clivly 0.2.2 → 0.3.0-next.1

package/index.mjs

@@ -1,84 +1,14 @@
 #!/usr/bin/env node
-import { t as createClivlySDK } from "./sdk-BZUn6wzs.mjs";
-import { t as CANONICAL_FIELDS } from "./entity-config-DoR0khce.mjs";
-import "./mapping-score-BJNe0lFn.mjs";
+import { t as CANONICAL_FIELDS } from "./entity-config-D3YpQB0z.mjs";
+import "./mapping-score-CPPvwoZC.mjs";
 import { matchesConcept, requiredFieldsFor, scoreFieldMap, scoreRelationships, suggestCursorField, toFieldMap } from "./core-entity-heuristics.mjs";
+import { t as createClivlySDK } from "./sdk-vu_uej2q.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { createJiti } from "jiti";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { createJiti } from "jiti";
 import { spawn } from "node:child_process";
-//#region src/render.ts
-function checkLine(ok, label, detail) {
-	return `  ${ok ? "✅" : "❌"} ${label}${detail ? ` — ${detail}` : ""}\n`;
-}
-//#endregion
-//#region src/connect.ts
-const REASON_HINT$1 = {
-	ok: "",
-	invalid_api_key: "The key was rejected (401). Check CLIVLY_API_KEY.",
-	forbidden: "The key lacks access (403).",
-	rate_limited: "Rate limited (429) — retry shortly.",
-	server_error: "Clivly returned a 5xx — retry shortly.",
-	client_error: "The request was rejected (4xx).",
-	network_error: "No response — check the network / apiUrl."
-};
-const defaultConnect$1 = (apiKey, apiUrl) => createClivlySDK({
-	apiKey,
-	apiUrl,
-	retry: { maxAttempts: 1 }
-}).connect();
-const defaultLoadConfig = async (path) => {
-	const mod = await createJiti(import.meta.url).import(path);
-	return mod.default ?? mod;
-};
-/**
-* `clivly connect` — a read-only pass/fail report: API key present → heartbeat
-* (real SDK connect, proving the cloud saw it) → config schema loadable →
-* trigger-URL note. Exit 0 iff the first three pass; a missing trigger URL warns
-* but does not fail (push-only setups are valid). Deps injectable for tests.
-*/
-async function runConnect(options) {
-	const out = options.out ?? ((line) => process.stdout.write(line));
-	out("\nClivly connect\n");
-	if (!options.apiKey) {
-		out(checkLine(false, "CLIVLY_API_KEY is not set."));
-		out("     Set it to your sk_live_… key from Settings → API keys.\n");
-		return 1;
-	}
-	const result = await (options.connectFn ?? defaultConnect$1)(options.apiKey, options.apiUrl);
-	if (result.ok) out(checkLine(true, `Heartbeat reached Clivly — org: ${result.org?.name ?? "(unnamed org)"}${result.org?.id ? ` (${result.org.id})` : ""}`));
-	else {
-		const status = result.status === null ? "no response" : `HTTP ${result.status}`;
-		out(checkLine(false, `Heartbeat failed (${result.reason}, ${status})`));
-		out(`     ${REASON_HINT$1[result.reason]}\n`);
-		return 1;
-	}
-	const path = resolve(options.cwd, options.configPath ?? "clivly.config.ts");
-	const loadConfig = options.loadConfigFn ?? defaultLoadConfig;
-	let config;
-	try {
-		config = await loadConfig(path);
-	} catch (error) {
-		out(checkLine(false, "Load clivly.config", error.message));
-		return 1;
-	}
-	const tables = Object.values(config.entities?.entities ?? {}).map((e) => e.source).filter((s) => Boolean(s));
-	if (tables.length === 0) {
-		out(checkLine(false, "No entities configured in clivly.config"));
-		return 1;
-	}
-	out(checkLine(true, `Schema: ${tables.length} entity table(s) — ${tables.join(", ")}`));
-	const triggerUrl = config.syncTrigger?.url;
-	if (triggerUrl) out(checkLine(true, `Trigger route configured — ${triggerUrl}`));
-	else {
-		out(checkLine(false, "No trigger URL — dashboard-triggered sync is not wired"));
-		out("     Set syncTrigger.url (CLIVLY_SYNC_TRIGGER_URL) to your public tick route.\n");
-	}
-	return 0;
-}
-//#endregion
 //#region src/detect.ts
 const FRAMEWORK_MARKERS = [
 	{
@@ -116,6 +46,24 @@ const ORM_MARKERS = [
 		deps: ["kysely"]
 	}
 ];
+const AUTH_MARKERS = [
+	{
+		auth: "clerk",
+		deps: [
+			"@clerk/nextjs",
+			"@clerk/backend",
+			"@clerk/tanstack-react-start"
+		]
+	},
+	{
+		auth: "better-auth",
+		deps: ["better-auth"]
+	},
+	{
+		auth: "workos",
+		deps: ["@workos-inc/node", "@workos-inc/authkit-nextjs"]
+	}
+];
 const FRAMEWORK_LABELS = {
 	nextjs: "Next.js",
 	"tanstack-start": "TanStack Start",
@@ -132,6 +80,10 @@ function detectOrm(deps) {
 	for (const { orm, deps: markers } of ORM_MARKERS) if (markers.some((dep) => dep in deps)) return orm;
 	return "unknown";
 }
+function detectAuth(deps) {
+	for (const { auth, deps: markers } of AUTH_MARKERS) if (markers.some((dep) => dep in deps)) return auth;
+	return "unknown";
+}
 const LOCKFILES = [
 	{
 		file: "pnpm-lock.yaml",
@@ -161,11 +113,28 @@ function addCommand(pm, packages) {
 	};
 }
 //#endregion
+//#region src/probe-module.ts
+async function probeModule(opts) {
+	for (const candidate of opts.candidates) {
+		let mod;
+		try {
+			mod = await opts.load(candidate);
+		} catch {
+			continue;
+		}
+		for (const [moduleKey, value] of Object.entries(mod)) if (opts.match(value)) return {
+			moduleKey,
+			importPath: toImportPath(candidate, opts.cwd)
+		};
+	}
+	return null;
+}
+//#endregion
 //#region src/discover-schema.ts
-const WINDOWS_SEP = /\\/g;
+const WINDOWS_SEP$1 = /\\/g;
 const MODULE_EXT = /\.(ts|js|mjs|cts|mts)$/;
 function toImportPath(schemaPath, cwd) {
-	const rel = relative(cwd, schemaPath).replace(WINDOWS_SEP, "/").replace(MODULE_EXT, "");
+	const rel = relative(cwd, schemaPath).replace(WINDOWS_SEP$1, "/").replace(MODULE_EXT, "");
 	return rel.startsWith(".") ? rel : `./${rel}`;
 }
 function isDirectory(path) {
@@ -178,7 +147,7 @@ function isDirectory(path) {
 function loadSchemaModule(schemaPath, load) {
 	return load(isDirectory(schemaPath) ? join(schemaPath, "index.ts") : schemaPath);
 }
-function defaultLoader(cwd) {
+function defaultLoader$1(cwd) {
 	const jiti = createJiti(pathToFileURL(join(cwd, "clivly.config.ts")).href);
 	return (specifier) => jiti.import(specifier);
 }
@@ -224,8 +193,20 @@ function toDiscoveredColumn(key, col, fkByColumn) {
 		...references ? { references } : {}
 	};
 }
+function isDrizzleDb(value) {
+	return typeof value?.select === "function";
+}
+const SIBLING_DB_NAMES = [
+	"db",
+	"client",
+	"index"
+];
+function siblingDbCandidates(schemaPath) {
+	const dir = isDirectory(schemaPath) ? schemaPath : dirname(schemaPath);
+	return SIBLING_DB_NAMES.map((name) => join(dir, name));
+}
 async function discoverSchema(opts) {
-	const load = opts.load ?? defaultLoader(opts.cwd);
+	const load = opts.load ?? defaultLoader$1(opts.cwd);
 	const mod = await loadSchemaModule(opts.schemaPath, load);
 	const drizzle = await load("drizzle-orm");
 	const pgCore = await loadPgCoreRuntime(load);
@@ -248,6 +229,12 @@ async function discoverSchema(opts) {
 			importPath
 		};
 	}
+	if (db === null) db = await probeModule({
+		candidates: siblingDbCandidates(opts.schemaPath),
+		cwd: opts.cwd,
+		load,
+		match: isDrizzleDb
+	});
 	return {
 		tables,
 		importPath,
@@ -255,57 +242,6 @@ async function discoverSchema(opts) {
 	};
 }
 //#endregion
-//#region src/doctor.ts
-async function loadSdkFromConfig(path) {
-	const mod = await createJiti(import.meta.url).import(path);
-	const sdk = mod.default ?? mod;
-	if (typeof sdk.doctor !== "function") throw new Error("default export is not a Clivly SDK instance");
-	return sdk;
-}
-/**
-* `clivly doctor` — load the app's clivly.config, run the SDK's read-only setup
-* checks, and print a ✅/❌ checklist. Exit 0 when every check passes. `loadSdk`
-* and `out` are injectable for tests.
-*/
-async function runDoctor(options) {
-	const out = options.out ?? ((line) => process.stdout.write(line));
-	const path = resolve(options.cwd, options.configPath ?? "clivly.config.ts");
-	const loadSdk = options.loadSdk ?? loadSdkFromConfig;
-	out("\nClivly doctor\n");
-	let sdk;
-	try {
-		sdk = await loadSdk(path);
-	} catch (error) {
-		out(checkLine(false, "Load clivly.config", error.message));
-		out("     Expected clivly.config.ts at your app root with `export default createClivlySDK({...})`.\n");
-		return 1;
-	}
-	const report = await sdk.doctor();
-	for (const check of report.checks) {
-		if (check.skipped) {
-			out(`  ⚠️  ${check.name} — ${check.detail}\n`);
-			continue;
-		}
-		out(checkLine(check.ok, check.name, check.detail));
-	}
-	return report.ok ? 0 : 1;
-}
-//#endregion
-//#region src/env-file.ts
-function hasKey(content, key) {
-	return new RegExp(`^\\s*${key}=`, "m").test(content);
-}
-/**
-* Append only the `entries` whose key is absent, each preceded by its comment.
-* Existing keys/values are left exactly as-is. Returns the full new content.
-*/
-function appendEnvKeys(existing, entries) {
-	const missing = entries.filter((e) => !hasKey(existing, e.key));
-	if (missing.length === 0) return existing;
-	const block = missing.map((e) => `${e.comment ? `# ${e.comment}\n` : ""}${e.key}=`).join("\n");
-	return `${existing}${existing.length > 0 && !existing.endsWith("\n") ? "\n" : ""}${existing.length > 0 ? "\n" : ""}# Clivly\n${block}\n`;
-}
-//#endregion
 //#region src/install.ts
 const defaultRun = (command, args, cwd) => new Promise((resolvePromise, reject) => {
 	const child = spawn(command, args, {
@@ -362,52 +298,6 @@ function isEntrypoint(argv1, moduleUrl, realpath = realpathSync) {
 	return resolve(argv1) === resolve(modulePath);
 }
 //#endregion
-//#region src/ping.ts
-const REASON_HINT = {
-	ok: "",
-	invalid_api_key: "The key was rejected (401). Check CLIVLY_API_KEY.",
-	forbidden: "The key is valid but lacks access to this org (403).",
-	rate_limited: "Rate limited (429). Wait a moment and retry.",
-	server_error: "Clivly returned a server error (5xx). Retry shortly.",
-	client_error: "The request was rejected (4xx). Check your configuration.",
-	network_error: "Could not reach Clivly. Check your network or --api-url."
-};
-const defaultConnect = (apiKey, apiUrl) => createClivlySDK({
-	apiKey,
-	apiUrl,
-	retry: { maxAttempts: 1 }
-}).connect();
-function resultLines(result) {
-	if (result.ok) {
-		const lines = [checkLine(true, "Connected to Clivly")];
-		if (result.org) {
-			const name = result.org.name ?? "(unnamed org)";
-			const id = result.org.id ? ` (${result.org.id})` : "";
-			lines.push(`     Org: ${name}${id}\n`);
-		}
-		return lines;
-	}
-	const status = result.status === null ? "no response" : `HTTP ${result.status}`;
-	return [checkLine(false, `Could not connect (${result.reason}, ${status})`), `     ${REASON_HINT[result.reason]}\n`];
-}
-/**
-* `clivly ping` — send one heartbeat with the configured key and print a clear
-* ✅/❌ with the resolved org or the failure reason. Verifies key + reachability
-* from the terminal with zero code. `connect`/`out` are injectable for tests.
-*/
-async function runPing(options) {
-	const out = options.out ?? ((line) => process.stdout.write(line));
-	out("\nClivly ping\n");
-	if (!options.apiKey) {
-		out(checkLine(false, "CLIVLY_API_KEY is not set."));
-		out("     Set it to your sk_live_… key from Settings → API keys.\n");
-		return 1;
-	}
-	const result = await (options.connect ?? defaultConnect)(options.apiKey, options.apiUrl);
-	for (const line of resultLines(result)) out(line);
-	return result.ok ? 0 : 1;
-}
-//#endregion
 //#region src/plan-init.ts
 function toScoredTable(table) {
 	return {
@@ -522,6 +412,21 @@ function planInit(schema) {
 	};
 }
 //#endregion
+//#region src/env-file.ts
+function hasKey$1(content, key) {
+	return new RegExp(`^\\s*${key}=`, "m").test(content);
+}
+/**
+* Append only the `entries` whose key is absent, each preceded by its comment.
+* Existing keys/values are left exactly as-is. Returns the full new content.
+*/
+function appendEnvKeys(existing, entries) {
+	const missing = entries.filter((e) => !hasKey$1(existing, e.key));
+	if (missing.length === 0) return existing;
+	const block = missing.map((e) => `${e.comment ? `# ${e.comment}\n` : ""}${e.key}=`).join("\n");
+	return `${existing}${existing.length > 0 && !existing.endsWith("\n") ? "\n" : ""}${existing.length > 0 ? "\n" : ""}# Clivly\n${block}\n`;
+}
+//#endregion
 //#region src/render-config.ts
 const CLIVLY_ENV_KEYS = [
 	{
@@ -564,8 +469,12 @@ function fallbackDbImportPath(schemaImportPath) {
 	const slash = schemaImportPath.lastIndexOf("/");
 	return `${slash >= 0 ? schemaImportPath.slice(0, slash) : "."}/db`;
 }
+function dbIsInSchemaModule(plan) {
+	return plan.db !== null && plan.db.importPath === plan.importPath;
+}
 function renderDbExpr(plan) {
-	return plan.db ? `schema.${plan.db.moduleKey}` : "db";
+	if (!plan.db) return "db";
+	return dbIsInSchemaModule(plan) ? `schema.${plan.db.moduleKey}` : plan.db.moduleKey;
 }
 function renderImports(plan) {
 	const lines = [
@@ -576,6 +485,7 @@ function renderImports(plan) {
 		`import * as schema from "${plan.importPath}";`
 	];
 	if (!plan.db) lines.push(`import { db } from "${fallbackDbImportPath(plan.importPath)}"; // TODO: point at your Drizzle instance`);
+	else if (!dbIsInSchemaModule(plan)) lines.push(`import { ${plan.db.moduleKey} } from "${plan.db.importPath}";`);
 	return lines.join("\n");
 }
 function renderTodoHeader(todos) {
@@ -615,46 +525,79 @@ ${sources.join(",\n")},
 `;
 }
 //#endregion
-//#region src/resolve-schema-path.ts
-const COMMON_PATHS = [
-	"src/db/schema.ts",
-	"src/db/schema",
-	"db/schema.ts",
-	"db/schema",
-	"src/schema.ts",
-	"src/schema",
-	"drizzle/schema.ts",
-	"drizzle/schema"
-];
-const DRIZZLE_CONFIG_NAMES = [
-	"drizzle.config.ts",
-	"drizzle.config.js",
-	"drizzle.config.mjs"
-];
-function defaultReadDrizzleConfigSchema(cwd) {
-	for (const name of DRIZZLE_CONFIG_NAMES) {
-		const path = resolve(cwd, name);
-		if (!existsSync(path)) continue;
-		try {
-			const schema = createJiti(pathToFileURL(path).href)(path).default?.schema;
-			const first = Array.isArray(schema) ? schema[0] : schema;
-			if (typeof first === "string") return first;
-		} catch {}
-	}
-	return null;
+//#region src/render-auth.ts
+const RESOLVE_USER = "const resolveUser = (req: Request) => adapter.getUser(req);";
+const STUB = {
+	complete: false,
+	envKeys: [],
+	hostImport: null,
+	imports: [],
+	packages: [],
+	body: `// TODO(clivly): resolve the signed-in host user from the request (your auth stack).
+const resolveUser = (_req: Request) => null;`
+};
+function clerkWiring() {
+	return {
+		complete: true,
+		envKeys: ["CLERK_SECRET_KEY", "CLERK_PUBLISHABLE_KEY"],
+		hostImport: null,
+		imports: ["import { createClerkAuthAdapter } from \"clivly/auth/clerk\";"],
+		packages: ["@clerk/backend"],
+		body: `const adapter = createClerkAuthAdapter({
+  secretKey: process.env.CLERK_SECRET_KEY ?? "",
+  publishableKey: process.env.CLERK_PUBLISHABLE_KEY,
+});
+${RESOLVE_USER}`
+	};
 }
-function resolveSchemaPath(opts) {
-	const exists = opts.deps?.exists ?? existsSync;
-	const readSchema = opts.deps?.readDrizzleConfigSchema ?? defaultReadDrizzleConfigSchema;
-	const toAbs = (p) => isAbsolute(p) ? p : resolve(opts.cwd, p);
-	if (opts.flag) return toAbs(opts.flag);
-	const fromConfig = readSchema(opts.cwd);
-	if (fromConfig) return toAbs(fromConfig);
-	for (const candidate of COMMON_PATHS) {
-		const abs = toAbs(candidate);
-		if (exists(abs)) return abs;
+function workosWiring() {
+	return {
+		complete: true,
+		envKeys: [
+			"WORKOS_API_KEY",
+			"WORKOS_CLIENT_ID",
+			"WORKOS_COOKIE_PASSWORD"
+		],
+		hostImport: null,
+		imports: ["import { createWorkOSAuthAdapter } from \"clivly/auth/workos\";"],
+		packages: ["@workos-inc/node"],
+		body: `const adapter = createWorkOSAuthAdapter({
+  apiKey: process.env.WORKOS_API_KEY ?? "",
+  clientId: process.env.WORKOS_CLIENT_ID ?? "",
+  cookiePassword: process.env.WORKOS_COOKIE_PASSWORD ?? "",
+});
+${RESOLVE_USER}`
+	};
+}
+function hostImportFor(instance) {
+	if (instance === null) return {
+		binding: "auth",
+		path: "./lib/auth",
+		todo: "TODO(clivly): point this at your better-auth instance."
+	};
+	return {
+		binding: instance.moduleKey === "auth" ? "auth" : `${instance.moduleKey} as auth`,
+		path: instance.importPath
+	};
+}
+function betterAuthWiring(instance) {
+	return {
+		complete: instance !== null,
+		envKeys: [],
+		hostImport: hostImportFor(instance),
+		imports: ["import { createBetterAuthAdapter } from \"clivly/auth/better-auth\";"],
+		packages: [],
+		body: `const adapter = createBetterAuthAdapter({ auth });
+${RESOLVE_USER}`
+	};
+}
+function renderAuthWiring(auth, authInstance = null) {
+	switch (auth) {
+		case "clerk": return clerkWiring();
+		case "workos": return workosWiring();
+		case "better-auth": return betterAuthWiring(authInstance);
+		default: return STUB;
 	}
-	return null;
 }
 //#endregion
 //#region src/scaffold.ts
@@ -688,15 +631,30 @@ function routePath(framework, kind) {
 	if (!paths) throw new Error(`No route path for framework: ${framework}`);
 	return paths[kind];
 }
+const WINDOWS_SEP = /\\/g;
+const LEADING_DOT_SLASH = /^\.\//;
 function configImport(routeFilePath) {
-	const rel = relative(dirname(routeFilePath), "clivly.config").replace(/\\/g, "/");
+	const rel = relative(dirname(routeFilePath), "clivly.config").replace(WINDOWS_SEP, "/");
 	return rel.startsWith(".") ? rel : `./${rel}`;
 }
-function renderBody(framework, importPath, verify) {
+function hostImportPath(routeFilePath, appRelative) {
+	const fromRoot = appRelative.replace(LEADING_DOT_SLASH, "");
+	const rel = relative(dirname(routeFilePath), fromRoot).replace(WINDOWS_SEP, "/");
+	return rel.startsWith(".") ? rel : `./${rel}`;
+}
+function renderAuthPreamble(routeFilePath, auth) {
+	const lines = [...auth.imports];
+	if (auth.hostImport) {
+		if (auth.hostImport.todo) lines.push(`// ${auth.hostImport.todo}`);
+		const path = hostImportPath(routeFilePath, auth.hostImport.path);
+		lines.push(`import { ${auth.hostImport.binding} } from "${path}";`);
+	}
+	lines.push("", auth.body);
+	return lines.join("\n");
+}
+function renderBody(framework, importPath, verify, auth, routeFilePath) {
 	const preamble = verify ? `import clivly from "${importPath}";
-
-// TODO(clivly): resolve the signed-in host user from the request (your auth stack).
-const resolveUser = (_req: Request) => null;
+${renderAuthPreamble(routeFilePath, auth)}
 const handler = clivly.createAuthVerifyHandler(resolveUser);
 ` : `import clivly from "${importPath}";
 
@@ -727,9 +685,9 @@ export default defineEventHandler((event) => handler(toWebRequest(event)));
 		default: throw new Error(`No route template for framework: ${framework}`);
 	}
 }
-function renderRouteFile(framework, kind) {
+function renderRouteFile(framework, kind, auth = renderAuthWiring("unknown")) {
 	const path = routePath(framework, kind);
-	let body = renderBody(framework, configImport(path), kind === "verify");
+	let body = renderBody(framework, configImport(path), kind === "verify", auth, path);
 	if (framework === "tanstack-start") {
 		const url = `/${path.replace(TANSTACK_ROUTE_PREFIX, "").replace(TS_EXTENSION, "")}`;
 		body = body.replace("__ROUTE__", url);
@@ -759,6 +717,405 @@ function planScaffold(framework) {
 	];
 }
 //#endregion
+//#region src/plan-mutations.ts
+function fileAction(present, force) {
+	if (!present) return "create";
+	return force ? "overwrite" : "skip";
+}
+function hasKey(content, key) {
+	return new RegExp(`^\\s*${key}=`, "m").test(content);
+}
+function planFiles(args) {
+	const mutations = [];
+	const render = (path) => {
+		if (path === "clivly.config.ts") return renderInitConfig(args.plan);
+		const kind = path.includes("verify") ? "verify" : "tick";
+		return renderRouteFile(args.framework, kind, args.authWiring);
+	};
+	for (const file of planScaffold(args.framework)) mutations.push({
+		path: file.path,
+		contents: render(file.path),
+		action: fileAction(args.exists(join(args.cwd, file.path)), args.force)
+	});
+	return mutations;
+}
+function envAction(addedCount, existingLength) {
+	if (addedCount === 0) return "skip";
+	return existingLength === 0 ? "create" : "update";
+}
+function planEnv(args) {
+	const existing = args.readEnv(args.cwd);
+	const addedKeys = CLIVLY_ENV_KEYS.filter((entry) => !hasKey(existing, entry.key)).map((entry) => entry.key);
+	return {
+		path: ".env",
+		addedKeys,
+		contents: appendEnvKeys(existing, CLIVLY_ENV_KEYS),
+		action: envAction(addedKeys.length, existing.length)
+	};
+}
+function planMutations(args) {
+	return {
+		files: planFiles(args),
+		env: planEnv(args)
+	};
+}
+//#endregion
+//#region src/probe-auth.ts
+const AUTH_MODULE_PATHS = [
+	"auth",
+	"lib/auth",
+	"src/auth",
+	"src/lib/auth",
+	"app/lib/auth",
+	"server/auth",
+	"src/server/auth"
+];
+/** A better-auth instance, duck-typed by the surface the adapter calls. */
+function isBetterAuthInstance(value) {
+	return typeof value?.api?.getSession === "function";
+}
+function authInstanceCandidates(cwd) {
+	return AUTH_MODULE_PATHS.map((path) => join(cwd, path));
+}
+function defaultLoader(cwd) {
+	const jiti = createJiti(pathToFileURL(join(cwd, "clivly.config.ts")).href);
+	return (specifier) => jiti.import(specifier);
+}
+function probeAuthInstance(cwd, load) {
+	return probeModule({
+		candidates: authInstanceCandidates(cwd),
+		cwd,
+		load: load ?? defaultLoader(cwd),
+		match: isBetterAuthInstance
+	});
+}
+//#endregion
+//#region src/load-config.ts
+const CONFIG_HINT = "Expected clivly.config.ts at your app root exporting `createClivlySDK({...})`.";
+function resolveConfigPath(cwd, configPath) {
+	return resolve(cwd, configPath ?? "clivly.config.ts");
+}
+/**
+* Load the config and return its default export, checking it carries the method
+* the caller needs. The check is by capability rather than by type: the config
+* is the developer's own SDK instance, and a clear "this isn't an SDK instance"
+* beats a TypeError deep inside a command.
+*/
+/**
+* The first meaningful line of an error message. jiti reports a failed
+* resolution with a multi-line "Require stack:" dump naming Clivly's own
+* internal files — noise that tells the developer nothing about their app and
+* buries the one line that does.
+*/
+function firstLine(message) {
+	return message.split("\n")[0]?.trim() ?? "";
+}
+async function loadConfigSdk(path, requiredMethod) {
+	const jiti = createJiti(import.meta.url);
+	let mod;
+	try {
+		mod = await jiti.import(path);
+	} catch (error) {
+		throw new Error(firstLine(error.message));
+	}
+	const sdk = mod.default ?? mod;
+	if (typeof sdk?.[requiredMethod] !== "function") throw new Error("default export is not a Clivly SDK instance");
+	return sdk;
+}
+//#endregion
+//#region src/push-schema.ts
+async function runPushSchema(options) {
+	const out = options.out ?? ((line) => process.stdout.write(line));
+	const path = resolveConfigPath(options.cwd, options.configPath);
+	const loadSdk = options.loadSdk ?? ((configPath) => loadConfigSdk(configPath, "heartbeat"));
+	out("\nClivly push-schema\n");
+	let sdk;
+	try {
+		sdk = await loadSdk(path);
+	} catch (error) {
+		out(`  ❌ Could not load config — ${error.message}\n`);
+		out(`     ${CONFIG_HINT}\n`);
+		return 1;
+	}
+	let delivered;
+	try {
+		delivered = await sdk.heartbeat();
+	} catch (error) {
+		out(`  ❌ Push failed — ${error.message}\n`);
+		return 1;
+	}
+	if (!delivered) {
+		out("  ❌ Clivly rejected the push.\n");
+		out("     Run `clivly status` to check your key and reachability.\n");
+		return 1;
+	}
+	out("  ✅ Schema reported to Clivly.\n");
+	out("     Integration liveness and trigger URL were refreshed too.\n");
+	out("     Open Integrations → Mapping to map your tables.\n");
+	return 0;
+}
+//#endregion
+//#region src/resolve-schema-path.ts
+const COMMON_PATHS = [
+	"src/db/schema.ts",
+	"src/db/schema",
+	"db/schema.ts",
+	"db/schema",
+	"src/schema.ts",
+	"src/schema",
+	"drizzle/schema.ts",
+	"drizzle/schema"
+];
+const DRIZZLE_CONFIG_NAMES = [
+	"drizzle.config.ts",
+	"drizzle.config.js",
+	"drizzle.config.mjs"
+];
+function defaultReadDrizzleConfigSchema(cwd) {
+	for (const name of DRIZZLE_CONFIG_NAMES) {
+		const path = resolve(cwd, name);
+		if (!existsSync(path)) continue;
+		try {
+			const schema = createJiti(pathToFileURL(path).href)(path).default?.schema;
+			const first = Array.isArray(schema) ? schema[0] : schema;
+			if (typeof first === "string") return first;
+		} catch {}
+	}
+	return null;
+}
+function resolveSchemaPath(opts) {
+	const exists = opts.deps?.exists ?? existsSync;
+	const readSchema = opts.deps?.readDrizzleConfigSchema ?? defaultReadDrizzleConfigSchema;
+	const toAbs = (p) => isAbsolute(p) ? p : resolve(opts.cwd, p);
+	if (opts.flag) return toAbs(opts.flag);
+	const fromConfig = readSchema(opts.cwd);
+	if (fromConfig) return toAbs(fromConfig);
+	for (const candidate of COMMON_PATHS) {
+		const abs = toAbs(candidate);
+		if (exists(abs)) return abs;
+	}
+	return null;
+}
+//#endregion
+//#region src/status-ladder.ts
+const SATISFYING = new Set(["pass", "warn"]);
+function unmetPrerequisites(stage, satisfied) {
+	return (stage.needs ?? []).filter((id) => !satisfied.has(id));
+}
+async function runLadder(stages, ctx) {
+	const results = [];
+	const satisfied = /* @__PURE__ */ new Set();
+	const total = stages.length;
+	for (const [index, stage] of stages.entries()) {
+		const position = {
+			step: index + 1,
+			total,
+			id: stage.id,
+			label: stage.label
+		};
+		const blockedBy = unmetPrerequisites(stage, satisfied);
+		if (blockedBy.length > 0) {
+			results.push({
+				...position,
+				state: "pending",
+				detail: `Waiting on: ${blockedBy.join(", ")}.`
+			});
+			continue;
+		}
+		let outcome;
+		try {
+			outcome = await stage.run(ctx);
+		} catch (error) {
+			outcome = {
+				state: "fail",
+				detail: error.message
+			};
+		}
+		if (SATISFYING.has(outcome.state)) satisfied.add(stage.id);
+		results.push({
+			...position,
+			...outcome
+		});
+	}
+	return results;
+}
+/**
+* Exit 0 only when the setup actually works. `pending` is still non-zero —
+* incomplete is not working, and scripts must see that — even though the
+* rendering frames it as progress rather than breakage.
+*/
+function ladderExitCode(results) {
+	return results.every((result) => result.state !== "fail" && result.state !== "pending") ? 0 : 1;
+}
+//#endregion
+//#region src/status-stages.ts
+const REASON_HINT = {
+	ok: "",
+	invalid_api_key: "The key was rejected (401). Check CLIVLY_API_KEY.",
+	forbidden: "The key is valid but lacks access to this org (403).",
+	rate_limited: "Rate limited (429). Wait a moment and retry.",
+	server_error: "Clivly returned a server error (5xx). Retry shortly.",
+	client_error: "The request was rejected (4xx). Check your configuration.",
+	network_error: "Could not reach Clivly. Check your network or --api-url."
+};
+const apiKeyStage = {
+	id: "api-key",
+	label: "API key present",
+	run(ctx) {
+		if (ctx.apiKey) return Promise.resolve({
+			state: "pass",
+			detail: "CLIVLY_API_KEY is set."
+		});
+		return Promise.resolve({
+			state: "fail",
+			detail: "CLIVLY_API_KEY is not set.",
+			hint: "Copy your API key from Settings → API keys into .env."
+		});
+	}
+};
+const heartbeatStage = {
+	id: "heartbeat",
+	label: "Clivly reachable",
+	needs: [apiKeyStage.id],
+	async run(ctx) {
+		const result = await ctx.connect(ctx.apiKey, ctx.apiUrl);
+		if (result.ok) return {
+			state: "pass",
+			detail: `Reached org: ${result.org?.name ?? "(unnamed org)"}${result.org?.id ? ` (${result.org.id})` : ""}`
+		};
+		const status = result.status === null ? "no response" : `HTTP ${result.status}`;
+		return {
+			state: "fail",
+			detail: `${result.reason} (${status})`,
+			hint: REASON_HINT[result.reason]
+		};
+	}
+};
+const configStage = {
+	id: "config",
+	label: "clivly.config loads",
+	async run(ctx) {
+		try {
+			ctx.sdk = await ctx.loadSdk(ctx.configPath);
+			return {
+				state: "pass",
+				detail: ctx.configPath
+			};
+		} catch (error) {
+			return {
+				state: "fail",
+				detail: error.message,
+				hint: CONFIG_HINT
+			};
+		}
+	}
+};
+/** The full ladder, in the order a developer completes setup. */
+const STATUS_STAGES = [
+	apiKeyStage,
+	heartbeatStage,
+	configStage,
+	{
+		id: "setup-checks",
+		label: "Setup checks",
+		needs: [configStage.id],
+		async run(ctx) {
+			const report = await ctx.sdk.doctor();
+			const counted = report.checks.filter((check) => !check.skipped);
+			const passed = counted.filter((check) => check.ok).length;
+			return {
+				state: report.ok ? "pass" : "fail",
+				detail: `${passed} of ${counted.length} passed`,
+				sub: report.checks.map((check) => ({
+					label: check.name,
+					ok: check.ok,
+					skipped: check.skipped,
+					detail: check.detail
+				}))
+			};
+		}
+	},
+	{
+		id: "trigger-url",
+		label: "Sync trigger URL",
+		needs: [configStage.id],
+		run(ctx) {
+			const url = ctx.sdk?.syncTrigger?.url;
+			if (url) return Promise.resolve({
+				state: "pass",
+				detail: url
+			});
+			return Promise.resolve({
+				state: "warn",
+				detail: "Not set — remote sync cannot call back into this app.",
+				hint: "Set CLIVLY_SYNC_TRIGGER_URL once the app is deployed. Push-only setups can ignore this."
+			});
+		}
+	}
+];
+function defaultLoadSdk(path) {
+	return loadConfigSdk(path, "doctor");
+}
+//#endregion
+//#region src/status.ts
+/** Stage ids each legacy command maps onto. */
+const ALIAS_STAGE_IDS = {
+	status: STATUS_STAGES.map((stage) => stage.id),
+	ping: ["api-key", "heartbeat"],
+	doctor: ["config", "setup-checks"],
+	connect: [
+		"api-key",
+		"heartbeat",
+		"config",
+		"trigger-url"
+	]
+};
+const MARK = {
+	pass: "✅",
+	fail: "❌",
+	warn: "⚠️ ",
+	skip: "⏭️ ",
+	pending: "⏳"
+};
+const defaultConnect = (apiKey, apiUrl) => createClivlySDK({
+	apiKey,
+	apiUrl,
+	retry: { maxAttempts: 1 }
+}).connect();
+function subMark(sub) {
+	if (sub.skipped) return "⚠️ ";
+	return sub.ok ? "✅" : "❌";
+}
+function renderStage(result, verbose, out) {
+	const step = `Step ${result.step} of ${result.total}`;
+	const detail = result.detail ? ` — ${result.detail}` : "";
+	out(`  ${MARK[result.state]} ${step} · ${result.label}${detail}\n`);
+	for (const sub of result.sub ?? []) {
+		if (!(verbose || sub.skipped || !sub.ok)) continue;
+		const subDetail = sub.detail ? ` — ${sub.detail}` : "";
+		out(`       ${subMark(sub)} ${sub.label}${subDetail}\n`);
+	}
+	if (result.hint && result.state !== "pass") out(`       ${result.hint}\n`);
+}
+async function runStatus(options) {
+	const out = options.out ?? ((line) => process.stdout.write(line));
+	const selected = new Set(options.only ?? ALIAS_STAGE_IDS.status);
+	const stages = STATUS_STAGES.filter((stage) => selected.has(stage.id));
+	const ctx = {
+		apiKey: options.apiKey,
+		apiUrl: options.apiUrl,
+		configPath: resolveConfigPath(options.cwd, options.configPath),
+		connect: options.connect ?? defaultConnect,
+		loadSdk: options.loadSdk ?? defaultLoadSdk
+	};
+	out("\nClivly status\n");
+	const results = await runLadder(stages, ctx);
+	for (const result of results) renderStage(result, options.verbose ?? false, out);
+	const code = ladderExitCode(results);
+	if (code !== 0 && results.some((result) => result.state === "pending")) out("\nSetup is incomplete — finish the steps above and re-run.\n");
+	return code;
+}
+//#endregion
 //#region src/index.ts
 function flagValue(argv, flag) {
 	const index = argv.indexOf(flag);
@@ -810,10 +1167,12 @@ function resolveInitDeps(options) {
 		}),
 		detectPackageManager: options.detectPackageManager ?? detectPackageManager,
 		install: options.installPackages ?? installPackages,
+		probeAuth: options.probeAuthInstance ?? probeAuthInstance,
 		readEnv: options.readEnv ?? defaultReadEnv,
 		readOwnVersion: options.readOwnVersion ?? readOwnVersion,
 		writeEnv: options.writeEnv ?? defaultWriteEnv,
-		framework: "unknown"
+		framework: "unknown",
+		authWiring: renderAuthWiring("unknown")
 	};
 }
 async function acquireSchema(options, deps) {
@@ -825,10 +1184,13 @@ async function acquireSchema(options, deps) {
 	}
 	const framework = detectFramework(appDeps);
 	const orm = detectOrm(appDeps);
+	const auth = detectAuth(appDeps);
 	deps.framework = framework;
+	deps.authWiring = renderAuthWiring(auth, auth === "better-auth" ? await deps.probeAuth(options.cwd) : null);
 	out("\nClivly init\n");
 	out(`  Framework: ${FRAMEWORK_LABELS[framework]}\n`);
-	out(`  ORM:       ${orm}\n\n`);
+	out(`  ORM:       ${orm}\n`);
+	out(`  Auth:      ${auth}${deps.authWiring.complete ? " (wired)" : ""}\n\n`);
 	if (orm !== "drizzle") {
 		out(`clivly init currently generates config for Drizzle only. Detected ORM: ${orm}\n`);
 		return { code: 1 };
@@ -867,50 +1229,81 @@ function printPlan(out, plan) {
 		out("\n");
 	}
 }
-function writeOwnedFile(options, deps, path, contents) {
-	const full = join(options.cwd, path);
-	if (deps.configExists(full) && !options.force) {
-		deps.out(`  • ${path} exists — skipped (pass --force to overwrite)\n`);
+function mutationsFor(options, deps, plan) {
+	return planMutations({
+		cwd: options.cwd,
+		force: options.force,
+		framework: deps.framework,
+		authWiring: deps.authWiring,
+		plan,
+		exists: deps.configExists,
+		readEnv: deps.readEnv
+	});
+}
+function applyMutations(options, deps, mutations) {
+	for (const file of mutations.files) {
+		if (file.action === "skip") {
+			deps.out(`  • ${file.path} exists — skipped (pass --force to overwrite)\n`);
+			continue;
+		}
+		deps.writeConfig(join(options.cwd, file.path), file.contents);
+		deps.out(`  ✓ ${file.path}\n`);
+	}
+	if (mutations.env.action === "skip") {
+		deps.out("  • .env already has every CLIVLY_* key — skipped\n");
 		return;
 	}
-	deps.writeConfig(full, contents);
-	deps.out(`  ✓ ${path}\n`);
+	deps.writeEnv(options.cwd, mutations.env.contents);
+	deps.out("  ✓ .env placeholders\n");
 }
-function writeScaffoldFiles(options, deps, plan) {
-	writeOwnedFile(options, deps, "clivly.config.ts", renderInitConfig(plan));
-	for (const file of planScaffold(deps.framework)) {
-		if (file.path === "clivly.config.ts") continue;
-		const kind = file.path.includes("verify") ? "verify" : "tick";
-		writeOwnedFile(options, deps, file.path, renderRouteFile(deps.framework, kind));
+function previewMutations(deps, mutations) {
+	const { out } = deps;
+	out("\nDry run — nothing was written.\n\n");
+	for (const file of mutations.files) {
+		const verb = {
+			create: "create",
+			overwrite: "overwrite",
+			skip: "skip"
+		}[file.action];
+		const lines = file.contents.split("\n").length;
+		const suffix = file.action === "skip" ? " (exists — pass --force to overwrite)" : ` (${lines} lines)`;
+		out(`  ${verb.padEnd(9)} ${file.path}${suffix}\n`);
 	}
+	if (mutations.env.addedKeys.length === 0) out("  skip      .env (every CLIVLY_* key already present)\n");
+	else {
+		out(`  ${mutations.env.action.padEnd(9)} .env\n`);
+		for (const key of mutations.env.addedKeys) out(`              + ${key}=\n`);
+	}
+	out("\nRe-run without --dry-run to apply.\n");
 }
-function writeEnvFile(options, deps) {
-	const nextEnv = appendEnvKeys(deps.readEnv(options.cwd), CLIVLY_ENV_KEYS);
-	deps.writeEnv(options.cwd, nextEnv);
-	deps.out("  ✓ .env placeholders\n");
-}
-function printNextSteps(out) {
+function printNextSteps(out, authComplete) {
 	out("\nNext steps:\n");
 	out("  1. Set the CLIVLY_* values in .env\n");
 	out("  2. Set CLIVLY_SYNC_TRIGGER_URL to your public tick route\n");
-	out("  3. Finish resolveUser in the auth/verify route\n");
-	out("  4. Run `clivly connect` to verify\n");
+	const step = authComplete ? 3 : 4;
+	if (!authComplete) out("  3. Finish resolveUser in the auth/verify route\n");
+	out(`  ${step}. Run \`clivly status\` to see where you are\n`);
 }
 async function scaffold(options, deps, plan) {
 	const { out } = deps;
 	const pm = deps.detectPackageManager(options.cwd);
 	const version = deps.readOwnVersion();
-	const spec = version ? `clivly@${version}` : "clivly";
+	const packages = [version ? `clivly@${version}` : "clivly", ...deps.authWiring.packages];
+	const mutations = mutationsFor(options, deps, plan);
+	if (options.dryRun) {
+		out(`\nWould install (${pm}): ${packages.join(", ")}\n`);
+		previewMutations(deps, mutations);
+		return plan.contactDetected ? 0 : 1;
+	}
 	const result = await deps.install({
 		cwd: options.cwd,
 		pm,
-		packages: [spec]
+		packages
 	});
 	if (result.ok) out(`Installed clivly (${pm})\n`);
 	else out(`Could not install automatically — run:\n  ${result.command}\n`);
-	writeScaffoldFiles(options, deps, plan);
-	writeEnvFile(options, deps);
-	printNextSteps(out);
+	applyMutations(options, deps, mutations);
+	printNextSteps(out, deps.authWiring.complete);
 	return plan.contactDetected ? 0 : 1;
 }
 async function runInit(options) {
@@ -927,26 +1320,28 @@ async function main(argv) {
 		case "init": return await runInit({
 			cwd: process.cwd(),
 			force: rest.includes("--force"),
+			dryRun: rest.includes("--dry-run"),
 			schemaFlag: flagValue(rest, "--schema")
 		});
-		case "ping": return await runPing({
-			apiKey: process.env.CLIVLY_API_KEY,
-			apiUrl: flagValue(rest, "--api-url") ?? process.env.CLIVLY_API_URL
-		});
-		case "doctor": return await runDoctor({
+		case "push-schema": return await runPushSchema({
 			cwd: process.cwd(),
 			configPath: flagValue(rest, "--config")
 		});
-		case "connect": return await runConnect({
+		case "status":
+		case "ping":
+		case "doctor":
+		case "connect": return await runStatus({
 			cwd: process.cwd(),
 			apiKey: process.env.CLIVLY_API_KEY,
 			apiUrl: flagValue(rest, "--api-url") ?? process.env.CLIVLY_API_URL,
-			configPath: flagValue(rest, "--config")
+			configPath: flagValue(rest, "--config"),
+			only: ALIAS_STAGE_IDS[command],
+			verbose: rest.includes("--verbose")
 		});
 		case void 0:
 		case "help":
 		case "--help":
-			process.stdout.write("clivly — embed a CRM in your app\n\nUsage:\n  clivly init [--force] [--schema <path>]   Scaffold Clivly (config, routes, .env) for your app\n  clivly ping [--api-url <url>]   Verify CLIVLY_API_KEY + reachability\n  clivly doctor [--config <path>]   Verify your clivly.config setup end-to-end\n  clivly connect [--config <path>]   One pass/fail check that setup is wired\n");
+			process.stdout.write("clivly — embed a CRM in your app\n\nUsage:\n  clivly init [--force] [--dry-run] [--schema <path>]   Scaffold Clivly (config, routes, .env) for your app\n  clivly status [--verbose] [--config <path>]   Check your setup, step by step\n  clivly push-schema [--config <path>]   Report your schema to Clivly without deploying\n");
 			return 0;
 		default:
 			process.stdout.write(`Unknown command: ${command}\n`);