dogfood: DX papercuts — redirect() defaults to 307; bare webjs dev skips predev

[vivek7405]

Problem

Two small DX papercuts, each of which cost a moment of confusion while building crisp and which an AI is prone to trip over:

(a) redirect() defaults to HTTP 307. A gating/post-action redirect like redirect('/login') returns 307 (Temporary Redirect, method-preserving), whereas the convention people/agents reach for is 302 (Found). Not wrong, but surprising — and method-preserving 307 on what's usually a GET-to-GET navigation is an odd default. An AI emits redirect('/login') assuming 302-ish behavior.

(b) A bare webjs dev silently skips the npm predev hook. The scaffold's dev script is webjs dev, and npm run dev runs predev (prisma generate) first. But invoking webjs dev directly (easy to do, and tempting for an AI/CLI) skips predev, so the dev server crashes on an ungenerated Prisma client with no hint that the canonical command is npm run dev. (This also bit the crisp work on the sandbox side earlier — a bare webjs dev vs npm run dev was a real source of "why won't it start".)

Design / approach

(a) Reconsider 302 as redirect()'s default (or, if 307 is intentional, document it prominently in the recipe with how to pass an explicit status).

(b) Have webjs dev detect a missing/stale generated Prisma client (or, more generally, a missing predev artifact) and either generate it or print a clear, actionable hint ("Prisma client not generated — run via npm run dev (which runs prisma generate first), or run webjs db generate"). Even just the hint turns a confusing crash into a one-line fix. Docs should name npm run dev as the canonical command and say why.

Acceptance criteria

• redirect()'s default status is documented; 302-vs-307 default reconsidered.
• webjs dev gives a clear, actionable message (or self-heals) when the Prisma client isn't generated, instead of a raw crash.
• Docs note npm run dev as the canonical dev command and the predev (prisma generate) reason.

[vivek7405]

Implementation notes (for the agent picking this up)

Two independent papercuts; can be split into two PRs.

(a) redirect() default status

• Where: packages/core/src/nav.js (the redirect helper / default status).
• Do: document the default prominently in the auth/recipes docs and how to pass an explicit status; reconsider 302 (Found) as the default for GET→GET gating redirects.
• Don't: don't blanket-change to 302 if method-preserving 307/303 is deliberately needed for POST/action redirects — audit call sites (action redirects may want 303/307). Backward-compat matters.

(b) bare webjs dev skips predev

• Where: packages/cli/bin/webjs.js (dev) + packages/server/src/dev.js (startup).
• Do: detect a missing/stale generated Prisma client at webjs dev startup and either run prisma generate or print a clear hint ("Prisma client not generated — run npm run dev (runs prisma generate first) or webjs db generate"). Document npm run dev as the canonical command and why.
• Don't: don't assume every app uses Prisma (guard on a prisma schema/client existing); don't silently auto-run arbitrary predev scripts — scope to the Prisma-client case or a hint only. No new build step (no-build framework).

Verify

• (a) redirect() default documented; status override works. (b) Running webjs dev without a generated client yields an actionable message instead of a raw crash; with Prisma absent, no spurious warning.