clivly 0.10.5 → 0.10.7

package/core-entity-heuristics.cjs

@@ -6,6 +6,7 @@ require("./deprecate-subpath-B9ngvizt.cjs").warnDeprecatedSubpath("clivly/core/e
 exports.TARGET_CONCEPTS = require_internal_entity_heuristics.TARGET_CONCEPTS;
 exports.hasDefiningColumn = require_internal_entity_heuristics.hasDefiningColumn;
 exports.hasSensitiveColumns = require_internal_entity_heuristics.hasSensitiveColumns;
+exports.isFrameworkTable = require_internal_entity_heuristics.isFrameworkTable;
 exports.matchesConcept = require_internal_entity_heuristics.matchesConcept;
 exports.requiredFieldsFor = require_internal_entity_heuristics.requiredFieldsFor;
 exports.scoreConcepts = require_internal_entity_heuristics.scoreConcepts;

package/core-entity-heuristics.d.cts

@@ -1,3 +1,3 @@
 import { p as DiscoveredColumnMeta } from "./entity-config-w8oMBWf8.cjs";
-import { FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping } from "./internal-entity-heuristics.cjs";
-export { type DiscoveredColumnMeta, FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };
+import { FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, isFrameworkTable, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping } from "./internal-entity-heuristics.cjs";
+export { type DiscoveredColumnMeta, FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, isFrameworkTable, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };

package/core-entity-heuristics.d.mts

@@ -1,3 +1,3 @@
 import { p as DiscoveredColumnMeta } from "./entity-config-w8oMBWf8.mjs";
-import { FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping } from "./internal-entity-heuristics.mjs";
-export { type DiscoveredColumnMeta, FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };
+import { FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, isFrameworkTable, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping } from "./internal-entity-heuristics.mjs";
+export { type DiscoveredColumnMeta, FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, isFrameworkTable, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };

package/core-entity-heuristics.mjs

@@ -1,6 +1,6 @@
-import { TARGET_CONCEPTS, hasDefiningColumn, hasSensitiveColumns, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping } from "./internal-entity-heuristics.mjs";
+import { TARGET_CONCEPTS, hasDefiningColumn, hasSensitiveColumns, isFrameworkTable, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping } from "./internal-entity-heuristics.mjs";
 import { t as warnDeprecatedSubpath } from "./deprecate-subpath-CmvZtCpE.mjs";
 //#region src/core-entity-heuristics.ts
 warnDeprecatedSubpath("clivly/core/entity-heuristics", "clivly/internal/entity-heuristics");
 //#endregion
-export { TARGET_CONCEPTS, hasDefiningColumn, hasSensitiveColumns, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };
+export { TARGET_CONCEPTS, hasDefiningColumn, hasSensitiveColumns, isFrameworkTable, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };

package/index.cjs

@@ -480,23 +480,38 @@ function cloudflaredMissingMessage() {
 * Warning someone away from a tunnel that was fine is worse than staying quiet,
 * for the same reason the port probe defaults to assuming the port is alive.
 */
-/** How long to wait before giving up and returning `unknown`. */
+/** How long any single probe attempt may take. */
 const IDENTITY_PROBE_TIMEOUT_MS = 8e3;
 /**
-* Probe the published tunnel URL and report who is on the other end.
+* How long to keep retrying before giving up.
 *
-* `fetchImpl` is injectable so tests do not need a network or a live tunnel.
+* The probe fires the moment `cloudflared` publishes a URL, which on a
+* Vite/Nuxt app is *before* the dev server has finished building its route
+* table. The first attempt therefore reaches a server that is up but does not
+* yet serve the tick route — a cold start, not a wrong port. The condition
+* being detected (a tunnel aimed at the wrong process) does not resolve
+* itself, so waiting costs nothing and a premature verdict costs a lot.
 */
-async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch) {
+const IDENTITY_RETRY_BUDGET_MS = 2e4;
+const IDENTITY_RETRY_DELAY_MS = 2e3;
+const sleep = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+/** One attempt. Separated so the retry loop stays readable. */
+async function attempt(triggerUrl, fetchImpl) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), IDENTITY_PROBE_TIMEOUT_MS);
 	try {
-		return (await fetchImpl(triggerUrl, {
+		const response = await fetchImpl(triggerUrl, {
 			method: "POST",
 			headers: { "content-type": "application/json" },
 			body: "{}",
 			signal: controller.signal
-		})).status === 401 ? "clivly" : "mismatch";
+		});
+		if (response.status === 401) return "clivly";
+		if (response.status === 403) return "host-rejected";
+		if (response.status === 404 || response.status >= 500) return "unknown";
+		return "mismatch";
 	} catch {
 		return "unknown";
 	} finally {
@@ -504,6 +519,40 @@ async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch) {
 	}
 }
 /**
+* Probe the published tunnel URL and report who is on the other end.
+*
+* Retries while the answer is inconclusive, because the first attempt lands
+* during the dev server's boot. Only a confident contradiction is reported.
+*
+* `fetchImpl` and `now` are injectable so tests need no network or clock.
+*/
+async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch, now = Date.now) {
+	const deadline = now() + IDENTITY_RETRY_BUDGET_MS;
+	let last = "unknown";
+	do {
+		last = await attempt(triggerUrl, fetchImpl);
+		if (last !== "unknown") return last;
+		if (now() >= deadline) break;
+		await sleep(IDENTITY_RETRY_DELAY_MS);
+	} while (now() < deadline);
+	return last;
+}
+/**
+* What to tell someone whose dev server refused the tunnel's Host header.
+*
+* `clivly dev` already prints the allowedHosts hint for Vite frameworks before
+* the tunnel opens; this fires when the tunnel proves it was not applied.
+*/
+function hostRejectedMessage() {
+	return [
+		"Warning: your dev server refused the tunnel's Host header (403).",
+		"  Vite rejects hostnames it does not recognise, so Clivly's request never",
+		"  reaches your tick route. Add the tunnel domain to your Vite config:",
+		"    server: { allowedHosts: ['.trycloudflare.com'] }",
+		"  (in nuxt.config.ts, nest it under `vite:`), then restart the dev server."
+	].join("\n");
+}
+/**
 * What to tell someone whose tunnel reaches the wrong process.
 *
 * Names the likely cause rather than only the symptom: the overwhelmingly
@@ -526,6 +575,12 @@ const UNREACHABLE_RESULT = {
 	ok: false,
 	kind: "unreachable"
 };
+/** The line to print for a probe verdict, or null when there is nothing to say. */
+function tunnelWarning(identity, port) {
+	if (identity === "mismatch") return tunnelMismatchMessage(port);
+	if (identity === "host-rejected") return hostRejectedMessage();
+	return null;
+}
 function flagValue$1(argv, flag) {
 	const i = argv.indexOf(flag);
 	return i >= 0 ? argv[i + 1] : void 0;
@@ -570,9 +625,10 @@ async function runDev(options) {
 			if (!await deps.isPortListening(port).catch(() => true)) deps.out(deadPortMessage(port, framework));
 		}
 		const identity = deps.probeTunnel && !flagValue$1(options.argv, "--url") ? await deps.probeTunnel(triggerUrl).catch(() => "unknown") : "unknown";
-		if (identity === "mismatch") deps.out(tunnelMismatchMessage(port));
+		const warning = tunnelWarning(identity, port);
+		if (warning) deps.out(warning);
 		const result = await deps.register(triggerUrl).catch(() => UNREACHABLE_RESULT);
-		if (result.ok) deps.out(identity === "mismatch" ? "Trigger URL registered, but see the warning above before relying on it." : "Dashboard-triggered sync now points at this local session.");
+		if (result.ok) deps.out(identity === "mismatch" || identity === "host-rejected" ? "Trigger URL registered, but see the warning above before relying on it." : "Dashboard-triggered sync now points at this local session.");
 		else deps.out(overrideFailureMessage(result.kind, result.status));
 	});
 	const stopWatching = deps.watchConfig?.(options.cwd, () => {
@@ -1601,13 +1657,14 @@ function writeCredentials(options, credentials) {
 	const entries = credentialEntries(credentials);
 	const result = upsertEnvValues(deps.readEnv(options.cwd), entries, { force: options.force });
 	deps.writeEnv(options.cwd, result.contents);
+	const envFile = deps.envFileName?.(options.cwd) ?? ".env";
 	deps.out("\nLogin successful.\n");
 	const valuesByKey = {
 		[SECRET_KEY_ENV]: credentials.apiKey,
 		CLIVLY_SYNC_TRIGGER_SECRET: credentials.triggerSecret
 	};
 	for (const entry of entries) if (result.skipped.includes(entry.key)) deps.out(`  • ${entry.key} already set — skipped (pass --force to overwrite)`);
-	else deps.out(`  ✓ ${entry.key}=${maskSecret(valuesByKey[entry.key] ?? "")} written to .env`);
+	else deps.out(`  ✓ ${entry.key}=${maskSecret(valuesByKey[entry.key] ?? "")} written to ${envFile}`);
 }
 async function runLogin(options) {
 	const { deps } = options;
@@ -1650,7 +1707,10 @@ function rankCandidates$1(tables, concept) {
 		m: require_internal_entity_heuristics.matchesConcept(t.tableName, concept)
 	})).filter((c) => Boolean(c.m)).sort((a, b) => {
 		const usable = Number(require_internal_entity_heuristics.hasDefiningColumn(concept, columnNames(b.t))) - Number(require_internal_entity_heuristics.hasDefiningColumn(concept, columnNames(a.t)));
-		return usable === 0 ? Number(b.m.exact) - Number(a.m.exact) : usable;
+		if (usable !== 0) return usable;
+		const exact = Number(b.m.exact) - Number(a.m.exact);
+		if (exact !== 0) return exact;
+		return Number(require_internal_entity_heuristics.isFrameworkTable(a.t.tableName)) - Number(require_internal_entity_heuristics.isFrameworkTable(b.t.tableName));
 	}).map((c) => c.t);
 }
 function selectEntities(tables) {
@@ -1893,7 +1953,14 @@ export async function register() {
 		return;
 	}
 	try {
-		const { default: clivly } = await import("${importPath}");
+		// Built at runtime so the bundler cannot statically trace it. Next
+		// compiles this file for BOTH runtimes, and the guard above only runs on
+		// the edge — it does not stop the edge BUILD from following a literal
+		// import into your config, and from there into your database driver. A
+		// node-postgres app fails that pass on \`require('path')\` and every route
+		// 500s before Clivly is ever reached.
+		const specifier = "${importPath}";
+		const { default: clivly } = await import(/* webpackIgnore: true */ specifier);
 		await clivly.start();
 	} catch (error) {
 		console.warn("[clivly] could not check in:", error);
@@ -2701,7 +2768,14 @@ function reportSchema(report, out) {
 	const updated = report.mappings.filter((m) => m.updated);
 	if (created.length > 0) out(`  ✅ Mapped ${countOf(created.length, "entity", "entities")}: ${created.map((m) => m.entityKey).join(", ")}.\n`);
 	if (updated.length > 0) out(`  ✅ Updated ${countOf(updated.length, "mapping")}: ${updated.map((m) => m.entityKey).join(", ")}.\n`);
-	if (report.mappings.length > 0 && created.length === 0 && updated.length === 0) out(`  ✅ ${countOf(report.mappings.length, "mapping")} already match your config.\n`);
+	const skipped = report.mappings.filter((m) => m.skipped === "dashboard-owned");
+	if (skipped.length > 0) {
+		out(`  ↩︎  Kept the dashboard's version of ${countOf(skipped.length, "entity", "entities")}: ${skipped.map((m) => m.entityKey).join(", ")}.\n`);
+		out("     The dashboard owns these mappings, so clivly.config did not change them.\n");
+		out("     To let your config own one, delete it in Integrations → Mapping, then push again.\n");
+	}
+	const settled = report.mappings.length - skipped.length;
+	if (settled > 0 && created.length === 0 && updated.length === 0) out(`  ✅ ${countOf(settled, "mapping")} already match your config.\n`);
 }
 async function runPushSchema(options) {
 	const out = options.out ?? ((line) => process.stdout.write(line));
@@ -4277,7 +4351,8 @@ function defaultLoginDeps() {
 		sleep: (ms) => new Promise((resolve) => {
 			setTimeout(resolve, ms);
 		}),
-		writeEnv: defaultWriteEnv
+		writeEnv: defaultWriteEnv,
+		envFileName: (cwd) => (0, node_path.basename)(resolveEnvPath(cwd))
 	};
 }
 function runInitFromArgv(argv, cwd) {

package/index.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { t as CANONICAL_FIELDS } from "./entity-config-bC3DX9f1.mjs";
 import "./mapping-score-C68uAqGB.mjs";
-import { hasDefiningColumn, matchesConcept, requiredFieldsFor, scoreFieldMap, scoreRelationships, suggestCursorField, toFieldMap } from "./internal-entity-heuristics.mjs";
+import { hasDefiningColumn, isFrameworkTable, matchesConcept, requiredFieldsFor, scoreFieldMap, scoreRelationships, suggestCursorField, toFieldMap } from "./internal-entity-heuristics.mjs";
 import { s as isPlaceholderUrl, t as createClivlySDK } from "./sdk-BTzaM8bF.mjs";
 import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
 import { accessSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, watch, writeFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
-import { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { createJiti } from "jiti";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -479,23 +479,38 @@ function cloudflaredMissingMessage() {
 * Warning someone away from a tunnel that was fine is worse than staying quiet,
 * for the same reason the port probe defaults to assuming the port is alive.
 */
-/** How long to wait before giving up and returning `unknown`. */
+/** How long any single probe attempt may take. */
 const IDENTITY_PROBE_TIMEOUT_MS = 8e3;
 /**
-* Probe the published tunnel URL and report who is on the other end.
+* How long to keep retrying before giving up.
 *
-* `fetchImpl` is injectable so tests do not need a network or a live tunnel.
+* The probe fires the moment `cloudflared` publishes a URL, which on a
+* Vite/Nuxt app is *before* the dev server has finished building its route
+* table. The first attempt therefore reaches a server that is up but does not
+* yet serve the tick route — a cold start, not a wrong port. The condition
+* being detected (a tunnel aimed at the wrong process) does not resolve
+* itself, so waiting costs nothing and a premature verdict costs a lot.
 */
-async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch) {
+const IDENTITY_RETRY_BUDGET_MS = 2e4;
+const IDENTITY_RETRY_DELAY_MS = 2e3;
+const sleep = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+/** One attempt. Separated so the retry loop stays readable. */
+async function attempt(triggerUrl, fetchImpl) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), IDENTITY_PROBE_TIMEOUT_MS);
 	try {
-		return (await fetchImpl(triggerUrl, {
+		const response = await fetchImpl(triggerUrl, {
 			method: "POST",
 			headers: { "content-type": "application/json" },
 			body: "{}",
 			signal: controller.signal
-		})).status === 401 ? "clivly" : "mismatch";
+		});
+		if (response.status === 401) return "clivly";
+		if (response.status === 403) return "host-rejected";
+		if (response.status === 404 || response.status >= 500) return "unknown";
+		return "mismatch";
 	} catch {
 		return "unknown";
 	} finally {
@@ -503,6 +518,40 @@ async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch) {
 	}
 }
 /**
+* Probe the published tunnel URL and report who is on the other end.
+*
+* Retries while the answer is inconclusive, because the first attempt lands
+* during the dev server's boot. Only a confident contradiction is reported.
+*
+* `fetchImpl` and `now` are injectable so tests need no network or clock.
+*/
+async function probeTunnelIdentity(triggerUrl, fetchImpl = fetch, now = Date.now) {
+	const deadline = now() + IDENTITY_RETRY_BUDGET_MS;
+	let last = "unknown";
+	do {
+		last = await attempt(triggerUrl, fetchImpl);
+		if (last !== "unknown") return last;
+		if (now() >= deadline) break;
+		await sleep(IDENTITY_RETRY_DELAY_MS);
+	} while (now() < deadline);
+	return last;
+}
+/**
+* What to tell someone whose dev server refused the tunnel's Host header.
+*
+* `clivly dev` already prints the allowedHosts hint for Vite frameworks before
+* the tunnel opens; this fires when the tunnel proves it was not applied.
+*/
+function hostRejectedMessage() {
+	return [
+		"Warning: your dev server refused the tunnel's Host header (403).",
+		"  Vite rejects hostnames it does not recognise, so Clivly's request never",
+		"  reaches your tick route. Add the tunnel domain to your Vite config:",
+		"    server: { allowedHosts: ['.trycloudflare.com'] }",
+		"  (in nuxt.config.ts, nest it under `vite:`), then restart the dev server."
+	].join("\n");
+}
+/**
 * What to tell someone whose tunnel reaches the wrong process.
 *
 * Names the likely cause rather than only the symptom: the overwhelmingly
@@ -525,6 +574,12 @@ const UNREACHABLE_RESULT = {
 	ok: false,
 	kind: "unreachable"
 };
+/** The line to print for a probe verdict, or null when there is nothing to say. */
+function tunnelWarning(identity, port) {
+	if (identity === "mismatch") return tunnelMismatchMessage(port);
+	if (identity === "host-rejected") return hostRejectedMessage();
+	return null;
+}
 function flagValue$1(argv, flag) {
 	const i = argv.indexOf(flag);
 	return i >= 0 ? argv[i + 1] : void 0;
@@ -569,9 +624,10 @@ async function runDev(options) {
 			if (!await deps.isPortListening(port).catch(() => true)) deps.out(deadPortMessage(port, framework));
 		}
 		const identity = deps.probeTunnel && !flagValue$1(options.argv, "--url") ? await deps.probeTunnel(triggerUrl).catch(() => "unknown") : "unknown";
-		if (identity === "mismatch") deps.out(tunnelMismatchMessage(port));
+		const warning = tunnelWarning(identity, port);
+		if (warning) deps.out(warning);
 		const result = await deps.register(triggerUrl).catch(() => UNREACHABLE_RESULT);
-		if (result.ok) deps.out(identity === "mismatch" ? "Trigger URL registered, but see the warning above before relying on it." : "Dashboard-triggered sync now points at this local session.");
+		if (result.ok) deps.out(identity === "mismatch" || identity === "host-rejected" ? "Trigger URL registered, but see the warning above before relying on it." : "Dashboard-triggered sync now points at this local session.");
 		else deps.out(overrideFailureMessage(result.kind, result.status));
 	});
 	const stopWatching = deps.watchConfig?.(options.cwd, () => {
@@ -1600,13 +1656,14 @@ function writeCredentials(options, credentials) {
 	const entries = credentialEntries(credentials);
 	const result = upsertEnvValues(deps.readEnv(options.cwd), entries, { force: options.force });
 	deps.writeEnv(options.cwd, result.contents);
+	const envFile = deps.envFileName?.(options.cwd) ?? ".env";
 	deps.out("\nLogin successful.\n");
 	const valuesByKey = {
 		[SECRET_KEY_ENV]: credentials.apiKey,
 		CLIVLY_SYNC_TRIGGER_SECRET: credentials.triggerSecret
 	};
 	for (const entry of entries) if (result.skipped.includes(entry.key)) deps.out(`  • ${entry.key} already set — skipped (pass --force to overwrite)`);
-	else deps.out(`  ✓ ${entry.key}=${maskSecret(valuesByKey[entry.key] ?? "")} written to .env`);
+	else deps.out(`  ✓ ${entry.key}=${maskSecret(valuesByKey[entry.key] ?? "")} written to ${envFile}`);
 }
 async function runLogin(options) {
 	const { deps } = options;
@@ -1649,7 +1706,10 @@ function rankCandidates$1(tables, concept) {
 		m: matchesConcept(t.tableName, concept)
 	})).filter((c) => Boolean(c.m)).sort((a, b) => {
 		const usable = Number(hasDefiningColumn(concept, columnNames(b.t))) - Number(hasDefiningColumn(concept, columnNames(a.t)));
-		return usable === 0 ? Number(b.m.exact) - Number(a.m.exact) : usable;
+		if (usable !== 0) return usable;
+		const exact = Number(b.m.exact) - Number(a.m.exact);
+		if (exact !== 0) return exact;
+		return Number(isFrameworkTable(a.t.tableName)) - Number(isFrameworkTable(b.t.tableName));
 	}).map((c) => c.t);
 }
 function selectEntities(tables) {
@@ -1892,7 +1952,14 @@ export async function register() {
 		return;
 	}
 	try {
-		const { default: clivly } = await import("${importPath}");
+		// Built at runtime so the bundler cannot statically trace it. Next
+		// compiles this file for BOTH runtimes, and the guard above only runs on
+		// the edge — it does not stop the edge BUILD from following a literal
+		// import into your config, and from there into your database driver. A
+		// node-postgres app fails that pass on \`require('path')\` and every route
+		// 500s before Clivly is ever reached.
+		const specifier = "${importPath}";
+		const { default: clivly } = await import(/* webpackIgnore: true */ specifier);
 		await clivly.start();
 	} catch (error) {
 		console.warn("[clivly] could not check in:", error);
@@ -2700,7 +2767,14 @@ function reportSchema(report, out) {
 	const updated = report.mappings.filter((m) => m.updated);
 	if (created.length > 0) out(`  ✅ Mapped ${countOf(created.length, "entity", "entities")}: ${created.map((m) => m.entityKey).join(", ")}.\n`);
 	if (updated.length > 0) out(`  ✅ Updated ${countOf(updated.length, "mapping")}: ${updated.map((m) => m.entityKey).join(", ")}.\n`);
-	if (report.mappings.length > 0 && created.length === 0 && updated.length === 0) out(`  ✅ ${countOf(report.mappings.length, "mapping")} already match your config.\n`);
+	const skipped = report.mappings.filter((m) => m.skipped === "dashboard-owned");
+	if (skipped.length > 0) {
+		out(`  ↩︎  Kept the dashboard's version of ${countOf(skipped.length, "entity", "entities")}: ${skipped.map((m) => m.entityKey).join(", ")}.\n`);
+		out("     The dashboard owns these mappings, so clivly.config did not change them.\n");
+		out("     To let your config own one, delete it in Integrations → Mapping, then push again.\n");
+	}
+	const settled = report.mappings.length - skipped.length;
+	if (settled > 0 && created.length === 0 && updated.length === 0) out(`  ✅ ${countOf(settled, "mapping")} already match your config.\n`);
 }
 async function runPushSchema(options) {
 	const out = options.out ?? ((line) => process.stdout.write(line));
@@ -4276,7 +4350,8 @@ function defaultLoginDeps() {
 		sleep: (ms) => new Promise((resolve) => {
 			setTimeout(resolve, ms);
 		}),
-		writeEnv: defaultWriteEnv
+		writeEnv: defaultWriteEnv,
+		envFileName: (cwd) => basename(resolveEnvPath(cwd))
 	};
 }
 function runInitFromArgv(argv, cwd) {

package/internal-entity-heuristics.cjs

@@ -283,6 +283,54 @@ const SENSITIVE_COLUMNS = /* @__PURE__ */ new Set([
 function hasSensitiveColumns(columns) {
 	return columns.some((column) => SENSITIVE_COLUMNS.has(column.toLowerCase().replaceAll("-", "_")));
 }
+/**
+* Table names the supported auth libraries create.
+*
+* `hasSensitiveColumns` cannot catch these. Better Auth's `organization` table
+* is `{id, name, slug, logo}` — no credential column anywhere, a real `name`,
+* and "organizations" is in the company vocabulary above. It is, by every
+* signal this module has, an excellent company candidate. On `vue-academy`
+* `clivly init` duly chose it over `campuses`, the actual business table that
+* every student row points at, and the first sync exported rows nothing could
+* receive.
+*
+* Matched on name, deliberately, and this is the inverse of the rule above:
+* withholding a table on a wrong guess is a real loss, so that is decided on
+* columns; *ranking* one below another is cheap to get wrong, so a name match
+* is enough. These are fixed names the plugins create, and an app whose own
+* business table is called `member` still ranks — just after its rivals.
+*/
+const FRAMEWORK_TABLE_NAMES = /* @__PURE__ */ new Set([
+	"account",
+	"session",
+	"user",
+	"verification",
+	"invitation",
+	"member",
+	"organization",
+	"team",
+	"team_member",
+	"apikey",
+	"api_key",
+	"jwks",
+	"passkey",
+	"rate_limit",
+	"ratelimit",
+	"two_factor",
+	"twofactor",
+	"__drizzle_migrations",
+	"drizzle_migrations"
+]);
+/**
+* Is this table one your auth library created, rather than one you wrote?
+*
+* Used to rank such tables below the developer's own when both could serve a
+* concept. Never to exclude them: mapping `user` as the contact entity is
+* legitimate for plenty of apps, and it stays selectable.
+*/
+function isFrameworkTable(name) {
+	return FRAMEWORK_TABLE_NAMES.has(name.toLowerCase().replaceAll("-", "_"));
+}
 function metaFor(table, column) {
 	return table.columnsMeta?.find((c) => c.name === column);
 }
@@ -497,6 +545,7 @@ function toFieldMap(scored) {
 exports.TARGET_CONCEPTS = TARGET_CONCEPTS;
 exports.hasDefiningColumn = hasDefiningColumn;
 exports.hasSensitiveColumns = hasSensitiveColumns;
+exports.isFrameworkTable = isFrameworkTable;
 exports.matchesConcept = matchesConcept;
 exports.requiredFieldsFor = requiredFieldsFor;
 exports.scoreConcepts = scoreConcepts;

package/internal-entity-heuristics.d.cts

@@ -19,6 +19,14 @@ interface ScoredTable {
  * They stay manually selectable — an explicit, informed choice is legitimate.
  */
 declare function hasSensitiveColumns(columns: string[]): boolean;
+/**
+ * Is this table one your auth library created, rather than one you wrote?
+ *
+ * Used to rank such tables below the developer's own when both could serve a
+ * concept. Never to exclude them: mapping `user` as the contact entity is
+ * legitimate for plenty of apps, and it stays selectable.
+ */
+declare function isFrameworkTable(name: string): boolean;
 declare function hasDefiningColumn(concept: TargetConcept, columns: string[]): boolean;
 declare function scoreConcepts(table: ScoredTable): Scored<TargetConcept>[];
 declare function topConcept(table: ScoredTable): {
@@ -61,4 +69,4 @@ interface FieldSuggestion {
 declare function scoreFieldMap(concept: TargetConcept, table: ScoredTable): Scored<FieldSuggestion>[];
 declare function toFieldMap(scored: Scored<FieldSuggestion>[]): Record<string, string>;
 //#endregion
-export { type DiscoveredColumnMeta, FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };
+export { type DiscoveredColumnMeta, FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, isFrameworkTable, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };

package/internal-entity-heuristics.d.mts

@@ -19,6 +19,14 @@ interface ScoredTable {
  * They stay manually selectable — an explicit, informed choice is legitimate.
  */
 declare function hasSensitiveColumns(columns: string[]): boolean;
+/**
+ * Is this table one your auth library created, rather than one you wrote?
+ *
+ * Used to rank such tables below the developer's own when both could serve a
+ * concept. Never to exclude them: mapping `user` as the contact entity is
+ * legitimate for plenty of apps, and it stays selectable.
+ */
+declare function isFrameworkTable(name: string): boolean;
 declare function hasDefiningColumn(concept: TargetConcept, columns: string[]): boolean;
 declare function scoreConcepts(table: ScoredTable): Scored<TargetConcept>[];
 declare function topConcept(table: ScoredTable): {
@@ -61,4 +69,4 @@ interface FieldSuggestion {
 declare function scoreFieldMap(concept: TargetConcept, table: ScoredTable): Scored<FieldSuggestion>[];
 declare function toFieldMap(scored: Scored<FieldSuggestion>[]): Record<string, string>;
 //#endregion
-export { type DiscoveredColumnMeta, FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };
+export { type DiscoveredColumnMeta, FieldSuggestion, RelationshipSuggestion, ScoredTable, SuggestedVia, TARGET_CONCEPTS, TargetConcept, hasDefiningColumn, hasSensitiveColumns, isFrameworkTable, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };

package/internal-entity-heuristics.mjs

@@ -282,6 +282,54 @@ const SENSITIVE_COLUMNS = /* @__PURE__ */ new Set([
 function hasSensitiveColumns(columns) {
 	return columns.some((column) => SENSITIVE_COLUMNS.has(column.toLowerCase().replaceAll("-", "_")));
 }
+/**
+* Table names the supported auth libraries create.
+*
+* `hasSensitiveColumns` cannot catch these. Better Auth's `organization` table
+* is `{id, name, slug, logo}` — no credential column anywhere, a real `name`,
+* and "organizations" is in the company vocabulary above. It is, by every
+* signal this module has, an excellent company candidate. On `vue-academy`
+* `clivly init` duly chose it over `campuses`, the actual business table that
+* every student row points at, and the first sync exported rows nothing could
+* receive.
+*
+* Matched on name, deliberately, and this is the inverse of the rule above:
+* withholding a table on a wrong guess is a real loss, so that is decided on
+* columns; *ranking* one below another is cheap to get wrong, so a name match
+* is enough. These are fixed names the plugins create, and an app whose own
+* business table is called `member` still ranks — just after its rivals.
+*/
+const FRAMEWORK_TABLE_NAMES = /* @__PURE__ */ new Set([
+	"account",
+	"session",
+	"user",
+	"verification",
+	"invitation",
+	"member",
+	"organization",
+	"team",
+	"team_member",
+	"apikey",
+	"api_key",
+	"jwks",
+	"passkey",
+	"rate_limit",
+	"ratelimit",
+	"two_factor",
+	"twofactor",
+	"__drizzle_migrations",
+	"drizzle_migrations"
+]);
+/**
+* Is this table one your auth library created, rather than one you wrote?
+*
+* Used to rank such tables below the developer's own when both could serve a
+* concept. Never to exclude them: mapping `user` as the contact entity is
+* legitimate for plenty of apps, and it stays selectable.
+*/
+function isFrameworkTable(name) {
+	return FRAMEWORK_TABLE_NAMES.has(name.toLowerCase().replaceAll("-", "_"));
+}
 function metaFor(table, column) {
 	return table.columnsMeta?.find((c) => c.name === column);
 }
@@ -493,4 +541,4 @@ function toFieldMap(scored) {
 	return map;
 }
 //#endregion
-export { TARGET_CONCEPTS, hasDefiningColumn, hasSensitiveColumns, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };
+export { TARGET_CONCEPTS, hasDefiningColumn, hasSensitiveColumns, isFrameworkTable, matchesConcept, requiredFieldsFor, scoreConcepts, scoreFieldMap, scoreRelationships, suggestCursorField, suggestDiscriminatorColumns, toFieldMap, topConcept, validateMapping };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clivly",
-  "version": "0.10.5",
+  "version": "0.10.7",
   "private": false,
   "type": "module",
   "description": "Clivly CLI — scaffold a CRM into your app (clivly init).",