@zveltio/cli 3.0.0-beta.4 → 3.0.0-beta.68

package/dist/index.js

@@ -861,7 +861,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          } else {}
+          }
         };
       }
       return this;
@@ -1888,7 +1888,7 @@ var require_commander = __commonJS((exports) => {
 
 // ../sdk/dist/build/index.js
 import { createRequire } from "module";
-import { existsSync as existsSync5, readFileSync } from "fs";
+import { existsSync as existsSync6, readFileSync } from "fs";
 import { dirname, join as join5 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1913,7 +1913,7 @@ function resolveSearchPaths(resolveFromDir) {
   for (let i = 0;i < 6; i++) {
     cur = dirname(cur);
     paths.push(cur);
-    if (existsSync5(join5(cur, "node_modules")))
+    if (existsSync6(join5(cur, "node_modules")))
       break;
   }
   return [...new Set(paths)];
@@ -1927,7 +1927,7 @@ function resolvePackageRoot(pkg, searchPaths) {
   }
   for (;; ) {
     const pkgJsonPath = join5(candidate, "package.json");
-    if (existsSync5(pkgJsonPath)) {
+    if (existsSync6(pkgJsonPath)) {
       const manifest = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
       if (manifest.name === pkg)
         return candidate;
@@ -1951,7 +1951,7 @@ function resolvePackageEsmEntry(pkg, resolveFromDir) {
     throw new Error(`Cannot determine ESM entry for package "${pkg}"`);
   }
   const abs = join5(root, rel.replace(/^\.\//, ""));
-  if (!existsSync5(abs)) {
+  if (!existsSync6(abs)) {
     throw new Error(`ESM entry missing for "${pkg}": ${abs}`);
   }
   if (abs.endsWith(".d.ts")) {
@@ -1997,7 +1997,7 @@ var init_build = __esm(() => {
 });
 
 // src/lib/extension-bundle.ts
-import { existsSync as existsSync6, renameSync } from "fs";
+import { existsSync as existsSync7, renameSync } from "fs";
 import { basename, dirname as dirname2, join as join6 } from "path";
 async function bundleExtensionEngine(opts) {
   const outdir = dirname2(opts.outfile);
@@ -2018,7 +2018,7 @@ async function bundleExtensionEngine(opts) {
 `);
     throw new Error(messages || "Bun.build failed");
   }
-  if (!existsSync6(builtPath)) {
+  if (!existsSync7(builtPath)) {
     throw new Error(`Bun.build succeeded but ${builtPath} was not produced`);
   }
   if (builtPath !== opts.outfile) {
@@ -2031,6 +2031,18 @@ var init_extension_bundle = __esm(() => {
   EXTENSION_BUNDLE_CORE_DEPS2 = EXTENSION_BUNDLE_CORE_DEPS;
 });
 
+// src/lib/pack-isolation.ts
+function resolvePackIsolation(opts) {
+  let resolved = opts.current;
+  if (opts.firstParty && resolved === "worker" && !opts.keepIsolation) {
+    resolved = undefined;
+  }
+  if (!resolved && opts.communityInject && !opts.firstParty) {
+    resolved = "worker";
+  }
+  return resolved;
+}
+
 // src/lib/publisher-tier.ts
 function tierAllowsInline(tier) {
   return tier === "first-party" || tier === "verified";
@@ -2069,14 +2081,108 @@ function normalizeTier(v) {
 // src/commands/extension-pack.ts
 var exports_extension_pack = {};
 __export(exports_extension_pack, {
+  recordBundledVersions: () => recordBundledVersions,
+  hashEngineSources: () => hashEngineSources,
   extensionPackCommand: () => extensionPackCommand
 });
 import { createHash } from "crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { join as join7, resolve } from "path";
+import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join as join7, relative, resolve } from "path";
+function scrubBuildPaths(outfile, dir) {
+  const original = readFileSync2(outfile, "utf8");
+  let count = 0;
+  let text = original.replace(/(__dirname|__filename)\s*=\s*"(\/[^"]*)"/g, (_match, name, abs) => {
+    count += 1;
+    const at = abs.lastIndexOf("node_modules/");
+    const tail = at === -1 ? abs.slice(abs.lastIndexOf("/") + 1) : abs.slice(at);
+    return `${name} = "/zveltio-extension/${tail}"`;
+  });
+  text = text.replace(/\.{1,2}\/[^\s"'`]*(?:node_modules|packages)\/[^\s"'`]*/g, (match) => {
+    const store = match.indexOf(".bun/");
+    const at = store === -1 ? Math.min(...[match.lastIndexOf("node_modules/"), match.indexOf("packages/")].filter((i) => i >= 0)) : store;
+    count += 1;
+    return `/zveltio-extension/${match.slice(at)}`;
+  });
+  text = text.replace(/(?<=^\/\/\s*)node_modules\//gm, "/zveltio-extension/node_modules/");
+  const prefix = relative(process.cwd(), dir).replace(/\\/g, "/");
+  if (prefix && !prefix.startsWith("..")) {
+    const re = new RegExp(`(?<=^//\\s*)${prefix.replace(/[.*+?^${}()|[\\]]/g, "\\$&")}/`, "gm");
+    const before = text;
+    text = text.replace(re, "");
+    if (text !== before)
+      count += 1;
+  }
+  const home = homedir();
+  if (home && home.startsWith("/") && home.length > 1 && text.includes(home)) {
+    count += text.split(home).length - 1;
+    text = text.split(home).join("/zveltio-extension");
+  }
+  if (count > 0)
+    writeFileSync(outfile, text, "utf8");
+  return count;
+}
+function recordBundledVersions(outfile, dir) {
+  let text = readFileSync2(outfile, "utf8");
+  const recorded = [];
+  for (const dep of CORE_DEPS) {
+    if (!text.includes(`node_modules/${dep}/`) || text.includes(`.bun/${dep}@`))
+      continue;
+    for (let at = resolve(dir);; at = resolve(at, "..")) {
+      const pkg = join7(at, "node_modules", dep, "package.json");
+      if (existsSync8(pkg)) {
+        const { version } = JSON.parse(readFileSync2(pkg, "utf8"));
+        if (version)
+          recorded.push(`${dep}@${version}`);
+        break;
+      }
+      if (at === resolve(at, ".."))
+        break;
+    }
+  }
+  if (recorded.length === 0)
+    return recorded;
+  text = text.replace(/\n*$/, `
+`);
+  text += recorded.map((r) => `// @zveltio-bundled ${r}
+`).join("");
+  writeFileSync(outfile, text, "utf8");
+  return recorded;
+}
+function hashEngineSources(dir) {
+  const engineDir = join7(dir, "engine");
+  const files = [];
+  const walk = (d) => {
+    for (const entry of readdirSync(d, { withFileTypes: true })) {
+      const full = join7(d, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === "migrations" || entry.name === "node_modules")
+          continue;
+        walk(full);
+        continue;
+      }
+      if (!/\.(ts|tsx|js|mjs|json)$/.test(entry.name))
+        continue;
+      if (/\.(test|spec)\.[a-z]+$/.test(entry.name))
+        continue;
+      if (entry.name === "index.js")
+        continue;
+      files.push(full);
+    }
+  };
+  walk(engineDir);
+  const h = createHash("sha256");
+  for (const f of files.sort()) {
+    h.update(f.slice(engineDir.length).replace(/\\/g, "/"));
+    h.update("\x00");
+    h.update(readFileSync2(f));
+    h.update("\x00");
+  }
+  return h.digest("hex");
+}
 function readManifest(dir) {
   const path = join7(dir, "manifest.json");
-  if (!existsSync7(path)) {
+  if (!existsSync8(path)) {
     throw new Error(`No manifest.json at ${path}.`);
   }
   return JSON.parse(readFileSync2(path, "utf8"));
@@ -2099,7 +2205,7 @@ async function extensionPackCommand(opts) {
   const dir = resolve(opts.dir ?? process.cwd());
   const entry = join7(dir, "engine", "index.ts");
   const outfile = join7(dir, "engine", "index.js");
-  if (!existsSync7(entry)) {
+  if (!existsSync8(entry)) {
     throw new Error(`No engine/index.ts at ${entry}. ` + `Run from the extension root or pass --dir. Extensions without an engine entry don't need pack.`);
   }
   const manifest = readManifest(dir);
@@ -2125,6 +2231,14 @@ async function extensionPackCommand(opts) {
   } catch (err) {
     throw new Error(`Bun bundle failed: ${err.message}`);
   }
+  const scrubbed = scrubBuildPaths(outfile, dir);
+  if (scrubbed > 0) {
+    console.log(`  ${c5.green("\u2713")} ${c5.dim(`${scrubbed} build path(s) neutralised`)}`);
+  }
+  const recorded = recordBundledVersions(outfile, dir);
+  if (recorded.length > 0) {
+    console.log(`  ${c5.green("\u2713")} ${c5.dim(`recorded bundled ${recorded.join(", ")}`)}`);
+  }
   const bundleBytes = readFileSync2(outfile);
   const engineSha256 = createHash("sha256").update(bundleBytes).digest("hex");
   const bundleText = bundleBytes.toString("utf8").replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|\s)\/\/[^\n]*/g, "$1");
@@ -2136,21 +2250,29 @@ async function extensionPackCommand(opts) {
   }
   const sizeKb = Math.round(bundleBytes.byteLength / 1024);
   console.log(`  ${c5.green("\u2713")} ${c5.bold(`engine/index.js`)} ${c5.dim(`(${sizeKb} KB, sha256=${engineSha256.slice(0, 12)}\u2026)`)}`);
-  let resolvedIsolation = manifest.engine?.isolation;
-  if (!resolvedIsolation) {
+  let communityInject = false;
+  if (!manifest.engine?.isolation) {
     const resolved = await resolvePublisherTier({
       firstParty: opts.firstParty,
       token: opts.token,
       registryUrl: opts.registryUrl
     });
     if (!resolved.allowsInline) {
-      resolvedIsolation = "worker";
+      communityInject = true;
       console.log(`  ${c5.yellow("\u26A0")} ${resolved.tier} publisher \u2014 auto-set ${c5.bold('engine.isolation: "worker"')} ` + `(community extensions can't run inline).`);
       if (resolved.source === "default") {
         console.log(c5.dim("    Tier defaulted to community (no --first-party flag, no registry token). " + "If you are verified/first-party, pass --first-party or set ZVELTIO_REGISTRY_TOKEN."));
       }
     }
+  } else if (opts.firstParty && manifest.engine.isolation === "worker" && !opts.keepIsolation) {
+    console.log(`  ${c5.yellow("\u26A0")} first-party pack \u2014 clearing sticky ${c5.bold('engine.isolation: "worker"')} ` + `(inline is the first-party default). Pass ${c5.bold("--keep-isolation")} to retain worker.`);
   }
+  const resolvedIsolation = resolvePackIsolation({
+    current: manifest.engine?.isolation,
+    firstParty: opts.firstParty,
+    keepIsolation: opts.keepIsolation,
+    communityInject
+  });
   if (!opts.noManifestUpdate) {
     manifest.engine = {
       entry: "engine/index.js",
@@ -2162,6 +2284,7 @@ async function extensionPackCommand(opts) {
     };
     manifest.integrity = {
       engineSha256,
+      sourceSha256: hashEngineSources(dir),
       ...manifest.integrity?.archiveSha256 ? { archiveSha256: manifest.integrity.archiveSha256 } : {}
     };
     writeManifest(dir, manifest);
@@ -3104,10 +3227,13 @@ function findDockerfile(cwd) {
   return null;
 }
 async function generateDockerfile(cwd, projectName) {
-  let entryPoint = "packages/engine/src/index.ts";
-  if (!existsSync4(join4(cwd, entryPoint))) {
-    entryPoint = existsSync4(join4(cwd, "src/index.ts")) ? "src/index.ts" : "index.ts";
-  }
+  const candidates = [
+    "packages/engine/src/binary-entry.ts",
+    "packages/engine/src/index.ts",
+    "src/binary-entry.ts",
+    "src/index.ts"
+  ];
+  const entryPoint = candidates.find((f) => existsSync4(join4(cwd, f))) ?? "index.ts";
   await Bun.write(join4(cwd, "Dockerfile"), `# Auto-generated by zveltio deploy
 # Edit this file to customise your production image.
 FROM oven/bun:1-alpine AS base
@@ -3140,6 +3266,40 @@ CMD ["./dist/${projectName}"]
 `);
 }
 
+// src/lib/engine-modules.ts
+import { existsSync as existsSync5 } from "fs";
+import { fileURLToPath } from "url";
+var CANDIDATES = [
+  "../../../engine/src/db/",
+  "../../engine/src/db/"
+];
+
+class EngineModulesUnavailable extends Error {
+  constructor() {
+    super(`this CLI cannot reach the engine\u2019s migration runner.
+
+` + `   The published @zveltio/cli package does not ship the engine, so the
+` + `   direct-to-database path only works from a repository checkout.
+
+` + `   Use one of these instead:
+` + `     zveltio migrate                     # the release binary, with DATABASE_URL set
+` + "     zveltio migrate --url http://host   # against a running engine");
+    this.name = "EngineModulesUnavailable";
+  }
+}
+async function loadEngineMigrationModules() {
+  for (const base of CANDIDATES) {
+    const dbUrl = new URL(`${base}index.js`, import.meta.url);
+    const path = fileURLToPath(dbUrl);
+    if (!existsSync5(path) && !existsSync5(path.replace(/\.js$/, ".ts")))
+      continue;
+    const db = await import(dbUrl.href);
+    const migrations = await import(new URL(`${base}migrations/index.js`, import.meta.url).href);
+    return { db, migrations };
+  }
+  throw new EngineModulesUnavailable;
+}
+
 // src/commands/migrate.ts
 var migrateCommand = new Command("migrate").description("Run pending database migrations").option("--url <url>", "Engine URL", "http://localhost:3000").option("--database-url <url>", "Direct database URL (skip engine)").option("--dry-run", "Show pending migrations without applying").action(async (opts) => {
   console.log(`
@@ -3155,10 +3315,9 @@ var migrateCommand = new Command("migrate").description("Run pending database mi
 async function runMigrationsDirectly(opts, databaseUrl) {
   try {
     process.env.DATABASE_URL = databaseUrl;
-    const dbPath = new URL("../../../engine/src/db/index.js", import.meta.url).href;
-    const migrationsPath = new URL("../../../engine/src/db/migrations/index.js", import.meta.url).href;
-    const { initDatabase } = await import(dbPath);
-    const { runMigrations, getAppliedMigrations, getLastAppliedMigration } = await import(migrationsPath);
+    const { db: dbModule, migrations } = await loadEngineMigrationModules();
+    const { initDatabase } = dbModule;
+    const { runMigrations, getAppliedMigrations, getLastAppliedMigration } = migrations;
     const db = await initDatabase();
     if (opts.dryRun) {
       const applied = await getAppliedMigrations(db);
@@ -3229,37 +3388,41 @@ async function runMigrationsViaAPI(opts) {
 }
 
 // src/commands/extension.ts
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 import { mkdir, writeFile } from "fs/promises";
 import { join as join8 } from "path";
 async function extensionCommand(action, name, opts) {
   switch (action) {
     case "create":
-      await createExtension(name, opts.category || "custom");
+      await createExtension(name, opts.category || "custom", opts.codePage === true);
       break;
     case "build":
       await buildExtension(opts);
       break;
-    case "dev":
-      await devExtension();
-      break;
   }
 }
-async function createExtension(name, category) {
+async function createExtension(name, category, codePage) {
   const safeName = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  const extName = `${category}/${safeName}`;
+  const table = `zv_${safeName.replace(/-/g, "_")}_items`;
   const targetDir = join8(process.cwd(), "extensions", category, safeName);
-  if (existsSync8(targetDir)) {
+  if (existsSync9(targetDir)) {
     console.error(`Extension already exists: ${targetDir}`);
     process.exit(1);
   }
   console.log(`
-Creating extension: ${category}/${safeName}
+Creating extension: ${extName}
 `);
-  await mkdir(join8(targetDir, "engine"), { recursive: true });
-  await mkdir(join8(targetDir, "studio", "src", "pages"), { recursive: true });
   await mkdir(join8(targetDir, "engine", "migrations"), { recursive: true });
+  await mkdir(join8(targetDir, "studio", "src", "components"), { recursive: true });
+  if (codePage) {
+    await mkdir(join8(targetDir, "studio", "pages"), { recursive: true });
+  } else {
+    await mkdir(join8(targetDir, "studio", "schemas"), { recursive: true });
+    await mkdir(join8(targetDir, "studio", "messages"), { recursive: true });
+  }
   await writeFile(join8(targetDir, "manifest.json"), JSON.stringify({
-    name: safeName,
+    name: extName,
     package: `@zveltio/ext-${safeName}`,
     category,
     displayName: name,
@@ -3268,13 +3431,29 @@ Creating extension: ${category}/${safeName}
     zveltioMinVersion: "1.0.0",
     zveltioMaxVersion: "4.0.0",
     permissions: ["database"],
-    contributes: { engine: true, studio: true, fieldTypes: [] }
+    studio: {
+      pages: [
+        {
+          path: `/admin/${safeName}`,
+          label: name,
+          icon: "Puzzle",
+          ...codePage ? {} : { schema: `schemas/${safeName}.json` }
+        }
+      ],
+      navGroup: "developer"
+    },
+    contributes: {
+      engine: true,
+      studio: true,
+      fieldTypes: [],
+      slots: []
+    }
   }, null, 2));
   await writeFile(join8(targetDir, "engine", "index.ts"), `import type { ZveltioExtension } from '@zveltio/sdk/extension';
 import { join } from 'path';
 
 const extension: ZveltioExtension = {
-  name: '${category}/${safeName}',
+  name: '${extName}',
   category: '${category}',
 
   getMigrations() {
@@ -3284,88 +3463,120 @@ const extension: ZveltioExtension = {
   },
 
   async register(app, ctx) {
-    // Register your API routes here
-    app.get('/api/${safeName}/ping', (c) => c.json({ pong: true }));
+    // The route the generated page reads. ctx.db resolves the caller's tenant
+    // transaction, so this returns only that tenant's rows.
+    app.get('/items', async (c) => {
+      const data = await ctx.db
+        .selectFrom('${table}')
+        .selectAll()
+        .orderBy('created_at', 'desc')
+        .limit(100)
+        .execute();
+      return c.json({ data });
+    });
   },
 };
 
 export default extension;
 `);
-  await writeFile(join8(targetDir, "engine", "migrations", "001_init.sql"), `-- ${name} extension initial schema
--- Add your tables here
+  await writeFile(join8(targetDir, "engine", "migrations", "001_init.sql"), `-- ${name} \u2014 initial schema.
+--
+-- Tenant isolation is not optional and not something to add later: a table
+-- without it is readable by every tenant on the instance. The three parts below
+-- are the whole pattern.
 
--- Example:
--- CREATE TABLE IF NOT EXISTS zv_${safeName.replace(/-/g, "_")} (
---   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
---   name TEXT NOT NULL,
---   created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
--- );
+CREATE TABLE IF NOT EXISTS ${table} (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name TEXT NOT NULL,
+  -- 1. The column, defaulting to the tenant of the transaction doing the write,
+  --    so application code never has to name it (and cannot forge it).
+  tenant_id UUID NOT NULL DEFAULT COALESCE(
+    NULLIF(current_setting('zveltio.current_tenant', true), '')::uuid,
+    '00000000-0000-0000-0000-000000000001'::uuid
+  ),
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_${table}_tenant ON ${table}(tenant_id);
+
+-- 2. FORCE matters. Without it Postgres lets the table owner bypass the policy,
+--    and the engine connects as owner on a stock install \u2014 RLS becomes advisory.
+ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;
+ALTER TABLE ${table} FORCE ROW LEVEL SECURITY;
+
+-- 3. The host's own predicate, not a hand-rolled copy: reads and writes agree
+--    with the column DEFAULT above, and the engine reconciles every policy
+--    named \`tenant_isolation_*\` onto it at boot.
+DROP POLICY IF EXISTS tenant_isolation_${table} ON ${table};
+CREATE POLICY tenant_isolation_${table} ON ${table}
+  USING (tenant_id = ANY (zveltio_visible_tenants()))
+  WITH CHECK (zveltio_tenant_write_ok(tenant_id));
 `);
-  await writeFile(join8(targetDir, "studio", "src", "index.ts"), `import MainPage from './pages/MainPage.svelte';
+  if (codePage) {
+    await writeFile(join8(targetDir, "studio", "pages", "+page.svelte"), `<script lang="ts">
+  import { api } from '$lib/api.js';
 
-export default function register() {
-  const zveltio = (window as any).__zveltio;
-  if (!zveltio) {
-    console.error('Zveltio Studio API not available');
-    return;
-  }
+  // A code page owns its fetching, loading and error states, and its strings
+  // have to reach i18n by hand. A schema gets all three from the host \u2014 worth
+  // re-checking that this page really needs to be code.
+  let items = $state<Array<{ id: string; name: string }>>([]);
 
-  zveltio.registerRoute({
-    path: '${safeName}',
-    component: MainPage,
-    label: '${name}',
-    icon: 'Puzzle',
-    category: '${category}',
+  $effect(() => {
+    api
+      .get<{ data: Array<{ id: string; name: string }> }>('/ext/${extName}/items')
+      .then((r) => {
+        items = r.data;
+      });
   });
-}
-`);
-  await writeFile(join8(targetDir, "studio", "src", "pages", "MainPage.svelte"), `<script lang="ts">
-  const engineUrl = (window as any).__ZVELTIO_ENGINE_URL__;
 </script>
 
 <div class="space-y-6">
   <h1 class="text-2xl font-bold">${name}</h1>
-  <p class="text-base-content/60">Welcome to the ${name} extension.</p>
+  {#each items as item (item.id)}
+    <div>{item.name}</div>
+  {/each}
 </div>
 `);
-  await writeFile(join8(targetDir, "studio", "vite.config.ts"), `import { svelte } from '@sveltejs/vite-plugin-svelte';
-import { defineConfig } from 'vite';
-
-export default defineConfig({
-  plugins: [svelte()],
-  build: {
-    lib: {
-      entry: 'src/index.ts',
-      formats: ['iife'],
-      fileName: () => 'bundle.js',
-    },
-    rollupOptions: {
-      external: ['svelte', 'svelte/internal', 'svelte/store'],
-      output: {
-        globals: {
-          'svelte': 'window.__SvelteRuntime?.svelte',
-          'svelte/internal': 'window.__SvelteRuntime?.internal',
-          'svelte/store': 'window.__SvelteRuntime?.store',
-        },
-      },
-    },
-  },
-});
+  } else {
+    await writeFile(join8(targetDir, "studio", "schemas", `${safeName}.json`), `${JSON.stringify({
+      sduiSchema: 1,
+      title: `${safeName}.title`,
+      subtitle: `${safeName}.subtitle`,
+      resources: [
+        {
+          id: "items",
+          dataSource: `/ext/${extName}/items`,
+          dataPath: "data",
+          search: { fields: ["name"], placeholder: "common.search" },
+          columns: [
+            { key: "name", label: "common.col.name" },
+            { key: "created_at", label: "common.col.created", type: "date" }
+          ]
+        }
+      ]
+    }, null, 2)}
+`);
+    await writeFile(join8(targetDir, "studio", "messages", "en.json"), `${JSON.stringify({
+      [`${safeName}.title`]: name,
+      [`${safeName}.subtitle`]: `Manage ${name.toLowerCase()} records`
+    }, null, 2)}
+`);
+  }
+  await writeFile(join8(targetDir, "studio", "src", "contribute.ts.example"), `/**
+ * Rename to contribute.ts to register dashboard/settings slot widgets.
+ * Synced by packages/studio/scripts/sync-extensions.ts \u2014 no studio/dist/ build.
+ *
+ * import { registerContributionSlot } from '$lib/extension-api.svelte.js';
+ * import MyWidget from './components/MyWidget.svelte';
+ *
+ * export function activate(): void {
+ *   registerContributionSlot('${extName}', 'dashboard.widgets', {
+ *     component: MyWidget,
+ *     priority: 100,
+ *   });
+ * }
+ */
 `);
-  await writeFile(join8(targetDir, "studio", "package.json"), JSON.stringify({
-    name: `@zveltio/ext-${safeName}-studio`,
-    version: "1.0.0",
-    type: "module",
-    scripts: {
-      build: "vite build",
-      dev: "vite build --watch"
-    },
-    dependencies: { svelte: "^5.0.0" },
-    devDependencies: {
-      "@sveltejs/vite-plugin-svelte": "^4.0.0",
-      vite: "^6.0.0"
-    }
-  }, null, 2));
   await writeFile(join8(targetDir, ".gitattributes"), `* text=auto eol=lf
 
 # Packed engine bundle: byte-identical across OSes. Manifest
@@ -3392,57 +3603,60 @@ jobs:
       - name: Install dependencies
         run: bun install
 
+      # Validate FIRST, on the COMMITTED bundle. It checks the bundle against
+      # manifest integrity.engineSha256 and against the source it was built
+      # from, so a bundle nobody repacked fails here. Running pack before this
+      # would rewrite both hashes and the check could never fail.
+      - name: Validate committed bundle, manifest + structure
+        run: bunx @zveltio/cli extension validate
+
       - name: Pack extension (engine/index.ts \u2192 engine/index.js + manifest hash)
         run: bunx @zveltio/cli extension pack
-
-      - name: Verify committed bundle matches manifest engineSha256
-        # If pack changed engine/index.js, the committed bytes drift
-        # from manifest.integrity.engineSha256. The publishing pipeline
-        # would reject this \u2014 fail PR before merging.
-        run: |
-          actual=$(sha256sum engine/index.js | awk '{print $1}')
-          declared=$(node -e "console.log(require('./manifest.json').integrity?.engineSha256 ?? '')")
-          if [ "$actual" != "$declared" ]; then
-            echo "::error::Bundle hash $actual \u2260 manifest engineSha256 $declared"
-            echo "::error::Run \\\`bunx @zveltio/cli extension pack\\\` locally and commit the result."
-            exit 1
-          fi
-
-      - name: Validate manifest + structure
-        run: bunx @zveltio/cli extension validate
 `);
+  const pageLines = codePage ? `    pages/
+      +page.svelte    <- code page (synced into Studio at release)` : `    schemas/
+      ${safeName}.json  <- THE PAGE (rendered by the host; no build step)
+    messages/
+      en.json         <- keys this schema owns; other locales filled from en`;
   console.log(`Extension scaffolded at extensions/${category}/${safeName}/
 
-Structure:
   engine/
-    index.ts          <- API routes
-    migrations/       <- SQL migrations
+    index.ts          <- API routes (mounted at /ext/${extName}/*)
+    migrations/       <- SQL, with tenant isolation already wired
   studio/
+${pageLines}
     src/
-      index.ts        <- Studio registration
-      pages/          <- Svelte UI components
-    vite.config.ts
+      components/     <- shared Svelte (optional)
+      contribute.ts.example  <- rename to contribute.ts for a dashboard widget
   manifest.json
-  .gitattributes      <- pins engine/index.js as binary (no EOL conversion)
-  .github/workflows/
-    ci.yml            <- pack + hash verify + validate on every PR
+  .gitattributes
+  .github/workflows/ci.yml
 
 Next steps:
-  1. Add your business logic in engine/index.ts
-  2. Create your UI in studio/src/pages/
-  3. Run \`bunx @zveltio/cli extension pack\` to build the bundle
-  4. Enable the extension: ZVELTIO_EXTENSIONS=${category}/${safeName}
+  1. Put your logic in engine/index.ts \u2014 that is where the truth lives
+  2. ${codePage ? "Write the page in studio/pages/+page.svelte" : `Shape the page in studio/schemas/${safeName}.json`}
+  3. \`bunx @zveltio/cli extension pack\` \u2014 produces engine/index.js + integrity
+     (validate needs this: it rejects a manifest with no engine block)
+  4. \`bunx @zveltio/cli extension validate\`${codePage ? " \u2014 manifest, migrations and bundle" : ` \u2014 checks the schema against the
+     routes you actually serve, and the message keys against what you ship`}
+  5. Local preview: \`cd packages/studio && bun scripts/sync-extensions.ts\`,
+     then \`bun run dev\` \u2014 see developer-guide.md \xA72
 
-Isolation (MARKETPLACE-POLICY \xA72):
-  Community publishers MUST run in worker isolation. \`extension pack\`
-  auto-sets "engine": { ..., "isolation": "worker" } for you unless it can
-  confirm you're a verified/first-party publisher (via --first-party or a
-  registry token). Worker mode = Bun.Worker with crash isolation and no
-  direct DB credentials.
+Where UI goes:
+  a page                    -> studio/schemas/*.json          (almost always)
+  a widget on the dashboard -> studio/src/contribute.ts        (occasionally)
+  canvas / chat / map / IDE -> studio/pages/+page.svelte       (rarely)
 
-  First-party / vendor builds that want inline isolation: pack with
-  --first-party. See https://github.com/zveltio-devs/zveltio/blob/master/docs/EXTENSION-DEVELOPER-GUIDE.md#135-isolation-tiers-be-honest-about-what-you-ship
+Do NOT add studio/vite.config.ts, studio/package.json, or studio/dist/ \u2014 removed in alpha.94/beta.15.
 `);
+  if (codePage) {
+    console.warn(`\x1B[33mScaffolded a CODE page. Across the 56 shipped extensions, 61 pages are
+schemas and seven are code \u2014 and each of those seven sits beside a schema, for
+the part a schema could not express. On this road you own fetching,
+loading and error states, i18n by hand, and a Studio release to ship a change.
+Worth it for a canvas, a chat, a map or an inbox \u2014 for a list, a form or
+settings, delete studio/pages/ and add \`schema\` back to manifest.studio.pages[0].\x1B[0m`);
+  }
 }
 async function buildExtension(opts) {
   console.warn("\x1B[33m`zveltio extension build` is deprecated \u2014 use `zveltio extension pack`.\x1B[0m");
@@ -3450,26 +3664,10 @@ async function buildExtension(opts) {
   const { extensionPackCommand: extensionPackCommand2 } = await Promise.resolve().then(() => (init_extension_pack(), exports_extension_pack));
   await extensionPackCommand2({ dir: opts.dir });
 }
-async function devExtension() {
-  console.log(`
-Starting extension dev mode...
-`);
-  const studioProc = Bun.spawn(["bun", "run", "dev"], {
-    cwd: "studio",
-    stdout: "inherit",
-    stderr: "inherit"
-  });
-  console.log("  Studio: watching for changes...");
-  process.on("SIGINT", () => {
-    studioProc.kill();
-    process.exit(0);
-  });
-  await studioProc.exited;
-}
 
 // src/commands/extension-types.ts
-import { existsSync as existsSync9, readdirSync, readFileSync as readFileSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join9, relative } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync2, readFileSync as readFileSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join9, relative as relative2 } from "path";
 
 // ../sdk/dist/schema-codegen.js
 var NUMERIC_TYPES = new Set([
@@ -3539,6 +3737,10 @@ function mapPgTypeToTs(pgType) {
     tsBase = "unknown";
   return isArray ? `${tsBase}[]` : tsBase;
 }
+function upSection(sql) {
+  const i = sql.search(/^--\s*DOWN\s*$/im);
+  return i < 0 ? sql : sql.slice(0, i);
+}
 function stripComments(sql) {
   let out = "";
   let i = 0;
@@ -3716,13 +3918,12 @@ function parseSchema(sqlChunks) {
     }
     return tables.get(name);
   };
-  const allSql = sqlChunks.map(stripComments).join(`
+  const allSql = sqlChunks.map(upSection).map(stripComments).join(`
 `);
   const createRe = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s*\(/gi;
-  let m;
-  while ((m = createRe.exec(allSql)) !== null) {
+  for (const m of allSql.matchAll(createRe)) {
     const tableName = m[1] ?? m[2];
-    const openIdx = createRe.lastIndex - 1;
+    const openIdx = m.index + m[0].length - 1;
     const closeIdx = findMatchingParen(allSql, openIdx);
     if (closeIdx < 0)
       continue;
@@ -3731,10 +3932,9 @@ function parseSchema(sqlChunks) {
     const tableCols = ensureTable(tableName);
     for (const c6 of columns)
       tableCols.set(c6.name, c6);
-    createRe.lastIndex = closeIdx + 1;
   }
   const alterRe = /ALTER\s+TABLE\s+(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+ADD\s+COLUMN\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+([^;]+?)(?=;|$)/gi;
-  while ((m = alterRe.exec(allSql)) !== null) {
+  for (const m of allSql.matchAll(alterRe)) {
     const tableName = m[1] ?? m[2];
     const colName = m[3] ?? m[4];
     const tail = m[5];
@@ -3744,6 +3944,10 @@ function parseSchema(sqlChunks) {
       tableCols.set(col.name, col);
     }
   }
+  const dropRe = /ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+DROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))/gi;
+  for (const m of allSql.matchAll(dropRe)) {
+    tables.get(m[1] ?? m[2])?.delete(m[3] ?? m[4]);
+  }
   return {
     tables: order.map((name) => ({ name, columns: [...tables.get(name).values()] }))
   };
@@ -3793,18 +3997,18 @@ ${c6.bold("Extension types")}
 `);
   console.log(`  Extension dir: ${c6.dim(dir)}`);
   const manifestPath = join9(dir, "manifest.json");
-  if (!existsSync9(manifestPath)) {
+  if (!existsSync10(manifestPath)) {
     console.error(c6.red(`No manifest.json found in ${dir}`));
     console.error(c6.dim("  Run this command from your extension's root folder, or pass --dir."));
     process.exit(1);
   }
   const migrationsDir = join9(dir, "engine", "migrations");
-  if (!existsSync9(migrationsDir)) {
+  if (!existsSync10(migrationsDir)) {
     console.error(c6.yellow(`No engine/migrations directory found at ${migrationsDir}`));
     console.error(c6.dim("  Nothing to generate. Add SQL migrations first."));
     process.exit(0);
   }
-  const sqlFiles = readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort();
+  const sqlFiles = readdirSync2(migrationsDir).filter((f) => f.endsWith(".sql")).sort();
   if (sqlFiles.length === 0) {
     console.error(c6.yellow(`No .sql files in ${migrationsDir}`));
     process.exit(0);
@@ -3832,13 +4036,14 @@ ${c6.bold("Extension types")}
   mkdirSync2(join9(outputPath, ".."), { recursive: true });
   writeFileSync2(outputPath, tsBody, "utf8");
   console.log(`
-${c6.green("Written:")} ${relative(process.cwd(), outputPath) || outputPath}`);
+${c6.green("Written:")} ${relative2(process.cwd(), outputPath) || outputPath}`);
   console.log(c6.dim("  Add `.zveltio/` to your .gitignore. Regenerate with this command after every migration."));
   console.log("");
 }
 
 // src/commands/extension-validate.ts
-import { existsSync as existsSync10, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync } from "fs";
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync11, readdirSync as readdirSync3, readFileSync as readFileSync4, statSync } from "fs";
 import { join as join10 } from "path";
 
 // ../sdk/dist/validate/migration-parse.js
@@ -3855,6 +4060,221 @@ function parseMigrationSql(raw) {
   return { up, down: downBody.length > 0 ? downBody : null };
 }
 
+// ../sdk/dist/validate/shared-message-keys.js
+var SHARED_MESSAGE_KEYS = new Set([
+  "common.accessRestricted",
+  "common.actions",
+  "common.add",
+  "common.added",
+  "common.aiStudio",
+  "common.approve",
+  "common.assign",
+  "common.bulkActions",
+  "common.cancel",
+  "common.cancelEdit",
+  "common.clear",
+  "common.clearSelection",
+  "common.close",
+  "common.col.account",
+  "common.col.active",
+  "common.col.address",
+  "common.col.amount",
+  "common.col.balance",
+  "common.col.bank",
+  "common.col.bcc",
+  "common.col.category",
+  "common.col.cc",
+  "common.col.channel",
+  "common.col.client",
+  "common.col.code",
+  "common.col.collection",
+  "common.col.company",
+  "common.col.created",
+  "common.col.credit",
+  "common.col.currency",
+  "common.col.date",
+  "common.col.days",
+  "common.col.debit",
+  "common.col.department",
+  "common.col.description",
+  "common.col.docNumber",
+  "common.col.dueDate",
+  "common.col.duration",
+  "common.col.email",
+  "common.col.employee",
+  "common.col.enabled",
+  "common.col.end",
+  "common.col.event",
+  "common.col.field",
+  "common.col.file",
+  "common.col.from",
+  "common.col.hireDate",
+  "common.col.host",
+  "common.col.iban",
+  "common.col.index",
+  "common.col.key",
+  "common.col.label",
+  "common.col.leaveType",
+  "common.col.locale",
+  "common.col.message",
+  "common.col.method",
+  "common.col.model",
+  "common.col.name",
+  "common.col.notes",
+  "common.col.number",
+  "common.col.paid",
+  "common.col.parent",
+  "common.col.password",
+  "common.col.path",
+  "common.col.phone",
+  "common.col.port",
+  "common.col.position",
+  "common.col.price",
+  "common.col.priority",
+  "common.col.product",
+  "common.col.project",
+  "common.col.provider",
+  "common.col.quantity",
+  "common.col.reason",
+  "common.col.recipient",
+  "common.col.records",
+  "common.col.required",
+  "common.col.resource",
+  "common.col.role",
+  "common.col.sku",
+  "common.col.slug",
+  "common.col.start",
+  "common.col.status",
+  "common.col.subject",
+  "common.col.taxId",
+  "common.col.template",
+  "common.col.ticket",
+  "common.col.time",
+  "common.col.title",
+  "common.col.to",
+  "common.col.total",
+  "common.col.type",
+  "common.col.unique",
+  "common.col.unit",
+  "common.col.user",
+  "common.col.username",
+  "common.col.validUntil",
+  "common.col.value",
+  "common.col.vat",
+  "common.col.vendor",
+  "common.col.version",
+  "common.col.warehouse",
+  "common.col.year",
+  "common.collectionRequired",
+  "common.confirm",
+  "common.copied",
+  "common.copy",
+  "common.copyShort",
+  "common.create",
+  "common.delete",
+  "common.deleteCount",
+  "common.deleteFailed",
+  "common.discard",
+  "common.dismiss",
+  "common.dismissNotification",
+  "common.done",
+  "common.download",
+  "common.edit",
+  "common.emptyDash",
+  "common.failed",
+  "common.fields",
+  "common.filter.admin",
+  "common.filter.all",
+  "common.filter.allStatuses",
+  "common.filter.auth",
+  "common.filter.data",
+  "common.format",
+  "common.generate",
+  "common.loadFailed",
+  "common.loading",
+  "common.logout",
+  "common.manage",
+  "common.mergeFailed",
+  "common.nameRequired",
+  "common.new",
+  "common.next",
+  "common.no",
+  "common.noResults",
+  "common.notFound",
+  "common.op.delete",
+  "common.op.insert",
+  "common.op.update",
+  "common.open",
+  "common.optional",
+  "common.optionalParen",
+  "common.other",
+  "common.pageOf",
+  "common.post",
+  "common.prev",
+  "common.publish",
+  "common.rangeOf",
+  "common.refresh",
+  "common.reject",
+  "common.remove",
+  "common.rename",
+  "common.reorder",
+  "common.required",
+  "common.resetFailed",
+  "common.retry",
+  "common.revoke",
+  "common.save",
+  "common.saveFailed",
+  "common.saved",
+  "common.saving",
+  "common.search",
+  "common.selectCollection",
+  "common.selectPlaceholder",
+  "common.selected",
+  "common.send",
+  "common.somethingWrong",
+  "common.status.approved",
+  "common.status.cancelled",
+  "common.status.draft",
+  "common.status.pending",
+  "common.status.reimbursed",
+  "common.status.rejected",
+  "common.status.submitted",
+  "common.submit",
+  "common.sync",
+  "common.testConnection",
+  "common.typeToSearch",
+  "common.undo",
+  "common.unexpectedError",
+  "common.unknownError",
+  "common.upload",
+  "common.uploadFailed",
+  "common.uploading",
+  "common.verifyingPermissions",
+  "common.view",
+  "common.viewAll",
+  "common.yes",
+  "ext.approved",
+  "ext.confirm.deleteForm",
+  "ext.confirm.deleteNamed",
+  "ext.confirm.removeSearchIndex",
+  "ext.confirmDelete",
+  "ext.copied",
+  "ext.copyFailed",
+  "ext.created",
+  "ext.deleted",
+  "ext.errorPrefix",
+  "ext.linkCopied",
+  "ext.loadFailed",
+  "ext.rejected",
+  "ext.reveal.copy",
+  "ext.reveal.note",
+  "ext.reveal.title",
+  "ext.saveFailed",
+  "ext.saved",
+  "ext.sent",
+  "ext.submitted"
+]);
+
 // ../sdk/dist/validate/index.js
 var SEMVER_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/;
 var KNOWN_CATEGORIES = new Set([
@@ -3890,6 +4310,9 @@ var SAFE_VERSION_RANGE = /^[\d.*^~>=<| -]+$/;
 function err(code, message, file) {
   return file ? { code, message, file } : { code, message };
 }
+function warn(code, message, file) {
+  return { ...err(code, message, file), severity: "warning" };
+}
 function validateManifest(input) {
   const out = [];
   const m = input.manifest;
@@ -3917,7 +4340,7 @@ function validateManifest(input) {
     out.push(err("MANIFEST_BAD_MAX_VERSION", `zveltioMaxVersion "${obj.zveltioMaxVersion}" is not valid semver`));
   }
   if (typeof obj.category === "string" && !KNOWN_CATEGORIES.has(obj.category)) {
-    out.push(err("MANIFEST_UNKNOWN_CATEGORY", `category "${obj.category}" isn't in the known set \u2014 typo? Known: ${[...KNOWN_CATEGORIES].sort().join(", ")}`));
+    out.push(warn("MANIFEST_UNKNOWN_CATEGORY", `category "${obj.category}" isn't in the known set \u2014 typo? Known: ${[...KNOWN_CATEGORIES].sort().join(", ")}`));
   }
   return out;
 }
@@ -3949,12 +4372,111 @@ function hasDestructiveDdl(upSql) {
     return true;
   if (/\bDROP\s+COLUMN\b/i.test(s))
     return true;
-  if (/\bALTER\s+COLUMN\b[\s\S]*?\bDROP\s+(NOT\s+NULL|DEFAULT)\b/i.test(s))
-    return true;
   return false;
 }
+function userRefUuidColumns(upSql) {
+  const s = upSql.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
+  const found = new Set;
+  for (const m of s.matchAll(/(\b[a-z_][a-z0-9_]*_by)\s+UUID\b/gi)) {
+    found.add(m[1].toLowerCase());
+  }
+  for (const m of s.matchAll(/ALTER\s+COLUMN\s+(\b[a-z_][a-z0-9_]*_by)\s+TYPE\s+UUID\b/gi)) {
+    found.add(m[1].toLowerCase());
+  }
+  return [...found];
+}
+function userRefFixedColumns(upSql) {
+  const s = upSql.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
+  return [
+    ...new Set([...s.matchAll(/ALTER\s+COLUMN\s+(\b[a-z_][a-z0-9_]*_by)\s+TYPE\s+TEXT\b/gi)].map((m) => m[1].toLowerCase()))
+  ];
+}
+function createTableColumnDefs(sql) {
+  const out = [];
+  const re = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?[^(]*\(/gi;
+  let m;
+  while ((m = re.exec(sql)) !== null) {
+    let depth = 1;
+    let item = "";
+    let i = m.index + m[0].length;
+    for (;i < sql.length && depth > 0; i++) {
+      const ch = sql[i];
+      if (ch === "(")
+        depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0)
+          break;
+      }
+      if (depth === 1 && ch === ",") {
+        out.push(item);
+        item = "";
+        continue;
+      }
+      item += ch;
+    }
+    out.push(item);
+    re.lastIndex = i;
+  }
+  return out;
+}
+function columnLevelUniqueColumns(sql) {
+  const out = [];
+  for (const def of createTableColumnDefs(sql)) {
+    const t = def.trim();
+    const bare = t.replace(/'(?:[^']|'')*'/g, "''");
+    if (!/\bUNIQUE\b(?!\s*\()/i.test(bare))
+      continue;
+    const name = /^([a-z_][a-z0-9_]*)\s+\S/i.exec(t)?.[1];
+    if (!name)
+      continue;
+    if (/^(?:primary|unique|constraint|foreign|check|exclude|like)$/i.test(name))
+      continue;
+    out.push(name);
+  }
+  return out;
+}
+function keyColumnSets(upSql) {
+  const s = upSql.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
+  const sets = [];
+  const add = (cols) => sets.push(cols.split(",").map((c7) => c7.trim().replace(/["`]/g, "").toLowerCase()).filter(Boolean));
+  for (const m of s.matchAll(/\bUNIQUE\s*\(([^)]+)\)/gi))
+    add(m[1]);
+  for (const m of s.matchAll(/\bPRIMARY\s+KEY\s*\(([^)]+)\)/gi))
+    add(m[1]);
+  for (const m of s.matchAll(/CREATE\s+UNIQUE\s+INDEX[^(]*\(([^)]+)\)/gi))
+    add(m[1]);
+  for (const col of columnLevelUniqueColumns(s))
+    add(col);
+  for (const m of s.matchAll(/\bADD\s+COLUMN\s+(?:IF\s+NOT\s+EXISTS\s+)?([a-z_][a-z0-9_]*)[^,;\n]*?\bUNIQUE\b(?!\s*\()/gi))
+    add(m[1]);
+  return sets;
+}
+function narrowKey(parts) {
+  if (parts.length === 0)
+    return null;
+  if (parts.includes("tenant_id"))
+    return null;
+  if (parts.length === 1 && parts[0] === "id")
+    return null;
+  if (parts.some((p) => /token|hash|secret/.test(p)))
+    return null;
+  if (parts.some((p) => /_id$/.test(p)))
+    return null;
+  return [...parts].sort().join(", ");
+}
+function widenedKey(parts) {
+  if (!parts.includes("tenant_id"))
+    return null;
+  const rest = parts.filter((p) => p !== "tenant_id").sort();
+  return rest.length > 0 ? rest.join(", ") : null;
+}
 function validateMigrations(input) {
   const out = [];
+  const narrowKeys = [];
+  const widened = new Set;
+  const uuidRefs = [];
+  const fixedRefs = new Set;
   for (const file of input.files) {
     if (file.sql.trim() === "") {
       out.push(err("MIGRATION_EMPTY", "migration file is empty", file.filename));
@@ -3974,6 +4496,25 @@ function validateMigrations(input) {
     if (input.requireDownForDestructive && hasDestructiveDdl(parsed.up) && !parsed.down) {
       out.push(err("MIGRATION_DESTRUCTIVE_NO_DOWN", 'migration contains destructive DDL (DROP TABLE/COLUMN or ALTER ... DROP) but has no "-- DOWN" section. Add one so uninstall --purgeData can roll back.', file.filename));
     }
+    narrowKeys.push(...keyColumnSets(parsed.up).map(narrowKey).filter((k) => k !== null).map((cols) => ({ cols, filename: file.filename })));
+    for (const parts of keyColumnSets(parsed.up)) {
+      const wide = widenedKey(parts);
+      if (wide)
+        widened.add(wide);
+    }
+    uuidRefs.push(...userRefUuidColumns(parsed.up).map((column) => ({ column, filename: file.filename })));
+    for (const column of userRefFixedColumns(parsed.up))
+      fixedRefs.add(column);
+  }
+  for (const { column, filename } of uuidRefs) {
+    if (fixedRefs.has(column))
+      continue;
+    out.push(err("SCHEMA_USER_REF_UUID", `"${column}" is declared UUID and its name says it records a user. ` + '`"user".id` is a 32-character nanoid, so Postgres rejects every write with ' + '22P02 "invalid input syntax for type uuid" \u2014 the route then fails for ' + "everybody, always, with an error naming the type rather than the cause. " + "Declare it TEXT.", filename));
+  }
+  for (const { cols, filename } of narrowKeys) {
+    if (widened.has(cols))
+      continue;
+    out.push(err("SCHEMA_UNIQUE_WITHOUT_TENANT", `UNIQUE (${cols}) leaves out tenant_id. Several companies share one ` + "instance, so the second one to use a value is refused it \u2014 its own invoice " + "number, its own product code, its own fiscal year \u2014 and row-level security " + "hides the conflicting row, so it is shown a database error about something " + `it cannot see and cannot resolve. Use UNIQUE (tenant_id, ${cols}) unless ` + "the value must be unique across the whole instance, as a token or a hash is.", filename));
   }
   return out;
 }
@@ -3997,6 +4538,215 @@ function validateBundleSize(input) {
   }
   return [];
 }
+var SDUI_SHARED_READ_ALLOWLIST = new Set([
+  "/api/collections",
+  "/api/views"
+]);
+function normalizeRoute(p) {
+  return p.split("?")[0].replace(/\{[^}]+\}/g, "*").replace(/:[^/]+/g, "*").replace(/\/+$/, "") || "/";
+}
+var SDUI_I18N_SLOTS = [
+  "title",
+  "subtitle",
+  "label",
+  "placeholder",
+  "note",
+  "confirm",
+  "description",
+  "emptyText",
+  "emptyTitle",
+  "hint"
+];
+var I18N_UNIVERSAL = new Set([
+  "API",
+  "JSON",
+  "NDJSON",
+  "CSV",
+  "SQL",
+  "URL",
+  "UUID",
+  "ID",
+  "HTTP",
+  "HTTPS",
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "Zveltio",
+  "OK",
+  "UTC",
+  "AI",
+  "SDK",
+  "CLI",
+  "RLS",
+  "DB",
+  "PDF",
+  "XML",
+  "YAML"
+]);
+var I18N_PRODUCT_NAMES = new Set([
+  "HubSpot",
+  "Notion",
+  "Airtable",
+  "Okta",
+  "Entra ID",
+  "Slack",
+  "Stripe",
+  "Salesforce",
+  "ANAF"
+]);
+function isProductNameList(s) {
+  const parts = s.split(/[/,\u00B7|]/).map((p) => p.trim()).filter(Boolean);
+  return parts.length > 0 && parts.every((p) => I18N_PRODUCT_NAMES.has(p));
+}
+function looksLikeMessageKey(s) {
+  return /^[a-z][a-z0-9]*(\.[a-z0-9_]+)+$/i.test(s);
+}
+function looksTranslatable(s) {
+  const t = s.trim();
+  if (t.length < 3)
+    return false;
+  if (I18N_UNIVERSAL.has(t))
+    return false;
+  if (isProductNameList(t))
+    return false;
+  if (!/[a-z]{2}/.test(t))
+    return false;
+  if (/^[a-z0-9_.\-/]+$/.test(t))
+    return false;
+  if (/^[a-z0-9_]+=/.test(t))
+    return false;
+  if (t.startsWith("http"))
+    return false;
+  return /^[A-Z]/.test(t) || t.split(/\s+/).length > 1;
+}
+function collectI18nStrings(node, acc) {
+  if (Array.isArray(node)) {
+    for (const x of node)
+      collectI18nStrings(x, acc);
+    return;
+  }
+  if (node && typeof node === "object") {
+    for (const [k, v] of Object.entries(node)) {
+      if (SDUI_I18N_SLOTS.includes(k) && typeof v === "string" && v)
+        acc.push({ slot: k, value: v });
+      else
+        collectI18nStrings(v, acc);
+    }
+  }
+}
+function collectEndpoints(node, acc) {
+  if (Array.isArray(node)) {
+    for (const x of node)
+      collectEndpoints(x, acc);
+    return;
+  }
+  if (node && typeof node === "object") {
+    for (const [k, v] of Object.entries(node)) {
+      if ((k === "dataSource" || k === "endpoint" || k === "saveEndpoint" || k === "catalogDataSource" || k === "loadEndpoint") && typeof v === "string")
+        acc.push(v);
+      else
+        collectEndpoints(v, acc);
+    }
+  }
+}
+function validateSduiSchema(input) {
+  const out = [];
+  const { schema, extName, file } = input;
+  if (schema === null || typeof schema !== "object" || Array.isArray(schema)) {
+    out.push(err("SDUI_NOT_OBJECT", "schema must be a JSON object", file));
+    return out;
+  }
+  const s = schema;
+  if (typeof s.title !== "string" || !s.title)
+    out.push(err("SDUI_NO_TITLE", 'schema missing "title"', file));
+  if (s.kind === "settings") {
+    if (typeof s.dataSource !== "string" || typeof s.saveEndpoint !== "string")
+      out.push(err("SDUI_SETTINGS_SHAPE", "settings schema needs dataSource + saveEndpoint", file));
+  } else if (!Array.isArray(s.resources) || s.resources.length === 0) {
+    out.push(err("SDUI_NO_RESOURCES", 'page schema needs a non-empty "resources" array', file));
+  }
+  const mount = `/ext/${extName}`;
+  const depMounts = (input.dependencies ?? []).map((d) => `/ext/${d}`);
+  const provided = input.providedRoutes ? new Set(input.providedRoutes.map(normalizeRoute)) : undefined;
+  const inMount = (bare, m) => bare === m || bare.startsWith(`${m}/`);
+  const endpoints = [];
+  collectEndpoints(schema, endpoints);
+  for (const raw of endpoints) {
+    const bare = raw.split("?")[0];
+    if (SDUI_SHARED_READ_ALLOWLIST.has(bare))
+      continue;
+    if (depMounts.some((m) => inMount(bare, m)))
+      continue;
+    if (!inMount(bare, mount)) {
+      out.push(err("SDUI_ENDPOINT_FOREIGN", `endpoint "${raw}" is outside this extension's namespace "${mount}/" (or a declared dependency, or the shared-read allowlist). Schemas may only call their own routes.`, file));
+      continue;
+    }
+    if (provided) {
+      const rel = normalizeRoute(bare.slice(mount.length) || "/");
+      if (!isProvidedRoute(provided, rel)) {
+        out.push(err("SDUI_ENDPOINT_UNKNOWN", `endpoint "${raw}" resolves to "${rel}", which the engine does not serve. Provided routes: ${[...provided].sort().join(", ") || "(none found)"}.`, file));
+      }
+    }
+  }
+  if (input.messageKeys) {
+    const known = new Set(input.messageKeys);
+    const strings = [];
+    collectI18nStrings(schema, strings);
+    for (const { slot, value } of strings) {
+      if (known.has(value))
+        continue;
+      if (looksLikeMessageKey(value)) {
+        out.push(err("SDUI_I18N_KEY_MISSING", `${slot} "${value}" is not a known message key. The host renders an unknown key as literal text, so this reaches the user as-is. Add it to studio/messages/{locale}.json, or use a shared common.* key.`, file));
+      } else if (looksTranslatable(value)) {
+        out.push(warn("SDUI_I18N_HARDCODED", `${slot} "${value}" is hardcoded text, not a message key \u2014 it stays English in all nine locales. Move it to studio/messages/{locale}.json.`, file));
+      }
+    }
+  }
+  return out;
+}
+function joinRoutePath(prefix, child) {
+  if (!child || child === "/")
+    return prefix || "/";
+  const p = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
+  return child.startsWith("/") ? `${p}${child}` : `${p}/${child}`;
+}
+function isProvidedRoute(provided, rel) {
+  if (provided.has(rel))
+    return true;
+  for (const p of provided) {
+    if (!p.endsWith("/*"))
+      continue;
+    const base = p.slice(0, -2);
+    if (!base || base === "/")
+      continue;
+    if (rel === base || rel.startsWith(`${base}/`))
+      return true;
+  }
+  return false;
+}
+function extractEngineRoutes(engineSourceTexts) {
+  const routes = new Set;
+  const methodRe = /\.(?:get|post|put|patch|delete)\(\s*['"`]([^'"`]+)['"`]/g;
+  const mountRe = /\.route\(\s*['"`]([^'"`]+)['"`]/g;
+  for (const text of engineSourceTexts) {
+    let m;
+    while ((m = methodRe.exec(text)) !== null) {
+      if (m[1].startsWith("/"))
+        routes.add(m[1]);
+    }
+    while ((m = mountRe.exec(text)) !== null) {
+      const prefix = m[1];
+      if (!prefix.startsWith("/"))
+        continue;
+      routes.add(prefix);
+      if (prefix !== "/")
+        routes.add(joinRoutePath(prefix, "/*"));
+    }
+  }
+  return [...routes];
+}
 function validateExtension(input) {
   const errors = [
     ...validateManifest(input.manifest),
@@ -4006,7 +4756,7 @@ function validateExtension(input) {
     ...input.bundleSize ? validateBundleSize(input.bundleSize) : []
   ];
   return {
-    ok: errors.length === 0,
+    ok: errors.every((e) => e.severity === "warning"),
     errors,
     stats: {
       tables: input.stats.tables,
@@ -4017,6 +4767,7 @@ function validateExtension(input) {
 }
 
 // src/commands/extension-validate.ts
+init_extension_pack();
 var c7 = {
   bold: (s) => `\x1B[1m${s}\x1B[0m`,
   green: (s) => `\x1B[32m${s}\x1B[0m`,
@@ -4034,14 +4785,16 @@ var PEER_DEPS_ALLOWLIST = new Set([
   "@aws-sdk/s3-request-presigner",
   "nanoid",
   "qrcode",
+  "pdf-lib",
+  "@pdf-lib/fontkit",
   "pdfkit",
   "graphql"
 ]);
 function recursiveSize(dir) {
   let total = 0;
-  if (!existsSync10(dir))
+  if (!existsSync11(dir))
     return 0;
-  for (const name of readdirSync2(dir)) {
+  for (const name of readdirSync3(dir)) {
     const full = join10(dir, name);
     if (name === "node_modules" || name === ".zveltio" || name === "dist")
       continue;
@@ -4058,14 +4811,119 @@ function recursiveSize(dir) {
   }
   return total;
 }
+function readEngineSources(dir) {
+  const bundled = join10(dir, "engine", "index.js");
+  if (existsSync11(bundled)) {
+    try {
+      return [readFileSync4(bundled, "utf8")];
+    } catch {}
+  }
+  const out = [];
+  const walk = (d) => {
+    if (!existsSync11(d))
+      return;
+    for (const name of readdirSync3(d)) {
+      if (name === "migrations" || name === "node_modules")
+        continue;
+      const full = join10(d, name);
+      let st;
+      try {
+        st = statSync(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory())
+        walk(full);
+      else if (/\.(ts|js)$/.test(name)) {
+        try {
+          out.push(readFileSync4(full, "utf8"));
+        } catch {}
+      }
+    }
+  };
+  walk(join10(dir, "engine"));
+  return out;
+}
+function readOwnMessageKeys(dir) {
+  const path = join10(dir, "studio", "messages", "en.json");
+  if (!existsSync11(path))
+    return;
+  try {
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    return new Set(Object.keys(parsed));
+  } catch {
+    return;
+  }
+}
+function readDependencyMessageKeys(dir, extName, deps) {
+  const out = new Set;
+  const depth = extName.split("/").length;
+  const root = join10(dir, ...Array(depth).fill(".."));
+  for (const dep of deps) {
+    const path = join10(root, dep, "studio", "messages", "en.json");
+    if (!existsSync11(path))
+      continue;
+    try {
+      for (const k of Object.keys(JSON.parse(readFileSync4(path, "utf8"))))
+        out.add(k);
+    } catch {}
+  }
+  return out;
+}
 function inferExpectedName(dir) {
   const norm = dir.replace(/\\/g, "/");
-  const idx = norm.indexOf("zveltio-extensions/");
+  const marker = "zveltio-extensions/";
+  const idx = norm.lastIndexOf(marker);
   if (idx >= 0) {
-    return norm.slice(idx + "zveltio-extensions/".length).replace(/\/$/, "");
+    return norm.slice(idx + marker.length).replace(/\/$/, "");
   }
   return norm.split("/").filter(Boolean).pop() ?? "";
 }
+function checkBundleIntegrity(dir, manifest) {
+  const bundle = join10(dir, "engine", "index.js");
+  const integrity = manifest?.integrity;
+  if (!integrity)
+    return [];
+  if (!existsSync11(bundle)) {
+    return integrity.engineSha256 && existsSync11(join10(dir, "engine", "index.ts")) ? [
+      {
+        code: "BUNDLE_MISSING",
+        message: "manifest records integrity.engineSha256 but engine/index.js does not exist. " + "Run `zveltio extension pack`.",
+        file: "engine/index.js"
+      }
+    ] : [];
+  }
+  const out = [];
+  if (integrity.engineSha256) {
+    const actual = createHash2("sha256").update(readFileSync4(bundle)).digest("hex");
+    if (actual !== integrity.engineSha256) {
+      out.push({
+        code: "BUNDLE_HASH_MISMATCH",
+        message: `engine/index.js (sha256 ${actual.slice(0, 12)}\u2026) does not match ` + `integrity.engineSha256 (${integrity.engineSha256.slice(0, 12)}\u2026). ` + "Re-pack \u2014 the engine refuses a bundle whose hash disagrees with its manifest.",
+        file: "engine/index.js"
+      });
+    }
+  }
+  if (!existsSync11(join10(dir, "engine", "index.ts")))
+    return out;
+  if (!integrity.sourceSha256) {
+    out.push({
+      code: "BUNDLE_SOURCE_UNRECORDED",
+      severity: "warning",
+      message: "manifest has no integrity.sourceSha256, so nothing can tell whether the bundle " + "was built from the committed source. Re-pack to record it.",
+      file: "manifest.json"
+    });
+    return out;
+  }
+  if (hashEngineSources(dir) !== integrity.sourceSha256) {
+    out.push({
+      code: "BUNDLE_OLDER_THAN_SOURCE",
+      message: "engine/index.js was NOT built from the current engine/ sources, so the changes in " + "them do not run anywhere. Run `zveltio extension pack`.",
+      file: "engine/index.js"
+    });
+  }
+  return out;
+}
 async function extensionValidateCommand(opts = {}) {
   const dir = opts.dir ?? process.cwd();
   console.log(`
@@ -4074,7 +4932,7 @@ ${c7.bold("Extension validate")}
   console.log(`  Extension dir: ${c7.dim(dir)}`);
   const manifestPath = join10(dir, "manifest.json");
   let manifest = null;
-  if (existsSync10(manifestPath)) {
+  if (existsSync11(manifestPath)) {
     try {
       manifest = JSON.parse(readFileSync4(manifestPath, "utf8"));
     } catch (e) {
@@ -4082,11 +4940,12 @@ ${c7.bold("Extension validate")}
       manifest = null;
     }
   }
+  const isStudioOnly = manifest != null && typeof manifest === "object" && manifest?.contributes?.engine === false && !manifest?.engine;
   const migrationsDir = join10(dir, "engine", "migrations");
   let sqlFiles = [];
   let parsedTableCount = 0;
-  if (existsSync10(migrationsDir)) {
-    sqlFiles = readdirSync2(migrationsDir).filter((f) => f.endsWith(".sql")).sort().map((filename) => ({
+  if (existsSync11(migrationsDir)) {
+    sqlFiles = readdirSync3(migrationsDir).filter((f) => f.endsWith(".sql")).sort().map((filename) => ({
       filename,
       sql: readFileSync4(join10(migrationsDir, filename), "utf8")
     }));
@@ -4098,10 +4957,10 @@ ${c7.bold("Extension validate")}
   }
   const paths = {};
   for (const rel of ["manifest.json", "engine/index.ts", "engine/index.js"]) {
-    paths[rel] = existsSync10(join10(dir, rel));
+    paths[rel] = existsSync11(join10(dir, rel));
   }
   const required = ["manifest.json"];
-  if (!(paths["engine/index.ts"] || paths["engine/index.js"])) {
+  if (!isStudioOnly && !(paths["engine/index.ts"] || paths["engine/index.js"])) {
     required.push("engine/index.ts");
   }
   const bundleBytes = recursiveSize(dir);
@@ -4125,10 +4984,67 @@ ${c7.bold("Extension validate")}
     },
     stats: { tables: parsedTableCount, migrations: sqlFiles.length }
   });
+  const sduiErrors = [];
+  {
+    const pages = manifest && typeof manifest === "object" ? manifest?.studio?.pages ?? [] : [];
+    const schemaPages = (Array.isArray(pages) ? pages : []).filter((p) => typeof p?.schema === "string");
+    if (schemaPages.length > 0) {
+      const manifestRecord = manifest && typeof manifest === "object" ? manifest : undefined;
+      const extName = typeof manifestRecord?.name === "string" ? manifestRecord.name : inferExpectedName(dir);
+      const provided = extractEngineRoutes(readEngineSources(dir));
+      const ownMessageKeys = readOwnMessageKeys(dir);
+      const dependencies = Array.isArray(manifest?.dependencies) ? manifest.dependencies.map((d) => typeof d === "string" ? d : d?.name).filter((x) => typeof x === "string") : [];
+      for (const p of schemaPages) {
+        const rel = join10("studio", p.schema).replace(/\\/g, "/");
+        const abs = join10(dir, "studio", p.schema);
+        let parsed = null;
+        if (!existsSync11(abs)) {
+          sduiErrors.push({
+            code: "SDUI_SCHEMA_MISSING",
+            message: "schema file not found",
+            file: rel
+          });
+          continue;
+        }
+        try {
+          parsed = JSON.parse(readFileSync4(abs, "utf8"));
+        } catch (e) {
+          sduiErrors.push({
+            code: "SDUI_SCHEMA_BAD_JSON",
+            message: `not valid JSON: ${e.message}`,
+            file: rel
+          });
+          continue;
+        }
+        sduiErrors.push(...validateSduiSchema({
+          schema: parsed,
+          extName,
+          providedRoutes: provided,
+          dependencies,
+          messageKeys: ownMessageKeys && new Set([
+            ...ownMessageKeys,
+            ...SHARED_MESSAGE_KEYS,
+            ...readDependencyMessageKeys(dir, extName, dependencies)
+          ]),
+          file: rel
+        }));
+      }
+      result.errors.push(...sduiErrors);
+      const sduiHard = sduiErrors.filter((e) => e.severity !== "warning");
+      if (sduiHard.length > 0)
+        result.ok = false;
+      const sduiWarn = sduiErrors.length - sduiHard.length;
+      const sduiSummary = sduiHard.length > 0 ? c7.red(`${sduiHard.length} error(s)`) : sduiWarn > 0 ? c7.yellow(`${schemaPages.length} OK, ${sduiWarn} warning(s)`) : c7.green(`${schemaPages.length} OK`);
+      console.log(`  SDUI schemas:  ${sduiSummary}`);
+    }
+  }
   const m = manifest;
+  const studioOnly = isStudioOnly;
   const v2Status = (() => {
     if (!m)
       return "unknown";
+    if (studioOnly)
+      return "studio-only";
     if (!m.engine)
       return "v1-legacy";
     if (m.engine.bundled !== true)
@@ -4143,34 +5059,39 @@ ${c7.bold("Extension validate")}
   console.log(`  Migrations:    ${c7.dim(`${result.stats.migrations} file(s), ${result.stats.tables} table(s) parsed`)}`);
   console.log(`  Peer deps:     ${c7.dim(`${result.stats.peerDeps} declared`)}`);
   console.log(`  Bundle size:   ${c7.dim(`${Math.ceil(bundleBytes / 1024)} KB`)}`);
-  const v2Label = v2Status === "v2-ok" ? c7.green("v2 (bundled)") : v2Status === "v1-legacy" ? c7.yellow("v1 (no engine block \u2014 run `zveltio extension pack`)") : v2Status === "engine-not-bundled" ? c7.red("engine.bundled !== true \u2014 re-pack required") : v2Status === "missing-engine-entry" ? c7.red("engine.entry missing") : v2Status === "missing-engine-sha" ? c7.red("integrity.engineSha256 missing \u2014 re-pack required") : c7.dim("unknown");
+  const v2Label = v2Status === "v2-ok" ? c7.green("v2 (bundled)") : v2Status === "studio-only" ? c7.green("studio/client-only (no engine)") : v2Status === "v1-legacy" ? c7.yellow("v1 (no engine block \u2014 run `zveltio extension pack`)") : v2Status === "engine-not-bundled" ? c7.red("engine.bundled !== true \u2014 re-pack required") : v2Status === "missing-engine-entry" ? c7.red("engine.entry missing") : v2Status === "missing-engine-sha" ? c7.red("integrity.engineSha256 missing \u2014 re-pack required") : c7.dim("unknown");
   console.log(`  Manifest v2:   ${v2Label}`);
-  const isolation = m?.engine?.isolation ?? "inline";
-  const resolved = await resolvePublisherTier({
-    firstParty: opts.firstParty,
-    token: opts.token,
-    registryUrl: opts.registryUrl
-  });
-  const inlineOk = tierAllowsInline(resolved.tier);
-  const tierSrc = resolved.source === "flag" ? "--first-party" : resolved.source === "registry" ? "registry" : "default";
-  if (isolation === "worker") {
-    console.log(`  Isolation:     ${c7.green("worker (runs in any tier)")}`);
-  } else if (inlineOk) {
-    console.log(`  Isolation:     ${c7.dim(`inline (${resolved.tier} \u2014 allowed, via ${tierSrc})`)}`);
+  if (studioOnly) {
+    console.log(`  Isolation:     ${c7.dim("n/a (no engine)")}`);
+    console.log("");
   } else {
-    console.log(`  Isolation:     ${c7.red(`inline \u2014 ${resolved.tier} publishers MUST use 'worker'`)}`);
-  }
-  console.log("");
-  if (isolation !== "worker" && !inlineOk) {
-    console.error(c7.red(`Validation failed: ${resolved.tier} publishers must declare ` + `engine.isolation: "worker" (MARKETPLACE-POLICY \xA72).`));
-    console.error(c7.dim('  Add `"isolation": "worker"` to the engine block in manifest.json, ' + "then re-pack. If you are a verified/first-party publisher, pass " + "--first-party or set ZVELTIO_REGISTRY_TOKEN so the tier can be confirmed. " + "See docs/MARKETPLACE-POLICY.md \xA72."));
-    if (opts.silentExit)
-      throw new Error("Validation failed: community inline isolation");
-    process.exit(1);
+    const isolation = m?.engine?.isolation ?? "inline";
+    const resolved = await resolvePublisherTier({
+      firstParty: opts.firstParty,
+      token: opts.token,
+      registryUrl: opts.registryUrl
+    });
+    const inlineOk = tierAllowsInline(resolved.tier);
+    const tierSrc = resolved.source === "flag" ? "--first-party" : resolved.source === "registry" ? "registry" : "default";
+    if (isolation === "worker") {
+      console.log(`  Isolation:     ${c7.green("worker (runs in any tier)")}`);
+    } else if (inlineOk) {
+      console.log(`  Isolation:     ${c7.dim(`inline (${resolved.tier} \u2014 allowed, via ${tierSrc})`)}`);
+    } else {
+      console.log(`  Isolation:     ${c7.red(`inline \u2014 ${resolved.tier} publishers MUST use 'worker'`)}`);
+    }
+    console.log("");
+    if (isolation !== "worker" && !inlineOk) {
+      console.error(c7.red(`Validation failed: ${resolved.tier} publishers must declare ` + `engine.isolation: "worker" (marketplace-policy.md \xA72).`));
+      console.error(c7.dim('  Add `"isolation": "worker"` to the engine block in manifest.json, ' + "then re-pack. If you are a verified/first-party publisher, pass " + "--first-party or set ZVELTIO_REGISTRY_TOKEN so the tier can be confirmed. " + "See docs/extensions/marketplace-policy.md \xA72."));
+      if (opts.silentExit)
+        throw new Error("Validation failed: community inline isolation");
+      process.exit(1);
+    }
   }
   if (v2Status === "v1-legacy") {
     console.error(c7.red("Validation failed: manifest is v1 (no engine.bundled block)."));
-    console.error(c7.dim("  v1 manifests are unsupported since 1.0.0-beta.1. Run `zveltio extension pack` to " + "generate the v2 engine + integrity blocks. See docs/EXTENSION-DEVELOPER-GUIDE.md \xA74."));
+    console.error(c7.dim("  v1 manifests are unsupported since 1.0.0-beta.1. Run `zveltio extension pack` to " + "generate the v2 engine + integrity blocks. See docs/extensions/developer-guide.md \xA74."));
     if (opts.silentExit)
       throw new Error("Validation failed: v1 manifest unsupported");
     process.exit(1);
@@ -4182,28 +5103,43 @@ ${c7.bold("Extension validate")}
       throw new Error("Validation failed: incomplete v2 manifest");
     process.exit(1);
   }
+  const integrityErrors = checkBundleIntegrity(dir, manifest);
+  if (integrityErrors.length > 0) {
+    result.errors.push(...integrityErrors);
+    if (integrityErrors.some((e) => e.severity !== "warning"))
+      result.ok = false;
+  }
+  const warnings = result.errors.filter((e) => e.severity === "warning");
+  const hardErrors = result.errors.filter((e) => e.severity !== "warning");
+  if (warnings.length > 0) {
+    console.log(c7.yellow(`${warnings.length} warning(s):`));
+    for (const e of warnings)
+      printError(e, "warning");
+    console.log("");
+  }
   if (result.ok) {
     console.log(c7.green("Validation passed."));
     console.log(c7.dim("  Run `zveltio extension types` to refresh generated types, then `zveltio extension publish` when ready."));
     console.log("");
     return;
   }
-  console.log(c7.red(`Validation failed with ${result.errors.length} error(s):`));
+  console.log(c7.red(`Validation failed with ${hardErrors.length} error(s):`));
   console.log("");
-  for (const e of result.errors) {
-    printError(e);
+  for (const e of hardErrors) {
+    printError(e, "error");
   }
   console.log("");
   if (!opts.silentExit)
     process.exit(1);
 }
-function printError(e) {
+function printError(e, severity = "error") {
   const loc = e.file ? c7.dim(` (${e.file})`) : "";
-  console.log(`  ${c7.red(e.code)}  ${e.message}${loc}`);
+  const code = severity === "warning" ? c7.yellow(e.code) : c7.red(e.code);
+  console.log(`  ${code}  ${e.message}${loc}`);
 }
 
 // src/commands/extension-publish.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync4, readFileSync as readFileSync6, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync6, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
 import { join as join12, resolve as resolve2 } from "path";
 import { tmpdir } from "os";
 
@@ -4272,16 +5208,16 @@ init_extension_pack();
 
 // src/commands/keys.ts
 import {
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync3,
-  readdirSync as readdirSync3,
+  readdirSync as readdirSync4,
   readFileSync as readFileSync5,
   writeFileSync as writeFileSync3,
   chmodSync,
   statSync as statSync2
 } from "fs";
 import { join as join11 } from "path";
-import { homedir, platform } from "os";
+import { homedir as homedir2, platform } from "os";
 var c8 = {
   bold: (s) => `\x1B[1m${s}\x1B[0m`,
   green: (s) => `\x1B[32m${s}\x1B[0m`,
@@ -4290,11 +5226,11 @@ var c8 = {
   dim: (s) => `\x1B[2m${s}\x1B[0m`
 };
 function keysDir() {
-  return join11(homedir(), ".zveltio", "keys");
+  return join11(homedir2(), ".zveltio", "keys");
 }
 function ensureKeysDir() {
   const dir = keysDir();
-  if (!existsSync11(dir)) {
+  if (!existsSync12(dir)) {
     mkdirSync3(dir, { recursive: true });
     if (platform() !== "win32") {
       try {
@@ -4318,7 +5254,7 @@ function writeKeyFile(kp) {
 }
 function readKeyFile(keyId) {
   const path = keyPath(keyId);
-  if (!existsSync11(path)) {
+  if (!existsSync12(path)) {
     throw new Error(`Keypair "${keyId}" not found at ${path}. Run \`zveltio keys generate --id ${keyId}\` first.`);
   }
   const raw = readFileSync5(path, "utf8");
@@ -4332,10 +5268,10 @@ function resolveKeyId(explicit) {
   if (explicit)
     return explicit;
   const dir = keysDir();
-  if (!existsSync11(dir)) {
+  if (!existsSync12(dir)) {
     throw new Error("No keypairs found. Run `zveltio keys generate` first.");
   }
-  const ids = readdirSync3(dir).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5));
+  const ids = readdirSync4(dir).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5));
   if (ids.length === 0)
     throw new Error("No keypairs found. Run `zveltio keys generate` first.");
   if (ids.length > 1) {
@@ -4346,7 +5282,7 @@ function resolveKeyId(explicit) {
 async function keysGenerateCommand(opts = {}) {
   ensureKeysDir();
   const kp = await generateKeypair(opts.id);
-  if (existsSync11(keyPath(kp.keyId)) && !opts.force) {
+  if (existsSync12(keyPath(kp.keyId)) && !opts.force) {
     console.error(c8.red(`Key "${kp.keyId}" already exists. Pass --force to overwrite.`));
     process.exit(1);
   }
@@ -4370,11 +5306,11 @@ ${c8.bold("Public key (share with registry admin):")}
 }
 async function keysListCommand() {
   const dir = keysDir();
-  if (!existsSync11(dir)) {
+  if (!existsSync12(dir)) {
     console.log(`${c8.yellow("No keypairs yet.")} Run ${c8.dim("zveltio keys generate")} to create one.`);
     return;
   }
-  const files = readdirSync3(dir).filter((f) => f.endsWith(".json")).sort();
+  const files = readdirSync4(dir).filter((f) => f.endsWith(".json")).sort();
   if (files.length === 0) {
     console.log(`${c8.yellow("No keypairs yet.")} Run ${c8.dim("zveltio keys generate")} to create one.`);
     return;
@@ -4411,7 +5347,7 @@ var c9 = {
 };
 function readManifest2(dir) {
   const path = join12(dir, "manifest.json");
-  if (!existsSync12(path)) {
+  if (!existsSync13(path)) {
     throw new Error(`No manifest.json at ${path}. Run from the extension's root or pass --dir.`);
   }
   const raw = readFileSync6(path, "utf8");
@@ -4451,7 +5387,7 @@ async function createArchive(dir, outFile) {
     throw new Error(`tar failed (exit ${code})`);
 }
 async function runStudioBuild(dir) {
-  if (!existsSync12(join12(dir, "studio")))
+  if (!existsSync13(join12(dir, "studio")))
     return;
   const proc = Bun.spawn(["bun", "run", "build"], {
     cwd: join12(dir, "studio"),
@@ -4463,7 +5399,7 @@ async function runStudioBuild(dir) {
     throw new Error(`Studio build failed (exit ${code})`);
 }
 async function runEnginePack(dir, tierOpts) {
-  if (!existsSync12(join12(dir, "engine", "index.ts")))
+  if (!existsSync13(join12(dir, "engine", "index.ts")))
     return;
   await extensionPackCommand({ dir, ...tierOpts });
 }
@@ -4560,7 +5496,7 @@ ${c9.green("Dry-run complete")} \u2014 skipped archive/sign/publish.
   console.log(`
 ${c9.bold("Step 4/6: archive")}`);
   const tmpDir = opts.output ? resolve2(opts.output) : join12(tmpdir(), `zveltio-publish-${Date.now()}`);
-  if (!existsSync12(tmpDir))
+  if (!existsSync13(tmpDir))
     mkdirSync4(tmpDir, { recursive: true });
   const zvextPath = join12(tmpDir, `${artifactBaseName(manifest)}.zvext`);
   try {
@@ -4662,10 +5598,10 @@ ${c9.bold("Step 6/6: upload")}`);
 }
 
 // src/commands/extension-dev.ts
-import { existsSync as existsSync13, statSync as statSync4 } from "fs";
+import { existsSync as existsSync14, statSync as statSync4 } from "fs";
 import { watch as fsWatch } from "fs";
-import { join as join13, resolve as resolve3, relative as relative3 } from "path";
-import { readdirSync as readdirSync4 } from "fs";
+import { join as join13, resolve as resolve3, relative as relative4 } from "path";
+import { readdirSync as readdirSync5 } from "fs";
 var c10 = {
   bold: (s) => `\x1B[1m${s}\x1B[0m`,
   green: (s) => `\x1B[32m${s}\x1B[0m`,
@@ -4678,7 +5614,7 @@ function readManifestName(dir, override) {
   if (override)
     return override;
   const manifestPath = join13(dir, "manifest.json");
-  if (!existsSync13(manifestPath)) {
+  if (!existsSync14(manifestPath)) {
     throw new Error(`No manifest.json at ${manifestPath}. Pass --name or run from the extension's root.`);
   }
   const Bun_ = globalThis.Bun;
@@ -4694,7 +5630,7 @@ function readManifestName(dir, override) {
   return m.name;
 }
 function collectEngineFiles(engineDir) {
-  if (!existsSync13(engineDir))
+  if (!existsSync14(engineDir))
     return [];
   const out = [];
   const stack = [engineDir];
@@ -4702,7 +5638,7 @@ function collectEngineFiles(engineDir) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = readdirSync4(dir);
+      entries = readdirSync5(dir);
     } catch {
       continue;
     }
@@ -4769,17 +5705,20 @@ ${c10.bold("Extension dev")}
     process.exit(1);
   }
   let studioProc = null;
-  if (!opts.noStudio && existsSync13(join13(dir, "studio"))) {
+  const studioPkg = join13(dir, "studio", "package.json");
+  if (!opts.noStudio && existsSync14(studioPkg)) {
     studioProc = Bun.spawn(["bun", "run", "dev"], {
       cwd: join13(dir, "studio"),
       stdout: "inherit",
       stderr: "inherit"
     });
-    console.log(`  Studio:     ${c10.green("watching (vite dev)")}`);
+    console.log(`  Studio:     ${c10.green("watching (legacy studio/package.json vite dev)")}`);
+  } else if (!opts.noStudio && existsSync14(join13(dir, "studio"))) {
+    console.log(`  Studio:     ${c10.dim("tier-3 pages \u2014 run packages/studio dev after sync-extensions (see dev guide \xA72)")}`);
   } else {
     console.log(`  Studio:     ${c10.dim(opts.noStudio ? "skipped (--no-studio)" : "no studio/ folder \u2014 skipped")}`);
   }
-  if (!existsSync13(engineDir)) {
+  if (!existsSync14(engineDir)) {
     console.log(`  Engine src: ${c10.yellow("no engine/ folder \u2014 engine watch disabled")}`);
   } else {
     const files = collectEngineFiles(engineDir);
@@ -4788,7 +5727,7 @@ ${c10.bold("Extension dev")}
     let lastTrigger = "";
     const debounceMs = 250;
     const onChange = (filePath) => {
-      lastTrigger = relative3(dir, filePath);
+      lastTrigger = relative4(dir, filePath);
       if (timer)
         clearTimeout(timer);
       timer = setTimeout(async () => {
@@ -4890,7 +5829,7 @@ ${c11.bold("Generate Types")}
 }
 
 // src/commands/install.ts
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import { readFile, mkdir as mkdir2, cp } from "fs/promises";
 import { join as join14 } from "path";
 async function installCommand(name, opts) {
@@ -4905,7 +5844,7 @@ async function installCommand(name, opts) {
   await installFromCatalog(name, engineUrl);
 }
 async function installFromPath(name, sourcePath, engineUrl, force) {
-  if (!existsSync14(join14(sourcePath, "manifest.json"))) {
+  if (!existsSync15(join14(sourcePath, "manifest.json"))) {
     console.error("\u274C No manifest.json found at", sourcePath);
     process.exit(1);
   }
@@ -4936,7 +5875,7 @@ async function installFromPath(name, sourcePath, engineUrl, force) {
   console.log(`  Version:  ${manifest.version || "?"}`);
   console.log(`  Category: ${category}`);
   const enginePkgPath = join14(process.cwd(), "packages/engine/package.json");
-  if (existsSync14(enginePkgPath)) {
+  if (existsSync15(enginePkgPath)) {
     const enginePkg = JSON.parse(await readFile(enginePkgPath, "utf-8"));
     const engineVersion = enginePkg.version || "unknown";
     if (manifest.zveltioMinVersion) {
@@ -4948,7 +5887,7 @@ async function installFromPath(name, sourcePath, engineUrl, force) {
   }
   const extName = manifest.name;
   const targetDir = join14(process.cwd(), "extensions", category, extName);
-  if (existsSync14(targetDir) && !force) {
+  if (existsSync15(targetDir) && !force) {
     console.error(`\u274C Extension already exists at ${targetDir}`);
     console.error(`   Use --force to overwrite.`);
     process.exit(1);
@@ -5114,6 +6053,7 @@ async function promptHidden(question) {
 }
 async function createGodCommand(opts) {
   const engineUrl = opts.url || process.env.ENGINE_URL || "http://localhost:3000";
+  const recoveryToken = opts.recoveryToken || process.env.RECOVERY_TOKEN || "";
   console.log(`
 \u26A0\uFE0F  SYSTEM RECOVERY OVERRIDE ACCOUNT`);
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
@@ -5191,28 +6131,29 @@ Creating God (super-admin) user at ${engineUrl}
       const err2 = await res.json().catch(() => ({ message: res.statusText }));
       throw new Error(err2.message || `HTTP ${res.status}`);
     }
-    const { user } = await res.json();
-    console.log("\uD83D\uDD11 Granting god permissions...");
-    const loginRes = await fetch(`${engineUrl}/api/auth/sign-in/email`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ email: email.trim(), password })
-    });
-    if (!loginRes.ok) {
-      console.warn("\u26A0\uFE0F  Could not auto-grant admin role \u2014 grant manually via permissions API");
+    await res.json();
+    if (!recoveryToken) {
       console.log(`
-\u2705 User created: ${email}
+\u2705 User created: ${email.trim()}`);
+      console.warn(`
+\u26A0\uFE0F  NOT granted the god role \u2014 no recovery token available.`);
+      console.warn("   `god` is handed out by one endpoint only, and it requires a token:");
+      console.warn("     RECOVERY_TOKEN=<32+ chars> zveltio create-god --email \u2026");
+      console.warn("     zveltio create-god --recovery-token <token> --email \u2026");
+      console.warn("   The engine must be started with the same RECOVERY_TOKEN set.");
+      console.warn("   With direct database access, the release binary does it without a");
+      console.warn(`   token: DATABASE_URL=\u2026 zveltio create-god --email \u2026 --password \u2026
 `);
-      return;
+      process.exit(1);
     }
-    const sessionCookie = loginRes.headers.get("set-cookie") || "";
-    const permRes = await fetch(`${engineUrl}/api/permissions/assign-role`, {
+    console.log("\uD83D\uDD11 Granting god permissions...");
+    const permRes = await fetch(`${engineUrl}/api/permissions/bootstrap`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Cookie: sessionCookie
+        Authorization: `Bearer ${recoveryToken}`
       },
-      body: JSON.stringify({ userId: user.id, role: "god" })
+      body: JSON.stringify({ email: email.trim() })
     });
     if (permRes.ok) {
       console.log(`
@@ -5220,15 +6161,20 @@ Creating God (super-admin) user at ${engineUrl}
       console.log(`   Email: ${email.trim()}`);
       console.log(`   Name:  ${name.trim()}`);
       console.log(`   Role:  god
+`);
+      console.log("   The recovery token is now spent. Rotate RECOVERY_TOKEN before the");
+      console.log(`   next recovery, and note that any previous god was stood down.
 `);
       console.log(`\uD83D\uDC49 Log in at: ${engineUrl}/admin
 `);
     } else {
+      const body = await permRes.json().catch(() => ({}));
       console.log(`
 \u2705 User created: ${email.trim()}`);
-      console.warn("\u26A0\uFE0F  Could not auto-assign god role.");
-      console.warn(`   Use the Permissions page in Studio to assign the admin role manually.
+      console.error(`
+\u274C The role was NOT granted: ${body.error ?? `engine returned ${permRes.status}`}
 `);
+      process.exit(1);
     }
   } catch (err2) {
     rl2.close();
@@ -5310,20 +6256,27 @@ var rollbackCommand = new Command("rollback").description("Rollback database mig
     process.exit(1);
   }
   process.env.DATABASE_URL = databaseUrl;
-  const dbPath = new URL("../../../engine/src/db/index.js", import.meta.url).href;
-  const migrationsPath = new URL("../../../engine/src/db/migrations/index.js", import.meta.url).href;
-  const { initDatabase } = await import(dbPath);
-  const { getLastAppliedMigration, rollbackMigration } = await import(migrationsPath);
+  let engine;
+  try {
+    engine = await loadEngineMigrationModules();
+  } catch (err2) {
+    console.error(`
+\u274C ${err2.message}
+`);
+    process.exit(1);
+  }
+  const { initDatabase } = engine.db;
+  const { getLastAppliedMigration, rollbackMigration } = engine.migrations;
   let targetVersion;
   if (opts.to !== undefined) {
     targetVersion = parseInt(opts.to);
-    if (isNaN(targetVersion)) {
+    if (Number.isNaN(targetVersion)) {
       console.error("\u274C --to must be a valid integer");
       process.exit(1);
     }
   } else {
     const steps = parseInt(opts.steps);
-    if (isNaN(steps) || steps < 1) {
+    if (Number.isNaN(steps) || steps < 1) {
       console.error("\u274C --steps must be a positive integer");
       process.exit(1);
     }
@@ -5421,7 +6374,7 @@ var versionCommand = new Command("version").description("Show version informatio
 });
 
 // src/commands/update.ts
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { join as join15 } from "path";
 var c12 = {
   bold: (s) => `\x1B[1m${s}\x1B[0m`,
@@ -5439,7 +6392,7 @@ ${c12.bold("Zveltio Update")}
   const installDir = opts.dir || process.env.ZVELTIO_DIR || join15(process.cwd(), "zveltio");
   const metaPath = join15(installDir, ".zveltio-install.json");
   let meta = null;
-  if (existsSync15(metaPath)) {
+  if (existsSync16(metaPath)) {
     try {
       meta = JSON.parse(await Bun.file(metaPath).text());
     } catch {}
@@ -5456,8 +6409,8 @@ ${c12.bold("Zveltio Update")}
       throw new Error(`Registry returned ${res.status}`);
     }
     versionsData = await res.json();
-    if (!versionsData?.latest) {
-      throw new Error('Invalid versions response (missing "latest" field)');
+    if (!versionsData?.latest && !versionsData?.latest_beta) {
+      throw new Error('Invalid versions response (no "latest" or "latest_beta")');
     }
   } catch (err2) {
     if (opts.check) {
@@ -5487,6 +6440,13 @@ ${c12.bold("Zveltio Update")}
     process.exit(1);
   }
   const targetVersion = opts.version || (opts.channel === "beta" ? versionsData.latest_beta ?? versionsData.latest : versionsData.latest);
+  if (!targetVersion) {
+    console.error(c12.red(`
+  No stable release has been published yet.`));
+    console.error(c12.dim(`  Latest beta: v${versionsData.latest_beta} \u2014 run ${c12.cyan("zveltio update --channel beta")}
+`));
+    process.exit(1);
+  }
   console.log(`  Target version:  ${c12.cyan(`v${targetVersion}`)}`);
   if (opts.check) {
     const hasUpdate = compareVersions(targetVersion, currentVersion) > 0;
@@ -5548,7 +6508,7 @@ async function getVersionFromPackageJson() {
     join15(process.cwd(), "package.json")
   ];
   for (const pkgPath of candidates) {
-    if (!existsSync15(pkgPath))
+    if (!existsSync16(pkgPath))
       continue;
     try {
       const pkg = JSON.parse(await Bun.file(pkgPath).text());
@@ -5572,14 +6532,14 @@ async function getCurrentVersionFromAPI(port) {
 }
 async function runUpdateScript(targetVersion, installDir, meta, force) {
   const envPath = join15(installDir, ".env");
-  if (existsSync15(envPath)) {
+  if (existsSync16(envPath)) {
     const backupPath = `${envPath}.backup.${Date.now()}`;
     const envContent = await Bun.file(envPath).text();
     await Bun.write(backupPath, envContent);
     console.log(`  Backed up .env \u2192 ${backupPath}`);
   }
   const installScript = join15(installDir, "install.sh");
-  if (existsSync15(installScript)) {
+  if (existsSync16(installScript)) {
     const args = [
       "bash",
       installScript,
@@ -5598,7 +6558,7 @@ async function runUpdateScript(targetVersion, installDir, meta, force) {
     if (code !== 0) {
       console.error(`
   Update failed. Your previous version is still running.`);
-      if (existsSync15(envPath)) {
+      if (existsSync16(envPath)) {
         console.log(`  Restore .env: copy ${envPath}.backup.* to ${envPath}`);
       }
       process.exit(1);
@@ -5763,14 +6723,14 @@ ${c13.bold("Zveltio Status")}
   console.log("");
 }
 async function getLocalVersion() {
-  const { existsSync: existsSync16 } = await import("fs");
+  const { existsSync: existsSync17 } = await import("fs");
   const { join: join16 } = await import("path");
   const candidates = [
     join16(process.cwd(), "packages/engine/package.json"),
     join16(process.cwd(), "package.json")
   ];
   for (const p of candidates) {
-    if (!existsSync16(p))
+    if (!existsSync17(p))
       continue;
     try {
       const pkg = JSON.parse(await Bun.file(p).text());
@@ -5783,7 +6743,7 @@ async function getLocalVersion() {
 // package.json
 var package_default = {
   name: "@zveltio/cli",
-  version: "3.0.0-beta.4",
+  version: "3.0.0-beta.68",
   type: "module",
   bin: {
     zveltio: "./dist/index.js"
@@ -5798,8 +6758,8 @@ var package_default = {
     dev: "bun run --watch src/index.ts"
   },
   dependencies: {
-    "@zveltio/sdk": "3.0.0-beta.4",
-    commander: "^12.0.0"
+    "@zveltio/sdk": "3.0.0-beta.68",
+    commander: "^12.1.0"
   },
   devDependencies: {
     "bun-types": "latest",
@@ -5823,7 +6783,7 @@ program2.addCommand(rollbackCommand);
 program2.command("status").description("Show system status (DB, cache, uptime, version)").option("--url <url>", "Engine URL", "http://localhost:3000").option("--json", "Output as JSON").action(statusCommand);
 program2.addCommand(versionCommand);
 program2.addCommand(updateCommand);
-program2.command("create-god").description("Create the first super-admin (god) user interactively").option("--url <url>", "Engine URL", "http://localhost:3000").option("--email <email>", "Admin email (skip prompt)").option("--name <name>", "Admin name (skip prompt)").action(createGodCommand);
+program2.command("create-god").description("Create the first super-admin (god) user interactively").option("--url <url>", "Engine URL", "http://localhost:3000").option("--email <email>", "Admin email (skip prompt)").option("--name <name>", "Admin name (skip prompt)").option("--recovery-token <token>", "RECOVERY_TOKEN the engine was started with \u2014 required to grant the god role (env: RECOVERY_TOKEN)").action(createGodCommand);
 var generate = program2.command("generate").description("Code generation utilities");
 generate.command("types [collection]").description("Generate TypeScript types for collections (writes to ./types/zveltio.d.ts)").option("-o, --output <path>", "Output file path", "./types/zveltio.d.ts").option("--url <url>", "Engine URL", "http://localhost:3000").action(generateTypesCommand);
 program2.command("generate-types [collection]").description("Generate TypeScript types for your collections").option("-o, --output <path>", "Output file path", "./types/zveltio.d.ts").option("--url <url>", "Engine URL", "http://localhost:3000").action(generateTypesCommand);
@@ -5851,10 +6811,10 @@ extensions.command("disable <name>").description("Disable an active extension").
   console.log(`${name} disabled.`);
 });
 var ext = program2.command("extension").description('Manage Zveltio extensions (use "extensions" for new commands)');
-ext.command("create <name>").description("Scaffold a new extension").option("--category <category>", "Extension category", "custom").action((name, opts) => extensionCommand("create", name, opts));
+ext.command("create <name>").description("Scaffold a new extension (admin page as an SDUI schema)").option("--category <category>", "Extension category", "custom").option("--code-page", "Scaffold a Svelte page instead of a schema \u2014 for UI a schema cannot express (canvas, chat, map, inbox)").action((name, opts) => extensionCommand("create", name, opts));
 ext.command("build").description("[deprecated] Alias for `extension pack` \u2014 produces the v2 engine bundle").option("--dir <dir>", "Extension root directory (defaults to cwd)").action((opts) => extensionCommand("build", "", opts));
 ext.command("dev").description("Watch engine/ + studio/, hot-reload the running engine on changes (S4-03)").option("--dir <dir>", "Extension root directory (defaults to cwd)").option("--url <url>", "Engine URL (env: ZVELTIO_ENGINE_URL)", "http://localhost:3000").option("--name <name>", "Extension name (default: read from manifest.json)").option("--no-studio", "Skip the Studio dev process (engine watch only)").action((opts) => extensionDevCommand(opts));
-ext.command("pack").description("Bundle engine/index.ts \u2192 engine/index.js (target=bun, ESM) and write engine + integrity blocks into manifest.json. Required before publish on v2 channels.").option("--dir <dir>", "Extension root directory (defaults to cwd)").option("--sourcemap", "Emit engine/index.js.map alongside the bundle").option("--no-manifest-update", "Build the bundle but do not patch manifest.json").option("--first-party", "Vendor / monorepo build \u2014 keep inline isolation, skip worker auto-inject").option("--token <token>", "Registry token for the publisher-tier lookup (env: ZVELTIO_REGISTRY_TOKEN)").option("--registry-url <url>", "Registry base URL (env: ZVELTIO_REGISTRY_URL)").action(async (opts) => {
+ext.command("pack").description("Bundle engine/index.ts \u2192 engine/index.js (target=bun, ESM) and write engine + integrity blocks into manifest.json. Required before publish on v2 channels.").option("--dir <dir>", "Extension root directory (defaults to cwd)").option("--sourcemap", "Emit engine/index.js.map alongside the bundle").option("--no-manifest-update", "Build the bundle but do not patch manifest.json").option("--first-party", "Vendor / monorepo build \u2014 keep inline isolation, skip worker auto-inject").option("--keep-isolation", 'With --first-party, retain engine.isolation: "worker" if already set (default: clear sticky worker)').option("--token <token>", "Registry token for the publisher-tier lookup (env: ZVELTIO_REGISTRY_TOKEN)").option("--registry-url <url>", "Registry base URL (env: ZVELTIO_REGISTRY_URL)").action(async (opts) => {
   const { extensionPackCommand: extensionPackCommand2 } = await Promise.resolve().then(() => (init_extension_pack(), exports_extension_pack));
   return extensionPackCommand2(opts);
 });