@dashai/cli 0.9.0 → 0.11.0

package/dist/bin.js

@@ -543,8 +543,11 @@ function manifestJson(opts) {
     owns: {
       tables: [
         {
+          // NOTE: no `name` key here — the backend manifest validator
+          // (POST /api/installations/dev) is strict and rejects unrecognized
+          // table keys, and it derives the display name from the slug. A
+          // `name` here would fail provisioning's table materialization (#4).
           slug: "items",
-          name: "Items",
           fields: [
             { slug: "title", type: "text" },
             { slug: "done", type: "boolean" }
@@ -719,10 +722,12 @@ function envLocal(apiUrl = SCAFFOLD_DEFAULT_API_URL) {
     "# There is no DASHWISE_INSTALLATION_ID \u2014 the API key resolves the",
     "# install server-side.",
     `DASHWISE_API_URL=${apiUrl}`,
-    "# Scoped `dwk_` key. Left blank; `dashwise dev` injects the local-dev",
-    "# key. For a standalone `next dev`, paste one from `dashwise api-keys",
-    "# create <name>`.",
-    "DASHWISE_API_KEY=",
+    "# Scoped `dwk_` key. Commented out on purpose: `dashwise dev` injects",
+    "# the local-dev key from ~/.config/dashwise/auth.json, and an empty",
+    "# `DASHWISE_API_KEY=` here would SHADOW that (and make a bare `next dev`",
+    "# fail with a confusing empty-key error). For a standalone `next dev`,",
+    "# uncomment + paste a key from `dashwise api-keys create <name>`.",
+    "# DASHWISE_API_KEY=",
     ""
   ].join("\n");
 }
@@ -924,6 +929,15 @@ export default withAuth({
   // redirect-loop trying to re-authenticate.
   publicPaths: ['/', '/about', '/sign-in-error'],
   loginPath: '/api/auth/sign-in',
+  // Silent sign-in: when a signed-in DashWise user opens the module through
+  // the platform (in-app embed or the module subdomain), the SSO handshake
+  // completes with zero clicks \u2014 they land straight in the app, landing page
+  // included. It never touches:
+  //   - anonymous visitors on public installs (no platform-session hint),
+  //   - local \`dashwise dev\` (no platform proxy \u2192 no hint header) \u2014 the
+  //     landing's "Sign in with DashWise" button stays your dev flow,
+  //   - anything within 60s of a failed silent attempt (no redirect loops).
+  autoSignIn: true,
 });
 
 export const config = {
@@ -965,11 +979,13 @@ export default function RootLayout({ children }: { children: React.ReactNode })
 function appPageCustomTsx(opts) {
   return `// Public landing page \u2014 listed in middleware.ts publicPaths.
 //
-// First-run experience for unauthenticated visitors: hero with the
-// module name + tagline, a "Sign in with DashWise" button that kicks
-// off the SSO flow (via /api/auth/sign-in), and a feature card
-// describing what the module does. After signing in, the user lands
-// on /dashboard (Server Component, session-validated).
+// NOTE: signed-in DashWise users usually never see this page \u2014 the
+// middleware's \`autoSignIn\` signs them in silently and they land on the
+// page they asked for. This landing serves anonymous visitors (public
+// installs), local \`dashwise dev\`, and the rare failed silent attempt \u2014
+// its "Sign in with DashWise" button is the manual fallback that kicks
+// off the same SSO flow (via /api/auth/sign-in). After signing in, the
+// user lands on /dashboard (Server Component, session-validated).
 //
 // Styling: shadcn/ui primitives (\`<Button>\`, \`<Card>\`) on Tailwind 4
 // theme tokens. Add more blocks via \`npx shadcn add @shadcn-studio/...\`
@@ -1185,6 +1201,11 @@ import { getPublicOrigin } from '@/lib/request-origin';
 export async function GET(request: Request) {
   const url = new URL(request.url);
   const returnTo = url.searchParams.get('return_to') ?? '/';
+  // \`auto=1\` marks a SILENT attempt (the middleware's autoSignIn redirect,
+  // no user click). Its failures degrade to the public landing page \u2014 where
+  // the manual "Sign in with DashWise" button lives \u2014 instead of the error
+  // page: the user never asked for anything, so don't show them an error.
+  const isAuto = url.searchParams.get('auto') === '1';
   const apiBaseUrl = process.env.DASHWISE_API_URL;
   const apiKey = process.env.DASHWISE_API_KEY;
 
@@ -1211,6 +1232,16 @@ export async function GET(request: Request) {
   const callback = new URL('/api/auth/callback', moduleOrigin);
   callback.searchParams.set('return_to', returnTo);
 
+  // Where a failed start lands: the error page for user-initiated sign-ins,
+  // the landing page for silent (auto) attempts.
+  const failTarget = (code: string, description?: string): URL => {
+    if (isAuto) return new URL('/', moduleOrigin);
+    const target = new URL('/sign-in-error', moduleOrigin);
+    target.searchParams.set('code', code);
+    if (description) target.searchParams.set('description', description);
+    return target;
+  };
+
   let res: Response;
   try {
     res = await fetch(\`\${apiBaseUrl}/api/module-api/sso/start-url\`, {
@@ -1223,10 +1254,9 @@ export async function GET(request: Request) {
       body: JSON.stringify({ callback_url: callback.toString() }),
     });
   } catch (err) {
-    const target = new URL('/sign-in-error', moduleOrigin);
-    target.searchParams.set('code', 'server_error');
-    target.searchParams.set('description', (err as Error).message);
-    return NextResponse.redirect(target);
+    return NextResponse.redirect(
+      failTarget('server_error', (err as Error).message),
+    );
   }
 
   if (!res.ok) {
@@ -1236,23 +1266,18 @@ export async function GET(request: Request) {
     const body = (await res.json().catch(() => null)) as
       | { code?: string; message?: string }
       | null;
-    const target = new URL('/sign-in-error', moduleOrigin);
-    target.searchParams.set('code', body?.code ?? 'invalid_request');
-    if (body?.message) target.searchParams.set('description', body.message);
-    return NextResponse.redirect(target);
+    return NextResponse.redirect(
+      failTarget(body?.code ?? 'invalid_request', body?.message),
+    );
   }
 
   const body = (await res.json().catch(() => null)) as
     | { redirect_url?: string }
     | null;
   if (!body?.redirect_url) {
-    const target = new URL('/sign-in-error', moduleOrigin);
-    target.searchParams.set('code', 'server_error');
-    target.searchParams.set(
-      'description',
-      'start-url response missing redirect_url',
+    return NextResponse.redirect(
+      failTarget('server_error', 'start-url response missing redirect_url'),
     );
-    return NextResponse.redirect(target);
   }
   return NextResponse.redirect(body.redirect_url);
 }
@@ -1288,7 +1313,13 @@ export async function GET(request: Request) {
     return NextResponse.redirect(target);
   }
   const code = url.searchParams.get('code');
-  const returnTo = url.searchParams.get('return_to') ?? '/';
+  // Only ever redirect to a ROOT-RELATIVE, same-module path. \`return_to\`
+  // rides through the SSO round-trip unvalidated (the backend checks only the
+  // callback ORIGIN, not this sub-param), so an absolute (\`https://evil\`),
+  // protocol-relative (\`//evil\`), or control-char-smuggled value would be a
+  // post-auth open redirect off the module host. Reject anything that isn't a
+  // clean root-relative path.
+  const returnTo = safeReturnTo(url.searchParams.get('return_to'));
   if (!code) {
     const target = new URL('/sign-in-error', publicOrigin);
     target.searchParams.set('code', 'missing_code');
@@ -1304,6 +1335,20 @@ export async function GET(request: Request) {
   }
   return NextResponse.redirect(new URL(returnTo, publicOrigin));
 }
+
+/** Root-relative in-module paths only \u2014 defends against open-redirect via
+ *  a crafted \`return_to\`. Rejects absolute/protocol-relative/backslash and
+ *  any ASCII control char (which WHATWG URL parsing strips, defeating a naive
+ *  prefix check). Falls back to '/'. */
+function safeReturnTo(raw: string | null): string {
+  if (!raw || raw[0] !== '/') return '/';
+  if (raw.startsWith('//') || raw.startsWith('/\\\\')) return '/';
+  for (let i = 0; i < raw.length; i++) {
+    const c = raw.charCodeAt(i);
+    if (c < 0x20 || c === 0x7f) return '/';
+  }
+  return raw;
+}
 `;
 }
 function appApiAuthSignOutTs() {
@@ -1919,6 +1964,29 @@ cached in \`~/.config/dashwise/auth.json#modules[${opts.slug}]\` after
 as \`DASHWISE_API_KEY\` into the Next.js child env automatically. The
 key binds the install server-side \u2014 there is no \`DASHWISE_INSTALLATION_ID\`.
 
+### Own tables vs. the shared Data Hub
+
+The dev key \`dashwise init\` mints gives you **full access to your
+module's OWN tables** (\`owns.tables\` in \`module.json\`) through \`db\` /
+\`qb\` \u2014 no grant setup needed. That covers the common case.
+
+The **shared workspace Data Hub** (other tables in the workspace, reached
+via \`datahub.table(<id>)\`) is separate: it is default-deny and returns
+**403** with the dev key until you mint a key that carries an explicit
+Data Hub grant. Do that with:
+
+\`\`\`
+# read a specific Data Hub table:
+dashwise api-keys create datahub-read --grant datahub:table=<tableId>:read
+# or a whole database (application):
+dashwise api-keys create datahub-rw --grant datahub:app=<appId>:read,create,update
+\`\`\`
+
+Paste the printed key as \`DASHWISE_API_KEY\` (or, for local dev, set it
+before \`dashwise dev\` so it wins over the auto-injected own-tables key).
+So: \`db\`/\`qb\` on your own tables works out of the box; \`datahub\` needs a
+granted key.
+
 ## Auth in dev mode
 
 \`dashwise dev\` registers a dev-mode SSO session with the backend so
@@ -2303,18 +2371,40 @@ async function moduleInitCommand(slugArg, options) {
   let devInstall = null;
   const wantsProvision = options.provision !== false;
   if (wantsProvision) {
+    const manifest = (() => {
+      try {
+        return readManifest(dir) ?? void 0;
+      } catch {
+        return void 0;
+      }
+    })();
     devInstall = await tryProvisionDevInstall({
       slug,
       name,
       description: options.description,
       workspaceFlag: options.workspace,
-      moduleKind: kind
+      moduleKind: kind,
+      ...manifest !== void 0 ? { manifest } : {}
     });
   } else {
     info(
       `Skipping provisioning (${code("--no-provision")}). ${dim("Run with provisioning later to enable `dashwise dev` data-plane.")}`
     );
   }
+  const keyCached = !wantsProvision || readModuleEntry(slug)?.apiKey ? true : false;
+  if (wantsProvision && !keyCached) {
+    fail(
+      `NO API KEY WAS CACHED for ${code(slug)} \u2014 the scaffold is written, but ${code("dashwise dev")} will run with NO token (data-plane + sign-in will fail).`
+    );
+    info(
+      `Fix it by re-running provisioning once the cause above is resolved:
+    ${code(`dashwise init ${slug} --force --workspace <your-workspace-slug>`)}
+  Confirm success: the line ${code("\u2713 Provisioned dev install id=\u2026 API key cached")} must appear,
+  and ${code("cat ~/.config/dashwise/auth.json")} must show a non-empty ${code(`modules.${slug}.apiKey`)} starting with ${code("dwk_")}.`
+    );
+    outro("Scaffold written, but provisioning failed \u2014 see above.");
+    return 2;
+  }
   info(`Next steps:`);
   process.stdout.write(`
   ${dim("1.")} ${code(`cd ${dir}`)}
@@ -2343,6 +2433,20 @@ async function tryProvisionDevInstall(args) {
     warn("CLI config disappeared mid-init. Skipping provisioning.");
     return null;
   }
+  const targetApiUrl = resolveApiUrl();
+  info(`Backend: ${code(targetApiUrl)}`);
+  const hostOf = (u) => {
+    try {
+      return new URL(u).host;
+    } catch {
+      return u;
+    }
+  };
+  if (hostOf(targetApiUrl) !== hostOf(cfg.apiUrl)) {
+    warn(
+      `Your saved login is for ${code(cfg.apiUrl)} but this run targets ${code(targetApiUrl)}. Provisioning uses the saved token, which the target backend will reject (401). Log in against the target first: ${code(`dashwise login --api-url ${targetApiUrl}`)}.`
+    );
+  }
   let workspace2;
   try {
     workspace2 = await selectWorkspace({
@@ -2358,25 +2462,42 @@ async function tryProvisionDevInstall(args) {
   info(
     `Provisioning dev install in workspace ${code(workspace2.slug)} (id=${workspace2.id})\u2026`
   );
+  const baseBody = {
+    slug: args.slug,
+    name: args.name,
+    ...args.description !== void 0 ? { description: args.description } : {},
+    workspaceId: workspace2.id,
+    ...args.moduleKind !== void 0 ? { moduleKind: args.moduleKind } : {}
+  };
+  const reqOpts = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
   let response;
   try {
     response = await createDevInstallation(
-      {
-        slug: args.slug,
-        name: args.name,
-        ...args.description !== void 0 ? { description: args.description } : {},
-        workspaceId: workspace2.id,
-        ...args.moduleKind !== void 0 ? { moduleKind: args.moduleKind } : {}
-      },
-      { baseUrl: resolveApiUrl(), auth: { token: cfg.token } }
+      { ...baseBody, ...args.manifest !== void 0 ? { manifest: args.manifest } : {} },
+      reqOpts
     );
   } catch (err) {
-    if (err instanceof ApiError) {
+    if (err instanceof ApiError && err.code === "MANIFEST_INVALID" && args.manifest !== void 0) {
+      warn(
+        `Couldn't pre-materialize the seeded table(s) (${err.message}). Provisioning without them; add tables later with ${code("dashwise table create")}.`
+      );
+      try {
+        response = await createDevInstallation(baseBody, reqOpts);
+      } catch (err2) {
+        if (err2 instanceof ApiError) {
+          surfaceProvisionApiError(err2, args.slug);
+          return null;
+        }
+        warn(`Provisioning failed: ${err2.message}`);
+        return null;
+      }
+    } else if (err instanceof ApiError) {
       surfaceProvisionApiError(err, args.slug);
       return null;
+    } else {
+      warn(`Provisioning failed: ${err.message}`);
+      return null;
     }
-    warn(`Provisioning failed: ${err.message}`);
-    return null;
   }
   try {
     upsertModuleEntry(args.slug, {
@@ -2394,7 +2515,7 @@ async function tryProvisionDevInstall(args) {
     return response;
   }
   success(
-    `Provisioned dev install id=${response.installation.id}. API key cached in your CLI config.`
+    `Provisioned dev install id=${response.installation.id}. API key cached in your CLI config.` + (response.tables_applied > 0 ? ` ${response.tables_applied} seeded table(s) materialized.` : "")
   );
   return response;
 }
@@ -2439,6 +2560,7 @@ var init_init = __esm({
     init_output();
     init_api_client();
     init_config();
+    init_manifest_io();
     init_workspaces();
   }
 });
@@ -3353,8 +3475,13 @@ async function devCommand(options) {
       `  ${dim("api key")}     ${maskedToken(apiKeyEnv)} ${dim(`(from ${source}${installId ? `, install id=${installId}` : ""})`)}`
     );
   } else if (manifestSlug !== void 0 && installationIdEnv === void 0) {
-    warn(
-      `No API key cached for module ${code(manifestSlug)}. Data-plane calls (db, qb) will fail with UnauthenticatedError. Run ${code(`dashwise init ${manifestSlug} --force`)} to provision a dev install + cache a key.`
+    fail(
+      `No ${code("dwk_")} API key for module ${code(manifestSlug)} \u2014 the module will run with NO token.`
+    );
+    info(
+      `  Data-plane calls (db, qb) AND sign-in will fail until you provision a dev install:
+    ${code(`dashwise init ${manifestSlug} --force --workspace <your-workspace-slug>`)}
+  (Ensure you're logged into the right backend: ${code(`dashwise login --api-url ${apiUrl}`)}.)`
     );
   }
   info("");
@@ -3528,9 +3655,9 @@ async function resolveModuleApiKey(slug, entry, apiUrl, cliBearer) {
   if (process.env.DASHWISE_API_KEY) return null;
   if (!entry) return null;
   if (entry.apiKey) return null;
-  if (!entry.runtimeToken) return null;
+  if (!entry.installationId) return null;
   info(
-    `Upgrading cached credentials for ${code(slug)} to a ${code("dwk_")} API key (the local runtime token format was retired)\u2026`
+    `No usable ${code("dwk_")} API key cached for ${code(slug)} \u2014 minting a fresh one against dev install ${entry.installationId} (a stale CLI can cache an empty key)\u2026`
   );
   let minted;
   try {
@@ -8501,6 +8628,12 @@ program.name("dashwise").description("DashWise CLI \u2014 log in, author modules
   "--api-url <url>",
   "Override DashWise backend URL (default: $DASHWISE_API_URL or saved config or http://localhost:3000)"
 );
+program.hook("preAction", () => {
+  const apiUrl = program.opts().apiUrl?.trim();
+  if (apiUrl) {
+    process.env.DASHWISE_API_URL = apiUrl.replace(/\/+$/, "");
+  }
+});
 program.command("login").description("Sign in via the device-code flow.").option("--no-prompt", 'Skip the "open browser" prompt; just print the URL.').option("--name <name>", "Suggested name for the minted token (default: dashwise-cli).").action(async (cmdOpts) => {
   const apiUrl = program.opts().apiUrl;
   const exit = await loginCommand({
@@ -9138,7 +9271,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 })();
 function getVersion() {
-  return "0.9.0";
+  return "0.11.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);