@dashai/cli 0.4.0 → 0.5.1

package/dist/bin.js

@@ -4,7 +4,7 @@ import { tmpdir, platform, homedir } from 'os';
 import { resolve, join, dirname, relative } from 'path';
 import pc from 'picocolors';
 import { intro, log, select, isCancel, cancel, spinner, outro, text, multiselect, confirm } from '@clack/prompts';
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
 import { spawn, spawnSync } from 'child_process';
 import open from 'open';
 import * as tar from 'tar';
@@ -231,6 +231,30 @@ async function destroyDevInstallation(installationId, options = {}) {
     options
   );
 }
+async function createApiKey(installationId, body, options = {}) {
+  return apiRequest(
+    "POST",
+    `/api/installations/${installationId}/api-keys`,
+    body,
+    options
+  );
+}
+async function listApiKeys(installationId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/api-keys`,
+    void 0,
+    options
+  );
+}
+async function revokeApiKey(installationId, keyId, options = {}) {
+  return apiRequest(
+    "DELETE",
+    `/api/installations/${installationId}/api-keys/${keyId}`,
+    void 0,
+    options
+  );
+}
 async function createTable(installationId, body, options = {}) {
   return apiRequest(
     "POST",
@@ -370,6 +394,9 @@ var init_output = __esm({
 });
 
 // src/lib/scaffold.ts
+function isDeployTarget(value) {
+  return DEPLOY_TARGETS.includes(value);
+}
 function manifestJson(opts) {
   const kind = opts.kind ?? "hand_authored";
   const manifest = {
@@ -993,6 +1020,7 @@ function appApiAuthSignInTs() {
 // the DashWise FE \`/login?return_to=...\` automatically \u2014 you don't
 // need to handle the "user not logged in" case here.
 import { NextResponse } from 'next/server';
+import { getPublicOrigin } from '@/lib/request-origin';
 
 export function GET(request: Request) {
   const url = new URL(request.url);
@@ -1018,8 +1046,10 @@ export function GET(request: Request) {
 
   // Absolute URL for return_to so the backend knows which host to
   // bounce back to (the callback path is fixed at /api/auth/callback
-  // by SDK convention).
-  const moduleOrigin = url.origin;
+  // by SDK convention). \`getPublicOrigin\` reads \`X-Forwarded-Host\`
+  // when present so the redirect URL points at the public domain,
+  // not the internal Node origin behind reverse proxies.
+  const moduleOrigin = getPublicOrigin(request);
   const absoluteReturnTo = \`\${moduleOrigin}\${returnTo}\`;
 
   let ssoStart;
@@ -1053,12 +1083,17 @@ function appApiAuthCallbackTs() {
 //      (e.g. \`access_denied\`, \`server_error\`, \`invalid_request\`).
 import { NextResponse } from 'next/server';
 import { exchangeCode } from '@dashai/sdk/auth/server';
+import { getPublicOrigin } from '@/lib/request-origin';
 
 export async function GET(request: Request) {
   const url = new URL(request.url);
+  // Resolve the public origin once \u2014 all redirects below are
+  // back to this module, and behind a reverse proxy url.origin is
+  // the internal Node origin (localhost:<PORT>), not the public host.
+  const publicOrigin = getPublicOrigin(request);
   const error = url.searchParams.get('error');
   if (error) {
-    const target = new URL('/sign-in-error', url.origin);
+    const target = new URL('/sign-in-error', publicOrigin);
     target.searchParams.set('code', error);
     const description = url.searchParams.get('error_description');
     if (description) target.searchParams.set('description', description);
@@ -1067,19 +1102,19 @@ export async function GET(request: Request) {
   const code = url.searchParams.get('code');
   const returnTo = url.searchParams.get('return_to') ?? '/';
   if (!code) {
-    const target = new URL('/sign-in-error', url.origin);
+    const target = new URL('/sign-in-error', publicOrigin);
     target.searchParams.set('code', 'missing_code');
     return NextResponse.redirect(target);
   }
   try {
     await exchangeCode(code); // sets the dashwise.session cookie
   } catch (err) {
-    const target = new URL('/sign-in-error', url.origin);
+    const target = new URL('/sign-in-error', publicOrigin);
     target.searchParams.set('code', 'exchange_failed');
     target.searchParams.set('description', (err as Error).message);
     return NextResponse.redirect(target);
   }
-  return NextResponse.redirect(new URL(returnTo, url.origin));
+  return NextResponse.redirect(new URL(returnTo, publicOrigin));
 }
 `;
 }
@@ -1092,10 +1127,14 @@ function appApiAuthSignOutTs() {
 // to follow with GET (not re-POST), landing on the public '/' page.
 import { NextResponse } from 'next/server';
 import { signOut } from '@dashai/sdk/auth/server';
+import { getPublicOrigin } from '@/lib/request-origin';
 
 export async function POST(request: Request) {
   await signOut();
-  return NextResponse.redirect(new URL('/', request.url), 303);
+  // Build the redirect against the public origin so we don't land
+  // the user on \`http://localhost:<PORT>/\` when running behind a
+  // reverse proxy (Railway/Vercel/Fly).
+  return NextResponse.redirect(new URL('/', getPublicOrigin(request)), 303);
 }
 `;
 }
@@ -1269,6 +1308,36 @@ export function cn(...inputs: ClassValue[]) {
 }
 `;
 }
+function libRequestOriginTs() {
+  return `/**
+ * Resolve the **public** origin of an incoming request.
+ *
+ * Behind a reverse proxy (Railway, Vercel, Fly, Cloudflare, an
+ * nginx in front of a Node container, etc.) \`new URL(request.url)\`
+ * reports the *internal* origin the Node process is bound to \u2014
+ * usually \`http://localhost:<PORT>\` \u2014 not the public URL the
+ * browser hit. The proxy preserves the public origin in
+ * \`X-Forwarded-*\` headers; we read those first.
+ *
+ * Falls back to \`new URL(request.url).origin\` for local dev where
+ * there's no proxy in front of Next.js.
+ *
+ * Both \`x-forwarded-proto\` and \`x-forwarded-host\` can be
+ * comma-separated when multiple proxies chain; the leftmost entry
+ * is the original client-facing one per RFC 7239 conventions.
+ */
+export function getPublicOrigin(request: Request): string {
+  const forwardedProto = request.headers.get('x-forwarded-proto');
+  const forwardedHost = request.headers.get('x-forwarded-host');
+  if (forwardedProto && forwardedHost) {
+    const proto = forwardedProto.split(',')[0].trim();
+    const host = forwardedHost.split(',')[0].trim();
+    return \`\${proto}://\${host}\`;
+  }
+  return new URL(request.url).origin;
+}
+`;
+}
 function componentsUiButtonTsx() {
   return `import * as React from "react";
 import { cva, type VariantProps } from "class-variance-authority";
@@ -1726,9 +1795,63 @@ Format (reverse chronological, newest first):
 schema mutation.
 `;
 }
-var SCAFFOLD_DEFAULT_API_URL;
+function railwayJson(_opts) {
+  return JSON.stringify(
+    {
+      $schema: "https://railway.com/railway.schema.json",
+      build: {
+        builder: "NIXPACKS"
+      },
+      deploy: {
+        restartPolicyType: "ON_FAILURE",
+        restartPolicyMaxRetries: 3
+      }
+    },
+    null,
+    2
+  ) + "\n";
+}
+function vercelJson(_opts) {
+  return JSON.stringify(
+    {
+      $schema: "https://openapi.vercel.sh/vercel.json",
+      framework: "nextjs"
+    },
+    null,
+    2
+  ) + "\n";
+}
+function flyToml(opts) {
+  return `# fly.toml \u2014 generated by \`dashwise init --deploy-target fly\`.
+# Run \`fly launch --no-deploy --copy-config\` to register this app with
+# Fly; the launcher will read this file and prompt for anything missing.
+#
+# Edit \`app\` if the slug is already taken globally on fly.io.
+# Edit \`primary_region\` for non-US-East deploys (https://fly.io/docs/reference/regions/).
+
+app = "${opts.slug}"
+primary_region = "iad"
+
+[build]
+
+[http_service]
+  internal_port = 3000
+  force_https = true
+  auto_stop_machines = "stop"
+  auto_start_machines = true
+  min_machines_running = 0
+  processes = ["app"]
+
+[[vm]]
+  cpu_kind = "shared"
+  cpus = 1
+  memory_mb = 256
+`;
+}
+var DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL;
 var init_scaffold = __esm({
   "src/lib/scaffold.ts"() {
+    DEPLOY_TARGETS = ["railway", "vercel", "fly"];
     SCAFFOLD_DEFAULT_API_URL = "http://localhost:3000";
   }
 });
@@ -1830,6 +1953,12 @@ async function moduleInitCommand(slugArg, options) {
     );
     return 1;
   }
+  if (options.deployTarget !== void 0 && !isDeployTarget(options.deployTarget)) {
+    fail(
+      `Invalid --deploy-target ${code(options.deployTarget)} \u2014 must be one of ${DEPLOY_TARGETS.map((t) => code(t)).join(", ")}.`
+    );
+    return 1;
+  }
   const kind = options.simple ? "hand_authored" : "custom";
   const scaffoldOpts = {
     slug,
@@ -1862,6 +1991,7 @@ async function moduleInitCommand(slugArg, options) {
       ["postcss.config.mjs", postcssConfigMjs()],
       ["app/globals.css", globalsCss()],
       ["lib/utils.ts", libUtilsTs()],
+      ["lib/request-origin.ts", libRequestOriginTs()],
       ["components/theme-provider.tsx", componentsThemeProviderTsx()],
       ["components/ui/button.tsx", componentsUiButtonTsx()],
       ["components/ui/card.tsx", componentsUiCardTsx()],
@@ -1880,6 +2010,19 @@ async function moduleInitCommand(slugArg, options) {
       ["app/page.tsx", appPageTsx(scaffoldOpts)]
     );
   }
+  if (options.deployTarget !== void 0) {
+    switch (options.deployTarget) {
+      case "railway":
+        files.push(["railway.json", railwayJson()]);
+        break;
+      case "vercel":
+        files.push(["vercel.json", vercelJson()]);
+        break;
+      case "fly":
+        files.push(["fly.toml", flyToml(scaffoldOpts)]);
+        break;
+    }
+  }
   for (const [relPath, content] of files) {
     const absPath = join(dir, relPath);
     const parentDir = join(absPath, "..");
@@ -2912,7 +3055,7 @@ async function devCommand(options) {
     pipeWithPrefix(child.stderr, process.stderr, prefix);
   }
   let manifestPoll = null;
-  const enablePoll = !options.noRemotePoll && moduleEntry !== void 0 && manifestSlug !== void 0;
+  const enablePoll = !options.noRemotePoll && moduleEntry !== null && manifestSlug !== void 0;
   if (enablePoll) {
     const intervalSec = Math.max(
       MIN_REMOTE_POLL_INTERVAL_SEC,
@@ -5219,6 +5362,374 @@ function surfacePullFailure(err) {
   return 1;
 }
 
+// src/bin.ts
+init_scaffold();
+
+// src/commands/api-keys.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+function loadContext(opts) {
+  const manifest = readManifestOrThrow(opts.dir);
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    throw new Error(
+      `module.json has no module.slug \u2014 the manifest is malformed.`
+    );
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    throw new Error("Not logged in. Run `dashwise login` first.");
+  }
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    throw new Error(
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+    );
+  }
+  return {
+    installationId: entry.installationId,
+    slug,
+    requestOptions: {
+      baseUrl: resolveApiUrl(),
+      auth: { token: cfg.token }
+    }
+  };
+}
+async function apiKeysListCommand(options) {
+  let ctx;
+  try {
+    ctx = loadContext(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let keys;
+  try {
+    const resp = await listApiKeys(ctx.installationId, ctx.requestOptions);
+    keys = resp.api_keys;
+  } catch (err) {
+    return surfaceApiKeysError(err);
+  }
+  const filtered = options.all ? keys : keys.filter((k) => k.revoked_at === null);
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify(filtered, null, 2)}
+`);
+    return 0;
+  }
+  if (filtered.length === 0) {
+    info(
+      options.all ? `No API keys (active or revoked) for ${code(ctx.slug)}.` : `No active API keys for ${code(ctx.slug)}. Run ${code("dashwise api-keys create <name>")} to mint one, or ${code("dashwise api-keys list --all")} to include revoked.`
+    );
+    return 0;
+  }
+  info(`API keys for ${code(ctx.slug)} (install id=${ctx.installationId}):`);
+  for (const k of filtered) {
+    const status = formatKeyStatus(k);
+    const lastUsed = k.last_used_at ? `last used ${formatRelative(new Date(k.last_used_at))}` : "never used";
+    process.stdout.write(
+      `  ${code(`#${k.id}`)} ${k.name} ${dim(`dwk_${k.key_prefix}\u2026`)} ${status} ${dim(`(${lastUsed})`)}
+`
+    );
+  }
+  return 0;
+}
+async function apiKeysCreateCommand(nameArg, options) {
+  const name = nameArg ?? options.name;
+  if (!name) {
+    fail("Usage: `dashwise api-keys create <name>` (e.g. `dashwise api-keys create production`)");
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = loadContext(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const body = { name };
+  if (options.scopes !== void 0) {
+    body.scopes = options.scopes.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  if (options.expiresAt !== void 0) {
+    body.expires_at = options.expiresAt;
+  }
+  let resp;
+  try {
+    resp = await createApiKey(ctx.installationId, body, ctx.requestOptions);
+  } catch (err) {
+    return surfaceApiKeysError(err);
+  }
+  if (options.rawOnly) {
+    process.stderr.write(
+      `Created API key #${resp.api_key.id} (${resp.api_key.name}) for install ${ctx.installationId}.
+`
+    );
+    process.stdout.write(`${resp.raw_key}
+`);
+    return 0;
+  }
+  success(
+    `Created API key ${code(`#${resp.api_key.id}`)} (${resp.api_key.name}) for ${code(ctx.slug)}.`
+  );
+  info("");
+  warn(
+    "This is the ONLY time the full key is displayed. Save it now \u2014 the backend stores a hash, not the plaintext."
+  );
+  info("");
+  process.stdout.write(`  ${code(resp.raw_key)}
+`);
+  info("");
+  info(`Use in a deployed module's env:`);
+  info(`  ${code(`DASHWISE_API_KEY=${resp.raw_key.slice(0, 12)}\u2026`)}`);
+  info(
+    `  ${code(`DASHWISE_INSTALLATION_ID=${ctx.installationId}`)}`
+  );
+  info(
+    `  ${code(`DASHWISE_API_URL=${resolveApiUrl()}`)}`
+  );
+  return 0;
+}
+async function apiKeysRevokeCommand(keyIdArg, options) {
+  if (!keyIdArg) {
+    fail("Usage: `dashwise api-keys revoke <key-id>` \u2014 id from `dashwise api-keys list`");
+    return 1;
+  }
+  const keyId = Number.parseInt(keyIdArg, 10);
+  if (!Number.isFinite(keyId) || keyId <= 0) {
+    fail(`Invalid key id "${keyIdArg}" \u2014 expected a positive integer.`);
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = loadContext(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  if (!options.yes) {
+    info(
+      `Revoking API key #${keyId} for ${code(ctx.slug)} (install ${ctx.installationId}). Pass ${code("--yes")} to skip this confirmation in scripts.`
+    );
+  }
+  let resp;
+  try {
+    resp = await revokeApiKey(ctx.installationId, keyId, ctx.requestOptions);
+  } catch (err) {
+    return surfaceApiKeysError(err);
+  }
+  success(
+    `Revoked API key #${resp.api_key.id} (${resp.api_key.name}). Future requests with this key will return 401.`
+  );
+  return 0;
+}
+function surfaceApiKeysError(err) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "UNAUTHENTICATED":
+        fail(
+          `Auth rejected by backend. Your CLI token may be stale \u2014 run ${code("dashwise login")} then retry.`
+        );
+        return 1;
+      case "NOT_WORKSPACE_MEMBER":
+        fail(
+          `You're not a member of this installation's workspace. API-key management requires workspace membership.`
+        );
+        return 1;
+      case "INSTALLATION_NOT_FOUND":
+        fail(
+          `Installation not found. It may have been destroyed; re-provision via ${code("dashwise init <slug>")}.`
+        );
+        return 1;
+      case "API_KEY_NOT_FOUND":
+        fail(
+          `API key not found for this installation. Use ${code("dashwise api-keys list")} to see valid ids.`
+        );
+        return 1;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+        return 1;
+    }
+  }
+  fail(`API-key operation failed: ${err.message}`);
+  return 1;
+}
+function formatKeyStatus(k) {
+  if (k.revoked_at) return dim("[revoked]");
+  if (k.expires_at && new Date(k.expires_at).getTime() <= Date.now()) {
+    return dim("[expired]");
+  }
+  return dim("[active]");
+}
+function formatRelative(d) {
+  const deltaMs = Date.now() - d.getTime();
+  const sec = Math.floor(deltaMs / 1e3);
+  if (sec < 60) return `${sec}s ago`;
+  const min = Math.floor(sec / 60);
+  if (min < 60) return `${min}m ago`;
+  const hr = Math.floor(min / 60);
+  if (hr < 24) return `${hr}h ago`;
+  const day = Math.floor(hr / 24);
+  return `${day}d ago`;
+}
+
+// src/commands/env-export.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+var PLACEHOLDER = "<run-`dashwise-api-keys-create-<name>`-and-paste-here>";
+async function envExportCommand(options) {
+  const format = options.format ?? "env";
+  if (!["env", "json", "railway", "vercel", "fly"].includes(format)) {
+    fail(
+      `Unknown --format "${format}". Allowed: env | json | railway | vercel | fly.`
+    );
+    return 1;
+  }
+  if (options.newKey && options.key) {
+    fail(
+      `Pass either --new-key (mint fresh) or --key (paste existing). Not both.`
+    );
+    return 1;
+  }
+  let manifest;
+  try {
+    manifest = readManifestOrThrow(options.dir);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    fail("module.json has no module.slug \u2014 the manifest is malformed.");
+    return 1;
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    fail("Not logged in. Run `dashwise login` first.");
+    return 1;
+  }
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    fail(
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+    );
+    return 1;
+  }
+  const apiUrl = resolveApiUrl();
+  const installationId = entry.installationId;
+  let apiKey;
+  let apiKeyComment = null;
+  if (options.key !== void 0) {
+    if (!options.key.startsWith("dwk_")) {
+      fail(`--key value must start with \`dwk_\` (got "${options.key.slice(0, 8)}\u2026").`);
+      return 1;
+    }
+    apiKey = options.key;
+    apiKeyComment = "# DASHWISE_API_KEY supplied via --key";
+  } else if (options.newKey !== void 0) {
+    try {
+      const resp = await createApiKey(
+        installationId,
+        { name: options.newKey },
+        {
+          baseUrl: apiUrl,
+          auth: { token: cfg.token }
+        }
+      );
+      apiKey = resp.raw_key;
+      apiKeyComment = `# DASHWISE_API_KEY minted by --new-key (id=${resp.api_key.id}, name="${resp.api_key.name}")`;
+      process.stderr.write(
+        `${dim("[env export]")} Minted API key #${resp.api_key.id} (${resp.api_key.name}). The plaintext below is the ONLY time it's shown \u2014 save the file or paste it now.
+`
+      );
+    } catch (err) {
+      if (err instanceof ApiError) {
+        fail(`Failed to mint API key: ${err.code} ${err.status} \u2014 ${err.message}`);
+      } else {
+        fail(`Failed to mint API key: ${err.message}`);
+      }
+      return 1;
+    }
+  } else {
+    apiKey = PLACEHOLDER;
+    apiKeyComment = "# DASHWISE_API_KEY \u2014 run `dashwise api-keys create <name>` to mint one + paste here.";
+  }
+  const entries = [
+    {
+      key: "DASHWISE_API_URL",
+      value: apiUrl,
+      comment: "# DashWise backend URL \u2014 same value the CLI is logged into."
+    },
+    {
+      key: "NEXT_PUBLIC_DASHWISE_API_URL",
+      value: apiUrl,
+      comment: "# Client-side mirror \u2014 Next.js inlines NEXT_PUBLIC_* into the browser bundle so <AuthProvider> hits the right origin."
+    },
+    {
+      key: "DASHWISE_INSTALLATION_ID",
+      value: String(installationId),
+      comment: `# Per-workspace install id for module "${slug}".`
+    },
+    {
+      key: "DASHWISE_API_KEY",
+      value: apiKey,
+      ...apiKeyComment !== null ? { comment: apiKeyComment } : {}
+    }
+  ];
+  process.stdout.write(render(entries, format));
+  if (format !== "json") process.stdout.write("\n");
+  if (apiKey === PLACEHOLDER) {
+    info("");
+    info(
+      `Next: ${code(`dashwise api-keys create <name>`)} \u2192 paste the plaintext into ${code("DASHWISE_API_KEY")}.`
+    );
+  } else if (options.newKey !== void 0) {
+    info("");
+    warn(
+      "API key plaintext is shown ONLY once. Save the output of this command now."
+    );
+  }
+  return 0;
+}
+function render(entries, format) {
+  switch (format) {
+    case "env": {
+      const lines = [];
+      for (const e of entries) {
+        if (e.comment) lines.push(e.comment);
+        lines.push(`${e.key}=${e.value}`);
+        lines.push("");
+      }
+      return lines.join("\n").trimEnd();
+    }
+    case "json": {
+      const obj = {};
+      for (const e of entries) obj[e.key] = e.value;
+      return JSON.stringify(obj, null, 2);
+    }
+    case "railway": {
+      const parts = entries.map((e) => `${e.key}='${e.value.replace(/'/g, "'\\''")}'`);
+      return `railway variables set ${parts.join(" ")}`;
+    }
+    case "vercel": {
+      const lines = entries.map(
+        (e) => `echo ${shellQuote(e.value)} | vercel env add ${e.key} production`
+      );
+      return lines.join("\n");
+    }
+    case "fly": {
+      const parts = entries.map((e) => `${e.key}=${shellQuote(e.value)}`);
+      return `fly secrets set ${parts.join(" ")}`;
+    }
+  }
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+
 // src/commands/query.ts
 init_manifest_io();
 init_output();
@@ -5864,6 +6375,11 @@ var initOptions = (cmd) => cmd.option("--dir <path>", "Override the target direc
 ).option(
   "--no-provision",
   "Skip the `POST /api/installations/dev` step. Local scaffold is still written; you can provision later by re-running `dashwise init --force` (or, once it ships, `dashwise module provision-dev-install`)."
+).addOption(
+  new Option(
+    "--deploy-target <platform>",
+    "Emit a platform deploy config file alongside the scaffold (railway.json | vercel.json | fly.toml). Default: none (clean repo). Pair with `dashwise env export --format <platform>` to push env vars after provisioning."
+  ).choices([...DEPLOY_TARGETS])
 );
 var initAction = async (slugArg, cmdOpts) => {
   process.exitCode = await moduleInitCommand(slugArg, {
@@ -5875,7 +6391,8 @@ var initAction = async (slugArg, cmdOpts) => {
     ...cmdOpts.git !== void 0 ? { git: cmdOpts.git } : {},
     ...cmdOpts.description !== void 0 ? { description: cmdOpts.description } : {},
     ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
-    ...cmdOpts.provision !== void 0 ? { provision: cmdOpts.provision } : {}
+    ...cmdOpts.provision !== void 0 ? { provision: cmdOpts.provision } : {},
+    ...cmdOpts.deployTarget !== void 0 ? { deployTarget: cmdOpts.deployTarget } : {}
   });
 };
 initOptions(
@@ -6005,6 +6522,72 @@ program.command("pull").description(
     ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {}
   });
 });
+var apiKeysCmd = program.command("api-keys").description(
+  "Manage per-installation API keys (`dwk_*`). Pasted into a deployed module's env for production data-plane auth."
+);
+apiKeysCmd.command("list").description(
+  "List API keys for the current module's installation. Active only by default; pass --all for revoked too."
+).option("--dir <path>", "Project root (default: current directory).").option("--all", "Include revoked + expired keys in the output.").option("--json", "Emit JSON instead of the human-friendly table.").action(async (cmdOpts) => {
+  process.exitCode = await apiKeysListCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.all !== void 0 ? { all: cmdOpts.all } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+apiKeysCmd.command("create [name]").description(
+  "Mint a new API key. The plaintext key is displayed ONCE \u2014 save it then."
+).option("--dir <path>", "Project root (default: current directory).").option("--name <name>", "Override the positional name arg (e.g. for scripted use).").option(
+  "--scopes <csv>",
+  "Comma-separated scope strings (e.g. `runtime:read,runtime:write`). Default: full install access."
+).option(
+  "--expires-at <iso>",
+  "ISO-8601 expiry timestamp (e.g. 2026-12-31T23:59:59Z). Default: never expires."
+).option(
+  "--raw-only",
+  "Print only the plaintext key on stdout; chatter goes to stderr. Useful for shell capture: `KEY=$(dashwise api-keys create prod --raw-only)`"
+).action(
+  async (nameArg, cmdOpts) => {
+    process.exitCode = await apiKeysCreateCommand(nameArg, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.name !== void 0 ? { name: cmdOpts.name } : {},
+      ...cmdOpts.scopes !== void 0 ? { scopes: cmdOpts.scopes } : {},
+      ...cmdOpts.expiresAt !== void 0 ? { expiresAt: cmdOpts.expiresAt } : {},
+      ...cmdOpts.rawOnly !== void 0 ? { rawOnly: cmdOpts.rawOnly } : {}
+    });
+  }
+);
+apiKeysCmd.command("revoke [key-id]").description(
+  "Soft-revoke an API key. Backend keeps the row for audit; further requests return 401."
+).option("--dir <path>", "Project root (default: current directory).").option("-y, --yes", "Skip the per-key confirmation message (for CI / scripts).").action(
+  async (keyIdArg, cmdOpts) => {
+    process.exitCode = await apiKeysRevokeCommand(keyIdArg, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
+    });
+  }
+);
+var envCmd = program.command("env").description("Environment-variable helpers for deploying a module.");
+envCmd.command("export").description(
+  "Emit the env vars a deployed module needs to authenticate against DashWise. By default emits .env-style KEY=value lines; --format = env | json | railway | vercel | fly to wrap in platform-native syntax. Use --new-key <name> to mint + inline an API key in one step."
+).option("--dir <path>", "Project root (default: current directory).").option(
+  "--format <fmt>",
+  "Output format: env | json | railway | vercel | fly (default: env)."
+).option(
+  "--new-key <name>",
+  "Mint a fresh API key with this name and inline the plaintext. (Mutually exclusive with --key.)"
+).option(
+  "--key <dwk_value>",
+  "Use a previously-minted API key (paste plaintext). (Mutually exclusive with --new-key.)"
+).action(
+  async (cmdOpts) => {
+    process.exitCode = await envExportCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.format !== void 0 ? { format: cmdOpts.format } : {},
+      ...cmdOpts.newKey !== void 0 ? { newKey: cmdOpts.newKey } : {},
+      ...cmdOpts.key !== void 0 ? { key: cmdOpts.key } : {}
+    });
+  }
+);
 moduleCmd.command("publish").description("Pack the current directory + upload it as a new module version.").option("--dir <path>", "Project root (default: current directory).").option("--bump <direction>", "Semver bump: patch | minor | major.").option("--dry-run", "Validate + upload but do not persist the version row.").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use).").option(
   "--exclude <pattern...>",
   "Extra exclude patterns (segment-matched) appended to the defaults."
@@ -6196,7 +6779,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 })();
 function getVersion() {
-  return "0.4.0";
+  return "0.5.1";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);