })
+        );
+      } else {
+        fail("Saved token is no longer valid. Run `dashwise login` again.");
+      }
+      return 1;
+    }
+    if (options.json) {
+      out(
+        JSON.stringify({
+          ok: false,
+          error: { code: "FETCH_FAILED", message: err.message }
+        })
+      );
+    } else {
+      fail(`Could not list tables: ${err.message}`);
+    }
+    return 1;
+  }
+  if (options.json) {
+    out(
+      JSON.stringify({
+        ok: true,
+        workspace: { id: workspace2.id, slug: workspace2.slug, name: workspace2.name },
+        tables
+      })
+    );
+    return 0;
   }
-  let workspaces = [];
-  try {
-    workspaces = await apiRequest("GET", "/api/workspaces");
-  } catch (err) {
-    fail(`Could not validate the workspace (${err.message}).`);
-    return 1;
+  if (tables.length === 0) {
+    info(`No tables visible to you in workspace ${code(workspace2.slug)}.`);
+    return 0;
   }
-  const match = workspaces.find(
-    (w) => w.slug === slug || `id:${w.id}` === slug || String(w.id) === slug
+  out("");
+  info(
+    `${tables.length} table${tables.length === 1 ? "" : "s"} in ${code(workspace2.slug)} ${dim(`(id ${workspace2.id})`)}:`
   );
-  if (!match) {
-    fail(`Workspace ${code(slug)} not found in your accessible workspaces.`);
-    out("");
-    info("Run `dashwise workspace list` to see what you can choose.");
-    return 1;
-  }
-  const matchedSlug = match.slug ?? `id:${match.id}`;
-  writeConfig({ ...cfg, workspaceSlug: matchedSlug });
-  success(`Default workspace set to ${code(matchedSlug)}`);
-  kv("Name", match.name);
-  if (match.role ?? match.permissions) {
-    kv("Role", String(match.role ?? match.permissions));
+  let lastApp = null;
+  for (const t of tables) {
+    if (t.application_name !== lastApp) {
+      out(`  ${dim(t.application_name)}`);
+      lastApp = t.application_name;
+    }
+    out(`    ${String(t.table_id).padEnd(8)} ${t.name}`);
   }
+  out("");
+  info(
+    `Use an id with ${code("dashwise uses add --from-table <id>")} to declare a contract on that table.`
+  );
+  out(
+    `  ${dim(`Not every table can back a uses slot \u2014 a module-managed one is refused; reach those with \`dashwise deps\`.`)}`
+  );
   return 0;
 }
 
@@ -6446,6 +8151,53 @@ function extractManifestIssues(err) {
 
 // src/commands/module/generate.ts
 init_api_client();
+
+// src/lib/generator-version.ts
+var SUPPORTED_GENERATOR_MAJOR = 3;
+var STAMP_KEY = "dashwiseGeneratedBy";
+var STAMP_RE = /^sdk-generator@(\d+)(?:\.|$)/;
+function readGeneratorStamp(files) {
+  const pkg = files["package.json"];
+  if (typeof pkg !== "string") return { kind: "unstamped" };
+  let parsed;
+  try {
+    parsed = JSON.parse(pkg);
+  } catch {
+    return { kind: "unstamped" };
+  }
+  const stamp = parsed?.[STAMP_KEY];
+  if (typeof stamp !== "string") return { kind: "unstamped" };
+  const match = STAMP_RE.exec(stamp);
+  if (!match) return { kind: "unstamped" };
+  return { kind: "stamped", stamp, major: Number.parseInt(match[1], 10) };
+}
+var ALLOW_NEWER_GENERATOR_FLAG = "--allow-newer-generator";
+var SUPPORTED_MAJOR_NOTE = "Generator 3: select fields in `uses` slots are typed as the wire sends them \u2014 the option id on a read, the id or the exact label on a write.";
+function judgeGeneratorStamp(stamp, opts = {}) {
+  if (stamp.kind === "unstamped") return { ok: true, note: null, warning: null };
+  if (stamp.major > SUPPORTED_GENERATOR_MAJOR) {
+    const skew = `This backend's type generator is ${stamp.stamp} \u2014 major ${stamp.major}, and this @dashai/cli understands major ${SUPPORTED_GENERATOR_MAJOR}. A generator major changes the shape of the generated types`;
+    if (opts.allowNewerGenerator) {
+      return {
+        ok: true,
+        note: null,
+        warning: `${skew}, and ${ALLOW_NEWER_GENERATOR_FLAG} told this CLI to write them anyway. The files are the backend's either way \u2014 generation is server-side \u2014 but nothing here can describe what changed about them, so a compile error in your own code after this is the expected shape of the skew. Upgrade with \`npm i -g @dashai/cli@latest\` when a release exists.`
+      };
+    }
+    return {
+      ok: false,
+      code: "GENERATOR_MAJOR_UNSUPPORTED",
+      message: `${skew}, so nothing was written: upgrade with \`npm i -g @dashai/cli@latest\`, then re-run \`dashwise module generate\`. If no release understands it yet, re-run with ${ALLOW_NEWER_GENERATOR_FLAG} to write it anyway \u2014 the output is identical either way, and you lose only this CLI's account of what changed.`
+    };
+  }
+  if (stamp.major === SUPPORTED_GENERATOR_MAJOR) {
+    return { ok: true, note: SUPPORTED_MAJOR_NOTE, warning: null };
+  }
+  return { ok: true, note: null, warning: null };
+}
+
+// src/commands/module/generate.ts
+init_sdk_version();
 init_output();
 function outputDir(projectRoot) {
   return join(projectRoot, "node_modules", "@dashai", "generated");
@@ -6491,6 +8243,14 @@ async function moduleGenerateCommand(options) {
     fail(`Could not generate SDK: ${err.message}`);
     return 1;
   }
+  const verdict = judgeGeneratorStamp(readGeneratorStamp(res.files), {
+    ...options.allowNewerGenerator !== void 0 ? { allowNewerGenerator: options.allowNewerGenerator } : {}
+  });
+  if (!verdict.ok) {
+    fail(`${verdict.code}: ${verdict.message}`);
+    return 1;
+  }
+  if (verdict.warning !== null) warn(verdict.warning);
   if (options.dryRun) {
     info(`Dry run: ${Object.keys(res.files).length} files`);
     info(`Hash: ${code(res.contentHash)}`);
@@ -6513,8 +8273,25 @@ async function moduleGenerateCommand(options) {
     `Generated ${Object.keys(res.files).length} files into ${code("node_modules/@dashai/generated/")}`
   );
   info(`Hash: ${dim(res.contentHash)}`);
+  if (verdict.note !== null && declaresUses(manifest)) info(verdict.note);
+  warnIfSdkBelowUsesFloor(projectRoot, manifest);
   return 0;
 }
+function declaresUses(manifest) {
+  const uses = manifest?.uses;
+  return Array.isArray(uses?.tables) && uses.tables.length > 0;
+}
+function warnIfSdkBelowUsesFloor(projectRoot, manifest) {
+  if (!declaresUses(manifest)) return;
+  const sdk = checkSdkFloor(projectRoot, USES_SDK_FLOOR);
+  if (sdk.ok) return;
+  warn(
+    `This manifest declares ${code("uses")}, which needs ${code(`@dashai/sdk >= ${sdk.floor}`)} \u2014 this project has ${code(sdk.installed ?? "none")}.`
+  );
+  info(
+    `Every import from ${code("@dashai/generated")} will throw until you upgrade, including your own tables: ${code(`npm install @dashai/sdk@^${sdk.floor}`)}.`
+  );
+}
 
 // src/commands/module/dev.ts
 init_output();
@@ -6818,6 +8595,7 @@ async function resolveWorkspaceWithFallback(opts) {
 
 // src/commands/module/install.ts
 init_output();
+init_connect_status();
 async function moduleInstallCommand(slugArg, options) {
   const slug = resolveSlug(slugArg, options.dir);
   if (!slug) {
@@ -6991,6 +8769,8 @@ async function moduleInstallCommand(slugArg, options) {
   const publicUrl = row?.public_url ?? null;
   const installedVersion = row?.module_version?.version ?? targetVersion;
   const runtimeProvisioned = isRealRuntimeUrl(row?.runtime_url);
+  const readiness = await fetchUsesReadiness(result.installation.id, auth);
+  const setupPending = readiness?.setupPending ?? false;
   if (options.json) {
     out(
       JSON.stringify({
@@ -6999,11 +8779,15 @@ async function moduleInstallCommand(slugArg, options) {
         version: installedVersion,
         was_upgrade: result.was_upgrade,
         public_url: publicUrl,
-        verified
+        verified,
+        // `null` when the binding surface was unreachable; `[]` when the
+        // module declares no slots. The two are not the same thing.
+        uses: readiness === null ? null : usesInstallJson(readiness),
+        setup_pending: setupPending
       })
     );
     if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
-    return 0;
+    return setupPending ? EXIT_SETUP_PENDING : 0;
   }
   if (!verified) {
     success(
@@ -7016,9 +8800,15 @@ async function moduleInstallCommand(slugArg, options) {
     return 0;
   }
   if (runtimeProvisioned && publicUrl) {
-    success(
-      `Deployed ${code(mod.slug)} ${code(`v${installedVersion}`)} \u2014 live at ${code(publicUrl)}`
-    );
+    if (setupPending) {
+      success(
+        `Deployed ${code(mod.slug)} ${code(`v${installedVersion}`)} at ${code(publicUrl)} \u2014 ${code("setup pending")}, not usable yet.`
+      );
+    } else {
+      success(
+        `Deployed ${code(mod.slug)} ${code(`v${installedVersion}`)} \u2014 live at ${code(publicUrl)}`
+      );
+    }
     info(
       `Install ${code(`#${result.installation.id}`)} (kind=${row?.kind ?? "unknown"}) in workspace ${code(workspace2.slug)}${result.was_upgrade ? " \u2014 upgraded in place." : "."}`
     );
@@ -7037,8 +8827,9 @@ async function moduleInstallCommand(slugArg, options) {
       `No public URL yet \u2014 runtime provisioning didn't complete. Re-running ${code("dashwise module install")} is idempotent and repairs a failed provision.`
     );
   }
+  if (readiness !== null) renderUsesReadiness(readiness, result);
   if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
-  return 0;
+  return setupPending ? EXIT_SETUP_PENDING : 0;
 }
 function publishedModuleLocalDevGuidance(slug) {
   return `Re-provision local dev any time with ${code(`dashwise init ${slug} --workspace <ws>`)} (or ${code("dashwise module reset-dev-install")}) \u2014 requires backend \u2265 2026-07-15; the fresh dev install COEXISTS with the production install.
@@ -7194,6 +8985,18 @@ function surfaceInstallError(err, slug, workspaceSlug, devInstallReplaced) {
   }
   return 1;
 }
+var EXIT_SETUP_PENDING = 3;
+function usesInstallJson(readiness) {
+  return {
+    pending: readiness.pending.map((b) => b.uses_slug),
+    slots: readiness.slots.map((b) => ({
+      uses_slug: b.uses_slug,
+      status: b.status,
+      required: b.if_missing !== "optional",
+      table: b.table ?? null
+    }))
+  };
+}
 
 // src/commands/module/list.ts
 init_api_client();
@@ -7307,6 +9110,109 @@ async function moduleListCommand(options) {
 init_api_client();
 init_config();
 init_output();
+
+// src/lib/gitignore.ts
+function escapeLiteral(ch) {
+  return ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function patternToRegex(pattern, anchored) {
+  let out2 = "";
+  let i = 0;
+  while (i < pattern.length) {
+    const ch = pattern[i];
+    if (ch === "*") {
+      if (pattern[i + 1] === "*") {
+        const nextIsSlash = pattern[i + 2] === "/";
+        if (nextIsSlash) {
+          out2 += "(?:.*/)?";
+          i += 3;
+        } else {
+          out2 += ".*";
+          i += 2;
+        }
+        continue;
+      }
+      out2 += "[^/]*";
+      i += 1;
+      continue;
+    }
+    if (ch === "?") {
+      out2 += "[^/]";
+      i += 1;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < pattern.length) {
+      out2 += escapeLiteral(pattern[i + 1]);
+      i += 2;
+      continue;
+    }
+    out2 += escapeLiteral(ch);
+    i += 1;
+  }
+  const prefix = anchored ? "^" : "^(?:.*/)?";
+  return new RegExp(`${prefix}${out2}(?:/.*)?$`);
+}
+function parseGitignore(content) {
+  const rules = [];
+  for (const rawLine of content.split(/\r?\n/)) {
+    const line = rawLine.replace(/(?<!\\)\s+$/, "");
+    if (line.length === 0 || line.startsWith("#")) continue;
+    let pattern = line;
+    let negated = false;
+    if (pattern.startsWith("!")) {
+      negated = true;
+      pattern = pattern.slice(1);
+    } else if (pattern.startsWith("\\!")) {
+      pattern = pattern.slice(1);
+    }
+    if (pattern.length === 0) continue;
+    let dirOnly = false;
+    if (pattern.endsWith("/")) {
+      dirOnly = true;
+      pattern = pattern.slice(0, -1);
+    }
+    if (pattern.length === 0) continue;
+    let anchored = pattern.includes("/");
+    if (pattern.startsWith("/")) {
+      anchored = true;
+      pattern = pattern.slice(1);
+    }
+    if (pattern.length === 0) continue;
+    rules.push({
+      negated,
+      dirOnly,
+      regex: patternToRegex(pattern, anchored),
+      source: line
+    });
+  }
+  return rules;
+}
+function isIgnored(relPath, isDir, scopes) {
+  let ignored = false;
+  for (const scope of scopes) {
+    if (scope.base !== "" && !relPath.startsWith(`${scope.base}/`)) continue;
+    const local = scope.base === "" ? relPath : relPath.slice(scope.base.length + 1);
+    if (local.length === 0) continue;
+    const segments = local.split("/");
+    const candidates = [];
+    for (let i = 0; i < segments.length - 1; i++) {
+      candidates.push({ path: segments.slice(0, i + 1).join("/"), isDir: true });
+    }
+    candidates.push({ path: local, isDir });
+    for (const rule of scope.rules) {
+      for (const candidate of candidates) {
+        if (rule.dirOnly && !candidate.isDir) continue;
+        if (rule.regex.test(candidate.path)) {
+          ignored = !rule.negated;
+          break;
+        }
+      }
+    }
+  }
+  return ignored;
+}
+
+// src/lib/tarball.ts
 var DEFAULT_EXCLUDE_PATTERNS = [
   "node_modules",
   ".next",
@@ -7327,6 +9233,7 @@ var DEFAULT_EXCLUDE_PATTERNS = [
   "dist",
   "build"
 ];
+var ALWAYS_EXCLUDE_FILES = ["seed.mjs"];
 var PER_FILE_BYTE_LIMIT = 10 * 1024 * 1024;
 var MAX_TARBALL_BYTES = 100 * 1024 * 1024;
 async function packTarball(opts) {
@@ -7338,10 +9245,18 @@ async function packTarball(opts) {
     ...opts.extraExclude ?? []
   ]);
   const filesIncluded = [];
+  const alwaysExcluded = [];
   const warnings = [];
-  const candidates = walk(opts.cwd, excludeSet);
+  const respectGitignore = opts.respectGitignore !== false;
+  const walked = walk(opts.cwd, excludeSet, respectGitignore);
+  const candidates = walked.files;
+  let gitignoredCount = walked.ignoredCount;
   for (const abs of candidates) {
     const rel = relative(opts.cwd, abs);
+    if (ALWAYS_EXCLUDE_FILES.includes(rel)) {
+      alwaysExcluded.push(rel);
+      continue;
+    }
     const size = statSync(abs).size;
     if (size > PER_FILE_BYTE_LIMIT) {
       warnings.push(
@@ -7357,6 +9272,7 @@ async function packTarball(opts) {
     );
   }
   filesIncluded.sort();
+  alwaysExcluded.sort();
   const chunks = [];
   await new Promise((resolveDone, rejectDone) => {
     const stream = tar.c(
@@ -7381,14 +9297,30 @@ async function packTarball(opts) {
       `packTarball: tarball is ${formatBytes(bytes.byteLength)}, exceeds ${formatBytes(MAX_TARBALL_BYTES)} max`
     );
   }
-  return { bytes, filesIncluded, warnings };
+  return { bytes, filesIncluded, warnings, gitignoredCount, alwaysExcluded };
 }
-function walk(root, excludeSet) {
+function walk(root, excludeSet, respectGitignore) {
   const out2 = [];
-  const stack = [root];
+  let ignoredCount = 0;
+  const rootScopes = [];
+  if (respectGitignore) {
+    const rootIgnore = readIgnoreFile(root);
+    if (rootIgnore !== null) rootScopes.push({ base: "", rules: rootIgnore });
+  }
+  const stack = [
+    { dir: root, scopes: rootScopes }
+  ];
   while (stack.length > 0) {
-    const dir = stack.pop();
-    if (!dir) continue;
+    const frame = stack.pop();
+    if (!frame) continue;
+    const { dir } = frame;
+    let scopes = frame.scopes;
+    if (respectGitignore && dir !== root) {
+      const nested = readIgnoreFile(dir);
+      if (nested !== null) {
+        scopes = [...scopes, { base: toPosixRel(root, dir), rules: nested }];
+      }
+    }
     let entries;
     try {
       entries = readdirSync(dir, { withFileTypes: true });
@@ -7398,14 +9330,34 @@ function walk(root, excludeSet) {
     for (const entry of entries) {
       if (excludeSet.has(entry.name)) continue;
       const abs = join(dir, entry.name);
-      if (entry.isDirectory()) {
-        stack.push(abs);
-      } else if (entry.isFile()) {
+      const isDir = entry.isDirectory();
+      if (!isDir && !entry.isFile()) continue;
+      if (respectGitignore && scopes.length > 0) {
+        if (isIgnored(toPosixRel(root, abs), isDir, scopes)) {
+          ignoredCount += 1;
+          continue;
+        }
+      }
+      if (isDir) {
+        stack.push({ dir: abs, scopes });
+      } else {
         out2.push(abs);
       }
     }
   }
-  return out2;
+  return { files: out2, ignoredCount };
+}
+function readIgnoreFile(dir) {
+  const path = join(dir, ".gitignore");
+  if (!existsSync(path)) return null;
+  try {
+    return parseGitignore(readFileSync(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function toPosixRel(root, abs) {
+  return relative(root, abs).split(sep).join("/");
 }
 function formatBytes(n) {
   if (n < 1024) return `${n}B`;
@@ -7415,6 +9367,11 @@ function formatBytes(n) {
 
 // src/commands/module/publish.ts
 var VALID_BUMP = /* @__PURE__ */ new Set(["patch", "minor", "major"]);
+var PACKED_FILE_LIST_CAP = 20;
+function packedFileLines(files, cap = PACKED_FILE_LIST_CAP) {
+  if (files.length <= cap) return [...files];
+  return [...files.slice(0, cap), `\u2026 and ${files.length - cap} more`];
+}
 async function modulePublishCommand(options) {
   const projectRoot = resolve(options.dir ?? process.cwd());
   const manifestPath2 = join(projectRoot, "module.json");
@@ -7489,7 +9446,8 @@ async function modulePublishCommand(options) {
   try {
     tarball = await packTarball({
       cwd: projectRoot,
-      ...options.exclude !== void 0 ? { extraExclude: options.exclude } : {}
+      ...options.exclude !== void 0 ? { extraExclude: options.exclude } : {},
+      respectGitignore: !options.noRespectGitignore
     });
   } catch (err) {
     fail(`Could not pack tarball: ${err.message}`);
@@ -7498,6 +9456,17 @@ async function modulePublishCommand(options) {
   info(
     `Packed ${tarball.filesIncluded.length} file${tarball.filesIncluded.length === 1 ? "" : "s"} into ${formatBytes2(tarball.bytes.byteLength)} (cap ${formatBytes2(MAX_TARBALL_BYTES)}).`
   );
+  for (const line of packedFileLines(tarball.filesIncluded)) out(`    ${dim(line)}`);
+  if (tarball.alwaysExcluded.length > 0) {
+    info(
+      `${tarball.alwaysExcluded.map((f) => code(f)).join(", ")} excluded \u2014 scaffold-local development ${tarball.alwaysExcluded.length === 1 ? "file, not part" : "files, not part"} of the running module, and never published.`
+    );
+  }
+  if (tarball.gitignoredCount > 0) {
+    info(
+      `${tarball.gitignoredCount} path${tarball.gitignoredCount === 1 ? "" : "s"} excluded by ${code(".gitignore")}${options.noRespectGitignore ? "" : ` ${dim("(--no-respect-gitignore to include them)")}`}.`
+    );
+  }
   for (const w of tarball.warnings) warn(w);
   if (!options.yes && process.stdout.isTTY && !options.dryRun) {
     const answer = await select({
@@ -7618,7 +9587,7 @@ async function pollBuild(buildId, moduleId, slug, options) {
         `/api/modules/${moduleId}/builds/${buildId}`
       );
     } catch {
-      await sleep2(intervalMs);
+      await sleep(intervalMs);
       continue;
     }
     if (!options.json && build.status !== lastStatus) {
@@ -7647,14 +9616,14 @@ async function pollBuild(buildId, moduleId, slug, options) {
       }
       return 1;
     }
-    await sleep2(intervalMs);
+    await sleep(intervalMs);
   }
   warn(
     `Still building after ${options.timeoutSec ?? 360}s \u2014 the build is likely still running. Re-run ${code("dashwise module publish")} to check, or inspect build ${code(`#${buildId}`)}.`
   );
   return 0;
 }
-function sleep2(ms) {
+function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 function formatBytes2(n) {
@@ -7668,6 +9637,7 @@ init_api_client();
 init_config();
 init_manifest_io();
 init_output();
+init_connect_status();
 async function moduleStatusCommand(slugArg, options) {
   let slug = slugArg;
   if (!slug) {
@@ -7753,6 +9723,7 @@ async function moduleStatusCommand(slugArg, options) {
   const state = runtimeProvisioned && row.public_url ? "live" : runtimeProvisioned ? "deployed" : "not_deployed";
   const installedVersion = row.module_version?.version ?? null;
   const updateAvailable = isUpdateAvailable(installedVersion, latestVersion);
+  const readiness = await fetchUsesReadiness(row.id, auth);
   if (options.json) {
     out(
       JSON.stringify({
@@ -7768,6 +9739,11 @@ async function moduleStatusCommand(slugArg, options) {
         runtime_url: row.runtime_url,
         public_url: row.public_url,
         state,
+        // C-09: per-slot data-plane readiness for THIS install. `null`
+        // when the binding surface was unreachable — distinct from `[]`,
+        // which means the module declares no slots.
+        uses: readiness === null ? null : usesJson(readiness),
+        setup_pending: readiness?.setupPending ?? false,
         // The coexisting dev install, so a script can see BOTH slots — the
         // human output reports it and `--json` used to hide it.
         dev_install: siblingDevInstall ? { id: siblingDevInstall.id, kind: siblingDevInstall.kind ?? null } : null
@@ -7789,8 +9765,12 @@ async function moduleStatusCommand(slugArg, options) {
     runtimeProvisioned ? `provisioned ${dim(`(${row.runtime_url})`)}` : "not provisioned"
   );
   kv("Public URL:", row.public_url ?? dim("(none)"));
-  kv("State:", stateLabel);
+  kv(
+    "State:",
+    readiness?.setupPending ? `${stateLabel} ${dim("\u2014 setup pending")}` : stateLabel
+  );
   out("");
+  if (readiness !== null) renderUsesReadiness(readiness, row);
   if (siblingDevInstall) {
     info(
       `A ${code(`kind=${siblingDevInstall.kind ?? "unknown"}`)} dev install (#${siblingDevInstall.id}) also exists in this workspace and coexists with the production install above \u2014 that is the one ${code("dashwise dev")} talks to.`
@@ -7807,6 +9787,20 @@ async function moduleStatusCommand(slugArg, options) {
   }
   return 0;
 }
+function usesJson(readiness) {
+  return {
+    setup_pending: readiness.setupPending,
+    slots: readiness.slots.map((b) => ({
+      uses_slug: b.uses_slug,
+      status: b.status,
+      if_missing: b.if_missing ?? null,
+      required: b.if_missing !== "optional",
+      table: b.table ?? null,
+      missing_fields: b.missing_fields ?? [],
+      reason: b.reason ?? null
+    }))
+  };
+}
 
 // src/commands/module/uninstall.ts
 init_api_client();
@@ -9413,30 +11407,8 @@ function surfaceBindingError(err) {
 init_api_client();
 init_config();
 init_manifest_io();
-
-// src/lib/uses-types.ts
-var PHYSICAL_TO_ABSTRACT = {
-  text: "text",
-  long_text: "long_text",
-  number: "number",
-  rating: "number",
-  boolean: "boolean",
-  // A date-with-time column has physical registry type `date` (with
-  // `config.includeTime`), NOT a distinct `datetime` type — the backend
-  // registry has no `datetime` key. So introspection only ever reports
-  // `date` here; there is no `datetime` physical entry to fold.
-  date: "date",
-  email: "email",
-  url: "url",
-  single_select: "single_select",
-  multi_select: "multi_select"
-};
-function abstractTypeForPhysical(physicalType) {
-  return PHYSICAL_TO_ABSTRACT[physicalType] ?? null;
-}
-var USES_OPERATIONS = ["create", "read", "update", "delete"];
-
-// src/commands/uses/add.ts
+init_uses_types();
+init_sdk_version();
 init_output();
 async function usesAddCommand(options) {
   if (!options.fromTable) {
@@ -9457,6 +11429,18 @@ async function usesAddCommand(options) {
     fail(err.message);
     return 1;
   }
+  const sdk = checkSdkFloor(resolve(options.dir ?? process.cwd()), USES_SDK_FLOOR);
+  if (!sdk.ok) {
+    fail(
+      `A ${code("uses")} contract needs ${code(`@dashai/sdk >= ${sdk.floor}`)}; this project has ${code(sdk.installed ?? "none")}.`
+    );
+    info(
+      `Below ${code(sdk.floor)} every import from ${code("@dashai/generated")} throws \u2014 including your own tables. Upgrade first: ${code(`npm install @dashai/sdk@^${sdk.floor}`)}.`
+    );
+    return 1;
+  }
+  const scopeExit = await assertTableInInstallWorkspace(ctx, options.fromTable);
+  if (scopeExit !== 0) return scopeExit;
   let table;
   try {
     table = await introspectWorkspaceTable(
@@ -9467,10 +11451,10 @@ async function usesAddCommand(options) {
   } catch (err) {
     return surfaceIntrospectError(err, options.fromTable);
   }
-  const slotSlug = options.slug ?? slugify(table.name);
-  if (!isKebab(slotSlug)) {
+  const slotSlug = options.slug ?? slugifyUsesName(table.name);
+  if (!isUsesSlug(slotSlug)) {
     fail(
-      `Generated slot slug ${code(slotSlug)} isn't kebab-case. Pass ${code("--slug <kebab-slug>")} explicitly.`
+      `Slot slug ${code(slotSlug || "(empty)")} doesn't match ${code(USES_SLUG_RULE)}. Pass ${code("--slug <snake_case_slug>")} explicitly.`
     );
     return 1;
   }
@@ -9481,6 +11465,37 @@ async function usesAddCommand(options) {
     );
     return 1;
   }
+  const badFields = fields.filter((f) => !isUsesSlug(f.slug));
+  if (badFields.length > 0) {
+    fail(
+      `${badFields.length} field name(s) on ${code(table.name)} don't fold into a legal ${code("uses")} field slug (${code(USES_SLUG_RULE)}):`
+    );
+    for (const f of badFields) {
+      const physical = table.fields.find((p) => p.slug === f.slug);
+      const name = physical?.name ?? f.slug;
+      out(`    ${dim("-")} ${code(name)} \u2192 ${code(f.slug || "(empty)")}`);
+    }
+    info(
+      `Rename the field(s) in Dashwise, or declare the slot by hand in ${code("module.json#uses.tables")}. Nothing was written.`
+    );
+    return 1;
+  }
+  const slugCounts = /* @__PURE__ */ new Map();
+  for (const f of fields) slugCounts.set(f.slug, (slugCounts.get(f.slug) ?? 0) + 1);
+  const collidingSlugs = [...slugCounts.entries()].filter(([, n]) => n > 1).map(([slug]) => slug);
+  if (collidingSlugs.length > 0) {
+    fail(
+      `${collidingSlugs.length} generated ${code("uses")} field slug(s) on ${code(table.name)} collide \u2014 the backend refuses a contract with a duplicate field slug:`
+    );
+    for (const slug of collidingSlugs) {
+      const names = table.fields.filter((p) => p.slug === slug && abstractTypeForPhysical(p.type) !== null).map((p) => p.name ?? p.slug);
+      out(`    ${dim("-")} ${names.map((n) => code(n)).join(" + ")} \u2192 ${code(slug)}`);
+    }
+    info(
+      `Rename one of each pair in Dashwise, or declare the slot by hand in ${code("module.json#uses.tables")}. Nothing was written.`
+    );
+    return 1;
+  }
   const slot = {
     slug: slotSlug,
     ops,
@@ -9517,6 +11532,13 @@ async function usesAddCommand(options) {
   }
   uses.tables = tables;
   ctx.manifest.uses = uses;
+  const pushed = await pushManifest(ctx);
+  if (!pushed.ok && pushed.rejected) {
+    info(
+      `${code("module.json")} was left unchanged \u2014 the generated slot was rejected before it could be written.`
+    );
+    return 1;
+  }
   try {
     writeManifest(ctx.manifest, ctx.dir);
   } catch (err) {
@@ -9526,8 +11548,7 @@ async function usesAddCommand(options) {
   success(
     `${existingIdx >= 0 ? "Replaced" : "Added"} ${code(`uses.tables[${slotSlug}]`)} in module.json.`
   );
-  const pushed = await pushManifest(ctx);
-  if (!pushed) {
+  if (!pushed.ok) {
     info(
       `The manifest edit is saved locally. Push it (${code("dashwise dev")} watches + applies, or re-run once the backend is reachable), then ${code(`dashwise bind ${slotSlug} --table ${table.table_id}`)}.`
     );
@@ -9552,6 +11573,52 @@ async function usesAddCommand(options) {
   }
   return 0;
 }
+async function assertTableInInstallWorkspace(ctx, fromTable) {
+  if (ctx.workspaceId === void 0) return 0;
+  const wanted = Number(fromTable);
+  if (!Number.isInteger(wanted) || wanted <= 0) return 0;
+  let tables;
+  try {
+    tables = await listWorkspaceTables(ctx.workspaceId, ctx.requestOptions);
+  } catch {
+    return 0;
+  }
+  const wantedRow = tables.find((t) => t.table_id === wanted);
+  if (wantedRow !== void 0 && !isModuleManaged(wantedRow)) return 0;
+  if (wantedRow !== void 0) {
+    fail(
+      `Table ${code(String(wanted))} (${wantedRow.name}) is managed by a module, so a ${code("uses")} contract on it could never be bound (${code("TABLE_IS_MODULE_MANAGED")}).`
+    );
+    info(
+      `A ${code("uses")} slot binds a table the WORKSPACE owns. Reach another module's tables as a dependency instead: ${code("dashwise deps")}.`
+    );
+    return 1;
+  }
+  const bindable = tables.filter((t) => !isModuleManaged(t));
+  const hidden = tables.length - bindable.length;
+  fail(
+    `Table ${code(String(wanted))} is not in this install's workspace, so a ${code("uses")} contract on it could never be bound.`
+  );
+  if (bindable.length === 0) {
+    info(
+      hidden > 0 ? `Every table visible to you in that workspace (${hidden}) is managed by a module, so none of them can back a ${code("uses")} slot either. Create a workspace table in Dashwise, or reach a module's tables with ${code("dashwise deps")}.` : `No tables are visible to you in that workspace. Create one in Dashwise, or re-provision the dev install with ${code("dashwise init")} against the right workspace.`
+    );
+    return 1;
+  }
+  out(`  ${dim(`${bindable.length} table(s) in this workspace:`)}`);
+  for (const t of bindable) {
+    out(
+      `  - ${t.name} ${dim(`(id ${t.table_id}, in ${t.application_name})`)}`
+    );
+  }
+  info(
+    hidden > 0 ? `That is the workspace's table list \u2014 ${hidden} module-managed table(s) are not shown, because a ${code("uses")} slot cannot bind one (${code("TABLE_IS_MODULE_MANAGED")}); reach those with ${code("dashwise deps")}.` : `That is the workspace's table list \u2014 the server decides which of them can back a ${code("uses")} slot, and refuses a module-managed one (${code("TABLE_IS_MODULE_MANAGED")}); reach those with ${code("dashwise deps")}.`
+  );
+  return 1;
+}
+function isModuleManaged(t) {
+  return typeof t.module_id === "number";
+}
 function loadContext3(opts) {
   const manifest = readManifestOrThrow(opts.dir);
   const moduleSlug = manifest.module?.slug;
@@ -9570,6 +11637,7 @@ function loadContext3(opts) {
   }
   return {
     installationId: entry.installationId,
+    ...entry.workspaceId !== void 0 ? { workspaceId: entry.workspaceId } : {},
     moduleSlug,
     ...opts.dir !== void 0 ? { dir: opts.dir } : {},
     manifest,
@@ -9589,10 +11657,10 @@ async function pushManifest(ctx) {
       warn(
         `Module ${code(ctx.moduleSlug)} isn't registered on the backend yet. Run ${code("dashwise module register")} (or ${code("dashwise init")}) before on-ramping a table.`
       );
-      return false;
+      return { ok: false, rejected: false };
     }
     warn(`Couldn't resolve the module id to push the manifest: ${err.message}`);
-    return false;
+    return { ok: false, rejected: false };
   }
   try {
     await applyDraftManifest(
@@ -9601,20 +11669,20 @@ async function pushManifest(ctx) {
       ctx.requestOptions
     );
     success("Pushed the manifest \u2014 the backend parked the new slot, ready to bind.");
-    return true;
+    return { ok: true };
   } catch (err) {
     if (err instanceof ApiError) {
       if (err.code === "MANIFEST_INVALID" || err.status === 400) {
         fail(`Manifest rejected by the backend validator: ${err.message}`);
         const issues = extractIssues(err.context);
         for (const issue of issues) out(`    ${dim("-")} ${issue}`);
-      } else {
-        fail(`Manifest push failed: ${err.code} ${err.status} \u2014 ${err.message}`);
+        return { ok: false, rejected: true };
       }
-    } else {
-      fail(`Manifest push failed: ${err.message}`);
+      fail(`Manifest push failed: ${err.code} ${err.status} \u2014 ${err.message}`);
+      return { ok: false, rejected: false };
     }
-    return false;
+    fail(`Manifest push failed: ${err.message}`);
+    return { ok: false, rejected: false };
   }
 }
 function extractIssues(context) {
@@ -9664,13 +11732,6 @@ function parseOps(opsCsv) {
   }
   return USES_OPERATIONS.filter((o) => seen.has(o));
 }
-function slugify(name) {
-  return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-var KEBAB_REGEX = /^[a-z][a-z0-9-]*[a-z0-9]$/;
-function isKebab(slug) {
-  return KEBAB_REGEX.test(slug);
-}
 function surfaceIntrospectError(err, tableRef) {
   if (err instanceof ApiError) {
     switch (err.code) {
@@ -10861,7 +12922,7 @@ async function runTail(moduleId, options) {
     } catch (err) {
       info(dim(`(tail poll error: ${err.message})`));
     }
-    await sleep3(POLL_INTERVAL_MS);
+    await sleep2(POLL_INTERVAL_MS);
   }
 }
 function buildTailParams(options) {
@@ -10974,29 +13035,37 @@ function formatRow(row) {
 function formatTimestamp(iso) {
   return iso.slice(0, 19).replace("T", " ");
 }
-function sleep3(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
+function sleep2(ms) {
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 
 // src/commands/module/action-log.ts
 init_api_client();
+init_manifest_io();
 init_output();
 var POLL_INTERVAL_MS2 = 5e3;
 async function moduleActionLogCommand(options) {
-  if (options.installation === void 0 && options.module === void 0) {
-    fail("Must pass either `--installation <id>` or `--module <slug>`.");
-    return 1;
-  }
   if (options.installation !== void 0 && options.module !== void 0) {
     fail("`--installation` and `--module` are mutually exclusive \u2014 pass one or the other.");
     return 1;
   }
+  let moduleSlug = options.module;
+  if (options.installation === void 0 && moduleSlug === void 0) {
+    const inferred = inferModuleSlug(options.dir);
+    if (inferred === null) {
+      fail(
+        "Pass `--installation <id>` or `--module <slug>`, or run this inside a module project directory containing module.json."
+      );
+      return 1;
+    }
+    moduleSlug = inferred;
+  }
   let installationId = options.installation;
-  if (installationId === void 0 && options.module !== void 0) {
+  if (installationId === void 0 && moduleSlug !== void 0) {
     try {
       const resolved = await apiRequest(
         "GET",
-        `/api/modules/by-slug/${encodeURIComponent(options.module)}/my-installation`
+        `/api/modules/by-slug/${encodeURIComponent(moduleSlug)}/my-installation`
       );
       installationId = resolved.installation_id;
     } catch (err) {
@@ -11069,7 +13138,7 @@ async function runTail2(installationId, options) {
       }
       dim(`(tail: transient error \u2014 ${err.message})`);
     }
-    await new Promise((resolve13) => setTimeout(resolve13, POLL_INTERVAL_MS2));
+    await new Promise((resolve14) => setTimeout(resolve14, POLL_INTERVAL_MS2));
   }
 }
 function printTable(rows) {
@@ -11134,6 +13203,17 @@ function mapAndPrintError(err, json) {
   else fail(msg);
   return 1;
 }
+function inferModuleSlug(dir) {
+  try {
+    const manifest = readManifestOrThrow(
+      dir ?? process.cwd()
+    );
+    const slug = manifest?.module?.slug;
+    return typeof slug === "string" && slug.length > 0 ? slug : null;
+  } catch {
+    return null;
+  }
+}
 
 // src/commands/module/logs.ts
 init_api_client();
@@ -11323,7 +13403,7 @@ async function runFollow(installationId, label, opts, auth) {
           return mapLogsError(err, false);
         }
         info(dim(`(follow: transient error \u2014 ${err.message})`));
-        await sleep4(POLL_INTERVAL_MS3, () => stopped);
+        await sleep3(POLL_INTERVAL_MS3, () => stopped);
         firstPoll = false;
         continue;
       }
@@ -11346,7 +13426,7 @@ async function runFollow(installationId, label, opts, auth) {
         }
       }
       firstPoll = false;
-      await sleep4(POLL_INTERVAL_MS3, () => stopped);
+      await sleep3(POLL_INTERVAL_MS3, () => stopped);
     }
   } finally {
     process.off("SIGINT", onSigint);
@@ -11439,11 +13519,11 @@ function mapLogsError(err, json) {
   else fail(message);
   return 1;
 }
-async function sleep4(ms, aborted) {
+async function sleep3(ms, aborted) {
   const slice = 100;
   let waited = 0;
   while (waited < ms && !aborted()) {
-    await new Promise((resolve13) => setTimeout(resolve13, Math.min(slice, ms - waited)));
+    await new Promise((resolve14) => setTimeout(resolve14, Math.min(slice, ms - waited)));
     waited += slice;
   }
 }
@@ -11453,7 +13533,7 @@ init_output();
 var program = new Command();
 program.name("dashwise").description("Dashwise CLI \u2014 log in, author modules, publish to the marketplace.").version(getVersion(), "-v, --version", "Show the CLI version + exit").option(
   "--api-url <url>",
-  "Override Dashwise backend URL (default: $DASHWISE_API_URL or saved config or http://localhost:3000)"
+  `Override Dashwise backend URL (default: $DASHWISE_API_URL, else your saved login, else ${KNOWN_API_URLS.dev}). Prod is ${KNOWN_API_URLS.prod}; pass a localhost URL to target a backend you are running yourself.`
 );
 program.hook("preAction", () => {
   const apiUrl = program.opts().apiUrl?.trim();
@@ -11479,12 +13559,107 @@ program.command("profile").description("Show the current user, default workspace
     ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
   });
 });
+var mcp = program.command("mcp").description(
+  "Run a local MCP server for a workspace, so Claude can read and write your data (`dashwise mcp` runs `serve`; see `dashwise mcp serve --help`), or register it with Claude Code (`add`)."
+);
+var collect = (value, previous) => [
+  ...previous ?? [],
+  value
+];
+mcp.command("serve", { isDefault: true }).description(
+  "Run the local MCP server (the default). The key is exchanged at startup and held in memory \u2014 it never reaches a config file or your shell history."
+).option(
+  "--workspace <slug>",
+  "Workspace to connect (default: `dashwise workspace use`)."
+).option(
+  "--scope <grant>",
+  "Narrow this session's key, enforced by the server. Repeatable; grants add up. `datahub:table=<id>:<ops>`, `datahub:app=<id>:<ops>`, `datahub:workspace:<ops>` (ops: one to four of c r u d) or `governance:workspace:r`. Each must be within your own access. Omitted: the key reaches what your account can.",
+  collect
+).option(
+  "--read-only",
+  "Refuse write tools. A CLIENT-SIDE GUARD: this proxy declines the call and the server is not told. It prevents accidents; it is not a fence. For a server-enforced limit, use --scope (for example `--scope datahub:workspace:r`)."
+).option(
+  "--endpoint-name <label>",
+  "Label for this machine's endpoint (default: your hostname). Each run gets its own endpoint, named `dashwise-cli@<label>#<id>` \u2014 the server adds the short id so concurrent sessions on one machine are told apart in the endpoints panel, where an admin can revoke one of them. The session lasts 24 hours and is revoked automatically on exit."
+).option(
+  "--verbose",
+  "Log frame types and sizes to stderr. Never frame bodies, never the key."
+).action(
+  async (cmdOpts) => {
+    process.exitCode = await mcpCommand({
+      ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+      ...cmdOpts.scope !== void 0 ? { scopes: cmdOpts.scope } : {},
+      ...cmdOpts.readOnly !== void 0 ? { readOnly: cmdOpts.readOnly } : {},
+      ...cmdOpts.endpointName !== void 0 ? { endpointName: cmdOpts.endpointName } : {},
+      ...cmdOpts.verbose !== void 0 ? { verbose: cmdOpts.verbose } : {}
+    });
+  }
+);
+mcp.command("add").description(
+  "Register `dashwise mcp` with Claude Code by shelling out to `claude mcp add`. Prints the exact command it runs, so it can be copied when `claude` is absent."
+).option("--workspace <slug>", "Workspace to bake into the registration.").option(
+  "--read-only",
+  "Register the read-only form (client-side guard; see `dashwise mcp serve --help`)."
+).option("--endpoint-name <label>", "Label for this machine's endpoint.").option(
+  "--name <server-name>",
+  "Name Claude Code shows for the server (default: dashwise)."
+).addOption(
+  new Option(
+    "--scope <scope>",
+    "Claude Code's config scope \u2014 where the registration is saved. Not the key's reach: for that, --grant-scope."
+  ).choices(["local", "project", "user"]).default("local")
+).option(
+  "--grant-scope <grant>",
+  "Narrow the registered server's key, enforced by the server: written into the registration as `dashwise mcp --scope <grant>`. Repeatable; grants add up. Same grammar as `dashwise mcp serve --scope`.",
+  collect
+).action(
+  async (cmdOpts) => {
+    process.exitCode = await mcpAddCommand({
+      ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+      ...cmdOpts.readOnly !== void 0 ? { readOnly: cmdOpts.readOnly } : {},
+      ...cmdOpts.endpointName !== void 0 ? { endpointName: cmdOpts.endpointName } : {},
+      ...cmdOpts.name !== void 0 ? { name: cmdOpts.name } : {},
+      ...cmdOpts.scope !== void 0 ? { scope: cmdOpts.scope } : {},
+      ...cmdOpts.grantScope !== void 0 ? { grantScopes: cmdOpts.grantScope } : {}
+    });
+  }
+);
+var agent = program.command("agent").description(
+  "Set up a coding agent to work with Dashwise (`dashwise agent setup`, `dashwise agent status`)."
+);
+agent.command("setup").description(
+  "Install the Dashwise plugin into Claude Code \u2014 its skills, the `dashwise` MCP server and the secrets guard \u2014 by running `claude plugin marketplace add` and `claude plugin install`. Without Claude Code, prints the two commands instead."
+).option(
+  "--marketplace <source>",
+  `Marketplace to add: owner/repo, a git URL, a local path or a URL (default: ${DEFAULT_MARKETPLACE_SOURCE}).`
+).option("--status", "Report what is installed, and change nothing.").option("--json", "Print one JSON object on stdout instead of progress lines.").action(async (cmdOpts) => {
+  process.exitCode = await agentSetupCommand({
+    ...cmdOpts.marketplace !== void 0 ? { marketplace: cmdOpts.marketplace } : {},
+    ...cmdOpts.status !== void 0 ? { status: cmdOpts.status } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+agent.command("status").description(
+  "Report the installed Dashwise plugin and skills: their versions, the path the skills are readable at without a restart, the newest version this machine has fetched, and the command that upgrades. Reads the filesystem only \u2014 it does not need Claude Code on the PATH."
+).option("--json", "Print one JSON object on stdout instead of the report.").action(async (cmdOpts) => {
+  process.exitCode = await agentStatusCommand({
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
 var workspace = program.command("workspace").description("Workspace context commands.");
 workspace.command("list").description("List accessible workspaces.").option("--json", "Emit JSON to stdout instead of human-readable columns.").action(async (cmdOpts) => {
   process.exitCode = await workspaceListCommand({
     ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
   });
 });
+workspace.command("tables").description(
+  "List a workspace's tables with their numeric ids \u2014 the ids `dashwise uses add --from-table <id>` needs. Defaults to the saved default workspace."
+).option("--workspace <slug>", "Workspace slug or numeric id (default: the saved default).").option("--json", "Emit JSON to stdout instead of human-readable columns.").action(async (cmdOpts) => {
+  process.exitCode = await workspaceTablesCommand({
+    ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
 workspace.command("use <slug>").description("Set the default workspace for subsequent commands.").action(async (slug) => {
   process.exitCode = await workspaceUseCommand(slug);
 });
@@ -11616,12 +13791,18 @@ moduleCmd.command("export [dir]").description(
     });
   }
 );
-moduleCmd.command("generate").description("Regenerate typed wrappers from the local module.json into node_modules/@dashai/generated/.").option("--dir <path>", "Project root (default: current directory).").option("--dry-run", "Print summary without writing files.").action(async (cmdOpts) => {
-  process.exitCode = await moduleGenerateCommand({
-    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
-    ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {}
-  });
-});
+moduleCmd.command("generate").description("Regenerate typed wrappers from the local module.json into node_modules/@dashai/generated/. Refuses output stamped with a generator major this CLI does not know (GENERATOR_MAJOR_UNSUPPORTED) before writing anything.").option("--dir <path>", "Project root (default: current directory).").option("--dry-run", "Print summary without writing files.").option(
+  "--allow-newer-generator",
+  "Write output from a generator major this CLI does not know, with a warning, instead of refusing (GENERATOR_MAJOR_UNSUPPORTED). Generation is server-side, so the files are identical to what a newer CLI would write \u2014 you lose only this CLI's account of what changed. For a backend that has rolled a generator major ahead of the CLI release."
+).action(
+  async (cmdOpts) => {
+    process.exitCode = await moduleGenerateCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {},
+      ...cmdOpts.allowNewerGenerator !== void 0 ? { allowNewerGenerator: cmdOpts.allowNewerGenerator } : {}
+    });
+  }
+);
 moduleCmd.command("dev").description("Watch module.json + regenerate typed wrappers on every save. Ctrl-C to stop.").option("--dir <path>", "Project root (default: current directory).").option("--debounce-ms <n>", "Filesystem change debounce window (default: 250ms).", parseIntOption).action(async (cmdOpts) => {
   process.exitCode = await moduleDevCommand({
     ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
@@ -11772,7 +13953,7 @@ usesCmd.command("add").description(
   "Comma-separated operations to declare (create,read,update,delete). Default: read."
 ).option(
   "--purpose <text>",
-  "Optional author-facing explanation, shown to admins at bind/consent."
+  `What your module does with these fields, in the admin's words \u2014 shown at bind/consent (up to 500 chars). Be specific: "Reads invoice totals to draw the revenue chart", not "access data".`
 ).option(
   "--no-bind",
   "Only write + push the manifest entry; don't attempt to bind it to the source table."
@@ -11955,6 +14136,9 @@ envCmd.command("export").description(
 moduleCmd.command("publish").description("Pack the current directory + upload it as a new module version.").option("--dir <path>", "Project root (default: current directory).").option("--bump <direction>", "Semver bump: patch | minor | major.").option("--dry-run", "Validate + upload but do not persist the version row.").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use).").option(
   "--exclude <pattern...>",
   "Extra exclude patterns (segment-matched) appended to the defaults."
+).option(
+  "--no-respect-gitignore",
+  "Pack files the project's .gitignore excludes (default: respect it)."
 ).option(
   "--no-wait",
   "Enqueue the build and exit immediately (print the build id) instead of polling to completion."
@@ -11970,6 +14154,9 @@ moduleCmd.command("publish").description("Pack the current directory + upload it
       ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {},
       ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
       ...cmdOpts.exclude !== void 0 ? { exclude: cmdOpts.exclude } : {},
+      // commander maps `--no-respect-gitignore` to
+      // `respectGitignore === false`.
+      ...cmdOpts.respectGitignore === false ? { noRespectGitignore: true } : {},
       // commander maps `--no-wait` to `wait === false`.
       ...cmdOpts.wait === false ? { noWait: true } : {},
       ...timeoutSec !== void 0 && Number.isFinite(timeoutSec) ? { timeoutSec } : {},
@@ -11978,7 +14165,7 @@ moduleCmd.command("publish").description("Pack the current directory + upload it
   }
 );
 moduleCmd.command("install [slug]").alias("deploy").description(
-  "Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row."
+  'Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row. Exits 3 \u2014 "deployed, setup pending" \u2014 when a required `uses` slot is still unbound: the deploy succeeded but the module throws on its first data call until an admin binds it.'
 ).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--version <semver>", "Install a specific published version (default: latest).").option("--force", "Proceed even when the upgrade breaks consumer modules (UPGRADE_BREAKS_CONSUMERS).").option(
   "--keep-dev-install",
   "Install production ALONGSIDE the workspace's kind=local dev install, leaving local dev working. Non-destructive. Backends >= 2026-07-15 keep a separate live-install slot per kind group, so the two coexist."
@@ -12047,7 +14234,10 @@ moduleCmd.command("query-log").description(
   }
 );
 moduleCmd.command("action-log").description(
-  "Read the per-installation server-action audit log. Shows both cross-module and own-module dispatches. Filter by role (caller / provider), slow, since, cross-module-only. `--tail` streams new entries every 5s. Pass either `--installation <id>` or `--module <slug>` (slug resolves to your accessible installation)."
+  "Read the per-installation server-action audit log. Shows both cross-module and own-module dispatches. Filter by role (caller / provider), slow, since, cross-module-only. `--tail` streams new entries every 5s. Pass `--installation <id>` or `--module <slug>`, or run it inside a module project and the slug is read from module.json like every other module command."
+).option(
+  "--dir <path>",
+  "Project root to read module.json from when neither --installation nor --module is given (default: current directory)."
 ).option(
   "--installation <id>",
   "Installation id to inspect. Mutually exclusive with `--module`.",
@@ -12069,6 +14259,7 @@ moduleCmd.command("action-log").description(
       return;
     }
     process.exitCode = await moduleActionLogCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
       ...cmdOpts.installation !== void 0 ? { installation: cmdOpts.installation } : {},
       ...cmdOpts.module !== void 0 ? { module: cmdOpts.module } : {},
       ...cmdOpts.role !== void 0 ? { role: cmdOpts.role } : {},
@@ -12226,7 +14417,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.18.3";
+  return "0.20.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);