@dashai/cli 0.2.0

package/dist/bin.js

@@ -0,0 +1,4343 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { spawn, spawnSync } from 'child_process';
+import { existsSync, readdirSync, mkdirSync, writeFileSync, readFileSync, rmSync, watch, chmodSync, renameSync, mkdtempSync, statSync } from 'fs';
+import { resolve, join, dirname, relative } from 'path';
+import { tmpdir, platform, homedir } from 'os';
+import pc from 'picocolors';
+import { intro, log, select, isCancel, cancel, spinner, outro, text, multiselect } from '@clack/prompts';
+import open from 'open';
+import * as tar from 'tar';
+import { pathToFileURL } from 'url';
+
+var FILE_NAME = "auth.json";
+var DIR_NAME = "dashwise";
+function configDir() {
+  if (process.env.XDG_CONFIG_HOME) {
+    return join(process.env.XDG_CONFIG_HOME, DIR_NAME);
+  }
+  if (platform() === "win32" && process.env.APPDATA) {
+    return join(process.env.APPDATA, DIR_NAME);
+  }
+  return join(homedir(), ".config", DIR_NAME);
+}
+function configPath() {
+  return join(configDir(), FILE_NAME);
+}
+function readConfig() {
+  const path = configPath();
+  if (!existsSync(path)) return null;
+  const raw = readFileSync(path, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse ${path}: ${err.message}. Run \`dashwise login\` to recreate it.`
+    );
+  }
+  if (!isPlausibleConfig(parsed)) {
+    throw new Error(
+      `Config at ${path} is missing required fields. Run \`dashwise login\` to recreate it.`
+    );
+  }
+  return parsed;
+}
+function writeConfig(config) {
+  const dir = configDir();
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+  const path = configPath();
+  const tmp = `${path}.tmp.${process.pid}`;
+  writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  try {
+    chmodSync(tmp, 384);
+  } catch {
+  }
+  renameSync(tmp, path);
+}
+function deleteConfig() {
+  const path = configPath();
+  if (!existsSync(path)) return;
+  rmSync(path);
+}
+function resolveApiUrl() {
+  const fromEnv = process.env.DASHWISE_API_URL?.trim();
+  if (fromEnv) return fromEnv.replace(/\/+$/, "");
+  const cfg = safeReadConfig();
+  if (cfg?.apiUrl) return cfg.apiUrl.replace(/\/+$/, "");
+  return "http://localhost:3000";
+}
+function readSavedToken() {
+  const cfg = safeReadConfig();
+  return cfg?.token ?? null;
+}
+function safeReadConfig() {
+  try {
+    return readConfig();
+  } catch {
+    return null;
+  }
+}
+function isPlausibleConfig(v) {
+  if (!v || typeof v !== "object") return false;
+  const c2 = v;
+  if (typeof c2.apiUrl !== "string") return false;
+  if (typeof c2.token !== "string") return false;
+  if (typeof c2.tokenId !== "number") return false;
+  if (!c2.user || typeof c2.user !== "object") return false;
+  const u = c2.user;
+  if (typeof u.id !== "number") return false;
+  if (typeof u.email !== "string") return false;
+  return true;
+}
+function success(msg) {
+  process.stderr.write(`${pc.green("\u2713")} ${msg}
+`);
+}
+function info(msg) {
+  process.stderr.write(`${pc.cyan("\u2139")} ${msg}
+`);
+}
+function warn(msg) {
+  process.stderr.write(`${pc.yellow("\u26A0")} ${msg}
+`);
+}
+function fail(msg) {
+  process.stderr.write(`${pc.red("\u2717")} ${msg}
+`);
+}
+function out(msg) {
+  process.stdout.write(`${msg}
+`);
+}
+function kv(key, value, padTo = 14) {
+  const padded = key.padEnd(padTo);
+  process.stdout.write(`${pc.bold(padded)} ${value}
+`);
+}
+function code(s) {
+  return pc.cyan(s);
+}
+function dim(s) {
+  return pc.dim(s);
+}
+
+// src/commands/dev.ts
+var PREFIX_SDK = `\x1B[36m[sdk]\x1B[0m `;
+var PREFIX_NEXT = `\x1B[35m[next]\x1B[0m `;
+async function devCommand(options) {
+  if (options.sdkOnly && options.nextOnly) {
+    fail(
+      `Cannot pass both ${code("--sdk-only")} and ${code("--next-only")} \u2014 they're mutually exclusive.`
+    );
+    return 1;
+  }
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const manifestPath2 = `${projectRoot}/module.json`;
+  if (!existsSync(manifestPath2)) {
+    fail(`No ${code("module.json")} found in ${code(projectRoot)}.`);
+    info(`Run ${code("dashwise module init <slug>")} to scaffold a new module first.`);
+    return 1;
+  }
+  const savedConfig = (() => {
+    try {
+      return readConfig();
+    } catch {
+      return null;
+    }
+  })();
+  const apiToken = process.env.DASHWISE_API_TOKEN ?? savedConfig?.token;
+  if (!apiToken) {
+    fail(`Not authenticated. Run ${code("dashwise login")} first.`);
+    info(
+      "The unified dev loop reads your CLI token from ~/.config/dashwise/auth.json and injects it into both child processes so the SDK can authenticate without you editing .env.local."
+    );
+    return 1;
+  }
+  const apiUrl = options.apiUrl ?? process.env.DASHWISE_API_URL ?? savedConfig?.apiUrl ?? "http://localhost:3000";
+  const installationId = options.installationId ?? process.env.DASHWISE_INSTALLATION_ID ?? "local";
+  const childEnv = {
+    ...process.env,
+    DASHWISE_API_URL: apiUrl,
+    DASHWISE_API_TOKEN: apiToken,
+    DASHWISE_INSTALLATION_ID: installationId
+  };
+  info(`Dev loop starting \u2014 Ctrl-C to stop.`);
+  info(`  ${dim("api")}        ${apiUrl}`);
+  info(`  ${dim("installation")} ${installationId}`);
+  info(`  ${dim("token")}      ${maskedToken(apiToken)} ${dim(`(from ${apiToken === savedConfig?.token ? "~/.config/dashwise/auth.json" : "$DASHWISE_API_TOKEN"})`)}`);
+  info("");
+  const children = [];
+  if (!options.nextOnly) {
+    const sdkChild = spawnSdkWatcher(projectRoot, childEnv);
+    children.push({ name: "sdk", child: sdkChild, prefix: PREFIX_SDK });
+  }
+  if (!options.sdkOnly) {
+    const nextChild = spawnNextDev(projectRoot, childEnv, options.port);
+    children.push({ name: "next", child: nextChild, prefix: PREFIX_NEXT });
+  }
+  for (const { child, prefix } of children) {
+    pipeWithPrefix(child.stdout, process.stdout, prefix);
+    pipeWithPrefix(child.stderr, process.stderr, prefix);
+  }
+  let shuttingDown = false;
+  const forwardSignal = (sig) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    info(`
+Received ${sig}, stopping children\u2026`);
+    for (const { child } of children) {
+      if (child.exitCode === null && child.signalCode === null) {
+        child.kill(sig);
+      }
+    }
+  };
+  process.on("SIGINT", () => forwardSignal("SIGINT"));
+  process.on("SIGTERM", () => forwardSignal("SIGTERM"));
+  const results = await Promise.all(
+    children.map(
+      ({ name, child }) => new Promise(
+        (resolveExit) => {
+          child.on("exit", (exitCode2, signal) => {
+            const killed = signal !== null;
+            const finalCode = exitCode2 ?? (killed ? 0 : 1);
+            resolveExit({ name, code: finalCode, killed });
+          });
+        }
+      )
+    )
+  );
+  const crashed = results.find((r) => !r.killed && r.code !== 0);
+  if (crashed && !shuttingDown) {
+    warn(`[${crashed.name}] exited with code ${crashed.code} \u2014 stopping others.`);
+    for (const { child } of children) {
+      if (child.exitCode === null && child.signalCode === null) {
+        child.kill("SIGTERM");
+      }
+    }
+  }
+  const exitCode = Math.max(0, ...results.map((r) => r.code));
+  if (exitCode === 0) {
+    success("Dev loop stopped cleanly.");
+  }
+  return exitCode;
+}
+function spawnSdkWatcher(projectRoot, env) {
+  const child = spawn(
+    process.execPath,
+    [process.argv[1], "module", "dev", "--dir", projectRoot],
+    {
+      cwd: projectRoot,
+      env,
+      stdio: ["ignore", "pipe", "pipe"]
+    }
+  );
+  return child;
+}
+function spawnNextDev(projectRoot, env, port) {
+  const portArgs = port !== void 0 ? ["--", "--port", String(port)] : [];
+  const hasDevNextScript = hasNpmScript(projectRoot, "dev:next");
+  const [cmd, args] = hasDevNextScript ? ["npm", ["run", "dev:next", ...portArgs]] : ["npx", ["next", "dev", ...port !== void 0 ? ["--port", String(port)] : []]];
+  const child = spawn(cmd, args, {
+    cwd: projectRoot,
+    env,
+    stdio: ["ignore", "pipe", "pipe"],
+    // Windows requires `shell: true` for `npm` / `npx` because they're
+    // `.cmd` shims, not real binaries.
+    shell: process.platform === "win32"
+  });
+  return child;
+}
+function hasNpmScript(projectRoot, scriptName) {
+  try {
+    const pkgPath = `${projectRoot}/package.json`;
+    if (!existsSync(pkgPath)) return false;
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    return typeof pkg.scripts?.[scriptName] === "string";
+  } catch {
+    return false;
+  }
+}
+function pipeWithPrefix(src, dst, prefix) {
+  if (!src) return;
+  let leftover = "";
+  src.on("data", (chunk) => {
+    const text3 = typeof chunk === "string" ? chunk : chunk.toString("utf-8");
+    const combined = leftover + text3;
+    const lines = combined.split("\n");
+    leftover = lines.pop() ?? "";
+    for (const line of lines) {
+      dst.write(`${prefix}${line}
+`);
+    }
+  });
+  src.on("end", () => {
+    if (leftover.length > 0) {
+      dst.write(`${prefix}${leftover}
+`);
+    }
+  });
+}
+function maskedToken(token) {
+  if (token.length <= 12) return "****";
+  const prefix = token.slice(0, 4);
+  const tail = token.slice(-4);
+  return `${prefix}\u2026${tail}`;
+}
+
+// src/lib/api-client.ts
+var ApiError = class extends Error {
+  status;
+  code;
+  context;
+  retriable;
+  constructor(status, envelope, fallbackMessage) {
+    const code2 = envelope?.code ?? codeFromStatus(status);
+    const message = envelope?.message ?? fallbackMessage;
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code2;
+    this.context = envelope?.context;
+    this.retriable = envelope?.retriable ?? status >= 500;
+  }
+};
+async function apiRequest(method, path, body, options = {}) {
+  const baseUrl = (options.baseUrl ?? resolveApiUrl()).replace(/\/+$/, "");
+  const url = `${baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
+  const headers = {
+    Accept: "application/json",
+    ...options.headers ?? {}
+  };
+  if (body !== void 0) {
+    headers["Content-Type"] = "application/json";
+  }
+  const authMode = options.auth ?? "auto";
+  if (authMode === "auto") {
+    const saved = readSavedToken();
+    if (saved) headers["Authorization"] = `Bearer ${saved}`;
+  } else if (typeof authMode === "object" && authMode.token) {
+    headers["Authorization"] = `Bearer ${authMode.token}`;
+  }
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+  } catch (err) {
+    throw new ApiError(0, { code: "NETWORK_ERROR", message: err.message }, "Network error");
+  }
+  if (res.status === 204) {
+    return void 0;
+  }
+  const contentType = res.headers.get("content-type") ?? "";
+  let parsed = null;
+  if (contentType.includes("application/json")) {
+    try {
+      parsed = await res.json();
+    } catch {
+      parsed = null;
+    }
+  } else if (res.status >= 400) {
+    try {
+      parsed = { message: await res.text() };
+    } catch {
+      parsed = null;
+    }
+  }
+  if (!res.ok) {
+    throw new ApiError(res.status, asEnvelope(parsed), `HTTP ${res.status}`);
+  }
+  return parsed;
+}
+function asEnvelope(v) {
+  if (!v || typeof v !== "object") return null;
+  const env = v;
+  const out2 = {};
+  if (typeof env.code === "string") out2.code = env.code;
+  if (typeof env.message === "string") out2.message = env.message;
+  if (typeof env.retriable === "boolean") out2.retriable = env.retriable;
+  if (env.context && typeof env.context === "object") {
+    out2.context = env.context;
+  }
+  return out2;
+}
+function codeFromStatus(status) {
+  if (status === 401) return "UNAUTHENTICATED";
+  if (status === 403) return "FORBIDDEN";
+  if (status === 404) return "NOT_FOUND";
+  if (status === 0) return "NETWORK_ERROR";
+  if (status >= 500) return "INTERNAL_ERROR";
+  return "HTTP_ERROR";
+}
+
+// src/commands/login.ts
+var DEFAULT_TOKEN_NAME = "dashwise-cli";
+async function loginCommand(options) {
+  const apiUrl = (options.apiUrl ?? resolveApiUrl()).replace(/\/+$/, "");
+  intro(`Logging into ${code(apiUrl)}`);
+  let dc;
+  try {
+    dc = await apiRequest(
+      "POST",
+      "/api/auth/cli/device-code",
+      {
+        name: options.name ?? DEFAULT_TOKEN_NAME
+      },
+      { auth: "public", baseUrl: apiUrl }
+    );
+  } catch (err) {
+    fail(formatApiError("Could not start login flow", err));
+    return 1;
+  }
+  log.message(
+    [
+      `Open the verification URL and confirm the code:`,
+      ``,
+      `  URL:  ${code(dc.verificationUriComplete)}`,
+      `  Code: ${code(dc.userCode)}`,
+      ``,
+      dim(
+        `Code expires in ${formatSeconds(dc.expiresIn)}. The CLI will keep polling until you approve.`
+      )
+    ].join("\n")
+  );
+  if (!options.noPrompt && process.stdout.isTTY) {
+    const choice = await select({
+      message: "Open the verification URL in your browser?",
+      options: [
+        { value: "open", label: "Open now" },
+        { value: "skip", label: "I\u2019ll open it manually" }
+      ],
+      initialValue: "open"
+    });
+    if (isCancel(choice)) {
+      cancel("Login cancelled.");
+      return 130;
+    }
+    if (choice === "open") {
+      try {
+        await open(dc.verificationUriComplete);
+      } catch (err) {
+        info(`Could not open browser automatically (${err.message}). Open the URL above manually.`);
+      }
+    }
+  }
+  const sp = spinner();
+  sp.start("Waiting for approval");
+  const overallDeadline = Date.now() + dc.expiresIn * 1e3;
+  let outcome = null;
+  const pollIntervalMs = Math.max(1e3, dc.interval * 1e3);
+  pollLoop: while (Date.now() < overallDeadline) {
+    let res;
+    try {
+      res = await apiRequest(
+        "POST",
+        "/api/auth/cli/poll",
+        { deviceCode: dc.deviceCode },
+        { auth: "public", baseUrl: apiUrl }
+      );
+    } catch (err) {
+      sp.stop(`Poll failed: ${err.message}`);
+      fail("Poll failed mid-flight; you can re-run `dashwise login` to retry.");
+      return 1;
+    }
+    switch (res.status) {
+      case "pending":
+      case "slow_down":
+        await sleep(pollIntervalMs);
+        continue pollLoop;
+      case "denied":
+        sp.stop("Login denied by user.");
+        cancel("Aborted.");
+        return 1;
+      case "expired":
+        sp.stop("Login code expired.");
+        fail("The code expired before approval. Run `dashwise login` again.");
+        return 1;
+      case "approved":
+        outcome = res;
+        break pollLoop;
+    }
+  }
+  if (!outcome) {
+    sp.stop("Timed out waiting for approval.");
+    fail("Login took too long to be approved. Run `dashwise login` again.");
+    return 1;
+  }
+  if (!outcome.token || !outcome.tokenId) {
+    sp.stop("Approval received but token missing from response.");
+    fail(
+      "Approval received but the backend did not return a token. Run `dashwise logout` then `dashwise login` to retry."
+    );
+    return 1;
+  }
+  let me;
+  try {
+    me = await apiRequest("GET", "/api/auth/me", void 0, {
+      auth: { token: outcome.token },
+      baseUrl: apiUrl
+    });
+  } catch (err) {
+    sp.stop("Approval accepted but profile fetch failed.");
+    fail(formatApiError("Could not load user profile", err));
+    return 1;
+  }
+  const cfg = {
+    apiUrl,
+    token: outcome.token,
+    tokenId: outcome.tokenId,
+    user: {
+      id: me.id,
+      email: me.email,
+      username: me.username,
+      firstName: me.first_name,
+      lastName: me.last_name
+    }
+  };
+  writeConfig(cfg);
+  sp.stop("Approved.");
+  success(`Logged in as ${code(me.email)}`);
+  outro("You can now run `dashwise profile`, `dashwise workspace list`, etc.");
+  return 0;
+}
+function sleep(ms) {
+  return new Promise((resolve11) => setTimeout(resolve11, ms));
+}
+function formatSeconds(seconds) {
+  if (seconds < 60) return `${seconds}s`;
+  const minutes = Math.round(seconds / 60);
+  return `${minutes}m`;
+}
+function formatApiError(prefix, err) {
+  if (err instanceof ApiError) {
+    return `${prefix}: ${err.message} (code: ${err.code}, status: ${err.status})`;
+  }
+  if (err instanceof Error) return `${prefix}: ${err.message}`;
+  return `${prefix}: ${String(err)}`;
+}
+
+// src/commands/logout.ts
+async function logoutCommand() {
+  let cfg;
+  try {
+    cfg = readConfig();
+  } catch {
+    deleteConfig();
+    success("Cleared a corrupted local credential file.");
+    return 0;
+  }
+  if (!cfg) {
+    info("Already logged out (no saved credentials).");
+    return 0;
+  }
+  try {
+    await apiRequest(
+      "DELETE",
+      `/api/auth/cli-tokens/${cfg.tokenId}`,
+      void 0,
+      { auth: { token: cfg.token }, baseUrl: cfg.apiUrl }
+    );
+  } catch (err) {
+    warn(
+      `Could not revoke the server-side token (${err.message}). Local credentials cleared anyway.`
+    );
+  }
+  deleteConfig();
+  success(`Logged out ${code(cfg.user.email)}`);
+  return 0;
+}
+
+// src/commands/profile.ts
+async function profileCommand(options = {}) {
+  const cfg = readConfig();
+  if (!cfg) {
+    if (options.json) {
+      out(JSON.stringify({ ok: false, error: { code: "NOT_LOGGED_IN", message: "Run `dashwise login` first." } }));
+    } else {
+      fail("Not logged in. Run `dashwise login` first.");
+    }
+    return 1;
+  }
+  let me = null;
+  let refreshError = null;
+  try {
+    me = await apiRequest("GET", "/api/auth/me");
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      if (options.json) {
+        out(JSON.stringify({ ok: false, error: { code: "TOKEN_INVALID", message: "Saved token is no longer valid." } }));
+      } else {
+        fail("Saved token is no longer valid. Run `dashwise login` again.");
+      }
+      return 1;
+    }
+    refreshError = err.message;
+    if (!options.json) {
+      warn(
+        `Could not refresh profile from the server (${refreshError}). Showing cached values.`
+      );
+    }
+  }
+  if (me) {
+    const refreshed = {
+      ...cfg,
+      user: {
+        id: me.id,
+        email: me.email,
+        username: me.username,
+        firstName: me.first_name,
+        lastName: me.last_name
+      }
+    };
+    writeConfig(refreshed);
+  }
+  const u = me ?? toMe(cfg.user);
+  let workspaces = [];
+  let workspaceError = null;
+  try {
+    const fetched = await apiRequest(
+      "GET",
+      "/api/workspaces"
+    );
+    workspaces = Array.isArray(fetched) ? fetched : [];
+  } catch (err) {
+    workspaceError = err.message;
+  }
+  if (options.json) {
+    out(
+      JSON.stringify({
+        ok: true,
+        user: {
+          id: u.id,
+          username: u.username,
+          email: u.email,
+          first_name: u.first_name,
+          last_name: u.last_name
+        },
+        default_workspace: cfg.workspaceSlug ?? null,
+        workspaces,
+        api_url: cfg.apiUrl,
+        ...refreshError ? { profile_refresh_error: refreshError } : {},
+        ...workspaceError ? { workspaces_error: workspaceError } : {}
+      })
+    );
+    return 0;
+  }
+  out("");
+  kv("User ID", `${u.id}`);
+  kv("Username", u.username);
+  kv("Email", u.email);
+  kv("Name", `${u.first_name} ${u.last_name}`.trim() || dim("(not set)"));
+  out("");
+  if (workspaceError) {
+    warn(
+      `Could not list workspaces (${workspaceError}). Try \`dashwise workspace list\`.`
+    );
+  } else if (workspaces.length === 0) {
+    info("No workspaces yet.");
+  } else {
+    kv("Workspaces", `${workspaces.length}`);
+    for (const w of workspaces) {
+      const slug = w.slug ?? `id:${w.id}`;
+      const role = w.role ?? w.permissions ?? "";
+      const star = cfg.workspaceSlug === slug ? code(" (default)") : "";
+      out(`  - ${slug}${role ? dim(` [${role}]`) : ""}${star}  ${dim(w.name)}`);
+    }
+  }
+  out("");
+  kv("API URL", cfg.apiUrl);
+  return 0;
+}
+function toMe(cached) {
+  return {
+    id: cached.id,
+    email: cached.email,
+    username: cached.username,
+    first_name: cached.firstName,
+    last_name: cached.lastName,
+    is_staff: false,
+    is_active: true,
+    date_joined: ""
+  };
+}
+
+// src/commands/workspace.ts
+async function workspaceListCommand(options = {}) {
+  const cfg = readConfig();
+  if (!cfg) {
+    if (options.json) {
+      out(JSON.stringify({ ok: false, error: { code: "NOT_LOGGED_IN", message: "Run `dashwise login` first." } }));
+    } else {
+      fail("Not logged in. Run `dashwise login` first.");
+    }
+    return 1;
+  }
+  let workspaces;
+  try {
+    workspaces = await apiRequest("GET", "/api/workspaces");
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      if (options.json) {
+        out(JSON.stringify({ ok: false, error: { code: "TOKEN_INVALID", message: "Saved token is no longer valid." } }));
+      } else {
+        fail("Saved token is no longer valid. Run `dashwise login` again.");
+      }
+      return 1;
+    }
+    if (options.json) {
+      out(JSON.stringify({ ok: false, error: { code: "FETCH_FAILED", message: err.message } }));
+    } else {
+      fail(`Could not list workspaces: ${err.message}`);
+    }
+    return 1;
+  }
+  if (options.json) {
+    out(
+      JSON.stringify({
+        ok: true,
+        default_workspace: cfg.workspaceSlug ?? null,
+        workspaces: Array.isArray(workspaces) ? workspaces : []
+      })
+    );
+    return 0;
+  }
+  if (!Array.isArray(workspaces) || workspaces.length === 0) {
+    info("No workspaces yet.");
+    return 0;
+  }
+  out("");
+  for (const w of workspaces) {
+    const slug = w.slug ?? `id:${w.id}`;
+    const role = w.role ?? w.permissions ?? "";
+    const isDefault = cfg.workspaceSlug === slug;
+    const marker = isDefault ? code(" *") : "  ";
+    out(`${marker} ${slug.padEnd(28)} ${dim(w.name)}${role ? dim(` [${role}]`) : ""}`);
+  }
+  out("");
+  if (cfg.workspaceSlug) {
+    info(`Default workspace: ${code(cfg.workspaceSlug)}`);
+  } else {
+    info("No default workspace set. Use `dashwise workspace use <slug>` to set one.");
+  }
+  return 0;
+}
+async function workspaceUseCommand(slug) {
+  const cfg = readConfig();
+  if (!cfg) {
+    fail("Not logged in. Run `dashwise login` first.");
+    return 1;
+  }
+  if (typeof slug !== "string" || slug.length === 0) {
+    fail("Usage: `dashwise workspace use <slug>`");
+    return 1;
+  }
+  let workspaces = [];
+  try {
+    workspaces = await apiRequest("GET", "/api/workspaces");
+  } catch (err) {
+    fail(`Could not validate the workspace (${err.message}).`);
+    return 1;
+  }
+  const match = workspaces.find(
+    (w) => w.slug === slug || `id:${w.id}` === slug || String(w.id) === slug
+  );
+  if (!match) {
+    fail(`Workspace ${code(slug)} not found in your accessible workspaces.`);
+    out("");
+    info("Run `dashwise workspace list` to see what you can choose.");
+    return 1;
+  }
+  const matchedSlug = match.slug ?? `id:${match.id}`;
+  writeConfig({ ...cfg, workspaceSlug: matchedSlug });
+  success(`Default workspace set to ${code(matchedSlug)}`);
+  kv("Name", match.name);
+  if (match.role ?? match.permissions) {
+    kv("Role", String(match.role ?? match.permissions));
+  }
+  return 0;
+}
+
+// src/lib/scaffold.ts
+function manifestJson(opts) {
+  const kind = opts.kind ?? "hand_authored";
+  const manifest = {
+    schema_version: 2,
+    module: {
+      slug: opts.slug,
+      name: opts.name,
+      version: "0.0.1"
+    },
+    module_kind: kind,
+    owns: {
+      tables: [
+        {
+          slug: "items",
+          fields: [{ slug: "title", type: "text", required: true }]
+        }
+      ]
+    }
+  };
+  if (kind === "custom") {
+    manifest.runtime = {
+      type: "nextjs",
+      kind: "machine",
+      machine_size: "shared-cpu-1x",
+      server_actions: true
+    };
+  }
+  if (opts.repositoryUrl) {
+    manifest.repository = { type: "git", url: opts.repositoryUrl };
+  }
+  return JSON.stringify(manifest, null, 2) + "\n";
+}
+function packageJson(opts) {
+  return JSON.stringify(
+    {
+      name: opts.slug,
+      version: "0.0.1",
+      private: true,
+      type: "module",
+      scripts: {
+        dev: "dashwise module dev",
+        "dev:next": "next dev --port 3000",
+        "dashwise:generate": "dashwise module generate",
+        build: "next build",
+        start: "next start"
+      },
+      dependencies: {
+        "@dashai/sdk": "^0.2.0",
+        next: "^15.0.0",
+        react: "^19.0.0",
+        "react-dom": "^19.0.0"
+      },
+      devDependencies: {
+        "@types/node": "^22.0.0",
+        "@types/react": "^19.0.0",
+        "@types/react-dom": "^19.0.0",
+        typescript: "^5.5.0"
+      }
+    },
+    null,
+    2
+  ) + "\n";
+}
+function tsconfigJson() {
+  return JSON.stringify(
+    {
+      compilerOptions: {
+        target: "ES2022",
+        lib: ["dom", "dom.iterable", "ES2022"],
+        module: "ESNext",
+        moduleResolution: "Bundler",
+        jsx: "preserve",
+        strict: true,
+        skipLibCheck: true,
+        resolveJsonModule: true,
+        esModuleInterop: true,
+        isolatedModules: true,
+        allowJs: false,
+        noEmit: true,
+        incremental: true,
+        plugins: [{ name: "next" }],
+        paths: { "@/*": ["./*"] }
+      },
+      include: ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+      exclude: ["node_modules"]
+    },
+    null,
+    2
+  ) + "\n";
+}
+function nextConfig() {
+  return `/** @type {import("next").NextConfig} */
+const nextConfig = {
+  typescript: { ignoreBuildErrors: true },
+  eslint: { ignoreDuringBuilds: true },
+};
+export default nextConfig;
+`;
+}
+function nextEnvDts() {
+  return `/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+`;
+}
+function gitignore() {
+  return [
+    "# Dependencies",
+    "/node_modules",
+    "",
+    "# Generated by Next.js",
+    "/.next",
+    "/out",
+    "",
+    "# Production",
+    "/build",
+    "",
+    "# Misc",
+    ".DS_Store",
+    "*.log",
+    "",
+    "# Env",
+    ".env",
+    ".env.local",
+    ".env.*.local",
+    "",
+    "# Editor",
+    ".vscode/",
+    ".idea/",
+    "",
+    "# DashWise-generated SDK output is regenerable from module.json",
+    "# (run `dashwise module generate`); keep it out of source control.",
+    "/node_modules/@dashai/generated/",
+    ""
+  ].join("\n");
+}
+function envLocalExample() {
+  return [
+    "# Copy to .env.local + fill in real values.",
+    "# These vars are auto-injected by `dashwise dev` (the unified dev loop)",
+    "# from ~/.config/dashwise/auth.json \u2014 you only need to edit this file if",
+    "# you want to point at a non-default backend or run `next dev` standalone.",
+    "DASHWISE_API_URL=http://localhost:3000",
+    "DASHWISE_API_TOKEN=",
+    "DASHWISE_INSTALLATION_ID=local",
+    ""
+  ].join("\n");
+}
+function appLayoutTsx(opts) {
+  return `export const metadata = {
+  title: ${JSON.stringify(opts.name)},
+  description: ${JSON.stringify(`DashWise module: ${opts.slug}`)},
+};
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en">
+      <body style={{ margin: 0, fontFamily: 'system-ui, sans-serif' }}>{children}</body>
+    </html>
+  );
+}
+`;
+}
+function appPageTsx(opts) {
+  return `export default function Page() {
+  return (
+    <main style={{ minHeight: '100dvh', display: 'grid', placeItems: 'center', padding: 32 }}>
+      <div style={{ maxWidth: 560, textAlign: 'center' }}>
+        <h1 style={{ fontSize: 28, marginBottom: 8 }}>${escapeHtml(opts.name)}</h1>
+        <p style={{ color: '#475569' }}>
+          Module slug: <code>${escapeHtml(opts.slug)}</code>
+        </p>
+        <p style={{ marginTop: 24, color: '#64748b', fontSize: 14 }}>
+          Run <code>dashwise module dev</code> to start the watch loop.
+          <br />
+          Edit <code>module.json</code> to add tables; regenerated types
+          land in <code>@dashai/generated</code>.
+        </p>
+      </div>
+    </main>
+  );
+}
+`;
+}
+function readme(opts) {
+  const kind = opts.kind ?? "hand_authored";
+  if (kind === "custom") {
+    return readmeCustom(opts);
+  }
+  return readmeHandAuthored(opts);
+}
+function readmeHandAuthored(opts) {
+  return `# ${opts.name}
+
+A DashWise module (hand-authored). Slug: \`${opts.slug}\`.
+
+## Get started
+
+\`\`\`bash
+npm install
+dashwise dev                # one command: watcher + Next.js dev together,
+                            # auth env vars auto-injected from your CLI config
+\`\`\`
+
+If you'd rather run the two halves in separate terminals (e.g. to attach a
+debugger to Next), use the legacy two-terminal flow:
+
+\`\`\`bash
+dashwise module generate    # produces node_modules/@dashai/generated/
+dashwise module dev         # watch module.json + auto-regenerate
+npm run dev:next            # plain Next.js dev server (in another terminal)
+\`\`\`
+
+## Project layout
+
+| Path | What |
+| --- | --- |
+| \`module.json\` | Manifest. Declares tables, dependencies, runtime config. |
+| \`app/\` | Next.js App Router. Edit freely. |
+| \`node_modules/@dashai/generated/\` | Auto-generated typed wrappers. **Do not edit by hand** \u2014 regenerated by \`dashwise module generate\`. |
+
+## Imports
+
+\`\`\`ts
+import { db } from '@dashai/generated';
+import type { ItemsRow } from '@dashai/generated';
+
+// runtime types + errors
+import { createClient, type Where } from '@dashai/sdk';
+\`\`\`
+`;
+}
+function readmeCustom(opts) {
+  return `# ${opts.name}
+
+A **custom DashWise module** \u2014 a full Next.js App Router app that
+runs in a per-installation Fly Machine (P7 substrate). Authenticated
+via the DashWise NestJS backend through \`@dashai/sdk/auth\`.
+
+Slug: \`${opts.slug}\`.
+
+## Get started
+
+\`\`\`bash
+npm install
+dashwise dev                # one command: watcher + Next.js dev together,
+                            # auth env vars auto-injected from your CLI config
+\`\`\`
+
+If you'd rather run the two halves in separate terminals (e.g. to attach a
+debugger to Next), use the legacy two-terminal flow:
+
+\`\`\`bash
+dashwise module generate    # produces node_modules/@dashai/generated/
+dashwise module dev         # watch + regen on module.json save (terminal 1)
+npm run dev:next            # next dev on :3000                  (terminal 2)
+\`\`\`
+
+## Architecture
+
+- **\`module.json\`** \u2014 manifest (\`module_kind: 'custom'\`, \`runtime.kind: 'machine'\`).
+- **\`middleware.ts\`** \u2014 \`withAuth\` from \`@dashai/sdk/auth/middleware\`. Redirects unauthenticated requests through the DashWise SSO flow.
+- **\`app/layout.tsx\`** \u2014 wraps the tree in \`<AuthProvider>\` from \`@dashai/sdk/auth/client\`.
+- **\`app/page.tsx\`** \u2014 public landing (allowlisted in \`middleware.ts\`).
+- **\`app/dashboard/page.tsx\`** \u2014 Server Component requiring a valid session via \`getServerSession()\`.
+- **\`app/api/auth/callback/route.ts\`** \u2014 exchanges the SSO one-time code for a session cookie (uses \`exchangeCode()\` from the SDK).
+- **\`app/api/auth/sign-in/route.ts\`** \u2014 entry point that redirects to the backend's \`/sso/start\` with the right \`return_to\` + \`client_id\`.
+- **\`app/api/auth/sign-out/route.ts\`** \u2014 clears the session cookie + tells the backend to revoke.
+
+## Imports
+
+\`\`\`ts
+// Data:
+import { db } from '@dashai/generated';
+
+// Auth (server, e.g. inside a Server Component or route handler):
+import { getServerSession, exchangeCode, signOut } from '@dashai/sdk/auth/server';
+
+// Auth (client, inside a Client Component):
+'use client';
+import { useSession, SignOutButton, AuthProvider } from '@dashai/sdk/auth/client';
+
+// Runtime types + errors:
+import { type Where, RowNotFoundError } from '@dashai/sdk';
+\`\`\`
+
+## Publish
+
+\`\`\`bash
+dashwise module validate          # local lint
+dashwise module publish --bump patch
+\`\`\`
+
+## Adding UI blocks
+
+The scaffold pre-installs two shadcn/ui primitives (\`Button\`, \`Card\`) plus the
+canonical Tailwind 4 + theme-tokens setup. To add more components:
+
+\`\`\`bash
+# shadcn/ui base (free):
+npx shadcn@latest add input badge dialog dropdown-menu
+
+# shadcn-studio blocks (free at https://shadcnstudio.com):
+npx shadcn@latest add @shadcn-studio/hero-section-01
+
+# shadcn-studio Pro blocks (requires $EMAIL + $LICENSE_KEY env vars):
+npx shadcn@latest add @ss-components/dashboard-shell-01
+\`\`\`
+
+If you're using Claude Code or another IDE that supports the shadcn-studio MCP,
+trigger \`/cui\` (create new UI) or \`/rui\` (refine existing UI) to walk through
+the canonical block-discovery flow.
+
+## Deploying elsewhere (custom domain)
+
+The scaffolded SSO flow is wired for DashWise's own infrastructure
+(\`m-<id>.dashwise.net\`). If you want to host this module on your own
+domain (e.g. \`mymodule.example.com\`), there are two options:
+
+1. **Wait for custom-domain support (in design).** A future \`--callback-origin\`
+   flag on \`dashwise module init\` plus a \`module_oauth_clients\` allowlist will
+   let modules run at arbitrary domains while still using DashWise SSO. Tracked
+   in [\`modules-author-experience-v1.md\`](https://github.com/sharmaintuize/dashwise-devops-docs/blob/main/plans/modules-author-experience-v1.md) \xA73.
+2. **Bypass SSO + use a Workspace API Token today.** Replace the SSO middleware
+   with a token-check middleware that reads \`Authorization: Token <key>\` from
+   each request. Tokens are created at \`<dashwise-dashboard>/settings/tokens\`
+   and scoped to a workspace. The SDK accepts these via the standard
+   \`DASHWISE_API_TOKEN\` env var. You'll lose the per-user session model
+   (every request runs as the token's owner) but gain the freedom to deploy
+   anywhere.
+
+The CLI's \`dashwise dev\` command auto-injects the developer's CLI token (also
+a bearer token) into local dev \u2014 so local development works regardless of
+which path you pick for production.
+`;
+}
+function middlewareTs() {
+  return `// Next.js middleware \u2014 gates every route on the DashWise session cookie.
+// Public routes (and /api/auth/*) bypass the redirect; everything else
+// 302s through the SSO flow when no \`dashwise.session\` cookie is set.
+import { withAuth } from '@dashai/sdk/auth/middleware';
+
+export default withAuth({
+  // \`/sign-in-error\` is public so unauthenticated visitors can actually
+  // see the polished SSO error page \u2014 otherwise a sign-in failure would
+  // redirect-loop trying to re-authenticate.
+  publicPaths: ['/', '/about', '/sign-in-error'],
+  loginPath: '/api/auth/sign-in',
+});
+
+export const config = {
+  matcher: ['/((?!_next/static|_next/image|favicon.ico|public/).*)'],
+};
+`;
+}
+function appLayoutCustomTsx(opts) {
+  return `import './globals.css';
+import { AuthProvider } from '@dashai/sdk/auth/client';
+import { ThemeProvider } from '@/components/theme-provider';
+
+export const metadata = {
+  title: ${JSON.stringify(opts.name)},
+  description: ${JSON.stringify(`DashWise custom module: ${opts.slug}`)},
+};
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en" suppressHydrationWarning>
+      <body className="antialiased">
+        <ThemeProvider
+          attribute="class"
+          defaultTheme="system"
+          enableSystem
+          disableTransitionOnChange
+        >
+          <AuthProvider>{children}</AuthProvider>
+        </ThemeProvider>
+      </body>
+    </html>
+  );
+}
+`;
+}
+function appPageCustomTsx(opts) {
+  return `// Public landing page \u2014 listed in middleware.ts publicPaths.
+//
+// First-run experience for unauthenticated visitors: hero with the
+// module name + tagline, a "Sign in with DashWise" button that kicks
+// off the SSO flow (via /api/auth/sign-in), and a feature card
+// describing what the module does. After signing in, the user lands
+// on /dashboard (Server Component, session-validated).
+//
+// Styling: shadcn/ui primitives (\`<Button>\`, \`<Card>\`) on Tailwind 4
+// theme tokens. Add more blocks via \`npx shadcn add @shadcn-studio/...\`
+// (see README's "Adding UI blocks" section).
+import Link from 'next/link';
+import { LogIn, LayoutDashboard } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from '@/components/ui/card';
+
+export default function Page() {
+  return (
+    <main className="flex min-h-dvh flex-col items-center justify-center gap-12 px-6 py-16">
+      <section className="flex max-w-2xl flex-col items-center gap-6 text-center">
+        <h1 className="text-balance text-4xl font-semibold tracking-tight sm:text-5xl">
+          ${escapeHtml(opts.name)}
+        </h1>
+        <p className="text-balance text-lg text-muted-foreground">
+          A DashWise module. Sign in with your DashWise account to access the
+          dashboard and start using the workspace's data through the typed SDK.
+        </p>
+        <div className="flex flex-wrap items-center justify-center gap-3">
+          <Button asChild size="lg">
+            <Link href="/api/auth/sign-in?return_to=/dashboard">
+              <LogIn aria-hidden="true" />
+              Sign in with DashWise
+            </Link>
+          </Button>
+          <Button asChild variant="ghost" size="lg">
+            <Link href="/dashboard">
+              <LayoutDashboard aria-hidden="true" />
+              Go to dashboard
+            </Link>
+          </Button>
+        </div>
+      </section>
+
+      <Card className="w-full max-w-2xl">
+        <CardHeader>
+          <CardTitle>What you can do here</CardTitle>
+          <CardDescription>
+            This is a custom DashWise module \u2014 a full Next.js app authenticated
+            against the DashWise SSO. Edit \`app/page.tsx\` to replace this
+            landing page; everything else is yours to customize.
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="text-sm text-muted-foreground">
+          <ul className="space-y-2">
+            <li>
+              Edit <code className="rounded bg-muted px-1.5 py-0.5">module.json</code>
+              {' '}to declare tables, dependencies, and runtime config.
+            </li>
+            <li>
+              Run <code className="rounded bg-muted px-1.5 py-0.5">dashwise dev</code>
+              {' '}for a one-command local loop with auth env vars auto-injected.
+            </li>
+            <li>
+              Import typed table clients from{' '}
+              <code className="rounded bg-muted px-1.5 py-0.5">@dashai/generated</code>
+              {' '}\u2014 the SDK regenerates on every manifest save.
+            </li>
+          </ul>
+        </CardContent>
+      </Card>
+    </main>
+  );
+}
+`;
+}
+function appDashboardPageTsx() {
+  return `import { getServerSession } from '@dashai/sdk/auth/server';
+import { redirect } from 'next/navigation';
+import { LogOut, ShieldCheck } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from '@/components/ui/card';
+
+/**
+ * Auth-gated Server Component. The middleware ensures the user has
+ * a session cookie before this page renders; \`getServerSession()\`
+ * validates the cookie against the backend's \`/api/auth/sessions/me\`
+ * endpoint, returning the decoded \`Session\` (or \`null\` if stale).
+ *
+ * On a successful render, this is the polished session card \u2014 replace
+ * the contents with whatever your module actually needs to show.
+ */
+export default async function Dashboard() {
+  const session = await getServerSession();
+  if (!session) {
+    redirect('/api/auth/sign-in?return_to=/dashboard');
+  }
+  return (
+    <main className="mx-auto flex min-h-dvh max-w-3xl flex-col gap-6 px-6 py-12">
+      <header className="flex items-start justify-between gap-4">
+        <div>
+          <h1 className="text-2xl font-semibold tracking-tight">Dashboard</h1>
+          <p className="text-sm text-muted-foreground">
+            You're signed in. This page is rendered as a Server Component and
+            validates the session cookie on every request.
+          </p>
+        </div>
+        <form action="/api/auth/sign-out" method="POST">
+          <Button variant="outline" size="sm" type="submit">
+            <LogOut aria-hidden="true" />
+            Sign out
+          </Button>
+        </form>
+      </header>
+
+      <Card>
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <ShieldCheck className="size-5 text-primary" aria-hidden="true" />
+            Session
+          </CardTitle>
+          <CardDescription>
+            Decoded from the \`dashwise.session\` cookie via{' '}
+            <code className="rounded bg-muted px-1.5 py-0.5">getServerSession()</code>.
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-3 text-sm">
+          <Row label="Email" value={session.user.email} />
+          <Row label="User ID" value={String(session.user.id)} />
+          <Row label="Workspace" value={String(session.workspaceId)} />
+          <Row label="Role" value={session.role} />
+          {session.installationId !== undefined && (
+            <Row
+              label="Installation"
+              value={
+                session.moduleSlug
+                  ? \`\${session.installationId} (\${session.moduleSlug})\`
+                  : String(session.installationId)
+              }
+            />
+          )}
+        </CardContent>
+      </Card>
+
+      <Card>
+        <CardHeader>
+          <CardTitle>Next steps</CardTitle>
+          <CardDescription>
+            Replace this dashboard with your module's actual UI.
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-2 text-sm text-muted-foreground">
+          <p>
+            <strong className="text-foreground">1.</strong> Edit{' '}
+            <code className="rounded bg-muted px-1.5 py-0.5">module.json</code>{' '}
+            to add tables, dependencies, and exposed actions.
+          </p>
+          <p>
+            <strong className="text-foreground">2.</strong> Import typed clients
+            from{' '}
+            <code className="rounded bg-muted px-1.5 py-0.5">@dashai/generated</code>{' '}
+            (regenerated on every manifest save).
+          </p>
+          <p>
+            <strong className="text-foreground">3.</strong> Run{' '}
+            <code className="rounded bg-muted px-1.5 py-0.5">dashwise module publish --bump patch</code>{' '}
+            when you're ready to ship.
+          </p>
+        </CardContent>
+      </Card>
+    </main>
+  );
+}
+
+function Row({ label, value }: { label: string; value: string }) {
+  return (
+    <div className="flex items-baseline justify-between gap-4 border-b border-border/50 pb-2 last:border-0 last:pb-0">
+      <span className="text-muted-foreground">{label}</span>
+      <span className="font-mono text-sm">{value}</span>
+    </div>
+  );
+}
+`;
+}
+function appApiAuthSignInTs() {
+  return `// /api/auth/sign-in \u2014 kick off the SSO flow.
+//
+// Reads \`?return_to=\` from the caller (defaults to '/'), looks up
+// the module's installation id from env, redirects the browser to
+// the DashWise backend's \`/api/auth/sso/start\`. The backend mints
+// an exchange code + 302s back to \`/api/auth/callback?code=...\`
+// where we set the session cookie.
+import { NextResponse } from 'next/server';
+
+export function GET(request: Request) {
+  const url = new URL(request.url);
+  const returnTo = url.searchParams.get('return_to') ?? '/';
+  const apiBaseUrl = process.env.DASHWISE_API_URL;
+  const installationId = process.env.DASHWISE_INSTALLATION_ID;
+  if (!apiBaseUrl || !installationId) {
+    return new NextResponse(
+      'DASHWISE_API_URL and DASHWISE_INSTALLATION_ID must be set in .env.local',
+      { status: 500 },
+    );
+  }
+  // Absolute URL for return_to so the backend knows which host to
+  // bounce back to (the callback path is fixed at /api/auth/callback
+  // by SDK convention).
+  const moduleOrigin = url.origin;
+  const ssoStart = new URL('/api/auth/sso/start', apiBaseUrl);
+  ssoStart.searchParams.set('return_to', \`\${moduleOrigin}\${returnTo}\`);
+  ssoStart.searchParams.set('client_id', installationId);
+  return NextResponse.redirect(ssoStart);
+}
+`;
+}
+function appApiAuthCallbackTs() {
+  return `// /api/auth/callback \u2014 receives \`?code=&return_to=\` from the
+// DashWise SSO start endpoint OR \`?error=&error_description=\` if the
+// SSO flow failed. Two paths:
+//
+//   1. Success path: exchange \`?code\` for a session cookie via
+//      \`exchangeCode()\`, then redirect to \`return_to\`.
+//   2. Error path: SSO returned \`?error=\` \u2014 redirect to the polished
+//      sign-in-error page so the user sees a real error UI instead of
+//      a raw 4xx page. The error code maps to known SSO error codes
+//      (e.g. \`access_denied\`, \`server_error\`, \`invalid_request\`).
+import { NextResponse } from 'next/server';
+import { exchangeCode } from '@dashai/sdk/auth/server';
+
+export async function GET(request: Request) {
+  const url = new URL(request.url);
+  const error = url.searchParams.get('error');
+  if (error) {
+    const target = new URL('/sign-in-error', url.origin);
+    target.searchParams.set('code', error);
+    const description = url.searchParams.get('error_description');
+    if (description) target.searchParams.set('description', description);
+    return NextResponse.redirect(target);
+  }
+  const code = url.searchParams.get('code');
+  const returnTo = url.searchParams.get('return_to') ?? '/';
+  if (!code) {
+    const target = new URL('/sign-in-error', url.origin);
+    target.searchParams.set('code', 'missing_code');
+    return NextResponse.redirect(target);
+  }
+  try {
+    await exchangeCode(code); // sets the dashwise.session cookie
+  } catch (err) {
+    const target = new URL('/sign-in-error', url.origin);
+    target.searchParams.set('code', 'exchange_failed');
+    target.searchParams.set('description', (err as Error).message);
+    return NextResponse.redirect(target);
+  }
+  return NextResponse.redirect(new URL(returnTo, url.origin));
+}
+`;
+}
+function appApiAuthSignOutTs() {
+  return `// /api/auth/sign-out \u2014 best-effort backend revoke + cookie clear.
+import { NextResponse } from 'next/server';
+import { signOut } from '@dashai/sdk/auth/server';
+
+export async function POST() {
+  await signOut();
+  return new NextResponse(null, { status: 204 });
+}
+`;
+}
+function packageJsonCustom(opts) {
+  return JSON.stringify(
+    {
+      name: opts.slug,
+      version: "0.0.1",
+      private: true,
+      type: "module",
+      scripts: {
+        dev: "dashwise module dev",
+        "dev:next": "next dev --port 3000",
+        "dashwise:generate": "dashwise module generate",
+        build: "next build",
+        start: "next start"
+      },
+      dependencies: {
+        "@dashai/sdk": "^0.2.0",
+        next: "^15.0.0",
+        react: "^19.0.0",
+        "react-dom": "^19.0.0",
+        // Styling system — same shadcn + Tailwind 4 stack as the
+        // main DashWise frontend, so look-and-feel stays consistent
+        // and module authors can add more blocks via the
+        // shadcn-studio MCP (`npx shadcn add @shadcn-studio/...`).
+        tailwindcss: "^4",
+        "@tailwindcss/postcss": "^4",
+        "tw-animate-css": "^1.4.0",
+        shadcn: "^4.0.8",
+        "radix-ui": "^1.4.3",
+        "class-variance-authority": "^0.7.1",
+        clsx: "^2.1.1",
+        "tailwind-merge": "^3.5.0",
+        "lucide-react": "^0.577.0",
+        "next-themes": "^0.4.6"
+      },
+      devDependencies: {
+        "@types/node": "^22.0.0",
+        "@types/react": "^19.0.0",
+        "@types/react-dom": "^19.0.0",
+        typescript: "^5.5.0"
+      }
+    },
+    null,
+    2
+  ) + "\n";
+}
+function componentsJson() {
+  return JSON.stringify(
+    {
+      $schema: "https://ui.shadcn.com/schema.json",
+      style: "new-york",
+      rsc: true,
+      tsx: true,
+      tailwind: {
+        config: "",
+        css: "app/globals.css",
+        baseColor: "neutral",
+        cssVariables: true,
+        prefix: ""
+      },
+      iconLibrary: "lucide",
+      rtl: false,
+      aliases: {
+        components: "@/components",
+        utils: "@/lib/utils",
+        ui: "@/components/ui",
+        lib: "@/lib",
+        hooks: "@/hooks"
+      },
+      registries: {
+        "@shadcn-studio": "https://shadcnstudio.com/r/{name}.json",
+        "@ss-components": {
+          url: "https://shadcnstudio.com/r/components/{name}.json",
+          params: {
+            email: "${EMAIL}",
+            license_key: "${LICENSE_KEY}"
+          }
+        }
+      }
+    },
+    null,
+    2
+  ) + "\n";
+}
+function postcssConfigMjs() {
+  return `const config = {
+  plugins: {
+    "@tailwindcss/postcss": {},
+  },
+};
+
+export default config;
+`;
+}
+function globalsCss() {
+  return `@import "tailwindcss";
+@import "tw-animate-css";
+@import "shadcn/tailwind.css";
+
+@custom-variant dark (&:is(.dark *));
+
+:root {
+  --background: oklch(1 0 0);
+  --foreground: oklch(0.14 0 0);
+  --card: oklch(1 0 0);
+  --card-foreground: oklch(0.14 0 0);
+  --popover: oklch(1 0 0);
+  --popover-foreground: oklch(0.14 0 0);
+  --primary: oklch(0.2 0 0);
+  --primary-foreground: oklch(0.99 0 0);
+  --secondary: oklch(0.97 0 0);
+  --secondary-foreground: oklch(0.2 0 0);
+  --muted: oklch(0.97 0 0);
+  --muted-foreground: oklch(0.56 0 0);
+  --accent: oklch(0.97 0 0);
+  --accent-foreground: oklch(0.2 0 0);
+  --destructive: oklch(0.58 0.24 28.48);
+  --border: oklch(0.92 0 0);
+  --input: oklch(0.92 0 0);
+  --ring: oklch(0.71 0 0);
+  --radius: 0.625rem;
+
+  --font-sans:
+    ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont,
+    "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+  --font-mono:
+    ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas,
+    "Liberation Mono", "Courier New", monospace;
+}
+
+.dark {
+  --background: oklch(0.14 0 0);
+  --foreground: oklch(0.99 0 0);
+  --card: oklch(0.2 0 0);
+  --card-foreground: oklch(0.99 0 0);
+  --popover: oklch(0.2 0 0);
+  --popover-foreground: oklch(0.99 0 0);
+  --primary: oklch(0.92 0 0);
+  --primary-foreground: oklch(0.2 0 0);
+  --secondary: oklch(0.27 0 0);
+  --secondary-foreground: oklch(0.99 0 0);
+  --muted: oklch(0.27 0 0);
+  --muted-foreground: oklch(0.71 0 0);
+  --accent: oklch(0.27 0 0);
+  --accent-foreground: oklch(0.99 0 0);
+  --destructive: oklch(0.7 0.19 22.23);
+  --border: oklch(0.27 0 0);
+  --input: oklch(0.27 0 0);
+  --ring: oklch(0.56 0 0);
+}
+
+* {
+  border-color: var(--border);
+}
+
+body {
+  background-color: var(--background);
+  color: var(--foreground);
+  font-family: var(--font-sans);
+}
+`;
+}
+function libUtilsTs() {
+  return `import { clsx, type ClassValue } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs));
+}
+`;
+}
+function componentsUiButtonTsx() {
+  return `import * as React from "react";
+import { cva, type VariantProps } from "class-variance-authority";
+import { Slot } from "radix-ui";
+
+import { cn } from "@/lib/utils";
+
+const buttonVariants = cva(
+  "inline-flex shrink-0 items-center justify-center gap-2 rounded-md text-sm font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+  {
+    variants: {
+      variant: {
+        default: "bg-primary text-primary-foreground hover:bg-primary/90",
+        destructive:
+          "bg-destructive text-white hover:bg-destructive/90",
+        outline:
+          "border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground",
+        secondary:
+          "bg-secondary text-secondary-foreground hover:bg-secondary/80",
+        ghost:
+          "hover:bg-accent hover:text-accent-foreground",
+        link: "text-primary underline-offset-4 hover:underline",
+      },
+      size: {
+        default: "h-9 px-4 py-2 has-[>svg]:px-3",
+        sm: "h-8 gap-1.5 rounded-md px-3 has-[>svg]:px-2.5",
+        lg: "h-10 rounded-md px-6 has-[>svg]:px-4",
+        icon: "size-9",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  },
+);
+
+function Button({
+  className,
+  variant = "default",
+  size = "default",
+  asChild = false,
+  ...props
+}: React.ComponentProps<"button"> &
+  VariantProps<typeof buttonVariants> & {
+    asChild?: boolean;
+  }) {
+  const Comp = asChild ? Slot.Root : "button";
+  return (
+    <Comp
+      data-slot="button"
+      className={cn(buttonVariants({ variant, size, className }))}
+      {...props}
+    />
+  );
+}
+
+export { Button, buttonVariants };
+`;
+}
+function componentsUiCardTsx() {
+  return `import * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Card({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card"
+      className={cn(
+        "flex flex-col gap-6 rounded-xl border bg-card py-6 text-card-foreground shadow-sm",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function CardHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-header"
+      className={cn(
+        "@container/card-header grid auto-rows-min grid-rows-[auto_auto] items-start gap-2 px-6",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function CardTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-title"
+      className={cn("leading-none font-semibold", className)}
+      {...props}
+    />
+  );
+}
+
+function CardDescription({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-description"
+      className={cn("text-sm text-muted-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+function CardContent({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-content"
+      className={cn("px-6", className)}
+      {...props}
+    />
+  );
+}
+
+function CardFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-footer"
+      className={cn("flex items-center px-6", className)}
+      {...props}
+    />
+  );
+}
+
+export { Card, CardHeader, CardFooter, CardTitle, CardDescription, CardContent };
+`;
+}
+function componentsThemeProviderTsx() {
+  return `"use client";
+
+import { ThemeProvider as NextThemesProvider } from "next-themes";
+
+export function ThemeProvider({
+  children,
+  ...props
+}: React.ComponentProps<typeof NextThemesProvider>) {
+  return <NextThemesProvider {...props}>{children}</NextThemesProvider>;
+}
+`;
+}
+function appSignInErrorPageTsx() {
+  return `import Link from 'next/link';
+import { AlertTriangle, RefreshCw } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from '@/components/ui/card';
+
+const ERROR_MESSAGES: Record<string, string> = {
+  access_denied:
+    "You declined the sign-in request. To use this module, you'll need to authorize it on the DashWise sign-in page.",
+  server_error:
+    'The DashWise sign-in server returned an internal error. This is usually transient \u2014 try again in a moment.',
+  invalid_request:
+    'The sign-in request was malformed. This is almost always a configuration bug \u2014 check that DASHWISE_API_URL and DASHWISE_INSTALLATION_ID are set correctly.',
+  missing_code:
+    'The callback URL was missing the expected exchange code. This usually means the SSO flow was interrupted.',
+  exchange_failed:
+    "The exchange code couldn't be redeemed for a session. The code may have expired (they're single-use and short-lived) \u2014 try signing in again.",
+};
+
+interface SignInErrorPageProps {
+  searchParams: Promise<{ code?: string; description?: string }>;
+}
+
+export default async function SignInErrorPage({ searchParams }: SignInErrorPageProps) {
+  const params = await searchParams;
+  const errorCode = params.code ?? 'unknown';
+  const friendlyMessage = ERROR_MESSAGES[errorCode];
+  return (
+    <main className="flex min-h-dvh items-center justify-center px-6 py-12">
+      <Card className="w-full max-w-lg">
+        <CardHeader>
+          <div className="flex items-start gap-3">
+            <div className="rounded-full bg-destructive/10 p-2">
+              <AlertTriangle className="size-5 text-destructive" aria-hidden="true" />
+            </div>
+            <div className="flex-1">
+              <CardTitle>Sign-in failed</CardTitle>
+              <CardDescription>
+                The DashWise SSO flow couldn't complete.
+              </CardDescription>
+            </div>
+          </div>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <div className="space-y-1">
+            <div className="text-xs uppercase tracking-wide text-muted-foreground">
+              Error code
+            </div>
+            <code className="block rounded bg-muted px-2 py-1 text-sm">
+              {errorCode}
+            </code>
+          </div>
+          {friendlyMessage && (
+            <p className="text-sm text-muted-foreground">{friendlyMessage}</p>
+          )}
+          {params.description && (
+            <div className="space-y-1">
+              <div className="text-xs uppercase tracking-wide text-muted-foreground">
+                Detail
+              </div>
+              <p className="text-sm text-muted-foreground">{params.description}</p>
+            </div>
+          )}
+          <div className="flex flex-wrap gap-2 pt-2">
+            <Button asChild>
+              <Link href="/api/auth/sign-in?return_to=/dashboard">
+                <RefreshCw aria-hidden="true" />
+                Try again
+              </Link>
+            </Button>
+            <Button asChild variant="ghost">
+              <Link href="/">Back to landing</Link>
+            </Button>
+          </div>
+        </CardContent>
+      </Card>
+    </main>
+  );
+}
+`;
+}
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function isValidSlug(slug) {
+  return /^[a-z][a-z0-9_-]*$/.test(slug);
+}
+
+// src/commands/module/clone.ts
+async function moduleCloneCommand(slug, options) {
+  if (!slug) {
+    fail("Usage: `dashwise module clone <slug>`");
+    return 1;
+  }
+  let meta;
+  try {
+    meta = await apiRequest(
+      "GET",
+      `/api/modules/${encodeURIComponent(slug)}/source-tarball`
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      fail(`Module ${code(slug)} not found.`);
+      return 1;
+    }
+    if (err instanceof ApiError && err.status === 401) {
+      fail("Not logged in. Run `dashwise login` first.");
+      return 1;
+    }
+    if (err instanceof ApiError && err.status === 403) {
+      fail(`No access to module ${code(slug)}. You must be a member of its owner workspace.`);
+      return 1;
+    }
+    fail(`Could not fetch module metadata: ${err.message}`);
+    return 1;
+  }
+  const target = resolve(options.dir ?? slug);
+  if (existsSync(target)) {
+    const entries = readdirSync(target);
+    if (entries.length > 0 && !options.force) {
+      fail(
+        `Directory ${code(target)} is not empty. Pass ${code("--force")} to clone anyway.`
+      );
+      return 1;
+    }
+  }
+  const wantGit = !options.noGit && meta.repository_url !== null;
+  if (wantGit) {
+    return cloneViaGit(meta, target);
+  }
+  if (meta.repository_url !== null && options.noGit) {
+    info(`--no-git: skipping git clone for ${code(meta.repository_url)}; writing manifest-only scaffold.`);
+  } else {
+    info(`Module ${code(slug)} has no ${code("repository.url")}; writing manifest-only scaffold.`);
+  }
+  return cloneViaManifest(slug, meta, target);
+}
+function cloneViaGit(meta, target) {
+  const repoUrl = meta.repository_url;
+  info(`Cloning ${code(repoUrl)} into ${code(target)}...`);
+  const result = spawnSync("git", ["clone", repoUrl, target], {
+    stdio: "inherit"
+  });
+  if (result.error) {
+    fail(`Failed to invoke git: ${result.error.message}`);
+    return 1;
+  }
+  if (result.status !== 0) {
+    fail(`git clone exited with status ${result.status}.`);
+    return result.status ?? 1;
+  }
+  success(`Cloned ${code(meta.module_slug)} from ${code(repoUrl)}.`);
+  if (meta.current_version) {
+    info(`Current published version: ${code(`v${meta.current_version}`)}`);
+  }
+  return 0;
+}
+function cloneViaManifest(slug, meta, target) {
+  if (!meta.manifest) {
+    fail(
+      `Module ${code(slug)} has no published manifest yet (publish at least one version first).`
+    );
+    return 1;
+  }
+  mkdirSync(target, { recursive: true });
+  const manifestObj = meta.manifest;
+  const moduleKind = manifestObj.module_kind === "custom" ? "custom" : "hand_authored";
+  const pkgFn = moduleKind === "custom" ? packageJsonCustom : packageJson;
+  writeFileSync(
+    join(target, "module.json"),
+    JSON.stringify(manifestObj, null, 2) + "\n",
+    "utf-8"
+  );
+  writeFileSync(
+    join(target, "package.json"),
+    pkgFn({ slug: meta.module_slug, name: meta.module_name}),
+    "utf-8"
+  );
+  writeFileSync(join(target, ".gitignore"), gitignore(), "utf-8");
+  writeFileSync(
+    join(target, "README.md"),
+    readmeForClone(meta, moduleKind),
+    "utf-8"
+  );
+  success(`Wrote ${moduleKind} scaffold for ${code(meta.module_slug)} into ${code(target)}`);
+  info(`Next steps:`);
+  out("");
+  out(`  ${dim("1.")} ${code(`cd ${target}`)}`);
+  out(`  ${dim("2.")} ${code("npm install")}`);
+  out(`  ${dim("3.")} ${code("dashwise module generate")}`);
+  out(`  ${dim("4.")} Recreate your ${code("app/")} (manifest-only clone \u2014 no source code available).`);
+  out("");
+  if (meta.repository_url) {
+    warn(
+      `Module's manifest declared ${code(meta.repository_url)} as its repo; consider running ${code(`dashwise module clone ${slug}`)} without ${code("--no-git")} to get the full source.`
+    );
+  } else {
+    info(
+      `If you have access to the original source, consider running ${code(`dashwise module connect-git <repo-url>`)} so future clones use it.`
+    );
+  }
+  return 0;
+}
+function readmeForClone(meta, kind) {
+  return `# ${meta.module_name}
+
+Manifest-only clone of \`${meta.module_slug}\` (${kind}) at version \`${meta.current_version ?? "unpublished"}\`.
+
+The original source code wasn't available \u2014 this directory contains
+only the published \`module.json\` + a starter scaffold. Recreate
+\`app/\` based on the manifest.
+
+## Get started
+
+\`\`\`bash
+npm install
+dashwise module generate
+dashwise module dev
+\`\`\`
+`;
+}
+async function moduleConnectGitCommand(repoUrl, options) {
+  if (!repoUrl || typeof repoUrl !== "string") {
+    fail("Usage: `dashwise module connect-git <repo-url>`");
+    return 1;
+  }
+  if (!isPlausibleRepoUrl(repoUrl)) {
+    fail(`Repo URL ${code(repoUrl)} doesn't look like https:// or git@host:owner/repo.`);
+    return 1;
+  }
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const manifestPath2 = join(projectRoot, "module.json");
+  if (!existsSync(manifestPath2)) {
+    fail(
+      `No ${code("module.json")} found in ${code(projectRoot)}. Run \`dashwise module init\` first.`
+    );
+    return 1;
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath2, "utf-8"));
+  } catch (err) {
+    fail(`Could not parse ${code(manifestPath2)}: ${err.message}`);
+    return 1;
+  }
+  const existing = manifest.repository ?? {};
+  const next = {
+    ...existing,
+    type: "git",
+    url: repoUrl
+  };
+  if (options.branch) {
+    next.branch = options.branch;
+  } else if (typeof existing.branch === "string") {
+    next.branch = existing.branch;
+  }
+  manifest.repository = next;
+  writeFileSync(manifestPath2, JSON.stringify(manifest, null, 2) + "\n", "utf-8");
+  success(`Connected to ${code(repoUrl)}`);
+  if (next.branch) info(`Branch: ${code(String(next.branch))}`);
+  info(`Updated ${code("module.json")}.`);
+  return 0;
+}
+function isPlausibleRepoUrl(url) {
+  if (url.startsWith("https://") || url.startsWith("http://")) {
+    try {
+      new URL(url);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return /^git@[^:]+:[^/]+\/.+/.test(url);
+}
+function outputDir(projectRoot) {
+  return join(projectRoot, "node_modules", "@dashai", "generated");
+}
+async function moduleGenerateCommand(options) {
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const manifestPath2 = join(projectRoot, "module.json");
+  if (!existsSync(manifestPath2)) {
+    fail(
+      `No ${code("module.json")} found in ${code(projectRoot)}. Run \`dashwise module init <slug>\` first.`
+    );
+    return 1;
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath2, "utf-8"));
+  } catch (err) {
+    fail(`Could not parse ${code(manifestPath2)}: ${err.message}`);
+    return 1;
+  }
+  let res;
+  try {
+    res = await apiRequest(
+      "POST",
+      "/api/modules/draft/generate-sdk",
+      {
+        manifest,
+        generation: options.generation ?? 0
+      }
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      fail("Not logged in. Run `dashwise login` first.");
+      return 1;
+    }
+    if (err instanceof ApiError && err.status === 400) {
+      fail(`Manifest validation failed: ${err.message}`);
+      if (err.context) {
+        process.stderr.write(JSON.stringify(err.context, null, 2) + "\n");
+      }
+      return 1;
+    }
+    fail(`Could not generate SDK: ${err.message}`);
+    return 1;
+  }
+  if (options.dryRun) {
+    info(`Dry run: ${Object.keys(res.files).length} files`);
+    info(`Hash: ${code(res.contentHash)}`);
+    return 0;
+  }
+  const out2 = outputDir(projectRoot);
+  if (existsSync(out2)) {
+    rmSync(out2, { recursive: true, force: true });
+  }
+  mkdirSync(out2, { recursive: true });
+  for (const [relPath, content] of Object.entries(res.files)) {
+    const absPath = join(out2, relPath);
+    const parent = dirname(absPath);
+    if (!existsSync(parent)) {
+      mkdirSync(parent, { recursive: true });
+    }
+    writeFileSync(absPath, content, "utf-8");
+  }
+  success(
+    `Generated ${Object.keys(res.files).length} files into ${code("node_modules/@dashai/generated/")}`
+  );
+  info(`Hash: ${dim(res.contentHash)}`);
+  return 0;
+}
+
+// src/commands/module/dev.ts
+var DEFAULT_DEBOUNCE_MS = 250;
+async function moduleDevCommand(options) {
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const manifestPath2 = join(projectRoot, "module.json");
+  if (!existsSync(manifestPath2)) {
+    fail(`No ${code("module.json")} found in ${code(projectRoot)}.`);
+    info("Run `dashwise module init <slug>` to scaffold a new module.");
+    return 1;
+  }
+  info(`Watching ${code(manifestPath2)} \u2014 Ctrl-C to stop.`);
+  let generation = 0;
+  const initial = await moduleGenerateCommand({
+    ...options.dir !== void 0 ? { dir: options.dir } : {},
+    generation
+  });
+  if (initial !== 0) {
+    warn("Initial regen failed; watcher will retry on the next change.");
+  }
+  generation += 1;
+  const debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;
+  let timer = null;
+  let isRunning = false;
+  let pendingRegen = false;
+  async function doRegen() {
+    if (isRunning) {
+      pendingRegen = true;
+      return;
+    }
+    isRunning = true;
+    try {
+      const start = Date.now();
+      const exit = await moduleGenerateCommand({
+        ...options.dir !== void 0 ? { dir: options.dir } : {},
+        generation
+      });
+      const elapsedMs = Date.now() - start;
+      if (exit === 0) {
+        success(`Regen complete (${elapsedMs}ms, gen=${generation})`);
+      } else {
+        warn(`Regen failed (exit ${exit}, gen=${generation}) \u2014 will retry on next change.`);
+      }
+      generation += 1;
+    } finally {
+      isRunning = false;
+      if (pendingRegen) {
+        pendingRegen = false;
+        setImmediate(doRegen);
+      }
+    }
+  }
+  const watcher = watch(manifestPath2, (eventType) => {
+    if (eventType !== "change") return;
+    if (timer !== null) clearTimeout(timer);
+    timer = setTimeout(() => {
+      timer = null;
+      void doRegen();
+    }, debounceMs);
+  });
+  return new Promise((resolveExit) => {
+    const stop = (signal) => {
+      if (timer !== null) clearTimeout(timer);
+      watcher.close();
+      info(`Stopping watcher${signal === "shutdown" ? "" : ` (${signal})`}.`);
+      process.stdout.write(dim("Goodbye.\n"));
+      resolveExit(0);
+    };
+    process.once("SIGINT", () => stop("SIGINT"));
+    process.once("SIGTERM", () => stop("SIGTERM"));
+  });
+}
+async function moduleDiffCommand(options) {
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const manifestPath2 = join(projectRoot, "module.json");
+  if (!existsSync(manifestPath2)) {
+    if (options.json) {
+      out(JSON.stringify({ ok: false, error: { code: "NO_MANIFEST", message: `No module.json found in ${projectRoot}.` } }));
+    } else {
+      fail(
+        `No ${code("module.json")} found in ${code(projectRoot)}. Run \`dashwise module init <slug>\` first.`
+      );
+    }
+    return 1;
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath2, "utf-8"));
+  } catch (err) {
+    if (options.json) {
+      out(JSON.stringify({ ok: false, error: { code: "MANIFEST_PARSE_FAILED", message: err.message } }));
+    } else {
+      fail(`Could not parse ${code(manifestPath2)}: ${err.message}`);
+    }
+    return 1;
+  }
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    if (options.json) {
+      out(JSON.stringify({ ok: false, error: { code: "MANIFEST_MISSING_SLUG", message: "module.json is missing module.slug." } }));
+    } else {
+      fail(`${code("module.json")} is missing ${code("module.slug")}.`);
+    }
+    return 1;
+  }
+  let mod;
+  try {
+    mod = await apiRequest(
+      "GET",
+      `/api/modules/by-slug/${encodeURIComponent(slug)}`
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      if (options.json) {
+        out(JSON.stringify({ ok: false, error: { code: "MODULE_NOT_FOUND", message: `Module ${slug} not found on the backend.` } }));
+      } else {
+        fail(
+          `Module ${code(slug)} not found on the backend. Create + publish it first; diff has nothing to compare against until then.`
+        );
+      }
+      return 1;
+    }
+    if (err instanceof ApiError && err.status === 401) {
+      if (options.json) {
+        out(JSON.stringify({ ok: false, error: { code: "NOT_LOGGED_IN", message: "Run `dashwise login` first." } }));
+      } else {
+        fail("Not logged in. Run `dashwise login` first.");
+      }
+      return 1;
+    }
+    if (options.json) {
+      out(JSON.stringify({ ok: false, error: { code: "RESOLVE_FAILED", message: err.message } }));
+    } else {
+      fail(`Could not resolve module: ${err.message}`);
+    }
+    return 1;
+  }
+  let diff;
+  try {
+    diff = await apiRequest(
+      "POST",
+      `/api/modules/${mod.id}/draft/diff`,
+      { manifest }
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 400) {
+      if (options.json) {
+        out(JSON.stringify({ ok: false, error: { code: "VALIDATION_FAILED", message: err.message, context: err.context ?? null } }));
+      } else {
+        fail(`Manifest validation failed: ${err.message}`);
+        if (err.context) {
+          out(JSON.stringify(err.context, null, 2));
+        }
+      }
+      return 1;
+    }
+    if (options.json) {
+      out(JSON.stringify({ ok: false, error: { code: "FETCH_FAILED", message: err.message } }));
+    } else {
+      fail(`Could not compute diff: ${err.message}`);
+    }
+    return 1;
+  }
+  if (options.json) {
+    out(JSON.stringify({ ok: true, ...diff }));
+    return 0;
+  }
+  if (diff.unchanged) {
+    success(
+      `No changes vs ${code(diff.current_version ? `v${diff.current_version}` : "(unpublished)")} \u2014 manifest is in sync.`
+    );
+    return 0;
+  }
+  out("");
+  info(
+    diff.current_version ? `Diff vs ${code(`v${diff.current_version}`)}:` : "Diff vs " + code("(unpublished \u2014 first version)") + ":"
+  );
+  if (diff.meta_changes.length > 0) {
+    out("");
+    out(code("Meta:"));
+    for (const m of diff.meta_changes) {
+      out(`  ${m.field}: ${dim(JSON.stringify(m.before))} \u2192 ${JSON.stringify(m.after)}`);
+    }
+  }
+  if (diff.tables_added.length > 0) {
+    out("");
+    out(code(`Tables added (${diff.tables_added.length}):`));
+    for (const t of diff.tables_added) out(`  + ${t}`);
+  }
+  if (diff.tables_removed.length > 0) {
+    out("");
+    out(code(`Tables removed (${diff.tables_removed.length}):`));
+    for (const t of diff.tables_removed) out(`  - ${t}`);
+  }
+  if (diff.tables_changed.length > 0) {
+    out("");
+    out(code(`Tables changed (${diff.tables_changed.length}):`));
+    for (const t of diff.tables_changed) {
+      out(`  ${dim("\u2022")} ${code(t.table)}`);
+      for (const f of t.fields_added) {
+        out(`      + field ${f.slug} (${f.type})`);
+      }
+      for (const f of t.fields_removed) {
+        out(`      - field ${f.slug} (${f.type})`);
+      }
+      for (const f of t.fields_changed) {
+        const changeSummary = Object.entries(f.changes).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(" ");
+        out(`      ~ field ${f.field}: ${dim(changeSummary)}`);
+      }
+    }
+  }
+  if (diff.deps_added.length > 0) {
+    out("");
+    out(code(`Dependencies added (${diff.deps_added.length}):`));
+    for (const d of diff.deps_added) {
+      out(`  + ${d.module}@${d.version}`);
+    }
+  }
+  if (diff.deps_removed.length > 0) {
+    out("");
+    out(code(`Dependencies removed (${diff.deps_removed.length}):`));
+    for (const d of diff.deps_removed) {
+      out(`  - ${d.module}@${d.version}`);
+    }
+  }
+  out("");
+  info("Run `dashwise module publish --bump <patch|minor|major>` when ready.");
+  return 0;
+}
+async function moduleInitCommand(slugArg, options) {
+  intro("Scaffolding a new DashWise module");
+  let slug = slugArg;
+  if (!slug && process.stdout.isTTY) {
+    const answer = await text({
+      message: "Module slug?",
+      placeholder: "tasks",
+      validate: (v) => isValidSlug(v) ? void 0 : "Slug must match /^[a-z][a-z0-9_-]*$/"
+    });
+    if (isCancel(answer)) {
+      fail("Aborted.");
+      return 130;
+    }
+    slug = answer;
+  }
+  if (!slug) {
+    fail("Usage: `dashwise module init <slug>`");
+    return 1;
+  }
+  if (!isValidSlug(slug)) {
+    fail(`Invalid slug ${code(slug)} \u2014 must match /^[a-z][a-z0-9_-]*$/`);
+    return 1;
+  }
+  const name = options.name ?? humanizeSlug(slug);
+  const dir = resolve(options.dir ?? slug);
+  if (existsSync(dir)) {
+    const entries = readdirSync(dir);
+    if (entries.length > 0 && !options.force) {
+      fail(
+        `Directory ${code(dir)} is not empty. Pass ${code("--force")} to scaffold anyway (existing files will be overwritten).`
+      );
+      return 1;
+    }
+  }
+  if (options.simple && options.custom) {
+    fail(
+      `Cannot pass both ${code("--simple")} and ${code("--custom")} \u2014 they're mutually exclusive. ${code("--simple")} selects the legacy minimal scaffold; the default (no flag) is the full Next.js scaffold (formerly ${code("--custom")}).`
+    );
+    return 1;
+  }
+  const kind = options.simple ? "hand_authored" : "custom";
+  const scaffoldOpts = {
+    slug,
+    name,
+    kind,
+    ...options.git !== void 0 ? { repositoryUrl: options.git } : {}
+  };
+  const files = [
+    ["module.json", manifestJson(scaffoldOpts)],
+    ["tsconfig.json", tsconfigJson()],
+    ["next.config.mjs", nextConfig()],
+    ["next-env.d.ts", nextEnvDts()],
+    [".gitignore", gitignore()],
+    [".env.local.example", envLocalExample()],
+    ["README.md", readme(scaffoldOpts)]
+  ];
+  if (kind === "custom") {
+    files.push(
+      ["package.json", packageJsonCustom(scaffoldOpts)],
+      ["middleware.ts", middlewareTs()],
+      ["components.json", componentsJson()],
+      ["postcss.config.mjs", postcssConfigMjs()],
+      ["app/globals.css", globalsCss()],
+      ["lib/utils.ts", libUtilsTs()],
+      ["components/theme-provider.tsx", componentsThemeProviderTsx()],
+      ["components/ui/button.tsx", componentsUiButtonTsx()],
+      ["components/ui/card.tsx", componentsUiCardTsx()],
+      ["app/layout.tsx", appLayoutCustomTsx(scaffoldOpts)],
+      ["app/page.tsx", appPageCustomTsx(scaffoldOpts)],
+      ["app/dashboard/page.tsx", appDashboardPageTsx()],
+      ["app/sign-in-error/page.tsx", appSignInErrorPageTsx()],
+      ["app/api/auth/sign-in/route.ts", appApiAuthSignInTs()],
+      ["app/api/auth/callback/route.ts", appApiAuthCallbackTs()],
+      ["app/api/auth/sign-out/route.ts", appApiAuthSignOutTs()]
+    );
+  } else {
+    files.push(
+      ["package.json", packageJson(scaffoldOpts)],
+      ["app/layout.tsx", appLayoutTsx(scaffoldOpts)],
+      ["app/page.tsx", appPageTsx(scaffoldOpts)]
+    );
+  }
+  for (const [relPath, content] of files) {
+    const absPath = join(dir, relPath);
+    const parentDir = join(absPath, "..");
+    if (!existsSync(parentDir)) {
+      mkdirSync(parentDir, { recursive: true });
+    }
+    writeFileSync(absPath, content, "utf-8");
+  }
+  success(
+    `Scaffolded ${code(slug)} (${kind === "custom" ? "custom Next.js" : "simple module"}) in ${code(dir)}`
+  );
+  info(`Next steps:`);
+  process.stdout.write(`
+  ${dim("1.")} ${code(`cd ${dir}`)}
+  ${dim("2.")} ${code("npm install")}
+  ${dim("3.")} ${code("dashwise dev")}                 ${dim("# one command: watcher + next dev, auth auto-injected")}
+
+  ${dim("   (or, for the two-terminal flow:")}
+  ${dim("     dashwise module generate")}              ${dim("# materialize typed wrappers")}
+  ${dim("     dashwise module dev")}                   ${dim("# watch + auto-regenerate")}
+  ${dim("     npm run dev:next                        # next dev on :3000)")}
+
+`);
+  outro("Happy authoring.");
+  return 0;
+}
+function humanizeSlug(slug) {
+  const words = slug.replace(/[-_]/g, " ").split(/\s+/).filter(Boolean);
+  if (words.length === 0) return slug;
+  const first = words[0];
+  const cap = first.charAt(0).toUpperCase() + first.slice(1);
+  return [cap, ...words.slice(1)].join(" ");
+}
+
+// src/commands/module/list.ts
+async function moduleListCommand(options) {
+  const cfg = readConfig();
+  if (!cfg) {
+    if (options.json) {
+      out(JSON.stringify({ ok: false, error: { code: "NOT_LOGGED_IN", message: "Run `dashwise login` first." } }));
+    } else {
+      fail("Not logged in. Run `dashwise login` first.");
+    }
+    return 1;
+  }
+  let workspaceId;
+  const targetSlug = options.workspace ?? cfg.workspaceSlug;
+  if (targetSlug) {
+    try {
+      const workspaces = await apiRequest(
+        "GET",
+        "/api/workspaces"
+      );
+      const match = workspaces.find((w) => w.slug === targetSlug);
+      if (!match) {
+        if (options.json) {
+          out(JSON.stringify({ ok: false, error: { code: "WORKSPACE_NOT_FOUND", message: `Workspace ${targetSlug} not found.` } }));
+        } else {
+          fail(
+            `Workspace ${code(targetSlug)} not found in your accessible workspaces. Run \`dashwise workspace list\` to see the choices.`
+          );
+        }
+        return 1;
+      }
+      workspaceId = match.id;
+    } catch (err) {
+      if (options.json) {
+        out(JSON.stringify({ ok: false, error: { code: "FETCH_FAILED", message: err.message } }));
+      } else {
+        fail(`Could not load workspaces: ${err.message}`);
+      }
+      return 1;
+    }
+  }
+  const params = new URLSearchParams();
+  if (!options.all) params.set("owned_only", "true");
+  if (workspaceId !== void 0) params.set("workspaceId", String(workspaceId));
+  const path = `/api/modules${params.toString() ? `?${params.toString()}` : ""}`;
+  let modules;
+  try {
+    modules = await apiRequest("GET", path);
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      if (options.json) {
+        out(JSON.stringify({ ok: false, error: { code: "NOT_LOGGED_IN", message: "Run `dashwise login` first." } }));
+      } else {
+        fail("Not logged in. Run `dashwise login` first.");
+      }
+      return 1;
+    }
+    if (options.json) {
+      out(JSON.stringify({ ok: false, error: { code: "FETCH_FAILED", message: err.message } }));
+    } else {
+      fail(`Could not list modules: ${err.message}`);
+    }
+    return 1;
+  }
+  if (options.json) {
+    out(
+      JSON.stringify({
+        ok: true,
+        modules: Array.isArray(modules) ? modules : [],
+        total: Array.isArray(modules) ? modules.length : 0
+      })
+    );
+    return 0;
+  }
+  if (!Array.isArray(modules) || modules.length === 0) {
+    info(
+      options.all ? "No modules found." : "No modules owned by you yet. Use `dashwise module init <slug>` to scaffold one."
+    );
+    return 0;
+  }
+  const slugWidth = Math.max(...modules.map((m) => m.slug.length), 4);
+  const versionWidth = Math.max(
+    ...modules.map((m) => (m.current_version ?? "(draft)").length),
+    7
+  );
+  out("");
+  out(
+    `${"SLUG".padEnd(slugWidth)}  ${"VERSION".padEnd(versionWidth)}  NAME`
+  );
+  out(
+    `${"-".repeat(slugWidth)}  ${"-".repeat(versionWidth)}  ${"-".repeat(20)}`
+  );
+  for (const m of modules) {
+    const version = m.current_version ?? "(draft)";
+    const flags = [
+      m.verified ? code("\u2713") : "",
+      m.public ? dim("public") : ""
+    ].filter(Boolean).join(" ");
+    const flagsCol = flags ? `  ${flags}` : "";
+    out(`${m.slug.padEnd(slugWidth)}  ${version.padEnd(versionWidth)}  ${m.name}${flagsCol}`);
+  }
+  out("");
+  info(`${modules.length} module${modules.length === 1 ? "" : "s"}.`);
+  return 0;
+}
+var DEFAULT_EXCLUDE_PATTERNS = [
+  "node_modules",
+  ".next",
+  ".git",
+  ".turbo",
+  ".dashwise",
+  ".DS_Store",
+  ".env",
+  ".env.local",
+  ".env.development.local",
+  ".env.test.local",
+  ".env.production.local",
+  "coverage",
+  ".nyc_output",
+  ".vitest-cache",
+  ".idea",
+  ".vscode",
+  "dist",
+  "build"
+];
+var PER_FILE_BYTE_LIMIT = 10 * 1024 * 1024;
+var MAX_TARBALL_BYTES = 100 * 1024 * 1024;
+async function packTarball(opts) {
+  if (!existsSync(opts.cwd)) {
+    throw new Error(`packTarball: cwd not found at ${opts.cwd}`);
+  }
+  const excludeSet = /* @__PURE__ */ new Set([
+    ...DEFAULT_EXCLUDE_PATTERNS,
+    ...opts.extraExclude ?? []
+  ]);
+  const filesIncluded = [];
+  const warnings = [];
+  const candidates = walk(opts.cwd, excludeSet);
+  for (const abs of candidates) {
+    const rel = relative(opts.cwd, abs);
+    const size = statSync(abs).size;
+    if (size > PER_FILE_BYTE_LIMIT) {
+      warnings.push(
+        `${rel} skipped \u2014 ${formatBytes(size)} exceeds ${formatBytes(PER_FILE_BYTE_LIMIT)} per-file cap`
+      );
+      continue;
+    }
+    filesIncluded.push(rel);
+  }
+  if (filesIncluded.length === 0) {
+    throw new Error(
+      `packTarball: nothing to pack in ${opts.cwd} (after applying exclude list)`
+    );
+  }
+  filesIncluded.sort();
+  const chunks = [];
+  await new Promise((resolveDone, rejectDone) => {
+    const stream = tar.c(
+      {
+        gzip: true,
+        cwd: opts.cwd,
+        // Don't follow symlinks — bundle-local content only.
+        follow: false,
+        // Preserve the exact case of paths; the backend's per-file
+        // policy gate keys off these.
+        portable: true
+      },
+      filesIncluded
+    );
+    stream.on("data", (chunk) => chunks.push(chunk));
+    stream.on("error", rejectDone);
+    stream.on("end", resolveDone);
+  });
+  const bytes = Buffer.concat(chunks);
+  if (bytes.byteLength > MAX_TARBALL_BYTES) {
+    throw new Error(
+      `packTarball: tarball is ${formatBytes(bytes.byteLength)}, exceeds ${formatBytes(MAX_TARBALL_BYTES)} max`
+    );
+  }
+  return { bytes, filesIncluded, warnings };
+}
+function walk(root, excludeSet) {
+  const out2 = [];
+  const stack = [root];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    if (!dir) continue;
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (excludeSet.has(entry.name)) continue;
+      const abs = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        stack.push(abs);
+      } else if (entry.isFile()) {
+        out2.push(abs);
+      }
+    }
+  }
+  return out2;
+}
+function formatBytes(n) {
+  if (n < 1024) return `${n}B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)}KB`;
+  return `${(n / 1024 / 1024).toFixed(1)}MB`;
+}
+
+// src/commands/module/publish.ts
+var VALID_BUMP = /* @__PURE__ */ new Set(["patch", "minor", "major"]);
+async function modulePublishCommand(options) {
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const manifestPath2 = join(projectRoot, "module.json");
+  if (!existsSync(manifestPath2)) {
+    fail(
+      `No ${code("module.json")} found in ${code(projectRoot)}. Run \`dashwise module init <slug>\` first.`
+    );
+    return 1;
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath2, "utf-8"));
+  } catch (err) {
+    fail(`Could not parse ${code(manifestPath2)}: ${err.message}`);
+    return 1;
+  }
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    fail(`${code("module.json")} is missing ${code("module.slug")}. Cannot publish.`);
+    return 1;
+  }
+  if (!readConfig()) {
+    fail("Not logged in. Run `dashwise login` first.");
+    return 1;
+  }
+  let bump = options.bump;
+  if (!bump && process.stdout.isTTY) {
+    intro(`Publishing module ${code(slug)}`);
+    const answer = await select({
+      message: "Bump direction?",
+      options: [
+        { value: "patch", label: "patch \u2014 bug fixes only (recommended for first publish)" },
+        { value: "minor", label: "minor \u2014 additive changes (new fields, new tables)" },
+        { value: "major", label: "major \u2014 breaking changes" }
+      ],
+      initialValue: "patch"
+    });
+    if (isCancel(answer)) {
+      fail("Aborted.");
+      return 130;
+    }
+    bump = answer;
+  }
+  if (!bump || !VALID_BUMP.has(bump)) {
+    fail("Bump direction required: `--bump patch|minor|major`.");
+    return 1;
+  }
+  let mod;
+  try {
+    mod = await apiRequest(
+      "GET",
+      `/api/modules/by-slug/${encodeURIComponent(slug)}`
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      fail(
+        `Module ${code(slug)} not found on the backend. Create it via the UI / API first, then re-run publish.`
+      );
+      return 1;
+    }
+    if (err instanceof ApiError && err.status === 401) {
+      fail("Not logged in. Run `dashwise login` first.");
+      return 1;
+    }
+    fail(`Could not resolve module: ${err.message}`);
+    return 1;
+  }
+  info(
+    `Module: ${code(mod.slug)} (id ${mod.id})${mod.current_version ? `, current ${code(`v${mod.current_version}`)}` : dim(", no published version yet")}`
+  );
+  let tarball;
+  try {
+    tarball = await packTarball({
+      cwd: projectRoot,
+      ...options.exclude !== void 0 ? { extraExclude: options.exclude } : {}
+    });
+  } catch (err) {
+    fail(`Could not pack tarball: ${err.message}`);
+    return 1;
+  }
+  info(
+    `Packed ${tarball.filesIncluded.length} file${tarball.filesIncluded.length === 1 ? "" : "s"} into ${formatBytes2(tarball.bytes.byteLength)} (cap ${formatBytes2(MAX_TARBALL_BYTES)}).`
+  );
+  for (const w of tarball.warnings) warn(w);
+  if (!options.yes && process.stdout.isTTY && !options.dryRun) {
+    const answer = await select({
+      message: `Upload + publish ${code(`bump:${bump}`)}?`,
+      options: [
+        { value: "go", label: "Yes, upload now" },
+        { value: "cancel", label: "No, abort" }
+      ],
+      initialValue: "go"
+    });
+    if (isCancel(answer) || answer === "cancel") {
+      fail("Aborted.");
+      return 130;
+    }
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    fail("Session vanished mid-publish \u2014 re-run `dashwise login`.");
+    return 1;
+  }
+  const url = `${resolveApiUrl()}/api/modules/${mod.id}/publish/cli`;
+  const form = new FormData();
+  const blob = new Blob([new Uint8Array(tarball.bytes)], { type: "application/gzip" });
+  form.set("file", blob, "module.tar.gz");
+  form.set("bump", bump);
+  if (options.dryRun) form.set("dry_run", "true");
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${cfg.token}`
+      },
+      body: form
+    });
+  } catch (err) {
+    fail(`Network error during upload: ${err.message}`);
+    return 1;
+  }
+  const body = await res.json().catch(() => null);
+  if (!res.ok) {
+    const env = body && typeof body === "object" ? body : null;
+    fail(
+      `Publish failed (${res.status}${env?.code ? ` ${env.code}` : ""}): ${env?.message ?? "(no message)"}`
+    );
+    if (env?.context) {
+      out(JSON.stringify(env.context, null, 2));
+    }
+    return 1;
+  }
+  const result = body;
+  if (!result) {
+    fail("Publish succeeded but the response body was empty or malformed.");
+    return 1;
+  }
+  if (options.dryRun) {
+    success(`Dry run OK \u2014 would publish ${code(`v${result.version}`)}`);
+  } else {
+    success(`Published ${code(mod.slug)} ${code(`v${result.version}`)}`);
+  }
+  info(`Bundle: ${code(result.bundle_url)}`);
+  info(`Hash:   ${dim(result.bundle_hash)}`);
+  info(`Size:   ${formatBytes2(result.bytes_uploaded)}`);
+  if (result.warnings.length > 0) {
+    warn(`${result.warnings.length} warning${result.warnings.length === 1 ? "" : "s"}:`);
+    for (const w of result.warnings) {
+      out(`  ${dim("\u2022")} ${w}`);
+    }
+  }
+  if (process.stdout.isTTY && !options.dryRun) outro("Done.");
+  return 0;
+}
+function formatBytes2(n) {
+  if (n < 1024) return `${n}B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)}KB`;
+  return `${(n / 1024 / 1024).toFixed(1)}MB`;
+}
+async function modulePullDataCommand(options) {
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const manifestPath2 = join(projectRoot, "module.json");
+  if (!existsSync(manifestPath2)) {
+    fail(
+      `No ${code("module.json")} found in ${code(projectRoot)}. Run \`dashwise module init <slug>\` first.`
+    );
+    return 1;
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath2, "utf-8"));
+  } catch (err) {
+    fail(`Could not parse ${code(manifestPath2)}: ${err.message}`);
+    return 1;
+  }
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    fail(`${code("module.json")} is missing ${code("module.slug")}.`);
+    return 1;
+  }
+  let mod;
+  try {
+    mod = await apiRequest(
+      "GET",
+      `/api/modules/by-slug/${encodeURIComponent(slug)}`
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      fail(`Module ${code(slug)} not found on the backend.`);
+      return 1;
+    }
+    if (err instanceof ApiError && err.status === 401) {
+      fail("Not logged in. Run `dashwise login` first.");
+      return 1;
+    }
+    fail(`Could not resolve module: ${err.message}`);
+    return 1;
+  }
+  const limit = options.limit ?? 100;
+  let res;
+  try {
+    res = await apiRequest(
+      "GET",
+      `/api/modules/${mod.id}/own-data?limit=${limit}`
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 400) {
+      fail(`Invalid request: ${err.message}`);
+      return 1;
+    }
+    fail(`Could not pull data: ${err.message}`);
+    return 1;
+  }
+  const outPath = options.out ? resolve(options.out) : join(projectRoot, "dashwise-data.json");
+  writeFileSync(outPath, JSON.stringify(res, null, 2) + "\n", "utf-8");
+  let totalRows = 0;
+  for (const t of res.tables) totalRows += t.rows.length;
+  success(`Wrote ${totalRows} row${totalRows === 1 ? "" : "s"} across ${res.tables.length} table${res.tables.length === 1 ? "" : "s"} to ${code(outPath)}`);
+  for (const t of res.tables) {
+    if (t.total_rows > t.rows.length) {
+      warn(
+        `Table ${code(t.slug)} truncated: ${t.rows.length} of ${t.total_rows} rows (use ${code(`--limit ${Math.min(t.total_rows, 1e3)}`)} to grab more).`
+      );
+    }
+  }
+  if (res.tables.length === 0) {
+    info(dim("No owned tables on this module. (Did you publish a manifest with `owns.tables`?)"));
+  }
+  return 0;
+}
+async function moduleValidateCommand(options) {
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const manifestPath2 = join(projectRoot, "module.json");
+  if (!existsSync(manifestPath2)) {
+    fail(
+      `No ${code("module.json")} found in ${code(projectRoot)}. Run \`dashwise module init <slug>\` first.`
+    );
+    return 1;
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath2, "utf-8"));
+  } catch (err) {
+    fail(`Could not parse ${code(manifestPath2)}: ${err.message}`);
+    return 1;
+  }
+  try {
+    const res = await apiRequest(
+      "POST",
+      "/api/modules/manifest/validate",
+      manifest
+    );
+    if (res.ok) {
+      success("Manifest is valid.");
+      return 0;
+    }
+    fail(`Unexpected response shape: ${JSON.stringify(res)}`);
+    return 1;
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 400) {
+      const issues = readIssues(err.context);
+      if (issues.length > 0) {
+        fail(`Manifest is invalid (${issues.length} issue${issues.length === 1 ? "" : "s"}):`);
+        for (const issue of issues) {
+          const path = issue.path ?? "(root)";
+          const message = issue.message ?? "(no message)";
+          out(`  ${dim("\u2022")} ${code(path)}: ${message}`);
+        }
+      } else {
+        fail(`Manifest is invalid: ${err.message}`);
+      }
+      return 1;
+    }
+    if (err instanceof ApiError && err.status === 401) {
+      fail("Not logged in. Run `dashwise login` first.");
+      return 1;
+    }
+    fail(`Could not validate manifest: ${err.message}`);
+    return 1;
+  }
+}
+function readIssues(context) {
+  if (!context) return [];
+  const v = context["issues"];
+  if (!Array.isArray(v)) return [];
+  return v.map((entry) => {
+    if (!entry || typeof entry !== "object") return null;
+    const e = entry;
+    const issue = {};
+    if (typeof e.path === "string") issue.path = e.path;
+    if (typeof e.message === "string") issue.message = e.message;
+    return issue;
+  }).filter((x) => x !== null);
+}
+function manifestPath(dir) {
+  return join(resolve(dir ?? process.cwd()), "module.json");
+}
+function readManifest(dir) {
+  const path = manifestPath(dir);
+  if (!existsSync(path)) return null;
+  const raw = readFileSync(path, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse ${path}: ${err.message}. Fix or delete the file and re-run.`
+    );
+  }
+}
+function writeManifest(manifest, dir) {
+  const path = manifestPath(dir);
+  writeFileSync(path, JSON.stringify(manifest, null, 2) + "\n", "utf-8");
+}
+function readManifestOrThrow(dir) {
+  const manifest = readManifest(dir);
+  if (!manifest) {
+    throw new Error(
+      `No module.json found in ${resolve(dir ?? process.cwd())}. Run \`dashwise module init\` first or pass \`--dir <path>\`.`
+    );
+  }
+  return manifest;
+}
+
+// src/commands/deps/add.ts
+var MIN_PURPOSE_LEN = 10;
+var MAX_PURPOSE_LEN = 500;
+async function depsAddCommand(providerSlug, options) {
+  if (!providerSlug || typeof providerSlug !== "string") {
+    fail("Usage: `dashwise deps add <provider-slug>`");
+    return 1;
+  }
+  if (!/^[a-z][a-z0-9-]*[a-z0-9]$/.test(providerSlug)) {
+    fail(
+      `Provider slug ${code(providerSlug)} is invalid. Module slugs are kebab-case (e.g. ${code("crm-app")}).`
+    );
+    return 1;
+  }
+  let manifest;
+  try {
+    manifest = readManifestOrThrow(options.dir);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  if (manifest.module?.slug === providerSlug) {
+    fail("A module cannot depend on itself.");
+    return 1;
+  }
+  const isInteractive = process.stdout.isTTY;
+  const hasAllNonInteractive = options.table !== void 0 && options.fields !== void 0 && options.purpose !== void 0;
+  if (!isInteractive && !hasAllNonInteractive) {
+    fail(
+      `Non-interactive mode requires ${code("--table")}, ${code("--fields")}, and ${code("--purpose")}.`
+    );
+    return 1;
+  }
+  let providerSummary = null;
+  let resolvedVersion = null;
+  try {
+    const mod = await apiRequest(
+      "GET",
+      `/api/modules/by-slug/${encodeURIComponent(providerSlug)}`
+    );
+    if (mod.current_version) {
+      const versions = await apiRequest(
+        "GET",
+        `/api/modules/${mod.id}/versions`
+      );
+      const current = versions.find((v) => v.version === mod.current_version) ?? versions[0];
+      if (current) {
+        providerSummary = current.manifest_jsonb;
+        resolvedVersion = current.version;
+      }
+    }
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      if (!isInteractive) {
+        fail(
+          `Provider ${code(providerSlug)} not found on the backend. Publish it first or check the slug.`
+        );
+        return 1;
+      }
+      warn(
+        `Provider ${code(providerSlug)} not found on the backend (404). You can still declare the dep manually.`
+      );
+    } else if (err instanceof ApiError && err.status === 401) {
+      fail("Not logged in. Run `dashwise login` first.");
+      return 1;
+    } else {
+      warn(`Could not fetch provider summary: ${err.message}`);
+    }
+  }
+  let entry;
+  if (isInteractive) {
+    intro(`Adding dependency on ${code(providerSlug)}`);
+    const built = await collectInteractive(
+      providerSlug,
+      providerSummary,
+      resolvedVersion,
+      options
+    );
+    if (built === null) {
+      outro("Cancelled.");
+      return 130;
+    }
+    entry = built;
+  } else {
+    const fieldList = (options.fields ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+    if (fieldList.length === 0) {
+      fail(`${code("--fields")} must list at least one field slug.`);
+      return 1;
+    }
+    const purposeErr = validatePurpose(options.purpose);
+    if (purposeErr) {
+      fail(purposeErr);
+      return 1;
+    }
+    entry = {
+      module: providerSlug,
+      version: options.version ?? (resolvedVersion ? `^${resolvedVersion}` : "^0.0.1"),
+      reads: [{ table: options.table, fields: fieldList }],
+      purpose: options.purpose
+    };
+  }
+  const deps = manifest.dependencies ?? [];
+  const existingIdx = deps.findIndex((d) => d.module === providerSlug);
+  if (existingIdx >= 0) {
+    if (!options.yes && isInteractive) {
+      const answer = await select({
+        message: `Dep on ${providerSlug} already exists. Replace it?`,
+        options: [
+          { value: "replace", label: "Replace (loses prior reads/writes)" },
+          { value: "cancel", label: "Cancel" }
+        ],
+        initialValue: "replace"
+      });
+      if (isCancel(answer) || answer === "cancel") {
+        outro("Cancelled.");
+        return 130;
+      }
+    }
+    deps[existingIdx] = entry;
+  } else {
+    deps.push(entry);
+  }
+  manifest.dependencies = deps;
+  try {
+    writeManifest(manifest, options.dir);
+  } catch (err) {
+    fail(`Could not write manifest: ${err.message}`);
+    return 1;
+  }
+  success(
+    `${existingIdx >= 0 ? "Replaced" : "Added"} dependency on ${code(providerSlug)}@${entry.version}.`
+  );
+  info(`Reads: ${entry.reads.map((r) => `${code(r.table)} (${r.fields.join(", ")})`).join("; ")}`);
+  info(`Run ${code("dashwise module generate")} to refresh typed wrappers.`);
+  if (isInteractive) outro("Done.");
+  return 0;
+}
+async function collectInteractive(providerSlug, summary, resolvedVersion, options) {
+  const reads = [];
+  if (summary && summary.exposes && summary.exposes.length > 0) {
+    info(
+      `Provider exposes ${summary.exposes.length} table${summary.exposes.length === 1 ? "" : "s"}.`
+    );
+    const readableTables = summary.exposes.filter((e) => {
+      const ops = e.operations;
+      if (!ops) return true;
+      return ops.list?.allowed === true || ops.get?.allowed === true;
+    });
+    if (readableTables.length === 0) {
+      warn(
+        `Provider ${code(providerSlug)} exposes tables but none are readable (operations.list / .get all denied).`
+      );
+      return null;
+    }
+    const picked = await multiselect({
+      message: "Which tables do you want to read from?",
+      options: readableTables.map((e) => ({
+        value: e.table,
+        label: `${e.table} ${dim(`(${e.fields.length} field${e.fields.length === 1 ? "" : "s"})`)}`
+      })),
+      required: true
+    });
+    if (isCancel(picked)) return null;
+    for (const tableSlug of picked) {
+      const exposeEntry = readableTables.find((e) => e.table === tableSlug);
+      const fieldsPicked = await multiselect({
+        message: `Fields to read from ${code(tableSlug)}:`,
+        options: exposeEntry.fields.map((f) => ({ value: f, label: f })),
+        required: true,
+        initialValues: exposeEntry.fields
+        // pre-select all; user trims down
+      });
+      if (isCancel(fieldsPicked)) return null;
+      reads.push({ table: tableSlug, fields: fieldsPicked });
+    }
+  } else {
+    info("No provider summary available \u2014 enter table + fields manually.");
+    const tableSlug = await text({
+      message: "Provider table slug to read from:",
+      placeholder: "contacts",
+      validate: (v) => /^[a-z][a-z0-9_]*[a-z0-9]$/.test(v) ? void 0 : "Table slugs are snake_case."
+    });
+    if (isCancel(tableSlug)) return null;
+    const fieldsStr = await text({
+      message: "Comma-separated field slugs:",
+      placeholder: "name, email, company",
+      validate: (v) => v.split(",").map((s) => s.trim()).filter(Boolean).length > 0 ? void 0 : "At least one field required."
+    });
+    if (isCancel(fieldsStr)) return null;
+    reads.push({
+      table: tableSlug,
+      fields: fieldsStr.split(",").map((s) => s.trim()).filter(Boolean)
+    });
+  }
+  const initialPurpose = options.purpose ?? "";
+  const purpose = await text({
+    message: `Why does your module need this dependency? ${dim(`(${MIN_PURPOSE_LEN}-${MAX_PURPOSE_LEN} chars; shown to workspace admins at install consent)`)}`,
+    placeholder: "Look up assignee contact info when rendering tasks.",
+    initialValue: initialPurpose,
+    validate: (v) => validatePurpose(v) ?? void 0
+  });
+  if (isCancel(purpose)) return null;
+  const defaultVersion = options.version ?? (resolvedVersion ? `^${resolvedVersion}` : "^0.0.1");
+  const version = await text({
+    message: `SemVer range to pin: ${dim("(npm-style; e.g. ^1.2.3, ~1.2.0, >=1.0.0)")}`,
+    placeholder: defaultVersion,
+    initialValue: defaultVersion,
+    validate: (v) => /^[\^~]?[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$/.test(v) || /^(>=|<=|>|<|=)?[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$/.test(v) ? void 0 : "Must be a npm-style semver range (e.g. ^1.2.3)."
+  });
+  if (isCancel(version)) return null;
+  return {
+    module: providerSlug,
+    version,
+    reads,
+    purpose
+  };
+}
+function validatePurpose(purpose) {
+  if (typeof purpose !== "string") return "Purpose must be a string.";
+  if (purpose.length < MIN_PURPOSE_LEN) {
+    return `Purpose must be at least ${MIN_PURPOSE_LEN} characters; got ${purpose.length}.`;
+  }
+  if (purpose.length > MAX_PURPOSE_LEN) {
+    return `Purpose must be at most ${MAX_PURPOSE_LEN} characters; got ${purpose.length}.`;
+  }
+  return null;
+}
+
+// src/commands/deps/check.ts
+async function depsCheckCommand(options) {
+  let manifest;
+  try {
+    manifest = readManifestOrThrow(options.dir);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const deps = manifest.dependencies ?? [];
+  if (deps.length === 0) {
+    if (options.json) {
+      out(JSON.stringify({ ok: true, deps: [], issues: [] }, null, 2));
+    } else {
+      info("No dependencies declared. Nothing to check.");
+    }
+    return 0;
+  }
+  const issues = [];
+  const perDepStatus = [];
+  for (const dep of deps) {
+    let mod;
+    try {
+      mod = await apiRequest(
+        "GET",
+        `/api/modules/by-slug/${encodeURIComponent(dep.module)}`
+      );
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 404) {
+        issues.push({
+          code: "PROVIDER_NOT_FOUND",
+          module: dep.module,
+          message: `Provider ${dep.module} not found on the backend. It may have been deleted or renamed.`
+        });
+        perDepStatus.push({ module: dep.module, ok: false, resolved_version: null });
+        continue;
+      }
+      if (err instanceof ApiError && err.status === 401) {
+        fail("Not logged in. Run `dashwise login` first.");
+        return 1;
+      }
+      issues.push({
+        code: "BACKEND_UNREACHABLE",
+        module: dep.module,
+        message: `Could not reach the backend: ${err.message}`
+      });
+      perDepStatus.push({ module: dep.module, ok: false, resolved_version: null });
+      continue;
+    }
+    let versions;
+    try {
+      versions = await apiRequest(
+        "GET",
+        `/api/modules/${mod.id}/versions`
+      );
+    } catch (err) {
+      issues.push({
+        code: "BACKEND_UNREACHABLE",
+        module: dep.module,
+        message: `Could not list versions: ${err.message}`
+      });
+      perDepStatus.push({ module: dep.module, ok: false, resolved_version: null });
+      continue;
+    }
+    const matching = pickMatching(versions, dep.version);
+    if (!matching) {
+      issues.push({
+        code: "NO_MATCHING_VERSION",
+        module: dep.module,
+        message: `No published version satisfies ${dep.version}. Available: ${versions.map((v) => v.version).join(", ") || "(none)"}.`,
+        context: { range: dep.version, available: versions.map((v) => v.version) }
+      });
+      perDepStatus.push({ module: dep.module, ok: false, resolved_version: null });
+      continue;
+    }
+    const exposes = matching.manifest_jsonb.exposes ?? [];
+    let depHealthy = true;
+    for (const readEntry of dep.reads) {
+      const exposeEntry = exposes.find((e) => e.table === readEntry.table);
+      if (!exposeEntry) {
+        issues.push({
+          code: "TABLE_NOT_EXPOSED",
+          module: dep.module,
+          message: `Table ${code(readEntry.table)} is no longer exposed by ${dep.module}@${matching.version}.`,
+          context: { table: readEntry.table, resolved_version: matching.version }
+        });
+        depHealthy = false;
+        continue;
+      }
+      const exposedFields = new Set(exposeEntry.fields);
+      const missing = readEntry.fields.filter((f) => !exposedFields.has(f));
+      if (missing.length > 0) {
+        issues.push({
+          code: "FIELD_NOT_EXPOSED",
+          module: dep.module,
+          message: `Fields ${missing.map((f) => code(f)).join(", ")} on ${code(readEntry.table)} are no longer exposed by ${dep.module}@${matching.version}.`,
+          context: {
+            table: readEntry.table,
+            missing,
+            resolved_version: matching.version
+          }
+        });
+        depHealthy = false;
+      }
+      const listAllowed = exposeEntry.operations?.list?.allowed !== false;
+      const getAllowed = exposeEntry.operations?.get?.allowed !== false;
+      if (!listAllowed && !getAllowed) {
+        issues.push({
+          code: "OP_NOT_ALLOWED",
+          module: dep.module,
+          message: `Provider ${dep.module}@${matching.version} disallows both list AND get on ${code(readEntry.table)} \u2014 no reads possible.`,
+          context: { table: readEntry.table, resolved_version: matching.version }
+        });
+        depHealthy = false;
+      }
+    }
+    for (const writeEntry of dep.writes ?? []) {
+      const exposeEntry = exposes.find((e) => e.table === writeEntry.table);
+      if (!exposeEntry) continue;
+      for (const op of writeEntry.operations) {
+        const gate = exposeEntry.operations?.[op];
+        if (!gate || gate.allowed !== true) {
+          issues.push({
+            code: "OP_NOT_ALLOWED",
+            module: dep.module,
+            message: `Write operation ${code(op)} on ${code(writeEntry.table)} is not allowed by ${dep.module}@${matching.version}.`,
+            context: {
+              table: writeEntry.table,
+              operation: op,
+              resolved_version: matching.version
+            }
+          });
+          depHealthy = false;
+        }
+      }
+    }
+    perDepStatus.push({
+      module: dep.module,
+      ok: depHealthy,
+      resolved_version: matching.version
+    });
+  }
+  const ok = issues.length === 0;
+  if (options.json) {
+    out(
+      JSON.stringify(
+        { ok, deps: perDepStatus, issues },
+        null,
+        2
+      )
+    );
+    return ok ? 0 : 1;
+  }
+  for (const dep of perDepStatus) {
+    if (dep.ok) {
+      success(
+        `${code(dep.module)} \u2192 ${dep.resolved_version ? `v${dep.resolved_version}` : dim("(no version)")}`
+      );
+    } else {
+      fail(`${code(dep.module)} ${dim("(drift detected)")}`);
+    }
+  }
+  if (issues.length > 0) {
+    out("");
+    warn(`${issues.length} issue${issues.length === 1 ? "" : "s"}:`);
+    for (const issue of issues) {
+      out(`  ${dim(`[${issue.code}]`)} ${issue.message}`);
+    }
+    out("");
+    info(
+      `Fix by removing/updating the dep (${code("dashwise deps remove <slug>")} then ${code("dashwise deps add <slug>")}) or by updating the provider.`
+    );
+  } else {
+    out("");
+    success(`All ${perDepStatus.length} dependenc${perDepStatus.length === 1 ? "y is" : "ies are"} healthy.`);
+  }
+  return ok ? 0 : 1;
+}
+function pickMatching(versions, range) {
+  for (const v of versions) {
+    if (rangeSatisfied(v.version, range)) return v;
+  }
+  return null;
+}
+function rangeSatisfied(version, range) {
+  const vParts = parseSemver(version);
+  if (!vParts) return false;
+  const trimmed = range.trim();
+  const opMatch = trimmed.match(/^(>=|<=|>|<|=|\^|~)?(.+)$/);
+  if (!opMatch) return false;
+  const op = opMatch[1] ?? "=";
+  const target = parseSemver(opMatch[2]);
+  if (!target) return false;
+  const cmp = compareSemver(vParts, target);
+  switch (op) {
+    case "=":
+      return cmp === 0;
+    case ">":
+      return cmp > 0;
+    case "<":
+      return cmp < 0;
+    case ">=":
+      return cmp >= 0;
+    case "<=":
+      return cmp <= 0;
+    case "^":
+      if (cmp < 0) return false;
+      if (target[0] > 0) return vParts[0] === target[0];
+      if (target[1] > 0) return vParts[0] === 0 && vParts[1] === target[1];
+      return vParts[0] === 0 && vParts[1] === 0 && vParts[2] === target[2];
+    case "~":
+      if (cmp < 0) return false;
+      return vParts[0] === target[0] && vParts[1] === target[1];
+    default:
+      return false;
+  }
+}
+function parseSemver(s) {
+  const m = s.trim().match(/^(\d+)\.(\d+)\.(\d+)(?:-[a-zA-Z0-9.-]+)?$/);
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function compareSemver(a, b) {
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] - b[i];
+  }
+  return 0;
+}
+
+// src/commands/deps/list.ts
+async function depsListCommand(options) {
+  let manifest;
+  try {
+    manifest = readManifestOrThrow(options.dir);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const deps = manifest.dependencies ?? [];
+  if (options.json) {
+    out(JSON.stringify(deps, null, 2));
+    return 0;
+  }
+  if (deps.length === 0) {
+    info("No dependencies declared in module.json.");
+    info(`Run ${code("dashwise deps add <provider-slug>")} to add one.`);
+    return 0;
+  }
+  out(`${deps.length} dependenc${deps.length === 1 ? "y" : "ies"} declared:`);
+  out("");
+  for (const dep of deps) {
+    out(`  ${code(dep.module)}@${dep.version}`);
+    out(`    ${dim("purpose:")} ${dep.purpose}`);
+    if (dep.reads.length > 0) {
+      out(`    ${dim("reads:")}`);
+      for (const r of dep.reads) {
+        out(`      ${code(r.table)} \u2192 ${r.fields.join(", ")}`);
+      }
+    }
+    if (dep.writes && dep.writes.length > 0) {
+      out(`    ${dim("writes:")}`);
+      for (const w of dep.writes) {
+        out(
+          `      ${code(w.table)} \u2192 ${w.fields.join(", ")} (${w.operations.join("/")})`
+        );
+      }
+    }
+    out("");
+  }
+  return 0;
+}
+async function depsRemoveCommand(providerSlug, options) {
+  if (!providerSlug || typeof providerSlug !== "string") {
+    fail("Usage: `dashwise deps remove <provider-slug>`");
+    return 1;
+  }
+  let manifest;
+  try {
+    manifest = readManifestOrThrow(options.dir);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const deps = manifest.dependencies ?? [];
+  const target = deps.find((d) => d.module === providerSlug);
+  if (!target) {
+    info(`No dependency on ${code(providerSlug)} declared; nothing to remove.`);
+    return 0;
+  }
+  if (!options.yes && process.stdout.isTTY) {
+    const answer = await select({
+      message: `Remove dependency on ${providerSlug}?`,
+      options: [
+        { value: "go", label: "Yes, remove it" },
+        { value: "cancel", label: "No, keep it" }
+      ],
+      initialValue: "go"
+    });
+    if (isCancel(answer) || answer === "cancel") {
+      info("Aborted.");
+      return 130;
+    }
+  }
+  manifest.dependencies = deps.filter((d) => d.module !== providerSlug);
+  if (manifest.dependencies.length === 0) {
+    delete manifest.dependencies;
+  }
+  try {
+    writeManifest(manifest, options.dir);
+  } catch (err) {
+    fail(`Could not write manifest: ${err.message}`);
+    return 1;
+  }
+  success(`Removed dependency on ${code(providerSlug)}.`);
+  info(`Run ${code("dashwise module generate")} to refresh typed wrappers.`);
+  return 0;
+}
+async function queryCommand(options) {
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  try {
+    readManifestOrThrow(projectRoot);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const generatedPath = join(
+    projectRoot,
+    "node_modules",
+    "@dashai",
+    "generated"
+  );
+  if (!existsSync(generatedPath)) {
+    fail(
+      `No ${code("@dashai/generated")} in ${code("node_modules")}. Run ${code("dashwise module generate")} first.`
+    );
+    return 1;
+  }
+  hydrateEnvFromDotenvLocal(projectRoot);
+  const modes = [
+    options.inline !== void 0 ? "inline" : null,
+    options.file !== void 0 ? "file" : null,
+    options.repl === true ? "repl" : null
+  ].filter(Boolean);
+  if (modes.length === 0) {
+    fail('Pass one of: `--inline "expr"`, `--file <path>`, or `--repl`.');
+    return 1;
+  }
+  if (modes.length > 1) {
+    fail(`--inline / --file / --repl are mutually exclusive (got: ${modes.join(", ")}).`);
+    return 1;
+  }
+  if (options.explain === true && options.repl === true) {
+    fail("--explain has no effect with --repl. In the REPL, call `.explain()` directly on your builder.");
+    return 1;
+  }
+  if (options.stream === true && options.repl === true) {
+    fail("--stream has no effect with --repl. In the REPL, call `.stream()` directly + use `for await`.");
+    return 1;
+  }
+  if (options.explain === true && options.stream === true) {
+    fail("--explain and --stream are mutually exclusive \u2014 `.explain()` returns a single plan envelope; `.stream()` yields rows.");
+    return 1;
+  }
+  const explain = options.explain === true;
+  const stream = options.stream === true;
+  if (options.repl) return runRepl(generatedPath);
+  if (options.file !== void 0)
+    return runFile(options.file, projectRoot, options.json === true, explain, stream);
+  if (options.inline !== void 0)
+    return runInline(
+      options.inline,
+      projectRoot,
+      generatedPath,
+      options.json === true,
+      explain,
+      stream
+    );
+  return 1;
+}
+async function runInline(expression, projectRoot, _generatedPath, jsonCompact, explain, stream) {
+  const tmpDir = mkdtempSync(join(tmpdir(), "dashwise-query-"));
+  const tmpFile = join(tmpDir, "inline.mjs");
+  const cleanedExpr = expression.trim().replace(/;\s*$/, "");
+  const source = [
+    "import { qb, deps, db } from '@dashai/generated';",
+    `export default (async () => (${cleanedExpr}))();`,
+    ""
+  ].join("\n");
+  writeFileSync(tmpFile, source, "utf-8");
+  try {
+    return await importAndPrint(tmpFile, projectRoot, jsonCompact, explain, stream);
+  } finally {
+    try {
+      rmSync(tmpDir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+async function runFile(file, projectRoot, jsonCompact, explain, stream) {
+  const abs = resolve(projectRoot, file);
+  if (!existsSync(abs)) {
+    fail(`File not found: ${code(abs)}`);
+    return 1;
+  }
+  if (!/\.(mjs|js)$/.test(abs)) {
+    fail(
+      `Only .mjs / .js files are supported in v1. For .ts files, run ${code("npx tsx <file>")} directly. (Tracked: bundle tsx for native .ts support.)`
+    );
+    return 1;
+  }
+  return importAndPrint(abs, projectRoot, jsonCompact, explain, stream);
+}
+async function runRepl(generatedPath) {
+  let generated;
+  try {
+    generated = await dynamicImportFromPath(generatedPath);
+  } catch (err) {
+    fail(
+      `Could not import ${code("@dashai/generated")}: ${err.message}`
+    );
+    info(
+      `Try running ${code("dashwise module generate")} to refresh the typed wrappers.`
+    );
+    return 1;
+  }
+  info(`${code("dashwise query --repl")} \u2014 Node REPL with qb / deps / db pre-bound.`);
+  info(`Try: ${code("await qb.<table>.execute()")}    Ctrl-D to exit.`);
+  out("");
+  const repl = await import('repl');
+  const server = repl.start({
+    prompt: `${code("dashwise")}${dim(">")} `,
+    useColors: true,
+    useGlobal: false
+  });
+  for (const [key, value] of Object.entries(generated)) {
+    Object.defineProperty(server.context, key, {
+      configurable: false,
+      enumerable: true,
+      writable: false,
+      value
+    });
+  }
+  return new Promise((resolveExit) => {
+    server.on("exit", () => {
+      out(dim("Goodbye."));
+      resolveExit(0);
+    });
+  });
+}
+async function importAndPrint(file, projectRoot, jsonCompact, explain, stream) {
+  const originalCwd = process.cwd();
+  try {
+    process.chdir(projectRoot);
+    const url = pathToFileURL(file).toString();
+    const mod = await import(url);
+    let result = mod.default;
+    if (result && typeof result.then === "function") {
+      result = await result;
+    }
+    if (result && typeof result.toAst === "function") {
+      if (stream && typeof result.stream === "function") {
+        const iterable = result.stream();
+        let rowCount = 0;
+        for await (const row of iterable) {
+          out(JSON.stringify(row));
+          rowCount++;
+        }
+        if (!jsonCompact) {
+          info(`Streamed ${rowCount} row${rowCount === 1 ? "" : "s"}.`);
+        }
+        return 0;
+      }
+      if (explain && typeof result.explain === "function") {
+        result = await result.explain();
+      } else if (typeof result.execute === "function") {
+        result = await result.execute();
+      }
+    }
+    if (jsonCompact) {
+      out(JSON.stringify(result));
+    } else {
+      out(JSON.stringify(result, null, 2));
+    }
+    return 0;
+  } catch (err) {
+    fail(`Query failed: ${err.message}`);
+    if (process.env.DASHWISE_DEBUG) {
+      console.error(err);
+    }
+    return 1;
+  } finally {
+    process.chdir(originalCwd);
+  }
+}
+async function dynamicImportFromPath(generatedDir) {
+  const entry = join(generatedDir, "index.js");
+  if (!existsSync(entry)) {
+    throw new Error(`Expected ${entry} to exist. Did 'dashwise module generate' run?`);
+  }
+  const url = pathToFileURL(entry).toString();
+  return await import(url);
+}
+function hydrateEnvFromDotenvLocal(projectRoot) {
+  const envFile = join(projectRoot, ".env.local");
+  if (!existsSync(envFile)) return;
+  const raw = readFileSync(envFile, "utf-8");
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (process.env[key] === void 0) {
+      process.env[key] = value;
+    }
+  }
+}
+
+// src/commands/module/query-log.ts
+var POLL_INTERVAL_MS = 5e3;
+async function moduleQueryLogCommand(options) {
+  let moduleId;
+  try {
+    moduleId = await resolveModuleId(options.module, options.dir);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  if (options.tail) {
+    return runTail(moduleId, options);
+  }
+  return runOnce(moduleId, options);
+}
+async function runOnce(moduleId, options) {
+  const params = {};
+  if (options.slow) params.slow = "true";
+  if (options.since) params.since = options.since;
+  if (typeof options.limit === "number") params.limit = String(options.limit);
+  const qs = new URLSearchParams(params).toString();
+  const path = `/api/modules/${moduleId}/query-log${qs ? `?${qs}` : ""}`;
+  let body;
+  try {
+    body = await apiRequest("GET", path);
+  } catch (err) {
+    return handleApiError(err);
+  }
+  if (options.json) {
+    out(JSON.stringify(body));
+    return 0;
+  }
+  if (body.entries.length === 0) {
+    info(
+      options.slow ? "No slow queries in the requested window." : "No query log entries in the requested window."
+    );
+    return 0;
+  }
+  renderTable(body.entries);
+  out("");
+  info(`${body.count} ${body.count === 1 ? "entry" : "entries"}.`);
+  return 0;
+}
+async function runTail(moduleId, options) {
+  const initialParams = {};
+  if (options.slow) initialParams.slow = "true";
+  initialParams.since = options.since ?? "5m";
+  if (typeof options.limit === "number") initialParams.limit = String(options.limit);
+  const initialQs = new URLSearchParams(initialParams).toString();
+  info(`Tailing query log for module ${moduleId}. Ctrl-C to stop.`);
+  out("");
+  const seenIds = /* @__PURE__ */ new Set();
+  let firstPoll = true;
+  printTableHeader();
+  while (true) {
+    try {
+      const path = `/api/modules/${moduleId}/query-log?${firstPoll ? initialQs : buildTailParams(options)}`;
+      const body = await apiRequest("GET", path);
+      const newRows = [];
+      for (const row of [...body.entries].reverse()) {
+        if (seenIds.has(row.request_id)) continue;
+        seenIds.add(row.request_id);
+        newRows.push(row);
+      }
+      for (const row of newRows) {
+        out(formatRow(row));
+      }
+      firstPoll = false;
+    } catch (err) {
+      info(dim(`(tail poll error: ${err.message})`));
+    }
+    await sleep2(POLL_INTERVAL_MS);
+  }
+}
+function buildTailParams(options) {
+  const params = { since: "7s" };
+  if (options.slow) params.slow = "true";
+  if (typeof options.limit === "number") params.limit = String(options.limit);
+  return new URLSearchParams(params).toString();
+}
+async function resolveModuleId(moduleArg, dir) {
+  if (moduleArg && moduleArg.length > 0) {
+    const asInt = Number.parseInt(moduleArg, 10);
+    if (Number.isFinite(asInt) && String(asInt) === moduleArg) {
+      return asInt;
+    }
+    return lookupModuleIdBySlug(moduleArg);
+  }
+  const projectRoot = dir ?? process.cwd();
+  try {
+    const manifest = readManifestOrThrow(projectRoot);
+    if (manifest?.module?.slug) {
+      return lookupModuleIdBySlug(manifest.module.slug);
+    }
+  } catch {
+  }
+  throw new Error(
+    `No module specified. Pass --module <id-or-slug> or run inside a module project directory containing module.json.`
+  );
+}
+async function lookupModuleIdBySlug(slug) {
+  const found = await apiRequest(
+    "GET",
+    `/api/modules/by-slug/${encodeURIComponent(slug)}`
+  );
+  if (!found || typeof found.id !== "number") {
+    throw new Error(`Module ${code(slug)} not found.`);
+  }
+  return found.id;
+}
+function handleApiError(err) {
+  if (err instanceof ApiError) {
+    if (err.status === 401) {
+      fail("Not logged in. Run `dashwise login` first.");
+      return 1;
+    }
+    if (err.status === 403) {
+      fail(
+        `Forbidden \u2014 you are not a member of this module's owner workspace. Use \`dashwise workspace list\` to see what you have access to.`
+      );
+      return 1;
+    }
+    if (err.status === 404) {
+      fail(`Module not found.`);
+      return 1;
+    }
+  }
+  fail(`Could not load query log: ${err.message}`);
+  return 1;
+}
+var COL_WIDTHS = {
+  time: 19,
+  // "YYYY-MM-DD HH:MM:SS"
+  endpoint: 7,
+  // "query" | "explain"
+  ms: 6,
+  // "12345" with margin
+  rows: 5,
+  code: 18,
+  request: 12
+  // first 12 chars of request_id (most are UUIDs)
+};
+function renderTable(entries) {
+  out("");
+  printTableHeader();
+  for (const row of entries) {
+    out(formatRow(row));
+  }
+}
+function printTableHeader() {
+  out(
+    [
+      "TIME".padEnd(COL_WIDTHS.time),
+      "ENDPT".padEnd(COL_WIDTHS.endpoint),
+      "MS".padStart(COL_WIDTHS.ms),
+      "ROWS".padStart(COL_WIDTHS.rows),
+      "CODE".padEnd(COL_WIDTHS.code),
+      "REQ"
+    ].join("  ")
+  );
+  out(
+    [
+      "-".repeat(COL_WIDTHS.time),
+      "-".repeat(COL_WIDTHS.endpoint),
+      "-".repeat(COL_WIDTHS.ms),
+      "-".repeat(COL_WIDTHS.rows),
+      "-".repeat(COL_WIDTHS.code),
+      "-".repeat(COL_WIDTHS.request)
+    ].join("  ")
+  );
+}
+function formatRow(row) {
+  const time = formatTimestamp(row.created_at);
+  const endpoint = row.endpoint.padEnd(COL_WIDTHS.endpoint);
+  const ms = String(row.duration_ms).padStart(COL_WIDTHS.ms);
+  const rows = row.row_count === null ? "\u2014".padStart(COL_WIDTHS.rows) : String(row.row_count).padStart(COL_WIDTHS.rows);
+  const errCode = row.error_code ?? "";
+  const codeCol = errCode ? code(errCode).padEnd(COL_WIDTHS.code + (code(errCode).length - errCode.length)) : "OK".padEnd(COL_WIDTHS.code);
+  const req = row.request_id.slice(0, COL_WIDTHS.request);
+  return [time, endpoint, ms, rows, codeCol, dim(req)].join("  ");
+}
+function formatTimestamp(iso) {
+  return iso.slice(0, 19).replace("T", " ");
+}
+function sleep2(ms) {
+  return new Promise((resolve11) => setTimeout(resolve11, ms));
+}
+
+// src/commands/module/action-log.ts
+var POLL_INTERVAL_MS2 = 5e3;
+async function moduleActionLogCommand(options) {
+  if (options.installation === void 0 && options.module === void 0) {
+    fail("Must pass either `--installation <id>` or `--module <slug>`.");
+    return 1;
+  }
+  if (options.installation !== void 0 && options.module !== void 0) {
+    fail("`--installation` and `--module` are mutually exclusive \u2014 pass one or the other.");
+    return 1;
+  }
+  let installationId = options.installation;
+  if (installationId === void 0 && options.module !== void 0) {
+    try {
+      const resolved = await apiRequest(
+        "GET",
+        `/api/modules/by-slug/${encodeURIComponent(options.module)}/my-installation`
+      );
+      installationId = resolved.installation_id;
+    } catch (err) {
+      return mapAndPrintError(err, options.json);
+    }
+  }
+  if (options.tail) {
+    return runTail2(installationId, options);
+  }
+  return runOnce2(installationId, options);
+}
+async function runOnce2(installationId, options) {
+  const params = {};
+  if (options.role !== void 0) params.role = options.role;
+  if (options.slow) params.slow = "true";
+  if (options.crossModuleOnly) params.cross_module_only = "true";
+  if (options.since !== void 0) params.since = options.since;
+  if (options.limit !== void 0) params.limit = String(options.limit);
+  let response;
+  try {
+    response = await apiRequest(
+      "GET",
+      `/api/modules/runtime/installations/${installationId}/action-log?${new URLSearchParams(params).toString()}`
+    );
+  } catch (err) {
+    return mapAndPrintError(err, options.json);
+  }
+  if (options.json) {
+    out(JSON.stringify(response));
+    return 0;
+  }
+  printTable(response.entries);
+  if (response.entries.length === 0) {
+    info("No entries.");
+  }
+  return 0;
+}
+async function runTail2(installationId, options) {
+  if (options.json) {
+    fail("`--tail` and `--json` are mutually exclusive.");
+    return 1;
+  }
+  info(`Tailing action log for installation ${code(String(installationId))} every 5s. Ctrl-C to stop.`);
+  let lastSeen;
+  const printed = /* @__PURE__ */ new Set();
+  while (true) {
+    const params = {};
+    if (options.role !== void 0) params.role = options.role;
+    if (options.slow) params.slow = "true";
+    if (options.crossModuleOnly) params.cross_module_only = "true";
+    if (lastSeen !== void 0) params.since = lastSeen;
+    else if (options.since !== void 0) params.since = options.since;
+    params.limit = String(options.limit ?? 100);
+    try {
+      const response = await apiRequest(
+        "GET",
+        `/api/modules/runtime/installations/${installationId}/action-log?${new URLSearchParams(params).toString()}`
+      );
+      const fresh = response.entries.filter((e) => !printed.has(e.id)).reverse();
+      if (fresh.length > 0) {
+        for (const entry of fresh) {
+          printed.add(entry.id);
+          printRow(entry);
+        }
+        lastSeen = fresh[fresh.length - 1].created_at;
+      }
+    } catch (err) {
+      if (err instanceof ApiError && (err.status === 401 || err.status === 403)) {
+        return mapAndPrintError(err, false);
+      }
+      dim(`(tail: transient error \u2014 ${err.message})`);
+    }
+    await new Promise((resolve11) => setTimeout(resolve11, POLL_INTERVAL_MS2));
+  }
+}
+function printTable(rows) {
+  if (rows.length === 0) {
+    out("");
+    out("  (no entries)");
+    out("");
+    return;
+  }
+  const widths = {
+    time: 19,
+    elapsed: 5,
+    cross: 5,
+    caller: 18,
+    action: 22,
+    code: 18
+  };
+  out("");
+  out(
+    `${"TIME".padEnd(widths.time)}  ${"MS".padStart(widths.elapsed)}  ${"CROSS".padEnd(widths.cross)}  ${"CALLER".padEnd(widths.caller)}  ${"ACTION".padEnd(widths.action)}  ${"CODE".padEnd(widths.code)}`
+  );
+  out(
+    `${"-".repeat(widths.time)}  ${"-".repeat(widths.elapsed)}  ${"-".repeat(widths.cross)}  ${"-".repeat(widths.caller)}  ${"-".repeat(widths.action)}  ${"-".repeat(widths.code)}`
+  );
+  for (const r of rows) {
+    printRow(r);
+  }
+  out("");
+  info(`${rows.length} entr${rows.length === 1 ? "y" : "ies"}.`);
+}
+function printRow(r) {
+  const time = r.created_at.slice(0, 19).replace("T", " ");
+  const cross = r.cross_module ? code("yes") : dim(" no");
+  const codeCol = r.ok ? dim("-") : code(r.error_code ?? "ERROR");
+  out(
+    `${time.padEnd(19)}  ${String(r.elapsed_ms).padStart(5)}  ${cross.padEnd(5)}  ${r.caller_module_slug.padEnd(18)}  ${r.action_name.padEnd(22)}  ${codeCol}`
+  );
+}
+function mapAndPrintError(err, json) {
+  if (err instanceof ApiError) {
+    if (err.status === 401) {
+      const msg2 = "Not logged in. Run `dashwise login` first.";
+      if (json) out(JSON.stringify({ ok: false, error: { code: "NOT_LOGGED_IN", message: msg2 } }));
+      else fail(msg2);
+      return 1;
+    }
+    if (err.status === 403) {
+      const msg2 = "Workspace-member access required for this installation.";
+      if (json) out(JSON.stringify({ ok: false, error: { code: "FORBIDDEN", message: msg2 } }));
+      else fail(msg2);
+      return 1;
+    }
+    if (err.status === 404) {
+      const msg2 = "Installation not found.";
+      if (json) out(JSON.stringify({ ok: false, error: { code: "INSTALLATION_NOT_FOUND", message: msg2 } }));
+      else fail(msg2);
+      return 1;
+    }
+  }
+  const msg = `Could not fetch action log: ${err.message}`;
+  if (json) out(JSON.stringify({ ok: false, error: { code: "FETCH_FAILED", message: err.message } }));
+  else fail(msg);
+  return 1;
+}
+
+// src/bin.ts
+var program = new Command();
+program.name("dashwise").description("DashWise CLI \u2014 log in, author modules, publish to the marketplace.").version(getVersion(), "-v, --version", "Show the CLI version + exit").option(
+  "--api-url <url>",
+  "Override DashWise backend URL (default: $DASHWISE_API_URL or saved config or http://localhost:3000)"
+);
+program.command("login").description("Sign in via the device-code flow.").option("--no-prompt", 'Skip the "open browser" prompt; just print the URL.').option("--name <name>", "Suggested name for the minted token (default: dashwise-cli).").action(async (cmdOpts) => {
+  const apiUrl = program.opts().apiUrl;
+  const exit = await loginCommand({
+    ...apiUrl !== void 0 ? { apiUrl } : {},
+    noPrompt: cmdOpts.prompt === false,
+    ...cmdOpts.name !== void 0 ? { name: cmdOpts.name } : {}
+  });
+  process.exitCode = exit;
+});
+program.command("logout").description("Clear the local credentials and revoke the server-side token.").action(async () => {
+  process.exitCode = await logoutCommand();
+});
+program.command("profile").description("Show the current user, default workspace, and accessible workspaces.").option("--json", "Emit JSON to stdout instead of human-readable kv pairs.").action(async (cmdOpts) => {
+  process.exitCode = await profileCommand({
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+var workspace = program.command("workspace").description("Workspace context commands.");
+workspace.command("list").description("List accessible workspaces.").option("--json", "Emit JSON to stdout instead of human-readable columns.").action(async (cmdOpts) => {
+  process.exitCode = await workspaceListCommand({
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+workspace.command("use <slug>").description("Set the default workspace for subsequent commands.").action(async (slug) => {
+  process.exitCode = await workspaceUseCommand(slug);
+});
+program.command("dev").description(
+  "One-command local dev loop: runs the manifest watcher + Next.js dev server together, with `DASHWISE_API_URL`/`DASHWISE_API_TOKEN`/`DASHWISE_INSTALLATION_ID` auto-injected from your saved CLI config. Run `dashwise login` first."
+).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option(
+  "--installation-id <id>",
+  'Override the `DASHWISE_INSTALLATION_ID` env var passed to children (default: "local").'
+).option(
+  "--api-url <url>",
+  "Override the `DASHWISE_API_URL` env var passed to children (default: saved CLI config)."
+).option("--port <number>", "Port for `next dev` (default: Next.js picks 3000 / next free).", parseIntOption).option("--sdk-only", "Only run the manifest watcher; skip `next dev`.").option("--next-only", "Only run `next dev`; skip the manifest watcher.").action(
+  async (cmdOpts) => {
+    process.exitCode = await devCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.installationId !== void 0 ? { installationId: cmdOpts.installationId } : {},
+      ...cmdOpts.apiUrl !== void 0 ? { apiUrl: cmdOpts.apiUrl } : {},
+      ...cmdOpts.port !== void 0 ? { port: cmdOpts.port } : {},
+      ...cmdOpts.sdkOnly !== void 0 ? { sdkOnly: cmdOpts.sdkOnly } : {},
+      ...cmdOpts.nextOnly !== void 0 ? { nextOnly: cmdOpts.nextOnly } : {}
+    });
+  }
+);
+var moduleCmd = program.command("module").description("Module authoring commands.");
+moduleCmd.command("init [slug]").description(
+  "Scaffold a new DashWise module \u2014 full Next.js app with auth wiring + SSO callback + protected dashboard. Pass --simple for the legacy minimal scaffold (no auth)."
+).option("--dir <path>", "Override the target directory (default: ./<slug>).").option("--name <name>", "Human-readable module name (default: derived from slug).").option("--force", "Overwrite an existing non-empty directory.").option(
+  "--simple",
+  "Use the legacy minimal scaffold (hand-authored, no Next.js auth wiring). Default before 2026-05-18; opt-in now."
+).option(
+  "--custom",
+  "[Deprecated alias \u2014 kept for backward compatibility.] Equivalent to the default (full Next.js + auth). Will be removed in a future major version; just call `dashwise module init` without flags."
+).option("--git <url>", "Initial Git repository URL \u2014 written to module.json#repository.url.").action(
+  async (slugArg, cmdOpts) => {
+    process.exitCode = await moduleInitCommand(slugArg, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.name !== void 0 ? { name: cmdOpts.name } : {},
+      ...cmdOpts.force !== void 0 ? { force: cmdOpts.force } : {},
+      ...cmdOpts.simple !== void 0 ? { simple: cmdOpts.simple } : {},
+      ...cmdOpts.custom !== void 0 ? { custom: cmdOpts.custom } : {},
+      ...cmdOpts.git !== void 0 ? { git: cmdOpts.git } : {}
+    });
+  }
+);
+moduleCmd.command("connect-git <repo-url>").description("Link the local module to a Git repository (writes module.json#repository).").option("--dir <path>", "Project root (default: current directory).").option("--branch <name>", "Default branch to publish from (e.g. `main`).").action(
+  async (repoUrl, cmdOpts) => {
+    process.exitCode = await moduleConnectGitCommand(repoUrl, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.branch !== void 0 ? { branch: cmdOpts.branch } : {}
+    });
+  }
+);
+moduleCmd.command("generate").description("Regenerate typed wrappers from the local module.json into node_modules/@dashai/generated/.").option("--dir <path>", "Project root (default: current directory).").option("--dry-run", "Print summary without writing files.").action(async (cmdOpts) => {
+  process.exitCode = await moduleGenerateCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {}
+  });
+});
+moduleCmd.command("dev").description("Watch module.json + regenerate typed wrappers on every save. Ctrl-C to stop.").option("--dir <path>", "Project root (default: current directory).").option("--debounce-ms <n>", "Filesystem change debounce window (default: 250ms).", parseIntOption).action(async (cmdOpts) => {
+  process.exitCode = await moduleDevCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.debounceMs !== void 0 ? { debounceMs: cmdOpts.debounceMs } : {}
+  });
+});
+moduleCmd.command("validate").description("Validate the local module.json against the backend manifest validator.").option("--dir <path>", "Project root (default: current directory).").action(async (cmdOpts) => {
+  process.exitCode = await moduleValidateCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {}
+  });
+});
+moduleCmd.command("list").description("List modules you own (or `--all` for owned + public).").option("--all", "Include public modules you can install but do not own.").option("--workspace <slug>", "Filter by workspace slug (default: saved default workspace).").option("--json", "Emit JSON to stdout instead of column-aligned text.").action(async (cmdOpts) => {
+  process.exitCode = await moduleListCommand({
+    ...cmdOpts.all !== void 0 ? { all: cmdOpts.all } : {},
+    ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+moduleCmd.command("diff").description("Show what would change at the next publish vs the currently-published version.").option("--dir <path>", "Project root (default: current directory).").option("--json", "Emit the structured diff as JSON instead of the human-readable summary.").action(async (cmdOpts) => {
+  process.exitCode = await moduleDiffCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+moduleCmd.command("pull-data").description("Export the module's own-table rows to a local JSON file (for fixtures, local dev seeding).").option("--dir <path>", "Project root (default: current directory).").option("--limit <n>", "Max rows per table (1-1000, default 100).", parseIntOption).option("--out <path>", "Output file path (default: ./dashwise-data.json).").action(async (cmdOpts) => {
+  process.exitCode = await modulePullDataCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.limit !== void 0 ? { limit: cmdOpts.limit } : {},
+    ...cmdOpts.out !== void 0 ? { out: cmdOpts.out } : {}
+  });
+});
+moduleCmd.command("clone <slug>").description("Clone a published module locally. Uses git if repository.url is set, else writes a manifest-only scaffold.").option("--dir <path>", "Target directory (default: ./<slug>).").option("--force", "Overwrite an existing non-empty directory.").option("--no-git", "Skip git clone even when repository.url is set; use the manifest-only scaffold.").action(
+  async (slug, cmdOpts) => {
+    process.exitCode = await moduleCloneCommand(slug, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.force !== void 0 ? { force: cmdOpts.force } : {},
+      ...cmdOpts.git === false ? { noGit: true } : {}
+    });
+  }
+);
+var depsCmd = program.command("deps").description("Cross-module dependency commands (manipulate module.json#dependencies).");
+depsCmd.command("list").description("List declared cross-module dependencies.").option("--dir <path>", "Project root (default: current directory).").option("--json", "Emit JSON to stdout instead of human-readable columns.").action(async (cmdOpts) => {
+  process.exitCode = await depsListCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+depsCmd.command("add <provider-slug>").description(
+  "Declare a cross-module dependency. Interactive in TTY (picks tables + fields from the provider's exposes); non-interactive requires --table, --fields, --purpose."
+).option("--dir <path>", "Project root (default: current directory).").option("--table <slug>", "Provider table slug to read from (non-interactive mode).").option("--fields <list>", "Comma-separated field slugs for --table (non-interactive mode).").option("--purpose <text>", "Human-readable explanation (10-500 chars, shown at install consent).").option("--version <range>", "SemVer range to pin (default: ^<provider-current-version>).").option("-y, --yes", "Skip the replace-existing confirmation prompt.").action(
+  async (providerSlug, cmdOpts) => {
+    process.exitCode = await depsAddCommand(providerSlug, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.table !== void 0 ? { table: cmdOpts.table } : {},
+      ...cmdOpts.fields !== void 0 ? { fields: cmdOpts.fields } : {},
+      ...cmdOpts.purpose !== void 0 ? { purpose: cmdOpts.purpose } : {},
+      ...cmdOpts.version !== void 0 ? { version: cmdOpts.version } : {},
+      ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
+    });
+  }
+);
+depsCmd.command("remove <provider-slug>").description("Remove a declared cross-module dependency.").option("--dir <path>", "Project root (default: current directory).").option("-y, --yes", "Skip the confirmation prompt.").action(async (providerSlug, cmdOpts) => {
+  process.exitCode = await depsRemoveCommand(providerSlug, {
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
+  });
+});
+depsCmd.command("check").description("Verify each declared dep still resolves to a published provider + that every field/op is still exposed. Exits 1 on drift.").option("--dir <path>", "Project root (default: current directory).").option("--json", "Emit a JSON drift report to stdout.").action(async (cmdOpts) => {
+  process.exitCode = await depsCheckCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+program.command("query").description(
+  'Run a typed query against the local module installation via @dashai/sdk/query. Pass one of `--inline "<expr>"`, `--file <path>`, or `--repl`. `qb`, `deps`, `db` are pre-bound to the local module\'s generated SDK.'
+).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option("--inline <expression>", "Evaluate a one-liner. e.g., `qb.tasks.where({done:false}).count()`.").option("--file <path>", "Dynamic-import a .mjs/.js file. Default export = Query | AggQuery | Promise | value.").option("--repl", "Open an interactive Node REPL with the generated SDK pre-bound. Top-level await supported.").option("--json", "Emit compact JSON (default: pretty-printed).").option(
+  "--explain",
+  "Call .explain() instead of .execute() \u2014 returns the Postgres plan + estimatedCost without executing the query. MVP supports joined queries; bare own/dep/view paths reject with EXPLAIN_NOT_SUPPORTED_YET."
+).option(
+  "--stream",
+  "Call .stream() instead of .execute() \u2014 prints rows incrementally as JSON-lines (one row per line). Lets you see progress on big queries + Ctrl-C cleanly midway. Mutually exclusive with --explain and --repl."
+).action(
+  async (cmdOpts) => {
+    process.exitCode = await queryCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.inline !== void 0 ? { inline: cmdOpts.inline } : {},
+      ...cmdOpts.file !== void 0 ? { file: cmdOpts.file } : {},
+      ...cmdOpts.repl !== void 0 ? { repl: cmdOpts.repl } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {},
+      ...cmdOpts.explain !== void 0 ? { explain: cmdOpts.explain } : {},
+      ...cmdOpts.stream !== void 0 ? { stream: cmdOpts.stream } : {}
+    });
+  }
+);
+moduleCmd.command("publish").description("Pack the current directory + upload it as a new module version.").option("--dir <path>", "Project root (default: current directory).").option("--bump <direction>", "Semver bump: patch | minor | major.").option("--dry-run", "Validate + upload but do not persist the version row.").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use).").option(
+  "--exclude <pattern...>",
+  "Extra exclude patterns (segment-matched) appended to the defaults."
+).action(
+  async (cmdOpts) => {
+    process.exitCode = await modulePublishCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.bump !== void 0 ? { bump: cmdOpts.bump } : {},
+      ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {},
+      ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
+      ...cmdOpts.exclude !== void 0 ? { exclude: cmdOpts.exclude } : {}
+    });
+  }
+);
+moduleCmd.command("query-log").description(
+  "Read the per-module SDK query log. Default: 50 most recent entries. `--slow` filters to duration_ms > 500ms; `--since 1h` narrows by time; `--tail` streams new entries every 5s."
+).option(
+  "--module <id-or-slug>",
+  "Module to inspect (default: slug from current directory's module.json)."
+).option("--slow", "Filter to slow queries only (duration_ms > 500).").option(
+  "--since <duration>",
+  'Only entries newer than this. Accepts "30m", "1h", "6h", "2d", "7d", or an ISO 8601 timestamp.'
+).option("--limit <n>", "Max rows per fetch (1-500, default 50).", parseIntOption).option("--tail", "Poll every 5s for new entries. Ctrl-C to stop.").option("--json", "Emit compact JSON instead of the table. Ignored with --tail.").option("--dir <path>", "Override project directory for module.json lookup.").action(
+  async (cmdOpts) => {
+    process.exitCode = await moduleQueryLogCommand({
+      ...cmdOpts.module !== void 0 ? { module: cmdOpts.module } : {},
+      ...cmdOpts.slow !== void 0 ? { slow: cmdOpts.slow } : {},
+      ...cmdOpts.since !== void 0 ? { since: cmdOpts.since } : {},
+      ...cmdOpts.limit !== void 0 ? { limit: cmdOpts.limit } : {},
+      ...cmdOpts.tail !== void 0 ? { tail: cmdOpts.tail } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {},
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {}
+    });
+  }
+);
+moduleCmd.command("action-log").description(
+  "Read the per-installation server-action audit log. Shows both cross-module and own-module dispatches. Filter by role (caller / provider), slow, since, cross-module-only. `--tail` streams new entries every 5s. Pass either `--installation <id>` or `--module <slug>` (slug resolves to your accessible installation)."
+).option(
+  "--installation <id>",
+  "Installation id to inspect. Mutually exclusive with `--module`.",
+  parseIntOption
+).option(
+  "--module <slug>",
+  "Module slug. Resolves to the caller's accessible installation of that module (first match if multi-workspace). Mutually exclusive with `--installation`."
+).option(
+  "--role <caller|provider>",
+  "Which side of cross-module dispatches to show. 'caller' (default) shows outbound; 'provider' shows inbound calls on this installation."
+).option("--slow", "Filter to slow actions only (elapsed_ms > 500).").option("--cross-module-only", "Hide own-module dispatches (cross_module=false rows).").option(
+  "--since <duration>",
+  'Only entries newer than this. Accepts "30m", "1h", "6h", "2d", "7d", or an ISO 8601 timestamp.'
+).option("--limit <n>", "Max rows per fetch (1-500, default 50).", parseIntOption).option("--tail", "Poll every 5s for new entries. Ctrl-C to stop.").option("--json", "Emit compact JSON instead of the table. Ignored with --tail.").action(
+  async (cmdOpts) => {
+    if (cmdOpts.role !== void 0 && cmdOpts.role !== "caller" && cmdOpts.role !== "provider") {
+      fail(`--role must be 'caller' or 'provider' (got "${cmdOpts.role}").`);
+      process.exitCode = 1;
+      return;
+    }
+    process.exitCode = await moduleActionLogCommand({
+      ...cmdOpts.installation !== void 0 ? { installation: cmdOpts.installation } : {},
+      ...cmdOpts.module !== void 0 ? { module: cmdOpts.module } : {},
+      ...cmdOpts.role !== void 0 ? { role: cmdOpts.role } : {},
+      ...cmdOpts.slow !== void 0 ? { slow: cmdOpts.slow } : {},
+      ...cmdOpts.crossModuleOnly !== void 0 ? { crossModuleOnly: cmdOpts.crossModuleOnly } : {},
+      ...cmdOpts.since !== void 0 ? { since: cmdOpts.since } : {},
+      ...cmdOpts.limit !== void 0 ? { limit: cmdOpts.limit } : {},
+      ...cmdOpts.tail !== void 0 ? { tail: cmdOpts.tail } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    });
+  }
+);
+(async () => {
+  try {
+    await program.parseAsync(process.argv);
+  } catch (err) {
+    fail(`Unhandled error: ${err.message ?? String(err)}`);
+    if (process.env.DASHWISE_DEBUG) {
+      console.error(err);
+    }
+    process.exitCode = 1;
+  }
+})();
+function getVersion() {
+  return "0.1.0";
+}
+function parseIntOption(value) {
+  const n = Number.parseInt(value, 10);
+  if (!Number.isFinite(n)) {
+    throw new Error(`Expected an integer, got '${value}'`);
+  }
+  return n;
+}
+//# sourceMappingURL=bin.js.map
+//# sourceMappingURL=bin.js.map