@dashai/cli 0.19.0 → 0.20.1

package/dist/bin.js

@@ -110,7 +110,7 @@ function resolveApiUrl() {
   if (fromEnv) return fromEnv.replace(/\/+$/, "");
   const cfg = safeReadConfig();
   if (cfg?.apiUrl) return cfg.apiUrl.replace(/\/+$/, "");
-  return "http://localhost:3000";
+  return DEFAULT_API_URL;
 }
 function readSavedToken() {
   const cfg = safeReadConfig();
@@ -172,11 +172,53 @@ function removeModuleEntry(slug) {
 function isLoggedIn() {
   return readSavedToken() !== null;
 }
-var FILE_NAME, DIR_NAME;
+var FILE_NAME, DIR_NAME, DEFAULT_API_URL, KNOWN_API_URLS;
 var init_config = __esm({
   "src/lib/config.ts"() {
     FILE_NAME = "auth.json";
     DIR_NAME = "dashwise";
+    DEFAULT_API_URL = "https://api.dashwise.dev";
+    KNOWN_API_URLS = {
+      dev: "https://api.dashwise.dev",
+      prod: "https://api.dashwise.net"
+    };
+  }
+});
+
+// src/lib/uses-types.ts
+function abstractTypeForPhysical(physicalType) {
+  return PHYSICAL_TO_ABSTRACT[physicalType] ?? null;
+}
+function slugifyUsesName(name) {
+  return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
+}
+function isUsesSlug(slug) {
+  return slug.length >= USES_SLUG_MIN_LENGTH && slug.length <= USES_SLUG_MAX_LENGTH && USES_SLUG_REGEX.test(slug);
+}
+var PHYSICAL_TO_ABSTRACT, USES_OPERATIONS, USES_SLUG_REGEX, USES_SLUG_MIN_LENGTH, USES_SLUG_MAX_LENGTH, USES_SLUG_RULE;
+var init_uses_types = __esm({
+  "src/lib/uses-types.ts"() {
+    PHYSICAL_TO_ABSTRACT = {
+      text: "text",
+      long_text: "long_text",
+      number: "number",
+      rating: "number",
+      boolean: "boolean",
+      // A date-with-time column has physical registry type `date` (with
+      // `config.includeTime`), NOT a distinct `datetime` type — the backend
+      // registry has no `datetime` key. So introspection only ever reports
+      // `date` here; there is no `datetime` physical entry to fold.
+      date: "date",
+      email: "email",
+      url: "url",
+      single_select: "single_select",
+      multi_select: "multi_select"
+    };
+    USES_OPERATIONS = ["create", "read", "update", "delete"];
+    USES_SLUG_REGEX = /^[a-z][a-z0-9_]*[a-z0-9]$/;
+    USES_SLUG_MIN_LENGTH = 2;
+    USES_SLUG_MAX_LENGTH = 63;
+    USES_SLUG_RULE = `^[a-z][a-z0-9_]*[a-z0-9]$ (snake_case, length ${USES_SLUG_MIN_LENGTH}\u2013${USES_SLUG_MAX_LENGTH})`;
   }
 });
 
@@ -422,8 +464,38 @@ async function declineBinding(installationId, usesSlug, options = {}) {
     options
   );
 }
-function slugifyFieldName(name) {
-  return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+async function listWorkspaceTables(workspaceId, options = {}) {
+  const apps = await apiRequest(
+    "GET",
+    `/api/applications/workspace/${workspaceId}`,
+    void 0,
+    options
+  );
+  const perApp = await Promise.all(
+    apps.map(async (app) => {
+      let tables;
+      try {
+        tables = await apiRequest(
+          "GET",
+          `/api/tables/application/${app.id}`,
+          void 0,
+          options
+        );
+      } catch {
+        return [];
+      }
+      return tables.map((t) => ({
+        table_id: t.id,
+        name: t.name,
+        module_id: t.module_id,
+        application_id: app.id,
+        application_name: app.name
+      }));
+    })
+  );
+  return perApp.flat().sort(
+    (a, b) => a.application_name.localeCompare(b.application_name) || a.name.localeCompare(b.name)
+  );
 }
 async function introspectWorkspaceTable(_installationId, tableNameOrId, options = {}) {
   const ref = String(tableNameOrId).trim();
@@ -515,10 +587,11 @@ async function getRuntimeLogs(installationId, opts = {}, options = {}) {
     options
   );
 }
-var ApiError, CODE_SHAPE;
+var ApiError, CODE_SHAPE, slugifyFieldName;
 var init_api_client = __esm({
   "src/lib/api-client.ts"() {
     init_config();
+    init_uses_types();
     ApiError = class extends Error {
       status;
       code;
@@ -536,6 +609,7 @@ var init_api_client = __esm({
       }
     };
     CODE_SHAPE = /^[A-Z][A-Z0-9_]*$/;
+    slugifyFieldName = slugifyUsesName;
   }
 });
 
@@ -605,10 +679,109 @@ async function safeGet(fn) {
     return null;
   }
 }
+function isRequiredSlot(b) {
+  return b.if_missing !== "optional";
+}
+function summarizeUsesReadiness(bindings) {
+  const slots = [...bindings];
+  const bound = slots.filter((b) => b.status === "bound");
+  return {
+    slots,
+    bound,
+    settings: {
+      settings_path: firstWireValue(slots.map((b) => b.settings_path)),
+      settings_url: firstWireValue(slots.map((b) => b.settings_url))
+    },
+    pending: slots.filter((b) => b.status === "unbound" && isRequiredSlot(b)),
+    optionalUnbound: slots.filter(
+      (b) => b.status === "unbound" && !isRequiredSlot(b)
+    ),
+    declined: slots.filter((b) => b.status === "declined"),
+    incomplete: bound.filter((b) => (b.missing_fields?.length ?? 0) > 0),
+    setupPending: slots.some((b) => b.status === "unbound" && isRequiredSlot(b))
+  };
+}
+async function fetchUsesReadiness(installationId, requestOptions) {
+  const bindings = await safeGet(
+    () => getInstallationBindings(installationId, requestOptions)
+  );
+  if (bindings === null) return null;
+  return summarizeUsesReadiness(bindings);
+}
+function wireValue(v) {
+  const trimmed = typeof v === "string" ? v.trim() : "";
+  return trimmed.length > 0 ? trimmed : null;
+}
+function firstWireValue(values) {
+  for (const v of values) {
+    const resolved = wireValue(v);
+    if (resolved !== null) return resolved;
+  }
+  return null;
+}
+function resolveSettingsPath(wire) {
+  return wireValue(wire) ?? SETUP_SETTINGS_PATH;
+}
+function resolveSettingsUrl(wire) {
+  const value = wireValue(wire);
+  if (value === null) return null;
+  return /^https?:\/\//i.test(value) ? value : null;
+}
+function renderUsesReadiness(readiness, wire) {
+  if (readiness.slots.length === 0) return;
+  const { slots } = readiness;
+  info(
+    `Data-plane readiness ${dim(
+      `(${readiness.bound.length}/${slots.length} slot${slots.length === 1 ? "" : "s"} bound)`
+    )}:`
+  );
+  for (const b of slots) renderReadinessSlot(b);
+  if (readiness.pending.length > 0) {
+    const names = readiness.pending.map((b) => b.uses_slug);
+    info(
+      `${names.length} required slot${names.length === 1 ? "" : "s"} await${names.length === 1 ? "s" : ""} setup \u2014 until then the module throws ${code("USES_UNBOUND")} on its first data call, which end users see as an error digest.`
+    );
+    for (const b of readiness.pending) {
+      out(`    ${dim("-")} ${code(`dashwise bind ${b.uses_slug} --table <name-or-id>`)}`);
+    }
+    const path = resolveSettingsPath(
+      wireValue(wire?.settings_path) ?? readiness.settings.settings_path
+    );
+    const url = resolveSettingsUrl(wire?.settings_url) ?? resolveSettingsUrl(readiness.settings.settings_url);
+    info(
+      `A workspace admin can do the same in the Dashwise app, under ${code(`Settings \u2192 ${path}`)}, where each declared table slot is bound.`
+    );
+    if (url !== null) out(`    ${dim("\u2192")} ${url}`);
+  }
+  for (const b of readiness.incomplete) {
+    info(
+      `${code(b.uses_slug)} is bound but ${(b.missing_fields ?? []).length} required field(s) are unmapped: ${(b.missing_fields ?? []).join(", ")}. Re-bind with ${code(`dashwise bind ${b.uses_slug} --map <field>=<physical>`)}.`
+    );
+  }
+}
+function renderReadinessSlot(b) {
+  const required = b.if_missing === "optional" ? dim(" (optional)") : "";
+  if (b.status === "bound") {
+    const tableLine = b.table ? ` ${dim(`\u2192 ${b.table.name} (id ${b.table.id})`)}` : "";
+    const gap = (b.missing_fields?.length ?? 0) > 0 ? ` ${pc.yellow(`(${b.missing_fields?.length} field(s) unmapped)`)}` : "";
+    out(`  ${pc.green("\u25CF bound")}    ${code(b.uses_slug)}${tableLine}${gap}`);
+    return;
+  }
+  if (b.status === "declined") {
+    out(`  ${pc.dim("\u2298 declined")} ${code(b.uses_slug)}`);
+    return;
+  }
+  const chip = b.if_missing === "optional" ? pc.dim("\u25CB unbound") : pc.yellow("\u25CB unbound");
+  out(
+    `  ${chip}  ${code(b.uses_slug)}${required} ${dim(`reason: ${b.reason ?? "(unspecified)"}`)}`
+  );
+}
+var SETUP_SETTINGS_PATH;
 var init_connect_status = __esm({
   "src/lib/connect-status.ts"() {
     init_api_client();
     init_output();
+    SETUP_SETTINGS_PATH = "Modules \u2192 Installed modules \u2192 Technical \u2192 Data connections";
   }
 });
 function manifestPath(dir) {
@@ -805,6 +978,33 @@ var init_manifest_poll = __esm({
     init_manifest_merge();
   }
 });
+
+// src/lib/redact.ts
+function maskSecret(value) {
+  if (value.length <= 12) return "****";
+  return `${value.slice(0, 4)}\u2026${value.slice(-4)}`;
+}
+function redactSecrets(line) {
+  let out2 = line;
+  for (const pattern of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    out2 = out2.replace(pattern, (match) => maskSecret(match));
+  }
+  return out2;
+}
+var SECRET_PATTERNS;
+var init_redact = __esm({
+  "src/lib/redact.ts"() {
+    SECRET_PATTERNS = [
+      // A JWT — three base64url segments. The SSO exchange code (C-10), and
+      // any access token that finds its way into a URL or a header dump.
+      /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g,
+      // The Dashwise credential family: dwk_ installation keys, dwc_ CLI
+      // tokens, dwm_ endpoint keys, dwa_/dwr_/dwo_ OAuth tokens.
+      /\bdw[kcmaro]_[A-Za-z0-9_-]{16,}/g
+    ];
+  }
+});
 async function devCommand(options) {
   if (options.sdkOnly && options.nextOnly) {
     fail(
@@ -1078,22 +1278,19 @@ function pipeWithPrefix(src, dst, prefix) {
     const lines = combined.split("\n");
     leftover = lines.pop() ?? "";
     for (const line of lines) {
-      dst.write(`${prefix}${line}
+      dst.write(`${prefix}${redactSecrets(line)}
 `);
     }
   });
   src.on("end", () => {
     if (leftover.length > 0) {
-      dst.write(`${prefix}${leftover}
+      dst.write(`${prefix}${redactSecrets(leftover)}
 `);
     }
   });
 }
 function maskedToken(token) {
-  if (token.length <= 12) return "****";
-  const prefix = token.slice(0, 4);
-  const tail = token.slice(-4);
-  return `${prefix}\u2026${tail}`;
+  return maskSecret(token);
 }
 async function resolveModuleApiKey(slug, entry, apiUrl, cliBearer) {
   if (process.env.DASHWISE_API_KEY) return null;
@@ -1171,13 +1368,13 @@ async function resolveDevPort(requested) {
 }
 async function isPortFree(port) {
   const { createServer } = await import('net');
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     const server = createServer();
     server.once("error", () => {
-      resolve13(false);
+      resolve14(false);
     });
     server.once("listening", () => {
-      server.close(() => resolve13(true));
+      server.close(() => resolve14(true));
     });
     server.listen(port, "0.0.0.0");
   });
@@ -1248,6 +1445,7 @@ var init_dev = __esm({
     init_manifest_io();
     init_manifest_poll();
     init_output();
+    init_redact();
     DEFAULT_NEXT_PORT = 3e3;
     PREFIX_SDK = `\x1B[36m[sdk]\x1B[0m `;
     PREFIX_NEXT = `\x1B[35m[next]\x1B[0m `;
@@ -1315,6 +1513,62 @@ var init_workspaces = __esm({
     init_api_client();
   }
 });
+function resolveSdkPackageJson(projectRoot) {
+  let dir = projectRoot;
+  for (; ; ) {
+    const candidate = join(dir, "node_modules", "@dashai", "sdk", "package.json");
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function readInstalledSdk(projectRoot) {
+  const pkgPath = resolveSdkPackageJson(projectRoot);
+  if (pkgPath === null) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    if (typeof parsed.version !== "string" || parsed.version.length === 0) return null;
+    return { version: parsed.version };
+  } catch {
+    return null;
+  }
+}
+function compareVersions(a, b) {
+  const parse = (v) => {
+    const [core = "", pre] = v.trim().replace(/^[^0-9]*/, "").split("-", 2);
+    const nums = core.split(".").map((n) => Number.parseInt(n, 10) || 0);
+    while (nums.length < 3) nums.push(0);
+    return [nums.slice(0, 3), pre !== void 0 && pre.length > 0];
+  };
+  const [an, apre] = parse(a);
+  const [bn, bpre] = parse(b);
+  for (let i = 0; i < 3; i++) {
+    const d = (an[i] ?? 0) - (bn[i] ?? 0);
+    if (d !== 0) return d;
+  }
+  if (apre === bpre) return 0;
+  return apre ? -1 : 1;
+}
+function satisfiesFloor(version, floor) {
+  return compareVersions(version, floor) >= 0;
+}
+function checkSdkFloor(projectRoot, floor) {
+  const installed = readInstalledSdk(projectRoot);
+  if (installed === null) return { ok: true, installed: null, floor };
+  return {
+    ok: satisfiesFloor(installed.version, floor),
+    installed: installed.version,
+    floor
+  };
+}
+var USES_SDK_FLOOR, SCAFFOLD_SDK_RANGE;
+var init_sdk_version = __esm({
+  "src/lib/sdk-version.ts"() {
+    USES_SDK_FLOOR = "2.5.0";
+    SCAFFOLD_SDK_RANGE = "^2.5.0";
+  }
+});
 
 // src/lib/scaffold.ts
 function isDeployTarget(value) {
@@ -1395,7 +1649,12 @@ function packageJson(opts) {
         start: "next start"
       },
       dependencies: {
-        "@dashai/sdk": "^2.3.0",
+        // The floor every scaffold feature can actually run on
+        // (S-02): `uses` needs >= 2.5.0, and a project resolved below
+        // it fails with "every import from @dashai/generated throws"
+        // — a symptom that names nothing. SCAFFOLD_SDK_RANGE is the
+        // single place this is stated.
+        "@dashai/sdk": SCAFFOLD_SDK_RANGE,
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0"
@@ -2421,10 +2680,11 @@ function packageJsonCustom(opts) {
         start: "next start"
       },
       dependencies: {
-        // >=2.4.0 for `@dashai/sdk/platform`, which app/layout.tsx imports. A
-        // ^2.3.0 floor resolves to 2.3.0 until 2.4.0 publishes, failing the
-        // first `next build` with an opaque module-not-found.
-        "@dashai/sdk": "^2.4.0",
+        // >=2.4.0 for `@dashai/sdk/platform`, which app/layout.tsx
+        // imports, and >=2.5.0 for `uses` (S-02) — a project resolved
+        // below that fails with "every import from @dashai/generated
+        // throws", which points nowhere near the cause.
+        "@dashai/sdk": SCAFFOLD_SDK_RANGE,
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0",
@@ -3809,11 +4069,63 @@ primary_region = "iad"
 var DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, MODULE_SLUG_REGEX;
 var init_scaffold = __esm({
   "src/lib/scaffold.ts"() {
+    init_sdk_version();
     DEPLOY_TARGETS = ["railway", "vercel", "fly"];
     SCAFFOLD_DEFAULT_API_URL = "http://localhost:3000";
     MODULE_SLUG_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
   }
 });
+function resolveTargetDir(slug, dirFlag) {
+  if (dirFlag !== void 0) return { dir: resolve(dirFlag) };
+  const cwd = process.cwd();
+  const nested = resolve(slug);
+  if (basename(cwd) !== slug) return { dir: nested };
+  const manifestPath2 = join(cwd, "module.json");
+  if (existsSync(manifestPath2)) {
+    const existingSlug = readManifestSlug(manifestPath2);
+    if (existingSlug === slug) {
+      return {
+        dir: cwd,
+        notice: `Re-provisioning ${code(slug)} in place \u2014 ${code(cwd)} already holds its ${code("module.json")}.`
+      };
+    }
+    if (existingSlug !== null) {
+      return {
+        dir: cwd,
+        refuse: `${code(cwd)} is the project directory for ${code(existingSlug)}, not ${code(slug)}. Run this from the parent directory, or pass ${code(`--dir <path>`)} to say where ${code(slug)} should go.`
+      };
+    }
+    return {
+      dir: cwd,
+      notice: `Scaffolding into ${code(cwd)} \u2014 it already holds a ${code("module.json")}.`
+    };
+  }
+  let entries;
+  try {
+    entries = readdirSync(cwd);
+  } catch {
+    return { dir: nested };
+  }
+  if (entries.length === 0) {
+    return {
+      dir: cwd,
+      notice: `Scaffolding into ${code(cwd)} \u2014 an empty directory already named ${code(slug)}.`
+    };
+  }
+  return {
+    dir: nested,
+    nestWarning: `You are inside a directory called ${code(slug)}, so this creates ${code(nested)}. Pass ${code("--dir .")} to scaffold here instead.`
+  };
+}
+function readManifestSlug(manifestPath2) {
+  try {
+    const parsed = JSON.parse(readFileSync(manifestPath2, "utf-8"));
+    const value = parsed.module?.slug;
+    return typeof value === "string" && value.length > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
 async function moduleInitCommand(slugArg, options) {
   intro("Scaffolding a new Dashwise module");
   let slug = slugArg;
@@ -3838,7 +4150,14 @@ async function moduleInitCommand(slugArg, options) {
     return 1;
   }
   const name = options.name ?? humanizeSlug(slug);
-  const dir = resolve(options.dir ?? slug);
+  const resolved = resolveTargetDir(slug, options.dir);
+  if (resolved.refuse) {
+    fail(resolved.refuse);
+    return 1;
+  }
+  const dir = resolved.dir;
+  if (resolved.notice) info(resolved.notice);
+  if (resolved.nestWarning) warn(resolved.nestWarning);
   const manifestExists = existsSync(join(dir, "module.json"));
   if (options.provisionOnly && !manifestExists) {
     fail(
@@ -5357,6 +5676,7 @@ function installExcessArgumentsGuard(program2) {
 init_output();
 
 // src/program.ts
+init_config();
 init_dev();
 
 // src/commands/login.ts
@@ -5807,8 +6127,8 @@ function startMcpProxy(opts) {
   let streamUnavailable = false;
   let streamStarted = false;
   let resolveDone;
-  const done = new Promise((resolve13) => {
-    resolveDone = resolve13;
+  const done = new Promise((resolve14) => {
+    resolveDone = resolve14;
   });
   const trace = (line) => {
     if (verbose) log2(line);
@@ -6108,13 +6428,13 @@ function startMcpProxy(opts) {
         const { done: finished, value } = await reader.read();
         if (finished) break;
         buffer2 += decoder.decode(value, { stream: true });
-        let sep2 = buffer2.indexOf("\n\n");
-        while (sep2 !== -1) {
-          const event = buffer2.slice(0, sep2);
-          buffer2 = buffer2.slice(sep2 + 2);
+        let sep3 = buffer2.indexOf("\n\n");
+        while (sep3 !== -1) {
+          const event = buffer2.slice(0, sep3);
+          buffer2 = buffer2.slice(sep3 + 2);
           const payload = eventData(event);
           if (payload !== null) emitFrame(payload, "server stream");
-          sep2 = buffer2.indexOf("\n\n");
+          sep3 = buffer2.indexOf("\n\n");
         }
       }
     } catch (err) {
@@ -6294,7 +6614,7 @@ async function revokeSession(endpointId) {
     () => false
   );
   const timeout = new Promise(
-    (resolve13) => setTimeout(() => resolve13(false), REVOKE_TIMEOUT_MS).unref()
+    (resolve14) => setTimeout(() => resolve14(false), REVOKE_TIMEOUT_MS).unref()
   );
   await Promise.race([attempt, timeout]);
 }
@@ -6472,7 +6792,7 @@ async function mcpAddCommand(options = {}) {
     fail(`Could not run \`claude\`: ${target.refused} Run the command above yourself.`);
     return 1;
   }
-  return await new Promise((resolve13) => {
+  return await new Promise((resolve14) => {
     const child = spawn(target.command, target.args, { shell: target.shell, stdio: "inherit" });
     let settled = false;
     child.on("error", (err) => {
@@ -6482,16 +6802,16 @@ async function mcpAddCommand(options = {}) {
         fail(
           `Claude Code is not on your PATH, so nothing was registered. Run the command above once ${code("claude")} is installed.`
         );
-        resolve13(1);
+        resolve14(1);
         return;
       }
       fail(`Could not run \`claude\`: ${err.message}`);
-      resolve13(1);
+      resolve14(1);
     });
     child.on("close", (codeOut) => {
       if (settled) return;
       settled = true;
-      resolve13(codeOut ?? 1);
+      resolve14(codeOut ?? 1);
     });
   });
 }
@@ -6499,13 +6819,121 @@ async function mcpAddCommand(options = {}) {
 // src/commands/agent.ts
 init_config();
 init_output();
+function claudeConfigDir() {
+  const override = process.env.CLAUDE_CONFIG_DIR;
+  if (override !== void 0 && override.length > 0) return override;
+  return join(homedir(), ".claude");
+}
+function pluginCacheRoot(marketplace, plugin) {
+  return join(claudeConfigDir(), "plugins", "cache", marketplace, plugin);
+}
+function marketplacePluginRoot(marketplace, plugin) {
+  return join(
+    claudeConfigDir(),
+    "plugins",
+    "marketplaces",
+    marketplace,
+    "plugins",
+    plugin
+  );
+}
+function readSkillVersion(skillMdPath) {
+  let text4;
+  try {
+    text4 = readFileSync(skillMdPath, "utf-8");
+  } catch {
+    return null;
+  }
+  const lines = text4.split(/\r?\n/);
+  if (lines[0]?.trim() !== "---") return null;
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.trim() === "---") break;
+    const match = /^version:\s*(.+?)\s*$/.exec(line);
+    if (match) return match[1].replace(/^['"]|['"]$/g, "");
+  }
+  return null;
+}
+function readSkills(skillsDir) {
+  if (!existsSync(skillsDir)) return [];
+  let entries;
+  try {
+    entries = readdirSync(skillsDir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => e.isDirectory()).map((e) => {
+    const dir = join(skillsDir, e.name);
+    return {
+      name: e.name,
+      version: readSkillVersion(join(dir, "SKILL.md")),
+      path: dir
+    };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+}
+function compareDotted(a, b) {
+  const pa = a.split(".");
+  const pb = b.split(".");
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const na = Number.parseInt(pa[i] ?? "0", 10);
+    const nb = Number.parseInt(pb[i] ?? "0", 10);
+    if (Number.isNaN(na) || Number.isNaN(nb)) return a.localeCompare(b);
+    if (na !== nb) return na - nb;
+  }
+  return 0;
+}
+function readInstalledPlugin(marketplace, plugin) {
+  const root = pluginCacheRoot(marketplace, plugin);
+  if (!existsSync(root)) return null;
+  let versions;
+  try {
+    versions = readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return null;
+  }
+  if (versions.length === 0) return null;
+  const version = versions.sort(compareDotted)[versions.length - 1];
+  const path = join(root, version);
+  const skillsPath = join(path, "skills");
+  return {
+    version,
+    path,
+    skillsPath: existsSync(skillsPath) ? skillsPath : null,
+    skills: readSkills(skillsPath)
+  };
+}
+function readMarketplacePlugin(marketplace, plugin) {
+  const root = marketplacePluginRoot(marketplace, plugin);
+  const manifest = join(root, ".claude-plugin", "plugin.json");
+  if (!existsSync(manifest)) return null;
+  let version;
+  try {
+    const parsed = JSON.parse(readFileSync(manifest, "utf-8"));
+    if (typeof parsed.version !== "string" || parsed.version.length === 0) return null;
+    version = parsed.version;
+  } catch {
+    return null;
+  }
+  const skillsPath = join(root, "skills");
+  return {
+    version,
+    path: root,
+    skillsPath: existsSync(skillsPath) ? skillsPath : null,
+    skills: readSkills(skillsPath)
+  };
+}
+function upgradeCommand(plugin, marketplace) {
+  return `claude plugin update ${plugin}@${marketplace}`;
+}
+
+// src/commands/agent.ts
 var PLUGIN_NAME = "dashwise";
 var MARKETPLACE_NAME = "dashwise";
 var DEFAULT_MARKETPLACE_SOURCE = "Intuize/dashwise-cli";
-var defaultRunner = (cmd, args, opts) => new Promise((resolve13) => {
+var defaultRunner = (cmd, args, opts) => new Promise((resolve14) => {
   const target = spawnTarget(cmd, args);
   if ("refused" in target) {
-    resolve13({ code: null, stdout: "", stderr: target.refused, missing: false });
+    resolve14({ code: null, stdout: "", stderr: target.refused, missing: false });
     return;
   }
   const child = spawn(target.command, target.args, {
@@ -6520,7 +6948,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolve13) => {
   child.on("error", (err) => {
     if (settled) return;
     settled = true;
-    resolve13({
+    resolve14({
       code: null,
       stdout,
       stderr: stderr || err.message,
@@ -6530,9 +6958,35 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolve13) => {
   child.on("close", (exitCode) => {
     if (settled) return;
     settled = true;
-    resolve13({ code: exitCode, stdout, stderr, missing: false });
+    resolve14({ code: exitCode, stdout, stderr, missing: false });
   });
 });
+function readSkillsOnDisk() {
+  const installed = readInstalledPlugin(MARKETPLACE_NAME, PLUGIN_NAME);
+  const latest = readMarketplacePlugin(MARKETPLACE_NAME, PLUGIN_NAME);
+  return {
+    skills_path: installed?.skillsPath ?? null,
+    installed_version: installed?.version ?? null,
+    latest_version: latest?.version ?? null,
+    skills: (installed?.skills ?? []).map((sk) => ({
+      name: sk.name,
+      version: sk.version,
+      path: sk.path
+    })),
+    upgrade_command: upgradeCommand(PLUGIN_NAME, MARKETPLACE_NAME)
+  };
+}
+function printSkillsOnDisk(disk) {
+  if (disk.skills_path === null) return;
+  info(
+    `The skills are readable on disk now, without a restart: ${code(disk.skills_path)}`
+  );
+  for (const sk of disk.skills) {
+    out(
+      `    ${dim("skill:")} ${sk.name}${sk.version ? ` ${dim(`v${sk.version}`)}` : ""}`
+    );
+  }
+}
 function parsePluginList(text4) {
   let parsed;
   try {
@@ -6692,12 +7146,23 @@ async function agentSetupCommand(options = {}, deps = {}) {
   const installed = await step(run, ["plugin", "install", pluginId], json, report);
   if (installed !== 0) return failed(report, source, json, finish, installed);
   report.plugin.installed = true;
+  const disk = readSkillsOnDisk();
+  report.on_disk = disk;
+  if (disk.installed_version !== null) report.plugin.version = disk.installed_version;
   report.next = ["Restart Claude Code so it loads the plugin."];
+  if (disk.skills_path !== null) {
+    report.next.push(`Or read the skills now, without restarting: ${disk.skills_path}`);
+  }
   if (!loggedIn())
     report.next.push("Run `dashwise login` once, so the plugin\u2019s MCP server can start.");
   if (!json) {
-    success(`Installed ${pluginId}.`);
-    for (const line of report.next) info(line);
+    success(
+      `Installed ${pluginId}${disk.installed_version ? ` v${disk.installed_version}` : ""}.`
+    );
+    info("Restart Claude Code so it loads the plugin.");
+    printSkillsOnDisk(disk);
+    if (!loggedIn())
+      info("Run `dashwise login` once, so the plugin\u2019s MCP server can start.");
   }
   return finish(0);
 }
@@ -6740,10 +7205,59 @@ function printStatus(report) {
   );
   if (p.others?.length) out(`Also installed from other marketplaces: ${p.others.join(", ")}`);
 }
+async function agentStatusCommand(options = {}) {
+  const installed = readInstalledPlugin(MARKETPLACE_NAME, PLUGIN_NAME);
+  const latest = readMarketplacePlugin(MARKETPLACE_NAME, PLUGIN_NAME);
+  const upgrade = upgradeCommand(PLUGIN_NAME, MARKETPLACE_NAME);
+  const report = {
+    plugin: `${PLUGIN_NAME}@${MARKETPLACE_NAME}`,
+    marketplace: MARKETPLACE_NAME,
+    installed_version: installed?.version ?? null,
+    latest_version: latest?.version ?? null,
+    up_to_date: installed && latest ? installed.version === latest.version : null,
+    skills_path: installed?.skillsPath ?? null,
+    skills: (installed?.skills ?? []).map((sk) => ({
+      name: sk.name,
+      version: sk.version,
+      path: sk.path
+    })),
+    latest_skills: (latest?.skills ?? []).map((sk) => ({
+      name: sk.name,
+      version: sk.version
+    })),
+    upgrade_command: upgrade
+  };
+  if (options.json === true) {
+    out(JSON.stringify(report, null, 2));
+    return 0;
+  }
+  if (installed === null) {
+    out(`Plugin ${report.plugin}: not installed`);
+    info(`Install it with ${code("dashwise agent setup")}.`);
+    return 0;
+  }
+  out(`Plugin ${report.plugin}: ${installed.version} installed`);
+  out(
+    `Marketplace copy: ${latest === null ? "could not tell (no marketplace clone on this machine)" : `${latest.version}${report.up_to_date ? " \u2014 up to date" : ""}`}`
+  );
+  if (report.skills_path !== null) out(`Skills: ${report.skills_path}`);
+  for (const sk of report.skills) {
+    const newer = report.latest_skills.find((l) => l.name === sk.name);
+    const drift = newer && newer.version && sk.version && newer.version !== sk.version ? ` ${dim(`\u2192 ${newer.version} available`)}` : "";
+    out(`  - ${sk.name}${sk.version ? ` v${sk.version}` : dim(" (unversioned)")}${drift}`);
+  }
+  if (report.up_to_date === false) {
+    info(`A newer plugin is available. Upgrade with ${code(upgrade)}.`);
+  } else if (report.up_to_date === null) {
+    info(`To check for a newer version: ${code(upgrade)}.`);
+  }
+  return 0;
+}
 
 // src/commands/workspace.ts
 init_api_client();
 init_config();
+init_workspaces();
 init_output();
 async function workspaceListCommand(options = {}) {
   const cfg = readConfig();
@@ -6839,6 +7353,111 @@ async function workspaceUseCommand(slug) {
   }
   return 0;
 }
+async function workspaceTablesCommand(options = {}) {
+  const cfg = readConfig();
+  if (!cfg) {
+    if (options.json) {
+      out(
+        JSON.stringify({
+          ok: false,
+          error: { code: "NOT_LOGGED_IN", message: "Run `dashwise login` first." }
+        })
+      );
+    } else {
+      fail("Not logged in. Run `dashwise login` first.");
+    }
+    return 1;
+  }
+  let workspace2;
+  try {
+    workspace2 = await selectWorkspace({
+      apiUrl: resolveApiUrl(),
+      apiToken: cfg.token,
+      ...options.workspace !== void 0 ? { flag: options.workspace } : cfg.workspaceSlug !== void 0 ? { flag: cfg.workspaceSlug } : {},
+      // A table listing is a read; prompting for a workspace mid-script
+      // would be worse than saying which flag to pass.
+      interactive: false
+    });
+  } catch (err) {
+    if (options.json) {
+      out(
+        JSON.stringify({
+          ok: false,
+          error: { code: "WORKSPACE_UNRESOLVED", message: err.message }
+        })
+      );
+    } else {
+      fail(err.message);
+    }
+    return 1;
+  }
+  let tables;
+  try {
+    tables = await listWorkspaceTables(workspace2.id, {
+      baseUrl: resolveApiUrl(),
+      auth: { token: cfg.token }
+    });
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      if (options.json) {
+        out(
+          JSON.stringify({
+            ok: false,
+            error: { code: "TOKEN_INVALID", message: "Saved token is no longer valid." }
+          })
+        );
+      } else {
+        fail("Saved token is no longer valid. Run `dashwise login` again.");
+      }
+      return 1;
+    }
+    if (options.json) {
+      out(
+        JSON.stringify({
+          ok: false,
+          error: { code: "FETCH_FAILED", message: err.message }
+        })
+      );
+    } else {
+      fail(`Could not list tables: ${err.message}`);
+    }
+    return 1;
+  }
+  if (options.json) {
+    out(
+      JSON.stringify({
+        ok: true,
+        workspace: { id: workspace2.id, slug: workspace2.slug, name: workspace2.name },
+        tables
+      })
+    );
+    return 0;
+  }
+  if (tables.length === 0) {
+    info(`No tables visible to you in workspace ${code(workspace2.slug)}.`);
+    return 0;
+  }
+  out("");
+  info(
+    `${tables.length} table${tables.length === 1 ? "" : "s"} in ${code(workspace2.slug)} ${dim(`(id ${workspace2.id})`)}:`
+  );
+  let lastApp = null;
+  for (const t of tables) {
+    if (t.application_name !== lastApp) {
+      out(`  ${dim(t.application_name)}`);
+      lastApp = t.application_name;
+    }
+    out(`    ${String(t.table_id).padEnd(8)} ${t.name}`);
+  }
+  out("");
+  info(
+    `Use an id with ${code("dashwise uses add --from-table <id>")} to declare a contract on that table.`
+  );
+  out(
+    `  ${dim(`Not every table can back a uses slot \u2014 a module-managed one is refused; reach those with \`dashwise deps\`.`)}`
+  );
+  return 0;
+}
 
 // src/commands/module/clone.ts
 init_api_client();
@@ -7532,6 +8151,53 @@ function extractManifestIssues(err) {
 
 // src/commands/module/generate.ts
 init_api_client();
+
+// src/lib/generator-version.ts
+var SUPPORTED_GENERATOR_MAJOR = 3;
+var STAMP_KEY = "dashwiseGeneratedBy";
+var STAMP_RE = /^sdk-generator@(\d+)(?:\.|$)/;
+function readGeneratorStamp(files) {
+  const pkg = files["package.json"];
+  if (typeof pkg !== "string") return { kind: "unstamped" };
+  let parsed;
+  try {
+    parsed = JSON.parse(pkg);
+  } catch {
+    return { kind: "unstamped" };
+  }
+  const stamp = parsed?.[STAMP_KEY];
+  if (typeof stamp !== "string") return { kind: "unstamped" };
+  const match = STAMP_RE.exec(stamp);
+  if (!match) return { kind: "unstamped" };
+  return { kind: "stamped", stamp, major: Number.parseInt(match[1], 10) };
+}
+var ALLOW_NEWER_GENERATOR_FLAG = "--allow-newer-generator";
+var SUPPORTED_MAJOR_NOTE = "Generator 3: select fields in `uses` slots are typed as the wire sends them \u2014 the option id on a read, the id or the exact label on a write.";
+function judgeGeneratorStamp(stamp, opts = {}) {
+  if (stamp.kind === "unstamped") return { ok: true, note: null, warning: null };
+  if (stamp.major > SUPPORTED_GENERATOR_MAJOR) {
+    const skew = `This backend's type generator is ${stamp.stamp} \u2014 major ${stamp.major}, and this @dashai/cli understands major ${SUPPORTED_GENERATOR_MAJOR}. A generator major changes the shape of the generated types`;
+    if (opts.allowNewerGenerator) {
+      return {
+        ok: true,
+        note: null,
+        warning: `${skew}, and ${ALLOW_NEWER_GENERATOR_FLAG} told this CLI to write them anyway. The files are the backend's either way \u2014 generation is server-side \u2014 but nothing here can describe what changed about them, so a compile error in your own code after this is the expected shape of the skew. Upgrade with \`npm i -g @dashai/cli@latest\` when a release exists.`
+      };
+    }
+    return {
+      ok: false,
+      code: "GENERATOR_MAJOR_UNSUPPORTED",
+      message: `${skew}, so nothing was written: upgrade with \`npm i -g @dashai/cli@latest\`, then re-run \`dashwise module generate\`. If no release understands it yet, re-run with ${ALLOW_NEWER_GENERATOR_FLAG} to write it anyway \u2014 the output is identical either way, and you lose only this CLI's account of what changed.`
+    };
+  }
+  if (stamp.major === SUPPORTED_GENERATOR_MAJOR) {
+    return { ok: true, note: SUPPORTED_MAJOR_NOTE, warning: null };
+  }
+  return { ok: true, note: null, warning: null };
+}
+
+// src/commands/module/generate.ts
+init_sdk_version();
 init_output();
 function outputDir(projectRoot) {
   return join(projectRoot, "node_modules", "@dashai", "generated");
@@ -7577,6 +8243,14 @@ async function moduleGenerateCommand(options) {
     fail(`Could not generate SDK: ${err.message}`);
     return 1;
   }
+  const verdict = judgeGeneratorStamp(readGeneratorStamp(res.files), {
+    ...options.allowNewerGenerator !== void 0 ? { allowNewerGenerator: options.allowNewerGenerator } : {}
+  });
+  if (!verdict.ok) {
+    fail(`${verdict.code}: ${verdict.message}`);
+    return 1;
+  }
+  if (verdict.warning !== null) warn(verdict.warning);
   if (options.dryRun) {
     info(`Dry run: ${Object.keys(res.files).length} files`);
     info(`Hash: ${code(res.contentHash)}`);
@@ -7599,8 +8273,25 @@ async function moduleGenerateCommand(options) {
     `Generated ${Object.keys(res.files).length} files into ${code("node_modules/@dashai/generated/")}`
   );
   info(`Hash: ${dim(res.contentHash)}`);
+  if (verdict.note !== null && declaresUses(manifest)) info(verdict.note);
+  warnIfSdkBelowUsesFloor(projectRoot, manifest);
   return 0;
 }
+function declaresUses(manifest) {
+  const uses = manifest?.uses;
+  return Array.isArray(uses?.tables) && uses.tables.length > 0;
+}
+function warnIfSdkBelowUsesFloor(projectRoot, manifest) {
+  if (!declaresUses(manifest)) return;
+  const sdk = checkSdkFloor(projectRoot, USES_SDK_FLOOR);
+  if (sdk.ok) return;
+  warn(
+    `This manifest declares ${code("uses")}, which needs ${code(`@dashai/sdk >= ${sdk.floor}`)} \u2014 this project has ${code(sdk.installed ?? "none")}.`
+  );
+  info(
+    `Every import from ${code("@dashai/generated")} will throw until you upgrade, including your own tables: ${code(`npm install @dashai/sdk@^${sdk.floor}`)}.`
+  );
+}
 
 // src/commands/module/dev.ts
 init_output();
@@ -7904,6 +8595,7 @@ async function resolveWorkspaceWithFallback(opts) {
 
 // src/commands/module/install.ts
 init_output();
+init_connect_status();
 async function moduleInstallCommand(slugArg, options) {
   const slug = resolveSlug(slugArg, options.dir);
   if (!slug) {
@@ -8077,6 +8769,8 @@ async function moduleInstallCommand(slugArg, options) {
   const publicUrl = row?.public_url ?? null;
   const installedVersion = row?.module_version?.version ?? targetVersion;
   const runtimeProvisioned = isRealRuntimeUrl(row?.runtime_url);
+  const readiness = await fetchUsesReadiness(result.installation.id, auth);
+  const setupPending = readiness?.setupPending ?? false;
   if (options.json) {
     out(
       JSON.stringify({
@@ -8085,11 +8779,15 @@ async function moduleInstallCommand(slugArg, options) {
         version: installedVersion,
         was_upgrade: result.was_upgrade,
         public_url: publicUrl,
-        verified
+        verified,
+        // `null` when the binding surface was unreachable; `[]` when the
+        // module declares no slots. The two are not the same thing.
+        uses: readiness === null ? null : usesInstallJson(readiness),
+        setup_pending: setupPending
       })
     );
     if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
-    return 0;
+    return setupPending ? EXIT_SETUP_PENDING : 0;
   }
   if (!verified) {
     success(
@@ -8102,9 +8800,15 @@ async function moduleInstallCommand(slugArg, options) {
     return 0;
   }
   if (runtimeProvisioned && publicUrl) {
-    success(
-      `Deployed ${code(mod.slug)} ${code(`v${installedVersion}`)} \u2014 live at ${code(publicUrl)}`
-    );
+    if (setupPending) {
+      success(
+        `Deployed ${code(mod.slug)} ${code(`v${installedVersion}`)} at ${code(publicUrl)} \u2014 ${code("setup pending")}, not usable yet.`
+      );
+    } else {
+      success(
+        `Deployed ${code(mod.slug)} ${code(`v${installedVersion}`)} \u2014 live at ${code(publicUrl)}`
+      );
+    }
     info(
       `Install ${code(`#${result.installation.id}`)} (kind=${row?.kind ?? "unknown"}) in workspace ${code(workspace2.slug)}${result.was_upgrade ? " \u2014 upgraded in place." : "."}`
     );
@@ -8123,8 +8827,9 @@ async function moduleInstallCommand(slugArg, options) {
       `No public URL yet \u2014 runtime provisioning didn't complete. Re-running ${code("dashwise module install")} is idempotent and repairs a failed provision.`
     );
   }
+  if (readiness !== null) renderUsesReadiness(readiness, result);
   if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
-  return 0;
+  return setupPending ? EXIT_SETUP_PENDING : 0;
 }
 function publishedModuleLocalDevGuidance(slug) {
   return `Re-provision local dev any time with ${code(`dashwise init ${slug} --workspace <ws>`)} (or ${code("dashwise module reset-dev-install")}) \u2014 requires backend \u2265 2026-07-15; the fresh dev install COEXISTS with the production install.
@@ -8280,6 +8985,18 @@ function surfaceInstallError(err, slug, workspaceSlug, devInstallReplaced) {
   }
   return 1;
 }
+var EXIT_SETUP_PENDING = 3;
+function usesInstallJson(readiness) {
+  return {
+    pending: readiness.pending.map((b) => b.uses_slug),
+    slots: readiness.slots.map((b) => ({
+      uses_slug: b.uses_slug,
+      status: b.status,
+      required: b.if_missing !== "optional",
+      table: b.table ?? null
+    }))
+  };
+}
 
 // src/commands/module/list.ts
 init_api_client();
@@ -8393,6 +9110,109 @@ async function moduleListCommand(options) {
 init_api_client();
 init_config();
 init_output();
+
+// src/lib/gitignore.ts
+function escapeLiteral(ch) {
+  return ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function patternToRegex(pattern, anchored) {
+  let out2 = "";
+  let i = 0;
+  while (i < pattern.length) {
+    const ch = pattern[i];
+    if (ch === "*") {
+      if (pattern[i + 1] === "*") {
+        const nextIsSlash = pattern[i + 2] === "/";
+        if (nextIsSlash) {
+          out2 += "(?:.*/)?";
+          i += 3;
+        } else {
+          out2 += ".*";
+          i += 2;
+        }
+        continue;
+      }
+      out2 += "[^/]*";
+      i += 1;
+      continue;
+    }
+    if (ch === "?") {
+      out2 += "[^/]";
+      i += 1;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < pattern.length) {
+      out2 += escapeLiteral(pattern[i + 1]);
+      i += 2;
+      continue;
+    }
+    out2 += escapeLiteral(ch);
+    i += 1;
+  }
+  const prefix = anchored ? "^" : "^(?:.*/)?";
+  return new RegExp(`${prefix}${out2}(?:/.*)?$`);
+}
+function parseGitignore(content) {
+  const rules = [];
+  for (const rawLine of content.split(/\r?\n/)) {
+    const line = rawLine.replace(/(?<!\\)\s+$/, "");
+    if (line.length === 0 || line.startsWith("#")) continue;
+    let pattern = line;
+    let negated = false;
+    if (pattern.startsWith("!")) {
+      negated = true;
+      pattern = pattern.slice(1);
+    } else if (pattern.startsWith("\\!")) {
+      pattern = pattern.slice(1);
+    }
+    if (pattern.length === 0) continue;
+    let dirOnly = false;
+    if (pattern.endsWith("/")) {
+      dirOnly = true;
+      pattern = pattern.slice(0, -1);
+    }
+    if (pattern.length === 0) continue;
+    let anchored = pattern.includes("/");
+    if (pattern.startsWith("/")) {
+      anchored = true;
+      pattern = pattern.slice(1);
+    }
+    if (pattern.length === 0) continue;
+    rules.push({
+      negated,
+      dirOnly,
+      regex: patternToRegex(pattern, anchored),
+      source: line
+    });
+  }
+  return rules;
+}
+function isIgnored(relPath, isDir, scopes) {
+  let ignored = false;
+  for (const scope of scopes) {
+    if (scope.base !== "" && !relPath.startsWith(`${scope.base}/`)) continue;
+    const local = scope.base === "" ? relPath : relPath.slice(scope.base.length + 1);
+    if (local.length === 0) continue;
+    const segments = local.split("/");
+    const candidates = [];
+    for (let i = 0; i < segments.length - 1; i++) {
+      candidates.push({ path: segments.slice(0, i + 1).join("/"), isDir: true });
+    }
+    candidates.push({ path: local, isDir });
+    for (const rule of scope.rules) {
+      for (const candidate of candidates) {
+        if (rule.dirOnly && !candidate.isDir) continue;
+        if (rule.regex.test(candidate.path)) {
+          ignored = !rule.negated;
+          break;
+        }
+      }
+    }
+  }
+  return ignored;
+}
+
+// src/lib/tarball.ts
 var DEFAULT_EXCLUDE_PATTERNS = [
   "node_modules",
   ".next",
@@ -8413,6 +9233,7 @@ var DEFAULT_EXCLUDE_PATTERNS = [
   "dist",
   "build"
 ];
+var ALWAYS_EXCLUDE_FILES = ["seed.mjs"];
 var PER_FILE_BYTE_LIMIT = 10 * 1024 * 1024;
 var MAX_TARBALL_BYTES = 100 * 1024 * 1024;
 async function packTarball(opts) {
@@ -8424,10 +9245,18 @@ async function packTarball(opts) {
     ...opts.extraExclude ?? []
   ]);
   const filesIncluded = [];
+  const alwaysExcluded = [];
   const warnings = [];
-  const candidates = walk(opts.cwd, excludeSet);
+  const respectGitignore = opts.respectGitignore !== false;
+  const walked = walk(opts.cwd, excludeSet, respectGitignore);
+  const candidates = walked.files;
+  let gitignoredCount = walked.ignoredCount;
   for (const abs of candidates) {
     const rel = relative(opts.cwd, abs);
+    if (ALWAYS_EXCLUDE_FILES.includes(rel)) {
+      alwaysExcluded.push(rel);
+      continue;
+    }
     const size = statSync(abs).size;
     if (size > PER_FILE_BYTE_LIMIT) {
       warnings.push(
@@ -8443,6 +9272,7 @@ async function packTarball(opts) {
     );
   }
   filesIncluded.sort();
+  alwaysExcluded.sort();
   const chunks = [];
   await new Promise((resolveDone, rejectDone) => {
     const stream = tar.c(
@@ -8467,14 +9297,30 @@ async function packTarball(opts) {
       `packTarball: tarball is ${formatBytes(bytes.byteLength)}, exceeds ${formatBytes(MAX_TARBALL_BYTES)} max`
     );
   }
-  return { bytes, filesIncluded, warnings };
+  return { bytes, filesIncluded, warnings, gitignoredCount, alwaysExcluded };
 }
-function walk(root, excludeSet) {
+function walk(root, excludeSet, respectGitignore) {
   const out2 = [];
-  const stack = [root];
+  let ignoredCount = 0;
+  const rootScopes = [];
+  if (respectGitignore) {
+    const rootIgnore = readIgnoreFile(root);
+    if (rootIgnore !== null) rootScopes.push({ base: "", rules: rootIgnore });
+  }
+  const stack = [
+    { dir: root, scopes: rootScopes }
+  ];
   while (stack.length > 0) {
-    const dir = stack.pop();
-    if (!dir) continue;
+    const frame = stack.pop();
+    if (!frame) continue;
+    const { dir } = frame;
+    let scopes = frame.scopes;
+    if (respectGitignore && dir !== root) {
+      const nested = readIgnoreFile(dir);
+      if (nested !== null) {
+        scopes = [...scopes, { base: toPosixRel(root, dir), rules: nested }];
+      }
+    }
     let entries;
     try {
       entries = readdirSync(dir, { withFileTypes: true });
@@ -8484,14 +9330,34 @@ function walk(root, excludeSet) {
     for (const entry of entries) {
       if (excludeSet.has(entry.name)) continue;
       const abs = join(dir, entry.name);
-      if (entry.isDirectory()) {
-        stack.push(abs);
-      } else if (entry.isFile()) {
+      const isDir = entry.isDirectory();
+      if (!isDir && !entry.isFile()) continue;
+      if (respectGitignore && scopes.length > 0) {
+        if (isIgnored(toPosixRel(root, abs), isDir, scopes)) {
+          ignoredCount += 1;
+          continue;
+        }
+      }
+      if (isDir) {
+        stack.push({ dir: abs, scopes });
+      } else {
         out2.push(abs);
       }
     }
   }
-  return out2;
+  return { files: out2, ignoredCount };
+}
+function readIgnoreFile(dir) {
+  const path = join(dir, ".gitignore");
+  if (!existsSync(path)) return null;
+  try {
+    return parseGitignore(readFileSync(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function toPosixRel(root, abs) {
+  return relative(root, abs).split(sep).join("/");
 }
 function formatBytes(n) {
   if (n < 1024) return `${n}B`;
@@ -8501,6 +9367,11 @@ function formatBytes(n) {
 
 // src/commands/module/publish.ts
 var VALID_BUMP = /* @__PURE__ */ new Set(["patch", "minor", "major"]);
+var PACKED_FILE_LIST_CAP = 20;
+function packedFileLines(files, cap = PACKED_FILE_LIST_CAP) {
+  if (files.length <= cap) return [...files];
+  return [...files.slice(0, cap), `\u2026 and ${files.length - cap} more`];
+}
 async function modulePublishCommand(options) {
   const projectRoot = resolve(options.dir ?? process.cwd());
   const manifestPath2 = join(projectRoot, "module.json");
@@ -8575,7 +9446,8 @@ async function modulePublishCommand(options) {
   try {
     tarball = await packTarball({
       cwd: projectRoot,
-      ...options.exclude !== void 0 ? { extraExclude: options.exclude } : {}
+      ...options.exclude !== void 0 ? { extraExclude: options.exclude } : {},
+      respectGitignore: !options.noRespectGitignore
     });
   } catch (err) {
     fail(`Could not pack tarball: ${err.message}`);
@@ -8584,6 +9456,17 @@ async function modulePublishCommand(options) {
   info(
     `Packed ${tarball.filesIncluded.length} file${tarball.filesIncluded.length === 1 ? "" : "s"} into ${formatBytes2(tarball.bytes.byteLength)} (cap ${formatBytes2(MAX_TARBALL_BYTES)}).`
   );
+  for (const line of packedFileLines(tarball.filesIncluded)) out(`    ${dim(line)}`);
+  if (tarball.alwaysExcluded.length > 0) {
+    info(
+      `${tarball.alwaysExcluded.map((f) => code(f)).join(", ")} excluded \u2014 scaffold-local development ${tarball.alwaysExcluded.length === 1 ? "file, not part" : "files, not part"} of the running module, and never published.`
+    );
+  }
+  if (tarball.gitignoredCount > 0) {
+    info(
+      `${tarball.gitignoredCount} path${tarball.gitignoredCount === 1 ? "" : "s"} excluded by ${code(".gitignore")}${options.noRespectGitignore ? "" : ` ${dim("(--no-respect-gitignore to include them)")}`}.`
+    );
+  }
   for (const w of tarball.warnings) warn(w);
   if (!options.yes && process.stdout.isTTY && !options.dryRun) {
     const answer = await select({
@@ -8754,6 +9637,7 @@ init_api_client();
 init_config();
 init_manifest_io();
 init_output();
+init_connect_status();
 async function moduleStatusCommand(slugArg, options) {
   let slug = slugArg;
   if (!slug) {
@@ -8839,6 +9723,7 @@ async function moduleStatusCommand(slugArg, options) {
   const state = runtimeProvisioned && row.public_url ? "live" : runtimeProvisioned ? "deployed" : "not_deployed";
   const installedVersion = row.module_version?.version ?? null;
   const updateAvailable = isUpdateAvailable(installedVersion, latestVersion);
+  const readiness = await fetchUsesReadiness(row.id, auth);
   if (options.json) {
     out(
       JSON.stringify({
@@ -8854,6 +9739,11 @@ async function moduleStatusCommand(slugArg, options) {
         runtime_url: row.runtime_url,
         public_url: row.public_url,
         state,
+        // C-09: per-slot data-plane readiness for THIS install. `null`
+        // when the binding surface was unreachable — distinct from `[]`,
+        // which means the module declares no slots.
+        uses: readiness === null ? null : usesJson(readiness),
+        setup_pending: readiness?.setupPending ?? false,
         // The coexisting dev install, so a script can see BOTH slots — the
         // human output reports it and `--json` used to hide it.
         dev_install: siblingDevInstall ? { id: siblingDevInstall.id, kind: siblingDevInstall.kind ?? null } : null
@@ -8875,8 +9765,12 @@ async function moduleStatusCommand(slugArg, options) {
     runtimeProvisioned ? `provisioned ${dim(`(${row.runtime_url})`)}` : "not provisioned"
   );
   kv("Public URL:", row.public_url ?? dim("(none)"));
-  kv("State:", stateLabel);
+  kv(
+    "State:",
+    readiness?.setupPending ? `${stateLabel} ${dim("\u2014 setup pending")}` : stateLabel
+  );
   out("");
+  if (readiness !== null) renderUsesReadiness(readiness, row);
   if (siblingDevInstall) {
     info(
       `A ${code(`kind=${siblingDevInstall.kind ?? "unknown"}`)} dev install (#${siblingDevInstall.id}) also exists in this workspace and coexists with the production install above \u2014 that is the one ${code("dashwise dev")} talks to.`
@@ -8893,6 +9787,20 @@ async function moduleStatusCommand(slugArg, options) {
   }
   return 0;
 }
+function usesJson(readiness) {
+  return {
+    setup_pending: readiness.setupPending,
+    slots: readiness.slots.map((b) => ({
+      uses_slug: b.uses_slug,
+      status: b.status,
+      if_missing: b.if_missing ?? null,
+      required: b.if_missing !== "optional",
+      table: b.table ?? null,
+      missing_fields: b.missing_fields ?? [],
+      reason: b.reason ?? null
+    }))
+  };
+}
 
 // src/commands/module/uninstall.ts
 init_api_client();
@@ -10499,30 +11407,8 @@ function surfaceBindingError(err) {
 init_api_client();
 init_config();
 init_manifest_io();
-
-// src/lib/uses-types.ts
-var PHYSICAL_TO_ABSTRACT = {
-  text: "text",
-  long_text: "long_text",
-  number: "number",
-  rating: "number",
-  boolean: "boolean",
-  // A date-with-time column has physical registry type `date` (with
-  // `config.includeTime`), NOT a distinct `datetime` type — the backend
-  // registry has no `datetime` key. So introspection only ever reports
-  // `date` here; there is no `datetime` physical entry to fold.
-  date: "date",
-  email: "email",
-  url: "url",
-  single_select: "single_select",
-  multi_select: "multi_select"
-};
-function abstractTypeForPhysical(physicalType) {
-  return PHYSICAL_TO_ABSTRACT[physicalType] ?? null;
-}
-var USES_OPERATIONS = ["create", "read", "update", "delete"];
-
-// src/commands/uses/add.ts
+init_uses_types();
+init_sdk_version();
 init_output();
 async function usesAddCommand(options) {
   if (!options.fromTable) {
@@ -10543,6 +11429,18 @@ async function usesAddCommand(options) {
     fail(err.message);
     return 1;
   }
+  const sdk = checkSdkFloor(resolve(options.dir ?? process.cwd()), USES_SDK_FLOOR);
+  if (!sdk.ok) {
+    fail(
+      `A ${code("uses")} contract needs ${code(`@dashai/sdk >= ${sdk.floor}`)}; this project has ${code(sdk.installed ?? "none")}.`
+    );
+    info(
+      `Below ${code(sdk.floor)} every import from ${code("@dashai/generated")} throws \u2014 including your own tables. Upgrade first: ${code(`npm install @dashai/sdk@^${sdk.floor}`)}.`
+    );
+    return 1;
+  }
+  const scopeExit = await assertTableInInstallWorkspace(ctx, options.fromTable);
+  if (scopeExit !== 0) return scopeExit;
   let table;
   try {
     table = await introspectWorkspaceTable(
@@ -10553,10 +11451,10 @@ async function usesAddCommand(options) {
   } catch (err) {
     return surfaceIntrospectError(err, options.fromTable);
   }
-  const slotSlug = options.slug ?? slugify(table.name);
-  if (!isKebab(slotSlug)) {
+  const slotSlug = options.slug ?? slugifyUsesName(table.name);
+  if (!isUsesSlug(slotSlug)) {
     fail(
-      `Generated slot slug ${code(slotSlug)} isn't kebab-case. Pass ${code("--slug <kebab-slug>")} explicitly.`
+      `Slot slug ${code(slotSlug || "(empty)")} doesn't match ${code(USES_SLUG_RULE)}. Pass ${code("--slug <snake_case_slug>")} explicitly.`
     );
     return 1;
   }
@@ -10567,6 +11465,37 @@ async function usesAddCommand(options) {
     );
     return 1;
   }
+  const badFields = fields.filter((f) => !isUsesSlug(f.slug));
+  if (badFields.length > 0) {
+    fail(
+      `${badFields.length} field name(s) on ${code(table.name)} don't fold into a legal ${code("uses")} field slug (${code(USES_SLUG_RULE)}):`
+    );
+    for (const f of badFields) {
+      const physical = table.fields.find((p) => p.slug === f.slug);
+      const name = physical?.name ?? f.slug;
+      out(`    ${dim("-")} ${code(name)} \u2192 ${code(f.slug || "(empty)")}`);
+    }
+    info(
+      `Rename the field(s) in Dashwise, or declare the slot by hand in ${code("module.json#uses.tables")}. Nothing was written.`
+    );
+    return 1;
+  }
+  const slugCounts = /* @__PURE__ */ new Map();
+  for (const f of fields) slugCounts.set(f.slug, (slugCounts.get(f.slug) ?? 0) + 1);
+  const collidingSlugs = [...slugCounts.entries()].filter(([, n]) => n > 1).map(([slug]) => slug);
+  if (collidingSlugs.length > 0) {
+    fail(
+      `${collidingSlugs.length} generated ${code("uses")} field slug(s) on ${code(table.name)} collide \u2014 the backend refuses a contract with a duplicate field slug:`
+    );
+    for (const slug of collidingSlugs) {
+      const names = table.fields.filter((p) => p.slug === slug && abstractTypeForPhysical(p.type) !== null).map((p) => p.name ?? p.slug);
+      out(`    ${dim("-")} ${names.map((n) => code(n)).join(" + ")} \u2192 ${code(slug)}`);
+    }
+    info(
+      `Rename one of each pair in Dashwise, or declare the slot by hand in ${code("module.json#uses.tables")}. Nothing was written.`
+    );
+    return 1;
+  }
   const slot = {
     slug: slotSlug,
     ops,
@@ -10603,6 +11532,13 @@ async function usesAddCommand(options) {
   }
   uses.tables = tables;
   ctx.manifest.uses = uses;
+  const pushed = await pushManifest(ctx);
+  if (!pushed.ok && pushed.rejected) {
+    info(
+      `${code("module.json")} was left unchanged \u2014 the generated slot was rejected before it could be written.`
+    );
+    return 1;
+  }
   try {
     writeManifest(ctx.manifest, ctx.dir);
   } catch (err) {
@@ -10612,8 +11548,7 @@ async function usesAddCommand(options) {
   success(
     `${existingIdx >= 0 ? "Replaced" : "Added"} ${code(`uses.tables[${slotSlug}]`)} in module.json.`
   );
-  const pushed = await pushManifest(ctx);
-  if (!pushed) {
+  if (!pushed.ok) {
     info(
       `The manifest edit is saved locally. Push it (${code("dashwise dev")} watches + applies, or re-run once the backend is reachable), then ${code(`dashwise bind ${slotSlug} --table ${table.table_id}`)}.`
     );
@@ -10638,6 +11573,52 @@ async function usesAddCommand(options) {
   }
   return 0;
 }
+async function assertTableInInstallWorkspace(ctx, fromTable) {
+  if (ctx.workspaceId === void 0) return 0;
+  const wanted = Number(fromTable);
+  if (!Number.isInteger(wanted) || wanted <= 0) return 0;
+  let tables;
+  try {
+    tables = await listWorkspaceTables(ctx.workspaceId, ctx.requestOptions);
+  } catch {
+    return 0;
+  }
+  const wantedRow = tables.find((t) => t.table_id === wanted);
+  if (wantedRow !== void 0 && !isModuleManaged(wantedRow)) return 0;
+  if (wantedRow !== void 0) {
+    fail(
+      `Table ${code(String(wanted))} (${wantedRow.name}) is managed by a module, so a ${code("uses")} contract on it could never be bound (${code("TABLE_IS_MODULE_MANAGED")}).`
+    );
+    info(
+      `A ${code("uses")} slot binds a table the WORKSPACE owns. Reach another module's tables as a dependency instead: ${code("dashwise deps")}.`
+    );
+    return 1;
+  }
+  const bindable = tables.filter((t) => !isModuleManaged(t));
+  const hidden = tables.length - bindable.length;
+  fail(
+    `Table ${code(String(wanted))} is not in this install's workspace, so a ${code("uses")} contract on it could never be bound.`
+  );
+  if (bindable.length === 0) {
+    info(
+      hidden > 0 ? `Every table visible to you in that workspace (${hidden}) is managed by a module, so none of them can back a ${code("uses")} slot either. Create a workspace table in Dashwise, or reach a module's tables with ${code("dashwise deps")}.` : `No tables are visible to you in that workspace. Create one in Dashwise, or re-provision the dev install with ${code("dashwise init")} against the right workspace.`
+    );
+    return 1;
+  }
+  out(`  ${dim(`${bindable.length} table(s) in this workspace:`)}`);
+  for (const t of bindable) {
+    out(
+      `  - ${t.name} ${dim(`(id ${t.table_id}, in ${t.application_name})`)}`
+    );
+  }
+  info(
+    hidden > 0 ? `That is the workspace's table list \u2014 ${hidden} module-managed table(s) are not shown, because a ${code("uses")} slot cannot bind one (${code("TABLE_IS_MODULE_MANAGED")}); reach those with ${code("dashwise deps")}.` : `That is the workspace's table list \u2014 the server decides which of them can back a ${code("uses")} slot, and refuses a module-managed one (${code("TABLE_IS_MODULE_MANAGED")}); reach those with ${code("dashwise deps")}.`
+  );
+  return 1;
+}
+function isModuleManaged(t) {
+  return typeof t.module_id === "number";
+}
 function loadContext3(opts) {
   const manifest = readManifestOrThrow(opts.dir);
   const moduleSlug = manifest.module?.slug;
@@ -10656,6 +11637,7 @@ function loadContext3(opts) {
   }
   return {
     installationId: entry.installationId,
+    ...entry.workspaceId !== void 0 ? { workspaceId: entry.workspaceId } : {},
     moduleSlug,
     ...opts.dir !== void 0 ? { dir: opts.dir } : {},
     manifest,
@@ -10675,10 +11657,10 @@ async function pushManifest(ctx) {
       warn(
         `Module ${code(ctx.moduleSlug)} isn't registered on the backend yet. Run ${code("dashwise module register")} (or ${code("dashwise init")}) before on-ramping a table.`
       );
-      return false;
+      return { ok: false, rejected: false };
     }
     warn(`Couldn't resolve the module id to push the manifest: ${err.message}`);
-    return false;
+    return { ok: false, rejected: false };
   }
   try {
     await applyDraftManifest(
@@ -10687,20 +11669,20 @@ async function pushManifest(ctx) {
       ctx.requestOptions
     );
     success("Pushed the manifest \u2014 the backend parked the new slot, ready to bind.");
-    return true;
+    return { ok: true };
   } catch (err) {
     if (err instanceof ApiError) {
       if (err.code === "MANIFEST_INVALID" || err.status === 400) {
         fail(`Manifest rejected by the backend validator: ${err.message}`);
         const issues = extractIssues(err.context);
         for (const issue of issues) out(`    ${dim("-")} ${issue}`);
-      } else {
-        fail(`Manifest push failed: ${err.code} ${err.status} \u2014 ${err.message}`);
+        return { ok: false, rejected: true };
       }
-    } else {
-      fail(`Manifest push failed: ${err.message}`);
+      fail(`Manifest push failed: ${err.code} ${err.status} \u2014 ${err.message}`);
+      return { ok: false, rejected: false };
     }
-    return false;
+    fail(`Manifest push failed: ${err.message}`);
+    return { ok: false, rejected: false };
   }
 }
 function extractIssues(context) {
@@ -10750,13 +11732,6 @@ function parseOps(opsCsv) {
   }
   return USES_OPERATIONS.filter((o) => seen.has(o));
 }
-function slugify(name) {
-  return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-var KEBAB_REGEX = /^[a-z][a-z0-9-]*[a-z0-9]$/;
-function isKebab(slug) {
-  return KEBAB_REGEX.test(slug);
-}
 function surfaceIntrospectError(err, tableRef) {
   if (err instanceof ApiError) {
     switch (err.code) {
@@ -12061,28 +13036,36 @@ function formatTimestamp(iso) {
   return iso.slice(0, 19).replace("T", " ");
 }
 function sleep2(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 
 // src/commands/module/action-log.ts
 init_api_client();
+init_manifest_io();
 init_output();
 var POLL_INTERVAL_MS2 = 5e3;
 async function moduleActionLogCommand(options) {
-  if (options.installation === void 0 && options.module === void 0) {
-    fail("Must pass either `--installation <id>` or `--module <slug>`.");
-    return 1;
-  }
   if (options.installation !== void 0 && options.module !== void 0) {
     fail("`--installation` and `--module` are mutually exclusive \u2014 pass one or the other.");
     return 1;
   }
+  let moduleSlug = options.module;
+  if (options.installation === void 0 && moduleSlug === void 0) {
+    const inferred = inferModuleSlug(options.dir);
+    if (inferred === null) {
+      fail(
+        "Pass `--installation <id>` or `--module <slug>`, or run this inside a module project directory containing module.json."
+      );
+      return 1;
+    }
+    moduleSlug = inferred;
+  }
   let installationId = options.installation;
-  if (installationId === void 0 && options.module !== void 0) {
+  if (installationId === void 0 && moduleSlug !== void 0) {
     try {
       const resolved = await apiRequest(
         "GET",
-        `/api/modules/by-slug/${encodeURIComponent(options.module)}/my-installation`
+        `/api/modules/by-slug/${encodeURIComponent(moduleSlug)}/my-installation`
       );
       installationId = resolved.installation_id;
     } catch (err) {
@@ -12155,7 +13138,7 @@ async function runTail2(installationId, options) {
       }
       dim(`(tail: transient error \u2014 ${err.message})`);
     }
-    await new Promise((resolve13) => setTimeout(resolve13, POLL_INTERVAL_MS2));
+    await new Promise((resolve14) => setTimeout(resolve14, POLL_INTERVAL_MS2));
   }
 }
 function printTable(rows) {
@@ -12220,6 +13203,17 @@ function mapAndPrintError(err, json) {
   else fail(msg);
   return 1;
 }
+function inferModuleSlug(dir) {
+  try {
+    const manifest = readManifestOrThrow(
+      dir ?? process.cwd()
+    );
+    const slug = manifest?.module?.slug;
+    return typeof slug === "string" && slug.length > 0 ? slug : null;
+  } catch {
+    return null;
+  }
+}
 
 // src/commands/module/logs.ts
 init_api_client();
@@ -12529,7 +13523,7 @@ async function sleep3(ms, aborted) {
   const slice = 100;
   let waited = 0;
   while (waited < ms && !aborted()) {
-    await new Promise((resolve13) => setTimeout(resolve13, Math.min(slice, ms - waited)));
+    await new Promise((resolve14) => setTimeout(resolve14, Math.min(slice, ms - waited)));
     waited += slice;
   }
 }
@@ -12539,7 +13533,7 @@ init_output();
 var program = new Command();
 program.name("dashwise").description("Dashwise CLI \u2014 log in, author modules, publish to the marketplace.").version(getVersion(), "-v, --version", "Show the CLI version + exit").option(
   "--api-url <url>",
-  "Override Dashwise backend URL (default: $DASHWISE_API_URL or saved config or http://localhost:3000)"
+  `Override Dashwise backend URL (default: $DASHWISE_API_URL, else your saved login, else ${KNOWN_API_URLS.dev}). Prod is ${KNOWN_API_URLS.prod}; pass a localhost URL to target a backend you are running yourself.`
 );
 program.hook("preAction", () => {
   const apiUrl = program.opts().apiUrl?.trim();
@@ -12630,7 +13624,9 @@ mcp.command("add").description(
     });
   }
 );
-var agent = program.command("agent").description("Set up a coding agent to work with Dashwise (`dashwise agent setup`).");
+var agent = program.command("agent").description(
+  "Set up a coding agent to work with Dashwise (`dashwise agent setup`, `dashwise agent status`)."
+);
 agent.command("setup").description(
   "Install the Dashwise plugin into Claude Code \u2014 its skills, the `dashwise` MCP server and the secrets guard \u2014 by running `claude plugin marketplace add` and `claude plugin install`. Without Claude Code, prints the two commands instead."
 ).option(
@@ -12643,12 +13639,27 @@ agent.command("setup").description(
     ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
   });
 });
+agent.command("status").description(
+  "Report the installed Dashwise plugin and skills: their versions, the path the skills are readable at without a restart, the newest version this machine has fetched, and the command that upgrades. Reads the filesystem only \u2014 it does not need Claude Code on the PATH."
+).option("--json", "Print one JSON object on stdout instead of the report.").action(async (cmdOpts) => {
+  process.exitCode = await agentStatusCommand({
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
 var workspace = program.command("workspace").description("Workspace context commands.");
 workspace.command("list").description("List accessible workspaces.").option("--json", "Emit JSON to stdout instead of human-readable columns.").action(async (cmdOpts) => {
   process.exitCode = await workspaceListCommand({
     ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
   });
 });
+workspace.command("tables").description(
+  "List a workspace's tables with their numeric ids \u2014 the ids `dashwise uses add --from-table <id>` needs. Defaults to the saved default workspace."
+).option("--workspace <slug>", "Workspace slug or numeric id (default: the saved default).").option("--json", "Emit JSON to stdout instead of human-readable columns.").action(async (cmdOpts) => {
+  process.exitCode = await workspaceTablesCommand({
+    ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
 workspace.command("use <slug>").description("Set the default workspace for subsequent commands.").action(async (slug) => {
   process.exitCode = await workspaceUseCommand(slug);
 });
@@ -12780,12 +13791,18 @@ moduleCmd.command("export [dir]").description(
     });
   }
 );
-moduleCmd.command("generate").description("Regenerate typed wrappers from the local module.json into node_modules/@dashai/generated/.").option("--dir <path>", "Project root (default: current directory).").option("--dry-run", "Print summary without writing files.").action(async (cmdOpts) => {
-  process.exitCode = await moduleGenerateCommand({
-    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
-    ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {}
-  });
-});
+moduleCmd.command("generate").description("Regenerate typed wrappers from the local module.json into node_modules/@dashai/generated/. Refuses output stamped with a generator major this CLI does not know (GENERATOR_MAJOR_UNSUPPORTED) before writing anything.").option("--dir <path>", "Project root (default: current directory).").option("--dry-run", "Print summary without writing files.").option(
+  "--allow-newer-generator",
+  "Write output from a generator major this CLI does not know, with a warning, instead of refusing (GENERATOR_MAJOR_UNSUPPORTED). Generation is server-side, so the files are identical to what a newer CLI would write \u2014 you lose only this CLI's account of what changed. For a backend that has rolled a generator major ahead of the CLI release."
+).action(
+  async (cmdOpts) => {
+    process.exitCode = await moduleGenerateCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {},
+      ...cmdOpts.allowNewerGenerator !== void 0 ? { allowNewerGenerator: cmdOpts.allowNewerGenerator } : {}
+    });
+  }
+);
 moduleCmd.command("dev").description("Watch module.json + regenerate typed wrappers on every save. Ctrl-C to stop.").option("--dir <path>", "Project root (default: current directory).").option("--debounce-ms <n>", "Filesystem change debounce window (default: 250ms).", parseIntOption).action(async (cmdOpts) => {
   process.exitCode = await moduleDevCommand({
     ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
@@ -12936,7 +13953,7 @@ usesCmd.command("add").description(
   "Comma-separated operations to declare (create,read,update,delete). Default: read."
 ).option(
   "--purpose <text>",
-  "Optional author-facing explanation, shown to admins at bind/consent."
+  `What your module does with these fields, in the admin's words \u2014 shown at bind/consent (up to 500 chars). Be specific: "Reads invoice totals to draw the revenue chart", not "access data".`
 ).option(
   "--no-bind",
   "Only write + push the manifest entry; don't attempt to bind it to the source table."
@@ -13119,6 +14136,9 @@ envCmd.command("export").description(
 moduleCmd.command("publish").description("Pack the current directory + upload it as a new module version.").option("--dir <path>", "Project root (default: current directory).").option("--bump <direction>", "Semver bump: patch | minor | major.").option("--dry-run", "Validate + upload but do not persist the version row.").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use).").option(
   "--exclude <pattern...>",
   "Extra exclude patterns (segment-matched) appended to the defaults."
+).option(
+  "--no-respect-gitignore",
+  "Pack files the project's .gitignore excludes (default: respect it)."
 ).option(
   "--no-wait",
   "Enqueue the build and exit immediately (print the build id) instead of polling to completion."
@@ -13134,6 +14154,9 @@ moduleCmd.command("publish").description("Pack the current directory + upload it
       ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {},
       ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
       ...cmdOpts.exclude !== void 0 ? { exclude: cmdOpts.exclude } : {},
+      // commander maps `--no-respect-gitignore` to
+      // `respectGitignore === false`.
+      ...cmdOpts.respectGitignore === false ? { noRespectGitignore: true } : {},
       // commander maps `--no-wait` to `wait === false`.
       ...cmdOpts.wait === false ? { noWait: true } : {},
       ...timeoutSec !== void 0 && Number.isFinite(timeoutSec) ? { timeoutSec } : {},
@@ -13142,7 +14165,7 @@ moduleCmd.command("publish").description("Pack the current directory + upload it
   }
 );
 moduleCmd.command("install [slug]").alias("deploy").description(
-  "Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row."
+  'Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row. Exits 3 \u2014 "deployed, setup pending" \u2014 when a required `uses` slot is still unbound: the deploy succeeded but the module throws on its first data call until an admin binds it.'
 ).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--version <semver>", "Install a specific published version (default: latest).").option("--force", "Proceed even when the upgrade breaks consumer modules (UPGRADE_BREAKS_CONSUMERS).").option(
   "--keep-dev-install",
   "Install production ALONGSIDE the workspace's kind=local dev install, leaving local dev working. Non-destructive. Backends >= 2026-07-15 keep a separate live-install slot per kind group, so the two coexist."
@@ -13211,7 +14234,10 @@ moduleCmd.command("query-log").description(
   }
 );
 moduleCmd.command("action-log").description(
-  "Read the per-installation server-action audit log. Shows both cross-module and own-module dispatches. Filter by role (caller / provider), slow, since, cross-module-only. `--tail` streams new entries every 5s. Pass either `--installation <id>` or `--module <slug>` (slug resolves to your accessible installation)."
+  "Read the per-installation server-action audit log. Shows both cross-module and own-module dispatches. Filter by role (caller / provider), slow, since, cross-module-only. `--tail` streams new entries every 5s. Pass `--installation <id>` or `--module <slug>`, or run it inside a module project and the slug is read from module.json like every other module command."
+).option(
+  "--dir <path>",
+  "Project root to read module.json from when neither --installation nor --module is given (default: current directory)."
 ).option(
   "--installation <id>",
   "Installation id to inspect. Mutually exclusive with `--module`.",
@@ -13233,6 +14259,7 @@ moduleCmd.command("action-log").description(
       return;
     }
     process.exitCode = await moduleActionLogCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
       ...cmdOpts.installation !== void 0 ? { installation: cmdOpts.installation } : {},
       ...cmdOpts.module !== void 0 ? { module: cmdOpts.module } : {},
       ...cmdOpts.role !== void 0 ? { role: cmdOpts.role } : {},
@@ -13390,7 +14417,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.19.0";
+  return "0.20.1";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);