@dashai/cli 0.3.2 → 0.5.0

package/dist/bin.js

@@ -231,6 +231,30 @@ async function destroyDevInstallation(installationId, options = {}) {
     options
   );
 }
+async function createApiKey(installationId, body, options = {}) {
+  return apiRequest(
+    "POST",
+    `/api/installations/${installationId}/api-keys`,
+    body,
+    options
+  );
+}
+async function listApiKeys(installationId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/api-keys`,
+    void 0,
+    options
+  );
+}
+async function revokeApiKey(installationId, keyId, options = {}) {
+  return apiRequest(
+    "DELETE",
+    `/api/installations/${installationId}/api-keys/${keyId}`,
+    void 0,
+    options
+  );
+}
 async function createTable(installationId, body, options = {}) {
   return apiRequest(
     "POST",
@@ -2032,6 +2056,47 @@ var init_init = __esm({
     init_workspaces();
   }
 });
+function loadSchemaCommandContext(opts) {
+  const projectRoot = resolve(opts.dir ?? process.cwd());
+  const manifestPath2 = join(projectRoot, "module.json");
+  const manifest = readManifestOrThrow(projectRoot);
+  const manifestRawBytes = readFileSync(manifestPath2, "utf-8");
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    throw new Error(
+      `module.json at ${manifestPath2} has no module.slug \u2014 the manifest is malformed.`
+    );
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    throw new Error("Not logged in. Run `dashwise login` first.");
+  }
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    throw new Error(
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+    );
+  }
+  return {
+    projectRoot,
+    manifestPath: manifestPath2,
+    manifest,
+    manifestRawBytes,
+    slug,
+    cfg,
+    entry,
+    requestOptions: {
+      baseUrl: resolveApiUrl(),
+      auth: { token: entry.runtimeToken }
+    }
+  };
+}
+var init_schema_command_context = __esm({
+  "src/lib/schema-command-context.ts"() {
+    init_config();
+    init_manifest_io();
+  }
+});
 
 // src/commands/module/destroy-dev-install.ts
 var destroy_dev_install_exports = {};
@@ -2202,47 +2267,6 @@ var init_reset_dev_install = __esm({
     init_output();
   }
 });
-function loadSchemaCommandContext(opts) {
-  const projectRoot = resolve(opts.dir ?? process.cwd());
-  const manifestPath2 = join(projectRoot, "module.json");
-  const manifest = readManifestOrThrow(projectRoot);
-  const manifestRawBytes = readFileSync(manifestPath2, "utf-8");
-  const slug = manifest.module?.slug;
-  if (!slug) {
-    throw new Error(
-      `module.json at ${manifestPath2} has no module.slug \u2014 the manifest is malformed.`
-    );
-  }
-  const cfg = readConfig();
-  if (!cfg) {
-    throw new Error("Not logged in. Run `dashwise login` first.");
-  }
-  const entry = readModuleEntry(slug);
-  if (!entry) {
-    throw new Error(
-      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
-    );
-  }
-  return {
-    projectRoot,
-    manifestPath: manifestPath2,
-    manifest,
-    manifestRawBytes,
-    slug,
-    cfg,
-    entry,
-    requestOptions: {
-      baseUrl: resolveApiUrl(),
-      auth: { token: entry.runtimeToken }
-    }
-  };
-}
-var init_schema_command_context = __esm({
-  "src/lib/schema-command-context.ts"() {
-    init_config();
-    init_manifest_io();
-  }
-});
 
 // src/lib/field-spec.ts
 function parseFieldSpec(spec) {
@@ -2707,10 +2731,76 @@ var init_set_type = __esm({
 init_api_client();
 init_config();
 init_manifest_io();
+
+// src/lib/manifest-poll.ts
+init_api_client();
+function startManifestPollLoop(opts) {
+  const {
+    installationId,
+    manifestPath: manifestPath2,
+    requestOptions,
+    intervalMs,
+    onUpdate,
+    onError
+  } = opts;
+  let lastSeenJson = existsSync(manifestPath2) ? readFileSync(manifestPath2, "utf-8") : "";
+  let timer = null;
+  let stopped = false;
+  const tick = async () => {
+    if (stopped) return;
+    try {
+      const { manifest } = await getInstallationSchema(
+        installationId,
+        requestOptions
+      );
+      const remoteJson = JSON.stringify(manifest, null, 2) + "\n";
+      const currentLocal = existsSync(manifestPath2) ? readFileSync(manifestPath2, "utf-8") : "";
+      if (remoteJson === currentLocal) {
+        lastSeenJson = remoteJson;
+      } else if (remoteJson !== lastSeenJson) {
+        writeFileSync(manifestPath2, remoteJson, "utf-8");
+        lastSeenJson = remoteJson;
+        if (onUpdate) {
+          const delta = Buffer.byteLength(remoteJson, "utf8") - Buffer.byteLength(currentLocal, "utf8");
+          const deltaStr = delta === 0 ? "0 bytes" : `${delta > 0 ? "+" : ""}${delta} bytes`;
+          onUpdate(
+            `Backend manifest changed \u2014 synced to module.json (${deltaStr}).`
+          );
+        }
+      }
+    } catch (err) {
+      if (onError) {
+        const message = err instanceof ApiError ? `${err.code} (HTTP ${err.status}): ${err.message}` : err.message;
+        onError(new Error(message));
+      }
+    } finally {
+      if (!stopped) {
+        timer = setTimeout(() => void tick(), intervalMs);
+      }
+    }
+  };
+  timer = setTimeout(() => void tick(), intervalMs);
+  return {
+    stop: () => {
+      if (stopped) return;
+      stopped = true;
+      if (timer) {
+        clearTimeout(timer);
+        timer = null;
+      }
+    },
+    isRunning: () => !stopped
+  };
+}
+
+// src/commands/dev.ts
 init_output();
 var DEFAULT_NEXT_PORT = 3e3;
 var PREFIX_SDK = `\x1B[36m[sdk]\x1B[0m `;
 var PREFIX_NEXT = `\x1B[35m[next]\x1B[0m `;
+var PREFIX_POLL = `\x1B[33m[poll]\x1B[0m `;
+var DEFAULT_REMOTE_POLL_INTERVAL_SEC = 5;
+var MIN_REMOTE_POLL_INTERVAL_SEC = 1;
 async function devCommand(options) {
   if (options.sdkOnly && options.nextOnly) {
     fail(
@@ -2845,10 +2935,43 @@ async function devCommand(options) {
     pipeWithPrefix(child.stdout, process.stdout, prefix);
     pipeWithPrefix(child.stderr, process.stderr, prefix);
   }
+  let manifestPoll = null;
+  const enablePoll = !options.noRemotePoll && moduleEntry !== null && manifestSlug !== void 0;
+  if (enablePoll) {
+    const intervalSec = Math.max(
+      MIN_REMOTE_POLL_INTERVAL_SEC,
+      options.remotePollIntervalSec ?? DEFAULT_REMOTE_POLL_INTERVAL_SEC
+    );
+    manifestPoll = startManifestPollLoop({
+      installationId: moduleEntry.installationId,
+      manifestPath: manifestPath2,
+      requestOptions: {
+        baseUrl: apiUrl,
+        auth: { token: moduleEntry.runtimeToken }
+      },
+      intervalMs: intervalSec * 1e3,
+      onUpdate: (msg) => {
+        process.stdout.write(`${PREFIX_POLL}${msg}
+`);
+      },
+      onError: (err) => {
+        process.stderr.write(`${PREFIX_POLL}${err.message}
+`);
+      }
+    });
+    info(
+      `  ${dim("poll")}        backend manifest every ${intervalSec}s ${dim("(--no-remote-poll to disable)")}`
+    );
+    info("");
+  }
   let shuttingDown = false;
   const forwardSignal = (sig) => {
     if (shuttingDown) return;
     shuttingDown = true;
+    if (manifestPoll) {
+      manifestPoll.stop();
+      manifestPoll = null;
+    }
     info(`
 Received ${sig}, stopping children\u2026`);
     for (const { child } of children) {
@@ -2885,6 +3008,10 @@ Received ${sig}, stopping children\u2026`);
       }
     }
   }
+  if (manifestPoll) {
+    manifestPoll.stop();
+    manifestPoll = null;
+  }
   const exitCode = Math.max(0, ...results.map((r) => r.code));
   if (exitCode === 0) {
     success("Dev loop stopped cleanly.");
@@ -5030,6 +5157,457 @@ async function depsRemoveCommand(providerSlug, options) {
   return 0;
 }
 
+// src/commands/pull.ts
+init_api_client();
+init_manifest_io();
+init_schema_command_context();
+init_output();
+async function pullCommand(options) {
+  let ctx;
+  try {
+    ctx = loadSchemaCommandContext({
+      ...options.dir !== void 0 ? { dir: options.dir } : {}
+    });
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  info(`Pulling manifest for installation ${ctx.entry.installationId}\u2026`);
+  let remoteManifest;
+  try {
+    const response = await getInstallationSchema(
+      ctx.entry.installationId,
+      ctx.requestOptions
+    );
+    remoteManifest = response.manifest;
+  } catch (err) {
+    return surfacePullFailure(err);
+  }
+  const localJson = JSON.stringify(ctx.manifest, null, 2) + "\n";
+  const remoteJson = JSON.stringify(remoteManifest, null, 2) + "\n";
+  if (localJson === remoteJson) {
+    success("Already in sync \u2014 local module.json matches backend.");
+    return 0;
+  }
+  const localBytes = Buffer.byteLength(localJson, "utf8");
+  const remoteBytes = Buffer.byteLength(remoteJson, "utf8");
+  const delta = remoteBytes - localBytes;
+  const deltaStr = delta === 0 ? "0 bytes" : `${delta > 0 ? "+" : ""}${delta} bytes`;
+  if (options.dryRun) {
+    info(
+      `Drift detected (${deltaStr}). ${code("--dry-run")} \u2014 not writing.`
+    );
+    info(`Run ${code("dashwise pull")} without ${code("--dry-run")} to apply.`);
+    return 0;
+  }
+  try {
+    writeManifest(remoteManifest, ctx.projectRoot);
+  } catch (err) {
+    fail(`Failed to write ${manifestPath(ctx.projectRoot)}: ${err.message}`);
+    return 1;
+  }
+  success(
+    `Synced module.json from backend (${deltaStr}). ${dim(`Run \`dashwise module generate\` to refresh typed SDK if your watcher isn't running.`)}`
+  );
+  return 0;
+}
+function surfacePullFailure(err) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "UNAUTHENTICATED":
+        fail(
+          `Runtime token rejected. The cached token for this module may be expired \u2014 re-run \`dashwise init <slug> --force\` to mint a fresh one.`
+        );
+        break;
+      case "SANDBOX_TOKEN_NOT_ACCEPTED":
+        fail(
+          `Schema-read endpoint requires a local-dev runtime token (kind=local). The cached token is the wrong kind \u2014 re-run \`dashwise init <slug> --force\`.`
+        );
+        break;
+      case "INSTALL_MISMATCH":
+        fail(
+          `Runtime token is bound to a different installation than expected. The cached install id may be stale \u2014 re-run \`dashwise init <slug> --force\`.`
+        );
+        break;
+      case "INSTALLATION_NOT_FOUND":
+        fail(
+          `The backend has no record of this installation. It may have been destroyed (GC, manual cleanup). Re-run \`dashwise init <slug>\` to provision a fresh one.`
+        );
+        break;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+    }
+    return 1;
+  }
+  fail(`Pull failed: ${err.message}`);
+  return 1;
+}
+
+// src/commands/api-keys.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+function loadContext(opts) {
+  const manifest = readManifestOrThrow(opts.dir);
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    throw new Error(
+      `module.json has no module.slug \u2014 the manifest is malformed.`
+    );
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    throw new Error("Not logged in. Run `dashwise login` first.");
+  }
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    throw new Error(
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+    );
+  }
+  return {
+    installationId: entry.installationId,
+    slug,
+    requestOptions: {
+      baseUrl: resolveApiUrl(),
+      auth: { token: cfg.token }
+    }
+  };
+}
+async function apiKeysListCommand(options) {
+  let ctx;
+  try {
+    ctx = loadContext(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let keys;
+  try {
+    const resp = await listApiKeys(ctx.installationId, ctx.requestOptions);
+    keys = resp.api_keys;
+  } catch (err) {
+    return surfaceApiKeysError(err);
+  }
+  const filtered = options.all ? keys : keys.filter((k) => k.revoked_at === null);
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify(filtered, null, 2)}
+`);
+    return 0;
+  }
+  if (filtered.length === 0) {
+    info(
+      options.all ? `No API keys (active or revoked) for ${code(ctx.slug)}.` : `No active API keys for ${code(ctx.slug)}. Run ${code("dashwise api-keys create <name>")} to mint one, or ${code("dashwise api-keys list --all")} to include revoked.`
+    );
+    return 0;
+  }
+  info(`API keys for ${code(ctx.slug)} (install id=${ctx.installationId}):`);
+  for (const k of filtered) {
+    const status = formatKeyStatus(k);
+    const lastUsed = k.last_used_at ? `last used ${formatRelative(new Date(k.last_used_at))}` : "never used";
+    process.stdout.write(
+      `  ${code(`#${k.id}`)} ${k.name} ${dim(`dwk_${k.key_prefix}\u2026`)} ${status} ${dim(`(${lastUsed})`)}
+`
+    );
+  }
+  return 0;
+}
+async function apiKeysCreateCommand(nameArg, options) {
+  const name = nameArg ?? options.name;
+  if (!name) {
+    fail("Usage: `dashwise api-keys create <name>` (e.g. `dashwise api-keys create production`)");
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = loadContext(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const body = { name };
+  if (options.scopes !== void 0) {
+    body.scopes = options.scopes.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  if (options.expiresAt !== void 0) {
+    body.expires_at = options.expiresAt;
+  }
+  let resp;
+  try {
+    resp = await createApiKey(ctx.installationId, body, ctx.requestOptions);
+  } catch (err) {
+    return surfaceApiKeysError(err);
+  }
+  if (options.rawOnly) {
+    process.stderr.write(
+      `Created API key #${resp.api_key.id} (${resp.api_key.name}) for install ${ctx.installationId}.
+`
+    );
+    process.stdout.write(`${resp.raw_key}
+`);
+    return 0;
+  }
+  success(
+    `Created API key ${code(`#${resp.api_key.id}`)} (${resp.api_key.name}) for ${code(ctx.slug)}.`
+  );
+  info("");
+  warn(
+    "This is the ONLY time the full key is displayed. Save it now \u2014 the backend stores a hash, not the plaintext."
+  );
+  info("");
+  process.stdout.write(`  ${code(resp.raw_key)}
+`);
+  info("");
+  info(`Use in a deployed module's env:`);
+  info(`  ${code(`DASHWISE_API_KEY=${resp.raw_key.slice(0, 12)}\u2026`)}`);
+  info(
+    `  ${code(`DASHWISE_INSTALLATION_ID=${ctx.installationId}`)}`
+  );
+  info(
+    `  ${code(`DASHWISE_API_URL=${resolveApiUrl()}`)}`
+  );
+  return 0;
+}
+async function apiKeysRevokeCommand(keyIdArg, options) {
+  if (!keyIdArg) {
+    fail("Usage: `dashwise api-keys revoke <key-id>` \u2014 id from `dashwise api-keys list`");
+    return 1;
+  }
+  const keyId = Number.parseInt(keyIdArg, 10);
+  if (!Number.isFinite(keyId) || keyId <= 0) {
+    fail(`Invalid key id "${keyIdArg}" \u2014 expected a positive integer.`);
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = loadContext(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  if (!options.yes) {
+    info(
+      `Revoking API key #${keyId} for ${code(ctx.slug)} (install ${ctx.installationId}). Pass ${code("--yes")} to skip this confirmation in scripts.`
+    );
+  }
+  let resp;
+  try {
+    resp = await revokeApiKey(ctx.installationId, keyId, ctx.requestOptions);
+  } catch (err) {
+    return surfaceApiKeysError(err);
+  }
+  success(
+    `Revoked API key #${resp.api_key.id} (${resp.api_key.name}). Future requests with this key will return 401.`
+  );
+  return 0;
+}
+function surfaceApiKeysError(err) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "UNAUTHENTICATED":
+        fail(
+          `Auth rejected by backend. Your CLI token may be stale \u2014 run ${code("dashwise login")} then retry.`
+        );
+        return 1;
+      case "NOT_WORKSPACE_MEMBER":
+        fail(
+          `You're not a member of this installation's workspace. API-key management requires workspace membership.`
+        );
+        return 1;
+      case "INSTALLATION_NOT_FOUND":
+        fail(
+          `Installation not found. It may have been destroyed; re-provision via ${code("dashwise init <slug>")}.`
+        );
+        return 1;
+      case "API_KEY_NOT_FOUND":
+        fail(
+          `API key not found for this installation. Use ${code("dashwise api-keys list")} to see valid ids.`
+        );
+        return 1;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+        return 1;
+    }
+  }
+  fail(`API-key operation failed: ${err.message}`);
+  return 1;
+}
+function formatKeyStatus(k) {
+  if (k.revoked_at) return dim("[revoked]");
+  if (k.expires_at && new Date(k.expires_at).getTime() <= Date.now()) {
+    return dim("[expired]");
+  }
+  return dim("[active]");
+}
+function formatRelative(d) {
+  const deltaMs = Date.now() - d.getTime();
+  const sec = Math.floor(deltaMs / 1e3);
+  if (sec < 60) return `${sec}s ago`;
+  const min = Math.floor(sec / 60);
+  if (min < 60) return `${min}m ago`;
+  const hr = Math.floor(min / 60);
+  if (hr < 24) return `${hr}h ago`;
+  const day = Math.floor(hr / 24);
+  return `${day}d ago`;
+}
+
+// src/commands/env-export.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+var PLACEHOLDER = "<run-`dashwise-api-keys-create-<name>`-and-paste-here>";
+async function envExportCommand(options) {
+  const format = options.format ?? "env";
+  if (!["env", "json", "railway", "vercel", "fly"].includes(format)) {
+    fail(
+      `Unknown --format "${format}". Allowed: env | json | railway | vercel | fly.`
+    );
+    return 1;
+  }
+  if (options.newKey && options.key) {
+    fail(
+      `Pass either --new-key (mint fresh) or --key (paste existing). Not both.`
+    );
+    return 1;
+  }
+  let manifest;
+  try {
+    manifest = readManifestOrThrow(options.dir);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    fail("module.json has no module.slug \u2014 the manifest is malformed.");
+    return 1;
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    fail("Not logged in. Run `dashwise login` first.");
+    return 1;
+  }
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    fail(
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+    );
+    return 1;
+  }
+  const apiUrl = resolveApiUrl();
+  const installationId = entry.installationId;
+  let apiKey;
+  let apiKeyComment = null;
+  if (options.key !== void 0) {
+    if (!options.key.startsWith("dwk_")) {
+      fail(`--key value must start with \`dwk_\` (got "${options.key.slice(0, 8)}\u2026").`);
+      return 1;
+    }
+    apiKey = options.key;
+    apiKeyComment = "# DASHWISE_API_KEY supplied via --key";
+  } else if (options.newKey !== void 0) {
+    try {
+      const resp = await createApiKey(
+        installationId,
+        { name: options.newKey },
+        {
+          baseUrl: apiUrl,
+          auth: { token: cfg.token }
+        }
+      );
+      apiKey = resp.raw_key;
+      apiKeyComment = `# DASHWISE_API_KEY minted by --new-key (id=${resp.api_key.id}, name="${resp.api_key.name}")`;
+      process.stderr.write(
+        `${dim("[env export]")} Minted API key #${resp.api_key.id} (${resp.api_key.name}). The plaintext below is the ONLY time it's shown \u2014 save the file or paste it now.
+`
+      );
+    } catch (err) {
+      if (err instanceof ApiError) {
+        fail(`Failed to mint API key: ${err.code} ${err.status} \u2014 ${err.message}`);
+      } else {
+        fail(`Failed to mint API key: ${err.message}`);
+      }
+      return 1;
+    }
+  } else {
+    apiKey = PLACEHOLDER;
+    apiKeyComment = "# DASHWISE_API_KEY \u2014 run `dashwise api-keys create <name>` to mint one + paste here.";
+  }
+  const entries = [
+    {
+      key: "DASHWISE_API_URL",
+      value: apiUrl,
+      comment: "# DashWise backend URL \u2014 same value the CLI is logged into."
+    },
+    {
+      key: "NEXT_PUBLIC_DASHWISE_API_URL",
+      value: apiUrl,
+      comment: "# Client-side mirror \u2014 Next.js inlines NEXT_PUBLIC_* into the browser bundle so <AuthProvider> hits the right origin."
+    },
+    {
+      key: "DASHWISE_INSTALLATION_ID",
+      value: String(installationId),
+      comment: `# Per-workspace install id for module "${slug}".`
+    },
+    {
+      key: "DASHWISE_API_KEY",
+      value: apiKey,
+      ...apiKeyComment !== null ? { comment: apiKeyComment } : {}
+    }
+  ];
+  process.stdout.write(render(entries, format));
+  if (format !== "json") process.stdout.write("\n");
+  if (apiKey === PLACEHOLDER) {
+    info("");
+    info(
+      `Next: ${code(`dashwise api-keys create <name>`)} \u2192 paste the plaintext into ${code("DASHWISE_API_KEY")}.`
+    );
+  } else if (options.newKey !== void 0) {
+    info("");
+    warn(
+      "API key plaintext is shown ONLY once. Save the output of this command now."
+    );
+  }
+  return 0;
+}
+function render(entries, format) {
+  switch (format) {
+    case "env": {
+      const lines = [];
+      for (const e of entries) {
+        if (e.comment) lines.push(e.comment);
+        lines.push(`${e.key}=${e.value}`);
+        lines.push("");
+      }
+      return lines.join("\n").trimEnd();
+    }
+    case "json": {
+      const obj = {};
+      for (const e of entries) obj[e.key] = e.value;
+      return JSON.stringify(obj, null, 2);
+    }
+    case "railway": {
+      const parts = entries.map((e) => `${e.key}='${e.value.replace(/'/g, "'\\''")}'`);
+      return `railway variables set ${parts.join(" ")}`;
+    }
+    case "vercel": {
+      const lines = entries.map(
+        (e) => `echo ${shellQuote(e.value)} | vercel env add ${e.key} production`
+      );
+      return lines.join("\n");
+    }
+    case "fly": {
+      const parts = entries.map((e) => `${e.key}=${shellQuote(e.value)}`);
+      return `fly secrets set ${parts.join(" ")}`;
+    }
+  }
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+
 // src/commands/query.ts
 init_manifest_io();
 init_output();
@@ -5635,7 +6213,14 @@ program.command("dev").description(
 ).option(
   "--api-url <url>",
   "Override the `DASHWISE_API_URL` env var passed to children (default: saved CLI config)."
-).option("--port <number>", "Port for `next dev` (default: 3000).", parseIntOption).option("--sdk-only", "Only run the manifest watcher; skip `next dev`.").option("--next-only", "Only run `next dev`; skip the manifest watcher.").action(
+).option("--port <number>", "Port for `next dev` (default: 3000).", parseIntOption).option("--sdk-only", "Only run the manifest watcher; skip `next dev`.").option("--next-only", "Only run `next dev`; skip the manifest watcher.").option(
+  "--no-remote-poll",
+  "Disable periodic backend manifest polling. By default, `dashwise dev` polls `GET /api/installations/:id/schema` every few seconds + writes module.json when the backend has advanced (dashboard edits, AI builder mutations, teammate commands)."
+).option(
+  "--remote-poll-interval <seconds>",
+  "Backend manifest poll interval, in seconds. Default: 5. Minimum: 1.",
+  parseIntOption
+).action(
   async (cmdOpts) => {
     process.exitCode = await devCommand({
       ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
@@ -5645,7 +6230,11 @@ program.command("dev").description(
       ...cmdOpts.apiUrl !== void 0 ? { apiUrl: cmdOpts.apiUrl } : {},
       ...cmdOpts.port !== void 0 ? { port: cmdOpts.port } : {},
       ...cmdOpts.sdkOnly !== void 0 ? { sdkOnly: cmdOpts.sdkOnly } : {},
-      ...cmdOpts.nextOnly !== void 0 ? { nextOnly: cmdOpts.nextOnly } : {}
+      ...cmdOpts.nextOnly !== void 0 ? { nextOnly: cmdOpts.nextOnly } : {},
+      // Commander's --no-foo flag maps to `foo: false`. devCommand's
+      // option is `noRemotePoll: boolean` — invert to map cleanly.
+      ...cmdOpts.remotePoll === false ? { noRemotePoll: true } : {},
+      ...cmdOpts.remotePollInterval !== void 0 ? { remotePollIntervalSec: cmdOpts.remotePollInterval } : {}
     });
   }
 );
@@ -5797,6 +6386,80 @@ program.command("query").description(
     });
   }
 );
+program.command("pull").description(
+  "Sync local module.json from the backend. Fetches the canonical manifest for the current install and writes it to disk. Inverse of `dashwise table/field` commands."
+).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option("--dry-run", "Fetch + report drift but do not write to module.json.").action(async (cmdOpts) => {
+  process.exitCode = await pullCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {}
+  });
+});
+var apiKeysCmd = program.command("api-keys").description(
+  "Manage per-installation API keys (`dwk_*`). Pasted into a deployed module's env for production data-plane auth."
+);
+apiKeysCmd.command("list").description(
+  "List API keys for the current module's installation. Active only by default; pass --all for revoked too."
+).option("--dir <path>", "Project root (default: current directory).").option("--all", "Include revoked + expired keys in the output.").option("--json", "Emit JSON instead of the human-friendly table.").action(async (cmdOpts) => {
+  process.exitCode = await apiKeysListCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.all !== void 0 ? { all: cmdOpts.all } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+apiKeysCmd.command("create [name]").description(
+  "Mint a new API key. The plaintext key is displayed ONCE \u2014 save it then."
+).option("--dir <path>", "Project root (default: current directory).").option("--name <name>", "Override the positional name arg (e.g. for scripted use).").option(
+  "--scopes <csv>",
+  "Comma-separated scope strings (e.g. `runtime:read,runtime:write`). Default: full install access."
+).option(
+  "--expires-at <iso>",
+  "ISO-8601 expiry timestamp (e.g. 2026-12-31T23:59:59Z). Default: never expires."
+).option(
+  "--raw-only",
+  "Print only the plaintext key on stdout; chatter goes to stderr. Useful for shell capture: `KEY=$(dashwise api-keys create prod --raw-only)`"
+).action(
+  async (nameArg, cmdOpts) => {
+    process.exitCode = await apiKeysCreateCommand(nameArg, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.name !== void 0 ? { name: cmdOpts.name } : {},
+      ...cmdOpts.scopes !== void 0 ? { scopes: cmdOpts.scopes } : {},
+      ...cmdOpts.expiresAt !== void 0 ? { expiresAt: cmdOpts.expiresAt } : {},
+      ...cmdOpts.rawOnly !== void 0 ? { rawOnly: cmdOpts.rawOnly } : {}
+    });
+  }
+);
+apiKeysCmd.command("revoke [key-id]").description(
+  "Soft-revoke an API key. Backend keeps the row for audit; further requests return 401."
+).option("--dir <path>", "Project root (default: current directory).").option("-y, --yes", "Skip the per-key confirmation message (for CI / scripts).").action(
+  async (keyIdArg, cmdOpts) => {
+    process.exitCode = await apiKeysRevokeCommand(keyIdArg, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
+    });
+  }
+);
+var envCmd = program.command("env").description("Environment-variable helpers for deploying a module.");
+envCmd.command("export").description(
+  "Emit the env vars a deployed module needs to authenticate against DashWise. By default emits .env-style KEY=value lines; --format = env | json | railway | vercel | fly to wrap in platform-native syntax. Use --new-key <name> to mint + inline an API key in one step."
+).option("--dir <path>", "Project root (default: current directory).").option(
+  "--format <fmt>",
+  "Output format: env | json | railway | vercel | fly (default: env)."
+).option(
+  "--new-key <name>",
+  "Mint a fresh API key with this name and inline the plaintext. (Mutually exclusive with --key.)"
+).option(
+  "--key <dwk_value>",
+  "Use a previously-minted API key (paste plaintext). (Mutually exclusive with --new-key.)"
+).action(
+  async (cmdOpts) => {
+    process.exitCode = await envExportCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.format !== void 0 ? { format: cmdOpts.format } : {},
+      ...cmdOpts.newKey !== void 0 ? { newKey: cmdOpts.newKey } : {},
+      ...cmdOpts.key !== void 0 ? { key: cmdOpts.key } : {}
+    });
+  }
+);
 moduleCmd.command("publish").description("Pack the current directory + upload it as a new module version.").option("--dir <path>", "Project root (default: current directory).").option("--bump <direction>", "Semver bump: patch | minor | major.").option("--dry-run", "Validate + upload but do not persist the version row.").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use).").option(
   "--exclude <pattern...>",
   "Extra exclude patterns (segment-matched) appended to the defaults."
@@ -5988,7 +6651,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 })();
 function getVersion() {
-  return "0.3.2";
+  return "0.5.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);