@dashai/cli 0.5.0 → 0.5.1

package/README.md

@@ -6,7 +6,7 @@
 
 ## Status
 
-`0.1.x` — full author workflow + **Query Plane v1 author tooling** + **P7 cross-module-action observability** (shipped 2026-05-20). Commands: `login`, `logout`, `profile`, `workspace`, `module init` (incl. `--custom`) / `connect-git` / `generate` / `dev` / `validate` / `list` / `publish` / `diff` / `pull-data` / `clone` / `query-log` / `action-log`, plus `query` (run AST queries against the local module) and `deps add` / `list` / `remove` / `check`.
+`0.5.x` — full author workflow + **Query Plane v1 author tooling** + **P7 cross-module-action observability** (shipped 2026-05-20) + **BaaS Phase 1 deploy loop** (`api-keys`, `env export`, `--deploy-target`; shipped 2026-05-24). Commands: `login`, `logout`, `profile`, `workspace`, `init` / `module init` (incl. `--custom`, `--deploy-target railway|vercel|fly`) / `connect-git` / `generate` / `dev` / `validate` / `list` / `publish` / `diff` / `pull-data` / `clone` / `query-log` / `action-log`, plus `query` (run AST queries against the local module), `pull` (sync canonical manifest from backend), `api-keys list|create|revoke`, `env export`, and `deps add` / `list` / `remove` / `check`.
 
 ## Install
 
@@ -103,23 +103,25 @@ Flags:
 
 Requires `dashwise login` first — the command refuses to start if no token is resolvable. The runtime-token injection requires `dashwise init <slug>` (LDI-6); the dev session SSO setup works without it.
 
-### `dashwise module init [slug]`
+### `dashwise init [slug]` / `dashwise module init [slug]`
 
-Scaffold a new DashWise module in a fresh directory. Two flavors:
+Scaffold a new DashWise module in a fresh directory. `dashwise init` is a top-level alias for `dashwise module init` — both accept the same flags. Two flavors:
 
-**Hand-authored** (default) — simple module-runtime app (isolate runtime). 10 files: `module.json`, `package.json`, `tsconfig.json`, `next.config.mjs`, `next-env.d.ts`, `.gitignore`, `.env.local.example`, `app/layout.tsx`, `app/page.tsx`, `README.md`.
+**Custom** (default since 2026-05-18) — full Next.js App Router app with SDK auth wired in (machine runtime, lands on Fly Machines once P7 ships). Files: `module.json`, `package.json`, `tsconfig.json`, `next.config.mjs`, `next-env.d.ts`, `middleware.ts` (uses `@dashai/sdk/auth/middleware`), `app/layout.tsx`, `app/page.tsx`, `app/dashboard/page.tsx` (auth-gated Server Component example), three `app/api/auth/*` route handlers, shadcn primitives + a `globals.css`, plus `CLAUDE.md` / `spec.md` / `agent-log.md` agent-facing docs. `module.json` carries `module_kind: 'custom'` + `runtime.kind: 'machine'`.
 
-**Custom** (`--custom`) — full Next.js App Router app with SDK auth wired in (machine runtime, lands on Fly Machines once P7 ships). Adds 5 files on top of the hand-authored set: `middleware.ts` (uses `@dashai/sdk/auth/middleware`), `app/dashboard/page.tsx` (auth-gated Server Component example), and three `app/api/auth/*` route handlers (`sign-in`, `callback`, `sign-out`). `module.json` carries `module_kind: 'custom'` + `runtime.kind: 'machine'`.
+**Hand-authored** (`--simple`) — the legacy simple module-runtime app (isolate runtime). 10 files total: no middleware, no `/api/auth/*`, no dashboard. Suitable for public viewers / demo modules that don't need SSO.
 
 Flags:
 - `--dir <path>` — Target directory (default `./<slug>`).
 - `--name <name>` — Human-readable module name (default: derived from slug).
 - `--force` — Overwrite an existing non-empty directory.
-- `--custom` — Use the full Next.js custom-module scaffold.
+- `--simple` — Use the legacy minimal scaffold (hand-authored, no Next.js auth wiring).
+- `--custom` — *[Deprecated alias — kept for back-compat.]* Equivalent to the default. Will be removed in a future major version.
 - `--git <url>` — Initial Git repository URL. Written to `module.json#repository.url`.
 - `--description <text>` — Module description forwarded to the backend when provisioning the dev installation (HH-CC-LDI-6). No effect under `--no-provision`.
 - `--workspace <slug-or-id>` — Target workspace for the dev installation (HH-CC-LDI-6). When omitted in a TTY, the CLI prompts; auto-picked if your account has one workspace; in non-interactive mode with multiple workspaces, errors with the list.
 - `--no-provision` — Skip the `POST /api/installations/dev` step (HH-CC-LDI-6). Local scaffold is still written, but the module won't have a backing dev installation — `dashwise dev` data-plane calls will fail with `UnauthenticatedError` until you re-run `dashwise init --force` or (once it ships) `dashwise module provision-dev-install`.
+- `--deploy-target railway|vercel|fly` (HH-CC-P1-D2) — Emit a platform deploy config file alongside the scaffold (`railway.json`, `vercel.json`, or `fly.toml`). Default: none (clean repo). Pair with `dashwise env export --format <platform>` to push env vars after provisioning. See [`docs/deploying.md`](../../docs/deploying.md) for the full deploy walkthrough.
 
 **Provisioning behavior (HH-CC-LDI-6):** by default, after the local scaffold is written, `dashwise init` provisions a real local-dev installation by calling `POST /api/installations/dev`. The returned runtime token (90-day JWT) is cached in `~/.config/dashwise/auth.json#modules[<slug>]` where `@dashai/sdk`'s `createDevClient({ moduleSlug })` reads it on every dev-server boot. Provisioning failures are surfaced as warnings; the local scaffold remains usable so you can retry later.
 
@@ -297,6 +299,76 @@ Flags:
 
 Pre-reqs: `dashwise module generate` must have run (the SDK reads `node_modules/@dashai/generated`). `DASHWISE_API_URL`, `DASHWISE_INSTALLATION_ID`, `DASHWISE_API_TOKEN` must be set (the scaffold's `.env.local` is loaded automatically).
 
+### `dashwise pull` (HH-CC-P1-E2)
+
+Fetch the canonical manifest from the backend and write it to local `module.json`. The inverse of `dashwise table create` / `field add` — useful after dashboard-side schema edits, DashAI mutations, or teammate-driven changes.
+
+The backend (`GET /api/installations/:id/schema`) is the source of truth; `pull` materializes that locally. `dashwise dev`'s watcher polls this endpoint automatically, so most authors don't need to invoke `pull` manually.
+
+```
+$ dashwise pull
+ℹ Backend at ab12cd34 — local at 9f8e7d6c. Writing module.json…
+✓ module.json updated (3 tables, 18 fields).
+```
+
+Flags:
+- `--dir <path>` — Project root (default: current directory).
+- `--dry-run` — Print the diff but don't write.
+
+### `dashwise api-keys list|create|revoke` (HH-CC-P1-C4)
+
+Mint long-lived production credentials for a `production` install. Used by self-hosted deploys (Railway / Vercel / Fly / your own infra) instead of the per-CLI-session runtime token. The key format is `dwk_<43-char-base64url>`; the backend stores only a `sha256` hash so the plaintext is shown exactly once at `create`.
+
+```sh
+# Mint a key. Plaintext appears on stdout — copy it now.
+dashwise api-keys create production
+
+# Script-friendly: capture the raw key with no other chatter.
+KEY=$(dashwise api-keys create ci --raw-only)
+
+# List all keys for the current install.
+dashwise api-keys list
+
+# Revoke. Irreversible. Effective on the next request.
+dashwise api-keys revoke <key-id>
+```
+
+The install is resolved from the cached entry in `~/.config/dashwise/auth.json#modules[<slug>]` (keyed by `module.json#module.slug`). Run from inside the module directory, or pass `--dir <path>`.
+
+Pairs with `dashwise env export --key dwk_...` to push the key into a deploy platform without ever copy-pasting it through a shell history.
+
+### `dashwise env export` (HH-CC-P1-D1)
+
+Emit the four env vars every self-hosted deploy needs:
+
+| Var | Source |
+|---|---|
+| `DASHWISE_API_URL` | CLI config (`apiUrl`). |
+| `NEXT_PUBLIC_DASHWISE_API_URL` | Same. |
+| `DASHWISE_INSTALLATION_ID` | `~/.config/dashwise/auth.json#modules[<slug>].installationId` (the dev install cached at `dashwise init`). |
+| `DASHWISE_API_KEY` | Placeholder by default; pass `--key dwk_...` to inline an existing key, or `--new-key <name>` to mint one in-flight. |
+
+Five output formats — `env`, `json`, `railway`, `vercel`, `fly`. The platform-specific ones wrap each var in the matching CLI invocation (`railway variables set …`, `vercel env add …`, `fly secrets set …`) so the output is directly pipeable into `sh`.
+
+```sh
+# .env syntax — copy/paste into a host that reads .env files.
+dashwise env export --format env > .env.production
+
+# Push straight into Railway.
+dashwise env export --key dwk_... --format railway | sh
+
+# Mint and inline a new key in one step.
+dashwise env export --new-key prod --format vercel | sh
+```
+
+Stdout carries only the env block (clean for piping); status chatter goes to stderr.
+
+Flags:
+- `--format env|json|railway|vercel|fly` — Output format. Default: `env`.
+- `--key dwk_<...>` — Inline an existing API key.
+- `--new-key <name>` — Mint a new API key and inline its plaintext.
+- `--dir <path>` — Project root.
+
 ### `dashwise module query-log`
 
 Read the per-module SDK query log (each cross-module / `.execute()` / `.stream()` / `.explain()` dispatch writes a row to `module_query_log` server-side). Workspace-member-scoped on the backend.

package/dist/bin.js

@@ -4,7 +4,7 @@ import { tmpdir, platform, homedir } from 'os';
 import { resolve, join, dirname, relative } from 'path';
 import pc from 'picocolors';
 import { intro, log, select, isCancel, cancel, spinner, outro, text, multiselect, confirm } from '@clack/prompts';
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
 import { spawn, spawnSync } from 'child_process';
 import open from 'open';
 import * as tar from 'tar';
@@ -394,6 +394,9 @@ var init_output = __esm({
 });
 
 // src/lib/scaffold.ts
+function isDeployTarget(value) {
+  return DEPLOY_TARGETS.includes(value);
+}
 function manifestJson(opts) {
   const kind = opts.kind ?? "hand_authored";
   const manifest = {
@@ -1017,6 +1020,7 @@ function appApiAuthSignInTs() {
 // the DashWise FE \`/login?return_to=...\` automatically \u2014 you don't
 // need to handle the "user not logged in" case here.
 import { NextResponse } from 'next/server';
+import { getPublicOrigin } from '@/lib/request-origin';
 
 export function GET(request: Request) {
   const url = new URL(request.url);
@@ -1042,8 +1046,10 @@ export function GET(request: Request) {
 
   // Absolute URL for return_to so the backend knows which host to
   // bounce back to (the callback path is fixed at /api/auth/callback
-  // by SDK convention).
-  const moduleOrigin = url.origin;
+  // by SDK convention). \`getPublicOrigin\` reads \`X-Forwarded-Host\`
+  // when present so the redirect URL points at the public domain,
+  // not the internal Node origin behind reverse proxies.
+  const moduleOrigin = getPublicOrigin(request);
   const absoluteReturnTo = \`\${moduleOrigin}\${returnTo}\`;
 
   let ssoStart;
@@ -1077,12 +1083,17 @@ function appApiAuthCallbackTs() {
 //      (e.g. \`access_denied\`, \`server_error\`, \`invalid_request\`).
 import { NextResponse } from 'next/server';
 import { exchangeCode } from '@dashai/sdk/auth/server';
+import { getPublicOrigin } from '@/lib/request-origin';
 
 export async function GET(request: Request) {
   const url = new URL(request.url);
+  // Resolve the public origin once \u2014 all redirects below are
+  // back to this module, and behind a reverse proxy url.origin is
+  // the internal Node origin (localhost:<PORT>), not the public host.
+  const publicOrigin = getPublicOrigin(request);
   const error = url.searchParams.get('error');
   if (error) {
-    const target = new URL('/sign-in-error', url.origin);
+    const target = new URL('/sign-in-error', publicOrigin);
     target.searchParams.set('code', error);
     const description = url.searchParams.get('error_description');
     if (description) target.searchParams.set('description', description);
@@ -1091,19 +1102,19 @@ export async function GET(request: Request) {
   const code = url.searchParams.get('code');
   const returnTo = url.searchParams.get('return_to') ?? '/';
   if (!code) {
-    const target = new URL('/sign-in-error', url.origin);
+    const target = new URL('/sign-in-error', publicOrigin);
     target.searchParams.set('code', 'missing_code');
     return NextResponse.redirect(target);
   }
   try {
     await exchangeCode(code); // sets the dashwise.session cookie
   } catch (err) {
-    const target = new URL('/sign-in-error', url.origin);
+    const target = new URL('/sign-in-error', publicOrigin);
     target.searchParams.set('code', 'exchange_failed');
     target.searchParams.set('description', (err as Error).message);
     return NextResponse.redirect(target);
   }
-  return NextResponse.redirect(new URL(returnTo, url.origin));
+  return NextResponse.redirect(new URL(returnTo, publicOrigin));
 }
 `;
 }
@@ -1116,10 +1127,14 @@ function appApiAuthSignOutTs() {
 // to follow with GET (not re-POST), landing on the public '/' page.
 import { NextResponse } from 'next/server';
 import { signOut } from '@dashai/sdk/auth/server';
+import { getPublicOrigin } from '@/lib/request-origin';
 
 export async function POST(request: Request) {
   await signOut();
-  return NextResponse.redirect(new URL('/', request.url), 303);
+  // Build the redirect against the public origin so we don't land
+  // the user on \`http://localhost:<PORT>/\` when running behind a
+  // reverse proxy (Railway/Vercel/Fly).
+  return NextResponse.redirect(new URL('/', getPublicOrigin(request)), 303);
 }
 `;
 }
@@ -1293,6 +1308,36 @@ export function cn(...inputs: ClassValue[]) {
 }
 `;
 }
+function libRequestOriginTs() {
+  return `/**
+ * Resolve the **public** origin of an incoming request.
+ *
+ * Behind a reverse proxy (Railway, Vercel, Fly, Cloudflare, an
+ * nginx in front of a Node container, etc.) \`new URL(request.url)\`
+ * reports the *internal* origin the Node process is bound to \u2014
+ * usually \`http://localhost:<PORT>\` \u2014 not the public URL the
+ * browser hit. The proxy preserves the public origin in
+ * \`X-Forwarded-*\` headers; we read those first.
+ *
+ * Falls back to \`new URL(request.url).origin\` for local dev where
+ * there's no proxy in front of Next.js.
+ *
+ * Both \`x-forwarded-proto\` and \`x-forwarded-host\` can be
+ * comma-separated when multiple proxies chain; the leftmost entry
+ * is the original client-facing one per RFC 7239 conventions.
+ */
+export function getPublicOrigin(request: Request): string {
+  const forwardedProto = request.headers.get('x-forwarded-proto');
+  const forwardedHost = request.headers.get('x-forwarded-host');
+  if (forwardedProto && forwardedHost) {
+    const proto = forwardedProto.split(',')[0].trim();
+    const host = forwardedHost.split(',')[0].trim();
+    return \`\${proto}://\${host}\`;
+  }
+  return new URL(request.url).origin;
+}
+`;
+}
 function componentsUiButtonTsx() {
   return `import * as React from "react";
 import { cva, type VariantProps } from "class-variance-authority";
@@ -1750,9 +1795,63 @@ Format (reverse chronological, newest first):
 schema mutation.
 `;
 }
-var SCAFFOLD_DEFAULT_API_URL;
+function railwayJson(_opts) {
+  return JSON.stringify(
+    {
+      $schema: "https://railway.com/railway.schema.json",
+      build: {
+        builder: "NIXPACKS"
+      },
+      deploy: {
+        restartPolicyType: "ON_FAILURE",
+        restartPolicyMaxRetries: 3
+      }
+    },
+    null,
+    2
+  ) + "\n";
+}
+function vercelJson(_opts) {
+  return JSON.stringify(
+    {
+      $schema: "https://openapi.vercel.sh/vercel.json",
+      framework: "nextjs"
+    },
+    null,
+    2
+  ) + "\n";
+}
+function flyToml(opts) {
+  return `# fly.toml \u2014 generated by \`dashwise init --deploy-target fly\`.
+# Run \`fly launch --no-deploy --copy-config\` to register this app with
+# Fly; the launcher will read this file and prompt for anything missing.
+#
+# Edit \`app\` if the slug is already taken globally on fly.io.
+# Edit \`primary_region\` for non-US-East deploys (https://fly.io/docs/reference/regions/).
+
+app = "${opts.slug}"
+primary_region = "iad"
+
+[build]
+
+[http_service]
+  internal_port = 3000
+  force_https = true
+  auto_stop_machines = "stop"
+  auto_start_machines = true
+  min_machines_running = 0
+  processes = ["app"]
+
+[[vm]]
+  cpu_kind = "shared"
+  cpus = 1
+  memory_mb = 256
+`;
+}
+var DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL;
 var init_scaffold = __esm({
   "src/lib/scaffold.ts"() {
+    DEPLOY_TARGETS = ["railway", "vercel", "fly"];
     SCAFFOLD_DEFAULT_API_URL = "http://localhost:3000";
   }
 });
@@ -1854,6 +1953,12 @@ async function moduleInitCommand(slugArg, options) {
     );
     return 1;
   }
+  if (options.deployTarget !== void 0 && !isDeployTarget(options.deployTarget)) {
+    fail(
+      `Invalid --deploy-target ${code(options.deployTarget)} \u2014 must be one of ${DEPLOY_TARGETS.map((t) => code(t)).join(", ")}.`
+    );
+    return 1;
+  }
   const kind = options.simple ? "hand_authored" : "custom";
   const scaffoldOpts = {
     slug,
@@ -1886,6 +1991,7 @@ async function moduleInitCommand(slugArg, options) {
       ["postcss.config.mjs", postcssConfigMjs()],
       ["app/globals.css", globalsCss()],
       ["lib/utils.ts", libUtilsTs()],
+      ["lib/request-origin.ts", libRequestOriginTs()],
       ["components/theme-provider.tsx", componentsThemeProviderTsx()],
       ["components/ui/button.tsx", componentsUiButtonTsx()],
       ["components/ui/card.tsx", componentsUiCardTsx()],
@@ -1904,6 +2010,19 @@ async function moduleInitCommand(slugArg, options) {
       ["app/page.tsx", appPageTsx(scaffoldOpts)]
     );
   }
+  if (options.deployTarget !== void 0) {
+    switch (options.deployTarget) {
+      case "railway":
+        files.push(["railway.json", railwayJson()]);
+        break;
+      case "vercel":
+        files.push(["vercel.json", vercelJson()]);
+        break;
+      case "fly":
+        files.push(["fly.toml", flyToml(scaffoldOpts)]);
+        break;
+    }
+  }
   for (const [relPath, content] of files) {
     const absPath = join(dir, relPath);
     const parentDir = join(absPath, "..");
@@ -5243,6 +5362,9 @@ function surfacePullFailure(err) {
   return 1;
 }
 
+// src/bin.ts
+init_scaffold();
+
 // src/commands/api-keys.ts
 init_api_client();
 init_config();
@@ -6253,6 +6375,11 @@ var initOptions = (cmd) => cmd.option("--dir <path>", "Override the target direc
 ).option(
   "--no-provision",
   "Skip the `POST /api/installations/dev` step. Local scaffold is still written; you can provision later by re-running `dashwise init --force` (or, once it ships, `dashwise module provision-dev-install`)."
+).addOption(
+  new Option(
+    "--deploy-target <platform>",
+    "Emit a platform deploy config file alongside the scaffold (railway.json | vercel.json | fly.toml). Default: none (clean repo). Pair with `dashwise env export --format <platform>` to push env vars after provisioning."
+  ).choices([...DEPLOY_TARGETS])
 );
 var initAction = async (slugArg, cmdOpts) => {
   process.exitCode = await moduleInitCommand(slugArg, {
@@ -6264,7 +6391,8 @@ var initAction = async (slugArg, cmdOpts) => {
     ...cmdOpts.git !== void 0 ? { git: cmdOpts.git } : {},
     ...cmdOpts.description !== void 0 ? { description: cmdOpts.description } : {},
     ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
-    ...cmdOpts.provision !== void 0 ? { provision: cmdOpts.provision } : {}
+    ...cmdOpts.provision !== void 0 ? { provision: cmdOpts.provision } : {},
+    ...cmdOpts.deployTarget !== void 0 ? { deployTarget: cmdOpts.deployTarget } : {}
   });
 };
 initOptions(
@@ -6651,7 +6779,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 })();
 function getVersion() {
-  return "0.5.0";
+  return "0.5.1";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);