@dashai/cli 0.8.1 → 0.10.0

package/dist/bin.js

@@ -256,53 +256,185 @@ async function revokeApiKey(installationId, keyId, options = {}) {
     options
   );
 }
-async function createTable(installationId, body, options = {}) {
+async function getOrigins(installationId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/origins`,
+    void 0,
+    options
+  );
+}
+async function setOrigins(installationId, allowedOrigins, options = {}) {
+  return apiRequest(
+    "PUT",
+    `/api/installations/${installationId}/origins`,
+    { allowed_origins: allowedOrigins },
+    options
+  );
+}
+async function createTable(body, options = {}) {
   return apiRequest(
     "POST",
-    `/api/installations/${installationId}/schema/tables`,
+    `/api/module-api/schema/tables`,
     body,
     options
   );
 }
-async function dropTable(installationId, tableSlug, options = {}) {
+async function dropTable(tableSlug, options = {}) {
   return apiRequest(
     "DELETE",
-    `/api/installations/${installationId}/schema/tables/${tableSlug}`,
+    `/api/module-api/schema/tables/${tableSlug}`,
     void 0,
     options
   );
 }
-async function addField(installationId, body, options = {}) {
+async function addField(body, options = {}) {
   return apiRequest(
     "POST",
-    `/api/installations/${installationId}/schema/fields`,
+    `/api/module-api/schema/fields`,
     body,
     options
   );
 }
-async function updateField(installationId, tableSlug, fieldSlug, body, options = {}) {
+async function updateField(tableSlug, fieldSlug, body, options = {}) {
   return apiRequest(
     "PATCH",
-    `/api/installations/${installationId}/schema/fields/${tableSlug}/${fieldSlug}`,
+    `/api/module-api/schema/fields/${tableSlug}/${fieldSlug}`,
     body,
     options
   );
 }
-async function getInstallationSchema(installationId, options = {}) {
+async function getInstallationSchema(options = {}) {
   return apiRequest(
     "GET",
-    `/api/installations/${installationId}/schema`,
+    `/api/module-api/schema`,
     void 0,
     options
   );
 }
-async function removeField(installationId, tableSlug, fieldSlug, options = {}) {
+async function removeField(tableSlug, fieldSlug, options = {}) {
   return apiRequest(
     "DELETE",
-    `/api/installations/${installationId}/schema/fields/${tableSlug}/${fieldSlug}`,
+    `/api/module-api/schema/fields/${tableSlug}/${fieldSlug}`,
+    void 0,
+    options
+  );
+}
+async function getInstallationDependencies(installationId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/dependencies`,
+    void 0,
+    options
+  );
+}
+async function bindDependency(installationId, providerSlug, body = {}, options = {}) {
+  return apiRequest(
+    "POST",
+    `/api/installations/${installationId}/dependencies/${providerSlug}/bind`,
+    body,
+    options
+  );
+}
+async function unbindDependency(installationId, providerSlug, options = {}) {
+  return apiRequest(
+    "POST",
+    `/api/installations/${installationId}/dependencies/${providerSlug}/unbind`,
+    void 0,
+    options
+  );
+}
+async function getInstallationBindings(installationId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/bindings`,
+    void 0,
+    options
+  );
+}
+async function getBindingCandidates(installationId, usesSlug, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/bindings/${encodeURIComponent(usesSlug)}/candidates`,
+    void 0,
+    options
+  );
+}
+async function putBinding(installationId, usesSlug, body, options = {}) {
+  return apiRequest(
+    "PUT",
+    `/api/installations/${installationId}/bindings/${encodeURIComponent(usesSlug)}`,
+    body,
+    options
+  );
+}
+async function unbindBinding(installationId, usesSlug, options = {}) {
+  return apiRequest(
+    "POST",
+    `/api/installations/${installationId}/bindings/${encodeURIComponent(usesSlug)}/unbind`,
+    void 0,
+    options
+  );
+}
+async function declineBinding(installationId, usesSlug, options = {}) {
+  return apiRequest(
+    "POST",
+    `/api/installations/${installationId}/bindings/${encodeURIComponent(usesSlug)}/decline`,
+    void 0,
+    options
+  );
+}
+function slugifyFieldName(name) {
+  return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+async function introspectWorkspaceTable(_installationId, tableNameOrId, options = {}) {
+  const ref = String(tableNameOrId).trim();
+  const asNumber = Number(ref);
+  if (!Number.isInteger(asNumber) || asNumber <= 0 || String(asNumber) !== ref) {
+    const message = `"${ref}" is not a numeric table id. Pass the workspace table's numeric id (find it in the Dashwise UI URL, or via \`GET /api/tables/application/:applicationId\`). Resolving a table by name is not yet supported by this command.`;
+    throw new ApiError(0, { code: "NON_NUMERIC_TABLE_REF", message }, message);
+  }
+  const table = await apiRequest(
+    "GET",
+    `/api/tables/${asNumber}`,
     void 0,
     options
   );
+  const rawFields = await apiRequest(
+    "GET",
+    `/api/fields/table/${asNumber}`,
+    void 0,
+    options
+  );
+  const fields = rawFields.map((f) => ({
+    id: f.id,
+    slug: slugifyFieldName(f.name),
+    name: f.name,
+    type: f.type,
+    ...f.is_required !== void 0 ? { required: f.is_required } : {}
+  }));
+  return {
+    table_id: table.id,
+    name: table.name,
+    slug: slugifyFieldName(table.name),
+    fields
+  };
+}
+async function getModuleBySlug(slug, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/modules/by-slug/${encodeURIComponent(slug)}`,
+    void 0,
+    options
+  );
+}
+async function applyDraftManifest(moduleId, manifest, options = {}) {
+  return apiRequest(
+    "PUT",
+    `/api/modules/${moduleId}/draft/manifest`,
+    manifest,
+    options
+  );
 }
 var ApiError;
 var init_api_client = __esm({
@@ -326,38 +458,6 @@ var init_api_client = __esm({
     };
   }
 });
-function manifestPath(dir) {
-  return join(resolve(dir ?? process.cwd()), "module.json");
-}
-function readManifest(dir) {
-  const path = manifestPath(dir);
-  if (!existsSync(path)) return null;
-  const raw = readFileSync(path, "utf-8");
-  try {
-    return JSON.parse(raw);
-  } catch (err) {
-    throw new Error(
-      `Failed to parse ${path}: ${err.message}. Fix or delete the file and re-run.`
-    );
-  }
-}
-function writeManifest(manifest, dir) {
-  const path = manifestPath(dir);
-  writeFileSync(path, JSON.stringify(manifest, null, 2) + "\n", "utf-8");
-}
-function readManifestOrThrow(dir) {
-  const manifest = readManifest(dir);
-  if (!manifest) {
-    throw new Error(
-      `No module.json found in ${resolve(dir ?? process.cwd())}. Run \`dashwise module init\` first or pass \`--dir <path>\`.`
-    );
-  }
-  return manifest;
-}
-var init_manifest_io = __esm({
-  "src/lib/manifest-io.ts"() {
-  }
-});
 function success(msg) {
   process.stderr.write(`${pc.green("\u2713")} ${msg}
 `);
@@ -393,6 +493,38 @@ var init_output = __esm({
   "src/lib/output.ts"() {
   }
 });
+function manifestPath(dir) {
+  return join(resolve(dir ?? process.cwd()), "module.json");
+}
+function readManifest(dir) {
+  const path = manifestPath(dir);
+  if (!existsSync(path)) return null;
+  const raw = readFileSync(path, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse ${path}: ${err.message}. Fix or delete the file and re-run.`
+    );
+  }
+}
+function writeManifest(manifest, dir) {
+  const path = manifestPath(dir);
+  writeFileSync(path, JSON.stringify(manifest, null, 2) + "\n", "utf-8");
+}
+function readManifestOrThrow(dir) {
+  const manifest = readManifest(dir);
+  if (!manifest) {
+    throw new Error(
+      `No module.json found in ${resolve(dir ?? process.cwd())}. Run \`dashwise module init\` first or pass \`--dir <path>\`.`
+    );
+  }
+  return manifest;
+}
+var init_manifest_io = __esm({
+  "src/lib/manifest-io.ts"() {
+  }
+});
 
 // src/lib/scaffold.ts
 function isDeployTarget(value) {
@@ -409,7 +541,19 @@ function manifestJson(opts) {
     },
     module_kind: kind,
     owns: {
-      tables: []
+      tables: [
+        {
+          // NOTE: no `name` key here — the backend manifest validator
+          // (POST /api/installations/dev) is strict and rejects unrecognized
+          // table keys, and it derives the display name from the slug. A
+          // `name` here would fail provisioning's table materialization (#4).
+          slug: "items",
+          fields: [
+            { slug: "title", type: "text" },
+            { slug: "done", type: "boolean" }
+          ]
+        }
+      ]
     }
   };
   if (kind === "custom") {
@@ -440,7 +584,7 @@ function packageJson(opts) {
         start: "next start"
       },
       dependencies: {
-        "@dashai/sdk": "^0.8.0",
+        "@dashai/sdk": "^2.0.0",
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0"
@@ -485,9 +629,27 @@ function tsconfigJson() {
 }
 function nextConfig() {
   return `/** @type {import("next").NextConfig} */
+//
+// Phase 2 two-var contract: the deploy env supplies exactly
+// DASHWISE_API_URL + DASHWISE_API_KEY. The browser needs the API URL
+// too (the SDK's <AuthProvider> calls /api/auth/sessions/me on it), so
+// we DERIVE NEXT_PUBLIC_DASHWISE_API_URL here from DASHWISE_API_URL at
+// build/start time \u2014 you never set the NEXT_PUBLIC_ var yourself. If
+// you already have one set (e.g. a custom setup), it wins.
+const apiUrl = process.env.DASHWISE_API_URL;
+
 const nextConfig = {
+  // Required for the platform-hosted (per-install Lambda) runtime: the
+  // injected wrapper probes [.next/standalone/server.js, server.js] and
+  // exit(1)s the cold start if neither exists. Without this the built
+  // Lambda FATALs. Harmless for local \`next dev\` / \`next start\`.
+  output: 'standalone',
   typescript: { ignoreBuildErrors: true },
   eslint: { ignoreDuringBuilds: true },
+  env: {
+    NEXT_PUBLIC_DASHWISE_API_URL:
+      process.env.NEXT_PUBLIC_DASHWISE_API_URL ?? apiUrl,
+  },
 };
 export default nextConfig;
 `;
@@ -531,16 +693,18 @@ function gitignore() {
 function envLocalExample(apiUrl = SCAFFOLD_DEFAULT_API_URL) {
   return [
     "# Copy to .env.local + fill in real values.",
-    "# These vars are auto-injected by `dashwise dev` (the unified dev loop)",
-    "# from ~/.config/dashwise/auth.json \u2014 you only need to edit this file if",
-    "# you want to point at a non-default backend or run `next dev` standalone.",
+    "# Phase 2 two-var contract: exactly these two vars. `dashwise dev`",
+    "# auto-injects both from ~/.config/dashwise/auth.json \u2014 you only need",
+    "# to edit this file if you point at a non-default backend or run",
+    "# `next dev` standalone.",
+    "#",
+    "# The browser needs the API URL too; next.config derives",
+    "# NEXT_PUBLIC_DASHWISE_API_URL from DASHWISE_API_URL, so you never set",
+    "# it yourself.",
     `DASHWISE_API_URL=${apiUrl}`,
-    "# Client-side mirror \u2014 Next.js inlines NEXT_PUBLIC_* into the browser",
-    "# bundle so the SDK's <AuthProvider> can hit `/api/auth/sessions/me`",
-    "# on the right origin. Should match DASHWISE_API_URL above.",
-    `NEXT_PUBLIC_DASHWISE_API_URL=${apiUrl}`,
-    "DASHWISE_API_TOKEN=",
-    "DASHWISE_INSTALLATION_ID=local",
+    "# Scoped `dwk_` API key \u2014 mint with `dashwise api-keys create <name>`",
+    "# for deploys; `dashwise dev` injects the local-dev key automatically.",
+    "DASHWISE_API_KEY=",
     ""
   ].join("\n");
 }
@@ -548,24 +712,22 @@ function envLocal(apiUrl = SCAFFOLD_DEFAULT_API_URL) {
   return [
     "# Local dev config \u2014 auto-generated by `dashwise module init`.",
     `# Backend URL pinned to your logged-in CLI config (${apiUrl}). Gitignored;`,
-    "# safe to edit. `dashwise dev` (the unified loop) auto-injects",
-    "# DASHWISE_API_TOKEN from ~/.config/dashwise/auth.json AND",
-    "# DASHWISE_DEV_SESSION_ID from the dev session it registers \u2014 so",
-    "# you typically don't need to set either here. Change DASHWISE_API_URL",
-    "# (and NEXT_PUBLIC_DASHWISE_API_URL to match) to point at a different",
-    "# backend.",
+    "# safe to edit. `dashwise dev` (the unified loop) auto-injects the",
+    "# Phase 2 two-var contract \u2014 DASHWISE_API_URL + the per-module `dwk_`",
+    "# DASHWISE_API_KEY \u2014 from ~/.config/dashwise/auth.json, so you",
+    "# typically don't need to set either here.",
     "#",
-    "# DASHWISE_INSTALLATION_ID is only needed AFTER you publish + install",
-    "# the module in a workspace; until then dev mode (DASHWISE_DEV_SESSION_ID,",
-    "# auto-set by `dashwise dev`) is the auth path.",
+    "# The browser needs the API URL too; next.config derives",
+    "# NEXT_PUBLIC_DASHWISE_API_URL from DASHWISE_API_URL automatically.",
+    "# There is no DASHWISE_INSTALLATION_ID \u2014 the API key resolves the",
+    "# install server-side.",
     `DASHWISE_API_URL=${apiUrl}`,
-    "# Client-side mirror (must match DASHWISE_API_URL). Next.js inlines",
-    "# NEXT_PUBLIC_* into the browser bundle so the SDK's AuthProvider can",
-    "# call /api/auth/sessions/me on the right origin instead of bouncing",
-    "# off the local module server with a 404.",
-    `NEXT_PUBLIC_DASHWISE_API_URL=${apiUrl}`,
-    "DASHWISE_API_TOKEN=",
-    "DASHWISE_INSTALLATION_ID=",
+    "# Scoped `dwk_` key. Commented out on purpose: `dashwise dev` injects",
+    "# the local-dev key from ~/.config/dashwise/auth.json, and an empty",
+    "# `DASHWISE_API_KEY=` here would SHADOW that (and make a bare `next dev`",
+    "# fail with a confusing empty-key error). For a standalone `next dev`,",
+    "# uncomment + paste a key from `dashwise api-keys create <name>`.",
+    "# DASHWISE_API_KEY=",
     ""
   ].join("\n");
 }
@@ -687,7 +849,7 @@ npm run dev:next            # next dev on :3000                  (terminal 2)
 - **\`app/page.tsx\`** \u2014 public landing (allowlisted in \`middleware.ts\`).
 - **\`app/dashboard/page.tsx\`** \u2014 Server Component requiring a valid session via \`getServerSession()\`.
 - **\`app/api/auth/callback/route.ts\`** \u2014 exchanges the SSO one-time code for a session cookie (uses \`exchangeCode()\` from the SDK).
-- **\`app/api/auth/sign-in/route.ts\`** \u2014 entry point that redirects to the backend's \`/sso/start\` with the right \`return_to\` + \`client_id\`.
+- **\`app/api/auth/sign-in/route.ts\`** \u2014 one entry point that calls the backend's \`POST /api/module-api/sso/start-url\` (authenticated with your \`dwk_\` key) and 302s the browser to the returned \`redirect_url\`. Same path in dev + prod.
 - **\`app/api/auth/sign-out/route.ts\`** \u2014 clears the session cookie + tells the backend to revoke.
 
 ## Imports
@@ -736,25 +898,23 @@ the canonical block-discovery flow.
 
 ## Deploying elsewhere (custom domain)
 
-The scaffolded SSO flow is wired for DashWise's own infrastructure
-(\`m-<id>.dashwise.net\`). If you want to host this module on your own
-domain (e.g. \`mymodule.example.com\`), there are two options:
-
-1. **Wait for custom-domain support (in design).** A future \`--callback-origin\`
-   flag on \`dashwise module init\` plus a \`module_oauth_clients\` allowlist will
-   let modules run at arbitrary domains while still using DashWise SSO. Tracked
-   in [\`modules-author-experience-v1.md\`](https://github.com/sharmaintuize/dashwise-devops-docs/blob/main/plans/modules-author-experience-v1.md) \xA73.
-2. **Bypass SSO + use a Workspace API Token today.** Replace the SSO middleware
-   with a token-check middleware that reads \`Authorization: Token <key>\` from
-   each request. Tokens are created at \`<dashwise-dashboard>/settings/tokens\`
-   and scoped to a workspace. The SDK accepts these via the standard
-   \`DASHWISE_API_TOKEN\` env var. You'll lose the per-user session model
-   (every request runs as the token's owner) but gain the freedom to deploy
-   anywhere.
-
-The CLI's \`dashwise dev\` command auto-injects the developer's CLI token (also
-a bearer token) into local dev \u2014 so local development works regardless of
-which path you pick for production.
+The scaffolded SSO flow works on any domain. The \`/api/auth/sign-in\`
+route sends its own public origin as the \`callback_url\` to the backend;
+the backend accepts it as long as the origin is on your installation's
+allowlist. Local dev (\`http://localhost:<port>\`) is allowlisted
+automatically for \`kind='local'\` installs.
+
+For a deployed custom domain (e.g. \`https://mymodule.example.com\`), add
+it to the allowlist:
+
+\`\`\`bash
+dashwise origins add https://mymodule.example.com
+dashwise origins list          # confirm
+\`\`\`
+
+That's it \u2014 no middleware changes, no separate token scheme. The single
+\`dwk_\` \`DASHWISE_API_KEY\` drives both the data plane and the SSO
+start-url call.
 `;
 }
 function middlewareTs() {
@@ -796,7 +956,10 @@ export default function RootLayout({ children }: { children: React.ReactNode })
           enableSystem
           disableTransitionOnChange
         >
-          <AuthProvider>{children}</AuthProvider>
+          {/* sessionEndpoint points at the same-origin /api/auth/session
+              route so the host-scoped session cookie is actually sent \u2014
+              a cross-origin fetch to the API would drop it (D8). */}
+          <AuthProvider sessionEndpoint="/api/auth/session">{children}</AuthProvider>
         </ThemeProvider>
       </body>
     </html>
@@ -1001,73 +1164,102 @@ function Row({ label, value }: { label: string; value: string }) {
 `;
 }
 function appApiAuthSignInTs() {
-  return `// /api/auth/sign-in \u2014 kick off the SSO flow.
-//
-// Reads \`?return_to=\` from the caller (defaults to '/'). Branches
-// on env:
+  return `// /api/auth/sign-in \u2014 kick off the SSO flow (one path, dev + prod).
 //
-//   - DASHWISE_DEV_SESSION_ID set (set automatically by
-//     \`dashwise dev\`): hits /api/auth/dev/sso/start with the dev
-//     session id. No installation_id required \u2014 the module isn't
-//     installed in a workspace yet.
+// Reads \`?return_to=\` from the caller (defaults to '/'), then asks the
+// DashWise backend for a redirect URL by calling the module-API
+// server-side start endpoint:
 //
-//   - DASHWISE_INSTALLATION_ID set (production / installed-module
-//     path): hits /api/auth/sso/start with the installation id.
+//   POST /api/module-api/sso/start-url
+//   Authorization: Bearer <DASHWISE_API_KEY>   (the module's dwk_ key)
+//   { "callback_url": "<this module>/api/auth/callback?return_to=..." }
 //
-// In both cases the backend mints an exchange code + 302s back to
-// \`/api/auth/callback?code=...\` where we set the session cookie.
+// The backend resolves the install from the key (no installation id in
+// the request), validates the callback_url origin against the install's
+// allowlist (kind='local' installs implicitly allow localhost), and
+// returns { redirect_url, expires_in_seconds }. We 302 the browser to
+// redirect_url, which runs the existing main-app SSO flow and ends in a
+// 302 back to callback_url?code=<one-time>. The /api/auth/callback route
+// exchanges that code for a session cookie.
 //
-// Unauthenticated browser hits to either backend endpoint 302 to
-// the DashWise FE \`/login?return_to=...\` automatically \u2014 you don't
-// need to handle the "user not logged in" case here.
+// No dev-vs-prod branching, no installation id, no dev-session id \u2014 the
+// single dwk_ key drives both local dev and production.
 import { NextResponse } from 'next/server';
 import { getPublicOrigin } from '@/lib/request-origin';
 
-export function GET(request: Request) {
+export async function GET(request: Request) {
   const url = new URL(request.url);
   const returnTo = url.searchParams.get('return_to') ?? '/';
   const apiBaseUrl = process.env.DASHWISE_API_URL;
-  const installationId = process.env.DASHWISE_INSTALLATION_ID;
-  const devSessionId = process.env.DASHWISE_DEV_SESSION_ID;
+  const apiKey = process.env.DASHWISE_API_KEY;
 
   if (!apiBaseUrl) {
-    return new NextResponse(
-      'DASHWISE_API_URL must be set in .env.local',
-      { status: 500 },
-    );
+    return new NextResponse('DASHWISE_API_URL must be set in the environment', {
+      status: 500,
+    });
   }
-  if (!installationId && !devSessionId) {
+  if (!apiKey) {
     return new NextResponse(
-      'Either DASHWISE_INSTALLATION_ID (installed module) or DASHWISE_DEV_SESSION_ID ' +
-        '(local dev via \`dashwise dev\`) must be set. Run \`dashwise dev\` to register ' +
-        'a dev session, or set DASHWISE_INSTALLATION_ID after publishing your module.',
+      'DASHWISE_API_KEY must be set in the environment. Run \`dashwise dev\` ' +
+        '(local) or paste a key from \`dashwise api-keys create\` (deployed).',
       { status: 500 },
     );
   }
 
-  // Absolute URL for return_to so the backend knows which host to
-  // bounce back to (the callback path is fixed at /api/auth/callback
-  // by SDK convention). \`getPublicOrigin\` reads \`X-Forwarded-Host\`
-  // when present so the redirect URL points at the public domain,
-  // not the internal Node origin behind reverse proxies.
+  // Absolute callback URL so the backend knows which host to bounce back
+  // to. \`getPublicOrigin\` reads \`X-Forwarded-Host\` when present so the
+  // URL points at the public domain, not the internal Node origin behind
+  // reverse proxies (Railway/Vercel/Fly). The callback path is fixed at
+  // /api/auth/callback by SDK convention; we tuck \`return_to\` onto it so
+  // the callback route can resume the user's original destination.
   const moduleOrigin = getPublicOrigin(request);
-  const absoluteReturnTo = \`\${moduleOrigin}\${returnTo}\`;
-
-  let ssoStart;
-  if (devSessionId) {
-    // Dev mode wins when both are set \u2014 \`dashwise dev\` injects
-    // DASHWISE_DEV_SESSION_ID into the child env, which overrides
-    // whatever was in .env.local. The dev session id keys back to
-    // the dev's workspace + callback origin allowlist.
-    ssoStart = new URL('/api/auth/dev/sso/start', apiBaseUrl);
-    ssoStart.searchParams.set('return_to', absoluteReturnTo);
-    ssoStart.searchParams.set('dev_session_id', devSessionId);
-  } else {
-    ssoStart = new URL('/api/auth/sso/start', apiBaseUrl);
-    ssoStart.searchParams.set('return_to', absoluteReturnTo);
-    ssoStart.searchParams.set('client_id', installationId);
+  const callback = new URL('/api/auth/callback', moduleOrigin);
+  callback.searchParams.set('return_to', returnTo);
+
+  let res: Response;
+  try {
+    res = await fetch(\`\${apiBaseUrl}/api/module-api/sso/start-url\`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        Authorization: \`Bearer \${apiKey}\`,
+      },
+      body: JSON.stringify({ callback_url: callback.toString() }),
+    });
+  } catch (err) {
+    const target = new URL('/sign-in-error', moduleOrigin);
+    target.searchParams.set('code', 'server_error');
+    target.searchParams.set('description', (err as Error).message);
+    return NextResponse.redirect(target);
+  }
+
+  if (!res.ok) {
+    // The backend rejected the start (bad key, callback origin not
+    // allowlisted, install missing). Surface a real error page instead
+    // of a raw 4xx.
+    const body = (await res.json().catch(() => null)) as
+      | { code?: string; message?: string }
+      | null;
+    const target = new URL('/sign-in-error', moduleOrigin);
+    target.searchParams.set('code', body?.code ?? 'invalid_request');
+    if (body?.message) target.searchParams.set('description', body.message);
+    return NextResponse.redirect(target);
   }
-  return NextResponse.redirect(ssoStart);
+
+  const body = (await res.json().catch(() => null)) as
+    | { redirect_url?: string }
+    | null;
+  if (!body?.redirect_url) {
+    const target = new URL('/sign-in-error', moduleOrigin);
+    target.searchParams.set('code', 'server_error');
+    target.searchParams.set(
+      'description',
+      'start-url response missing redirect_url',
+    );
+    return NextResponse.redirect(target);
+  }
+  return NextResponse.redirect(body.redirect_url);
 }
 `;
 }
@@ -1139,6 +1331,65 @@ export async function POST(request: Request) {
 }
 `;
 }
+function appApiItemsRouteTs() {
+  return `// Example data-plane route \u2014 lists + creates rows in the seeded
+// \`items\` table via the generated typed SDK. Delete this (and the
+// \`items\` table in module.json) once you add your own tables.
+//
+// \`db\` comes from @dashai/generated, regenerated on every module.json
+// save by \`dashwise dev\`. Run it (or \`dashwise module generate\`) first.
+import { NextResponse } from 'next/server';
+import { db } from '@dashai/generated';
+
+export async function GET() {
+  const page = await db.items.list({ limit: 50 });
+  return NextResponse.json(page.rows);
+}
+
+export async function POST(request: Request) {
+  const body = (await request.json().catch(() => null)) as
+    | { title?: unknown; done?: unknown }
+    | null;
+  const title = typeof body?.title === 'string' ? body.title : '';
+  if (!title) {
+    return NextResponse.json(
+      { error: 'title is required (string)' },
+      { status: 400 },
+    );
+  }
+  const done = typeof body?.done === 'boolean' ? body.done : false;
+  const row = await db.items.create({ title, done });
+  return NextResponse.json(row, { status: 201 });
+}
+`;
+}
+function appApiAuthSessionTs() {
+  return `// /api/auth/session \u2014 SAME-ORIGIN session probe for client components.
+//
+// D8: the browser's <AuthProvider> can't read the session by calling the
+// cross-origin DashWise API directly, because the \`dashwise.session\`
+// cookie is host-scoped to THIS module's origin and is never sent to
+// \`api.dashwise.net\`. So <AuthProvider sessionEndpoint="/api/auth/session">
+// hits this route (same origin \u2192 the cookie IS sent); we validate it
+// server-side via \`getServerSession()\` (which forwards the cookie to the
+// API for us) and return the fully-enriched session \u2014 or \`null\` \u2014 as JSON.
+//
+// \`getServerSession()\` already merges the RBAC slice, so the client
+// receives \`rbacRoles\` / \`rbacPermissions\` and skips a second fetch.
+import { NextResponse } from 'next/server';
+import { getServerSession } from '@dashai/sdk/auth/server';
+
+export async function GET() {
+  const session = await getServerSession();
+  // Always 200 \u2014 \`null\` is a valid "not signed in" answer the client
+  // maps to \`unauthenticated\`. \`no-store\` so a stale signed-in body is
+  // never served to a signed-out user after sign-out.
+  return NextResponse.json(session, {
+    headers: { 'Cache-Control': 'no-store' },
+  });
+}
+`;
+}
 function packageJsonCustom(opts) {
   return JSON.stringify(
     {
@@ -1154,7 +1405,7 @@ function packageJsonCustom(opts) {
         start: "next start"
       },
       dependencies: {
-        "@dashai/sdk": "^0.8.0",
+        "@dashai/sdk": "^2.0.0",
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0",
@@ -1504,7 +1755,7 @@ const ERROR_MESSAGES: Record<string, string> = {
   server_error:
     'The DashWise sign-in server returned an internal error. This is usually transient \u2014 try again in a moment.',
   invalid_request:
-    'The sign-in request was malformed. This is almost always a configuration bug \u2014 check that DASHWISE_API_URL and DASHWISE_INSTALLATION_ID are set correctly.',
+    'The sign-in request was malformed. This is almost always a configuration bug \u2014 check that DASHWISE_API_URL and DASHWISE_API_KEY are set correctly and the callback origin is allowlisted (run "dashwise origins add <url>").',
   missing_code:
     'The callback URL was missing the expected exchange code. This usually means the SSO flow was interrupted.',
   exchange_failed:
@@ -1577,7 +1828,14 @@ function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 function isValidSlug(slug) {
-  return /^[a-z][a-z0-9_-]*$/.test(slug);
+  return MODULE_SLUG_REGEX.test(slug);
+}
+function slugValidationMessage(slug) {
+  if (slug.includes("_")) {
+    const suggestion = slug.replace(/_/g, "-").replace(/^-+|-+$/g, "");
+    return `Slug "${slug}" uses underscores \u2014 module slugs must be kebab-case (letters, digits, hyphens; e.g. "${suggestion || "my-module"}"). Rename it and retry.`;
+  }
+  return `Slug "${slug}" must be kebab-case \u2014 match /^[a-z][a-z0-9-]*[a-z0-9]$/ (a leading letter, then letters/digits/hyphens, no trailing hyphen).`;
 }
 function claudeMd(opts) {
   const isCustom = (opts.kind ?? "hand_authored") === "custom";
@@ -1660,17 +1918,43 @@ await db.<table>.create({ /* fields */ });
 const stats = await qb.from('<table>').where({ /* ... */ }).execute();
 \`\`\`
 
-The data plane authenticates via the per-module runtime token cached
-in \`~/.config/dashwise/auth.json#modules[${opts.slug}]\` after
-\`dashwise init\` provisions the dev install. \`dashwise dev\` injects
-this token into the Next.js child env automatically.
+The data plane authenticates via the per-module scoped \`dwk_\` API key
+cached in \`~/.config/dashwise/auth.json#modules[${opts.slug}]\` after
+\`dashwise init\` provisions the dev install. \`dashwise dev\` injects it
+as \`DASHWISE_API_KEY\` into the Next.js child env automatically. The
+key binds the install server-side \u2014 there is no \`DASHWISE_INSTALLATION_ID\`.
+
+### Own tables vs. the shared Data Hub
+
+The dev key \`dashwise init\` mints gives you **full access to your
+module's OWN tables** (\`owns.tables\` in \`module.json\`) through \`db\` /
+\`qb\` \u2014 no grant setup needed. That covers the common case.
+
+The **shared workspace Data Hub** (other tables in the workspace, reached
+via \`datahub.table(<id>)\`) is separate: it is default-deny and returns
+**403** with the dev key until you mint a key that carries an explicit
+Data Hub grant. Do that with:
+
+\`\`\`
+# read a specific Data Hub table:
+dashwise api-keys create datahub-read --grant datahub:table=<tableId>:read
+# or a whole database (application):
+dashwise api-keys create datahub-rw --grant datahub:app=<appId>:read,create,update
+\`\`\`
+
+Paste the printed key as \`DASHWISE_API_KEY\` (or, for local dev, set it
+before \`dashwise dev\` so it wins over the auto-injected own-tables key).
+So: \`db\`/\`qb\` on your own tables works out of the box; \`datahub\` needs a
+granted key.
 
 ## Auth in dev mode
 
-\`dashwise dev\` registers a dev-mode SSO session with the backend
-and injects \`DASHWISE_DEV_SESSION_ID\` so workspace members can sign
-into the locally-running module via DashWise SSO \u2014 no installed
-\`installation_id\` required.
+\`dashwise dev\` registers a dev-mode SSO session with the backend so
+workspace members can sign into the locally-running module via DashWise
+SSO. The scaffold's \`/api/auth/sign-in\` route is a single path: it
+calls \`POST /api/module-api/sso/start-url\` with your \`dwk_\` key and
+follows the returned \`redirect_url\` \u2014 the same code runs in dev and in
+production, with no installation id or dev-session id in the request.
 
 In Server Components: \`await getServerSession()\` (from
 \`@dashai/sdk/auth/server\`).
@@ -1727,13 +2011,14 @@ what tables it owns.
 
 | Table | Columns | Notes |
 |---|---|---|
-| (none yet) | run \`dashwise table create <slug> --field <slug:type>\` to add one | |
+| \`items\` | \`title:text\`, \`done:boolean\` | seeded example \u2014 edit or replace; \`dashwise table create <slug> --field <slug:type>\` adds more |
 
 ## API / contract
 
 | Method | Path | Auth | Purpose |
 |---|---|---|---|
-| (none yet) | | | |
+| GET | \`/api/items\` | dwk_ (server-side) | list \`items\` rows via \`db.items.list()\` |
+| POST | \`/api/items\` | dwk_ (server-side) | create an \`items\` row via \`db.items.create()\` |
 
 ## Business rules
 
@@ -1849,11 +2134,12 @@ primary_region = "iad"
   memory_mb = 256
 `;
 }
-var DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL;
+var DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, MODULE_SLUG_REGEX;
 var init_scaffold = __esm({
   "src/lib/scaffold.ts"() {
     DEPLOY_TARGETS = ["railway", "vercel", "fly"];
     SCAFFOLD_DEFAULT_API_URL = "http://localhost:3000";
+    MODULE_SLUG_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
   }
 });
 async function selectWorkspace(opts) {
@@ -1921,7 +2207,7 @@ async function moduleInitCommand(slugArg, options) {
     const answer = await text({
       message: "Module slug?",
       placeholder: "tasks",
-      validate: (v) => isValidSlug(v) ? void 0 : "Slug must match /^[a-z][a-z0-9_-]*$/"
+      validate: (v) => isValidSlug(v) ? void 0 : slugValidationMessage(v)
     });
     if (isCancel(answer)) {
       fail("Aborted.");
@@ -1934,7 +2220,7 @@ async function moduleInitCommand(slugArg, options) {
     return 1;
   }
   if (!isValidSlug(slug)) {
-    fail(`Invalid slug ${code(slug)} \u2014 must match /^[a-z][a-z0-9_-]*$/`);
+    fail(slugValidationMessage(slug));
     return 1;
   }
   const name = options.name ?? humanizeSlug(slug);
@@ -1982,7 +2268,11 @@ async function moduleInitCommand(slugArg, options) {
     // discipline + SDK pointers loaded into context from byte one.
     ["CLAUDE.md", claudeMd(scaffoldOpts)],
     ["spec.md", specMd(scaffoldOpts)],
-    ["agent-log.md", agentLogMd(scaffoldOpts)]
+    ["agent-log.md", agentLogMd(scaffoldOpts)],
+    // Example data-plane route (both flavors) — exercises the generated
+    // SDK against the seeded `items` table. Ships for simple + custom
+    // since both produce `@dashai/generated`.
+    ["app/api/items/route.ts", appApiItemsRouteTs()]
   ];
   if (kind === "custom") {
     files.push(
@@ -2002,7 +2292,10 @@ async function moduleInitCommand(slugArg, options) {
       ["app/sign-in-error/page.tsx", appSignInErrorPageTsx()],
       ["app/api/auth/sign-in/route.ts", appApiAuthSignInTs()],
       ["app/api/auth/callback/route.ts", appApiAuthCallbackTs()],
-      ["app/api/auth/sign-out/route.ts", appApiAuthSignOutTs()]
+      ["app/api/auth/sign-out/route.ts", appApiAuthSignOutTs()],
+      // D8: same-origin session probe that <AuthProvider> hits so the
+      // host-scoped session cookie is actually sent.
+      ["app/api/auth/session/route.ts", appApiAuthSessionTs()]
     );
   } else {
     files.push(
@@ -2038,18 +2331,40 @@ async function moduleInitCommand(slugArg, options) {
   let devInstall = null;
   const wantsProvision = options.provision !== false;
   if (wantsProvision) {
+    const manifest = (() => {
+      try {
+        return readManifest(dir) ?? void 0;
+      } catch {
+        return void 0;
+      }
+    })();
     devInstall = await tryProvisionDevInstall({
       slug,
       name,
       description: options.description,
       workspaceFlag: options.workspace,
-      moduleKind: kind
+      moduleKind: kind,
+      ...manifest !== void 0 ? { manifest } : {}
     });
   } else {
     info(
       `Skipping provisioning (${code("--no-provision")}). ${dim("Run with provisioning later to enable `dashwise dev` data-plane.")}`
     );
   }
+  const keyCached = !wantsProvision || readModuleEntry(slug)?.apiKey ? true : false;
+  if (wantsProvision && !keyCached) {
+    fail(
+      `NO API KEY WAS CACHED for ${code(slug)} \u2014 the scaffold is written, but ${code("dashwise dev")} will run with NO token (data-plane + sign-in will fail).`
+    );
+    info(
+      `Fix it by re-running provisioning once the cause above is resolved:
+    ${code(`dashwise init ${slug} --force --workspace <your-workspace-slug>`)}
+  Confirm success: the line ${code("\u2713 Provisioned dev install id=\u2026 API key cached")} must appear,
+  and ${code("cat ~/.config/dashwise/auth.json")} must show a non-empty ${code(`modules.${slug}.apiKey`)} starting with ${code("dwk_")}.`
+    );
+    outro("Scaffold written, but provisioning failed \u2014 see above.");
+    return 2;
+  }
   info(`Next steps:`);
   process.stdout.write(`
   ${dim("1.")} ${code(`cd ${dir}`)}
@@ -2061,7 +2376,7 @@ async function moduleInitCommand(slugArg, options) {
   ${dim("     dashwise module dev")}                   ${dim("# watch + auto-regenerate")}
   ${dim("     npm run dev:next                        # next dev on :3000)")}
 ${devInstall ? `
-  ${dim(`Dev installation id=${devInstall.installation.id}; runtime token expires ${devInstall.runtime_token_expires_at}.`)}
+  ${dim(`Dev installation id=${devInstall.installation.id}; API key expires ${devInstall.api_key_expires_at}.`)}
 ` : ""}`);
   outro("Happy authoring.");
   return 0;
@@ -2078,6 +2393,20 @@ async function tryProvisionDevInstall(args) {
     warn("CLI config disappeared mid-init. Skipping provisioning.");
     return null;
   }
+  const targetApiUrl = resolveApiUrl();
+  info(`Backend: ${code(targetApiUrl)}`);
+  const hostOf = (u) => {
+    try {
+      return new URL(u).host;
+    } catch {
+      return u;
+    }
+  };
+  if (hostOf(targetApiUrl) !== hostOf(cfg.apiUrl)) {
+    warn(
+      `Your saved login is for ${code(cfg.apiUrl)} but this run targets ${code(targetApiUrl)}. Provisioning uses the saved token, which the target backend will reject (401). Log in against the target first: ${code(`dashwise login --api-url ${targetApiUrl}`)}.`
+    );
+  }
   let workspace2;
   try {
     workspace2 = await selectWorkspace({
@@ -2093,42 +2422,60 @@ async function tryProvisionDevInstall(args) {
   info(
     `Provisioning dev install in workspace ${code(workspace2.slug)} (id=${workspace2.id})\u2026`
   );
+  const baseBody = {
+    slug: args.slug,
+    name: args.name,
+    ...args.description !== void 0 ? { description: args.description } : {},
+    workspaceId: workspace2.id,
+    ...args.moduleKind !== void 0 ? { moduleKind: args.moduleKind } : {}
+  };
+  const reqOpts = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
   let response;
   try {
     response = await createDevInstallation(
-      {
-        slug: args.slug,
-        name: args.name,
-        ...args.description !== void 0 ? { description: args.description } : {},
-        workspaceId: workspace2.id,
-        ...args.moduleKind !== void 0 ? { moduleKind: args.moduleKind } : {}
-      },
-      { baseUrl: resolveApiUrl(), auth: { token: cfg.token } }
+      { ...baseBody, ...args.manifest !== void 0 ? { manifest: args.manifest } : {} },
+      reqOpts
     );
   } catch (err) {
-    if (err instanceof ApiError) {
+    if (err instanceof ApiError && err.code === "MANIFEST_INVALID" && args.manifest !== void 0) {
+      warn(
+        `Couldn't pre-materialize the seeded table(s) (${err.message}). Provisioning without them; add tables later with ${code("dashwise table create")}.`
+      );
+      try {
+        response = await createDevInstallation(baseBody, reqOpts);
+      } catch (err2) {
+        if (err2 instanceof ApiError) {
+          surfaceProvisionApiError(err2, args.slug);
+          return null;
+        }
+        warn(`Provisioning failed: ${err2.message}`);
+        return null;
+      }
+    } else if (err instanceof ApiError) {
       surfaceProvisionApiError(err, args.slug);
       return null;
+    } else {
+      warn(`Provisioning failed: ${err.message}`);
+      return null;
     }
-    warn(`Provisioning failed: ${err.message}`);
-    return null;
   }
   try {
     upsertModuleEntry(args.slug, {
-      runtimeToken: response.runtime_token,
+      apiKey: response.api_key,
+      apiKeyId: response.api_key_id,
       installationId: response.installation.id,
-      expiresAt: response.runtime_token_expires_at
+      expiresAt: response.api_key_expires_at
     });
   } catch (err) {
     warn(
-      `Provisioned successfully (installation id=${response.installation.id}) but failed to cache the runtime token: ${err.message}
-  Runtime token (save this manually): ${response.runtime_token}
-  Token expires: ${response.runtime_token_expires_at}`
+      `Provisioned successfully (installation id=${response.installation.id}) but failed to cache the API key: ${err.message}
+  API key (save this manually): ${response.api_key}
+  Key expires: ${response.api_key_expires_at}`
     );
     return response;
   }
   success(
-    `Provisioned dev install id=${response.installation.id}. Runtime token cached in your CLI config.`
+    `Provisioned dev install id=${response.installation.id}. API key cached in your CLI config.` + (response.tables_applied > 0 ? ` ${response.tables_applied} seeded table(s) materialized.` : "")
   );
   return response;
 }
@@ -2173,6 +2520,7 @@ var init_init = __esm({
     init_output();
     init_api_client();
     init_config();
+    init_manifest_io();
     init_workspaces();
   }
 });
@@ -2197,6 +2545,7 @@ function loadSchemaCommandContext(opts) {
       `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
     );
   }
+  const token = resolveSchemaAuthToken(entry, slug);
   return {
     projectRoot,
     manifestPath: manifestPath2,
@@ -2207,10 +2556,16 @@ function loadSchemaCommandContext(opts) {
     entry,
     requestOptions: {
       baseUrl: resolveApiUrl(),
-      auth: { token: entry.runtimeToken }
+      auth: { token }
     }
   };
 }
+function resolveSchemaAuthToken(entry, slug) {
+  if (entry.apiKey) return entry.apiKey;
+  throw new Error(
+    `The cached credential for "${slug}" is a legacy runtime token, which the schema endpoints no longer accept. Run \`dashwise dev\` once (it mints a dwk_ API key and updates your config), or \`dashwise init ${slug} --force\` to re-provision.`
+  );
+}
 var init_schema_command_context = __esm({
   "src/lib/schema-command-context.ts"() {
     init_config();
@@ -2549,7 +2904,6 @@ async function tableCreateCommand(slug, options) {
   info(`Creating table ${code(slug)} in installation ${ctx.entry.installationId}\u2026`);
   try {
     const result = await createTable(
-      ctx.entry.installationId,
       { slug, fields },
       ctx.requestOptions
     );
@@ -2563,10 +2917,7 @@ async function tableCreateCommand(slug, options) {
 }
 async function syncLocalManifest(ctx) {
   try {
-    const { manifest } = await getInstallationSchema(
-      ctx.entry.installationId,
-      ctx.requestOptions
-    );
+    const { manifest } = await getInstallationSchema(ctx.requestOptions);
     writeManifest(manifest, ctx.projectRoot);
     return 0;
   } catch (err) {
@@ -2599,17 +2950,17 @@ function surfaceFailure(err) {
         break;
       case "UNAUTHENTICATED":
         fail(
-          `Runtime token rejected by backend. The cached token may be expired \u2014 re-run \`dashwise init <slug> --force\` to mint a fresh one.`
+          `API key rejected by backend. The cached key may be expired or revoked \u2014 re-run \`dashwise init <slug> --force\` to mint a fresh one.`
         );
         break;
-      case "SANDBOX_TOKEN_NOT_ACCEPTED":
+      case "SCHEMA_LOCKED":
         fail(
-          `Schema-mutation endpoints require a local-dev runtime token (kind=local). The cached token is the wrong kind \u2014 re-run \`dashwise init <slug> --force\`.`
+          `Schema mutations require a local-dev install (kind=local). The cached API key belongs to a non-local install \u2014 schema is locked. Run \`dashwise init <slug> --force\` for a local dev install.`
         );
         break;
       case "INSTALL_MISMATCH":
         fail(
-          `Runtime token is bound to a different installation than the URL. The cached install id may be stale \u2014 re-run \`dashwise init <slug> --force\`.`
+          `API key is bound to a different installation than the URL. The cached install id may be stale \u2014 re-run \`dashwise init <slug> --force\`.`
         );
         break;
       default:
@@ -2651,11 +3002,7 @@ async function tableDeleteCommand(slug, options) {
   }
   info(`Dropping table ${code(slug)} from installation ${ctx.entry.installationId}\u2026`);
   try {
-    const result = await dropTable(
-      ctx.entry.installationId,
-      slug,
-      ctx.requestOptions
-    );
+    const result = await dropTable(slug, ctx.requestOptions);
     success(
       `Dropped table ${code(slug)} (manifest_version=${result.manifest_version}). Physical table soft-deleted; recoverable for 30 days via the dashboard's trash.`
     );
@@ -2723,7 +3070,6 @@ async function fieldAddCommand(tableSlug, fieldSpec, options) {
   );
   try {
     const result = await addField(
-      ctx.entry.installationId,
       { table_slug: tableSlug, field },
       ctx.requestOptions
     );
@@ -2769,7 +3115,6 @@ async function fieldRemoveCommand(tableSlug, fieldSlug, options) {
   );
   try {
     const result = await removeField(
-      ctx.entry.installationId,
       tableSlug,
       fieldSlug,
       ctx.requestOptions
@@ -2823,7 +3168,6 @@ async function fieldSetTypeCommand(tableSlug, fieldSlug, newType, options) {
   );
   try {
     const result = await updateField(
-      ctx.entry.installationId,
       tableSlug,
       fieldSlug,
       { type: newType },
@@ -2849,14 +3193,84 @@ var init_set_type = __esm({
 
 // src/commands/dev.ts
 init_api_client();
-init_config();
-init_manifest_io();
 
-// src/lib/manifest-poll.ts
+// src/lib/connect-status.ts
 init_api_client();
-function startManifestPollLoop(opts) {
+init_output();
+async function reportConnectStatus(opts) {
+  const [deps, bindings] = await Promise.all([
+    safeGet(
+      () => getInstallationDependencies(opts.installationId, opts.requestOptions)
+    ),
+    safeGet(
+      () => getInstallationBindings(opts.installationId, opts.requestOptions)
+    )
+  ]);
+  if (deps === null && bindings === null) return;
+  const depList = deps ?? [];
+  const bindList = bindings ?? [];
+  if (depList.length === 0 && bindList.length === 0) return;
+  const unboundDeps = depList.filter((d) => d.status === "unbound").length;
+  const unboundUses = bindList.filter((b) => b.status === "unbound").length;
+  info(
+    `Connect status for ${code(opts.moduleSlug)} ${dim(
+      `(${depList.length} dep${depList.length === 1 ? "" : "s"}, ${bindList.length} uses slot${bindList.length === 1 ? "" : "s"})`
+    )}:`
+  );
+  for (const d of depList) renderDep(d);
+  for (const b of bindList) renderBinding(b);
+  const hints = [];
+  if (unboundDeps > 0) {
+    hints.push(
+      `${code("dashwise deps bind <provider-slug>")} once the provider is installed`
+    );
+  }
+  if (unboundUses > 0) {
+    hints.push(`${code("dashwise bind <uses-slug> --table <name>")} to connect a table`);
+  }
+  if (hints.length > 0) {
+    info(`Connect parked items with ${hints.join("; ")}.`);
+  }
+  out("");
+}
+function renderDep(d) {
+  if (d.status === "resolved") {
+    const providerLine = d.provider ? ` ${dim(`\u2192 install #${d.provider.installation_id} @ v${d.provider.version}`)}` : "";
+    out(`  ${pc.green("\u25CF resolved")} ${dim("dep")} ${code(d.slug)}@${d.range ?? "*"}${providerLine}`);
+  } else {
+    out(
+      `  ${pc.yellow("\u25CB unbound")}  ${dim("dep")} ${code(d.slug)}@${d.range ?? "*"} ${dim(`reason: ${d.reason ?? "(unspecified)"}`)}`
+    );
+  }
+}
+function renderBinding(b) {
+  if (b.status === "bound") {
+    const tableLine = b.table ? ` ${dim(`\u2192 ${b.table.name} (id ${b.table.id})`)}` : "";
+    out(`  ${pc.green("\u25CF bound")}    ${dim("uses")} ${code(b.uses_slug)}${tableLine}`);
+  } else if (b.status === "declined") {
+    out(`  ${pc.dim("\u2298 declined")} ${dim("uses")} ${code(b.uses_slug)}`);
+  } else {
+    out(
+      `  ${pc.yellow("\u25CB unbound")}  ${dim("uses")} ${code(b.uses_slug)} ${dim(`reason: ${b.reason ?? "(unspecified)"}`)}`
+    );
+  }
+}
+async function safeGet(fn) {
+  try {
+    return await fn();
+  } catch (err) {
+    return null;
+  }
+}
+
+// src/commands/dev.ts
+init_config();
+init_manifest_io();
+
+// src/lib/manifest-poll.ts
+init_api_client();
+function startManifestPollLoop(opts) {
   const {
-    installationId,
     manifestPath: manifestPath2,
     requestOptions,
     intervalMs,
@@ -2869,10 +3283,7 @@ function startManifestPollLoop(opts) {
   const tick = async () => {
     if (stopped) return;
     try {
-      const { manifest } = await getInstallationSchema(
-        installationId,
-        requestOptions
-      );
+      const { manifest } = await getInstallationSchema(requestOptions);
       const remoteJson = JSON.stringify(manifest, null, 2) + "\n";
       const currentLocal = existsSync(manifestPath2) ? readFileSync(manifestPath2, "utf-8") : "";
       if (remoteJson === currentLocal) {
@@ -2967,16 +3378,15 @@ async function devCommand(options) {
   }
   const explicitInstallationId = options.installationId ?? process.env.DASHWISE_INSTALLATION_ID;
   const reuseDevSessionId = process.env.DASHWISE_DEV_SESSION_ID;
-  const moduleEntry = manifestSlug !== void 0 ? readModuleEntry(manifestSlug) : null;
-  const runtimeTokenEnv = process.env.DASHWISE_RUNTIME_TOKEN ?? moduleEntry?.runtimeToken;
+  let moduleEntry = manifestSlug !== void 0 ? readModuleEntry(manifestSlug) : null;
+  const healed = manifestSlug !== void 0 ? await resolveModuleApiKey(manifestSlug, moduleEntry, apiUrl, apiToken) : null;
+  if (healed) moduleEntry = healed;
+  const apiKeyEnv = process.env.DASHWISE_API_KEY ?? moduleEntry?.apiKey;
   let installationIdEnv;
-  let devSessionIdEnv;
   let revokeDevSession;
   if (explicitInstallationId && explicitInstallationId !== "local") {
     installationIdEnv = explicitInstallationId;
-  } else if (reuseDevSessionId) {
-    devSessionIdEnv = reuseDevSessionId;
-  } else {
+  } else if (reuseDevSessionId) ; else {
     let workspaceContext;
     try {
       workspaceContext = await resolveTargetWorkspace(apiUrl, apiToken, options.workspace);
@@ -2990,7 +3400,6 @@ async function devCommand(options) {
         target_workspace_id: workspaceContext.id,
         callback_origins: callbackOrigins
       });
-      devSessionIdEnv = session.id;
       revokeDevSession = () => revokeDevSessionBestEffort(apiUrl, apiToken, session.id);
       info(`  ${dim("dev session")} ${session.id}`);
       info(`  ${dim("workspace")}   ${workspaceContext.name} (id=${workspaceContext.id}, slug=${workspaceContext.slug})`);
@@ -3005,43 +3414,44 @@ async function devCommand(options) {
       return 1;
     }
   }
-  const childInstallationId = installationIdEnv ?? (runtimeTokenEnv !== void 0 ? "sandbox" : "");
   const childEnv = {
     ...process.env,
     DASHWISE_API_URL: apiUrl,
-    // HH-CC-FUP-3: client-side mirror. Next.js inlines NEXT_PUBLIC_*
-    // env vars into the browser bundle at build time (or, in dev, at
-    // process-start time). Without this, the SDK's <AuthProvider> hits
-    // `/api/auth/sessions/me` on its own origin (localhost:<port>),
-    // 404s, and stays unauthenticated. We mirror DASHWISE_API_URL so
-    // the client + server agree on the backend origin without the
-    // module author having to touch .env.local.
     NEXT_PUBLIC_DASHWISE_API_URL: apiUrl,
-    DASHWISE_API_TOKEN: apiToken,
-    DASHWISE_INSTALLATION_ID: childInstallationId,
-    ...devSessionIdEnv !== void 0 ? { DASHWISE_DEV_SESSION_ID: devSessionIdEnv } : {},
-    ...runtimeTokenEnv !== void 0 ? { DASHWISE_RUNTIME_TOKEN: runtimeTokenEnv } : {}
+    ...apiKeyEnv !== void 0 ? { DASHWISE_API_KEY: apiKeyEnv } : {}
   };
   info(`Dev loop starting \u2014 Ctrl-C to stop.`);
   info(`  ${dim("api")}         ${apiUrl}`);
   if (installationIdEnv !== void 0) {
     info(`  ${dim("installation")} ${installationIdEnv} (prod-mode SSO)`);
   } else {
-    info(`  ${dim("mode")}        dev (DASHWISE_DEV_SESSION_ID injected)`);
+    info(`  ${dim("mode")}        dev (dev SSO session registered)`);
   }
-  info(`  ${dim("token")}       ${maskedToken(apiToken)} ${dim(`(from ${apiToken === savedConfig?.token ? "~/.config/dashwise/auth.json" : "$DASHWISE_API_TOKEN"})`)}`);
-  if (runtimeTokenEnv !== void 0) {
-    const source = process.env.DASHWISE_RUNTIME_TOKEN === runtimeTokenEnv ? "$DASHWISE_RUNTIME_TOKEN" : `~/.config/dashwise/auth.json#modules[${manifestSlug}]`;
+  info(`  ${dim("cli token")}   ${maskedToken(apiToken)} ${dim(`(from ${apiToken === savedConfig?.token ? "~/.config/dashwise/auth.json" : "$DASHWISE_API_TOKEN"})`)}`);
+  if (apiKeyEnv !== void 0) {
+    const source = process.env.DASHWISE_API_KEY === apiKeyEnv ? "$DASHWISE_API_KEY" : `~/.config/dashwise/auth.json#modules[${manifestSlug}]`;
     const installId = moduleEntry?.installationId;
     info(
-      `  ${dim("runtime")}     ${maskedToken(runtimeTokenEnv)} ${dim(`(from ${source}${installId ? `, install id=${installId}` : ""})`)}`
+      `  ${dim("api key")}     ${maskedToken(apiKeyEnv)} ${dim(`(from ${source}${installId ? `, install id=${installId}` : ""})`)}`
     );
   } else if (manifestSlug !== void 0 && installationIdEnv === void 0) {
-    warn(
-      `No runtime token cached for module ${code(manifestSlug)}. Data-plane calls (db, qb) will fail with UnauthenticatedError. Run ${code(`dashwise init ${manifestSlug} --force`)} to provision a dev install + cache the token.`
+    fail(
+      `No ${code("dwk_")} API key for module ${code(manifestSlug)} \u2014 the module will run with NO token.`
+    );
+    info(
+      `  Data-plane calls (db, qb) AND sign-in will fail until you provision a dev install:
+    ${code(`dashwise init ${manifestSlug} --force --workspace <your-workspace-slug>`)}
+  (Ensure you're logged into the right backend: ${code(`dashwise login --api-url ${apiUrl}`)}.)`
     );
   }
   info("");
+  if (moduleEntry !== null && manifestSlug !== void 0) {
+    await reportConnectStatus({
+      installationId: moduleEntry.installationId,
+      moduleSlug: manifestSlug,
+      requestOptions: { baseUrl: apiUrl, auth: { token: apiToken } }
+    });
+  }
   const children = [];
   if (!options.nextOnly) {
     const sdkChild = spawnSdkWatcher(projectRoot, childEnv);
@@ -3056,18 +3466,19 @@ async function devCommand(options) {
     pipeWithPrefix(child.stderr, process.stderr, prefix);
   }
   let manifestPoll = null;
-  const enablePoll = !options.noRemotePoll && moduleEntry !== null && manifestSlug !== void 0;
-  if (enablePoll) {
+  const pollEntry = moduleEntry;
+  const enablePoll = !options.noRemotePoll && pollEntry !== null && apiKeyEnv !== void 0 && manifestSlug !== void 0;
+  if (enablePoll && pollEntry !== null) {
     const intervalSec = Math.max(
       MIN_REMOTE_POLL_INTERVAL_SEC,
       options.remotePollIntervalSec ?? DEFAULT_REMOTE_POLL_INTERVAL_SEC
     );
     manifestPoll = startManifestPollLoop({
-      installationId: moduleEntry.installationId,
       manifestPath: manifestPath2,
       requestOptions: {
         baseUrl: apiUrl,
-        auth: { token: moduleEntry.runtimeToken }
+        // The `dwk_` key resolves the install server-side.
+        auth: { token: apiKeyEnv }
       },
       intervalMs: intervalSec * 1e3,
       onUpdate: (msg) => {
@@ -3200,6 +3611,51 @@ function maskedToken(token) {
   const tail = token.slice(-4);
   return `${prefix}\u2026${tail}`;
 }
+async function resolveModuleApiKey(slug, entry, apiUrl, cliBearer) {
+  if (process.env.DASHWISE_API_KEY) return null;
+  if (!entry) return null;
+  if (entry.apiKey) return null;
+  if (!entry.installationId) return null;
+  info(
+    `No usable ${code("dwk_")} API key cached for ${code(slug)} \u2014 minting a fresh one against dev install ${entry.installationId} (a stale CLI can cache an empty key)\u2026`
+  );
+  let minted;
+  try {
+    minted = await createApiKey(
+      entry.installationId,
+      { name: "local-dev" },
+      { baseUrl: apiUrl, auth: { token: cliBearer } }
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.code === "INSTALLATION_NOT_FOUND") {
+      warn(
+        `Could not upgrade credentials for ${code(slug)}: its dev install no longer exists. Run ${code(`dashwise init ${slug} --force`)} to re-provision (a clean re-register).`
+      );
+      return null;
+    }
+    const reason = err instanceof ApiError ? `${err.code}: ${err.message}` : err.message;
+    warn(
+      `Could not upgrade credentials for ${code(slug)} (${reason}). Data-plane calls may fail; run ${code(`dashwise init ${slug} --force`)} to refresh.`
+    );
+    return null;
+  }
+  const upgraded = {
+    apiKey: minted.raw_key,
+    apiKeyId: minted.api_key.id,
+    installationId: entry.installationId,
+    expiresAt: minted.api_key.expires_at ?? entry.expiresAt
+  };
+  try {
+    upsertModuleEntry(slug, upgraded);
+  } catch (err) {
+    warn(
+      `Minted a new API key for ${code(slug)} but failed to cache it: ${err.message}
+  API key (save manually): ${minted.raw_key}`
+    );
+  }
+  success(`Upgraded ${code(slug)} to a dwk_ API key (id=${minted.api_key.id}).`);
+  return upgraded;
+}
 function computeCallbackOrigins(port, extra) {
   const def = `http://localhost:${port}`;
   return Array.from(/* @__PURE__ */ new Set([def, ...extra]));
@@ -3887,7 +4343,7 @@ function isPlausibleRepoUrl(url) {
 
 // src/commands/module/convert.ts
 init_scaffold();
-var SDK_DEP_RANGE = "^0.8.0";
+var SDK_DEP_RANGE = "^2.0.0";
 var SCAN_DIRS = ["app", "src", "pages", "lib", "components"];
 var SCAN_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs"];
 var MAX_SCAN_FILES = 2e3;
@@ -3943,6 +4399,7 @@ function convertModule(opts) {
   writeIfMissing("app/api/auth/sign-in/route.ts", appApiAuthSignInTs());
   writeIfMissing("app/api/auth/callback/route.ts", appApiAuthCallbackTs());
   writeIfMissing("app/api/auth/sign-out/route.ts", appApiAuthSignOutTs());
+  writeIfMissing("app/api/auth/session/route.ts", appApiAuthSessionTs());
   writeIfMissing("app/sign-in-error/page.tsx", appSignInErrorPageTsx());
   writeIfMissing(".env.local.example", envLocalExample());
   const layoutFile = [
@@ -3954,7 +4411,7 @@ function convertModule(opts) {
     writeIfMissing("app/layout.tsx", appLayoutCustomTsx(sopts));
   } else if (!readFileSync(join(dir, layoutFile), "utf-8").includes("AuthProvider")) {
     warnings.push(
-      `${layoutFile}: wrap your tree in <AuthProvider> from "@dashai/sdk/auth/client" so client components can read the session.`
+      `${layoutFile}: wrap your tree in <AuthProvider sessionEndpoint="/api/auth/session"> from "@dashai/sdk/auth/client" so client components can read the session (the same-origin session route was scaffolded for you).`
     );
   } else {
     skipped.push(layoutFile);
@@ -4236,6 +4693,7 @@ async function moduleExportCommand(opts) {
 init_config();
 init_output();
 init_manifest_io();
+init_scaffold();
 init_workspaces();
 init_api_client();
 var MODULE_KINDS = ["ai_builder", "hand_authored", "custom"];
@@ -4258,6 +4716,13 @@ async function moduleRegisterCommand(opts) {
     fail("module.json is missing `module.slug`.");
     return 1;
   }
+  if (!isValidSlug(slug)) {
+    fail(
+      `${slugValidationMessage(slug)}
+  Fix ${code("module.slug")} in module.json, then re-run ${code("dashwise module register")}.`
+    );
+    return 1;
+  }
   const name = opts.name ?? (typeof manifest.module?.name === "string" ? manifest.module.name : slug);
   const moduleKind = MODULE_KINDS.includes(
     manifest.module_kind
@@ -4295,7 +4760,12 @@ async function moduleRegisterCommand(opts) {
         name,
         ...description !== void 0 ? { description } : {},
         workspaceId: workspace2.id,
-        ...moduleKind !== void 0 ? { moduleKind } : {}
+        ...moduleKind !== void 0 ? { moduleKind } : {},
+        // P1-C C2: push the whole local manifest so the backend
+        // materializes owns.tables into the fresh draft. `init` omits
+        // this (scaffolds empty); `register` sends it because the local
+        // module.json is the source of truth for an already-authored app.
+        manifest
       },
       { baseUrl: resolveApiUrl(), auth: { token: cfg.token } }
     );
@@ -4307,6 +4777,13 @@ async function moduleRegisterCommand(opts) {
         );
       } else if (err.code === "FORBIDDEN") {
         fail(`Not a member of workspace "${workspace2.slug}". Join it, then retry.`);
+      } else if (err.code === "MANIFEST_INVALID") {
+        const issues = extractManifestIssues(err);
+        fail(
+          `Your module.json failed validation:
+${issues}
+  Fix the issues above (or run ${code("dashwise module validate")} for the full report) and retry.`
+        );
       } else {
         fail(`Registration failed (${err.code || err.status}): ${err.message}`);
       }
@@ -4317,26 +4794,49 @@ async function moduleRegisterCommand(opts) {
   }
   try {
     upsertModuleEntry(slug, {
-      runtimeToken: response.runtime_token,
+      apiKey: response.api_key,
+      apiKeyId: response.api_key_id,
       installationId: response.installation.id,
-      expiresAt: response.runtime_token_expires_at
+      expiresAt: response.api_key_expires_at
     });
   } catch (err) {
     warn(
-      `Registered (installation id=${response.installation.id}) but failed to cache the runtime token: ${err.message}
-  Runtime token (save this manually): ${response.runtime_token}
-  Expires: ${response.runtime_token_expires_at}`
+      `Registered (installation id=${response.installation.id}) but failed to cache the API key: ${err.message}
+  API key (save this manually): ${response.api_key}
+  Expires: ${response.api_key_expires_at}`
     );
     return 0;
   }
+  const tablesApplied = response.tables_applied ?? 0;
   success(
-    `Registered "${name}" \u2192 module #${response.module.id}, dev install #${response.installation.id}. Runtime token cached.`
+    `Registered "${name}" \u2192 module #${response.module.id}, dev install #${response.installation.id}. API key cached.`
   );
+  if (tablesApplied > 0) {
+    info(
+      `Materialized ${code(String(tablesApplied))} ${tablesApplied === 1 ? "table" : "tables"} from your module.json into the dev install.`
+    );
+  }
   info(
-    `Next: ${code("dashwise dev")} to run it against DashWise, or ${code("dashwise module publish")} to deploy. Add tables with ${code("dashwise table create")}.`
+    `Next: ${code("dashwise dev")} to run it against DashWise, or ${code("dashwise module publish")} to deploy.${tablesApplied === 0 ? ` Add tables with ${code("dashwise table create")}.` : ""}`
   );
   return 0;
 }
+function extractManifestIssues(err) {
+  const issues = err.context?.issues;
+  if (Array.isArray(issues) && issues.length > 0) {
+    return issues.map((issue) => {
+      if (typeof issue === "string") return `  - ${issue}`;
+      if (issue && typeof issue === "object") {
+        const o = issue;
+        const path = typeof o.path === "string" ? `${o.path}: ` : "";
+        const message = typeof o.message === "string" ? o.message : JSON.stringify(issue);
+        return `  - ${path}${message}`;
+      }
+      return `  - ${String(issue)}`;
+    }).join("\n");
+  }
+  return `  - ${err.message}`;
+}
 
 // src/commands/module/generate.ts
 init_api_client();
@@ -5174,6 +5674,7 @@ function readIssues(context) {
 
 // src/commands/deps/add.ts
 init_api_client();
+init_config();
 init_manifest_io();
 init_output();
 var MIN_PURPOSE_LEN = 10;
@@ -5309,9 +5810,59 @@ async function depsAddCommand(providerSlug, options) {
   );
   info(`Reads: ${entry.reads.map((r) => `${code(r.table)} (${r.fields.join(", ")})`).join("; ")}`);
   info(`Run ${code("dashwise module generate")} to refresh typed wrappers.`);
+  await reportConnectStatus2(manifest.module?.slug, providerSlug);
   if (isInteractive) outro("Done.");
   return 0;
 }
+async function reportConnectStatus2(consumerSlug, providerSlug) {
+  if (!consumerSlug) return;
+  let cfg;
+  let entry;
+  try {
+    cfg = readConfig();
+    entry = readModuleEntry(consumerSlug);
+  } catch {
+    cfg = null;
+    entry = null;
+  }
+  if (!cfg || !entry) {
+    info(
+      `Once provisioned (${code("dashwise init")}) + pushed (${code("dashwise dev")}), run ${code("dashwise deps")} to see whether ${code(providerSlug)} resolves or parks.`
+    );
+    return;
+  }
+  const requestOptions = {
+    baseUrl: resolveApiUrl(),
+    auth: { token: cfg.token }
+  };
+  try {
+    const deps = await getInstallationDependencies(entry.installationId, requestOptions);
+    const match = deps.find((d) => d.slug === providerSlug);
+    if (!match) {
+      info(
+        `${code(providerSlug)} isn't reconciled server-side yet. Push the manifest (${code("dashwise dev")} watches + applies it) \u2014 then ${code("dashwise deps")} shows its resolve/park status.`
+      );
+      return;
+    }
+    if (match.status === "resolved") {
+      const providerLine = match.provider != null ? ` (${dim(`provider install #${match.provider.installation_id} @ v${match.provider.version}`)})` : "";
+      out(`  ${pc.green("\u25CF resolved")}${providerLine}`);
+    } else {
+      out(`  ${pc.yellow("\u25CB unbound")}  ${dim("reason:")} ${match.reason ?? dim("(unspecified)")}`);
+      info(
+        `Declared but not connected. Install the provider in this workspace, then ${code(`dashwise deps bind ${providerSlug}`)} \u2014 reads return ${code("DEP_UNBOUND")} until it's bound.`
+      );
+    }
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      info(`(Skipped connect-status check \u2014 CLI token stale; run ${code("dashwise login")} to refresh.)`);
+    } else {
+      info(
+        `(Couldn't fetch connect status right now \u2014 run ${code("dashwise deps")} later to see whether ${code(providerSlug)} resolves or parks.)`
+      );
+    }
+  }
+}
 async function collectInteractive(providerSlug, summary, resolvedVersion, options) {
   const reads = [];
   if (summary && summary.exposes && summary.exposes.length > 0) {
@@ -5730,96 +6281,7 @@ async function depsRemoveCommand(providerSlug, options) {
   return 0;
 }
 
-// src/commands/pull.ts
-init_api_client();
-init_manifest_io();
-init_schema_command_context();
-init_output();
-async function pullCommand(options) {
-  let ctx;
-  try {
-    ctx = loadSchemaCommandContext({
-      ...options.dir !== void 0 ? { dir: options.dir } : {}
-    });
-  } catch (err) {
-    fail(err.message);
-    return 1;
-  }
-  info(`Pulling manifest for installation ${ctx.entry.installationId}\u2026`);
-  let remoteManifest;
-  try {
-    const response = await getInstallationSchema(
-      ctx.entry.installationId,
-      ctx.requestOptions
-    );
-    remoteManifest = response.manifest;
-  } catch (err) {
-    return surfacePullFailure(err);
-  }
-  const localJson = JSON.stringify(ctx.manifest, null, 2) + "\n";
-  const remoteJson = JSON.stringify(remoteManifest, null, 2) + "\n";
-  if (localJson === remoteJson) {
-    success("Already in sync \u2014 local module.json matches backend.");
-    return 0;
-  }
-  const localBytes = Buffer.byteLength(localJson, "utf8");
-  const remoteBytes = Buffer.byteLength(remoteJson, "utf8");
-  const delta = remoteBytes - localBytes;
-  const deltaStr = delta === 0 ? "0 bytes" : `${delta > 0 ? "+" : ""}${delta} bytes`;
-  if (options.dryRun) {
-    info(
-      `Drift detected (${deltaStr}). ${code("--dry-run")} \u2014 not writing.`
-    );
-    info(`Run ${code("dashwise pull")} without ${code("--dry-run")} to apply.`);
-    return 0;
-  }
-  try {
-    writeManifest(remoteManifest, ctx.projectRoot);
-  } catch (err) {
-    fail(`Failed to write ${manifestPath(ctx.projectRoot)}: ${err.message}`);
-    return 1;
-  }
-  success(
-    `Synced module.json from backend (${deltaStr}). ${dim(`Run \`dashwise module generate\` to refresh typed SDK if your watcher isn't running.`)}`
-  );
-  return 0;
-}
-function surfacePullFailure(err) {
-  if (err instanceof ApiError) {
-    switch (err.code) {
-      case "UNAUTHENTICATED":
-        fail(
-          `Runtime token rejected. The cached token for this module may be expired \u2014 re-run \`dashwise init <slug> --force\` to mint a fresh one.`
-        );
-        break;
-      case "SANDBOX_TOKEN_NOT_ACCEPTED":
-        fail(
-          `Schema-read endpoint requires a local-dev runtime token (kind=local). The cached token is the wrong kind \u2014 re-run \`dashwise init <slug> --force\`.`
-        );
-        break;
-      case "INSTALL_MISMATCH":
-        fail(
-          `Runtime token is bound to a different installation than expected. The cached install id may be stale \u2014 re-run \`dashwise init <slug> --force\`.`
-        );
-        break;
-      case "INSTALLATION_NOT_FOUND":
-        fail(
-          `The backend has no record of this installation. It may have been destroyed (GC, manual cleanup). Re-run \`dashwise init <slug>\` to provision a fresh one.`
-        );
-        break;
-      default:
-        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
-    }
-    return 1;
-  }
-  fail(`Pull failed: ${err.message}`);
-  return 1;
-}
-
-// src/bin.ts
-init_scaffold();
-
-// src/commands/api-keys.ts
+// src/commands/deps/connect.ts
 init_api_client();
 init_config();
 init_manifest_io();
@@ -5828,9 +6290,7 @@ function loadContext(opts) {
   const manifest = readManifestOrThrow(opts.dir);
   const slug = manifest.module?.slug;
   if (!slug) {
-    throw new Error(
-      `module.json has no module.slug \u2014 the manifest is malformed.`
-    );
+    throw new Error("module.json has no module.slug \u2014 the manifest is malformed.");
   }
   const cfg = readConfig();
   if (!cfg) {
@@ -5851,7 +6311,12 @@ function loadContext(opts) {
     }
   };
 }
-async function apiKeysListCommand(options) {
+function statusChip(status) {
+  if (status === "resolved") return pc.green("\u25CF resolved");
+  if (status === "unbound") return pc.yellow("\u25CB unbound");
+  return pc.dim(`? ${status}`);
+}
+async function depsConnectListCommand(options) {
   let ctx;
   try {
     ctx = loadContext(options);
@@ -5859,40 +6324,50 @@ async function apiKeysListCommand(options) {
     fail(err.message);
     return 1;
   }
-  let keys;
+  let deps;
   try {
-    const resp = await listApiKeys(ctx.installationId, ctx.requestOptions);
-    keys = resp.api_keys;
+    deps = await getInstallationDependencies(ctx.installationId, ctx.requestOptions);
   } catch (err) {
-    return surfaceApiKeysError(err);
+    return surfaceDepError(err);
   }
-  const filtered = options.all ? keys : keys.filter((k) => k.revoked_at === null);
   if (options.json) {
-    process.stdout.write(`${JSON.stringify(filtered, null, 2)}
-`);
+    out(JSON.stringify(deps, null, 2));
     return 0;
   }
-  if (filtered.length === 0) {
-    info(
-      options.all ? `No API keys (active or revoked) for ${code(ctx.slug)}.` : `No active API keys for ${code(ctx.slug)}. Run ${code("dashwise api-keys create <name>")} to mint one, or ${code("dashwise api-keys list --all")} to include revoked.`
-    );
+  if (deps.length === 0) {
+    info(`No cross-module dependencies declared for ${code(ctx.slug)}.`);
+    info(`Add one with ${code("dashwise deps add <provider-slug>")}.`);
     return 0;
   }
-  info(`API keys for ${code(ctx.slug)} (install id=${ctx.installationId}):`);
-  for (const k of filtered) {
-    const status = formatKeyStatus(k);
-    const lastUsed = k.last_used_at ? `last used ${formatRelative(new Date(k.last_used_at))}` : "never used";
-    process.stdout.write(
-      `  ${code(`#${k.id}`)} ${k.name} ${dim(`dwk_${k.key_prefix}\u2026`)} ${status} ${dim(`(${lastUsed})`)}
-`
+  const unbound = deps.filter((d) => d.status === "unbound").length;
+  info(
+    `Cross-module dependencies for ${code(ctx.slug)} ${dim(
+      `(${deps.length} declared${unbound > 0 ? `, ${unbound} unbound` : ""})`
+    )}:`
+  );
+  out("");
+  for (const dep of deps) {
+    out(`  ${statusChip(dep.status)}  ${code(dep.slug)}@${dep.range ?? "*"}`);
+    if (dep.status === "resolved" && dep.provider) {
+      out(
+        `      ${dim("provider:")} install #${dep.provider.installation_id} @ v${dep.provider.version}`
+      );
+    }
+    if (dep.status === "unbound") {
+      out(`      ${dim("reason:")} ${dep.reason ?? dim("(unspecified)")}`);
+    }
+    out("");
+  }
+  if (unbound > 0) {
+    info(
+      `Connect a parked dep with ${code("dashwise deps bind <provider-slug>")} once its provider is installed.`
     );
   }
   return 0;
 }
-async function apiKeysCreateCommand(nameArg, options) {
-  const name = nameArg ?? options.name;
-  if (!name) {
-    fail("Usage: `dashwise api-keys create <name>` (e.g. `dashwise api-keys create production`)");
+async function depsBindCommand(providerSlug, options) {
+  if (!providerSlug || typeof providerSlug !== "string") {
+    fail("Usage: `dashwise deps bind <provider-slug> [--installation <id>]`");
     return 1;
   }
   let ctx;
@@ -5902,23 +6377,1091 @@ async function apiKeysCreateCommand(nameArg, options) {
     fail(err.message);
     return 1;
   }
-  const body = { name };
-  if (options.scopes !== void 0) {
-    body.scopes = options.scopes.split(",").map((s) => s.trim()).filter(Boolean);
+  try {
+    const result = await bindDependency(
+      ctx.installationId,
+      providerSlug,
+      options.installation !== void 0 ? { provider_installation_id: options.installation } : {},
+      ctx.requestOptions
+    );
+    const providerLine = result.provider != null ? ` \u2192 install #${result.provider.installation_id} @ v${result.provider.version}` : "";
+    success(`Bound ${code(providerSlug)} for ${code(ctx.slug)}${providerLine}.`);
+    info("Runtime reads against this dependency will now succeed.");
+    return 0;
+  } catch (err) {
+    return surfaceBindError(err, providerSlug, ctx.slug);
   }
-  if (options.expiresAt !== void 0) {
-    body.expires_at = options.expiresAt;
+}
+async function depsUnbindCommand(providerSlug, options) {
+  if (!providerSlug || typeof providerSlug !== "string") {
+    fail("Usage: `dashwise deps unbind <provider-slug>`");
+    return 1;
   }
-  let resp;
+  let ctx;
   try {
-    resp = await createApiKey(ctx.installationId, body, ctx.requestOptions);
+    ctx = loadContext(options);
   } catch (err) {
-    return surfaceApiKeysError(err);
+    fail(err.message);
+    return 1;
   }
-  if (options.rawOnly) {
-    process.stderr.write(
-      `Created API key #${resp.api_key.id} (${resp.api_key.name}) for install ${ctx.installationId}.
-`
+  try {
+    await unbindDependency(ctx.installationId, providerSlug, ctx.requestOptions);
+    success(`Unbound ${code(providerSlug)} for ${code(ctx.slug)}.`);
+    warn(
+      `Runtime reads against this dependency now return ${code("DEP_UNBOUND")} until you ${code("dashwise deps bind")} it again.`
+    );
+    return 0;
+  } catch (err) {
+    return surfaceDepError(err);
+  }
+}
+function surfaceBindError(err, providerSlug, consumerSlug) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "MISSING_DEPENDENCY":
+        fail(
+          `No installation of ${code(providerSlug)} found in ${code(consumerSlug)}'s workspace. Install the provider module first, then re-run ${code(`dashwise deps bind ${providerSlug}`)}.`
+        );
+        return 1;
+      case "DEPENDENCY_VERSION_MISMATCH":
+        fail(
+          `The installed ${code(providerSlug)} version is outside your declared range (${err.message}). Update the range in module.json (${code(`dashwise deps add ${providerSlug}`)}) or upgrade the provider install.`
+        );
+        return 1;
+      case "PROVIDER_VERSION_RECORD_MISSING":
+        fail(
+          `The provider ${code(providerSlug)}'s version record is missing (${err.message}). This is a provider-side data issue \u2014 the provider may need to re-publish.`
+        );
+        return 1;
+      case "EXPOSES_MISSING":
+        fail(
+          `${code(providerSlug)} no longer exposes a table/field your dependency reads (${err.message}). Trim your ${code("reads[]")} or ask the provider to re-expose it.`
+        );
+        return 1;
+      case "EXPOSES_PRIVATE":
+        fail(
+          `${code(providerSlug)} exposes the requested surface as ${code("private")} \u2014 it can't be read by depending modules (${err.message}).`
+        );
+        return 1;
+      case "ACTION_NOT_EXPOSED":
+        fail(
+          `A cross-module action your dependency declares isn't exposed by ${code(providerSlug)} (${err.message}). Remove it from your dep's ${code("actions[]")} or ask the provider to expose it.`
+        );
+        return 1;
+      case "PROVIDER_NOT_PRODUCTION":
+        fail(
+          `A production install can only bind to a production provider install; the available ${code(providerSlug)} install isn't production (${err.message}).`
+        );
+        return 1;
+      case "DEPENDENCY_NOT_DECLARED":
+        fail(
+          `${code(consumerSlug)}'s module.json doesn't declare a dependency on ${code(providerSlug)}. Add it with ${code(`dashwise deps add ${providerSlug}`)} + push the manifest first.`
+        );
+        return 1;
+      default:
+        fail(
+          `Could not bind ${code(providerSlug)}: ${err.code}${err.message ? ` \u2014 ${err.message}` : ""}. The dependency stays unbound.`
+        );
+        return 1;
+    }
+  }
+  fail(`Bind failed: ${err.message}`);
+  return 1;
+}
+function surfaceDepError(err) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "UNAUTHENTICATED":
+        fail(
+          `Auth rejected by backend. Your CLI token may be stale \u2014 run ${code("dashwise login")} then retry.`
+        );
+        return 1;
+      case "NOT_WORKSPACE_MEMBER":
+        fail(
+          `You're not a member of this installation's workspace. Dependency management requires workspace membership.`
+        );
+        return 1;
+      case "NOT_WORKSPACE_ADMIN":
+      case "FORBIDDEN":
+        fail(
+          `Not authorized. Binding / unbinding dependencies requires workspace-admin.`
+        );
+        return 1;
+      case "INSTALLATION_NOT_FOUND":
+        fail(
+          `Installation not found. It may have been destroyed; re-provision via ${code("dashwise init <slug>")}.`
+        );
+        return 1;
+      case "DEPENDENCY_NOT_DECLARED":
+        fail(
+          `No such dependency declared in this module's manifest. Run ${code("dashwise deps")} to see declared deps.`
+        );
+        return 1;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+        return 1;
+    }
+  }
+  fail(`Dependency operation failed: ${err.message}`);
+  return 1;
+}
+
+// src/commands/uses/bind.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+function loadContext2(opts) {
+  const manifest = readManifestOrThrow(opts.dir);
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    throw new Error("module.json has no module.slug \u2014 the manifest is malformed.");
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    throw new Error("Not logged in. Run `dashwise login` first.");
+  }
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    throw new Error(
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+    );
+  }
+  return {
+    installationId: entry.installationId,
+    slug,
+    ...opts.dir !== void 0 ? { dir: opts.dir } : {},
+    requestOptions: {
+      baseUrl: resolveApiUrl(),
+      auth: { token: cfg.token }
+    }
+  };
+}
+function statusChip2(status) {
+  if (status === "bound") return pc.green("\u25CF bound");
+  if (status === "unbound") return pc.yellow("\u25CB unbound");
+  if (status === "declined") return pc.dim("\u2298 declined");
+  return pc.dim(`? ${status}`);
+}
+function opsLine(ops) {
+  return ops.length > 0 ? ops.join(", ") : dim("(none)");
+}
+async function bindListCommand(options) {
+  let ctx;
+  try {
+    ctx = loadContext2(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let bindings;
+  try {
+    bindings = await getInstallationBindings(ctx.installationId, ctx.requestOptions);
+  } catch (err) {
+    return surfaceBindingError(err);
+  }
+  if (options.json) {
+    out(JSON.stringify(bindings, null, 2));
+    return 0;
+  }
+  if (bindings.length === 0) {
+    info(`No workspace-table ${code("uses")} slots declared for ${code(ctx.slug)}.`);
+    info(
+      `Declare one by hand in ${code("module.json#uses.tables")}, or on-ramp an existing table with ${code("dashwise uses add --from-table <name>")}.`
+    );
+    return 0;
+  }
+  const unbound = bindings.filter((b) => b.status === "unbound").length;
+  info(
+    `Workspace-table bindings for ${code(ctx.slug)} ${dim(
+      `(${bindings.length} declared${unbound > 0 ? `, ${unbound} unbound` : ""})`
+    )}:`
+  );
+  out("");
+  for (const b of bindings) {
+    const enforced = b.ops.filter((o) => (b.consented_ops ?? []).includes(o));
+    const opsSummary = b.status === "bound" && enforced.length !== b.ops.length ? `${opsLine(enforced)} ${dim(`(declared ${opsLine(b.ops)}; re-bind to consent to the rest)`)}` : opsLine(b.ops);
+    out(`  ${statusChip2(b.status)}  ${code(b.uses_slug)}  ${dim(`[${opsSummary}]`)}`);
+    if (b.purpose) {
+      out(`      ${dim("purpose:")} ${b.purpose}`);
+    }
+    if (b.status === "bound" && b.table) {
+      out(`      ${dim("table:")} ${b.table.name} ${dim(`(id ${b.table.id})`)}`);
+      const mapped = b.field_map ? Object.keys(b.field_map).length : 0;
+      if (mapped > 0) {
+        out(`      ${dim("fields:")} ${mapped} mapped`);
+      }
+    }
+    if (b.status === "unbound") {
+      out(`      ${dim("reason:")} ${b.reason ?? dim("(unspecified)")}`);
+    }
+    if (b.missing_fields && b.missing_fields.length > 0) {
+      out(
+        `      ${pc.yellow("missing:")} ${b.missing_fields.join(", ")} ${dim("(required field(s) not mapped)")}`
+      );
+    }
+    out("");
+  }
+  if (unbound > 0) {
+    info(
+      `Connect a parked slot with ${code("dashwise bind <uses-slug> --table <name>")} (or ${code("--create")} to materialize a fresh table).`
+    );
+  }
+  return 0;
+}
+async function bindCommand(usesSlug, options) {
+  if (!usesSlug || typeof usesSlug !== "string") {
+    fail(
+      "Usage: `dashwise bind <uses-slug> [--table <name-or-id>] [--map <usesField>=<physicalFieldName>...]`, `--create`, or `--decline`."
+    );
+    return 1;
+  }
+  const modes = [options.create, options.decline, options.table !== void 0].filter(
+    Boolean
+  ).length;
+  if (modes > 1) {
+    fail(
+      `Pass at most one of ${code("--table")}, ${code("--create")}, ${code("--decline")} \u2014 they select different bind modes.`
+    );
+    return 1;
+  }
+  if (options.decline && (options.map ?? []).length > 0) {
+    fail(`${code("--map")} makes no sense with ${code("--decline")} (nothing is being bound).`);
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = loadContext2(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  if (options.decline) {
+    return declineSlot(ctx, usesSlug);
+  }
+  if (options.create) {
+    return bindViaCreate(ctx, usesSlug);
+  }
+  let mapOverrides;
+  try {
+    mapOverrides = parseMapOverrides(options.map);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let candidates;
+  try {
+    candidates = await getBindingCandidates(
+      ctx.installationId,
+      usesSlug,
+      ctx.requestOptions
+    );
+  } catch (err) {
+    return surfaceBindingError(err);
+  }
+  const chosen = await chooseCandidate(candidates, usesSlug, options.table);
+  if (chosen === "cancelled") {
+    info("Cancelled.");
+    return 130;
+  }
+  if (chosen === null) {
+    return 1;
+  }
+  let fieldMap;
+  try {
+    fieldMap = await buildFieldMap(ctx, chosen, mapOverrides);
+  } catch (err) {
+    if (err instanceof ApiError) return surfaceBindingError(err);
+    fail(err.message);
+    return 1;
+  }
+  let result;
+  try {
+    result = await putBinding(
+      ctx.installationId,
+      usesSlug,
+      fieldMap !== void 0 ? { table_id: chosen.table_id, field_map: fieldMap } : { table_id: chosen.table_id },
+      ctx.requestOptions
+    );
+  } catch (err) {
+    return surfacePutBindingError(err, usesSlug, ctx.slug);
+  }
+  reportBoundOk(result, ctx.slug);
+  return 0;
+}
+async function chooseCandidate(candidates, usesSlug, tableFlag) {
+  if (candidates.length === 0) {
+    fail(
+      `No workspace table can satisfy ${code(usesSlug)} yet. Create a matching table (or ${code(`dashwise bind ${usesSlug} --create`)} to materialize one from the declared fields).`
+    );
+    return null;
+  }
+  if (tableFlag !== void 0) {
+    const match = matchCandidate(candidates, tableFlag);
+    if (!match) {
+      const list2 = candidates.map((c2) => `  - ${c2.name} ${dim(`(id ${c2.table_id}, score ${c2.match_score})`)}`).join("\n");
+      fail(
+        `No candidate table matching ${code(tableFlag)} for ${code(usesSlug)}. Candidates:
+${list2}`
+      );
+      return null;
+    }
+    return match;
+  }
+  if (candidates.length === 1) {
+    return candidates[0];
+  }
+  if (process.stdout.isTTY) {
+    const choice = await select({
+      message: `Which workspace table should ${usesSlug} bind to?`,
+      options: candidates.map((c2) => ({
+        value: String(c2.table_id),
+        label: c2.name,
+        hint: c2.missing_required.length > 0 ? `id=${c2.table_id}, score=${c2.match_score}, missing: ${c2.missing_required.join(", ")}` : `id=${c2.table_id}, score=${c2.match_score}, full coverage`
+      }))
+    });
+    if (isCancel(choice)) return "cancelled";
+    return candidates.find((c2) => String(c2.table_id) === choice) ?? null;
+  }
+  const list = candidates.map((c2) => `  - ${c2.name} ${dim(`(id ${c2.table_id}, score ${c2.match_score})`)}`).join("\n");
+  fail(
+    `${candidates.length} candidate tables for ${code(usesSlug)}. Re-run with ${code("--table <name-or-id>")} to pick one:
+${list}`
+  );
+  return null;
+}
+function matchCandidate(candidates, flag) {
+  const asNumber = Number.parseInt(flag, 10);
+  const isNumeric = !Number.isNaN(asNumber) && String(asNumber) === flag;
+  if (isNumeric) {
+    return candidates.find((c2) => c2.table_id === asNumber);
+  }
+  return candidates.find((c2) => c2.name === flag);
+}
+async function buildFieldMap(ctx, candidate, overrides) {
+  const overrideKeys = Object.keys(overrides);
+  if (overrideKeys.length === 0) {
+    return Object.keys(candidate.auto_field_map).length > 0 ? { ...candidate.auto_field_map } : void 0;
+  }
+  const table = await introspectWorkspaceTable(
+    ctx.installationId,
+    String(candidate.table_id),
+    ctx.requestOptions
+  );
+  const byName = /* @__PURE__ */ new Map();
+  for (const f of table.fields) {
+    byName.set(f.slug, f.id);
+    if (f.name) byName.set(f.name, f.id);
+  }
+  const merged = { ...candidate.auto_field_map };
+  for (const [usesField, physicalName] of Object.entries(overrides)) {
+    const id = byName.get(physicalName);
+    if (id === void 0) {
+      const available = table.fields.map((f) => f.name && f.name !== f.slug ? `${f.slug} (${f.name})` : f.slug).join(", ");
+      throw new Error(
+        `--map ${usesField}=${physicalName}: table "${table.name}" has no field named "${physicalName}". Available: ${available}.`
+      );
+    }
+    merged[usesField] = id;
+  }
+  return merged;
+}
+function parseMapOverrides(specs) {
+  const out2 = {};
+  for (const spec of specs ?? []) {
+    const eq = spec.indexOf("=");
+    if (eq <= 0 || eq === spec.length - 1) {
+      throw new Error(
+        `Invalid --map "${spec}". Expected \`<usesField>=<physicalFieldName>\` (e.g. \`--map name=full_name\`).`
+      );
+    }
+    const usesField = spec.slice(0, eq).trim();
+    const physicalName = spec.slice(eq + 1).trim();
+    if (!usesField || !physicalName) {
+      throw new Error(`Invalid --map "${spec}": both sides must be non-empty.`);
+    }
+    if (out2[usesField] !== void 0) {
+      throw new Error(`Duplicate --map for uses field "${usesField}".`);
+    }
+    out2[usesField] = physicalName;
+  }
+  return out2;
+}
+async function bindViaCreate(ctx, usesSlug) {
+  const slot = findUsesSlot(ctx, usesSlug);
+  if (slot && slot.if_missing !== void 0 && slot.if_missing !== "create") {
+    warn(
+      `${code(usesSlug)} declares ${code(`if_missing: "${slot.if_missing}"`)}, not ${code('"create"')} \u2014 the backend may reject ${code("--create")}. Set it to ${code("create")} in module.json if you want a table materialized.`
+    );
+  }
+  let result;
+  try {
+    result = await putBinding(
+      ctx.installationId,
+      usesSlug,
+      { create: true },
+      ctx.requestOptions
+    );
+  } catch (err) {
+    return surfacePutBindingError(err, usesSlug, ctx.slug);
+  }
+  if (result.table) {
+    success(
+      `Materialized ${code(result.table.name)} ${dim(`(id ${result.table.id})`)} and bound ${code(usesSlug)} for ${code(ctx.slug)}.`
+    );
+    info(
+      `The new table is a plain user-owned Data Hub table \u2014 it stays in the workspace when the module is uninstalled.`
+    );
+  } else {
+    success(`Bound ${code(usesSlug)} for ${code(ctx.slug)} to a freshly-created table.`);
+  }
+  return 0;
+}
+async function declineSlot(ctx, usesSlug) {
+  try {
+    await declineBinding(ctx.installationId, usesSlug, ctx.requestOptions);
+    success(`Declined ${code(usesSlug)} for ${code(ctx.slug)} \u2014 the module runs without it.`);
+    return 0;
+  } catch (err) {
+    return surfacePutBindingError(err, usesSlug, ctx.slug);
+  }
+}
+function findUsesSlot(ctx, usesSlug) {
+  try {
+    const manifest = readManifestOrThrow(ctx.dir);
+    return manifest.uses?.tables?.find((t) => t.slug === usesSlug);
+  } catch {
+    return void 0;
+  }
+}
+function reportBoundOk(result, moduleSlug) {
+  const tableLine = result.table ? ` \u2192 ${result.table.name} ${dim(`(id ${result.table.id})`)}` : "";
+  success(`Bound ${code(result.uses_slug)} for ${code(moduleSlug)}${tableLine}.`);
+  const consented = result.consented_ops ?? [];
+  info(
+    `Consented ops: ${opsLine(consented)}. Runtime reads/writes against this slot now succeed.`
+  );
+  if (result.missing_fields && result.missing_fields.length > 0) {
+    warn(
+      `Still unmapped required field(s): ${result.missing_fields.join(", ")}. Re-run with ${code("--map <usesField>=<physicalFieldName>")} to map them.`
+    );
+  }
+}
+async function unbindCommand(usesSlug, options) {
+  if (!usesSlug || typeof usesSlug !== "string") {
+    fail("Usage: `dashwise unbind <uses-slug>`");
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = loadContext2(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  try {
+    await unbindBinding(ctx.installationId, usesSlug, ctx.requestOptions);
+    success(`Unbound ${code(usesSlug)} for ${code(ctx.slug)}.`);
+    warn(
+      `Runtime reads/writes against this slot now return ${code("USES_UNBOUND")} until you ${code("dashwise bind")} it again.`
+    );
+    return 0;
+  } catch (err) {
+    return surfaceBindingError(err);
+  }
+}
+function surfacePutBindingError(err, usesSlug, moduleSlug) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "TABLE_NOT_IN_WORKSPACE":
+        fail(
+          `The chosen table isn't in ${code(moduleSlug)}'s workspace (${err.message}). A ${code("uses")} binding can only target a table the install's workspace owns.`
+        );
+        return 1;
+      case "TABLE_IS_MODULE_MANAGED":
+        fail(
+          `That table is module-managed \u2014 ${code("uses")} bindings target plain WORKSPACE tables only. Reach a module's own tables via ${code("dashwise deps")} instead.`
+        );
+        return 1;
+      case "MISSING_REQUIRED_FIELDS":
+        fail(
+          `The table is missing required field(s) the ${code(usesSlug)} contract needs (${err.message}). Map them explicitly with ${code("--map <usesField>=<physicalFieldName>")}, or pick a table that has them.`
+        );
+        return 1;
+      case "FIELD_TYPE_INCOMPATIBLE":
+        fail(
+          `A mapped physical field's type is incompatible with the declared abstract type (${err.message}). Map to a compatible field with ${code("--map")}.`
+        );
+        return 1;
+      case "FIELD_NOT_FOUND":
+        fail(
+          `A ${code("--map")} referenced a physical field that doesn't exist on the table (${err.message}). Check the field name.`
+        );
+        return 1;
+      case "DECLINE_NOT_ALLOWED":
+        fail(
+          `${code(usesSlug)} is a required need \u2014 it can't be declined. Bind it to a table (${code(`dashwise bind ${usesSlug} --table <name>`)}) or set ${code('if_missing: "optional"')} in module.json.`
+        );
+        return 1;
+      case "USES_SLOT_NOT_DECLARED":
+      case "BINDING_NOT_FOUND":
+        fail(
+          `${code(moduleSlug)}'s module.json doesn't declare a ${code("uses")} slot named ${code(usesSlug)}. Add it (or ${code("dashwise uses add --from-table <name>")}) + push the manifest first.`
+        );
+        return 1;
+      case "NOT_WORKSPACE_ADMIN":
+      case "FORBIDDEN":
+        fail(`Not authorized. Binding / unbinding / declining requires workspace-admin.`);
+        return 1;
+      default:
+        fail(
+          `Could not bind ${code(usesSlug)}: ${err.code}${err.message ? ` \u2014 ${err.message}` : ""}. The binding is unchanged.`
+        );
+        return 1;
+    }
+  }
+  fail(`Bind failed: ${err.message}`);
+  return 1;
+}
+function surfaceBindingError(err) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "UNAUTHENTICATED":
+        fail(
+          `Auth rejected by backend. Your CLI token may be stale \u2014 run ${code("dashwise login")} then retry.`
+        );
+        return 1;
+      case "NOT_WORKSPACE_MEMBER":
+        fail(
+          `You're not a member of this installation's workspace. Binding management requires workspace membership.`
+        );
+        return 1;
+      case "NOT_WORKSPACE_ADMIN":
+      case "FORBIDDEN":
+        fail(`Not authorized. Binding / unbinding requires workspace-admin.`);
+        return 1;
+      case "INSTALLATION_NOT_FOUND":
+        fail(
+          `Installation not found. It may have been destroyed; re-provision via ${code("dashwise init <slug>")}.`
+        );
+        return 1;
+      case "USES_SLOT_NOT_DECLARED":
+      case "BINDING_NOT_FOUND":
+        fail(
+          `No such ${code("uses")} slot declared in this module's manifest. Run ${code("dashwise bind")} to see declared slots.`
+        );
+        return 1;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+        return 1;
+    }
+  }
+  fail(`Binding operation failed: ${err.message}`);
+  return 1;
+}
+
+// src/commands/uses/add.ts
+init_api_client();
+init_config();
+init_manifest_io();
+
+// src/lib/uses-types.ts
+var PHYSICAL_TO_ABSTRACT = {
+  text: "text",
+  long_text: "long_text",
+  number: "number",
+  rating: "number",
+  boolean: "boolean",
+  // A date-with-time column has physical registry type `date` (with
+  // `config.includeTime`), NOT a distinct `datetime` type — the backend
+  // registry has no `datetime` key. So introspection only ever reports
+  // `date` here; there is no `datetime` physical entry to fold.
+  date: "date",
+  email: "email",
+  url: "url",
+  single_select: "single_select",
+  multi_select: "multi_select"
+};
+function abstractTypeForPhysical(physicalType) {
+  return PHYSICAL_TO_ABSTRACT[physicalType] ?? null;
+}
+var USES_OPERATIONS = ["create", "read", "update", "delete"];
+
+// src/commands/uses/add.ts
+init_output();
+async function usesAddCommand(options) {
+  if (!options.fromTable) {
+    fail("Usage: `dashwise uses add --from-table <name-or-id>`");
+    return 1;
+  }
+  let ops;
+  try {
+    ops = parseOps(options.ops);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = loadContext3(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let table;
+  try {
+    table = await introspectWorkspaceTable(
+      ctx.installationId,
+      options.fromTable,
+      ctx.requestOptions
+    );
+  } catch (err) {
+    return surfaceIntrospectError(err, options.fromTable);
+  }
+  const slotSlug = options.slug ?? slugify(table.name);
+  if (!isKebab(slotSlug)) {
+    fail(
+      `Generated slot slug ${code(slotSlug)} isn't kebab-case. Pass ${code("--slug <kebab-slug>")} explicitly.`
+    );
+    return 1;
+  }
+  const { fields, skipped } = generateFields(table.fields);
+  if (fields.length === 0) {
+    fail(
+      `Table ${code(table.name)} has no fields representable as a v1 ${code("uses")} contract (all are link_row / formula / ai / file). Nothing to declare.`
+    );
+    return 1;
+  }
+  const slot = {
+    slug: slotSlug,
+    ops,
+    fields,
+    if_missing: "require"
+  };
+  if (options.purpose) slot.purpose = options.purpose;
+  info(
+    `Generated a ${code("uses")} contract ${code(slotSlug)} from table ${code(table.name)} ${dim(`(id ${table.table_id})`)}:`
+  );
+  out(`    ${dim("ops:")} ${ops.join(", ")}`);
+  for (const f of fields) {
+    const req = f.required ? dim(" (required)") : "";
+    out(`    ${dim("field:")} ${code(f.slug)} \u2192 ${f.types.join(" | ")}${req}`);
+  }
+  if (skipped.length > 0) {
+    warn(
+      `Skipped ${skipped.length} field(s) not representable in a v1 uses contract: ${skipped.join(", ")}.`
+    );
+  }
+  const uses = ctx.manifest.uses ?? { tables: [] };
+  const tables = uses.tables ?? [];
+  const existingIdx = tables.findIndex((t) => t.slug === slotSlug);
+  if (existingIdx >= 0 && !options.yes) {
+    fail(
+      `A ${code("uses")} slot ${code(slotSlug)} already exists in module.json. Re-run with ${code("--yes")} to replace it, or pass a different ${code("--slug")}.`
+    );
+    return 1;
+  }
+  if (existingIdx >= 0) {
+    tables[existingIdx] = slot;
+  } else {
+    tables.push(slot);
+  }
+  uses.tables = tables;
+  ctx.manifest.uses = uses;
+  try {
+    writeManifest(ctx.manifest, ctx.dir);
+  } catch (err) {
+    fail(`Could not write manifest: ${err.message}`);
+    return 1;
+  }
+  success(
+    `${existingIdx >= 0 ? "Replaced" : "Added"} ${code(`uses.tables[${slotSlug}]`)} in module.json.`
+  );
+  const pushed = await pushManifest(ctx);
+  if (!pushed) {
+    info(
+      `The manifest edit is saved locally. Push it (${code("dashwise dev")} watches + applies, or re-run once the backend is reachable), then ${code(`dashwise bind ${slotSlug} --table ${table.table_id}`)}.`
+    );
+    return 1;
+  }
+  if (options.noBind) {
+    info(
+      `Skipped auto-bind (${code("--no-bind")}). Connect it when ready: ${code(`dashwise bind ${slotSlug} --table ${table.table_id}`)}.`
+    );
+    return 0;
+  }
+  info(`Binding ${code(slotSlug)} to ${code(table.name)}\u2026`);
+  const bindExit = await bindCommand(slotSlug, {
+    ...ctx.dir !== void 0 ? { dir: ctx.dir } : {},
+    table: String(table.table_id)
+  });
+  if (bindExit !== 0) {
+    warn(
+      `The ${code("uses")} slot was declared + pushed, but the auto-bind didn't complete. Retry with ${code(`dashwise bind ${slotSlug} --table ${table.table_id}`)}.`
+    );
+    return bindExit;
+  }
+  return 0;
+}
+function loadContext3(opts) {
+  const manifest = readManifestOrThrow(opts.dir);
+  const moduleSlug = manifest.module?.slug;
+  if (!moduleSlug) {
+    throw new Error("module.json has no module.slug \u2014 the manifest is malformed.");
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    throw new Error("Not logged in. Run `dashwise login` first.");
+  }
+  const entry = readModuleEntry(moduleSlug);
+  if (!entry) {
+    throw new Error(
+      `No dev install cached for module "${moduleSlug}". Run \`dashwise init ${moduleSlug} --force\` to provision one.`
+    );
+  }
+  return {
+    installationId: entry.installationId,
+    moduleSlug,
+    ...opts.dir !== void 0 ? { dir: opts.dir } : {},
+    manifest,
+    requestOptions: {
+      baseUrl: resolveApiUrl(),
+      auth: { token: cfg.token }
+    }
+  };
+}
+async function pushManifest(ctx) {
+  let moduleId;
+  try {
+    const mod = await getModuleBySlug(ctx.moduleSlug, ctx.requestOptions);
+    moduleId = mod.id;
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      warn(
+        `Module ${code(ctx.moduleSlug)} isn't registered on the backend yet. Run ${code("dashwise module register")} (or ${code("dashwise init")}) before on-ramping a table.`
+      );
+      return false;
+    }
+    warn(`Couldn't resolve the module id to push the manifest: ${err.message}`);
+    return false;
+  }
+  try {
+    await applyDraftManifest(
+      moduleId,
+      ctx.manifest,
+      ctx.requestOptions
+    );
+    success("Pushed the manifest \u2014 the backend parked the new slot, ready to bind.");
+    return true;
+  } catch (err) {
+    if (err instanceof ApiError) {
+      if (err.code === "MANIFEST_INVALID" || err.status === 400) {
+        fail(`Manifest rejected by the backend validator: ${err.message}`);
+        const issues = extractIssues(err.context);
+        for (const issue of issues) out(`    ${dim("-")} ${issue}`);
+      } else {
+        fail(`Manifest push failed: ${err.code} ${err.status} \u2014 ${err.message}`);
+      }
+    } else {
+      fail(`Manifest push failed: ${err.message}`);
+    }
+    return false;
+  }
+}
+function extractIssues(context) {
+  if (!context) return [];
+  const raw = context.issues;
+  if (!Array.isArray(raw)) return [];
+  return raw.map((i) => {
+    if (typeof i === "string") return i;
+    if (i && typeof i === "object") {
+      const o = i;
+      const path = typeof o.path === "string" ? o.path : "";
+      const message = typeof o.message === "string" ? o.message : JSON.stringify(i);
+      return path ? `${path}: ${message}` : message;
+    }
+    return String(i);
+  });
+}
+function generateFields(physical) {
+  const fields = [];
+  const skipped = [];
+  for (const f of physical) {
+    const abstract = abstractTypeForPhysical(f.type);
+    if (abstract === null) {
+      skipped.push(`${f.slug} (${f.type})`);
+      continue;
+    }
+    const entry = { slug: f.slug, types: [abstract] };
+    if (f.required) entry.required = true;
+    fields.push(entry);
+  }
+  return { fields, skipped };
+}
+function parseOps(opsCsv) {
+  if (opsCsv === void 0) return ["read"];
+  const parsed = opsCsv.split(",").map((o) => o.trim()).filter(Boolean);
+  if (parsed.length === 0) {
+    throw new Error(`--ops must list at least one of ${USES_OPERATIONS.join(", ")}.`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const op of parsed) {
+    if (!USES_OPERATIONS.includes(op)) {
+      throw new Error(
+        `Invalid --ops value "${op}". Allowed: ${USES_OPERATIONS.join(", ")}.`
+      );
+    }
+    seen.add(op);
+  }
+  return USES_OPERATIONS.filter((o) => seen.has(o));
+}
+function slugify(name) {
+  return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+var KEBAB_REGEX = /^[a-z][a-z0-9-]*[a-z0-9]$/;
+function isKebab(slug) {
+  return KEBAB_REGEX.test(slug);
+}
+function surfaceIntrospectError(err, tableRef) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "NON_NUMERIC_TABLE_REF":
+        fail(err.message);
+        return 1;
+      case "NOT_FOUND":
+        fail(
+          `No workspace table with id ${code(tableRef)} is visible to you. Check the id (find it in the Dashwise UI URL, or via ${code("GET /api/tables/application/:applicationId")}).`
+        );
+        return 1;
+      case "TABLE_IS_MODULE_MANAGED":
+        fail(
+          `Table ${code(tableRef)} is module-managed \u2014 ${code("uses")} is for plain WORKSPACE tables. Reach a module's own tables via ${code("dashwise deps")} instead.`
+        );
+        return 1;
+      case "UNAUTHENTICATED":
+        fail(
+          `Auth rejected by backend. Your CLI token may be stale \u2014 run ${code("dashwise login")} then retry.`
+        );
+        return 1;
+      case "NOT_WORKSPACE_MEMBER":
+      case "FORBIDDEN":
+        fail(`You're not a member of the workspace that owns table ${code(tableRef)}.`);
+        return 1;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+        return 1;
+    }
+  }
+  fail(`Table introspection failed: ${err.message}`);
+  return 1;
+}
+
+// src/commands/pull.ts
+init_api_client();
+init_manifest_io();
+init_schema_command_context();
+init_output();
+async function pullCommand(options) {
+  let ctx;
+  try {
+    ctx = loadSchemaCommandContext({
+      ...options.dir !== void 0 ? { dir: options.dir } : {}
+    });
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  info(`Pulling manifest for installation ${ctx.entry.installationId}\u2026`);
+  let remoteManifest;
+  try {
+    const response = await getInstallationSchema(ctx.requestOptions);
+    remoteManifest = response.manifest;
+  } catch (err) {
+    return surfacePullFailure(err);
+  }
+  const localJson = JSON.stringify(ctx.manifest, null, 2) + "\n";
+  const remoteJson = JSON.stringify(remoteManifest, null, 2) + "\n";
+  if (localJson === remoteJson) {
+    success("Already in sync \u2014 local module.json matches backend.");
+    return 0;
+  }
+  const localBytes = Buffer.byteLength(localJson, "utf8");
+  const remoteBytes = Buffer.byteLength(remoteJson, "utf8");
+  const delta = remoteBytes - localBytes;
+  const deltaStr = delta === 0 ? "0 bytes" : `${delta > 0 ? "+" : ""}${delta} bytes`;
+  if (options.dryRun) {
+    info(
+      `Drift detected (${deltaStr}). ${code("--dry-run")} \u2014 not writing.`
+    );
+    info(`Run ${code("dashwise pull")} without ${code("--dry-run")} to apply.`);
+    return 0;
+  }
+  try {
+    writeManifest(remoteManifest, ctx.projectRoot);
+  } catch (err) {
+    fail(`Failed to write ${manifestPath(ctx.projectRoot)}: ${err.message}`);
+    return 1;
+  }
+  success(
+    `Synced module.json from backend (${deltaStr}). ${dim(`Run \`dashwise module generate\` to refresh typed SDK if your watcher isn't running.`)}`
+  );
+  return 0;
+}
+function surfacePullFailure(err) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "UNAUTHENTICATED":
+        fail(
+          `Runtime token rejected. The cached token for this module may be expired \u2014 re-run \`dashwise init <slug> --force\` to mint a fresh one.`
+        );
+        break;
+      case "SANDBOX_TOKEN_NOT_ACCEPTED":
+        fail(
+          `Schema-read endpoint requires a local-dev runtime token (kind=local). The cached token is the wrong kind \u2014 re-run \`dashwise init <slug> --force\`.`
+        );
+        break;
+      case "INSTALL_MISMATCH":
+        fail(
+          `Runtime token is bound to a different installation than expected. The cached install id may be stale \u2014 re-run \`dashwise init <slug> --force\`.`
+        );
+        break;
+      case "INSTALLATION_NOT_FOUND":
+        fail(
+          `The backend has no record of this installation. It may have been destroyed (GC, manual cleanup). Re-run \`dashwise init <slug>\` to provision a fresh one.`
+        );
+        break;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+    }
+    return 1;
+  }
+  fail(`Pull failed: ${err.message}`);
+  return 1;
+}
+
+// src/bin.ts
+init_scaffold();
+
+// src/commands/api-keys.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+function loadContext4(opts) {
+  const manifest = readManifestOrThrow(opts.dir);
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    throw new Error(
+      `module.json has no module.slug \u2014 the manifest is malformed.`
+    );
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    throw new Error("Not logged in. Run `dashwise login` first.");
+  }
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    throw new Error(
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+    );
+  }
+  return {
+    installationId: entry.installationId,
+    slug,
+    requestOptions: {
+      baseUrl: resolveApiUrl(),
+      auth: { token: cfg.token }
+    }
+  };
+}
+async function apiKeysListCommand(options) {
+  let ctx;
+  try {
+    ctx = loadContext4(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let keys;
+  try {
+    const resp = await listApiKeys(ctx.installationId, ctx.requestOptions);
+    keys = resp.api_keys;
+  } catch (err) {
+    return surfaceApiKeysError(err);
+  }
+  const filtered = options.all ? keys : keys.filter((k) => k.revoked_at === null);
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify(filtered, null, 2)}
+`);
+    return 0;
+  }
+  if (filtered.length === 0) {
+    info(
+      options.all ? `No API keys (active or revoked) for ${code(ctx.slug)}.` : `No active API keys for ${code(ctx.slug)}. Run ${code("dashwise api-keys create <name>")} to mint one, or ${code("dashwise api-keys list --all")} to include revoked.`
+    );
+    return 0;
+  }
+  info(`API keys for ${code(ctx.slug)} (install id=${ctx.installationId}):`);
+  for (const k of filtered) {
+    const status = formatKeyStatus(k);
+    const lastUsed = k.last_used_at ? `last used ${formatRelative(new Date(k.last_used_at))}` : "never used";
+    process.stdout.write(
+      `  ${code(`#${k.id}`)} ${k.name} ${dim(`dwk_${k.key_prefix}\u2026`)} ${status} ${dim(`(${lastUsed})`)}
+`
+    );
+    const grantLines = formatGrants(k.grants);
+    if (grantLines.length > 0) {
+      for (const line of grantLines) {
+        process.stdout.write(`      ${dim(line)}
+`);
+      }
+    } else if (k.grants !== void 0) {
+      process.stdout.write(`      ${dim("full install access (no grants)")}
+`);
+    }
+  }
+  return 0;
+}
+async function apiKeysCreateCommand(nameArg, options) {
+  const name = nameArg ?? options.name;
+  if (!name) {
+    fail("Usage: `dashwise api-keys create <name>` (e.g. `dashwise api-keys create production`)");
+    return 1;
+  }
+  let grants;
+  try {
+    grants = parseGrants(options.grant);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let expiresAt;
+  try {
+    expiresAt = resolveExpiresAt(options.expires);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = loadContext4(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const body = { name };
+  if (grants !== void 0) body.grants = grants;
+  if (expiresAt !== void 0) body.expires_at = expiresAt;
+  let resp;
+  try {
+    resp = await createApiKey(ctx.installationId, body, ctx.requestOptions);
+  } catch (err) {
+    return surfaceApiKeysError(err);
+  }
+  if (options.rawOnly) {
+    process.stderr.write(
+      `Created API key #${resp.api_key.id} (${resp.api_key.name}) for install ${ctx.installationId}.
+`
     );
     process.stdout.write(`${resp.raw_key}
 `);
@@ -5927,6 +7470,13 @@ async function apiKeysCreateCommand(nameArg, options) {
   success(
     `Created API key ${code(`#${resp.api_key.id}`)} (${resp.api_key.name}) for ${code(ctx.slug)}.`
   );
+  const grantLines = formatGrants(resp.api_key.grants);
+  if (grantLines.length > 0) {
+    info(`  ${dim("scope:")} scoped to`);
+    for (const line of grantLines) info(`    ${line}`);
+  } else {
+    info(`  ${dim("scope:")} full install access (no grants)`);
+  }
   info("");
   warn(
     "This is the ONLY time the full key is displayed. Save it now \u2014 the backend stores a hash, not the plaintext."
@@ -5935,14 +7485,9 @@ async function apiKeysCreateCommand(nameArg, options) {
   process.stdout.write(`  ${code(resp.raw_key)}
 `);
   info("");
-  info(`Use in a deployed module's env:`);
+  info(`Use in a deployed module's env (the two-var contract):`);
+  info(`  ${code(`DASHWISE_API_URL=${resolveApiUrl()}`)}`);
   info(`  ${code(`DASHWISE_API_KEY=${resp.raw_key.slice(0, 12)}\u2026`)}`);
-  info(
-    `  ${code(`DASHWISE_INSTALLATION_ID=${ctx.installationId}`)}`
-  );
-  info(
-    `  ${code(`DASHWISE_API_URL=${resolveApiUrl()}`)}`
-  );
   return 0;
 }
 async function apiKeysRevokeCommand(keyIdArg, options) {
@@ -5957,7 +7502,7 @@ async function apiKeysRevokeCommand(keyIdArg, options) {
   }
   let ctx;
   try {
-    ctx = loadContext(options);
+    ctx = loadContext4(options);
   } catch (err) {
     fail(err.message);
     return 1;
@@ -5991,6 +7536,17 @@ function surfaceApiKeysError(err) {
           `You're not a member of this installation's workspace. API-key management requires workspace membership.`
         );
         return 1;
+      case "NOT_WORKSPACE_ADMIN":
+      case "FORBIDDEN":
+        fail(
+          `Not authorized. Minting scoped keys (with --grant) or keys on non-local installs requires workspace-admin; members can mint full-access keys on local dev installs only.`
+        );
+        return 1;
+      case "INVALID_GRANT":
+        fail(
+          `A --grant referenced a table/app the backend rejected (${err.message}). Data Hub grants need a table or app that exists in this workspace; module grants need a table your manifest owns.`
+        );
+        return 1;
       case "INSTALLATION_NOT_FOUND":
         fail(
           `Installation not found. It may have been destroyed; re-provision via ${code("dashwise init <slug>")}.`
@@ -6009,6 +7565,117 @@ function surfaceApiKeysError(err) {
   fail(`API-key operation failed: ${err.message}`);
   return 1;
 }
+var GRANT_OPERATIONS = ["create", "read", "update", "delete"];
+function parseGrants(specs) {
+  if (!specs || specs.length === 0) return void 0;
+  return specs.map((spec) => parseGrantSpec(spec));
+}
+function parseGrantSpec(spec) {
+  const raw = spec.trim();
+  const parts = raw.split(":");
+  const source = parts[0];
+  if (source === "module") {
+    if (parts.length !== 3) {
+      throw new Error(
+        `Invalid --grant "${spec}". Module grants are \`module:<tableSlug>:<ops>\` (e.g. \`module:tasks:read,create\`).`
+      );
+    }
+    const tableSlug = parts[1];
+    if (!tableSlug) {
+      throw new Error(`Invalid --grant "${spec}": missing table slug.`);
+    }
+    return {
+      source: "module",
+      tableSlug,
+      operations: parseOps2(parts[2], spec)
+    };
+  }
+  if (source === "datahub") {
+    const scope = parts[1];
+    if (!scope) {
+      throw new Error(
+        `Invalid --grant "${spec}". Data Hub grants are \`datahub:table=<id>:<ops>\`, \`datahub:app=<id>:<ops>\`, or \`datahub:workspace:<ops>\`.`
+      );
+    }
+    if (scope === "workspace") {
+      if (parts.length !== 3) {
+        throw new Error(
+          `Invalid --grant "${spec}". Workspace-wide Data Hub grants are \`datahub:workspace:<ops>\`.`
+        );
+      }
+      return { source: "datahub", operations: parseOps2(parts[2], spec) };
+    }
+    const eq = scope.indexOf("=");
+    const scopeKind = eq === -1 ? scope : scope.slice(0, eq);
+    const scopeVal = eq === -1 ? "" : scope.slice(eq + 1);
+    if (scopeKind !== "table" && scopeKind !== "app" || scopeVal === "") {
+      throw new Error(
+        `Invalid --grant "${spec}". Data Hub scope must be \`table=<id>\`, \`app=<id>\`, or \`workspace\`.`
+      );
+    }
+    if (parts.length !== 3) {
+      throw new Error(
+        `Invalid --grant "${spec}". Data Hub grants are \`datahub:${scopeKind}=<id>:<ops>\`.`
+      );
+    }
+    const id = Number.parseInt(scopeVal, 10);
+    if (!Number.isInteger(id) || id <= 0 || String(id) !== scopeVal) {
+      throw new Error(
+        `Invalid --grant "${spec}": ${scopeKind} id must be a positive integer (got "${scopeVal}").`
+      );
+    }
+    const operations = parseOps2(parts[2], spec);
+    return scopeKind === "table" ? { source: "datahub", tableId: id, operations } : { source: "datahub", applicationId: id, operations };
+  }
+  throw new Error(
+    `Invalid --grant "${spec}": unknown source "${source}". Use \`module:\u2026\` or \`datahub:\u2026\`.`
+  );
+}
+function parseOps2(opsCsv, spec) {
+  const ops = opsCsv.split(",").map((o) => o.trim()).filter(Boolean);
+  if (ops.length === 0) {
+    throw new Error(
+      `Invalid --grant "${spec}": at least one operation is required (${GRANT_OPERATIONS.join(", ")}).`
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const op of ops) {
+    if (!GRANT_OPERATIONS.includes(op)) {
+      throw new Error(
+        `Invalid --grant "${spec}": unknown operation "${op}". Allowed: ${GRANT_OPERATIONS.join(", ")}.`
+      );
+    }
+    seen.add(op);
+  }
+  return GRANT_OPERATIONS.filter((op) => seen.has(op));
+}
+function resolveExpiresAt(days) {
+  if (days === void 0) return void 0;
+  if (!Number.isFinite(days) || days <= 0) {
+    throw new Error(`--expires must be a positive number of days (got ${days}).`);
+  }
+  return new Date(Date.now() + days * 24 * 60 * 60 * 1e3).toISOString();
+}
+function formatGrants(grants) {
+  if (!grants || grants.length === 0) return [];
+  const byScope = /* @__PURE__ */ new Map();
+  for (const g of grants) {
+    const label = grantScopeLabel(g);
+    const existing = byScope.get(label);
+    if (existing) existing.ops.add(g.operation);
+    else byScope.set(label, { label, ops: /* @__PURE__ */ new Set([g.operation]) });
+  }
+  return [...byScope.values()].map((s) => {
+    const ops = GRANT_OPERATIONS.filter((o) => s.ops.has(o));
+    return `${s.label}: ${ops.join(", ")}`;
+  });
+}
+function grantScopeLabel(g) {
+  if (g.source === "module") return `module ${g.table_slug ?? "?"}`;
+  if (g.table_id != null) return `datahub table#${g.table_id}`;
+  if (g.application_id != null) return `datahub app#${g.application_id}`;
+  return "datahub workspace";
+}
 function formatKeyStatus(k) {
   if (k.revoked_at) return dim("[revoked]");
   if (k.expires_at && new Date(k.expires_at).getTime() <= Date.now()) {
@@ -6028,6 +7695,190 @@ function formatRelative(d) {
   return `${day}d ago`;
 }
 
+// src/commands/origins.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+function loadContext5(opts) {
+  const manifest = readManifestOrThrow(opts.dir);
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    throw new Error(
+      `module.json has no module.slug \u2014 the manifest is malformed.`
+    );
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    throw new Error("Not logged in. Run `dashwise login` first.");
+  }
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    throw new Error(
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+    );
+  }
+  return {
+    installationId: entry.installationId,
+    slug,
+    requestOptions: {
+      baseUrl: resolveApiUrl(),
+      auth: { token: cfg.token }
+    }
+  };
+}
+function normalizeOrigin(raw) {
+  const trimmed = raw.trim();
+  try {
+    return new URL(trimmed).origin;
+  } catch {
+    return trimmed;
+  }
+}
+async function originsListCommand(options) {
+  let ctx;
+  try {
+    ctx = loadContext5(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let origins;
+  try {
+    const resp = await getOrigins(ctx.installationId, ctx.requestOptions);
+    origins = resp.allowed_origins;
+  } catch (err) {
+    return surfaceOriginsError(err);
+  }
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify(origins, null, 2)}
+`);
+    return 0;
+  }
+  info(
+    `SSO callback origins for ${code(ctx.slug)} ${dim(
+      "(localhost is always allowed for local dev installs)"
+    )}:`
+  );
+  if (origins.length === 0) {
+    info(`  ${dim("(none configured \u2014 only implicit localhost applies)")}`);
+    info("");
+    info(
+      `Add a deployed domain with ${code("dashwise origins add https://your-domain")}.`
+    );
+    return 0;
+  }
+  for (const o of origins) {
+    process.stdout.write(`  ${o}
+`);
+  }
+  return 0;
+}
+async function originsAddCommand(urlArg, options) {
+  if (!urlArg) {
+    fail("Usage: `dashwise origins add <url>` (e.g. `dashwise origins add https://app.example.com`)");
+    return 1;
+  }
+  const origin = normalizeOrigin(urlArg);
+  let ctx;
+  try {
+    ctx = loadContext5(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let current;
+  try {
+    current = (await getOrigins(ctx.installationId, ctx.requestOptions)).allowed_origins;
+  } catch (err) {
+    return surfaceOriginsError(err);
+  }
+  if (current.some((o) => normalizeOrigin(o) === origin)) {
+    info(`${code(origin)} is already allowlisted for ${code(ctx.slug)}. Nothing to do.`);
+    return 0;
+  }
+  const next = [...current, origin];
+  try {
+    const resp = await setOrigins(ctx.installationId, next, ctx.requestOptions);
+    success(`Added ${code(origin)} to the SSO callback allowlist for ${code(ctx.slug)}.`);
+    info(`  ${dim(`${resp.allowed_origins.length} origin(s) now configured.`)}`);
+  } catch (err) {
+    return surfaceOriginsError(err);
+  }
+  return 0;
+}
+async function originsRemoveCommand(urlArg, options) {
+  if (!urlArg) {
+    fail("Usage: `dashwise origins remove <url>`");
+    return 1;
+  }
+  const origin = normalizeOrigin(urlArg);
+  let ctx;
+  try {
+    ctx = loadContext5(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let current;
+  try {
+    current = (await getOrigins(ctx.installationId, ctx.requestOptions)).allowed_origins;
+  } catch (err) {
+    return surfaceOriginsError(err);
+  }
+  const next = current.filter((o) => normalizeOrigin(o) !== origin);
+  if (next.length === current.length) {
+    fail(
+      `${code(origin)} is not in the allowlist for ${code(ctx.slug)}. Run ${code("dashwise origins list")} to see current entries.`
+    );
+    return 1;
+  }
+  try {
+    await setOrigins(ctx.installationId, next, ctx.requestOptions);
+    success(`Removed ${code(origin)} from the SSO callback allowlist for ${code(ctx.slug)}.`);
+  } catch (err) {
+    return surfaceOriginsError(err);
+  }
+  return 0;
+}
+function surfaceOriginsError(err) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "UNAUTHENTICATED":
+        fail(
+          `Auth rejected by backend. Your CLI token may be stale \u2014 run ${code("dashwise login")} then retry.`
+        );
+        return 1;
+      case "NOT_WORKSPACE_MEMBER":
+        fail(
+          `You're not a member of this installation's workspace. Origins management requires workspace membership.`
+        );
+        return 1;
+      case "NOT_WORKSPACE_ADMIN":
+      case "FORBIDDEN":
+        fail(
+          `Not authorized. Managing SSO callback origins requires workspace-admin.`
+        );
+        return 1;
+      case "INVALID_ORIGIN":
+        fail(
+          `The backend rejected an origin (${err.message}). Non-localhost origins must be absolute https:// URLs.`
+        );
+        return 1;
+      case "INSTALLATION_NOT_FOUND":
+        fail(
+          `Installation not found. It may have been destroyed; re-provision via ${code("dashwise init <slug>")}.`
+        );
+        return 1;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+        return 1;
+    }
+  }
+  fail(`Origins operation failed: ${err.message}`);
+  return 1;
+}
+
 // src/commands/env-export.ts
 init_api_client();
 init_config();
@@ -6117,16 +7968,6 @@ async function envExportCommand(options) {
       value: apiUrl,
       comment: "# DashWise backend URL \u2014 same value the CLI is logged into."
     },
-    {
-      key: "NEXT_PUBLIC_DASHWISE_API_URL",
-      value: apiUrl,
-      comment: "# Client-side mirror \u2014 Next.js inlines NEXT_PUBLIC_* into the browser bundle so <AuthProvider> hits the right origin."
-    },
-    {
-      key: "DASHWISE_INSTALLATION_ID",
-      value: String(installationId),
-      comment: `# Per-workspace install id for module "${slug}".`
-    },
     {
       key: "DASHWISE_API_KEY",
       value: apiKey,
@@ -6747,6 +8588,12 @@ program.name("dashwise").description("DashWise CLI \u2014 log in, author modules
   "--api-url <url>",
   "Override DashWise backend URL (default: $DASHWISE_API_URL or saved config or http://localhost:3000)"
 );
+program.hook("preAction", () => {
+  const apiUrl = program.opts().apiUrl?.trim();
+  if (apiUrl) {
+    process.env.DASHWISE_API_URL = apiUrl.replace(/\/+$/, "");
+  }
+});
 program.command("login").description("Sign in via the device-code flow.").option("--no-prompt", 'Skip the "open browser" prompt; just print the URL.').option("--name <name>", "Suggested name for the minted token (default: dashwise-cli).").action(async (cmdOpts) => {
   const apiUrl = program.opts().apiUrl;
   const exit = await loginCommand({
@@ -6947,8 +8794,15 @@ moduleCmd.command("clone <slug>").description("Clone a published module locally.
     });
   }
 );
-var depsCmd = program.command("deps").description("Cross-module dependency commands (manipulate module.json#dependencies).");
-depsCmd.command("list").description("List declared cross-module dependencies.").option("--dir <path>", "Project root (default: current directory).").option("--json", "Emit JSON to stdout instead of human-readable columns.").action(async (cmdOpts) => {
+var depsCmd = program.command("deps").description(
+  "Cross-module dependency commands. Bare `dashwise deps` shows the live connect status (resolved / unbound) of each declared dep on your installation; the subcommands manage module.json#dependencies (add / remove / list / check) and the connect lifecycle (bind / unbind)."
+).option("--dir <path>", "Project root (default: current directory).").option("--json", "Emit the connect-status list as JSON instead of the human-readable view.").action(async (cmdOpts) => {
+  process.exitCode = await depsConnectListCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+depsCmd.command("list").description("List declared cross-module dependencies (offline local module.json read).").option("--dir <path>", "Project root (default: current directory).").option("--json", "Emit JSON to stdout instead of human-readable columns.").action(async (cmdOpts) => {
   process.exitCode = await depsListCommand({
     ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
     ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
@@ -6980,6 +8834,93 @@ depsCmd.command("check").description("Verify each declared dep still resolves to
     ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
   });
 });
+depsCmd.command("bind <provider-slug>").description(
+  "(Re-)connect a parked dependency to its provider installation. Re-runs resolution + snapshots the contract; on success runtime reads succeed. Fails (the dep stays unbound) with the park reason if the provider isn't installed / the version doesn't match / a table/action isn't exposed. Workspace-admin."
+).option("--dir <path>", "Project root (default: current directory).").option(
+  "--installation <id>",
+  "Provider installation id to bind to (disambiguates when the workspace has more than one candidate install of the provider).",
+  parseIntOption
+).action(
+  async (providerSlug, cmdOpts) => {
+    process.exitCode = await depsBindCommand(providerSlug, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.installation !== void 0 ? { installation: cmdOpts.installation } : {}
+    });
+  }
+);
+depsCmd.command("unbind <provider-slug>").description(
+  "Disconnect a bound dependency: NULLs the provider ref + contract snapshot and parks the dep (reason MANUALLY_UNBOUND). Runtime reads then return DEP_UNBOUND until you bind it again. Workspace-admin."
+).option("--dir <path>", "Project root (default: current directory).").action(async (providerSlug, cmdOpts) => {
+  process.exitCode = await depsUnbindCommand(providerSlug, {
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {}
+  });
+});
+program.command("bind [uses-slug]").description(
+  "Connect the module's declared workspace-table (`uses`) slots to real tables. Bare `dashwise bind` lists every slot's status (bound / unbound / declined) with reasons + missing fields. `dashwise bind <uses-slug> [--table <name-or-id>]` binds one (interactive pick when the match is ambiguous in a TTY); `--map <usesField>=<physicalFieldName>` overrides field mappings; `--create` materializes a fresh table; `--decline` declines an optional-needs slot. Bind/unbind/decline are workspace-admin."
+).option("--dir <path>", "Project root (default: current directory).").option("--json", "With no slug: emit the binding-status list as JSON.").option(
+  "--table <name-or-id>",
+  "Workspace table (name or numeric id) to bind the slot to. Use for scripts / to skip the interactive pick."
+).option(
+  "--map <usesField=physicalFieldName>",
+  "Override a field mapping (repeatable). The server auto-completes unmapped fields by name match.",
+  collectRepeated,
+  []
+).option("--create", "Materialize a fresh Data Hub table from the declared fields + bind to it.").option("--decline", "Decline this slot (optional-needs only; the module runs without it).").action(
+  async (usesSlug, cmdOpts) => {
+    if (usesSlug === void 0) {
+      process.exitCode = await bindListCommand({
+        ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+        ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+      });
+      return;
+    }
+    process.exitCode = await bindCommand(usesSlug, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.table !== void 0 ? { table: cmdOpts.table } : {},
+      ...cmdOpts.map !== void 0 && cmdOpts.map.length > 0 ? { map: cmdOpts.map } : {},
+      ...cmdOpts.create !== void 0 ? { create: cmdOpts.create } : {},
+      ...cmdOpts.decline !== void 0 ? { decline: cmdOpts.decline } : {}
+    });
+  }
+);
+program.command("unbind <uses-slug>").description(
+  "Disconnect a bound workspace-table (`uses`) slot: NULLs the table ref + field map and parks the slot (reason MANUALLY_UNBOUND). Runtime reads/writes then return USES_UNBOUND until you bind it again. Workspace-admin."
+).option("--dir <path>", "Project root (default: current directory).").action(async (usesSlug, cmdOpts) => {
+  process.exitCode = await unbindCommand(usesSlug, {
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {}
+  });
+});
+var usesCmd = program.command("uses").description("Workspace-table (`uses`) contract commands.");
+usesCmd.command("add").description(
+  'On-ramp an existing workspace table: introspect it, generate the `uses.tables` manifest entry (fields + abstract types, read op by default), write module.json, push (draft-apply reconciles + parks), then bind the new slot to that table. One command from "I have an Employees table" to typed access.'
+).option("--dir <path>", "Project root (default: current directory).").requiredOption(
+  "--from-table <id>",
+  "The existing workspace table to generate a `uses` contract from \u2014 its NUMERIC id (find it in the Dashwise UI URL). Resolving by table name isn't wired yet."
+).option(
+  "--slug <slug>",
+  "Override the generated `uses` slot slug (default: slugified table name)."
+).option(
+  "--ops <list>",
+  "Comma-separated operations to declare (create,read,update,delete). Default: read."
+).option(
+  "--purpose <text>",
+  "Optional author-facing explanation, shown to admins at bind/consent."
+).option(
+  "--no-bind",
+  "Only write + push the manifest entry; don't attempt to bind it to the source table."
+).option("-y, --yes", "Skip the overwrite-existing-slot confirmation prompt.").action(
+  async (cmdOpts) => {
+    process.exitCode = await usesAddCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      fromTable: cmdOpts.fromTable,
+      ...cmdOpts.slug !== void 0 ? { slug: cmdOpts.slug } : {},
+      ...cmdOpts.ops !== void 0 ? { ops: cmdOpts.ops } : {},
+      ...cmdOpts.purpose !== void 0 ? { purpose: cmdOpts.purpose } : {},
+      ...cmdOpts.bind === false ? { noBind: true } : {},
+      ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
+    });
+  }
+);
 program.command("query").description(
   'Run a typed query against the local module installation via @dashai/sdk/query. Pass one of `--inline "<expr>"`, `--file <path>`, or `--repl`. `qb`, `deps`, `db` are pre-bound to the local module\'s generated SDK.'
 ).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option("--inline <expression>", "Evaluate a one-liner. e.g., `qb.tasks.where({done:false}).count()`.").option("--file <path>", "Dynamic-import a .mjs/.js file. Default export = Query | AggQuery | Promise | value.").option("--repl", "Open an interactive Node REPL with the generated SDK pre-bound. Top-level await supported.").option("--json", "Emit compact JSON (default: pretty-printed).").option(
@@ -7024,11 +8965,14 @@ apiKeysCmd.command("list").description(
 apiKeysCmd.command("create [name]").description(
   "Mint a new API key. The plaintext key is displayed ONCE \u2014 save it then."
 ).option("--dir <path>", "Project root (default: current directory).").option("--name <name>", "Override the positional name arg (e.g. for scripted use).").option(
-  "--scopes <csv>",
-  "Comma-separated scope strings (e.g. `runtime:read,runtime:write`). Default: full install access."
+  "--grant <spec>",
+  "Scoped grant (repeatable). `module:<tableSlug>:<ops>`, `datahub:table=<id>:<ops>`, `datahub:app=<id>:<ops>`, or `datahub:workspace:<ops>` where <ops> is a comma list of create,read,update,delete. Any grant mints a scoped (default-deny) key (workspace-admin required). Omit for a full-access key.",
+  collectRepeated,
+  []
 ).option(
-  "--expires-at <iso>",
-  "ISO-8601 expiry timestamp (e.g. 2026-12-31T23:59:59Z). Default: never expires."
+  "--expires <days>",
+  "Days until the key expires (converted to an absolute timestamp). Default: never expires.",
+  parseIntOption
 ).option(
   "--raw-only",
   "Print only the plaintext key on stdout; chatter goes to stderr. Useful for shell capture: `KEY=$(dashwise api-keys create prod --raw-only)`"
@@ -7037,8 +8981,8 @@ apiKeysCmd.command("create [name]").description(
     process.exitCode = await apiKeysCreateCommand(nameArg, {
       ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
       ...cmdOpts.name !== void 0 ? { name: cmdOpts.name } : {},
-      ...cmdOpts.scopes !== void 0 ? { scopes: cmdOpts.scopes } : {},
-      ...cmdOpts.expiresAt !== void 0 ? { expiresAt: cmdOpts.expiresAt } : {},
+      ...cmdOpts.grant !== void 0 && cmdOpts.grant.length > 0 ? { grant: cmdOpts.grant } : {},
+      ...cmdOpts.expires !== void 0 ? { expires: cmdOpts.expires } : {},
       ...cmdOpts.rawOnly !== void 0 ? { rawOnly: cmdOpts.rawOnly } : {}
     });
   }
@@ -7053,6 +8997,27 @@ apiKeysCmd.command("revoke [key-id]").description(
     });
   }
 );
+var originsCmd = program.command("origins").description(
+  "Manage the current module install's SSO callback-origin allowlist. Local dev (localhost) is always allowed; add deployed domains here."
+);
+originsCmd.command("list").description("Show the SSO callback origins configured for the current module install.").option("--dir <path>", "Project root (default: current directory).").option("--json", "Emit a JSON array instead of the human-friendly list.").action(async (cmdOpts) => {
+  process.exitCode = await originsListCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+originsCmd.command("add <url>").description(
+  "Add an SSO callback origin (e.g. https://app.example.com). Idempotent; non-localhost origins must be https://."
+).option("--dir <path>", "Project root (default: current directory).").action(async (url, cmdOpts) => {
+  process.exitCode = await originsAddCommand(url, {
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {}
+  });
+});
+originsCmd.command("remove <url>").description("Remove an SSO callback origin from the allowlist.").option("--dir <path>", "Project root (default: current directory).").action(async (url, cmdOpts) => {
+  process.exitCode = await originsRemoveCommand(url, {
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {}
+  });
+});
 var envCmd = program.command("env").description("Environment-variable helpers for deploying a module.");
 envCmd.command("export").description(
   "Emit the env vars a deployed module needs to authenticate against DashWise. By default emits .env-style KEY=value lines; --format = env | json | railway | vercel | fly to wrap in platform-native syntax. Use --new-key <name> to mint + inline an API key in one step."
@@ -7266,7 +9231,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 })();
 function getVersion() {
-  return "0.8.1";
+  return "0.10.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);