@relyio/cli 0.2.2 → 0.3.0

package/dist/index.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
+import http from 'http';
 import * as fs2 from 'fs';
-import { existsSync, readdirSync, statSync, mkdirSync, cpSync } from 'fs';
-import path3 from 'path';
+import fs2__default, { existsSync, readFileSync, mkdirSync, readdirSync, writeFileSync, statSync, cpSync } from 'fs';
+import path5 from 'path';
 import * as os from 'os';
 import os__default from 'os';
 import * as yaml from 'yaml';
@@ -9,17 +10,18 @@ import axios, { AxiosError } from 'axios';
 import axiosRetry from 'axios-retry';
 import { z } from 'zod';
 import * as fs4 from 'fs/promises';
-import { mkdir, writeFile, rm, readFile, stat } from 'fs/promises';
+import { rm, writeFile, readFile, stat, mkdir } from 'fs/promises';
 import * as yaml2 from 'js-yaml';
 import { glob } from 'glob';
 import { createJiti } from 'jiti';
 import { fileURLToPath } from 'url';
 import { execFileSync, execSync, spawn } from 'child_process';
+import Handlebars from 'handlebars';
 import 'object-hash';
 import 'semver';
 import { format } from 'prettier';
 import { structuredPatch, diffWordsWithSpace } from 'diff';
-import { randomUUID, createHash } from 'crypto';
+import { randomBytes, randomUUID, createHash } from 'crypto';
 import React3, { createContext, memo, useState, useEffect, useReducer, useMemo, useCallback, useContext, useRef, useSyncExternalStore } from 'react';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 import { Box, Text, useApp, Static, useInput, usePaste, useWindowSize } from 'ink';
@@ -35,13 +37,11 @@ import figures from 'figures';
 import { table as table$1 } from 'table';
 import readline from 'readline';
 import open from 'open';
-import http from 'http';
-import inquirer from 'inquirer';
+import inquirer2 from 'inquirer';
 import { Listr } from 'listr2';
 import 'strip-ansi';
 import { watch } from 'chokidar';
 import { EventEmitter } from 'events';
-import Handlebars from 'handlebars';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -52,6 +52,143 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
+async function startCallbackServer(options = {}) {
+  const host = options.host ?? "127.0.0.1";
+  const callbackPath = options.callbackPath ?? "/callback";
+  const server = http.createServer();
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, host, resolve);
+  });
+  const { port } = server.address();
+  const origin = `http://${host}:${port}`;
+  const redirectUri = `${origin}${callbackPath === "/" ? "" : callbackPath}`;
+  let settled = false;
+  let waiter;
+  const held = [];
+  const close = () => {
+    try {
+      server.close();
+      server.closeAllConnections?.();
+    } catch {
+    }
+  };
+  const decide = (query, res, active) => {
+    if (query.get("state") !== active.expectedState) {
+      settled = true;
+      html(res, 400, errorHtml("State mismatch"));
+      close();
+      active.settle({
+        ok: false,
+        error: new Error("Sign-in state mismatch \u2014 aborting for safety.")
+      });
+      return;
+    }
+    const error2 = query.get("error");
+    if (error2 !== null) {
+      settled = true;
+      html(res, 400, errorHtml(error2));
+      close();
+      active.settle({ ok: false, error: new Error(`Authorization failed: ${error2}`) });
+      return;
+    }
+    settled = true;
+    html(res, 200, SUCCESS_HTML);
+    close();
+    active.settle({ ok: true, query });
+  };
+  server.on("request", (req, res) => {
+    const url = new URL(req.url ?? "/", origin);
+    if (url.pathname !== callbackPath) {
+      res.writeHead(404).end();
+      return;
+    }
+    if (settled) {
+      html(res, 200, SUCCESS_HTML);
+      return;
+    }
+    if (url.search === "") {
+      html(res, 200, WAITING_HTML);
+      return;
+    }
+    if (waiter === void 0) {
+      held.push({ query: url.searchParams, res });
+      return;
+    }
+    decide(url.searchParams, res, waiter);
+  });
+  const waitForCallback = (expectedState, timeoutMs = DEFAULT_CALLBACK_TIMEOUT_MS) => new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      close();
+      reject(new Error("Timed out waiting for the browser sign-in to complete."));
+    }, timeoutMs);
+    timer.unref?.();
+    const active = {
+      expectedState,
+      settle: (outcome) => {
+        clearTimeout(timer);
+        if (outcome.ok) resolve(outcome.query);
+        else reject(outcome.error);
+      }
+    };
+    waiter = active;
+    const [first, ...rest] = held.splice(0);
+    for (const extra of rest) html(extra.res, 200, SUCCESS_HTML);
+    if (first) decide(first.query, first.res, active);
+  });
+  const waitForCode = async (expectedState, timeoutMs) => {
+    const query = await waitForCallback(expectedState, timeoutMs);
+    const code = query.get("code");
+    if (code === null || code === "") {
+      throw new Error("The sign-in callback carried no authorization code.");
+    }
+    return code;
+  };
+  return { redirectUri, waitForCallback, waitForCode, close };
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function writeSecretFile(filePath, data) {
+  fs2__default.mkdirSync(path5.dirname(filePath), { recursive: true });
+  fs2__default.writeFileSync(filePath, JSON.stringify(data, null, 2), {
+    encoding: "utf8",
+    mode: SECRET_FILE_MODE
+  });
+  fs2__default.chmodSync(filePath, SECRET_FILE_MODE);
+}
+function readSecretFile(filePath) {
+  try {
+    if (!fs2__default.existsSync(filePath)) return null;
+    return JSON.parse(fs2__default.readFileSync(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+var DEFAULT_CALLBACK_TIMEOUT_MS, SUCCESS_HTML, WAITING_HTML, errorHtml, html, SECRET_FILE_MODE;
+var init_dist = __esm({
+  "../device-auth/dist/index.js"() {
+    DEFAULT_CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+    SUCCESS_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>RelyIO</title>
+<style>body{font-family:system-ui,-apple-system,Segoe UI,Roboto,sans-serif;text-align:center;padding:3rem;color:#111}h1{color:#16a34a}</style>
+</head><body><h1>Connected to RelyIO</h1><p>Authentication succeeded. You can close this tab and return to your terminal.</p></body></html>`;
+    WAITING_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>RelyIO</title>
+<style>body{font-family:system-ui,-apple-system,Segoe UI,Roboto,sans-serif;text-align:center;padding:3rem;color:#111}</style>
+</head><body><h1>Waiting for RelyIO</h1><p>Finish signing in in the tab that opened, then come back here.</p></body></html>`;
+    errorHtml = (message) => `<!doctype html><html><head><meta charset="utf-8"><title>RelyIO</title>
+<style>body{font-family:system-ui,-apple-system,Segoe UI,Roboto,sans-serif;text-align:center;padding:3rem;color:#111}h1{color:#dc2626}</style>
+</head><body><h1>Authentication failed</h1><p>${escapeHtml(message)}</p></body></html>`;
+    html = (res, status, body) => {
+      res.writeHead(status, {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store"
+      }).end(body);
+    };
+    SECRET_FILE_MODE = 384;
+  }
+});
 
 // src/config/secret-store.ts
 var secret_store_exports = {};
@@ -91,19 +228,10 @@ function emitPlaintextWarning() {
   );
 }
 function readLegacyFile() {
-  try {
-    if (!fs2.existsSync(LEGACY_CONFIG_FILE)) return {};
-    const raw = fs2.readFileSync(LEGACY_CONFIG_FILE, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return {};
-  }
+  return readSecretFile(LEGACY_CONFIG_FILE) ?? {};
 }
 function writeLegacyFile(data) {
-  if (!fs2.existsSync(LEGACY_CONFIG_DIR)) {
-    fs2.mkdirSync(LEGACY_CONFIG_DIR, { recursive: true });
-  }
-  fs2.writeFileSync(LEGACY_CONFIG_FILE, JSON.stringify(data, null, 2), "utf8");
+  writeSecretFile(LEGACY_CONFIG_FILE, data);
 }
 async function setSecret(key, value) {
   cache.set(key, value);
@@ -183,9 +311,10 @@ function __resetForTests() {
 var SERVICE_NAME, LEGACY_CONFIG_DIR, LEGACY_CONFIG_FILE, keytarPromise, keychainAvailable, plaintextWarningShown, cache;
 var init_secret_store = __esm({
   "src/config/secret-store.ts"() {
+    init_dist();
     SERVICE_NAME = "relyio-cli";
-    LEGACY_CONFIG_DIR = path3.join(os.homedir(), ".relyio");
-    LEGACY_CONFIG_FILE = path3.join(LEGACY_CONFIG_DIR, "config.json");
+    LEGACY_CONFIG_DIR = path5.join(os.homedir(), ".relyio");
+    LEGACY_CONFIG_FILE = path5.join(LEGACY_CONFIG_DIR, "config.json");
     plaintextWarningShown = false;
     cache = /* @__PURE__ */ new Map();
   }
@@ -233,28 +362,19 @@ function ensureDirectory(dir) {
   }
 }
 function readGlobalConfig() {
-  try {
-    ensureDirectory(GLOBAL_CONFIG_DIR);
-    if (fs2.existsSync(GLOBAL_CONFIG_FILE)) {
-      const configData = fs2.readFileSync(GLOBAL_CONFIG_FILE, "utf8");
-      return JSON.parse(configData);
-    }
-  } catch (error2) {
-    debugError("Error reading global config", error2);
-  }
-  return { ...defaultGlobalConfig };
+  const stored = readSecretFile(GLOBAL_CONFIG_FILE);
+  return stored ?? { ...defaultGlobalConfig };
 }
 function writeGlobalConfig(config) {
   try {
-    ensureDirectory(GLOBAL_CONFIG_DIR);
-    fs2.writeFileSync(GLOBAL_CONFIG_FILE, JSON.stringify(config, null, 2), "utf8");
+    writeSecretFile(GLOBAL_CONFIG_FILE, config);
   } catch (error2) {
     debugError("Error writing global config", error2);
     throw new Error("Failed to write global configuration");
   }
 }
 function getProjectConfigPath() {
-  return path3.join(process.cwd(), PROJECT_CONFIG_FILE);
+  return path5.join(process.cwd(), PROJECT_CONFIG_FILE);
 }
 function readProjectConfig() {
   try {
@@ -278,7 +398,7 @@ function writeProjectConfig(config) {
   }
 }
 function getLocalConfigPath() {
-  return path3.join(process.cwd(), LOCAL_CONFIG_FILE);
+  return path5.join(process.cwd(), LOCAL_CONFIG_FILE);
 }
 function readLocalConfig() {
   try {
@@ -294,7 +414,7 @@ function readLocalConfig() {
 }
 function writeLocalConfig(config) {
   try {
-    const configDir = path3.join(process.cwd(), LOCAL_CONFIG_DIR);
+    const configDir = path5.join(process.cwd(), LOCAL_CONFIG_DIR);
     ensureDirectory(configDir);
     const configPath = getLocalConfigPath();
     fs2.writeFileSync(configPath, yaml.stringify(config), "utf8");
@@ -428,13 +548,14 @@ async function isAuthenticated() {
 var isDebug, GLOBAL_CONFIG_DIR, GLOBAL_CONFIG_FILE, PROJECT_CONFIG_FILE, LOCAL_CONFIG_DIR, LOCAL_CONFIG_FILE, PROD_API_URL, PROD_DASHBOARD_URL, defaultGlobalConfig, defaultProjectConfig, defaultLocalConfig, getAuthTokenAsync, getApiKeyAsync, config_manager_default;
 var init_config_manager = __esm({
   "src/config/config-manager.ts"() {
+    init_dist();
     init_secret_store();
     isDebug = () => process.env.DEBUG === "true" || process.env.DEBUG === "1";
-    GLOBAL_CONFIG_DIR = path3.join(os.homedir(), ".relyio");
-    GLOBAL_CONFIG_FILE = path3.join(GLOBAL_CONFIG_DIR, "config.json");
+    GLOBAL_CONFIG_DIR = path5.join(os.homedir(), ".relyio");
+    GLOBAL_CONFIG_FILE = path5.join(GLOBAL_CONFIG_DIR, "config.json");
     PROJECT_CONFIG_FILE = ".relyio-context.json";
     LOCAL_CONFIG_DIR = "relyio";
-    LOCAL_CONFIG_FILE = path3.join(LOCAL_CONFIG_DIR, "config.yaml");
+    LOCAL_CONFIG_FILE = path5.join(LOCAL_CONFIG_DIR, "config.yaml");
     PROD_API_URL = "https://api.relyio.com";
     PROD_DASHBOARD_URL = "https://dashboard.relyio.com";
     defaultGlobalConfig = {};
@@ -542,12 +663,32 @@ var init_config = __esm({
     config_default = config_manager_default;
   }
 });
-var DEFAULT_TIMEOUT_MS, isDebug2, ApiClient, apiClient, client_default;
+function redactForLog(data) {
+  if (typeof data === "string") {
+    try {
+      return redactForLog(JSON.parse(data));
+    } catch {
+      return data;
+    }
+  }
+  if (Array.isArray(data)) return data.map((item) => redactForLog(item));
+  if (typeof data === "object" && data !== null) {
+    return Object.fromEntries(
+      Object.entries(data).map(([key, value]) => [
+        key,
+        SECRET_FIELD.test(key) ? "***" : redactForLog(value)
+      ])
+    );
+  }
+  return data;
+}
+var DEFAULT_TIMEOUT_MS, isDebug2, SECRET_FIELD, ApiClient, apiClient, client_default;
 var init_client = __esm({
   "src/api/client.ts"() {
     init_config();
     DEFAULT_TIMEOUT_MS = 3e4;
     isDebug2 = () => process.env.DEBUG === "true" || process.env.DEBUG === "1";
+    SECRET_FIELD = /secret|token|password/i;
     ApiClient = class {
       client;
       constructor() {
@@ -635,9 +776,8 @@ var init_client = __esm({
           }
         }
         if (reqConfig.data) {
-          const data = typeof reqConfig.data === "string" ? reqConfig.data : JSON.stringify(reqConfig.data);
           curlCommand += ` \\
-  -d '${data}'`;
+  -d '${JSON.stringify(redactForLog(reqConfig.data))}'`;
         }
         console.error(`[relyio-cli][debug] ${curlCommand}`);
       }
@@ -682,21 +822,21 @@ var init_client = __esm({
         }
       }
       // Helper methods for common HTTP methods
-      async get(path23, options) {
+      async get(path25, options) {
         return this.request({
           method: "GET",
-          url: path23,
+          url: path25,
           params: options?.params,
           headers: options?.headers
         });
       }
-      async post(path23, data, headers) {
-        return this.request({ method: "POST", url: path23, data, headers });
+      async post(path25, data, headers) {
+        return this.request({ method: "POST", url: path25, data, headers });
       }
-      async put(path23, data, headers) {
-        return this.request({ method: "PUT", url: path23, data, headers });
+      async put(path25, data, headers) {
+        return this.request({ method: "PUT", url: path25, data, headers });
       }
-      async delete(path23, headers) {
+      async delete(path25, headers) {
         const customHeaders = {
           ...headers,
           // Remove Content-Type for DELETE requests as they typically don't have a body
@@ -704,7 +844,7 @@ var init_client = __esm({
         };
         return this.request({
           method: "DELETE",
-          url: path23,
+          url: path25,
           headers: customHeaders
         });
       }
@@ -714,38 +854,10 @@ var init_client = __esm({
   }
 });
 
-// src/api/schema.ts
-async function getSchemaStatus(projectId, branchId, localSchema) {
-  const response = await client_default.post(
-    `/projects/${projectId}/branches/${branchId}/schema/status`,
-    localSchema || {}
-  );
-  return response.data;
-}
-async function deploySchema(projectId, branchId, localSchema, options) {
-  const response = await client_default.post(
-    `/projects/${projectId}/branches/${branchId}/schema/deploy`,
-    {
-      localSchema,
-      ...options
-    }
-  );
-  const data = response.data;
-  if ("data" in data && typeof data.data === "object") {
-    return data.data;
-  }
-  return data;
-}
-var init_schema = __esm({
-  "src/api/schema.ts"() {
-    init_client();
-  }
-});
-
-// ../../platform/api-contract/dist/chunk-QKXHDVSP.js
+// ../../platform/api-contract/dist/chunk-MFO7NR2F.js
 var ERROR_CODES;
-var init_chunk_QKXHDVSP = __esm({
-  "../../platform/api-contract/dist/chunk-QKXHDVSP.js"() {
+var init_chunk_MFO7NR2F = __esm({
+  "../../platform/api-contract/dist/chunk-MFO7NR2F.js"() {
     ERROR_CODES = {
       MISSING_API_KEY: { status: 401 },
       INVALID_API_KEY: { status: 401 },
@@ -757,7 +869,7 @@ var init_chunk_QKXHDVSP = __esm({
       REQUEST_INVALID: { status: 400 },
       CONTENT_INVALID: { status: 400 },
       /**
-       * Added in API3a, and the only name added to §4's approved seventeen.
+       * Added in API3a, the first name added to §4's approved seventeen.
        *
        * `apps/edge/cdn` answers any method other than `GET`, `HEAD` or `OPTIONS`
        * with `405`, and no code in §4 carries that status. The two alternatives
@@ -775,6 +887,37 @@ var init_chunk_QKXHDVSP = __esm({
        * approves those. Approved 2026-09-06 (plan §4, decision record in §16 API3a).
        */
       METHOD_NOT_ALLOWED: { status: 405 },
+      /**
+       * Added by REL-657, the second name added to §4's approved seventeen.
+       *
+       * A session that verified a factor too long ago may not hand authority out:
+       * mint an Access Token, approve an app, delete the account. `ACCESS_DENIED`
+       * is what a subject may never do; this is what a subject may do once they
+       * have proved the session is still theirs, and a client does something
+       * different on reading it — it raises a Reverification and retries — which
+       * is Decision 3's test. `details.level` names the proof the client asks for.
+       *
+       * A **customer-facing naming decision**, approved by the product owner on
+       * 2026-09-20 (REL-657, spec 016).
+       */
+      REVERIFICATION_REQUIRED: { status: 403 },
+      /**
+       * Added by REL-1080, the third name added to §4's approved seventeen.
+       *
+       * A downgrade (or cancel) that would leave the Organization keeping more than
+       * the target Plan allows — more Projects, Members or stored bytes than its
+       * Stock Limits — is refused, because the lower Plan would otherwise keep
+       * serving what it refuses to admit. It is not `ACCESS_DENIED` (the subject may
+       * downgrade) and not `RESOURCE_CONFLICT` (no version raced): a client reading
+       * it does something no other code tells it — shows `details.stockLimits`, the
+       * same list the downgrade preview reads, and asks the customer to reduce what
+       * they keep before retrying. 409 because the request conflicts with the
+       * Organization's current state and succeeds unchanged once that state does.
+       *
+       * A **customer-facing naming decision**, approved by the product owner on
+       * 2026-09-24 (REL-1080).
+       */
+      PLAN_DOWNGRADE_BLOCKED: { status: 409 },
       RESOURCE_NOT_FOUND: { status: 404 },
       RESOURCE_CONFLICT: { status: 409 },
       RESOURCE_EXPIRED: { status: 410 },
@@ -821,7 +964,7 @@ function readError(body) {
 var ContractBodyError;
 var init_client2 = __esm({
   "../../platform/api-contract/dist/client/index.js"() {
-    init_chunk_QKXHDVSP();
+    init_chunk_MFO7NR2F();
     ContractBodyError = class extends Error {
       body;
       constructor(message, body) {
@@ -868,9 +1011,11 @@ async function getProject(projectId) {
 }
 async function getProjectBranches(projectId, filter) {
   const params = new URLSearchParams();
-  if (filter?.name) params.append("name", filter.name);
-  if (filter?.sortField) params.append("sortField", filter.sortField);
-  if (filter?.sortDirection) params.append("sortDirection", filter.sortDirection);
+  if (filter?.name) params.append("name", `eq:${filter.name}`);
+  if (filter?.sortField) {
+    params.append("sort", filter.sortField);
+    if (filter.sortDirection) params.append("order", filter.sortDirection);
+  }
   params.append("limit", "100");
   const queryString = params.toString();
   const url = `/projects/${projectId}/branches${queryString ? `?${queryString}` : ""}`;
@@ -916,6 +1061,26 @@ async function compareBranchSchemas(projectId, sourceBranchId, targetBranchId) {
     )
   );
 }
+async function createProjectApiKey(projectId, body) {
+  return readPayload(
+    await client_default.post(`/projects/${projectId}/api-keys`, body)
+  );
+}
+async function getProjectConnections(projectId) {
+  return readPayload(
+    await client_default.get(`/projects/${projectId}/connections`)
+  );
+}
+async function createConnection(projectId, body) {
+  return readPayload(
+    await client_default.post(`/projects/${projectId}/connections`, body)
+  );
+}
+async function createAutomation(projectId, body) {
+  return readPayload(
+    await client_default.post(`/projects/${projectId}/automations`, body)
+  );
+}
 var manage_default;
 var init_manage = __esm({
   "src/api/manage.ts"() {
@@ -932,11 +1097,43 @@ var init_manage = __esm({
       createBranchWithParentDetection,
       deleteBranch,
       getBranchDivergence,
-      compareBranchSchemas
+      compareBranchSchemas,
+      createProjectApiKey,
+      getProjectConnections,
+      createConnection,
+      createAutomation
     };
   }
 });
 
+// src/api/schema.ts
+async function getSchemaStatus(projectId, branchId, localSchema) {
+  const response = await client_default.post(
+    `/projects/${projectId}/branches/${branchId}/schema/status`,
+    localSchema || {}
+  );
+  return response.data;
+}
+async function deploySchema(projectId, branchId, localSchema, options) {
+  const response = await client_default.post(
+    `/projects/${projectId}/branches/${branchId}/schema/deploy`,
+    {
+      localSchema,
+      ...options
+    }
+  );
+  const data = response.data;
+  if ("data" in data && typeof data.data === "object") {
+    return data.data;
+  }
+  return data;
+}
+var init_schema = __esm({
+  "src/api/schema.ts"() {
+    init_client();
+  }
+});
+
 // src/api/manage-error.ts
 function manageErrorBody(error2) {
   const candidate = error2;
@@ -977,24 +1174,24 @@ var init_manage_error = __esm({
 });
 function detectCircularFallback(startCode, locales) {
   const visited = /* @__PURE__ */ new Set();
-  const path23 = [];
+  const path25 = [];
   const localeMap = new Map(locales.map((l) => [l.code, l]));
   function visit(code) {
     if (visited.has(code)) {
-      const cycleStart = path23.indexOf(code);
-      return [...path23.slice(cycleStart), code];
+      const cycleStart = path25.indexOf(code);
+      return [...path25.slice(cycleStart), code];
     }
     const locale = localeMap.get(code);
     if (!locale || !locale.fallback || locale.fallback.length === 0) {
       return null;
     }
     visited.add(code);
-    path23.push(code);
+    path25.push(code);
     for (const fallbackCode of locale.fallback) {
       const cycle = visit(fallbackCode);
       if (cycle) return cycle;
     }
-    path23.pop();
+    path25.pop();
     visited.delete(code);
     return null;
   }
@@ -1086,6 +1283,14 @@ var init_chunk_VGBOPF6G = __esm({
     });
   }
 });
+
+// ../../domain/schema/dist/chunk-JH6U6ENN.js
+var TIME_UNITS;
+var init_chunk_JH6U6ENN = __esm({
+  "../../domain/schema/dist/chunk-JH6U6ENN.js"() {
+    TIME_UNITS = ["minutes", "hours", "days", "weeks", "months", "years"];
+  }
+});
 function sortDependencyLevels(nodes, dependencies) {
   const nodeSet = new Set(nodes);
   const dependents = /* @__PURE__ */ new Map();
@@ -1127,21 +1332,21 @@ function sortDependencyLevels(nodes, dependencies) {
 function extractCycle(leftover, dependencies) {
   const leftoverSet = new Set(leftover);
   const visiting = /* @__PURE__ */ new Set();
-  const path23 = [];
+  const path25 = [];
   const dfs = (node) => {
     if (visiting.has(node)) {
-      const start = path23.indexOf(node);
-      return [...path23.slice(start), node];
+      const start = path25.indexOf(node);
+      return [...path25.slice(start), node];
     }
     if (!leftoverSet.has(node)) return null;
     visiting.add(node);
-    path23.push(node);
+    path25.push(node);
     for (const dep of dependencies.get(node) ?? []) {
       if (!leftoverSet.has(dep)) continue;
       const cycle = dfs(dep);
       if (cycle) return cycle;
     }
-    path23.pop();
+    path25.pop();
     visiting.delete(node);
     leftoverSet.delete(node);
     return null;
@@ -1171,7 +1376,7 @@ function fieldsFromDirectOrFieldsets(type) {
 function refineDeclaredReadSets(fields, ctx) {
   const knownIds = new Set(fields.map((entry) => entry.field.id));
   const dependencies = /* @__PURE__ */ new Map();
-  for (const { field, path: path23 } of fields) {
+  for (const { field, path: path25 } of fields) {
     const inputs = field.ai?.inputs;
     if (!inputs || inputs.length === 0) continue;
     const valid2 = [];
@@ -1180,7 +1385,7 @@ function refineDeclaredReadSets(fields, ctx) {
         ctx.addIssue({
           code: z.ZodIssueCode.custom,
           message: UNKNOWN_INPUT_MESSAGE(field.id, inputId),
-          path: [...path23, "ai", "inputs"]
+          path: [...path25, "ai", "inputs"]
         });
         continue;
       }
@@ -1200,9 +1405,10 @@ function refineDeclaredReadSets(fields, ctx) {
     });
   }
 }
-var AI_INSTRUCTIONS_MAX_CHARS, AIConfigSchema, FieldAIConfigSchema, AssetAIConfigSchema, BaseUIConfigSchema, TextUIOptionsSchema, UIConfigSchema, RuleConditionSchema, RuleConditionsSchema, VisibilityRuleSchema, RequirementRuleSchema, ValidationRuleSchema, ReadOnlyRuleSchema, FieldRuleSchema, LocalizationConfigSchema, FieldSchema, FieldsetSchema, BUILT_IN_ROLES, ROLE_ACTIONS, RoleActionSchema, BuiltInRoleSchema, roleIdPattern, RoleIdSchema, accessTagPattern, AccessTagSchema, AccessTagsArraySchema, ResourcePermissionSchema, FieldVisibilitySchema, RolePermissionsSchema, RoleSchema, RolesArraySchema, stageIdPattern, WorkflowEscalationSchema, WorkflowAutoAssignSchema, WorkflowStageSchema, WorkflowConfigSchema, ContentTypeWorkflowSchema, FILTER_OPERATORS, FilterOperatorSchema, TEXT_OPERATORS, LONG_TEXT_OPERATORS, NUMERIC_OPERATORS, BOOLEAN_OPERATORS, ENUM_OPERATORS, DATE_OPERATORS, REFERENCE_OPERATORS, TAGS_OPERATORS, FIELD_TYPE_OPERATORS, TIME_UNITS, TimeUnitSchema, RelativeDateValueSchema, COLUMN_RENDERERS, ColumnRendererSchema, ASSET_KINDS, FORBIDDEN_ASSET_TYPE_FIELD_TYPES, IMAGE_OUTPUT_FORMATS, IMAGE_FIT_MODES, UNKNOWN_INPUT_MESSAGE, INPUT_CYCLE_MESSAGE, FitSchema, OutputFormatSchema, ImageTransformSchema, ImageUploadConfigSchema, VideoUploadConfigSchema, FileUploadConfigSchema, ImageExifConfigSchema, VariantDefinitionSchema, ImageSourceConfigSchema, ImageKindConfigSchema, VideoPosterConfigSchema, VideoCaptionsConfigSchema, VideoDownloadConfigSchema, VideoWatermarkConfigSchema, VideoKindConfigSchema, FileScanConfigSchema, FileKindConfigSchema, AssetTypeSchema;
-var init_chunk_NB2NTUXG = __esm({
-  "../../domain/schema/dist/chunk-NB2NTUXG.js"() {
+var AI_INSTRUCTIONS_MAX_CHARS, AIConfigSchema, FieldAIConfigSchema, AssetAIConfigSchema, BaseUIConfigSchema, TextUIOptionsSchema, UIConfigSchema, RuleConditionSchema, RuleConditionsSchema, VisibilityRuleSchema, RequirementRuleSchema, ValidationRuleSchema, ReadOnlyRuleSchema, FieldRuleSchema, LocalizationConfigSchema, FieldSchema, FieldsetSchema, BUILT_IN_ROLES, ROLE_ACTIONS, RoleActionSchema, BuiltInRoleSchema, roleIdPattern, RoleIdSchema, accessTagPattern, AccessTagSchema, AccessTagsArraySchema, ResourcePermissionSchema, FieldVisibilitySchema, RolePermissionsSchema, RoleSchema, RolesArraySchema, stageIdPattern, WorkflowEscalationSchema, WorkflowAutoAssignSchema, WorkflowStageSchema, WorkflowConfigSchema, ContentTypeWorkflowSchema, FILTER_OPERATORS, FilterOperatorSchema, TEXT_OPERATORS, LONG_TEXT_OPERATORS, NUMERIC_OPERATORS, BOOLEAN_OPERATORS, ENUM_OPERATORS, DATE_OPERATORS, REFERENCE_OPERATORS, TAGS_OPERATORS, FIELD_TYPE_OPERATORS, TimeUnitSchema, RelativeDateValueSchema, COLUMN_RENDERERS, ColumnRendererSchema, ASSET_KINDS, FORBIDDEN_ASSET_TYPE_FIELD_TYPES, IMAGE_OUTPUT_FORMATS, IMAGE_FIT_MODES, UNKNOWN_INPUT_MESSAGE, INPUT_CYCLE_MESSAGE, FitSchema, OutputFormatSchema, ImageTransformSchema, ImageUploadConfigSchema, VideoUploadConfigSchema, FileUploadConfigSchema, ImageExifConfigSchema, VariantDefinitionSchema, ImageSourceConfigSchema, ImageKindConfigSchema, VideoPosterConfigSchema, VideoCaptionsConfigSchema, VideoDownloadConfigSchema, VideoWatermarkConfigSchema, VideoKindConfigSchema, FileScanConfigSchema, FileKindConfigSchema, AssetTypeSchema;
+var init_chunk_PCG6XHFD = __esm({
+  "../../domain/schema/dist/chunk-PCG6XHFD.js"() {
+    init_chunk_JH6U6ENN();
     AI_INSTRUCTIONS_MAX_CHARS = 1e3;
     AIConfigSchema = z.object({
       /**
@@ -1669,7 +1875,6 @@ var init_chunk_NB2NTUXG = __esm({
       list: []
       // Lists are complex, use nested filters
     };
-    TIME_UNITS = ["minutes", "hours", "days", "weeks", "months", "years"];
     TimeUnitSchema = z.enum(TIME_UNITS);
     RelativeDateValueSchema = z.object({
       amount: z.number().int().positive(),
@@ -2057,11 +2262,42 @@ var init_chunk_NB2NTUXG = __esm({
     });
   }
 });
-var StringOperationSchema, StringOperationWithParamsSchema, WhereValueSchema, WhereConditionSchema, SortConditionSchema, EnhancedIncludeObjectSchema, IncludeDefinitionSchema, SelectMappingSchema, FilterDefinitionSchema, FullTextSearchSchema, ContentTypesSchema, SearchBlockSchema, SimilarBlockSchema, AggregationMetricSchema, QueryCachePolicySchema, FetchBlockSchema, AggregateBlockSchema, IncludeSubQueriesSchema, QueryDefinitionSchema, FilterValueSchema, FilterConditionSchema, LogicalOperatorSchema, FilterGroupSchema, ColumnConfigSchema, MetadataFieldConfigSchema, MetadataLineConfigSchema, TableSettingsSchema, ViewScopeSchema, ViewDSLSchema, ViewVisibilitySchema, ViewSourceSchema, SchemaViewDefinitionSchema, getComponentIdFromType, ComponentSchema, ContentTypeSchema, SettingsGroupSchema, SchemaDefinitionSchema;
-var init_chunk_OOMXKJZA = __esm({
-  "../../domain/schema/dist/chunk-OOMXKJZA.js"() {
+var PARAMETER_EXPRESSION_SOURCE, ParameterExpressionStringSchema, QUERY_PARAMETER_TYPES, QueryParameterTypeSchema, QueryParameterScalarSchema, QueryParameterSchema, StringOperationSchema, StringOperationWithParamsSchema, ParameterizedLimitSchema, ParameterizedOffsetSchema, WhereValueSchema, WhereConditionSchema, SortConditionSchema, EnhancedIncludeObjectSchema, IncludeDefinitionSchema, SelectMappingSchema, FilterDefinitionSchema, FullTextSearchSchema, ContentTypesSchema, SearchBlockSchema, SimilarBlockSchema, AggregationMetricSchema, QueryCardinalitySchema, QueryCachePolicySchema, FetchBlockSchema, AggregateBlockSchema, IncludeSubQueriesSchema, QueryDefinitionSchema, VIEW_SLUG_PATTERN, VIEW_SLUG_MESSAGE, FilterValueSchema, FilterConditionSchema, LogicalOperatorSchema, FilterGroupSchema, ColumnConfigSchema, MetadataFieldConfigSchema, MetadataLineConfigSchema, TableSettingsSchema, ViewScopeSchema, ViewDSLSchema, ViewVisibilitySchema, ViewSourceSchema, SchemaViewDefinitionSchema, getComponentIdFromType, ComponentSchema, ContentTypeSchema, SettingsGroupSchema, SchemaDefinitionSchema;
+var init_chunk_2326XWZE = __esm({
+  "../../domain/schema/dist/chunk-2326XWZE.js"() {
     init_chunk_VGBOPF6G();
-    init_chunk_NB2NTUXG();
+    init_chunk_PCG6XHFD();
+    PARAMETER_EXPRESSION_SOURCE = String.raw`\$\{([a-zA-Z][a-zA-Z0-9_]*)(\?([^}]*))?\}`;
+    ParameterExpressionStringSchema = z.string().regex(
+      new RegExp(`^${PARAMETER_EXPRESSION_SOURCE}$`),
+      "Must be a parameter expression like ${limit?20}"
+    );
+    QUERY_PARAMETER_TYPES = [
+      "string",
+      "number",
+      "integer",
+      "boolean",
+      "array",
+      "object"
+    ];
+    QueryParameterTypeSchema = z.enum(QUERY_PARAMETER_TYPES);
+    QueryParameterScalarSchema = z.union([z.string(), z.number(), z.boolean()]);
+    QueryParameterSchema = z.object({
+      name: z.string().regex(
+        /^[a-zA-Z][a-zA-Z0-9_]*$/,
+        "Parameter name must start with a letter and contain only letters, numbers, and underscores"
+      ),
+      type: QueryParameterTypeSchema.optional(),
+      /** Absent means "required unless every `${…}` occurrence says otherwise". */
+      required: z.boolean().optional(),
+      default: z.union([QueryParameterScalarSchema, z.array(QueryParameterScalarSchema)]).optional(),
+      minimum: z.number().optional(),
+      maximum: z.number().optional(),
+      minLength: z.number().int().min(0).optional(),
+      maxLength: z.number().int().min(0).optional(),
+      pattern: z.string().min(1).optional(),
+      enum: z.array(QueryParameterScalarSchema).min(1).optional()
+    });
     StringOperationSchema = z.enum([
       "first",
       // Get first character
@@ -2085,6 +2321,14 @@ var init_chunk_OOMXKJZA = __esm({
       name: z.string().min(1),
       defaultValue: z.union([z.string(), z.number(), z.boolean()]).optional()
     });
+    ParameterizedLimitSchema = z.union([
+      z.number().int().positive(),
+      ParameterExpressionStringSchema
+    ]);
+    ParameterizedOffsetSchema = z.union([
+      z.number().int().min(0),
+      ParameterExpressionStringSchema
+    ]);
     WhereValueSchema = z.union([
       z.string(),
       z.number(),
@@ -2232,8 +2476,8 @@ var init_chunk_OOMXKJZA = __esm({
       ]).optional(),
       // Sorting and pagination
       sort: SortConditionSchema.optional(),
-      limit: z.number().int().positive().optional(),
-      offset: z.number().int().min(0).optional()
+      limit: ParameterizedLimitSchema.optional(),
+      offset: ParameterizedOffsetSchema.optional()
     }).refine((data) => data.contentType || data.contentTypes, {
       message: "Either contentType or contentTypes is required for search queries"
     });
@@ -2250,7 +2494,7 @@ var init_chunk_OOMXKJZA = __esm({
       /** Fields to return */
       fields: SelectMappingSchema.optional(),
       /** Maximum results to return */
-      limit: z.number().int().positive().optional()
+      limit: ParameterizedLimitSchema.optional()
     }).refine((data) => data.contentType || data.contentTypes, {
       message: "Either contentType or contentTypes is required for similar queries"
     });
@@ -2260,6 +2504,7 @@ var init_chunk_OOMXKJZA = __esm({
       z.string()
       // field expression like "items.quantity.sum" or "id.count"
     );
+    QueryCardinalitySchema = z.enum(["one", "many"]);
     QueryCachePolicySchema = z.union([
       // Simple: "public 300s" or "private" or "public 300s swr 60s"
       z.string(),
@@ -2277,8 +2522,8 @@ var init_chunk_OOMXKJZA = __esm({
       where: WhereConditionSchema.optional(),
       include: IncludeDefinitionSchema.optional(),
       sort: SortConditionSchema.optional(),
-      limit: z.number().int().positive().optional(),
-      offset: z.number().int().min(0).optional()
+      limit: ParameterizedLimitSchema.optional(),
+      offset: ParameterizedOffsetSchema.optional()
     }).refine((data) => data.contentType || data.singleton, {
       message: "Either contentType or singleton must be specified"
     }).refine((data) => !(data.contentType && data.singleton), {
@@ -2323,7 +2568,7 @@ var init_chunk_OOMXKJZA = __esm({
         ])
       ).optional(),
       sort: SortConditionSchema.optional(),
-      limit: z.number().int().positive().optional()
+      limit: ParameterizedLimitSchema.optional()
     });
     IncludeSubQueriesSchema = z.record(
       z.string(),
@@ -2331,7 +2576,7 @@ var init_chunk_OOMXKJZA = __esm({
         source: z.string(),
         where: WhereConditionSchema.optional(),
         sort: SortConditionSchema.optional(),
-        limit: z.number().int().positive().optional(),
+        limit: ParameterizedLimitSchema.optional(),
         select: SelectMappingSchema.optional()
       })
     );
@@ -2359,7 +2604,15 @@ var init_chunk_OOMXKJZA = __esm({
       filters: FilterDefinitionSchema.optional(),
       fullText: FullTextSearchSchema.optional(),
       select: SelectMappingSchema.optional(),
-      cache: QueryCachePolicySchema.optional()
+      cache: QueryCachePolicySchema.optional(),
+      /**
+       * What the query accepts. Additive and optional: a query that declares nothing still has the
+       * parameters its own `${…}` expressions and endpoint segments declare — `declareQueryParameters`
+       * is the one reader, and this block is authoritative where it speaks (type and constraints).
+       */
+      parameters: z.array(QueryParameterSchema).optional(),
+      /** `one` or `many`. Absent means `many`, unless the query fetches a singleton. */
+      cardinality: QueryCardinalitySchema.optional()
     }).refine((data) => data.fetch || data.aggregate || data.search || data.similar, {
       message: "Query must contain at least one of: fetch, aggregate, search, or similar block"
     }).refine(
@@ -2373,6 +2626,8 @@ var init_chunk_OOMXKJZA = __esm({
         message: "Aggregate block must have a source when not used with fetch"
       }
     );
+    VIEW_SLUG_PATTERN = /^[a-z][a-z0-9-]*$/;
+    VIEW_SLUG_MESSAGE = "Slug must be lowercase, start with a letter, and contain only letters, numbers, and hyphens";
     FilterValueSchema = z.union([
       // Simple values
       z.string(),
@@ -2620,7 +2875,7 @@ var init_chunk_OOMXKJZA = __esm({
        * URL-friendly slug for the view (unique per dataset)
        * Used in Studio URLs like /studio/views/:slug
        */
-      slug: z.string().regex(/^[a-z][a-z0-9-]*$/, "Slug must be lowercase, start with a letter"),
+      slug: z.string().regex(VIEW_SLUG_PATTERN, VIEW_SLUG_MESSAGE),
       /**
        * Optional description
        */
@@ -2676,7 +2931,7 @@ var init_chunk_OOMXKJZA = __esm({
        * URL-friendly slug for the view (optional, auto-generated from id if not provided)
        * Used in Studio URLs like /studio/views/:slug
        */
-      slug: z.string().regex(/^[a-z][a-z0-9-]*$/, "Slug must be lowercase, start with a letter").optional(),
+      slug: z.string().regex(VIEW_SLUG_PATTERN, VIEW_SLUG_MESSAGE).optional(),
       /**
        * View name
        */
@@ -3138,18 +3393,19 @@ var init_chunk_OOMXKJZA = __esm({
 // ../../domain/schema/dist/parsed-type.js
 var init_parsed_type = __esm({
   "../../domain/schema/dist/parsed-type.js"() {
-    init_chunk_OOMXKJZA();
+    init_chunk_2326XWZE();
     init_chunk_VGBOPF6G();
-    init_chunk_NB2NTUXG();
+    init_chunk_PCG6XHFD();
+    init_chunk_JH6U6ENN();
   }
 });
 async function loadRelyIOConfig(baseDir) {
   for (const configPath of CONFIG_FILE_PATHS) {
-    const fullPath = path3.join(baseDir, configPath);
+    const fullPath = path5.join(baseDir, configPath);
     if (existsSync(fullPath)) {
       try {
-        const __filename2 = fileURLToPath(import.meta.url);
-        const jiti = createJiti(__filename2, {
+        const __filename = fileURLToPath(import.meta.url);
+        const jiti = createJiti(__filename, {
           interopDefault: true,
           // Must stay OFF: jiti's module cache is process-global, so in a long-running process
           // (`relyio dev`) a cached config would be re-served after edits. fsCache (content-hashed
@@ -3172,7 +3428,7 @@ async function loadRelyIOConfig(baseDir) {
 }
 async function findTypeScriptSchema(relyioDir) {
   for (const tsPath of TS_SCHEMA_PATHS) {
-    const fullPath = path3.join(relyioDir, tsPath);
+    const fullPath = path5.join(relyioDir, tsPath);
     if (existsSync(fullPath)) {
       return {
         found: true,
@@ -3192,7 +3448,7 @@ async function findYamlSchemas(relyioDir) {
     if (yamlFiles.length > 0) {
       return {
         found: true,
-        paths: yamlFiles.map((f) => path3.join(relyioDir, f)),
+        paths: yamlFiles.map((f) => path5.join(relyioDir, f)),
         description: `YAML schema (${yamlFiles.length} file${yamlFiles.length === 1 ? "" : "s"})`
       };
     }
@@ -3201,7 +3457,7 @@ async function findYamlSchemas(relyioDir) {
   return { found: false };
 }
 async function detectSchemaSource(baseDir = process.cwd()) {
-  const relyioDir = path3.join(baseDir, RELYIO_DIR);
+  const relyioDir = path5.join(baseDir, RELYIO_DIR);
   if (!existsSync(relyioDir)) {
     return {
       sourceType: null,
@@ -3218,7 +3474,7 @@ async function detectSchemaSource(baseDir = process.cwd()) {
   if (config?.schemaSource) {
     if (config.schemaSource === "typescript") {
       if (config.schemaPath) {
-        const customPath = path3.join(baseDir, config.schemaPath);
+        const customPath = path5.join(baseDir, config.schemaPath);
         if (existsSync(customPath)) {
           return {
             sourceType: "typescript",
@@ -3359,8 +3615,8 @@ async function loadTypeScriptSchema(schemaPath, detection) {
     });
   }
   try {
-    const __filename2 = fileURLToPath(import.meta.url);
-    const jiti = createJiti(__filename2, {
+    const __filename = fileURLToPath(import.meta.url);
+    const jiti = createJiti(__filename, {
       // Enable ESM interop
       interopDefault: true,
       // Must stay OFF. jiti's module cache is process-global and integrates with Node's require
@@ -3637,7 +3893,7 @@ function isIgnoredWatchPath(filePath) {
   return IGNORED_WATCH_DIR_RE.test(filePath);
 }
 async function getSchemaWatchPaths(baseDir = process.cwd()) {
-  const relyioDir = path3.join(baseDir, RELYIO_DIR);
+  const relyioDir = path5.join(baseDir, RELYIO_DIR);
   return existsSync(relyioDir) ? [relyioDir] : [];
 }
 var RELYIO_DIR, TS_SCHEMA_PATHS, CONFIG_FILE_PATHS, SCHEMA_FILE_RE, DECLARATION_FILE_RE, IGNORED_WATCH_DIR_RE, SchemaNotFoundError;
@@ -3652,7 +3908,7 @@ var init_schema_loader = __esm({
     IGNORED_WATCH_DIR_RE = /(^|[/\\])(node_modules|\.git|dist|\.next|\.turbo|coverage)([/\\]|$)/;
     SchemaNotFoundError = class extends Error {
       constructor(baseDir) {
-        const relyioDir = path3.join(baseDir, RELYIO_DIR);
+        const relyioDir = path5.join(baseDir, RELYIO_DIR);
         const message = `
 No schema found in ${relyioDir}
 
@@ -4060,13 +4316,214 @@ var init_deploy_service = __esm({
     };
   }
 });
+
+// ../sdk/dist/chunk-XQ4QHWZE.js
+var __defProp2, __name;
+var init_chunk_XQ4QHWZE = __esm({
+  "../sdk/dist/chunk-XQ4QHWZE.js"() {
+    __defProp2 = Object.defineProperty;
+    __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
+  }
+});
+
+// ../sdk/dist/chunk-BBUB7C2Z.js
+function readDeadline(raw, now) {
+  if (raw === void 0 || raw === null || raw === "") return { state: "none" };
+  if (typeof raw !== "string") return { state: "unreadable" };
+  const deadline = new Date(raw).getTime();
+  if (!Number.isFinite(deadline)) return { state: "unreadable" };
+  return deadline <= now ? { state: "passed", expiredAt: raw } : { state: "live", expiresAt: raw };
+}
+function parseDevContextFile(raw, now) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { state: "unreadable", reason: "not-json" };
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return { state: "unreadable", reason: "not-json" };
+  }
+  const record = parsed;
+  const { datasetId, previewApiKey, branchId, expiresAt } = record;
+  if (typeof datasetId !== "string" || datasetId === "" || typeof previewApiKey !== "string" || previewApiKey === "" || typeof branchId !== "string" || branchId === "") {
+    return { state: "unreadable", reason: "missing-fields" };
+  }
+  const deadline = readDeadline(expiresAt, now);
+  if (deadline.state === "unreadable") return { state: "unreadable", reason: "bad-expiry" };
+  const context = {
+    datasetId,
+    previewApiKey,
+    branchId,
+    expiresAt: deadline.state === "none" ? null : expiresAt
+  };
+  return deadline.state === "passed" ? { state: "expired", context, expiredAt: deadline.expiredAt } : { state: "active", context };
+}
+function buildDevEnv(context) {
+  const env = {
+    [DEV_ENV.dataset]: context.datasetId,
+    [DEV_ENV.apiKey]: context.previewApiKey
+  };
+  if (context.expiresAt != null && context.expiresAt !== "") {
+    env[DEV_ENV.expiresAt] = context.expiresAt;
+  }
+  return env;
+}
+function parseDevEnv(env, now) {
+  const dataset = env?.[DEV_ENV.dataset];
+  const apiKey = env?.[DEV_ENV.apiKey];
+  if (dataset == null || dataset === "" || apiKey == null || apiKey === "") {
+    return { state: "absent" };
+  }
+  const deadline = readDeadline(env?.[DEV_ENV.expiresAt], now);
+  switch (deadline.state) {
+    case "unreadable":
+      return { state: "unreadable", reason: "bad-expiry" };
+    case "passed":
+      return { state: "expired", expiredAt: deadline.expiredAt };
+    case "live":
+      return { state: "active", credentials: { dataset, apiKey }, expiresAt: deadline.expiresAt };
+    case "none":
+      return { state: "active", credentials: { dataset, apiKey }, expiresAt: null };
+  }
+}
+var DEV_CONTEXT_DIR, DEV_CONTEXT_FILENAME, DEV_CONTEXT_FILE, DEV_ENV;
+var init_chunk_BBUB7C2Z = __esm({
+  "../sdk/dist/chunk-BBUB7C2Z.js"() {
+    init_chunk_XQ4QHWZE();
+    DEV_CONTEXT_DIR = ".relyio";
+    DEV_CONTEXT_FILENAME = "dev.json";
+    DEV_CONTEXT_FILE = `${DEV_CONTEXT_DIR}/${DEV_CONTEXT_FILENAME}`;
+    DEV_ENV = {
+      dataset: "RELYIO_DEV_DATASET",
+      apiKey: "RELYIO_DEV_API_KEY",
+      expiresAt: "RELYIO_DEV_EXPIRES_AT"
+    };
+    __name(readDeadline, "readDeadline");
+    __name(parseDevContextFile, "parseDevContextFile");
+    __name(buildDevEnv, "buildDevEnv");
+    __name(parseDevEnv, "parseDevEnv");
+  }
+});
+
+// ../sdk/dist/dev-handshake/index.js
+var init_dev_handshake = __esm({
+  "../sdk/dist/dev-handshake/index.js"() {
+    init_chunk_BBUB7C2Z();
+  }
+});
+function registerPlugin(language, load3) {
+  registeredPlugins.set(language, load3);
+}
+function registeredLanguages() {
+  return [...registeredPlugins.keys()].sort((a, b) => a.localeCompare(b));
+}
+function asPlugin(module_, describe3) {
+  const candidate = module_?.default ?? module_;
+  const plugin3 = candidate;
+  if (!plugin3 || typeof plugin3.generate !== "function") {
+    throw new Error(`Invalid plugin: ${describe3}`);
+  }
+  return plugin3;
+}
+async function loadPlugin(language) {
+  const registered = registeredPlugins.get(language);
+  if (!registered) {
+    const available = registeredLanguages();
+    throw new Error(
+      `No generator is registered for "${language}". ` + (available.length > 0 ? `Registered generators: ${available.join(", ")}.` : `No generator is registered at all \u2014 the host registers them at startup.`)
+    );
+  }
+  return asPlugin(await registered(), `registered ${language}`);
+}
+async function writeFiles(files, outputDir) {
+  await fs4.mkdir(outputDir, { recursive: true });
+  await Promise.all(
+    files.map(async (file) => {
+      const fullPath = path5.join(outputDir, file.path);
+      const dir = path5.dirname(fullPath);
+      await fs4.mkdir(dir, { recursive: true });
+      await fs4.writeFile(fullPath, file.content, "utf8");
+    })
+  );
+}
+function words(identifier) {
+  return identifier.split(/[-_\s]+/).filter((word) => word.length > 0);
+}
+var BUILT_IN_LANGUAGES, registeredPlugins, TemplateEngine, naming;
+var init_dist2 = __esm({
+  "../codegen-core/dist/index.js"() {
+    BUILT_IN_LANGUAGES = ["typescript", "python"];
+    registeredPlugins = /* @__PURE__ */ new Map();
+    TemplateEngine = class {
+      handlebars;
+      constructor() {
+        this.handlebars = Handlebars.create();
+        this.registerHelpers();
+      }
+      registerHelpers() {
+        this.handlebars.registerHelper("pascalCase", (str) => {
+          if (!str) return "";
+          return str.replaceAll(/(^|_)(\w)/g, (_, __, char) => char.toUpperCase());
+        });
+        this.handlebars.registerHelper("camelCase", (str) => {
+          if (!str) return "";
+          const pascal = str.replaceAll(/(^|_)(\w)/g, (_, __, char) => char.toUpperCase());
+          return pascal.charAt(0).toLowerCase() + pascal.slice(1);
+        });
+        this.handlebars.registerHelper("snakeCase", (str) => {
+          if (!str) return "";
+          return str.replaceAll(/([A-Z])/g, "_$1").toLowerCase().replace(/^_/, "");
+        });
+        this.handlebars.registerHelper("kebabCase", (str) => {
+          if (!str) return "";
+          return str.replaceAll(/([A-Z])/g, "-$1").toLowerCase().replace(/^-/, "");
+        });
+        this.handlebars.registerHelper("plural", (str) => {
+          if (!str) return "";
+          if (str.endsWith("y")) {
+            return str.slice(0, -1) + "ies";
+          }
+          if (str.endsWith("s") || str.endsWith("sh") || str.endsWith("ch")) {
+            return str + "es";
+          }
+          return str + "s";
+        });
+      }
+      compile(template) {
+        const compiledTemplate = this.handlebars.compile(template);
+        return (context) => compiledTemplate(context);
+      }
+      render(template, context) {
+        const compiledTemplate = this.compile(template);
+        return compiledTemplate(context);
+      }
+    };
+    new TemplateEngine();
+    naming = {
+      /** `blogPost` → `BlogPost`. The name of a generated type, class or struct. */
+      pascal(identifier) {
+        return words(identifier).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
+      },
+      /** `blog_post` → `blogPost`. The name of a generated value or field. */
+      camel(identifier) {
+        const pascal = naming.pascal(identifier);
+        return pascal.charAt(0).toLowerCase() + pascal.slice(1);
+      },
+      /** `blogPost` → `blog_post`. Python module paths and field names. */
+      snake(identifier) {
+        return identifier.replaceAll(/([A-Z])/g, "_$1").toLowerCase().replace(/^_/, "").replaceAll(/[-\s]+/g, "_");
+      }
+    };
+  }
+});
 function normalizeReferenceTargets(to) {
   if (to == null) return [];
   return Array.isArray(to) ? [...to] : [to];
 }
 var BaseFieldConfigSchema, ReferenceStrengthSchema, OnTargetDeleteSchema, ReferenceTargetSchema;
-var init_chunk_YL47KAP2 = __esm({
-  "../../domain/schema/dist/chunk-YL47KAP2.js"() {
+var init_chunk_RIJEP5Z6 = __esm({
+  "../../domain/schema/dist/chunk-RIJEP5Z6.js"() {
     BaseFieldConfigSchema = z.object({
       required: z.boolean().optional(),
       unique: z.boolean().optional(),
@@ -4120,10 +4577,11 @@ var init_chunk_YL47KAP2 = __esm({
     });
   }
 });
-var init_chunk_KWUTF26B = __esm({
-  "../../domain/schema/dist/chunk-KWUTF26B.js"() {
-    init_chunk_YL47KAP2();
-    init_chunk_NB2NTUXG();
+var init_chunk_3UOSTM65 = __esm({
+  "../../domain/schema/dist/chunk-3UOSTM65.js"() {
+    init_chunk_2326XWZE();
+    init_chunk_RIJEP5Z6();
+    init_chunk_PCG6XHFD();
     BaseFieldConfigSchema.extend({
       maxLength: z.number().min(1).optional(),
       pattern: z.string().optional(),
@@ -4359,30 +4817,62 @@ var init_chunk_XTMEVLMJ = __esm({
   }
 });
 
+// ../../domain/schema/dist/chunk-73FJJM22.js
+var TABLE_SYSTEM_FIELD_KINDS;
+var init_chunk_73FJJM22 = __esm({
+  "../../domain/schema/dist/chunk-73FJJM22.js"() {
+    init_chunk_RIJEP5Z6();
+    init_chunk_PCG6XHFD();
+    TABLE_SYSTEM_FIELD_KINDS = {
+      id: "text",
+      contentType: "choice",
+      status: "text",
+      createdAt: "date",
+      updatedAt: "date",
+      publishedAt: "date",
+      createdBy: "reference",
+      updatedBy: "reference"
+    };
+    ({
+      ...TABLE_SYSTEM_FIELD_KINDS,
+      "file.status": "text",
+      "file.backend": "text",
+      "file.mimeType": "text",
+      "file.fileName": "text",
+      "file.size": "number",
+      "file.extracted.width": "number",
+      "file.extracted.height": "number",
+      "file.extracted.duration": "number"
+    });
+  }
+});
+
 // ../../domain/schema/dist/chunk-QSWR2YJN.js
 var init_chunk_QSWR2YJN = __esm({
   "../../domain/schema/dist/chunk-QSWR2YJN.js"() {
   }
 });
 
-// ../../domain/schema/dist/chunk-N5M2EZW6.js
-var init_chunk_N5M2EZW6 = __esm({
-  "../../domain/schema/dist/chunk-N5M2EZW6.js"() {
-    init_chunk_YL47KAP2();
+// ../../domain/schema/dist/chunk-2ABFISBQ.js
+var init_chunk_2ABFISBQ = __esm({
+  "../../domain/schema/dist/chunk-2ABFISBQ.js"() {
+    init_chunk_RIJEP5Z6();
     init_chunk_QSWR2YJN();
-    init_chunk_NB2NTUXG();
+    init_chunk_PCG6XHFD();
   }
 });
-var init_dist = __esm({
+var init_dist3 = __esm({
   "../../domain/schema/dist/index.js"() {
-    init_chunk_KWUTF26B();
-    init_chunk_OOMXKJZA();
+    init_chunk_3UOSTM65();
+    init_chunk_2326XWZE();
     init_chunk_XTMEVLMJ();
     init_chunk_VGBOPF6G();
-    init_chunk_N5M2EZW6();
-    init_chunk_YL47KAP2();
+    init_chunk_73FJJM22();
+    init_chunk_2ABFISBQ();
+    init_chunk_RIJEP5Z6();
     init_chunk_QSWR2YJN();
-    init_chunk_NB2NTUXG();
+    init_chunk_PCG6XHFD();
+    init_chunk_JH6U6ENN();
     new Set(FORBIDDEN_ASSET_TYPE_FIELD_TYPES);
   }
 });
@@ -4427,24 +4917,17 @@ function validateSchema(schema) {
     formatted: SchemaValidator.formatErrors(errors)
   };
 }
-function toPascalCase(str) {
-  const spaced = str.replaceAll(/([a-z])([A-Z])/g, "$1 $2");
-  return spaced.split(/[-_\s]+/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
-}
-function toCamelCase(str) {
-  const pascal = toPascalCase(str);
-  return pascal.charAt(0).toLowerCase() + pascal.slice(1);
-}
 async function generateTypeScriptFromSchema(rawSchema, options) {
   const parsedSchema = parseSchema(rawSchema);
   const generator = new TypeScriptGenerator(parsedSchema, options);
   return generator.generate();
 }
 var ASSET_KINDS2, SchemaParser, SchemaValidator, TypeScriptGenerator, plugin, index_default;
-var init_dist2 = __esm({
+var init_dist4 = __esm({
   "../codegen-typescript/dist/index.js"() {
-    init_dist();
-    init_dist();
+    init_dist3();
+    init_dist2();
+    init_dist3();
     ASSET_KINDS2 = ["image", "video", "file"];
     SchemaParser = class {
       /**
@@ -4911,16 +5394,16 @@ var init_dist2 = __esm({
        * Validate a content type
        */
       validateContentType(id, contentType) {
-        const path23 = `contentTypes.${id}`;
-        this.validateFields(contentType.fields, path23);
+        const path25 = `contentTypes.${id}`;
+        this.validateFields(contentType.fields, path25);
         if (contentType.fields.length === 0) {
-          this.addWarning(path23, "Content type has no fields defined");
+          this.addWarning(path25, "Content type has no fields defined");
         }
         const reservedFields = /* @__PURE__ */ new Set(["id", "createdAt", "updatedAt", "_id"]);
         for (const field of contentType.fields) {
           if (reservedFields.has(field.id)) {
             this.addError(
-              `${path23}.fields.${field.id}`,
+              `${path25}.fields.${field.id}`,
               `Field name '${field.id}' is reserved by BaseContent`,
               `Use a different field name`
             );
@@ -4947,20 +5430,20 @@ var init_dist2 = __esm({
       /**
        * Validate field type
        */
-      validateFieldType(field, path23) {
+      validateFieldType(field, path25) {
         if (field.type === "enum" && (!field.enumValues || field.enumValues.length === 0)) {
-          this.addError(path23, "Enum field has no values defined");
+          this.addError(path25, "Enum field has no values defined");
         }
         if (field.type === "reference" && !field.referenceType) {
           this.addError(
-            path23,
+            path25,
             "Reference field missing referenceType",
             "Ensure the reference target (to) is specified in the schema"
           );
         }
         if (field.type === "component" && !field.componentType) {
           this.addError(
-            path23,
+            path25,
             "Component field missing componentType",
             "Ensure component type is specified as component(componentName)"
           );
@@ -4970,11 +5453,11 @@ var init_dist2 = __esm({
        * Check for circular references
        */
       checkCircularReferences(schema) {
-        const checkType = (typeName, visited, path23) => {
+        const checkType = (typeName, visited, path25) => {
           if (visited.has(typeName)) {
             this.addError(
-              path23.join(" -> "),
-              `Circular reference detected: ${path23.join(" -> ")} -> ${typeName}`
+              path25.join(" -> "),
+              `Circular reference detected: ${path25.join(" -> ")} -> ${typeName}`
             );
             return;
           }
@@ -4983,7 +5466,7 @@ var init_dist2 = __esm({
           visited.add(typeName);
           for (const field of contentType.fields) {
             if (field.isReference && field.referenceType) {
-              checkType(field.referenceType, new Set(visited), [...path23, field.referenceType]);
+              checkType(field.referenceType, new Set(visited), [...path25, field.referenceType]);
             }
           }
         };
@@ -4994,10 +5477,10 @@ var init_dist2 = __esm({
       /**
        * Add an error
        */
-      addError(path23, message, suggestion) {
+      addError(path25, message, suggestion) {
         this.errors.push({
           type: "error",
-          path: path23,
+          path: path25,
           message,
           suggestion
         });
@@ -5005,10 +5488,10 @@ var init_dist2 = __esm({
       /**
        * Add a warning
        */
-      addWarning(path23, message, suggestion) {
+      addWarning(path25, message, suggestion) {
         this.warnings.push({
           type: "warning",
-          path: path23,
+          path: path25,
           message,
           suggestion
         });
@@ -5153,6 +5636,9 @@ ${prefix}: ${error2.path}`, `   ${error2.message}`);
 import type {
   ${typeImports.join(",\n  ")},
 } from '@relyio/sdk/schema'
+
+// Puts '@relyio/sdk' in the program for the \`Register\` augmentation at the end of this file
+import type {} from '@relyio/sdk'
 `);
       }
       /**
@@ -5183,7 +5669,7 @@ import type {
           }
           lines.push(" */");
         }
-        const varName = toCamelCase(component.id) + "Component";
+        const varName = naming.camel(component.id) + "Component";
         lines.push(`export const ${varName} = defineComponent('${component.id}', {`);
         if (component.displayName) {
           lines.push(`  displayName: '${this.escapeString(component.displayName)}',`);
@@ -5226,7 +5712,7 @@ import type {
           }
           lines.push(" */");
         }
-        const varName = toCamelCase(contentType.id);
+        const varName = naming.camel(contentType.id);
         lines.push(`export const ${varName} = defineContentType('${contentType.id}', {`);
         if (contentType.displayName) {
           lines.push(`  displayName: '${this.escapeString(contentType.displayName)}',`);
@@ -5283,7 +5769,7 @@ import type {
           }
           lines.push(" */");
         }
-        const varName = toCamelCase(assetType.id);
+        const varName = naming.camel(assetType.id);
         lines.push(`export const ${varName} = defineAssetType('${assetType.id}', {`);
         if (assetType.displayName) {
           lines.push(`  displayName: '${this.escapeString(assetType.displayName)}',`);
@@ -5558,7 +6044,7 @@ import type {
           }
           lines.push(" */");
         }
-        const varName = toCamelCase(singleton5.id);
+        const varName = naming.camel(singleton5.id);
         lines.push(`export const ${varName} = defineSingleton('${singleton5.id}', {`);
         if (singleton5.displayName) {
           lines.push(`  displayName: '${this.escapeString(singleton5.displayName)}',`);
@@ -5610,7 +6096,7 @@ import type {
           }
           lines.push(" */");
         }
-        const varName = toCamelCase(group.id) + "Settings";
+        const varName = naming.camel(group.id) + "Settings";
         lines.push(`export const ${varName} = defineSettingsGroup('${group.id}', {`);
         if (group.displayName) {
           lines.push(`  displayName: '${this.escapeString(group.displayName)}',`);
@@ -5643,7 +6129,7 @@ import type {
        */
       generateQuery(query) {
         const lines = [];
-        const varName = toCamelCase(query.id) + "Query";
+        const varName = naming.camel(query.id) + "Query";
         lines.push(`export const ${varName} = defineQuery('${query.id}', {`);
         if (query.endpoint) {
           lines.push(`  endpoint: '${query.endpoint}',`);
@@ -5702,7 +6188,7 @@ import type {
         if (this.schema.contentTypes.size > 0) {
           lines.push("  contentTypes: {");
           for (const [id] of this.schema.contentTypes) {
-            const varName = toCamelCase(id);
+            const varName = naming.camel(id);
             lines.push(`    ${id}: ${varName},`);
           }
           lines.push("  },");
@@ -5710,7 +6196,7 @@ import type {
         if (this.schema.components.size > 0) {
           lines.push("  components: {");
           for (const [id] of this.schema.components) {
-            const varName = toCamelCase(id) + "Component";
+            const varName = naming.camel(id) + "Component";
             lines.push(`    ${id}: ${varName},`);
           }
           lines.push("  },");
@@ -5718,7 +6204,7 @@ import type {
         if (this.schema.assetTypes.size > 0) {
           lines.push("  assetTypes: {");
           for (const [id] of this.schema.assetTypes) {
-            const varName = toCamelCase(id);
+            const varName = naming.camel(id);
             lines.push(`    ${id}: ${varName},`);
           }
           lines.push("  },");
@@ -5726,7 +6212,7 @@ import type {
         if (this.schema.singletons.size > 0) {
           lines.push("  singletonContentTypes: {");
           for (const [id] of this.schema.singletons) {
-            const varName = toCamelCase(id);
+            const varName = naming.camel(id);
             lines.push(`    ${id}: ${varName},`);
           }
           lines.push("  },");
@@ -5734,7 +6220,7 @@ import type {
         if (this.schema.queries.size > 0) {
           lines.push("  queries: {");
           for (const [id] of this.schema.queries) {
-            const varName = toCamelCase(id) + "Query";
+            const varName = naming.camel(id) + "Query";
             lines.push(`    ${id}: ${varName},`);
           }
           lines.push("  },");
@@ -5742,7 +6228,7 @@ import type {
         if (this.schema.settingsGroups.size > 0) {
           lines.push("  settingsGroups: {");
           for (const [id] of this.schema.settingsGroups) {
-            const varName = toCamelCase(id) + "Settings";
+            const varName = naming.camel(id) + "Settings";
             lines.push(`    ${id}: ${varName},`);
           }
           lines.push("  },");
@@ -5760,13 +6246,13 @@ import type {
 `);
         const lines = [];
         for (const [id] of this.schema.contentTypes) {
-          const varName = toCamelCase(id);
-          const typeName = toPascalCase(id);
+          const varName = naming.camel(id);
+          const typeName = naming.pascal(id);
           lines.push(`export type ${typeName} = InferContentType<typeof ${varName}>`);
         }
         for (const [, assetType] of this.schema.assetTypes) {
-          const varName = toCamelCase(assetType.id);
-          const typeName = toPascalCase(assetType.id);
+          const varName = naming.camel(assetType.id);
+          const typeName = naming.pascal(assetType.id);
           lines.push(`export type ${typeName} = InferAssetType<typeof ${varName}>`);
           if (assetType.variantIds && assetType.variantIds.length > 0) {
             const union = assetType.variantIds.map((vid) => `'${this.escapeString(vid)}'`).join(" | ");
@@ -5774,8 +6260,8 @@ import type {
           }
         }
         for (const [id] of this.schema.singletons) {
-          const varName = toCamelCase(id);
-          const typeName = toPascalCase(id);
+          const varName = naming.camel(id);
+          const typeName = naming.pascal(id);
           lines.push(`export type ${typeName} = InferSingleton<typeof ${varName}>`);
         }
         this.output.push(
@@ -5785,6 +6271,27 @@ import type {
 export type SchemaTypes = typeof schema
 `
         );
+        this.addRegisterAugmentation();
+      }
+      /**
+       * Register this schema with the SDK, so `createClient({ apiKey })` is typed with no generic and no
+       * `schema:` (`INV-SS-TYPES-INFERRED`, `sdk-surfaces-spec.md` decision 7).
+       *
+       * It is emitted into this same file rather than a second one: the augmentation takes effect
+       * wherever `schema.ts` is part of the program. It needs `'@relyio/sdk'` itself in the program too,
+       * which is what the empty `import type {} from '@relyio/sdk'` in `addImports` is for — measured,
+       * a program whose only SDK import is `@relyio/sdk/client` fails this block with TS2664 ("module
+       * '@relyio/sdk' cannot be found") even though the name resolves. Two generated files augmenting
+       * `Register` in one program conflict on `schema` (TS2717); one program registers one schema.
+       */
+      addRegisterAugmentation() {
+        this.output.push(`// Registers this schema with the SDK: \`createClient({ apiKey })\` is typed by it
+declare module '@relyio/sdk' {
+  interface Register {
+    schema: typeof schema
+  }
+}
+`);
       }
       /**
        * Escape string for use in generated code
@@ -5918,18 +6425,12 @@ function mapFieldTypeToPython(fieldType, config) {
     default: {
       const componentMatch = fieldType.match(/^component\(([^)]+)\)$/);
       if (componentMatch) {
-        return toPascalCase2(componentMatch[1]);
+        return naming.pascal(componentMatch[1]);
       }
       return "Any";
     }
   }
 }
-function toPascalCase2(str) {
-  return str.split(/[-_\s]+/).map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase()).join("");
-}
-function toSnakeCase(str) {
-  return str.replaceAll(/([A-Z])/g, "_$1").toLowerCase().replace(/^_/, "").replaceAll(/[-\s]+/g, "_");
-}
 function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -5968,7 +6469,7 @@ async function generatePython(ir, options) {
     for (const [id, contentType] of recordEntries(ir.contentTypes)) {
       const content = generateContentType(id, asSchemaType(contentType), options);
       files.push({
-        path: `content_types/${toSnakeCase(id)}.py`,
+        path: `content_types/${naming.snake(id)}.py`,
         content
       });
     }
@@ -5982,7 +6483,7 @@ async function generatePython(ir, options) {
     for (const [id, component] of recordEntries(ir.components)) {
       const content = generateComponent(id, asSchemaType(component), options);
       files.push({
-        path: `components/${toSnakeCase(id)}.py`,
+        path: `components/${naming.snake(id)}.py`,
         content
       });
     }
@@ -5996,7 +6497,7 @@ async function generatePython(ir, options) {
     for (const [id, singleton5] of recordEntries(ir.singletons)) {
       const content = generateSingleton(id, asSchemaType(singleton5), options);
       files.push({
-        path: `singletons/${toSnakeCase(id)}.py`,
+        path: `singletons/${naming.snake(id)}.py`,
         content
       });
     }
@@ -6109,7 +6610,7 @@ __all__ = ['RichTextContent', 'ImageField', 'FileField', 'Reference']
 `;
 }
 function generateContentType(id, contentType, options) {
-  const className = toPascalCase2(id);
+  const className = naming.pascal(id);
   const fields = generateFields(contentType.fields || [], options);
   const imports = ["from ..base_types import RichTextContent, ImageField, FileField, Reference"];
   if (options.baseModel === "pydantic") {
@@ -6147,7 +6648,7 @@ __all__ = ['${className}', 'Create${className}Input', 'Update${className}Input']
   }
 }
 function generateComponent(id, component, options) {
-  const className = toPascalCase2(id);
+  const className = naming.pascal(id);
   const fields = generateFields(component.fields || [], options);
   const imports = ["from ..base_types import RichTextContent, ImageField, FileField, Reference"];
   if (options.baseModel === "pydantic") {
@@ -6178,7 +6679,7 @@ __all__ = ['${className}']
   }
 }
 function generateSingleton(id, singleton5, options) {
-  const className = toPascalCase2(id);
+  const className = naming.pascal(id);
   const fields = generateFields(singleton5.fields || [], options);
   const imports = ["from ..base_types import RichTextContent, ImageField, FileField, Reference"];
   if (options.baseModel === "pydantic") {
@@ -6214,12 +6715,12 @@ __all__ = ['${className}', 'Update${className}Input']
 }
 function generateFields(fields, options) {
   return fields.map((field) => {
-    const fieldName = toSnakeCase(field.id);
+    const fieldName = naming.snake(field.id);
     const pythonType = mapFieldTypeToPython(field.type, field.config);
     const isOptional = !field.required;
     const fieldType = isOptional ? `Optional[${pythonType}]` : pythonType;
     const defaultValue = isOptional ? " = None" : "";
-    if (options.baseModel === "pydantic" && field.id !== toSnakeCase(field.id)) {
+    if (options.baseModel === "pydantic" && field.id !== naming.snake(field.id)) {
       return `${fieldName}: ${fieldType} = Field(${defaultValue.slice(3)}, alias='${field.id}')`;
     }
     return `${fieldName}: ${fieldType}${defaultValue}`;
@@ -6339,8 +6840,8 @@ class TenantContext(BaseModel):
 `);
     if (isRecord2(ir.contentTypes)) {
       for (const id of Object.keys(ir.contentTypes)) {
-        const className = toPascalCase2(id);
-        imports.push(`from .content_types.${toSnakeCase(id)} import ${className}`);
+        const className = naming.pascal(id);
+        imports.push(`from .content_types.${naming.snake(id)} import ${className}`);
         tenantTypes.push(`
 class Tenant${className}(${className}):
     """Tenant-scoped ${className}"""
@@ -6359,8 +6860,8 @@ class TenantContext:
 `);
     if (isRecord2(ir.contentTypes)) {
       for (const id of Object.keys(ir.contentTypes)) {
-        const className = toPascalCase2(id);
-        imports.push(`from .content_types.${toSnakeCase(id)} import ${className}`);
+        const className = naming.pascal(id);
+        imports.push(`from .content_types.${naming.snake(id)} import ${className}`);
         tenantTypes.push(`
 @dataclass
 class Tenant${className}(${className}):
@@ -6373,7 +6874,7 @@ class Tenant${className}(${className}):
   const exportList = ["TenantContext"];
   if (isRecord2(ir.contentTypes)) {
     for (const id of Object.keys(ir.contentTypes)) {
-      exportList.push(`Tenant${toPascalCase2(id)}`);
+      exportList.push(`Tenant${naming.pascal(id)}`);
     }
   }
   return `${imports.join("\n")}
@@ -6416,10 +6917,10 @@ __all__ = ['validate_data', 'to_dict', 'to_json']
 }
 function generateContentTypesIndex(contentTypeIds, _options) {
   const imports = contentTypeIds.map(
-    (id) => `from .${toSnakeCase(id)} import ${toPascalCase2(id)}, Create${toPascalCase2(id)}Input, Update${toPascalCase2(id)}Input`
+    (id) => `from .${naming.snake(id)} import ${naming.pascal(id)}, Create${naming.pascal(id)}Input, Update${naming.pascal(id)}Input`
   );
   const exports = contentTypeIds.flatMap((id) => {
-    const className = toPascalCase2(id);
+    const className = naming.pascal(id);
     return [`'${className}'`, `'Create${className}Input'`, `'Update${className}Input'`];
   });
   return `${imports.join("\n")}
@@ -6428,8 +6929,8 @@ __all__ = [${exports.join(", ")}]
 `;
 }
 function generateComponentsIndex(componentIds, _options) {
-  const imports = componentIds.map((id) => `from .${toSnakeCase(id)} import ${toPascalCase2(id)}`);
-  const exports = componentIds.map((id) => `'${toPascalCase2(id)}'`);
+  const imports = componentIds.map((id) => `from .${naming.snake(id)} import ${naming.pascal(id)}`);
+  const exports = componentIds.map((id) => `'${naming.pascal(id)}'`);
   return `${imports.join("\n")}
 
 __all__ = [${exports.join(", ")}]
@@ -6437,10 +6938,10 @@ __all__ = [${exports.join(", ")}]
 }
 function generateSingletonsIndex(singletonIds, _options) {
   const imports = singletonIds.map(
-    (id) => `from .${toSnakeCase(id)} import ${toPascalCase2(id)}, Update${toPascalCase2(id)}Input`
+    (id) => `from .${naming.snake(id)} import ${naming.pascal(id)}, Update${naming.pascal(id)}Input`
   );
   const exports = singletonIds.flatMap((id) => {
-    const className = toPascalCase2(id);
+    const className = naming.pascal(id);
     return [`'${className}'`, `'Update${className}Input'`];
   });
   return `${imports.join("\n")}
@@ -6449,8 +6950,10 @@ __all__ = [${exports.join(", ")}]
 `;
 }
 var plugin2, index_default2;
-var init_dist3 = __esm({
+var init_dist5 = __esm({
   "../codegen-python/dist/index.js"() {
+    init_dist2();
+    init_dist2();
     plugin2 = {
       language: "python",
       async generate(ir, options) {
@@ -6862,7 +7365,8 @@ async function fetchHandoffSummary(req) {
       body: JSON.stringify({
         fromAgent: req.fromAgent,
         toAgent: req.toAgent,
-        messages: req.messages
+        messages: req.messages,
+        projectId: req.projectId
       }),
       signal: controller.signal
     });
@@ -8045,7 +8549,7 @@ var init_agent_loop = __esm({
       async tryReadFile(relPath) {
         if (!this.projectRoot) return void 0;
         try {
-          const fullPath = path3.resolve(this.projectRoot, relPath);
+          const fullPath = path5.resolve(this.projectRoot, relPath);
           if (!fullPath.startsWith(this.projectRoot)) return void 0;
           return await readFile(fullPath, "utf8");
         } catch {
@@ -8206,7 +8710,9 @@ var init_agent_loop = __esm({
         const result = await fetchHandoffSummary({
           fromAgent,
           toAgent,
-          messages: this.messages
+          messages: this.messages,
+          // The gateway needs it to attribute the summary's tokens and cost to an org.
+          projectId: this.options.context.projectId
         });
         if (result) {
           this.messages = [
@@ -8302,10 +8808,10 @@ var init_permission_gate = __esm({
         return PROTECTED_PATHS.some((p) => normalized.startsWith(p) || normalized.includes(`/${p}`));
       }
       isOutsideProjectRoot(filePath) {
-        if (path3.isAbsolute(filePath)) {
+        if (path5.isAbsolute(filePath)) {
           return !filePath.startsWith(this.projectRoot);
         }
-        const resolved = path3.resolve(this.projectRoot, filePath);
+        const resolved = path5.resolve(this.projectRoot, filePath);
         return !resolved.startsWith(this.projectRoot);
       }
     };
@@ -8454,7 +8960,7 @@ var init_context_provider = __esm({
         });
         const schemaFiles = [];
         for (const filePath of files) {
-          const fullPath = path3.join(projectRoot, filePath);
+          const fullPath = path5.join(projectRoot, filePath);
           try {
             const stats = await stat2(fullPath);
             const contentType = this.inferContentType(filePath);
@@ -8522,7 +9028,7 @@ var init_read_file_handler = __esm({
       }
       async execute(input) {
         const filePath = input.path;
-        const fullPath = path3.resolve(this.projectRoot, filePath);
+        const fullPath = path5.resolve(this.projectRoot, filePath);
         if (!fullPath.startsWith(this.projectRoot)) {
           return { error: "Path is outside project root" };
         }
@@ -8605,12 +9111,12 @@ var init_write_file_handler = __esm({
       async execute(input) {
         const filePath = input.path;
         const content = input.content;
-        const fullPath = path3.resolve(this.projectRoot, filePath);
+        const fullPath = path5.resolve(this.projectRoot, filePath);
         if (!fullPath.startsWith(this.projectRoot)) {
           return { error: "Path is outside project root" };
         }
         try {
-          await mkdir(path3.dirname(fullPath), { recursive: true });
+          await mkdir(path5.dirname(fullPath), { recursive: true });
           await writeFile(fullPath, content, "utf8");
           return { success: true, path: filePath, bytesWritten: content.length };
         } catch (error2) {
@@ -8634,7 +9140,7 @@ var init_apply_patch_handler = __esm({
         const filePath = input.path;
         const searchBlock = input.searchBlock;
         const replaceBlock = input.replaceBlock;
-        const fullPath = path3.resolve(this.projectRoot, filePath);
+        const fullPath = path5.resolve(this.projectRoot, filePath);
         if (!fullPath.startsWith(this.projectRoot)) {
           return { error: "Path is outside project root" };
         }
@@ -10142,7 +10648,7 @@ function Banner() {
         label: "App",
         value: dev.sandbox.wiredEnv ? "wired" : "manual",
         valueColor: dev.sandbox.wiredEnv ? "green" : void 0,
-        suffix: dev.sandbox.wiredEnv ? void 0 : ".relyio/dev.json"
+        suffix: dev.sandbox.wiredEnv ? void 0 : DEV_CONTEXT_FILE
       }
     ];
   } else {
@@ -10208,11 +10714,12 @@ function FieldRow({ field }) {
 var CLI_VERSION2, BRAND_GLYPH, BRAND_NAME, LABEL_WIDTH, TWO_COLUMN_MIN_COLS;
 var init_banner = __esm({
   "src/ai/repl/components/banner.tsx"() {
+    init_dev_handshake();
     init_runtime_context();
     init_dev_cockpit_context();
     init_dev_cockpit_format();
     init_startup_info();
-    CLI_VERSION2 = "0.2.2" ;
+    CLI_VERSION2 = "0.3.0" ;
     BRAND_GLYPH = "\u25B6";
     BRAND_NAME = "RelyIO";
     LABEL_WIDTH = 9;
@@ -10472,8 +10979,8 @@ function entryLabel(fields, contentType) {
   return title || contentType || "";
 }
 function itemTarget(tc) {
-  const path23 = tc.input.path;
-  if (path23) return path23;
+  const path25 = tc.input.path;
+  if (path25) return path25;
   switch (tc.toolName) {
     case "getSchemaReference": {
       const topic = tc.input.topic;
@@ -11201,8 +11708,8 @@ var init_input_preprocessor = __esm({
 var HISTORY_DIR, HISTORY_FILE, MAX_HISTORY_ENTRIES, PersistentHistory;
 var init_input_history = __esm({
   "src/ai/services/input-history.ts"() {
-    HISTORY_DIR = path3.join(os.homedir(), ".relyio");
-    HISTORY_FILE = path3.join(HISTORY_DIR, "ai-history");
+    HISTORY_DIR = path5.join(os.homedir(), ".relyio");
+    HISTORY_FILE = path5.join(HISTORY_DIR, "ai-history");
     MAX_HISTORY_ENTRIES = 1e3;
     PersistentHistory = class {
       entries = [];
@@ -11213,7 +11720,7 @@ var init_input_history = __esm({
       }
       load() {
         try {
-          fs2.mkdirSync(path3.dirname(this.filePath), { recursive: true });
+          fs2.mkdirSync(path5.dirname(this.filePath), { recursive: true });
           if (fs2.existsSync(this.filePath)) {
             const content = fs2.readFileSync(this.filePath, "utf8");
             this.entries = content.split("\n").filter(Boolean);
@@ -11243,7 +11750,7 @@ var init_input_history = __esm({
       }
       save() {
         try {
-          fs2.mkdirSync(path3.dirname(this.filePath), { recursive: true });
+          fs2.mkdirSync(path5.dirname(this.filePath), { recursive: true });
           fs2.writeFileSync(this.filePath, this.entries.join("\n") + "\n");
         } catch {
         }
@@ -11252,18 +11759,18 @@ var init_input_history = __esm({
   }
 });
 function readMentionedFile(filePath, projectRoot) {
-  const resolved = path3.isAbsolute(filePath) ? filePath : path3.resolve(projectRoot, filePath);
+  const resolved = path5.isAbsolute(filePath) ? filePath : path5.resolve(projectRoot, filePath);
   try {
     const stat2 = fs2.statSync(resolved);
     if (stat2.size > MAX_FILE_SIZE) {
       const content2 = fs2.readFileSync(resolved, "utf8").slice(0, MAX_FILE_SIZE);
       const lines2 = content2.split("\n").length;
-      const relativePath2 = path3.relative(projectRoot, resolved);
+      const relativePath2 = path5.relative(projectRoot, resolved);
       return { filePath: relativePath2, content: content2, lines: lines2, truncated: true };
     }
     const content = fs2.readFileSync(resolved, "utf8");
     const lines = content.split("\n").length;
-    const relativePath = path3.relative(projectRoot, resolved);
+    const relativePath = path5.relative(projectRoot, resolved);
     return { filePath: relativePath, content, lines, truncated: false };
   } catch {
     return null;
@@ -12135,11 +12642,11 @@ var init_autocomplete = __esm({
         const schemaMatches = this.schemaFiles.filter((f) => f.toLowerCase().includes(query.toLowerCase())).slice(0, 15).map((f) => ({ value: f, label: f, kind: "file" }));
         if (schemaMatches.length > 0) return schemaMatches;
         try {
-          const dir = query.includes("/") ? path3.join(this.projectRoot, path3.dirname(query)) : this.projectRoot;
-          const prefix = query.includes("/") ? path3.basename(query) : query;
+          const dir = query.includes("/") ? path5.join(this.projectRoot, path5.dirname(query)) : this.projectRoot;
+          const prefix = query.includes("/") ? path5.basename(query) : query;
           const entries = fs2.readdirSync(dir, { withFileTypes: true });
           return entries.filter((e) => e.name.startsWith(prefix) && !e.name.startsWith(".")).map((e) => {
-            const rel = path3.relative(this.projectRoot, path3.join(dir, e.name));
+            const rel = path5.relative(this.projectRoot, path5.join(dir, e.name));
             const value = e.isDirectory() ? `${rel}/` : rel;
             return { value, label: value, kind: "file" };
           }).slice(0, 15);
@@ -12600,8 +13107,7 @@ function ModelPicker() {
         description = `${description} \xB7 now routing to ${resolvedModelId}`;
       }
       if (!m.available) {
-        const reason = m.disabledReason === "paused" ? "AI is globally paused" : "admin-disabled for this workspace";
-        description = `${description} \xB7 ${reason}`;
+        description = `${description} \xB7 admin-disabled for this workspace`;
       }
       return {
         id: m.id,
@@ -13991,7 +14497,7 @@ var init_use_confirmation = __esm({
 var SESSIONS_DIR, SESSION_VERSION, SessionManager;
 var init_session_manager = __esm({
   "src/ai/services/session-manager.ts"() {
-    SESSIONS_DIR = path3.join(os.homedir(), ".relyio", "ai-sessions");
+    SESSIONS_DIR = path5.join(os.homedir(), ".relyio", "ai-sessions");
     SESSION_VERSION = 4;
     SessionManager = class {
       sessionsDir;
@@ -14000,13 +14506,13 @@ var init_session_manager = __esm({
         fs2.mkdirSync(this.sessionsDir, { recursive: true });
       }
       save(session) {
-        const filePath = path3.join(this.sessionsDir, `${session.id}.json`);
+        const filePath = path5.join(this.sessionsDir, `${session.id}.json`);
         session.version = SESSION_VERSION;
         session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
         fs2.writeFileSync(filePath, JSON.stringify(session, null, 2));
       }
       load(sessionId) {
-        const filePath = path3.join(this.sessionsDir, `${sessionId}.json`);
+        const filePath = path5.join(this.sessionsDir, `${sessionId}.json`);
         try {
           const content = fs2.readFileSync(filePath, "utf8");
           const parsed = JSON.parse(content);
@@ -14063,7 +14569,7 @@ var init_session_manager = __esm({
           const files = fs2.readdirSync(this.sessionsDir).filter((f) => f.endsWith(".json"));
           return files.map((f) => {
             try {
-              const content = fs2.readFileSync(path3.join(this.sessionsDir, f), "utf8");
+              const content = fs2.readFileSync(path5.join(this.sessionsDir, f), "utf8");
               const parsed = JSON.parse(content);
               if (parsed.version !== SESSION_VERSION && parsed.version !== 3 && parsed.version !== 2) {
                 return null;
@@ -14081,7 +14587,7 @@ var init_session_manager = __esm({
         return this.listAll().slice(0, count);
       }
       delete(sessionId) {
-        const filePath = path3.join(this.sessionsDir, `${sessionId}.json`);
+        const filePath = path5.join(this.sessionsDir, `${sessionId}.json`);
         try {
           fs2.unlinkSync(filePath);
           return true;
@@ -14119,7 +14625,7 @@ var init_snapshot_store = __esm({
     SnapshotStore = class {
       dir;
       constructor(sessionDir) {
-        this.dir = path3.join(sessionDir, "snapshots");
+        this.dir = path5.join(sessionDir, "snapshots");
         fs2.mkdirSync(this.dir, { recursive: true });
       }
       /**
@@ -14180,7 +14686,7 @@ var init_snapshot_store = __esm({
           const hash = entry.slice(0, -4);
           if (keepHashes.has(hash)) continue;
           try {
-            fs2.unlinkSync(path3.join(this.dir, entry));
+            fs2.unlinkSync(path5.join(this.dir, entry));
             removed++;
           } catch {
           }
@@ -14188,7 +14694,7 @@ var init_snapshot_store = __esm({
         return removed;
       }
       pathFor(hash) {
-        return path3.join(this.dir, `${hash}.bin`);
+        return path5.join(this.dir, `${hash}.bin`);
       }
     };
   }
@@ -14203,7 +14709,7 @@ var init_decision_log = __esm({
     DecisionLog = class {
       filePath;
       constructor(sessionDir) {
-        this.filePath = path3.join(sessionDir, "decisions.jsonl");
+        this.filePath = path5.join(sessionDir, "decisions.jsonl");
         if (!fs2.existsSync(this.filePath)) {
           fs2.writeFileSync(this.filePath, "", "utf8");
         }
@@ -14328,7 +14834,7 @@ var init_session_history = __esm({
   "src/ai/sessions/session-history.ts"() {
     init_snapshot_store();
     init_decision_log();
-    SESSIONS_ROOT = path3.join(os.homedir(), ".relyio", "ai-sessions");
+    SESSIONS_ROOT = path5.join(os.homedir(), ".relyio", "ai-sessions");
     MAX_UNDOABLE_EVENTS = 200;
     SessionHistory = class {
       sessionDir;
@@ -14337,7 +14843,7 @@ var init_session_history = __esm({
       projectRoot;
       constructor(args) {
         const root = args.sessionsRoot ?? SESSIONS_ROOT;
-        this.sessionDir = path3.join(root, args.sessionId);
+        this.sessionDir = path5.join(root, args.sessionId);
         fs2.mkdirSync(this.sessionDir, { recursive: true });
         this.snapshots = new SnapshotStore(this.sessionDir);
         this.log = new DecisionLog(this.sessionDir);
@@ -14498,11 +15004,11 @@ var init_session_history = __esm({
        * files via a malformed log entry.
        */
       async writeFileSafe(relPath, content) {
-        const fullPath = path3.resolve(this.projectRoot, relPath);
+        const fullPath = path5.resolve(this.projectRoot, relPath);
         if (!fullPath.startsWith(this.projectRoot)) {
           throw new Error(`Refusing to write outside project root: ${relPath}`);
         }
-        await fs2.promises.mkdir(path3.dirname(fullPath), { recursive: true });
+        await fs2.promises.mkdir(path5.dirname(fullPath), { recursive: true });
         await fs2.promises.writeFile(fullPath, content, "utf8");
       }
     };
@@ -14510,10 +15016,10 @@ var init_session_history = __esm({
 });
 function renameLocalSessionArtifacts(oldId, newId) {
   if (oldId === newId) return;
-  const oldTranscript = path3.join(SESSIONS_DIR2, `${oldId}.json`);
-  const newTranscript = path3.join(SESSIONS_DIR2, `${newId}.json`);
-  const oldHistoryDir = path3.join(SESSIONS_DIR2, oldId);
-  const newHistoryDir = path3.join(SESSIONS_DIR2, newId);
+  const oldTranscript = path5.join(SESSIONS_DIR2, `${oldId}.json`);
+  const newTranscript = path5.join(SESSIONS_DIR2, `${newId}.json`);
+  const oldHistoryDir = path5.join(SESSIONS_DIR2, oldId);
+  const newHistoryDir = path5.join(SESSIONS_DIR2, newId);
   try {
     if (fs2.existsSync(oldTranscript) && !fs2.existsSync(newTranscript)) {
       fs2.renameSync(oldTranscript, newTranscript);
@@ -14617,7 +15123,7 @@ var init_use_session_persistence = __esm({
     init_runtime_context();
     init_session_manager();
     init_session_history();
-    SESSIONS_DIR2 = path3.join(os.homedir(), ".relyio", "ai-sessions");
+    SESSIONS_DIR2 = path5.join(os.homedir(), ".relyio", "ai-sessions");
   }
 });
 
@@ -14639,8 +15145,8 @@ var init_proposals_client = __esm({
     init_gateway_url();
     AI_GATEWAY_PROPOSALS_PATH = "/ai/proposals";
     ProposalsClient = class {
-      async request(method, path23, init = {}) {
-        const url = new URL(`${getGatewayUrl()}${AI_GATEWAY_PROPOSALS_PATH}${path23}`);
+      async request(method, path25, init = {}) {
+        const url = new URL(`${getGatewayUrl()}${AI_GATEWAY_PROPOSALS_PATH}${path25}`);
         if (init.query) {
           for (const [k, v] of Object.entries(init.query)) url.searchParams.set(k, v);
         }
@@ -14656,7 +15162,7 @@ var init_proposals_client = __esm({
           const raw = await response.text().catch(() => "");
           const refusal = readError(parseJson(raw));
           throw new Error(
-            refusal === void 0 ? `Proposals API ${method} ${path23} \u2192 ${response.status}: ${raw}` : `Proposals API ${method} ${path23} \u2192 ${response.status} ${refusal.code}: ${refusal.messages.join(" ")}`
+            refusal === void 0 ? `Proposals API ${method} ${path25} \u2192 ${response.status}: ${raw}` : `Proposals API ${method} ${path25} \u2192 ${response.status} ${refusal.code}: ${refusal.messages.join(" ")}`
           );
         }
         return readPayload(await response.json());
@@ -15434,8 +15940,8 @@ function formatHistoryEntries(entries, status, limit) {
   const rows = entries.map((e) => {
     const time = new Date(e.timestamp).toLocaleTimeString();
     const glyph = decisionGlyph(e.kind);
-    const path23 = e.path || "\u2014";
-    return `  ${time}  ${glyph}  ${path23}`;
+    const path25 = e.path || "\u2014";
+    return `  ${time}  ${glyph}  ${path25}`;
   });
   return [header, "", ...rows, "", footer].join("\n");
 }
@@ -15673,11 +16179,10 @@ Tip: just type \`/model\` (no args) to pick interactively.`
       return;
     }
     if (!match.available) {
-      const reason = match.disabledReason === "paused" ? "AI is paused globally" : "this model is currently disabled by the workspace admin";
       ctx.dispatch({
         type: "SYSTEM_MESSAGE_APPENDED",
         label: "/model",
-        text: `Cannot switch to ${match.name} \u2014 ${reason}.`
+        text: `Cannot switch to ${match.name} \u2014 this model is currently disabled by the workspace admin.`
       });
       return;
     }
@@ -16063,7 +16568,7 @@ async function resolveContext(spec, flags, pins = {}) {
       acc.datasetId = pins.datasetId;
       acc.datasetName = await safeDatasetName(projectId, acc.branchId, pins.datasetId);
     } else {
-      const datasetOutcome = await resolveDataset(projectId, acc.branchId, flags.dataset);
+      const datasetOutcome = await resolveDataset2(projectId, acc.branchId, flags.dataset);
       if (datasetOutcome.kind === "needs-pick") {
         return { ...datasetOutcome, partial: acc };
       }
@@ -16137,7 +16642,7 @@ async function safeBranchName(projectId, branchId) {
     return void 0;
   }
 }
-async function resolveDataset(projectId, branchId, flag) {
+async function resolveDataset2(projectId, branchId, flag) {
   let datasets;
   try {
     datasets = await manage_default.getProjectDatasets(projectId, { branchId });
@@ -16717,223 +17222,55 @@ function confirm(message) {
 // src/api/auth.ts
 init_client();
 init_config();
+init_dist();
 var isDebug3 = () => process.env.DEBUG === "true" || process.env.DEBUG === "1";
-var HTML_TEMPLATES = {
-  success: (tokenName) => `
-    <html>
-      <head>
-        <title>RelyIO Authentication</title>
-        <meta name="viewport" content="width=device-width, initial-scale=1.0">
-        <style>
-          body {
-            font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-            text-align: center;
-            padding: 2rem;
-            max-width: 600px;
-            margin: 0 auto;
-            line-height: 1.5;
-            color: #333;
-          }
-          h1 { color: #38a169; margin-bottom: 1rem; }
-          p { margin-bottom: 1rem; }
-        </style>
-      </head>
-      <body>
-        <h1>Authentication Successful</h1>
-        <p>${tokenName ? `Personal access token "${tokenName}" created successfully.` : "You have successfully authenticated."}</p>
-        <p>You can close this window and return to the CLI.</p>
-      </body>
-    </html>
-  `,
-  error: (message) => `
-    <html>
-      <head>
-        <title>RelyIO Authentication Error</title>
-        <meta name="viewport" content="width=device-width, initial-scale=1.0">
-        <style>
-          body {
-            font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-            text-align: center;
-            padding: 2rem;
-            max-width: 600px;
-            margin: 0 auto;
-            line-height: 1.5;
-            color: #333;
-          }
-          h1 { color: #e53e3e; margin-bottom: 1rem; }
-          p { margin-bottom: 1rem; }
-        </style>
-      </head>
-      <body>
-        <h1>Authentication Failed</h1>
-        <p>${message}</p>
-        <p>Please try again or contact support if the issue persists.</p>
-      </body>
-    </html>
-  `,
-  serverError: (message) => `
-    <html>
-      <head>
-        <title>RelyIO Server Error</title>
-        <meta name="viewport" content="width=device-width, initial-scale=1.0">
-        <style>
-          body {
-            font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-            text-align: center;
-            padding: 2rem;
-            max-width: 600px;
-            margin: 0 auto;
-            line-height: 1.5;
-            color: #333;
-          }
-          h1 { color: #e53e3e; margin-bottom: 1rem; }
-          p { margin-bottom: 1rem; }
-        </style>
-      </head>
-      <body>
-        <h1>Internal Error</h1>
-        <p>An unexpected error occurred during authentication:</p>
-        <p>${message}</p>
-        <p>Please try again or contact support if the issue persists.</p>
-      </body>
-    </html>
-  `
-};
+var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
 async function login(email, password) {
   const response = await client_default.post("/auth/login", { email, password });
   await config_default.storeAuthToken(response.token);
   return response;
 }
 async function browserLogin() {
-  const server = http.createServer();
-  await new Promise((resolve) => server.listen(0, resolve));
-  const { port } = server.address();
-  const callbackUrl = `http://localhost:${port}`;
-  const deviceName = os__default.hostname();
   const dashboardUrl = config_default.getDashboardUrl();
   if (!dashboardUrl) {
     throw new Error(
       "Dashboard URL is not configured. Please run the command with --dashboard-url option."
     );
   }
-  const authUrl = `${dashboardUrl}/auth/cli-login?callback=${encodeURIComponent(callbackUrl)}&device_name=${encodeURIComponent(deviceName)}`;
+  const state = randomBytes(32).toString("base64url");
+  const server = await startCallbackServer({ callbackPath: "/" });
   try {
-    await open(authUrl);
-    console.log(success("Browser opened successfully"));
-  } catch (error2) {
-    console.error(error(`Failed to open browser: ${error2.message}`));
-    throw new Error(`Failed to open browser: ${error2.message}`);
-  }
-  console.log(info("Waiting for authentication to complete..."));
-  const tokenData = await new Promise((resolve, reject) => {
-    const timeoutId = setTimeout(
-      () => {
-        cleanupServer(server);
-        reject(new Error("Authentication timed out. Please try again."));
-      },
-      5 * 60 * 1e3
-    );
-    let authProcessed = false;
-    server.on("request", async (req, res) => {
-      try {
-        const reqUrl = new URL(req.url || "", `http://localhost:${port}`);
-        const params = reqUrl.searchParams;
-        const token = params.get("token");
-        const expires_at = params.get("expires_at");
-        const token_name = params.get("token_name");
-        if (!authProcessed && token) {
-          authProcessed = true;
-          clearTimeout(timeoutId);
-          try {
-            await (token_name && expires_at ? config_default.storePAT(token, token_name, expires_at) : config_default.storeAuthToken(token));
-            sendHtmlResponse(res, 200, HTML_TEMPLATES.success(token_name || void 0));
-            let user;
-            try {
-              user = await getCurrentUser();
-            } catch (userError) {
-              if (isDebug3()) console.error("[relyio-cli][debug] fetch user failed:", userError);
-              user = {
-                id: "unknown",
-                email: "unknown",
-                name: "Unknown User"
-              };
-            }
-            cleanupServer(server);
-            resolve({
-              token,
-              user
-            });
-          } catch (storageError) {
-            if (isDebug3()) console.error("[relyio-cli][debug] token storage:", storageError);
-            sendHtmlResponse(
-              res,
-              500,
-              HTML_TEMPLATES.serverError("Failed to store authentication token")
-            );
-            cleanupServer(server);
-            reject(storageError);
-          }
-        } else if (!authProcessed && params.has("error")) {
-          authProcessed = true;
-          const errorMsg = params.get("error") || "Authentication failed or was canceled.";
-          sendHtmlResponse(res, 400, HTML_TEMPLATES.error(errorMsg));
-          cleanupServer(server);
-          reject(new Error(errorMsg));
-        } else {
-          if (!token && !authProcessed) {
-            if (!res.headersSent) {
-              res.writeHead(200, { "Content-Type": "text/plain" });
-              res.end("Waiting for authentication to complete...");
-            }
-          } else if (authProcessed && !res.headersSent) {
-            res.writeHead(200, { "Content-Type": "text/plain" });
-            res.end("Authentication already processed. You can close this window.");
-          }
-        }
-      } catch (error2) {
-        if (isDebug3()) console.error("[relyio-cli][debug] callback processing:", error2);
-        if (authProcessed) {
-          if (!res.headersSent) {
-            res.writeHead(500, { "Content-Type": "text/plain" });
-            res.end("Error occurred, but authentication was already processed.");
-          }
-        } else {
-          authProcessed = true;
-          if (!res.headersSent) {
-            sendHtmlResponse(
-              res,
-              500,
-              HTML_TEMPLATES.serverError(error2.message || "Unknown error")
-            );
-          }
-          cleanupServer(server);
-          reject(error2);
-        }
-      }
-    });
-  });
-  return tokenData;
-}
-function sendHtmlResponse(res, statusCode, html) {
-  if (!res.headersSent) {
-    res.writeHead(statusCode, {
-      "Content-Type": "text/html; charset=utf-8",
-      "Cache-Control": "no-store, no-cache, must-revalidate"
-    });
-    res.end(html);
+    const authUrl = new URL("/auth/cli-login", dashboardUrl);
+    authUrl.searchParams.set("callback", server.redirectUri);
+    authUrl.searchParams.set("device_name", os__default.hostname());
+    authUrl.searchParams.set("state", state);
+    try {
+      await open(authUrl.toString());
+      console.log(success("Browser opened successfully"));
+    } catch (error2) {
+      console.error(error(`Failed to open browser: ${error2.message}`));
+      throw new Error(`Failed to open browser: ${error2.message}`);
+    }
+    console.log(info("Waiting for authentication to complete..."));
+    const handOff = await server.waitForCallback(state, LOGIN_TIMEOUT_MS);
+    const token = handOff.get("token");
+    const tokenName = handOff.get("token_name");
+    const expiresAt = handOff.get("expires_at");
+    if (token === null || token === "") {
+      throw new Error("The sign-in callback carried no token.");
+    }
+    await (tokenName && expiresAt ? config_default.storePAT(token, tokenName, expiresAt) : config_default.storeAuthToken(token));
+    return { token, user: await currentUserOrStub() };
+  } finally {
+    server.close();
   }
 }
-function cleanupServer(server) {
+async function currentUserOrStub() {
   try {
-    server.close();
-    if (typeof server.closeAllConnections === "function") {
-      server.closeAllConnections();
-    }
-    const exitTimeout = setTimeout(() => {
-    }, 100);
-    exitTimeout.unref();
-  } catch (error2) {
-    if (isDebug3()) console.error("[relyio-cli][debug] server close:", error2);
+    return await getCurrentUser();
+  } catch (userError) {
+    if (isDebug3()) console.error("[relyio-cli][debug] fetch user failed:", userError);
+    return { id: "unknown", email: "unknown", name: "Unknown User" };
   }
 }
 async function logout() {
@@ -17020,18 +17357,17 @@ init_client();
 async function getProjects() {
   return await client_default.get("/projects");
 }
-var __filename = fileURLToPath(import.meta.url);
-var __dirname = path3.dirname(__filename);
+var __dirname = path5.dirname(fileURLToPath(import.meta.url));
 function getTemplatesDir() {
   const override = process.env.RELYIO_CLI_TEMPLATES_DIR;
   const candidates = [
-    override ? path3.resolve(override) : null,
+    override ? path5.resolve(override) : null,
     // dist/index.js → ../templates  (built layout)
-    path3.resolve(__dirname, "..", "templates"),
-    // src/commands/init.ts → ../../templates  (source layout)
-    path3.resolve(__dirname, "..", "..", "templates"),
-    // src/commands/init.ts → ../../../templates  (just in case dist gets nested)
-    path3.resolve(__dirname, "..", "..", "..", "templates")
+    path5.resolve(__dirname, "..", "templates"),
+    // src/utils/templates-dir.ts → ../../templates  (source layout)
+    path5.resolve(__dirname, "..", "..", "templates"),
+    // src/utils/templates-dir.ts → ../../../templates  (just in case dist gets nested)
+    path5.resolve(__dirname, "..", "..", "..", "templates")
   ].filter((p) => p !== null);
   for (const candidate of candidates) {
     if (existsSync(candidate)) return candidate;
@@ -17042,10 +17378,402 @@ function getTemplatesDir() {
 Set RELYIO_CLI_TEMPLATES_DIR to point at the templates folder, or reinstall the CLI.`
   );
 }
+function schemaTemplateNames(templatesDir) {
+  return readdirSync(templatesDir).filter((item) => {
+    const fullPath = path5.join(templatesDir, item);
+    return statSync(fullPath).isDirectory() && item !== "node_modules" && !item.startsWith(".") && existsSync(path5.join(fullPath, "schemas"));
+  }).sort();
+}
+
+// src/commands/init-next.ts
+init_config();
+init_manage();
+var NEXT_ENV = {
+  apiKey: "RELYIO_API_KEY",
+  previewApiKey: "RELYIO_PREVIEW_API_KEY",
+  webhookSecret: "RELYIO_WEBHOOK_SECRET"
+};
+var REVALIDATE_PATH = "/api/relyio/revalidate";
+var REVALIDATION_EVENTS = [
+  "entry.published",
+  "entry.unpublished",
+  "entry.deleted",
+  "entry.archived",
+  "entry.restored"
+];
+var WEBHOOK_ACTION_SLUG = "http-post";
+var ENV_FILE = ".env.local";
+var FRAMEWORK_DIR = path5.join("frameworks", "next");
+var TEMPLATE_SUFFIX = ".tmpl";
+var DATASET_PLACEHOLDER = "{{DATASET}}";
+var NEXT_CONFIG = "next.config.ts";
+var NEXT_CONFIG_NAMES = [
+  "next.config.ts",
+  "next.config.mts",
+  "next.config.js",
+  "next.config.mjs",
+  "next.config.cjs"
+];
+function revalidationUrl(siteUrl) {
+  let parsed;
+  try {
+    parsed = new URL(siteUrl);
+  } catch {
+    throw new Error(`Outbound URL is not a valid URL: ${siteUrl}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(
+      `Outbound URL protocol "${parsed.protocol}" is not allowed (only http: and https:)`
+    );
+  }
+  const hostname = parsed.hostname.toLowerCase();
+  if (["localhost", "broadcasthost", "ip6-localhost", "ip6-loopback"].includes(hostname) || hostname.endsWith(".localhost") || hostname.endsWith(".local")) {
+    throw new Error(
+      `Outbound URL hostname "${hostname}" is not allowed. The webhook is sent to your deployed site; pass its public URL as --site-url.`
+    );
+  }
+  const address = hostname.replaceAll(/^\[|\]$/g, "");
+  if (isLocalAddress(address)) {
+    throw new Error(
+      `Outbound URL IP "${address}" is in a private/loopback range. The webhook is sent to your deployed site; pass its public URL as --site-url.`
+    );
+  }
+  const base = `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
+  return `${base}${REVALIDATE_PATH}`;
+}
+function isLocalAddress(address) {
+  const v4 = /^(\d{1,3})\.(\d{1,3})\.\d{1,3}\.\d{1,3}$/.exec(address);
+  if (v4) {
+    const a = Number(v4[1]);
+    const b = Number(v4[2]);
+    return a === 0 || a === 127 || a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
+  }
+  if (!address.includes(":")) return false;
+  return address === "::" || address === "::1" || /^f[cd][0-9a-f]{2}:/.test(address) || /^fe[89ab][0-9a-f]:/.test(address);
+}
+function assignmentOf(name) {
+  return new RegExp(`^(\\s*(?:export\\s+)?)${name}(?:\\s*=|:\\s)(.*)$`);
+}
+function parseEnvValue(raw) {
+  const value = raw.trim();
+  const quote = value[0];
+  if (quote === '"' || quote === "'" || quote === "`") {
+    const end = value.indexOf(quote, 1);
+    return end === -1 ? value.slice(1) : value.slice(1, end);
+  }
+  return (value.split("#")[0] ?? "").trim();
+}
+function readEnvValue(content, name) {
+  if (content === null) return void 0;
+  const pattern = assignmentOf(name);
+  let value;
+  for (const line of content.split(/\r?\n/)) {
+    const match = pattern.exec(line);
+    if (match) value = parseEnvValue(match[2] ?? "");
+  }
+  return value === void 0 || value === "" ? void 0 : value;
+}
+function upsertEnv(content, values) {
+  const source = content ?? "";
+  const eol = source.includes("\r\n") ? "\r\n" : "\n";
+  const lines = source.split(/\r?\n/);
+  if (lines.at(-1) === "") lines.pop();
+  const written = [];
+  const kept = [];
+  for (const [name, value] of Object.entries(values)) {
+    if (readEnvValue(source, name) !== void 0) {
+      kept.push(name);
+      continue;
+    }
+    const pattern = assignmentOf(name);
+    let last = -1;
+    for (const [index, line] of lines.entries()) {
+      if (pattern.test(line)) last = index;
+    }
+    if (last === -1) {
+      lines.push(`${name}=${value}`);
+    } else {
+      const prefix = pattern.exec(lines[last] ?? "")?.[1] ?? "";
+      lines[last] = `${prefix}${name}=${value}`;
+    }
+    written.push(name);
+  }
+  if (written.length === 0) return { content: source, written, kept };
+  return { content: `${lines.join(eol)}${eol}`, written, kept };
+}
+function renderNextTemplate(source, dataset) {
+  const literal = dataset.replaceAll("\\", "\\\\").replaceAll("'", String.raw`\'`);
+  return source.replaceAll(DATASET_PLACEHOLDER, literal);
+}
+function nextTemplateFiles(templatesDir = getTemplatesDir()) {
+  const root = path5.join(templatesDir, FRAMEWORK_DIR);
+  const found = [];
+  const walk2 = (directory) => {
+    for (const name of readdirSync(directory)) {
+      const full = path5.join(directory, name);
+      if (statSync(full).isDirectory()) walk2(full);
+      else if (name.endsWith(TEMPLATE_SUFFIX)) found.push(path5.relative(root, full));
+    }
+  };
+  walk2(root);
+  return found.sort();
+}
+function writeNextScaffold(cwd, dataset, templatesDir = getTemplatesDir()) {
+  const useSrc = existsSync(path5.join(cwd, "src", "app")) && !existsSync(path5.join(cwd, "app"));
+  const files = [];
+  let nextConfigToMerge;
+  for (const template of nextTemplateFiles(templatesDir)) {
+    const text = renderNextTemplate(
+      readFileSync(path5.join(templatesDir, FRAMEWORK_DIR, template), "utf8"),
+      dataset
+    );
+    let target = template.slice(0, -TEMPLATE_SUFFIX.length).split(path5.sep).join("/");
+    if (target === NEXT_CONFIG) {
+      const existing = NEXT_CONFIG_NAMES.find((name) => existsSync(path5.join(cwd, name)));
+      if (existing !== void 0) {
+        nextConfigToMerge = { file: existing, fragment: text };
+        continue;
+      }
+    }
+    if (useSrc && (target.startsWith("app/") || target.startsWith("lib/"))) {
+      target = `src/${target}`;
+    }
+    const destination = path5.join(cwd, target);
+    if (existsSync(destination)) {
+      const current = readFileSync(destination, "utf8");
+      files.push({ path: target, outcome: current === text ? "unchanged" : "kept" });
+      continue;
+    }
+    mkdirSync(path5.dirname(destination), { recursive: true });
+    writeFileSync(destination, text);
+    files.push({ path: target, outcome: "written" });
+  }
+  return { files, nextConfigToMerge };
+}
+var defaultIo = () => ({
+  cwd: process.cwd(),
+  log: (line) => console.log(line),
+  interactive: process.stdin.isTTY === true
+});
+function named(text, max) {
+  return text.trim().slice(0, max);
+}
+async function runInitNext(options, io = defaultIo()) {
+  const { cwd, log } = io;
+  const projectId = options.project ?? config_default.getProjectId();
+  if (projectId === void 0 || projectId === "") {
+    throw new Error("No project. Run 'relyio link' in this directory, or pass --project <id>.");
+  }
+  const url = revalidationUrl(await requireSiteUrl(options.siteUrl, io.interactive));
+  const site = new URL(url).host;
+  const dataset = await resolveDataset(projectId, options.dataset, io.interactive);
+  const connections = await getProjectConnections(projectId);
+  const conflicting = connections.find(
+    (connection) => connection.type === "webhook" && connection.config.url === url
+  );
+  if (conflicting !== void 0) {
+    throw new Error(
+      `A webhook Connection to ${url} already exists: "${conflicting.name}" (${conflicting.id}). Nothing was created. Delete it and its Automation in the dashboard, or pass another --site-url, and run again.`
+    );
+  }
+  const envPath = path5.join(cwd, ENV_FILE);
+  const envBefore = existsSync(envPath) ? readFileSync(envPath, "utf8") : null;
+  let envNow = envBefore;
+  const written = [];
+  const kept = Object.values(NEXT_ENV).filter((name) => readEnvValue(envBefore, name) !== void 0);
+  const persist = (name, value) => {
+    const update = upsertEnv(envNow, { [name]: value });
+    if (update.written.length === 0) return;
+    writeFileSync(envPath, update.content, { mode: 384 });
+    envNow = update.content;
+    written.push(...update.written);
+  };
+  const created = [];
+  try {
+    let publishedKey;
+    let previewKey;
+    const signingSecret = readEnvValue(envBefore, NEXT_ENV.webhookSecret) ?? randomBytes(32).toString("hex");
+    persist(NEXT_ENV.webhookSecret, signingSecret);
+    if (readEnvValue(envBefore, NEXT_ENV.apiKey) === void 0) {
+      const key = await createProjectApiKey(projectId, {
+        name: named(`Next.js ${site} published`, 80),
+        keyType: "production",
+        readOnly: true,
+        defaultDatasetId: dataset.id,
+        allowedDatasetIds: [dataset.id]
+      });
+      publishedKey = { id: key.id, name: key.name };
+      created.push(`API key "${key.name}" (${key.id})`);
+      persist(NEXT_ENV.apiKey, requireToken(key.token, "published"));
+    }
+    if (readEnvValue(envBefore, NEXT_ENV.previewApiKey) === void 0) {
+      const key = await createProjectApiKey(projectId, {
+        name: named(`Next.js ${site} preview`, 80),
+        keyType: "preview",
+        previewScope: "drafts",
+        defaultDatasetId: dataset.id,
+        allowedDatasetIds: [dataset.id]
+      });
+      previewKey = { id: key.id, name: key.name };
+      created.push(`API key "${key.name}" (${key.id})`);
+      persist(NEXT_ENV.previewApiKey, requireToken(key.token, "preview"));
+    }
+    const connection = await createConnection(projectId, {
+      name: named(`Next.js revalidation ${site}`, 100),
+      type: "webhook",
+      config: { url, signingSecret }
+    });
+    created.push(`Connection "${connection.name}" (${connection.id})`);
+    const automation = await createAutomation(projectId, {
+      name: named(`Revalidate ${site} on entry changes`, 100),
+      events: [...REVALIDATION_EVENTS],
+      connectionId: connection.id,
+      actionSlug: WEBHOOK_ACTION_SLUG,
+      filterDatasets: [dataset.id]
+    });
+    created.push(`Automation "${automation.name}" (${automation.id})`);
+    const scaffold = writeNextScaffold(cwd, dataset.name);
+    const result = {
+      dataset: { id: dataset.id, name: dataset.name },
+      publishedKey,
+      previewKey,
+      connection: { id: connection.id, name: connection.name, url },
+      automation: { id: automation.id, name: automation.name },
+      env: { written, kept },
+      scaffold
+    };
+    report(result, log);
+    return result;
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    const partial = created.length === 0 ? "" : `
+Created before the failure: ${created.join("; ")}. Keys and the secret are in ${ENV_FILE}; run again to finish.`;
+    throw new Error(`${message}${partial}`);
+  }
+}
+function requireToken(token, kind) {
+  if (typeof token !== "string" || token === "") {
+    throw new Error(`manage minted the ${kind} key but served no token for it`);
+  }
+  return token;
+}
+async function requireSiteUrl(siteUrl, interactive) {
+  if (siteUrl !== void 0) return siteUrl;
+  if (!interactive) {
+    throw new Error(
+      "Pass --site-url <url>: your deployed site's URL, which the revalidation webhook targets."
+    );
+  }
+  const { answer } = await inquirer2.prompt([
+    {
+      type: "input",
+      name: "answer",
+      message: "Your deployed site's URL (the revalidation webhook targets it):",
+      validate: (input) => {
+        try {
+          revalidationUrl(input);
+          return true;
+        } catch (error2) {
+          return error2.message;
+        }
+      }
+    }
+  ]);
+  return answer;
+}
+async function resolveDataset(projectId, name, interactive) {
+  if (name !== void 0) {
+    const found = await getProjectDatasets(projectId, { q: name });
+    const match = found.find((d) => d.name === name);
+    if (match === void 0) {
+      throw new Error(
+        `No dataset named "${name}" in project ${projectId}. Run without --dataset to pick one.`
+      );
+    }
+    return match;
+  }
+  const datasets = await getProjectDatasets(projectId);
+  const names = datasets.map((d) => d.name).join(", ");
+  if (!interactive) {
+    throw new Error(`Pass --dataset <name>. This project's datasets: ${names}`);
+  }
+  const { answer } = await inquirer2.prompt([
+    {
+      type: "list",
+      name: "answer",
+      message: "Dataset the site reads:",
+      choices: datasets.map((d) => ({ name: d.name, value: d.id })),
+      default: datasets.find((d) => d.isDefault)?.id
+    }
+  ]);
+  const chosen = datasets.find((d) => d.id === answer);
+  if (chosen === void 0) throw new Error(`No dataset with id ${answer}`);
+  return chosen;
+}
+function report(result, log) {
+  const row = (label, value) => log(`  ${label.padEnd(15)}${value}`);
+  const kept = (name) => `kept the ${name} already in ${ENV_FILE}; none minted`;
+  log(success("Provisioned RelyIO for this Next.js app"));
+  row("Dataset", `${result.dataset.name} (${result.dataset.id})`);
+  row(
+    "Published key",
+    result.publishedKey ? `${result.publishedKey.name} (${result.publishedKey.id})` : kept(NEXT_ENV.apiKey)
+  );
+  row(
+    "Preview key",
+    result.previewKey ? `${result.previewKey.name} (${result.previewKey.id})` : kept(NEXT_ENV.previewApiKey)
+  );
+  row(
+    "Connection",
+    `${result.connection.name} (${result.connection.id}) \u2192 ${result.connection.url}`
+  );
+  row("Automation", `${result.automation.name} (${result.automation.id})`);
+  row(
+    ENV_FILE,
+    [
+      result.env.written.length > 0 ? `wrote ${result.env.written.join(", ")}` : "",
+      result.env.kept.length > 0 ? `kept ${result.env.kept.join(", ")}` : ""
+    ].filter(Boolean).join("; ")
+  );
+  for (const file of result.scaffold.files) {
+    row(file.outcome, file.outcome === "kept" ? `${file.path} (differs; left as is)` : file.path);
+  }
+  if (result.scaffold.nextConfigToMerge) {
+    log(
+      warning(
+        `${result.scaffold.nextConfigToMerge.file} exists and was not edited. Merge its images block:`
+      )
+    );
+    log(result.scaffold.nextConfigToMerge.fragment);
+  }
+  log(
+    info(
+      `Set ${Object.values(NEXT_ENV).join(", ")} in your host's environment too: the webhook reaches the deployed site, which does not read ${ENV_FILE}.`
+    )
+  );
+}
+
+// src/commands/init.ts
+var FRAMEWORK_TEMPLATES = ["next"];
 async function handleInit(options) {
+  if (options.template !== void 0) {
+    if (options.example !== void 0) {
+      throw new Error(
+        "--template scaffolds a framework app and --example picks a schema template; pass one."
+      );
+    }
+    if (options.template !== "next") {
+      throw new Error(
+        `Unknown --template '${options.template}'. Available: ${FRAMEWORK_TEMPLATES.join(", ")}`
+      );
+    }
+    await requireAuth();
+    await runInitNext(options);
+    return;
+  }
   console.log(heading("Initialize a new RelyIO project"));
   if (config_default.isProjectInitialized()) {
-    const { shouldReinitialize } = await inquirer.prompt([
+    const { shouldReinitialize } = await inquirer2.prompt([
       {
         type: "confirm",
         name: "shouldReinitialize",
@@ -17079,7 +17807,7 @@ async function handleInit(options) {
   }
 }
 async function collectProjectInfo(options) {
-  const { directory } = await inquirer.prompt([
+  const { directory } = await inquirer2.prompt([
     {
       type: "input",
       name: "directory",
@@ -17087,7 +17815,7 @@ async function collectProjectInfo(options) {
       default: process.cwd()
     }
   ]);
-  const { projectName } = await inquirer.prompt([
+  const { projectName } = await inquirer2.prompt([
     {
       type: "input",
       name: "projectName",
@@ -17101,12 +17829,7 @@ async function collectProjectInfo(options) {
     console.error(error(`Templates directory not found at: ${templatesDir}`));
     process.exit(1);
   }
-  const dirContents = readdirSync(templatesDir);
-  const templates = dirContents.filter((item) => {
-    const fullPath = path3.join(templatesDir, item);
-    const stats = statSync(fullPath);
-    return stats.isDirectory() && item !== "node_modules" && !item.startsWith(".");
-  }).map((template) => {
+  const templates = schemaTemplateNames(templatesDir).map((template) => {
     const description = (() => {
       switch (template) {
         case "bare": {
@@ -17134,7 +17857,7 @@ async function collectProjectInfo(options) {
     }
     console.log(heading("\nSelect a template for your project"));
     console.log(info("Use \u2191 and \u2193 arrow keys to select, then press Enter\n"));
-    const { selectedExample } = await inquirer.prompt([
+    const { selectedExample } = await inquirer2.prompt([
       {
         type: "list",
         name: "selectedExample",
@@ -17159,7 +17882,7 @@ async function collectProjectInfo(options) {
     try {
       existingProjects = await getProjects();
       if (existingProjects.length > 0) {
-        const { linkType } = await inquirer.prompt([
+        const { linkType } = await inquirer2.prompt([
           {
             type: "list",
             name: "linkType",
@@ -17173,7 +17896,7 @@ async function collectProjectInfo(options) {
         ]);
         if (linkType === "existing") {
           createProject = false;
-          const { selectedProject } = await inquirer.prompt([
+          const { selectedProject } = await inquirer2.prompt([
             {
               type: "list",
               name: "selectedProject",
@@ -17208,12 +17931,12 @@ async function collectProjectInfo(options) {
 }
 function createProjectStructure(context) {
   const { directory, example = "bare" } = context;
-  const relyioDir = path3.resolve(directory, "relyio");
+  const relyioDir = path5.resolve(directory, "relyio");
   if (!existsSync(relyioDir)) {
     mkdirSync(relyioDir, { recursive: true });
   }
   const templatesDir = getTemplatesDir();
-  const templateDir = path3.resolve(templatesDir, example);
+  const templateDir = path5.resolve(templatesDir, example);
   if (!existsSync(templateDir)) {
     throw new Error(
       `Template '${example}' not found. Available templates: ${existsSync(templatesDir) ? readdirSync(templatesDir).join(", ") : "none"}`
@@ -17226,7 +17949,7 @@ function createProjectStructure(context) {
     if (isDirectory) {
       if (!existsSync(dest)) mkdirSync(dest, { recursive: true });
       for (const childItemName of readdirSync(src)) {
-        copyRecursive(path3.join(src, childItemName), path3.join(dest, childItemName));
+        copyRecursive(path5.join(src, childItemName), path5.join(dest, childItemName));
       }
     } else {
       cpSync(src, dest);
@@ -17242,7 +17965,13 @@ function initCommand(program2) {
     (options) => handleInit(options),
     false
     // Don't require auth for init command
-  ).option("--example <type>", "Initialize with an example template (bare or blog)");
+  ).option("--example <type>", "Initialize with an example template (bare or blog)").option(
+    "--template <framework>",
+    "Scaffold a framework app and provision its keys, webhook and env file (next)"
+  ).option(
+    "--site-url <url>",
+    "With --template next: your deployed site's URL; the revalidation webhook targets it"
+  ).option("--dataset <name>", "With --template next: the dataset the site reads").option("--project <id>", "With --template next: the project id (default: the linked project)");
 }
 init_config();
 async function handleLogin(options) {
@@ -17268,7 +17997,7 @@ async function handleLogin(options) {
     try {
       const user = await auth_default.getCurrentUser();
       console.log(warning(`You are already logged in as ${colors.highlight(user.email)}`));
-      const { shouldLogout } = await inquirer.prompt([
+      const { shouldLogout } = await inquirer2.prompt([
         {
           type: "confirm",
           name: "shouldLogout",
@@ -18578,60 +19307,51 @@ async function pollTaskUntilDone(projectId, taskId, options = {}) {
 
 // src/commands/promote.ts
 init_config();
-var DEV_CONTEXT_DIR = ".relyio";
-var DEV_CONTEXT_FILE = path3.join(DEV_CONTEXT_DIR, "dev.json");
-var GITIGNORE_ENTRY = `${DEV_CONTEXT_DIR}/dev.json`;
+
+// src/dev/dev-context.ts
+init_dist();
+init_dev_handshake();
 function devContextPath(projectRoot) {
-  return path3.join(projectRoot, DEV_CONTEXT_FILE);
+  return path5.join(projectRoot, DEV_CONTEXT_FILE);
 }
 async function writeDevContext(projectRoot, context) {
-  await mkdir(path3.join(projectRoot, DEV_CONTEXT_DIR), { recursive: true });
-  await writeFile(devContextPath(projectRoot), `${JSON.stringify(context, null, 2)}
-`, "utf8");
+  writeSecretFile(devContextPath(projectRoot), context);
   await ensureGitignore(projectRoot);
 }
 async function readDevContext(projectRoot) {
+  let raw;
   try {
-    const raw = await readFile(devContextPath(projectRoot), "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed.datasetId === "string" && typeof parsed.previewApiKey === "string" && typeof parsed.branchId === "string") {
-      return {
-        datasetId: parsed.datasetId,
-        previewApiKey: parsed.previewApiKey,
-        branchId: parsed.branchId,
-        expiresAt: typeof parsed.expiresAt === "string" ? parsed.expiresAt : null
-      };
-    }
-    return null;
+    raw = await readFile(devContextPath(projectRoot), "utf8");
   } catch {
-    return null;
+    return { state: "absent" };
   }
+  return parseDevContextFile(raw, Date.now());
 }
 async function clearDevContext(projectRoot) {
   await rm(devContextPath(projectRoot), { force: true }).catch(() => {
   });
 }
 async function ensureGitignore(projectRoot) {
-  const gitignorePath = path3.join(projectRoot, ".gitignore");
+  const gitignorePath = path5.join(projectRoot, ".gitignore");
   if (!existsSync(gitignorePath)) {
     await writeFile(
       gitignorePath,
       `# RelyIO sandbox dev artifact (contains a scoped preview key \u2014 never commit)
-${GITIGNORE_ENTRY}
+${DEV_CONTEXT_FILE}
 `,
       "utf8"
     );
     return;
   }
   const current = await readFile(gitignorePath, "utf8");
-  const alreadyIgnored = current.split(/\r?\n/).map((line) => line.trim()).some((line) => line === GITIGNORE_ENTRY || line === `/${GITIGNORE_ENTRY}`);
+  const alreadyIgnored = current.split(/\r?\n/).map((line) => line.trim()).some((line) => line === DEV_CONTEXT_FILE || line === `/${DEV_CONTEXT_FILE}`);
   if (alreadyIgnored) return;
   const prefix = current.endsWith("\n") || current.length === 0 ? "" : "\n";
   await writeFile(
     gitignorePath,
     `${current}${prefix}
 # RelyIO sandbox dev artifact (contains a scoped preview key \u2014 never commit)
-${GITIGNORE_ENTRY}
+${DEV_CONTEXT_FILE}
 `,
     "utf8"
   );
@@ -18648,12 +19368,13 @@ function requireProjectId() {
   return projectId;
 }
 async function resolveActiveSandbox(projectId) {
+  const artifact = await readDevContext(process.cwd());
   const sandboxes = await sandbox_default.listSandboxes(projectId);
-  if (sandboxes.length === 0) return null;
-  const devContext = await readDevContext(process.cwd());
-  if (devContext) {
-    const byArtifact = sandboxes.find((s) => s.branch.id === devContext.branchId);
-    if (byArtifact) return byArtifact;
+  if (sandboxes.length === 0) return { sandbox: null, artifact };
+  if (artifact.state === "expired") return { sandbox: null, artifact };
+  if (artifact.state === "active") {
+    const byArtifact = sandboxes.find((s) => s.branch.id === artifact.context.branchId);
+    if (byArtifact) return { sandbox: byArtifact, artifact };
   }
   const gitBranch = getCurrentGitBranch();
   if (gitBranch) {
@@ -18662,12 +19383,25 @@ async function resolveActiveSandbox(projectId) {
       const parent = branches.find((b) => b.name === gitBranch);
       if (parent) {
         const byParent = sandboxes.find((s) => s.branch.parentBranchId === parent.id);
-        if (byParent) return byParent;
+        if (byParent) return { sandbox: byParent, artifact };
       }
     } catch {
     }
   }
-  return sandboxes.length === 1 ? sandboxes[0] : null;
+  return { sandbox: sandboxes.length === 1 ? sandboxes[0] : null, artifact };
+}
+function reportArtifact(artifact) {
+  if (artifact.state === "expired") {
+    displayWarning(
+      `Your sandbox's local dev artifact expired at ${artifact.expiredAt}.`,
+      "It can no longer identify which sandbox to promote, and guessing from your git branch could promote a different one. Run `relyio dev` to refresh it, then promote."
+    );
+  } else if (artifact.state === "unreadable") {
+    displayWarning(
+      `Your \`.relyio/dev.json\` could not be read (${artifact.reason}).`,
+      "Your app is not reading the sandbox. Delete the file and run `relyio dev` to rewrite it."
+    );
+  }
 }
 async function resolveTargetBranch(projectId, requested, defaultParentBranchId) {
   const branches = await manage_default.getProjectBranches(projectId);
@@ -18688,14 +19422,16 @@ async function handlePromote(options) {
   displayHeader("RelyIO Promote", "Flush your sandbox into a real branch");
   const projectId = requireProjectId();
   const spinner2 = createSpinner("Resolving your active sandbox...");
-  const sandbox = await resolveActiveSandbox(projectId);
+  const { sandbox, artifact } = await resolveActiveSandbox(projectId);
   if (!sandbox) {
     spinner2.fail("No active sandbox found");
+    reportArtifact(artifact);
     displayInfo("Start one with `relyio dev`, then run `relyio promote` again.");
     process.exit(1);
     return;
   }
   spinner2.succeed(`Sandbox: ${sandbox.branch.name}`);
+  reportArtifact(artifact);
   const target = await resolveTargetBranch(projectId, options.branch, sandbox.branch.parentBranchId);
   if (!target) {
     displayError(
@@ -18810,7 +19546,8 @@ async function offerPromoteWhenSandboxActive() {
   if (!projectId) return false;
   let sandbox;
   try {
-    sandbox = await resolveActiveSandbox(projectId);
+    ;
+    ({ sandbox } = await resolveActiveSandbox(projectId));
   } catch {
     return false;
   }
@@ -18983,7 +19720,7 @@ async function handleDeploy(options) {
   let notes;
   if (!json && !options.yes) {
     console.log();
-    const { confirmed } = await inquirer.prompt([
+    const { confirmed } = await inquirer2.prompt([
       {
         type: "confirm",
         name: "confirmed",
@@ -18996,7 +19733,7 @@ async function handleDeploy(options) {
       return;
     }
     if (!options.skipNotes) {
-      const answer = await inquirer.prompt([
+      const answer = await inquirer2.prompt([
         {
           type: "input",
           name: "notes",
@@ -19703,7 +20440,7 @@ function sandboxCommands(program2) {
 }
 
 // src/commands/version.ts
-var CLI_VERSION = "0.2.2" ;
+var CLI_VERSION = "0.3.0" ;
 async function handleVersion(_options) {
   console.log(heading("RelyIO CLI Version Information"));
   const versionInfo = [
@@ -19786,13 +20523,13 @@ var TerminalWatcher = class extends EventEmitter {
       ignoreInitial: true,
       persistent: true
     });
-    this.watcher.on("raw", (event, path23) => {
+    this.watcher.on("raw", (event, path25) => {
       if (event === "change" || event === "rename") {
-        return this.handleFileChange(path23);
+        return this.handleFileChange(path25);
       }
     });
-    this.watcher.on("add", (path23) => this.handleFileChange(path23));
-    this.watcher.on("unlink", (path23) => this.handleFileChange(path23));
+    this.watcher.on("add", (path25) => this.handleFileChange(path25));
+    this.watcher.on("unlink", (path25) => this.handleFileChange(path25));
     this.watcher.on("error", (error2) => {
       const errorMessage = error2 instanceof Error ? error2.message : String(error2);
       if (this.options.onError && error2 instanceof Error) {
@@ -20476,7 +21213,7 @@ async function handleLink(options) {
       console.log(info("Please create an organization from the dashboard."));
       process.exit(1);
     }
-    const { organizationId } = await inquirer.prompt([
+    const { organizationId } = await inquirer2.prompt([
       {
         type: "list",
         name: "organizationId",
@@ -20496,7 +21233,7 @@ async function handleLink(options) {
       console.log(info("Please create a project first."));
       process.exit(1);
     }
-    const { projectId } = await inquirer.prompt([
+    const { projectId } = await inquirer2.prompt([
       {
         type: "list",
         name: "projectId",
@@ -20546,172 +21283,13 @@ init_schema_loader();
 init_schema();
 init_manage();
 init_manage_error();
-var BUILT_IN_LANGUAGES = ["typescript", "python"];
-var registeredPlugins = /* @__PURE__ */ new Map();
-function registerPlugin(language, load3) {
-  registeredPlugins.set(language, load3);
-}
-function asPlugin(module_, describe3) {
-  const candidate = module_?.default ?? module_;
-  const plugin3 = candidate;
-  if (!plugin3 || typeof plugin3.generate !== "function") {
-    throw new Error(`Invalid plugin: ${describe3}`);
-  }
-  return plugin3;
-}
-async function loadPlugin(language) {
-  const registered = registeredPlugins.get(language);
-  if (registered) {
-    return asPlugin(await registered(), `registered ${language}`);
-  }
-  if (language === "typescript" || language === "python") {
-    try {
-      const pluginName2 = `@relyio/codegen-${language}`;
-      const pluginModule = await import(
-        /* webpackIgnore: true */
-        pluginName2
-      );
-      const plugin3 = pluginModule.default || pluginModule;
-      if (!plugin3 || typeof plugin3.generate !== "function") {
-        throw new Error(`Invalid built-in plugin: ${language}`);
-      }
-      return plugin3;
-    } catch {
-      try {
-        const relativePath = path3.resolve(
-          path3.dirname(import.meta.url.replace("file://", "")),
-          `../../codegen-${language}/dist/index.js`
-        );
-        const pluginModule = await import(
-          /* webpackIgnore: true */
-          relativePath
-        );
-        const plugin3 = pluginModule.default || pluginModule;
-        if (!plugin3 || typeof plugin3.generate !== "function") {
-          throw new Error(`Invalid built-in plugin: ${language}`);
-        }
-        return plugin3;
-      } catch {
-        throw new Error(
-          `Built-in ${language} generator not found. Please ensure @relyio/codegen-${language} is built.`
-        );
-      }
-    }
-  }
-  const pluginName = `@relyio/codegen-${language}`;
-  try {
-    const pluginModule = await import(
-      /* webpackIgnore: true */
-      pluginName
-    );
-    const plugin3 = pluginModule.default || pluginModule;
-    if (!plugin3 || typeof plugin3.generate !== "function") {
-      throw new Error(`Invalid plugin: ${pluginName}`);
-    }
-    return plugin3;
-  } catch (error2) {
-    const code = error2 !== null && typeof error2 === "object" && "code" in error2 ? String(error2.code) : void 0;
-    if (code === "MODULE_NOT_FOUND") {
-      throw new Error(`Generator "${language}" not installed.
-Run: pnpm add -D ${pluginName}`);
-    }
-    throw error2;
-  }
-}
-async function getAvailablePlugins() {
-  try {
-    const packageJsonPath = path3.join(process.cwd(), "package.json");
-    const packageJsonModule = await import(packageJsonPath);
-    const packageJson = packageJsonModule.default;
-    const dependencies = {
-      ...packageJson.dependencies,
-      ...packageJson.devDependencies
-    };
-    const plugins = Object.keys(dependencies).filter((name) => name.startsWith("@relyio/codegen-")).map((name) => name.replace("@relyio/codegen-", ""));
-    if (!plugins.includes("typescript")) {
-      plugins.unshift("typescript");
-    }
-    if (!plugins.includes("python")) {
-      plugins.unshift("python");
-    }
-    return plugins;
-  } catch {
-    return ["typescript", "python"];
-  }
-}
-function getSuggestedPlugins() {
-  return {
-    python: "@relyio/codegen-python",
-    go: "@relyio/codegen-go",
-    rust: "@relyio/codegen-rust",
-    java: "@relyio/codegen-java",
-    csharp: "@relyio/codegen-csharp",
-    php: "@relyio/codegen-php",
-    swift: "@relyio/codegen-swift",
-    kotlin: "@relyio/codegen-kotlin"
-  };
-}
-async function writeFiles(files, outputDir) {
-  await fs4.mkdir(outputDir, { recursive: true });
-  await Promise.all(
-    files.map(async (file) => {
-      const fullPath = path3.join(outputDir, file.path);
-      const dir = path3.dirname(fullPath);
-      await fs4.mkdir(dir, { recursive: true });
-      await fs4.writeFile(fullPath, file.content, "utf8");
-    })
-  );
-}
-var TemplateEngine = class {
-  handlebars;
-  constructor() {
-    this.handlebars = Handlebars.create();
-    this.registerHelpers();
-  }
-  registerHelpers() {
-    this.handlebars.registerHelper("pascalCase", (str) => {
-      if (!str) return "";
-      return str.replaceAll(/(^|_)(\w)/g, (_, __, char) => char.toUpperCase());
-    });
-    this.handlebars.registerHelper("camelCase", (str) => {
-      if (!str) return "";
-      const pascal = str.replaceAll(/(^|_)(\w)/g, (_, __, char) => char.toUpperCase());
-      return pascal.charAt(0).toLowerCase() + pascal.slice(1);
-    });
-    this.handlebars.registerHelper("snakeCase", (str) => {
-      if (!str) return "";
-      return str.replaceAll(/([A-Z])/g, "_$1").toLowerCase().replace(/^_/, "");
-    });
-    this.handlebars.registerHelper("kebabCase", (str) => {
-      if (!str) return "";
-      return str.replaceAll(/([A-Z])/g, "-$1").toLowerCase().replace(/^-/, "");
-    });
-    this.handlebars.registerHelper("plural", (str) => {
-      if (!str) return "";
-      if (str.endsWith("y")) {
-        return str.slice(0, -1) + "ies";
-      }
-      if (str.endsWith("s") || str.endsWith("sh") || str.endsWith("ch")) {
-        return str + "es";
-      }
-      return str + "s";
-    });
-  }
-  compile(template) {
-    const compiledTemplate = this.handlebars.compile(template);
-    return (context) => compiledTemplate(context);
-  }
-  render(template, context) {
-    const compiledTemplate = this.compile(template);
-    return compiledTemplate(context);
-  }
-};
-new TemplateEngine();
+init_dist2();
 
 // src/codegen/built-in-generators.ts
+init_dist2();
 var BUILT_IN_GENERATOR_LOADERS = Object.freeze({
-  typescript: () => Promise.resolve().then(() => (init_dist2(), dist_exports)),
-  python: () => Promise.resolve().then(() => (init_dist3(), dist_exports2))
+  typescript: () => Promise.resolve().then(() => (init_dist4(), dist_exports)),
+  python: () => Promise.resolve().then(() => (init_dist5(), dist_exports2))
 });
 function registerBuiltInGenerators() {
   for (const language of BUILT_IN_LANGUAGES) {
@@ -20722,6 +21300,9 @@ registerBuiltInGenerators();
 
 // src/commands/generate-types.ts
 init_git();
+
+// src/utils/codegen-config.ts
+init_dist2();
 var CodegenConfigSchema = z.object({
   output: z.string().optional(),
   languages: z.array(z.string()).optional(),
@@ -20736,16 +21317,11 @@ var CodegenConfigSchema = z.object({
     output: z.string().optional(),
     baseModel: z.enum(["pydantic", "dataclass"]).optional(),
     includeValidators: z.boolean().optional()
-  }).optional(),
-  go: z.object({
-    output: z.string().optional(),
-    packageName: z.string().optional(),
-    includeValidators: z.boolean().optional()
   }).optional()
 });
 async function loadCodegenConfig(configPath) {
-  const defaultPath = path3.join(process.cwd(), "relyio.codegen.yaml");
-  const alternatePath = path3.join(process.cwd(), "relyio.codegen.yml");
+  const defaultPath = path5.join(process.cwd(), "relyio.codegen.yaml");
+  const alternatePath = path5.join(process.cwd(), "relyio.codegen.yml");
   let targetPath = configPath;
   if (!targetPath) {
     try {
@@ -20789,12 +21365,11 @@ function mergeConfigWithOptions(config, options, language) {
     moduleFormat: options.moduleFormat || languageConfig.moduleFormat || "esm"
   };
 }
-function validateLanguages(languages) {
-  const supportedLanguages = ["typescript", "python", "go", "rust", "csharp", "java"];
+function assertSupportedLanguages(languages) {
   for (const language of languages) {
-    if (!supportedLanguages.includes(language)) {
+    if (!BUILT_IN_LANGUAGES.includes(language)) {
       throw new Error(
-        `Unsupported language: ${language}. Supported languages: ${supportedLanguages.join(", ")}`
+        `Unsupported language: ${language}. Supported languages: ${BUILT_IN_LANGUAGES.join(", ")}`
       );
     }
   }
@@ -20810,24 +21385,8 @@ function formatSchemaSource3(result) {
   const count = files.length;
   return `YAML (${count} file${count === 1 ? "" : "s"})`;
 }
-async function handleGenerationError(error2) {
+function handleGenerationError(error2) {
   if (error2 instanceof Error) {
-    if (error2.message.includes("not installed")) {
-      const availablePlugins = await getAvailablePlugins();
-      const suggestedPlugins = getSuggestedPlugins();
-      displayInfo("\u{1F4CB} Available generators:");
-      for (const plugin3 of availablePlugins) {
-        const status = plugin3 === "typescript" || plugin3 === "python" ? " (built-in)" : "";
-        displayInfo(`  \u2705 ${plugin3}${status}`);
-      }
-      displayInfo("\n\u{1F4BE} Install additional generators with:");
-      for (const [language, packageName] of Object.entries(suggestedPlugins)) {
-        if (!availablePlugins.includes(language)) {
-          displayInfo(`  pnpm add -D ${packageName}`);
-        }
-      }
-      return;
-    }
     if (error2.message.includes("Schema validation failed") || error2.message.includes("validation error")) {
       displayInfo("\n\u{1F4A1} Troubleshooting steps:");
       displayInfo("1. Run 'relyio status' to see validation details");
@@ -20896,14 +21455,16 @@ async function performTypeGeneration(branchName, options, watchMode = false) {
               `Failed to load configuration: ${error2 instanceof Error ? error2.message : "Unknown error"}`
             );
           }
-          if (options.languages || options.language) {
-            const requestedLanguages = options.languages ? options.languages.split(",") : [options.language || "typescript"];
-            ctx.languages = [...new Set(requestedLanguages)];
-          } else {
-            const configLanguages = ctx.config.languages || ["typescript"];
-            ctx.languages = [...new Set(configLanguages)];
-          }
-          validateLanguages(ctx.languages);
+          const requested = options.languages || options.language ? [
+            ...new Set(
+              options.languages ? options.languages.split(",") : [options.language || "typescript"]
+            )
+          ] : (
+            // Use config file languages if no CLI language specified
+            [...new Set(ctx.config.languages || ["typescript"])]
+          );
+          assertSupportedLanguages(requested);
+          ctx.languages = requested;
         }
       },
       {
@@ -21041,7 +21602,7 @@ async function performTypeGeneration(branchName, options, watchMode = false) {
       "Type generation failed",
       error2 instanceof Error ? error2.message : "Unknown error"
     );
-    await handleGenerationError(error2);
+    handleGenerationError(error2);
     process.exit(1);
   }
 }
@@ -21111,18 +21672,17 @@ function generateTypesCommand(program2) {
     "after",
     `
 Examples:
-  $ relyio generate-types                    # Generate TypeScript types
-  $ relyio generate-types -o ./src/types     # Custom output directory
-  $ relyio generate-types --watch            # Watch mode
-  $ relyio generate-types -l python          # Generate Python types
-  $ relyio generate-types --languages ts,py  # Multiple languages
+  $ relyio generate-types                                # Generate TypeScript types
+  $ relyio generate-types -o ./src/types                 # Custom output directory
+  $ relyio generate-types --watch                        # Watch mode
+  $ relyio generate-types -l python                      # Generate Python types
+  $ relyio generate-types --languages typescript,python  # Multiple languages
 
-Supported Languages:
-  typescript (ts)   TypeScript type definitions
-  python (py)       Python type hints (dataclasses)
+Supported languages:
+  ${BUILT_IN_LANGUAGES.join(", ")}
 
 Configuration:
-  Create codegen.config.ts or codegen.config.json for advanced options.
+  Create relyio.codegen.yaml (or .yml) for advanced options.
 `
   );
 }
@@ -21299,7 +21859,6 @@ function displayObjectDiff(obj, indent, mode) {
   const color = THEME3.added ;
   const prefix = "+" ;
   for (const [key, value] of Object.entries(obj)) {
-    if (key === "_tag") continue;
     if (Array.isArray(value)) {
       console.log(color(`${indent}${prefix} ${key}:`));
       for (const item of value) {
@@ -22287,7 +22846,7 @@ var THEME7 = {
   alias: chalk12.cyan,
   command: chalk12.yellow
 };
-var ALIAS_FILE = path3.join(os.homedir(), ".relyio", "aliases.json");
+var ALIAS_FILE = path5.join(os.homedir(), ".relyio", "aliases.json");
 function readAliases() {
   try {
     if (fs2.existsSync(ALIAS_FILE)) {
@@ -22298,7 +22857,7 @@ function readAliases() {
   return {};
 }
 function writeAliases(aliases) {
-  const dir = path3.dirname(ALIAS_FILE);
+  const dir = path5.dirname(ALIAS_FILE);
   if (!fs2.existsSync(dir)) {
     fs2.mkdirSync(dir, { recursive: true });
   }
@@ -22438,6 +22997,7 @@ function runPreflight() {
 }
 
 // src/dev/cockpit.tsx
+init_dev_handshake();
 init_app();
 init_dev_cockpit_context();
 var WrappedChildProcess = class {
@@ -22452,8 +23012,7 @@ var WrappedChildProcess = class {
       cwd: this.options.cwd,
       env: {
         ...process.env,
-        RELYIO_DEV_DATASET: this.options.env.RELYIO_DEV_DATASET,
-        RELYIO_DEV_API_KEY: this.options.env.RELYIO_DEV_API_KEY
+        ...this.options.env
       },
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -22678,10 +23237,14 @@ function DevCockpit({
         command: childCommand.command,
         args: childCommand.args,
         cwd: projectRoot,
-        env: {
-          RELYIO_DEV_DATASET: sandbox.datasetId,
-          RELYIO_DEV_API_KEY: sandbox.previewApiKey
-        },
+        // The wrapped child and the standalone `.relyio/dev.json` reader must see the same
+        // sandbox, deadline included — before REL-647 the env carrier had no deadline at all, so a
+        // lapsed sandbox kept working here for the life of the process.
+        env: buildDevEnv({
+          datasetId: sandbox.datasetId,
+          previewApiKey: sandbox.previewApiKey,
+          expiresAt: sandbox.expiresAt
+        }),
         onOutput: (chunk) => setChildLines((previous) => appendChildLines(previous, chunk)),
         onExit: () => setChildRunning(false)
       });
@@ -22935,8 +23498,8 @@ function getAuthToken7() {
   throw new Error("Not authenticated. Run `relyio login` first.");
 }
 var ConversationsClient = class {
-  async request(method, path23, init = {}) {
-    const url = new URL(`${getGatewayUrl()}${AI_GATEWAY_CONVERSATIONS_PATH}${path23}`);
+  async request(method, path25, init = {}) {
+    const url = new URL(`${getGatewayUrl()}${AI_GATEWAY_CONVERSATIONS_PATH}${path25}`);
     if (init.query) {
       for (const [k, v] of Object.entries(init.query)) {
         if (v === void 0) continue;
@@ -22955,7 +23518,7 @@ var ConversationsClient = class {
       const raw = await response.text().catch(() => "");
       const refusal = readError(parseJson(raw));
       throw new Error(
-        refusal === void 0 ? `Conversations API ${method} ${path23} \u2192 ${response.status}: ${raw}` : `Conversations API ${method} ${path23} \u2192 ${response.status} ${refusal.code}: ${refusal.messages.join(" ")}`
+        refusal === void 0 ? `Conversations API ${method} ${path25} \u2192 ${response.status}: ${raw}` : `Conversations API ${method} ${path25} \u2192 ${response.status} ${refusal.code}: ${refusal.messages.join(" ")}`
       );
     }
     const text = await response.text();
@@ -23205,10 +23768,13 @@ async function resolveModelFlag(rawRef) {
       return "invalid";
     }
     if (!match.available) {
-      const reason = match.disabledReason === "paused" ? "AI is paused globally" : "this model is currently disabled by the workspace admin";
-      console.log(chalk12.red(`
-  Cannot use ${match.name} \u2014 ${reason}.
-`));
+      console.log(
+        chalk12.red(
+          `
+  Cannot use ${match.name} \u2014 this model is currently disabled by the workspace admin.
+`
+        )
+      );
       return "invalid";
     }
     return match.id;
@@ -24037,7 +24603,7 @@ Examples:
 }
 
 // src/index.ts
-var CLI_VERSION3 = "0.2.2" ;
+var CLI_VERSION3 = "0.3.0" ;
 var program = new Command();
 program.name("relyio").description("RelyIO CLI - Content Management, Simplified").version(CLI_VERSION3);
 registerGlobalOptions(program);