@dashai/cli 0.23.0 → 0.25.0

package/dist/bin.js

@@ -3,7 +3,7 @@ import pc from 'picocolors';
 import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, watch, readdirSync, chmodSync, renameSync, lstatSync, mkdtempSync, statSync } from 'fs';
 import { hostname, tmpdir, platform, homedir } from 'os';
 import { resolve, join, relative, dirname, basename, win32, sep } from 'path';
-import { spawn, spawnSync } from 'child_process';
+import { execFileSync, spawn, spawnSync } from 'child_process';
 import { intro, log, select, isCancel, cancel, spinner, outro, text, confirm, multiselect } from '@clack/prompts';
 import { Command, Option } from 'commander';
 import open from 'open';
@@ -112,6 +112,12 @@ function resolveApiUrl() {
   if (cfg?.apiUrl) return cfg.apiUrl.replace(/\/+$/, "");
   return DEFAULT_API_URL;
 }
+function resolveExplicitApiUrl() {
+  const fromEnv = process.env.DASHWISE_API_URL?.trim();
+  if (fromEnv) return fromEnv.replace(/\/+$/, "");
+  const cfg = safeReadConfig();
+  return cfg?.apiUrl ? cfg.apiUrl.replace(/\/+$/, "") : null;
+}
 function readSavedToken() {
   const cfg = safeReadConfig();
   return cfg?.token ?? null;
@@ -1406,13 +1412,13 @@ async function resolveDevPort(requested) {
 }
 async function isPortFree(port) {
   const { createServer } = await import('net');
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     const server = createServer();
     server.once("error", () => {
-      resolve14(false);
+      resolve15(false);
     });
     server.once("listening", () => {
-      server.close(() => resolve14(true));
+      server.close(() => resolve15(true));
     });
     server.listen(port, "0.0.0.0");
   });
@@ -1493,6 +1499,62 @@ var init_dev = __esm({
     PORT_PROBE_LIMIT = 10;
   }
 });
+function resolveSdkPackageJson(projectRoot) {
+  let dir = projectRoot;
+  for (; ; ) {
+    const candidate = join(dir, "node_modules", "@dashai", "sdk", "package.json");
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function readInstalledSdk(projectRoot) {
+  const pkgPath = resolveSdkPackageJson(projectRoot);
+  if (pkgPath === null) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    if (typeof parsed.version !== "string" || parsed.version.length === 0) return null;
+    return { version: parsed.version };
+  } catch {
+    return null;
+  }
+}
+function compareVersions(a, b) {
+  const parse = (v) => {
+    const [core = "", pre] = v.trim().replace(/^[^0-9]*/, "").split("-", 2);
+    const nums = core.split(".").map((n) => Number.parseInt(n, 10) || 0);
+    while (nums.length < 3) nums.push(0);
+    return [nums.slice(0, 3), pre !== void 0 && pre.length > 0];
+  };
+  const [an, apre] = parse(a);
+  const [bn, bpre] = parse(b);
+  for (let i = 0; i < 3; i++) {
+    const d = (an[i] ?? 0) - (bn[i] ?? 0);
+    if (d !== 0) return d;
+  }
+  if (apre === bpre) return 0;
+  return apre ? -1 : 1;
+}
+function satisfiesFloor(version, floor) {
+  return compareVersions(version, floor) >= 0;
+}
+function checkSdkFloor(projectRoot, floor) {
+  const installed = readInstalledSdk(projectRoot);
+  if (installed === null) return { ok: true, installed: null, floor };
+  return {
+    ok: satisfiesFloor(installed.version, floor),
+    installed: installed.version,
+    floor
+  };
+}
+var USES_SDK_FLOOR, SCAFFOLD_SDK_RANGE;
+var init_sdk_version = __esm({
+  "src/lib/sdk-version.ts"() {
+    USES_SDK_FLOOR = "2.5.0";
+    SCAFFOLD_SDK_RANGE = "^2.5.0";
+  }
+});
 async function selectWorkspace(opts) {
   const workspaces = await apiRequest(
     "GET",
@@ -1551,62 +1613,6 @@ var init_workspaces = __esm({
     init_api_client();
   }
 });
-function resolveSdkPackageJson(projectRoot) {
-  let dir = projectRoot;
-  for (; ; ) {
-    const candidate = join(dir, "node_modules", "@dashai", "sdk", "package.json");
-    if (existsSync(candidate)) return candidate;
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-function readInstalledSdk(projectRoot) {
-  const pkgPath = resolveSdkPackageJson(projectRoot);
-  if (pkgPath === null) return null;
-  try {
-    const parsed = JSON.parse(readFileSync(pkgPath, "utf-8"));
-    if (typeof parsed.version !== "string" || parsed.version.length === 0) return null;
-    return { version: parsed.version };
-  } catch {
-    return null;
-  }
-}
-function compareVersions(a, b) {
-  const parse = (v) => {
-    const [core = "", pre] = v.trim().replace(/^[^0-9]*/, "").split("-", 2);
-    const nums = core.split(".").map((n) => Number.parseInt(n, 10) || 0);
-    while (nums.length < 3) nums.push(0);
-    return [nums.slice(0, 3), pre !== void 0 && pre.length > 0];
-  };
-  const [an, apre] = parse(a);
-  const [bn, bpre] = parse(b);
-  for (let i = 0; i < 3; i++) {
-    const d = (an[i] ?? 0) - (bn[i] ?? 0);
-    if (d !== 0) return d;
-  }
-  if (apre === bpre) return 0;
-  return apre ? -1 : 1;
-}
-function satisfiesFloor(version, floor) {
-  return compareVersions(version, floor) >= 0;
-}
-function checkSdkFloor(projectRoot, floor) {
-  const installed = readInstalledSdk(projectRoot);
-  if (installed === null) return { ok: true, installed: null, floor };
-  return {
-    ok: satisfiesFloor(installed.version, floor),
-    installed: installed.version,
-    floor
-  };
-}
-var USES_SDK_FLOOR, SCAFFOLD_SDK_RANGE;
-var init_sdk_version = __esm({
-  "src/lib/sdk-version.ts"() {
-    USES_SDK_FLOOR = "2.5.0";
-    SCAFFOLD_SDK_RANGE = "^2.5.0";
-  }
-});
 
 // src/lib/scaffold-locks/simple.json
 var simple_default;
@@ -1634,7 +1640,7 @@ var init_simple = __esm({
             typescript: "^5.5.0"
           },
           engines: {
-            node: "22.x"
+            node: "22.x || 24.x"
           }
         },
         "node_modules/@dashai/sdk": {
@@ -2679,7 +2685,7 @@ var init_custom = __esm({
             typescript: "^5.5.0"
           },
           engines: {
-            node: "22.x"
+            node: "22.x || 24.x"
           }
         },
         "node_modules/@alloc/quick-lru": {
@@ -9990,7 +9996,7 @@ function manifestJson(opts) {
           // everything on the default — a warning on every column just trains
           // people to click through warnings.
           fields: [
-            { slug: "title", type: "text", human_edit: "open" },
+            { slug: "title", type: "text", primary: true, human_edit: "open" },
             { slug: "done", type: "boolean", human_edit: "guarded" }
           ]
         }
@@ -10017,9 +10023,10 @@ function packageJson(opts) {
       version: "0.0.1",
       private: true,
       type: "module",
-      engines: { node: "22.x" },
+      engines: { node: NODE_ENGINES },
       scripts: {
-        dev: "dashwise module dev",
+        dev: "dashwise dev",
+        "dev:watch": "dashwise module dev",
         "dev:next": "next dev",
         "dashwise:generate": "dashwise module generate",
         typecheck: "tsc --noEmit",
@@ -10235,7 +10242,7 @@ function appPageTsx(opts) {
           Module slug: <code>${escapeHtml(opts.slug)}</code>
         </p>
         <p style={{ marginTop: 24, color: '#64748b', fontSize: 14 }}>
-          Run <code>dashwise module dev</code> to start the watch loop.
+          Run <code>npm run dev</code> to start the app and the watch loop.
           <br />
           Edit <code>module.json</code> to add tables; regenerated types
           land in <code>@dashai/generated</code>.
@@ -10269,7 +10276,7 @@ debugger to Next), use the legacy two-terminal flow:
 
 \`\`\`bash
 dashwise module generate    # produces node_modules/@dashai/generated/
-dashwise module dev         # watch module.json + auto-regenerate
+npm run dev:watch           # watch module.json + auto-regenerate
 npm run dev:next            # plain Next.js dev server (in another terminal)
 \`\`\`
 
@@ -10314,7 +10321,7 @@ debugger to Next), use the legacy two-terminal flow:
 
 \`\`\`bash
 dashwise module generate    # produces node_modules/@dashai/generated/
-dashwise module dev         # watch + regen on module.json save (terminal 1)
+npm run dev:watch           # watch + regen on module.json save (terminal 1)
 npm run dev:next            # next dev on :3000                  (terminal 2)
 \`\`\`
 
@@ -11119,9 +11126,10 @@ function packageJsonCustom(opts) {
       version: "0.0.1",
       private: true,
       type: "module",
-      engines: { node: "22.x" },
+      engines: { node: NODE_ENGINES },
       scripts: {
-        dev: "dashwise module dev",
+        dev: "dashwise dev",
+        "dev:watch": "dashwise module dev",
         "dev:next": "next dev",
         "dashwise:generate": "dashwise module generate",
         typecheck: "tsc --noEmit",
@@ -12206,7 +12214,9 @@ function claudeMd(opts) {
 Instructions for AI coding agents (Claude Code, Cursor, etc.) working
 in this Dashwise module. Read this before making changes.
 
-${opts.cloudReady === false ? "" : cloudAgentInstructions()}
+Every table declares exactly one primary field (the row's name everywhere in Dashwise).
+
+${opts.cloudReady === false ? "" : cloudAgentInstructions() + "\n" + claudeCloudNote(opts.apiUrl)}
 ## What this module is
 
 A Dashwise ${isCustom ? "**custom Next.js** module (full app runtime, machine-class)" : "**hand-authored simple** module (isolate runtime)"} authored against \`@dashai/sdk\`.
@@ -12350,17 +12360,18 @@ which calls the schema endpoints and rewrites the local
 Common commands:
 
 \`\`\`
-dashwise table create <slug> --field <slug:type[:required]>
+dashwise table create <slug> --field title:text:primary
 dashwise table delete <slug>
 dashwise field add <table> <slug:type[:required]>
 dashwise field remove <table> <slug>
 dashwise field set-type <table> <slug> <type>
 \`\`\`
 
-Allowed field types (18): \`text\`, \`long_text\`, \`number\`, \`boolean\`,
+Allowed field types (21): \`text\`, \`long_text\`, \`number\`, \`boolean\`,
 \`date\`, \`datetime\`, \`single_select\`, \`multi_select\`,
 \`link_row\`, \`file\`, \`multi_file\`, \`email\`, \`url\`,
-\`phone\`, \`formula\`, \`ai\`, \`uuid\`, \`jsonb\`.
+\`phone\`, \`formula\`, \`ai\`, \`uuid\`, \`jsonb\`,
+\`rating\`, \`duration\`, \`autonumber\`.
 
 ### \`human_edit\` \u2014 who may hand-edit each column
 
@@ -12614,7 +12625,7 @@ what tables it owns.
 
 | Table | Columns | Notes |
 |---|---|---|
-| \`items\` | \`title:text\`, \`done:boolean\` | seeded example \u2014 edit or replace; \`dashwise table create <slug> --field <slug:type>\` adds more |
+| \`items\` | \`title:text:primary\`, \`done:boolean\` | seeded example \u2014 edit or replace; \`dashwise table create <slug> --field title:text:primary\` adds more |
 
 ## API / contract
 
@@ -12742,21 +12753,153 @@ primary_region = "iad"
 `;
 }
 function cloudAgentInstructions() {
-  return `## Cloud workflow
+  return `## Default way of working
+
+These are defaults. When the person you work for says otherwise (in the chat,
+or in their own \`CLAUDE.md\` / \`AGENTS.md\`), follow them instead.
+
+- Assume the person is not a developer. Before and after each step, say in one
+  or two plain sentences what you are doing and why, for example "I'm saving
+  your changes so Dashwise can see them." When a term like branch or pull
+  request is unavoidable, explain it in a few words.
+- You handle git. Get the finished work onto the repository's default branch
+  (usually \`main\`) yourself, so the person, Dashwise and the next agent all
+  see the latest version. The person needs no git, branch or pull request
+  knowledge:
+  - Working locally on the person's computer: commit on the default branch and push it.
+  - Working in the cloud (Codex cloud, Claude Code on the web): if your tool
+    lets you push to the default branch or merge your own pull request, do it
+    once the checks pass. If it only lets you push a branch, push it and tell the
+    person in plain words that the changes are saved and that Release in
+    Dashwise includes them. Don't ask them to merge anything.
+- Never force-push and never rewrite the default branch's history.
+- The person only confirms Release and Take live in Dashwise. When the work is
+  pushed, tell them it is ready: in Dashwise open the module, click Release,
+  then Take live.
+
+## Cloud workflow
 
 - Read \`module.json\`, the task and \`spec.md\` first. Preserve module identity and permission checks.
-- Use Node 22 in the provider environment (\`.nvmrc\` / \`.node-version\`). From the repository root run \`bash scripts/cloud-setup.sh\`.
+- Use Node 22 or 24 (\`.nvmrc\` prefers 22; Codex's default 24 works too). From the repository root run \`bash scripts/cloud-setup.sh\`.
 - After edits run \`npm run typecheck\`, \`npm test\`, \`npm run build\`, then \`npm run smoke:production\`. Add behavior tests for your changes. A dev server does not prove production readiness.
 - Update \`spec.md\` for behavior changes and \`agent-log.md\` in the same commit. Read \`CLAUDE.md\` for SDK, authorization and UI conventions.
-- Work on one branch and push it. Report the pushed SHA and checks, including failures. No user merge is required for Dashwise to receive the branch.
-- Never print, persist or commit secrets. Repository code delivery needs no Dashwise token. Do not log in or access company data for setup or checks.
+- \`npm run smoke:production\` starts the built app on a local loopback port. If a cloud sandbox refuses that port, rerun the command with the network permission; never skip the check.
+- Report what you changed, the pushed SHA and the checks you ran, including failures, in plain words.
+- Never print, persist or commit secrets. Repository code delivery needs no Dashwise token. Do not log in or access company data for setup or checks; see "Dashwise login" for full development.
 - Never automatically release, publish, deploy or take an installation live. Release and Live require an explicit human action.
+- Even when the person says you may release, you can't do it for them: tell them in one sentence where to click (in Dashwise open the module, click Release, then Take live). Never ask for a \`dashwise login\` or a token just to release.
+
+## If you can't see the repository
+
+Connecting GitHub in the AI tool is not enough for a private repository. Tell
+the person, in plain words, to also install the tool's GitHub app on the GitHub
+organisation that owns this repository and give it access to this repository
+(an organisation owner may have to approve it), then start the task again:
+
+- Claude: the Claude GitHub app, https://github.com/apps/claude
+- Codex: the ChatGPT Codex Connector, https://github.com/apps/chatgpt-codex-connector
+
+## Dashwise login (only for full development)
+
+The checks (\`npm run typecheck\`, \`npm test\`, \`npm run build\`,
+\`npm run smoke:production\`) need no login. Full Dashwise development does:
+\`npm run dev\` (\`dashwise dev\`: the app plus the watcher), \`dashwise module
+generate\` and the schema commands. When the task needs them:
+
+- If \`dashwise\` is not installed, run \`npm install -g @dashai/cli@latest\`.
+- Ask the person once, in plain words, for example: "To run your module
+  against Dashwise I need to sign in as you. I'll show you a code and a link;
+  open the link and approve." Then run \`dashwise login --no-prompt\` and show
+  them the code and link it prints. The login acts with the person's own rights.
+- Keep the login outside the repository. In the cloud, run CLI commands with
+  \`XDG_CONFIG_HOME=/tmp/dashwise-config\` so the saved login lands in
+  \`/tmp\`, never in the checkout.
+- Never write a token into a script, a file in the repository, a commit, an
+  environment setup script or snapshot, or a log.
+- In the cloud, run CLI commands with \`NODE_USE_ENV_PROXY=1\` so the CLI
+  uses the environment's network proxy (newer CLI versions do this on their own).
+- A cloud environment forgets the login when it restarts; ask again only when
+  a command reports that the login is missing.
+`;
+}
+function companyApiHost(apiUrl) {
+  if (!apiUrl) return null;
+  try {
+    const host = new URL(apiUrl).host;
+    return host in HOSTED_API_HOSTS ? host : null;
+  } catch {
+    return null;
+  }
+}
+function apiHostLine(apiUrl) {
+  const host = companyApiHost(apiUrl);
+  return host ? `\`${host}\` (this company's Dashwise API; the company uses Dashwise at ${HOSTED_API_HOSTS[host]})` : "the company's Dashwise API host: `api.dashwise.net` if the person opens Dashwise at app.dashwise.net, `api.dashwise.dev` if at app.dashwise.dev. If you can't tell, ask them which address they use";
+}
+function codexEnvironmentInstructions(apiUrl) {
+  const host = companyApiHost(apiUrl);
+  const apiUrlValue = host ? `https://${host}` : "https://<the company API host above>";
+  return `## Codex cloud environment
+
+When the person asks you to set up the Codex cloud environment for this
+repository, use exactly these settings. Show each one to the person and say in
+one sentence what it is for.
+
+| Setting | Value |
+|---|---|
+| Node.js | 22 or 24 (24 is Codex's default and works; \`.nvmrc\` prefers 22) |
+| Setup script | \`if [ -f scripts/cloud-setup.sh ]; then bash scripts/cloud-setup.sh; else echo "No Dashwise template yet, setup skipped"; fi\` |
+| Agent internet access | On: keep the "package managers" preset and add only the company's Dashwise API host (below) |
+| Environment variables | \`DASHWISE_API_URL=${apiUrlValue}\`, \`NODE_USE_ENV_PROXY=1\` |
+| Secrets | none |
+
+Set the network access before you start the setup, so the first run can
+already install packages. The preset covers npm and GitHub; the one added
+domain is:
+
+- ${apiHostLine(apiUrl)}
+
+The module and the CLI talk to the company's Dashwise API. Do not add other
+Dashwise hosts. If the environment offers no preset, allow exactly
+${CLOUD_ALLOWED_HOSTS.map((h) => `\`${h}\``).join(", ")} plus that host.
+
+The setup script checks Node 22 or 24 and installs the exact dependencies with
+\`npm ci\`. The guard lets a first run pass while the repository holds only a
+README.
+
+Never add secrets: no \`dwk_\` module key, no \`dwc_\` CLI token and no password,
+and never put a \`dashwise login\` into the setup script. Delivering code needs
+none of them; for full development see "Dashwise login".
+
+To check the environment, run \`npm run typecheck\`, \`npm test\`,
+\`npm run build\` and \`npm run smoke:production\`. If one fails because of a
+setting, fix the setting; otherwise report the failure in plain words.
+
+If the repository has no \`package.json\` yet (only a README), skip these
+checks: the setup script already skipped installing, and the first task adds
+the template. Tell the person the settings are ready.
+
+When the checks pass, or were skipped for a README-only repository, tell the
+person: "The environment works. Click Publish to save it for your next tasks."
+Publishing is their click.
+`;
+}
+function claudeCloudNote(apiUrl) {
+  const host = companyApiHost(apiUrl);
+  return `## Claude cloud
+
+Claude Code on the web has no environment setup chat. It reads this repository
+and \`CLAUDE.md\`, and \`.claude/settings.json\` runs \`scripts/cloud-setup.sh\`
+when a cloud session starts. Node 22 or 24 both work. If
+the environment has a network setting, allow the same domains as for Codex:
+${CLOUD_ALLOWED_HOSTS.map((h) => `\`${h}\``).join(", ")} and ${host ? `\`${host}\`` : "the company's Dashwise API host (`api.dashwise.net` for app.dashwise.net, `api.dashwise.dev` for app.dashwise.dev)"}. No secrets.
 `;
 }
 function agentsMd(opts) {
   return `# ${opts.name}: agent instructions
 
-` + cloudAgentInstructions();
+Every table declares exactly one primary field (the row's name everywhere in Dashwise).
+
+` + cloudAgentInstructions() + "\n" + codexEnvironmentInstructions(opts.apiUrl) + "\n" + claudeCloudNote(opts.apiUrl);
 }
 function nodeVersion() {
   return "22\n";
@@ -12778,9 +12921,12 @@ fi
 repo_root="$(cd -- "$(dirname -- "\${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 fail() { printf 'cloud-setup: %s\\n' "$1" >&2; exit 1; }
-command -v node >/dev/null 2>&1 || fail 'Node 22 is required. Select Node 22 in your cloud environment, then retry.'
-[[ "$(node -p 'process.versions.node.split(".")[0]')" == "22" ]] || fail 'Node 22 is required. Select Node 22 in your cloud environment, then retry. A subshell-only runtime change will not persist into agent commands.'
-command -v npm >/dev/null 2>&1 || fail 'npm is required with Node 22.'
+command -v node >/dev/null 2>&1 || fail 'Node 22 or 24 is required. Select Node 22 or 24 in your cloud environment, then retry.'
+case "$(node -p 'process.versions.node.split(".")[0]')" in
+  22|24) ;;
+  *) fail 'Node 22 or 24 is required. Select Node 22 or 24 in your cloud environment, then retry. A subshell-only runtime change will not persist into agent commands.' ;;
+esac
+command -v npm >/dev/null 2>&1 || fail 'npm is required with Node 22 or 24.'
 [[ -f package-lock.json && -f package.json ]] || fail 'Missing package.json or committed package-lock.json. Run this from a complete repository checkout.'
 
 # Only the Claude startup/resume path reuses an unchanged install. Explicit
@@ -12788,15 +12934,21 @@ command -v npm >/dev/null 2>&1 || fail 'npm is required with Node 22.'
 stamp="$(node --input-type=module -e 'import {createHash} from "node:crypto"; import {readFileSync} from "node:fs"; const hash=createHash("sha256"); for (const path of ["package.json", "package-lock.json", "scripts/cloud-setup.sh"]) hash.update(readFileSync(path)); hash.update(process.version); hash.update(process.platform); hash.update(process.arch); process.stdout.write(hash.digest("hex"));')"
 stamp_file="node_modules/.dashwise-cloud-setup"
 if [[ "\${1:-}" == "--claude" && -f "$stamp_file" && "$(cat "$stamp_file")" == "$stamp" && -x node_modules/.bin/next && -x node_modules/.bin/tsc && -f node_modules/@dashai/sdk/package.json ]]; then
-  printf 'cloud-setup: dependencies already match Node 22 and the lockfile.\\n'
+  printf 'cloud-setup: dependencies already match this Node version and the lockfile.\\n'
   exit 0
 fi
 # Keep install output out of session logs: third-party lifecycle scripts may
 # echo environment variables. npm's own detailed logs stay in its local cache.
 rm -f "$stamp_file"
-npm ci --include=dev --no-audit --no-fund > /dev/null 2>&1 || fail 'npm ci failed. Check the committed lockfile, Node 22 and network access to registry.npmjs.org. Review npm logs privately; never paste credentials.'
+# Some sandboxes mount HOME read-only; npm then cannot write its cache.
+npm_cache="\${npm_config_cache:-\${HOME:-}/.npm}"
+if ! { mkdir -p "$npm_cache" 2>/dev/null && [[ -w "$npm_cache" ]]; }; then
+  export npm_config_cache="\${TMPDIR:-/tmp}/npm-cache"
+  printf 'cloud-setup: %s is not writable, using %s for the npm cache.\\n' "$npm_cache" "$npm_config_cache"
+fi
+npm ci --include=dev --no-audit --no-fund > /dev/null 2>&1 || fail 'npm ci failed. Check the committed lockfile, Node 22 or 24 and network access to registry.npmjs.org. Review npm logs privately; never paste credentials.'
 printf '%s' "$stamp" > "$stamp_file"
-printf 'cloud-setup: dependencies installed with Node 22.\\n'
+printf 'cloud-setup: dependencies installed with Node %s.\\n' "$(node -p 'process.versions.node')"
 `;
 }
 function claudeSettingsJson() {
@@ -12952,7 +13104,7 @@ function cloudReadme() {
   return `
 ## Cloud builders
 
-Use Node 22 (the root runtime pins) and run \`bash scripts/cloud-setup.sh\`.
+Use Node 22 (the root runtime pins; 24 also works) and run \`bash scripts/cloud-setup.sh\`.
 Commit \`package-lock.json\` after any dependency change; setup uses \`npm ci\`.
 Checks: \`npm run typecheck\`, \`npm test\`, \`npm run build\`, \`npm run smoke:production\`.
 The smoke command starts the built server, probes anonymous API denial and stops
@@ -12961,33 +13113,49 @@ The example uses \`lib/items.ts\` directly against the SDK, so a fresh checkout
 can build without authenticated code generation. Keep it aligned with the
 example table, or replace it when you author your schema.
 
-Codex: select Node 22 in the provider environment and use
-\`bash scripts/cloud-setup.sh\` as setup/maintenance. GitHub authorization and
-the cloud environment are configured in the provider; these repo files do
-not create an environment or authorize your account.
+Codex: \`AGENTS.md\` \u2192 "Codex cloud environment" lists the exact settings
+(Node 22 or 24, setup script, network, \`DASHWISE_API_URL\`, no secrets);
+Codex's environment setup chat can follow it, then you click Publish. GitHub
+authorization is configured in the provider: install the ChatGPT Codex
+Connector on your GitHub organisation so Codex can see a private repository.
 
 Claude Code web: \`.claude/settings.json\` ships a cloud-only SessionStart
 hook for startup/resume. It calls \`bash "$CLAUDE_PROJECT_DIR"/scripts/cloud-setup.sh --claude\`;
 local sessions skip installation and unchanged cloud installs reuse dependencies.
-Select Node 22 in the environment; do not rely on a setup subshell changing the
+Select Node 22 or 24 in the environment; do not rely on a setup subshell changing the
 runtime of later agent commands. The same script can be used in the environment
 setup field. Allow \`registry.npmjs.org\` for installs (Claude's Trusted list).
 The [official hook recipe](https://code.claude.com/docs/en/cloud-environments#install-dependencies-with-a-sessionstart-hook)
 explains startup and cache behavior.
 
-Read \`AGENTS.md\` / \`CLAUDE.md\`, work on one branch and push. Release and Live
-remain human actions. No Dashwise token is needed for repository code delivery.
+Read \`AGENTS.md\` / \`CLAUDE.md\`. By default agents get the work onto the
+default branch themselves and explain each step in plain words; Release in
+Dashwise includes work an agent could only push to a branch. Release and Live
+remain human actions. No Dashwise token is needed for
+repository code delivery.
 `;
 }
-var DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, MODULE_SLUG_REGEX;
+var NODE_ENGINES, DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, MODULE_SLUG_REGEX, CLOUD_ALLOWED_HOSTS, HOSTED_API_HOSTS;
 var init_scaffold = __esm({
   "src/lib/scaffold.ts"() {
     init_sdk_version();
     init_simple();
     init_custom();
+    NODE_ENGINES = "22.x || 24.x";
     DEPLOY_TARGETS = ["railway", "vercel", "fly"];
     SCAFFOLD_DEFAULT_API_URL = "http://localhost:3000";
     MODULE_SLUG_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
+    CLOUD_ALLOWED_HOSTS = [
+      "registry.npmjs.org",
+      "github.com",
+      "api.github.com",
+      "raw.githubusercontent.com",
+      "codeload.github.com"
+    ];
+    HOSTED_API_HOSTS = {
+      "api.dashwise.dev": "app.dashwise.dev",
+      "api.dashwise.net": "app.dashwise.net"
+    };
   }
 });
 function isFreshCloneEntry(name) {
@@ -13065,7 +13233,7 @@ function canAdoptCloudFiles(dir, templatePackage) {
     if (lock.lockfileVersion !== 2 && lock.lockfileVersion !== 3 || !root) {
       return false;
     }
-    if (pkg.engines?.node !== "22.x" || !pkg.scripts || !expected.scripts) {
+    if (pkg.engines?.node !== "22.x" && pkg.engines?.node !== expected.engines?.node || !pkg.scripts || !expected.scripts) {
       return false;
     }
     for (const script of ["typecheck", "test", "build", "start", "smoke:production"]) {
@@ -13168,12 +13336,14 @@ async function moduleInitCommand(slugArg, options) {
   const templatePackage = (kind === "custom" ? packageJsonCustom : packageJson)({
     slug});
   const cloudReady = writeMode === "all" || canAdoptCloudFiles(dir, templatePackage);
+  const companyApiUrl = resolveExplicitApiUrl();
   const scaffoldOpts = {
     cloudReady,
     slug,
     name,
     kind,
-    ...options.git !== void 0 ? { repositoryUrl: options.git } : {}
+    ...options.git !== void 0 ? { repositoryUrl: options.git } : {},
+    ...companyApiUrl !== null ? { apiUrl: companyApiUrl } : {}
   };
   const scaffoldApiUrl = resolveApiUrl();
   const files = [
@@ -13371,7 +13541,7 @@ async function moduleInitCommand(slugArg, options) {
 
   ${dim("   (or, for the two-terminal flow:")}
   ${dim("     dashwise module generate")}              ${dim("# materialize typed wrappers")}
-  ${dim("     dashwise module dev")}                   ${dim("# watch + auto-regenerate")}
+  ${dim("     npm run dev:watch")}                     ${dim("# watch + auto-regenerate")}
   ${dim("     npm run dev:next                        # next dev on :3000)")}
 ${devInstall ? `
   ${dim(`Dev installation id=${devInstall.installation.id}; API key expires ${devInstall.api_key_expires_at}.`)}
@@ -14023,6 +14193,16 @@ function printApplySummary(applied) {
   const updated = asArray(applied.tables_updated);
   const removed = asArray(applied.tables_removed);
   success(`Manifest applied to the dev install.`);
+  for (const warning of asArray(applied.warnings)) {
+    const message = strProp(warning, "message");
+    if (!message) continue;
+    const warningCode = strProp(warning, "code");
+    const table = strProp(warning, "table");
+    const field = strProp(warning, "field");
+    const location = table ? `${table}${field ? `.${field}` : ""}` : field;
+    const prefix = [warningCode, location].filter(Boolean).join(" ");
+    warn(`${prefix ? `${code(prefix)}: ` : ""}${message}`);
+  }
   if (created.length === 0 && updated.length === 0 && removed.length === 0) {
     info(dim("No table changes (metadata-only or already in sync)."));
     return;
@@ -14132,6 +14312,76 @@ var init_push = __esm({
   }
 });
 
+// ../sdk/dist/index.js
+function primaryDeclarationIssues(table) {
+  const invalid = table.fields.findIndex(
+    (field2) => field2.primary !== void 0 && field2.primary !== true
+  );
+  if (invalid !== -1) {
+    return [
+      { path: ["fields", invalid, "primary"], message: "primary must be literal true or omitted" }
+    ];
+  }
+  const marked = table.fields.filter((field2) => field2.primary === true);
+  if (marked.length !== 1) {
+    return [
+      {
+        path: ["fields"],
+        message: `Table ${table.slug}: mark exactly one field as primary: true (the row's label in links, pickers, titles)`
+      }
+    ];
+  }
+  const field = marked[0];
+  const path = ["fields", table.fields.indexOf(field), "primary"];
+  if (field.type === "formula") {
+    return [{ path, message: "formula fields cannot be the primary of a module table yet" }];
+  }
+  if (!PRIMARY_TYPES.has(field.type)) {
+    return [
+      {
+        path,
+        message: `Table ${table.slug}: mark a field that can be the primary with primary: true (${field.slug} of type ${field.type} cannot be primary)`
+      }
+    ];
+  }
+  return [];
+}
+function weakPrimaryWarning(table) {
+  const field = table.fields.find((field2) => field2.primary === true);
+  if (!field || !WEAK_PRIMARY_TYPES.has(field.type)) return void 0;
+  return `${field.slug} is a weak row label; prefer a short text field such as a name or title`;
+}
+var PRIMARY_TYPES, WEAK_PRIMARY_TYPES;
+var init_dist = __esm({
+  "../sdk/dist/index.js"() {
+    PRIMARY_TYPES = /* @__PURE__ */ new Set([
+      "text",
+      "long_text",
+      "number",
+      "date",
+      "datetime",
+      "single_select",
+      "multi_select",
+      "email",
+      "url",
+      "phone",
+      "rating",
+      "duration",
+      "autonumber"
+    ]);
+    WEAK_PRIMARY_TYPES = /* @__PURE__ */ new Set([
+      "single_select",
+      "multi_select",
+      "number",
+      "rating",
+      "duration",
+      "date",
+      "datetime",
+      "autonumber"
+    ]);
+  }
+});
+
 // src/lib/field-spec.ts
 function parseFieldSpec(spec) {
   const parts = spec.split(":");
@@ -14186,6 +14436,7 @@ function parseFieldSpec(spec) {
         );
       }
       if (flag === "required") result.required = true;
+      if (flag === "primary") result.primary = true;
     }
   }
   if ((type === "single_select" || type === "multi_select") && result.options === void 0) {
@@ -14228,6 +14479,9 @@ function parseFieldJson(json) {
       `--field-json missing or invalid ${quote("type")}. Allowed: ${FIELD_TYPES.join(", ")}.`
     );
   }
+  if (o.primary !== void 0 && o.primary !== true) {
+    throw new FieldSpecError("primary must be literal true or omitted");
+  }
   return o;
 }
 function quote(s) {
@@ -14240,6 +14494,9 @@ var init_field_spec = __esm({
       "text",
       "long_text",
       "number",
+      "rating",
+      "duration",
+      "autonumber",
       "boolean",
       "date",
       "datetime",
@@ -14255,7 +14512,7 @@ var init_field_spec = __esm({
       "ai"
     ];
     SLUG_REGEX = /^[a-z][a-z0-9_]*[a-z0-9]$/;
-    KNOWN_FLAGS = /* @__PURE__ */ new Set(["required"]);
+    KNOWN_FLAGS = /* @__PURE__ */ new Set(["required", "primary"]);
     DECIMALS_FLAG_REGEX = /^\d+$/;
     MAX_DECIMAL_PLACES = 10;
     FieldSpecError = class extends Error {
@@ -14276,7 +14533,7 @@ __export(create_exports, {
 });
 async function tableCreateCommand(slug, options) {
   if (!slug) {
-    fail("Usage: `dashwise table create <slug> --field <slug>:<type>[:required] [...]`");
+    fail("Usage: `dashwise table create <slug> --field <slug>:<type>[:primary,required] [...]`");
     return 1;
   }
   const fields = [];
@@ -14308,6 +14565,15 @@ async function tableCreateCommand(slug, options) {
     }
     seen.add(f.slug);
   }
+  const table = { slug, fields };
+  const issues = primaryDeclarationIssues(table);
+  if (issues.length > 0) {
+    for (const issue of issues) fail(issue.message);
+    info("Mark the row name explicitly, e.g. --field title:text:primary.");
+    return 1;
+  }
+  const primaryWarning = weakPrimaryWarning(table);
+  if (primaryWarning) warn(primaryWarning);
   let ctx;
   try {
     ctx = loadSchemaCommandContext({
@@ -14400,6 +14666,7 @@ function surfaceFailure(err) {
 }
 var init_create = __esm({
   "src/commands/table/create.ts"() {
+    init_dist();
     init_manifest_io();
     init_api_client();
     init_manifest_merge();
@@ -14619,6 +14886,26 @@ var init_set_type = __esm({
   }
 });
 
+// src/lib/env-proxy.ts
+var PROXY_VARS = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
+function hasProxyEnv(env = process.env) {
+  return PROXY_VARS.some((name) => Boolean(env[name]?.trim()));
+}
+async function installEnvProxy(env = process.env) {
+  if (!hasProxyEnv(env)) return false;
+  const undici = await import('undici');
+  undici.setGlobalDispatcher(new undici.EnvHttpProxyAgent());
+  Object.assign(globalThis, {
+    fetch: undici.fetch,
+    FormData: undici.FormData,
+    Headers: undici.Headers,
+    Request: undici.Request,
+    Response: undici.Response
+  });
+  env.NODE_USE_ENV_PROXY ??= "1";
+  return true;
+}
+
 // src/lib/excess-args.ts
 init_output();
 var SMART_DASH_RE = /^[‒–—―−]/;
@@ -15021,6 +15308,440 @@ function toMe(cached) {
   };
 }
 
+// src/commands/doctor.ts
+init_api_client();
+init_config();
+init_output();
+init_sdk_version();
+var MIN_NODE = [20, 18, 1];
+var CLOUD_FILES = [
+  "scripts/cloud-setup.sh",
+  ".claude/settings.json",
+  "AGENTS.md",
+  "CLAUDE.md"
+];
+async function doctorCommand(options, deps) {
+  const checks = await runDoctorChecks(resolve(options.dir ?? process.cwd()), deps);
+  const ok = !checks.some((c2) => c2.status === "fail");
+  if (options.json) {
+    out(JSON.stringify({ ok, checks }, null, 2));
+  } else {
+    for (const c2 of checks) {
+      out(`${badge(c2.status)} ${c2.label}: ${c2.detail}`);
+      if (c2.fix) out(`    ${dim("\u2192")} ${c2.fix}`);
+    }
+    const fails = checks.filter((c2) => c2.status === "fail").length;
+    const warns = checks.filter((c2) => c2.status === "warn").length;
+    out("");
+    out(
+      fails === 0 && warns === 0 ? pc.green("Everything looks good.") : `${fails} problem${fails === 1 ? "" : "s"}, ${warns} warning${warns === 1 ? "" : "s"}.`
+    );
+  }
+  return ok ? 0 : 1;
+}
+async function runDoctorChecks(dir, deps) {
+  const checks = [];
+  const apiUrl = resolveApiUrl();
+  checks.push(targetCheck(apiUrl));
+  const cfg = safeReadConfig2();
+  let signedIn = false;
+  if (!cfg?.token) {
+    checks.push({
+      id: "login",
+      label: "Login",
+      status: "fail",
+      detail: "not signed in",
+      fix: `Run ${code("dashwise login")}.`
+    });
+    checks.push(await connectionOnly(apiUrl));
+  } else {
+    try {
+      const me = await apiRequest("GET", "/api/auth/me");
+      signedIn = true;
+      checks.push({
+        id: "login",
+        label: "Login",
+        status: "ok",
+        detail: `signed in as ${me.email}`
+      });
+      checks.push({
+        id: "connection",
+        label: "Connection",
+        status: "ok",
+        detail: `${apiUrl} answers`
+      });
+    } catch (err) {
+      if (err instanceof ApiError && err.code === "NETWORK_ERROR") {
+        checks.push({
+          id: "login",
+          label: "Login",
+          status: "skip",
+          detail: "not checked, Dashwise is not reachable"
+        });
+        checks.push(unreachable(apiUrl));
+      } else if (err instanceof ApiError && err.status === 401) {
+        checks.push({
+          id: "login",
+          label: "Login",
+          status: "fail",
+          detail: "the saved login is expired or was revoked",
+          fix: `Run ${code("dashwise login")} again.`
+        });
+        checks.push({
+          id: "connection",
+          label: "Connection",
+          status: "ok",
+          detail: `${apiUrl} answers`
+        });
+      } else {
+        checks.push({
+          id: "login",
+          label: "Login",
+          status: "fail",
+          detail: `could not check the login (${err.message})`,
+          fix: `Try again; if it stays, run ${code("dashwise login")}.`
+        });
+        checks.push({
+          id: "connection",
+          label: "Connection",
+          status: "warn",
+          detail: `${apiUrl} answered with an error`
+        });
+      }
+    }
+  }
+  checks.push(nodeCheck(deps.nodeVersion));
+  checks.push(
+    await versionCheck(
+      "cli",
+      "Dashwise CLI",
+      deps.cliVersion,
+      await deps.latestVersion("@dashai/cli"),
+      `Run ${code("npx @dashai/cli@latest <command>")} or ${code("npm install -g @dashai/cli@latest")}.`
+    )
+  );
+  const manifestPath2 = join(dir, "module.json");
+  if (!existsSync(manifestPath2)) {
+    checks.push({
+      id: "module",
+      label: "Module",
+      status: "skip",
+      detail: `no ${code("module.json")} here, so the module checks were skipped`,
+      fix: `Run ${code("dashwise doctor")} inside a module folder to check it too.`
+    });
+    return checks;
+  }
+  let parsed = false;
+  let manifest = null;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath2, "utf-8"));
+    parsed = true;
+  } catch (err) {
+    checks.push({
+      id: "module",
+      label: "module.json",
+      status: "fail",
+      detail: `cannot be read: ${err.message}`,
+      fix: `Fix the JSON in ${code("module.json")}.`
+    });
+  }
+  const header = manifest !== null && typeof manifest === "object" ? manifest.module : void 0;
+  const slug = typeof header?.slug === "string" ? header.slug : null;
+  if (parsed) checks.push(await manifestCheck(manifest, signedIn));
+  const sdk = readInstalledSdk(dir);
+  checks.push(
+    sdk ? await versionCheck(
+      "sdk",
+      "Dashwise SDK",
+      sdk.version,
+      await deps.latestVersion("@dashai/sdk"),
+      `Run ${code("npm install @dashai/sdk@latest")}.`
+    ) : {
+      id: "sdk",
+      label: "Dashwise SDK",
+      status: "warn",
+      detail: "not installed in this folder",
+      fix: `Run ${code("npm install")}.`
+    }
+  );
+  checks.push(await repoCheck(dir, slug, signedIn, deps));
+  const missing = CLOUD_FILES.filter((f) => !existsSync(join(dir, f)));
+  checks.push(
+    missing.length === 0 ? {
+      id: "cloud-setup",
+      label: "Cloud setup files",
+      status: "ok",
+      detail: "present (cloud agents can set up this module)"
+    } : {
+      id: "cloud-setup",
+      label: "Cloud setup files",
+      status: "warn",
+      detail: `missing: ${missing.join(", ")}`,
+      fix: `Copy them from a fresh ${code("dashwise init")} of the template, so Claude Code web and Codex cloud can set this module up.`
+    }
+  );
+  return checks;
+}
+function targetCheck(apiUrl) {
+  const source = process.env.DASHWISE_API_URL?.trim() ? "from DASHWISE_API_URL" : "from your saved login";
+  if (sameOrigin(apiUrl, KNOWN_API_URLS.prod)) {
+    return {
+      id: "target",
+      label: "Target",
+      status: "warn",
+      detail: `PRODUCTION (${apiUrl}, ${source}). Commands here change real company data.`,
+      fix: `To build against dev, run ${code(`dashwise login --api-url ${KNOWN_API_URLS.dev}`)} or set ${code(`DASHWISE_API_URL=${KNOWN_API_URLS.dev}`)}.`
+    };
+  }
+  if (sameOrigin(apiUrl, KNOWN_API_URLS.dev)) {
+    return {
+      id: "target",
+      label: "Target",
+      status: "ok",
+      detail: `dev (${apiUrl}, ${source})`
+    };
+  }
+  return {
+    id: "target",
+    label: "Target",
+    status: "ok",
+    detail: `custom (${apiUrl}, ${source})`
+  };
+}
+async function connectionOnly(apiUrl) {
+  try {
+    await apiRequest("GET", "/api/auth/me", void 0, { auth: "public" });
+  } catch (err) {
+    if (err instanceof ApiError && err.code === "NETWORK_ERROR") {
+      return unreachable(apiUrl);
+    }
+  }
+  return {
+    id: "connection",
+    label: "Connection",
+    status: "ok",
+    detail: `${apiUrl} answers`
+  };
+}
+function unreachable(apiUrl) {
+  return {
+    id: "connection",
+    label: "Connection",
+    status: "fail",
+    detail: `cannot reach ${apiUrl}`,
+    fix: "Check your network, VPN or proxy, and that the address is right."
+  };
+}
+function nodeCheck(version) {
+  const parts = version.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10));
+  let supported = parts.length === 3 && parts.every(Number.isFinite);
+  for (let i = 0; supported && i < 3; i++) {
+    if (parts[i] !== MIN_NODE[i]) {
+      supported = parts[i] > MIN_NODE[i];
+      break;
+    }
+  }
+  return supported ? { id: "node", label: "Node", status: "ok", detail: version } : {
+    id: "node",
+    label: "Node",
+    status: "fail",
+    detail: `${version} is too old`,
+    fix: `Install Node ${MIN_NODE.join(".")} or newer (the template pins Node 22).`
+  };
+}
+async function versionCheck(id, label, installed, latest, fix) {
+  if (!latest) {
+    return {
+      id,
+      label,
+      status: "ok",
+      detail: `${installed} (could not look up the newest version)`
+    };
+  }
+  return compareVersions(installed, latest) < 0 ? {
+    id,
+    label,
+    status: "warn",
+    detail: `${installed}, newest is ${latest}`,
+    fix
+  } : { id, label, status: "ok", detail: `${installed} (newest)` };
+}
+async function manifestCheck(manifest, signedIn) {
+  if (manifest === null || typeof manifest !== "object" || Array.isArray(manifest)) {
+    return {
+      id: "module",
+      label: "module.json",
+      status: "fail",
+      detail: "is not a JSON object",
+      fix: `Run ${code("dashwise module validate")} and fix ${code("module.json")}.`
+    };
+  }
+  if (!signedIn) {
+    return {
+      id: "module",
+      label: "module.json",
+      status: "ok",
+      detail: "readable (not validated, you are not signed in)"
+    };
+  }
+  try {
+    await apiRequest("POST", "/api/modules/manifest/validate", manifest);
+    return {
+      id: "module",
+      label: "module.json",
+      status: "ok",
+      detail: "valid"
+    };
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 400) {
+      return {
+        id: "module",
+        label: "module.json",
+        status: "fail",
+        detail: `invalid: ${err.message}`,
+        fix: `Run ${code("dashwise module validate")} for the full list.`
+      };
+    }
+    return {
+      id: "module",
+      label: "module.json",
+      status: "warn",
+      detail: `not validated (${err.message})`
+    };
+  }
+}
+async function repoCheck(dir, slug, signedIn, deps) {
+  const origin = deps.gitOrigin(dir);
+  if (!slug || !signedIn) {
+    return {
+      id: "repository",
+      label: "Repository",
+      status: "skip",
+      detail: !slug ? `no module slug in ${code("module.json")}` : "not checked, you are not signed in"
+    };
+  }
+  let linked = null;
+  try {
+    const mod = await apiRequest(
+      "GET",
+      `/api/modules/by-slug/${encodeURIComponent(slug)}`
+    );
+    if (!("repository_url" in mod)) {
+      return {
+        id: "repository",
+        label: "Repository",
+        status: "warn",
+        code: "REPOSITORY_NOT_VISIBLE",
+        detail: `you cannot see the repository of ${code(slug)}: only its builders and owners in its company can`,
+        fix: "Ask one of the module owners to add you as a builder."
+      };
+    }
+    linked = mod.repository_url ?? null;
+  } catch (err) {
+    return {
+      id: "repository",
+      label: "Repository",
+      status: "warn",
+      detail: err instanceof ApiError && err.status === 404 ? `module ${code(slug)} is not found in this Dashwise` : `could not read the module (${err.message})`,
+      fix: "Check the target above and that you can build this module."
+    };
+  }
+  if (!linked) {
+    return {
+      id: "repository",
+      label: "Repository",
+      status: "warn",
+      code: "REPOSITORY_NOT_LINKED",
+      detail: "the module has no repository linked in Dashwise",
+      fix: "Link one on the module's Build tab in Dashwise."
+    };
+  }
+  if (!origin) {
+    return {
+      id: "repository",
+      label: "Repository",
+      status: "warn",
+      detail: `linked to ${linked}, but this folder has no git origin`,
+      fix: `Run ${code(`git remote add origin ${linked}.git`)}.`
+    };
+  }
+  return sameRepo(origin, linked) ? {
+    id: "repository",
+    label: "Repository",
+    status: "ok",
+    detail: `${linked} (matches git origin)`
+  } : {
+    id: "repository",
+    label: "Repository",
+    status: "warn",
+    detail: `git origin is ${origin}, Dashwise builds from ${linked}`,
+    fix: `Push to ${linked}, or link this repository on the module's Build tab.`
+  };
+}
+function repoKey(url) {
+  const m = /github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?\/?$/i.exec(url.trim());
+  return m ? `${m[1]}/${m[2]}`.toLowerCase() : null;
+}
+function sameRepo(a, b) {
+  const ka = repoKey(a);
+  return ka !== null && ka === repoKey(b);
+}
+function sameOrigin(a, b) {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return false;
+  }
+}
+function safeReadConfig2() {
+  try {
+    return readConfig();
+  } catch {
+    return null;
+  }
+}
+function badge(status) {
+  switch (status) {
+    case "ok":
+      return pc.green("\u2714");
+    case "warn":
+      return pc.yellow("!");
+    case "fail":
+      return pc.red("\u2716");
+    default:
+      return dim("-");
+  }
+}
+function defaultDoctorDeps(cliVersion) {
+  return {
+    cliVersion,
+    nodeVersion: process.version,
+    latestVersion: async (pkg) => {
+      try {
+        const res = await fetch(
+          `https://registry.npmjs.org/${pkg.replace("/", "%2f")}/latest`,
+          { signal: AbortSignal.timeout(4e3) }
+        );
+        if (!res.ok) return null;
+        const body = await res.json();
+        return typeof body.version === "string" ? body.version : null;
+      } catch {
+        return null;
+      }
+    },
+    gitOrigin: (dir) => {
+      try {
+        return execFileSync("git", ["remote", "get-url", "origin"], {
+          cwd: dir,
+          stdio: ["ignore", "pipe", "ignore"]
+        }).toString().trim() || null;
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+
 // src/commands/mcp.ts
 init_api_client();
 init_config();
@@ -15145,8 +15866,8 @@ function startMcpProxy(opts) {
   let streamUnavailable = false;
   let streamStarted = false;
   let resolveDone;
-  const done = new Promise((resolve14) => {
-    resolveDone = resolve14;
+  const done = new Promise((resolve15) => {
+    resolveDone = resolve15;
   });
   const trace = (line) => {
     if (verbose) log2(line);
@@ -15632,7 +16353,7 @@ async function revokeSession(endpointId) {
     () => false
   );
   const timeout = new Promise(
-    (resolve14) => setTimeout(() => resolve14(false), REVOKE_TIMEOUT_MS).unref()
+    (resolve15) => setTimeout(() => resolve15(false), REVOKE_TIMEOUT_MS).unref()
   );
   await Promise.race([attempt, timeout]);
 }
@@ -15810,7 +16531,7 @@ async function mcpAddCommand(options = {}) {
     fail(`Could not run \`claude\`: ${target.refused} Run the command above yourself.`);
     return 1;
   }
-  return await new Promise((resolve14) => {
+  return await new Promise((resolve15) => {
     const child = spawn(target.command, target.args, { shell: target.shell, stdio: "inherit" });
     let settled = false;
     child.on("error", (err) => {
@@ -15820,16 +16541,16 @@ async function mcpAddCommand(options = {}) {
         fail(
           `Claude Code is not on your PATH, so nothing was registered. Run the command above once ${code("claude")} is installed.`
         );
-        resolve14(1);
+        resolve15(1);
         return;
       }
       fail(`Could not run \`claude\`: ${err.message}`);
-      resolve14(1);
+      resolve15(1);
     });
     child.on("close", (codeOut) => {
       if (settled) return;
       settled = true;
-      resolve14(codeOut ?? 1);
+      resolve15(codeOut ?? 1);
     });
   });
 }
@@ -15948,10 +16669,10 @@ function upgradeCommand(plugin, marketplace) {
 var PLUGIN_NAME = "dashwise";
 var MARKETPLACE_NAME = "dashwise";
 var DEFAULT_MARKETPLACE_SOURCE = "Intuize/dashwise-cli";
-var defaultRunner = (cmd, args, opts) => new Promise((resolve14) => {
+var defaultRunner = (cmd, args, opts) => new Promise((resolve15) => {
   const target = spawnTarget(cmd, args);
   if ("refused" in target) {
-    resolve14({ code: null, stdout: "", stderr: target.refused, missing: false });
+    resolve15({ code: null, stdout: "", stderr: target.refused, missing: false });
     return;
   }
   const child = spawn(target.command, target.args, {
@@ -15966,7 +16687,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolve14) => {
   child.on("error", (err) => {
     if (settled) return;
     settled = true;
-    resolve14({
+    resolve15({
       code: null,
       stdout,
       stderr: stderr || err.message,
@@ -15976,7 +16697,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolve14) => {
   child.on("close", (exitCode) => {
     if (settled) return;
     settled = true;
-    resolve14({ code: exitCode, stdout, stderr, missing: false });
+    resolve15({ code: exitCode, stdout, stderr, missing: false });
   });
 });
 function readSkillsOnDisk() {
@@ -17670,7 +18391,14 @@ async function moduleInstallCommand(slugArg, options) {
   try {
     const installs = await listWorkspaceInstallations(workspace2.id, auth);
     const byKind = selectInstallsByKind(installs, mod.id);
-    existing = byKind.production;
+    const production = byKind.all.filter((row2) => !isDevInstallKind(row2.kind));
+    if (production.length > 1) {
+      fail(
+        "Several production installations exist for this module in this company. Select the installation to update in the app. Nothing was changed."
+      );
+      return 1;
+    }
+    existing = production[0];
     devInstall = byKind.dev;
   } catch (err) {
     fail(
@@ -17753,7 +18481,8 @@ async function moduleInstallCommand(slugArg, options) {
       mod.id,
       {
         workspaceId: workspace2.id,
-        ...options.version !== void 0 ? { version: options.version } : {},
+        version: targetVersion,
+        ...existing ? { installation_id: existing.id } : {},
         ...options.force !== void 0 ? { force: options.force } : {}
       },
       auth
@@ -17761,6 +18490,12 @@ async function moduleInstallCommand(slugArg, options) {
   } catch (err) {
     return surfaceInstallError(err, mod.slug, workspace2.slug, devInstallReplaced);
   }
+  if (existing && (isInstallGated(result) || result.installation.id !== existing.id)) {
+    fail(
+      `The backend did not confirm an in-place update of installation #${existing.id}. Check its state in the app before retrying; no fallback install will be attempted.`
+    );
+    return 1;
+  }
   if (isInstallGated(result)) {
     if (options.json) {
       out(JSON.stringify(result));
@@ -17780,7 +18515,9 @@ async function moduleInstallCommand(slugArg, options) {
   let verified = false;
   try {
     const after = await listWorkspaceInstallations(workspace2.id, auth);
-    row = selectInstallsByKind(after, mod.id).production;
+    row = after.find(
+      (candidate) => candidate.id === result.installation.id && candidate.module_id === mod.id && !isDevInstallKind(candidate.kind)
+    );
     verified = row !== void 0;
   } catch {
   }
@@ -18390,6 +19127,16 @@ function packedFileLines(files, cap = PACKED_FILE_LIST_CAP) {
   if (files.length <= cap) return [...files];
   return [...files.slice(0, cap), `\u2026 and ${files.length - cap} more`];
 }
+function repositoryLinkedDecision(input) {
+  if (!input.repositoryUrl || input.fromLocal || input.dryRun) return "proceed";
+  return input.interactive ? "confirm" : "refuse";
+}
+function canPrompt(stdin, stdout) {
+  return stdin.isTTY === true && stdout.isTTY === true;
+}
+function repositoryLinkedWarning(repositoryUrl) {
+  return `These files are not in ${repositoryUrl}; the next repository build replaces them.`;
+}
 async function modulePublishCommand(options) {
   const projectRoot = resolve(options.dir ?? process.cwd());
   const manifestPath2 = join(projectRoot, "module.json");
@@ -18486,6 +19233,35 @@ async function modulePublishCommand(options) {
     );
   }
   for (const w of tarball.warnings) warn(w);
+  if (mod.repository_url) {
+    const decision = repositoryLinkedDecision({
+      repositoryUrl: mod.repository_url,
+      fromLocal: options.fromLocal === true,
+      dryRun: options.dryRun === true,
+      interactive: canPrompt(process.stdin, process.stdout)
+    });
+    warn(repositoryLinkedWarning(mod.repository_url));
+    if (decision === "refuse") {
+      fail(
+        `${code(slug)} is linked to a repository. Re-run with ${code("--from-local")} to publish these local files anyway.`
+      );
+      return 1;
+    }
+    if (decision === "confirm") {
+      const answer = await select({
+        message: "Publish these local files anyway?",
+        options: [
+          { value: "go", label: "Yes, publish from local files" },
+          { value: "cancel", label: "No, abort" }
+        ],
+        initialValue: "cancel"
+      });
+      if (isCancel(answer) || answer === "cancel") {
+        fail("Aborted.");
+        return 130;
+      }
+    }
+  }
   if (!options.yes && process.stdout.isTTY && !options.dryRun) {
     const answer = await select({
       message: `Upload + publish ${code(`bump:${bump}`)}?`,
@@ -19022,7 +19798,7 @@ async function moduleReleaseCommand(slugArg, options) {
   }
   async function wait() {
     const remaining = Math.max(0, deadline - Date.now());
-    await new Promise((resolve14) => setTimeout(resolve14, Math.min(options.pollIntervalMs ?? 4e3, remaining)));
+    await new Promise((resolve15) => setTimeout(resolve15, Math.min(options.pollIntervalMs ?? 4e3, remaining)));
   }
 }
 
@@ -22430,7 +23206,7 @@ function formatTimestamp(iso) {
   return iso.slice(0, 19).replace("T", " ");
 }
 function sleep2(ms) {
-  return new Promise((resolve14) => setTimeout(resolve14, ms));
+  return new Promise((resolve15) => setTimeout(resolve15, ms));
 }
 
 // src/commands/module/action-log.ts
@@ -22532,7 +23308,7 @@ async function runTail2(installationId, options) {
       }
       dim(`(tail: transient error \u2014 ${err.message})`);
     }
-    await new Promise((resolve14) => setTimeout(resolve14, POLL_INTERVAL_MS2));
+    await new Promise((resolve15) => setTimeout(resolve15, POLL_INTERVAL_MS2));
   }
 }
 function printTable(rows) {
@@ -22917,7 +23693,7 @@ async function sleep3(ms, aborted) {
   const slice = 100;
   let waited = 0;
   while (waited < ms && !aborted()) {
-    await new Promise((resolve14) => setTimeout(resolve14, Math.min(slice, ms - waited)));
+    await new Promise((resolve15) => setTimeout(resolve15, Math.min(slice, ms - waited)));
     waited += slice;
   }
 }
@@ -23467,6 +24243,17 @@ program.command("login").description("Sign in via the device-code flow.").option
   });
   process.exitCode = exit;
 });
+program.command("doctor").description(
+  "Check your setup: which Dashwise you target (dev or prod), login, connection, Node, CLI and SDK versions, and inside a module folder module.json, the repository link and the cloud setup files. Each item says what to do. Exits 1 when something fails."
+).option("--dir <path>", "Module folder to check (default: current directory).").option("--json", "Print one JSON object { ok, checks } instead of the report.").action(async (cmdOpts) => {
+  process.exitCode = await doctorCommand(
+    {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    },
+    defaultDoctorDeps(getVersion())
+  );
+});
 program.command("logout").description("Clear the local credentials and revoke the server-side token.").action(async () => {
   process.exitCode = await logoutCommand();
 });
@@ -24057,6 +24844,9 @@ moduleCmd.command("release [slug]").description("Release an exact pushed reposit
   });
 });
 moduleCmd.command("publish").description("Pack the current directory + upload it as a new module version.").option("--dir <path>", "Project root (default: current directory).").option("--bump <direction>", "Semver bump: patch | minor | major.").option("--dry-run", "Validate + upload but do not persist the version row.").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use).").option(
+  "--from-local",
+  "Publish local files to a module that has a linked repository (the next repository build replaces them)."
+).option(
   "--exclude <pattern...>",
   "Extra exclude patterns (segment-matched) appended to the defaults."
 ).option(
@@ -24076,6 +24866,7 @@ moduleCmd.command("publish").description("Pack the current directory + upload it
       ...cmdOpts.bump !== void 0 ? { bump: cmdOpts.bump } : {},
       ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {},
       ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
+      ...cmdOpts.fromLocal !== void 0 ? { fromLocal: cmdOpts.fromLocal } : {},
       ...cmdOpts.exclude !== void 0 ? { exclude: cmdOpts.exclude } : {},
       // commander maps `--no-respect-gitignore` to
       // `respectGitignore === false`.
@@ -24332,12 +25123,12 @@ tableCmd.command("create <slug>").description(
   "Create a new table. Pass --field flags to define columns. Calls POST /api/installations/:id/schema/tables and syncs the updated manifest back to local module.json."
 ).option("--dir <path>", "Project root (default: current directory).").option(
   "-f, --field <spec>",
-  "Field spec \u2014 `<slug>:<type>[:required]`. Repeat for multiple fields. For options/target/default, use --field-json instead. Example: `--field title:text:required --field done:boolean`.",
+  "Field spec: `<slug>:<type>[:primary,required]`. Exactly one eligible field must be primary. Repeat for multiple fields. For options/target/default, use --field-json instead. Example: `--field title:text:primary,required --field done:boolean`.",
   (val, prev = []) => [...prev, val],
   []
 ).option(
   "--field-json <json>",
-  "Field as a JSON object \u2014 `{slug,type,required?,options?,target?,default?}`. Repeatable. Use for fields where the simple syntax can't express the shape.",
+  "Field as a JSON object \u2014 `{slug,type,primary?:true,required?,options?,target?,default?}`. Repeatable. Use for fields where the simple syntax can't express the shape.",
   (val, prev = []) => [...prev, val],
   []
 ).action(
@@ -24401,7 +25192,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.23.0";
+  return "0.25.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);
@@ -24417,6 +25208,7 @@ function collectRepeated(value, previous) {
 // src/bin.ts
 (async () => {
   try {
+    await installEnvProxy();
     await program.parseAsync(process.argv);
   } catch (err) {
     if (err instanceof ExcessArgumentsError) {