@dashai/cli 0.20.1 → 0.22.0

package/dist/bin.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import pc from 'picocolors';
-import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, watch, readdirSync, chmodSync, renameSync, mkdtempSync, statSync } from 'fs';
+import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, watch, readdirSync, chmodSync, renameSync, lstatSync, mkdtempSync, statSync } from 'fs';
 import { hostname, tmpdir, platform, homedir } from 'os';
 import { resolve, join, relative, dirname, basename, win32, sep } from 'path';
 import { spawn, spawnSync } from 'child_process';
-import { intro, log, select, isCancel, cancel, spinner, outro, text, multiselect, confirm } from '@clack/prompts';
+import { intro, log, select, isCancel, cancel, spinner, outro, text, confirm, multiselect } from '@clack/prompts';
 import { Command, Option } from 'commander';
 import open from 'open';
 import AdmZip from 'adm-zip';
@@ -286,6 +286,15 @@ function asEnvelope(v) {
   } else if (env.details && typeof env.details === "object") {
     out2.context = env.details;
   }
+  const folded = {};
+  for (const key of TOP_LEVEL_CONTEXT_KEYS) {
+    if (typeof env[key] === "string" && out2.context?.[key] === void 0) {
+      folded[key] = env[key];
+    }
+  }
+  if (Object.keys(folded).length > 0) {
+    out2.context = { ...out2.context ?? {}, ...folded };
+  }
   return out2;
 }
 function codeFromStatus(status) {
@@ -587,7 +596,34 @@ async function getRuntimeLogs(installationId, opts = {}, options = {}) {
     options
   );
 }
-var ApiError, CODE_SHAPE, slugifyFieldName;
+async function getInstallationRuntime(installationId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/runtime`,
+    void 0,
+    options
+  );
+}
+async function setInstallationRuntime(installationId, body, options = {}) {
+  return apiRequest(
+    "PATCH",
+    `/api/installations/${installationId}/runtime`,
+    body,
+    options
+  );
+}
+async function rebuildModule(moduleId, body, options = {}) {
+  return apiRequest("POST", `/api/modules/${moduleId}/rebuild`, body, options);
+}
+async function getModuleBuild(moduleId, buildId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/modules/${moduleId}/builds/${buildId}`,
+    void 0,
+    options
+  );
+}
+var ApiError, CODE_SHAPE, TOP_LEVEL_CONTEXT_KEYS, slugifyFieldName;
 var init_api_client = __esm({
   "src/lib/api-client.ts"() {
     init_config();
@@ -609,6 +645,7 @@ var init_api_client = __esm({
       }
     };
     CODE_SHAPE = /^[A-Z][A-Z0-9_]*$/;
+    TOP_LEVEL_CONTEXT_KEYS = ["feature", "permission", "plane"];
     slugifyFieldName = slugifyUsesName;
   }
 });
@@ -2068,13 +2105,27 @@ import { AuthProvider, HostRouteSync } from '@dashai/sdk/auth/client';
 import { PlatformProvider, PLATFORM_PREPAINT_SCRIPT } from '@dashai/sdk/platform';
 import { ThemeProvider } from '@/components/theme-provider';
 import { PlatformThemeSync } from '@/components/platform-theme-sync';
+import { getSession } from '@/lib/session';
 
 export const metadata = {
   title: ${JSON.stringify(opts.name)},
   description: ${JSON.stringify(`Dashwise module: ${opts.slug}`)},
 };
 
-export default function RootLayout({ children }: { children: React.ReactNode }) {
+// force-dynamic: the layout reads the session at render (below), which needs
+// DASHWISE_API_URL/KEY. \`next build\` prerenders with NO Dashwise env, so the
+// SDK would throw "missing apiBaseUrl" \u2192 BUILD_FAILED on first publish.
+// Required today; becomes optional once the SDK reads cookies before config.
+export const dynamic = 'force-dynamic';
+
+export default async function RootLayout({ children }: { children: React.ReactNode }) {
+  // Fetch the session ONCE, on the server, and hand it to <AuthProvider> as
+  // \`initialSession\`. Without it the provider fetches /api/auth/session from
+  // the browser after hydration: a second server invocation (and two more
+  // backend calls) on every page load before useSession() knows anything.
+  // \`getSession\` is React-\`cache\`d, so pages calling it in the same request
+  // reuse this result instead of asking the backend again.
+  const session = await getSession();
   return (
     // \`data-dw-surface="embedded"\` is the SERVER default: this module normally
     // renders inside the Dashwise app shell, where the header/nav/theme toggle
@@ -2100,10 +2151,12 @@ export default function RootLayout({ children }: { children: React.ReactNode })
                 Bridges the SDK to next-themes so the SDK stays theming-library
                 agnostic. Inert when standalone \u2014 your own toggle wins there. */}
             <PlatformThemeSync />
-            {/* sessionEndpoint points at the same-origin /api/auth/session
-                route so the host-scoped session cookie is actually sent \u2014
-                a cross-origin fetch to the API would drop it (D8). */}
-            <AuthProvider sessionEndpoint="/api/auth/session">
+            {/* initialSession: server-fetched above, so the provider skips
+                its mount-time fetch. sessionEndpoint stays for refresh():
+                it points at the same-origin /api/auth/session route so the
+                host-scoped session cookie is actually sent \u2014 a cross-origin
+                fetch to the API would drop it (D8). */}
+            <AuthProvider sessionEndpoint="/api/auth/session" initialSession={session}>
               {/* Mirrors in-module navigation to the Dashwise host's address
                   bar when embedded; inert when standalone. */}
               <HostRouteSync />
@@ -2139,58 +2192,86 @@ function appPageCustomTsx(opts) {
 // \`ModuleShell\` below encodes all of that. Anything that should appear only
 // when the module is opened on its own subdomain goes in \`.dw-standalone-only\`.
 // See CLAUDE.md \u2192 "Embedded-first UI" for the full contract.
-import { getServerSession } from '@dashai/sdk/auth/server';
+import { db } from '@dashai/generated';
+import { hasPermissionInSession } from '@dashai/sdk/auth/server';
 import { redirect } from 'next/navigation';
-import { PlusIcon } from 'lucide-react';
-import { Button } from '@/components/ui/button';
 import { ModuleShell } from '@/components/module-shell';
+import { NewItemForm } from '@/components/new-item-form';
 import { EmptyState } from '@/components/states';
+import { getSession } from '@/lib/session';
 
-// force-dynamic: this page calls getServerSession() at render, which
-// reads DASHWISE_API_URL/KEY. \`next build\` statically PRERENDERS pages by
+// force-dynamic: this page reads the session at render, which needs
+// DASHWISE_API_URL/KEY. \`next build\` statically PRERENDERS pages by
 // default and runs with NO Dashwise env, so the SDK would throw
 // "missing apiBaseUrl" and the platform's first publish would fail with
 // an opaque BUILD_FAILED. Opting into dynamic rendering skips prerender.
+// Required today; becomes optional once the SDK reads cookies before config.
 export const dynamic = 'force-dynamic';
 
 export default async function Home() {
-  const session = await getServerSession();
+  // \`getSession()\` is the per-request cached getServerSession(): the layout
+  // already started it, so awaiting it here costs no extra backend call.
+  const session = await getSession();
   if (!session) {
     redirect('/api/auth/sign-in?return_to=/');
   }
 
-  // Replace this with your real first screen: list what the user came to see,
-  // and render EmptyState only while there is genuinely nothing yet. Keep the
-  // loading state (ListSkeleton) and error state (ErrorState) \u2014 they're in
-  // components/states.tsx and they are what makes a module feel finished.
+  // The middleware only checks that a session cookie EXISTS, and the layout
+  // checks no permission \u2014 neither is the guard. What the user may see and
+  // do is a PERMISSION check: here, before any data is read, and again
+  // inside every Server Action (app/actions.ts), because hiding a button is
+  // not authorization. \`items:read\` / \`items:create\` are the per-table
+  // permissions the platform synthesizes when module.json has no \`rbac\`.
+  const canRead = hasPermissionInSession(session, 'items:read');
+  const canCreate = hasPermissionInSession(session, 'items:create');
+
+  // Read only what the user may see. With two or more independent reads,
+  // start them together after the check: \`await Promise.all([a(), b()])\`,
+  // never one await after another.
+  //
+  // \`db.items.list()\` with no \`limit\` returns ONE page of 100 rows and drops
+  // \`total\`. Pass a \`limit\`, use \`listPage()\` when you need the count, or
+  // paginate \u2014 never "read everything and filter in JS".
+  const items = canRead ? await db.items.list({ limit: 50 }) : [];
+
+  // Replace this with your real first screen. Keep the three states: the
+  // loading state is app/loading.tsx (ListSkeleton), errors land in
+  // app/error.tsx, and EmptyState covers "genuinely nothing yet".
   return (
-    <ModuleShell
-      title="${escapeHtml(opts.name)}"
-      primaryAction={
-        <Button>
-          <PlusIcon aria-hidden="true" />
-          Add item
-        </Button>
-      }
-    >
-      <EmptyState
-        title="Nothing here yet"
-        description="This is your module's home. Build the first screen in app/page.tsx \u2014 declare your tables with \`dashwise table create\`, then read them with the typed \`db\` client from @dashai/generated."
-        action={
-          <Button>
-            <PlusIcon aria-hidden="true" />
-            Add item
-          </Button>
-        }
-      />
+    <ModuleShell title="${escapeHtml(opts.name)}">
+      {canCreate ? <NewItemForm /> : null}
+      {!canRead ? (
+        <EmptyState
+          title="You can't see items yet"
+          description="Your role in this module doesn't include viewing items. Ask a workspace admin for access."
+        />
+      ) : items.length === 0 ? (
+        <EmptyState
+          title="Nothing here yet"
+          description="This is your module's home. Build the first screen in app/page.tsx \u2014 declare your tables with \`dashwise table create\`, then read them with the typed \`db\` client from @dashai/generated."
+        />
+      ) : (
+        <ul className="divide-y divide-border rounded-lg border border-border">
+          {items.map((item) => (
+            <li
+              key={item.id}
+              className="flex items-center justify-between gap-4 px-4 py-3 text-sm"
+            >
+              <span className="min-w-0 truncate">{item.title}</span>
+              {item.done ? (
+                <span className="shrink-0 text-muted-foreground">Done</span>
+              ) : null}
+            </li>
+          ))}
+        </ul>
+      )}
     </ModuleShell>
   );
 }
 `;
 }
 function appDashboardPageTsx() {
-  return `import { getServerSession } from '@dashai/sdk/auth/server';
-import { redirect } from 'next/navigation';
+  return `import { redirect } from 'next/navigation';
 import { LogOut, ShieldCheck } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import { ModuleShell } from '@/components/module-shell';
@@ -2201,12 +2282,14 @@ import {
   CardHeader,
   CardTitle,
 } from '@/components/ui/card';
+import { getSession } from '@/lib/session';
 
 /**
  * An ADDITIONAL example route \u2014 your real home is app/page.tsx (\`/\`).
  * This \`/dashboard\` page shows a second auth-gated Server Component: keep
- * it, rename it, or delete it. The middleware ensures the user has a session
- * cookie before this page renders; \`getServerSession()\` validates the cookie
+ * it, rename it, or delete it. The middleware only ensures a session cookie
+ * EXISTS before this page renders; \`getSession()\` (lib/session.ts, a
+ * per-request cached \`getServerSession()\`) validates the cookie
  * against the backend's \`/api/auth/sessions/me\` endpoint, returning the
  * decoded \`Session\` (or \`null\` if stale).
  *
@@ -2215,13 +2298,15 @@ import {
  * Dashwise app the user menu already offers sign-out, so rendering our own
  * would duplicate the app's chrome. See CLAUDE.md \u2192 "Embedded-first UI".
  */
-// force-dynamic: same reason as app/page.tsx \u2014 this route calls
-// getServerSession() at render, which needs DASHWISE_API_URL/KEY. Static
-// prerender during \`next build\` runs with no env \u2192 BUILD_FAILED. Opt out.
+// force-dynamic: same reason as app/page.tsx \u2014 this route reads the session
+// (getSession() \u2192 getServerSession()) at render, which needs
+// DASHWISE_API_URL/KEY. Static prerender during \`next build\` runs with no
+// env \u2192 BUILD_FAILED. Opt out.
+// Required today; becomes optional once the SDK reads cookies before config.
 export const dynamic = 'force-dynamic';
 
 export default async function Dashboard() {
-  const session = await getServerSession();
+  const session = await getSession();
   if (!session) {
     redirect('/api/auth/sign-in?return_to=/');
   }
@@ -2602,26 +2687,44 @@ export async function POST(request: Request) {
 `;
 }
 function appApiItemsRouteTs() {
-  return `// Example data-plane route \u2014 lists + creates rows in the seeded
-// \`items\` table via the generated typed SDK. Delete this (and the
-// \`items\` table in module.json) once you add your own tables.
+  return `// \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+//  EXAMPLE ROUTE \u2014 DELETE OR RENAME IT.
+//  It exists to show a guarded JSON route over the seeded \`items\` table.
+//  Delete this file (and the \`items\` table in module.json) once you add
+//  your own tables; your UI's writes belong in Server Actions
+//  (app/actions.ts in the full scaffold), not here.
+// \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+//
+// Every route handler checks a PERMISSION. The middleware only checks that a
+// session cookie exists, and \`db\` talks to the Data Hub with the module's own
+// dwk_ key \u2014 so an unguarded route hands the module's full data access to
+// anyone who can reach the URL. \`withPermission\` answers 401 with no session
+// and 403 without the permission. \`items:read\` / \`items:create\` are the
+// per-table permissions the platform synthesizes when module.json has no
+// \`rbac\` block. Per-user rows also need an ownership check in the handler.
+//
+// A module scaffolded with \`--simple\` has no sign-in routes, so this answers
+// 401 until you add sign-in \u2014 that is the intended default.
 //
 // \`db\` comes from @dashai/generated, regenerated on every module.json
 // save by \`dashwise dev\`. Run it (or \`dashwise module generate\`) first.
 import { NextResponse } from 'next/server';
+import { withPermission } from '@dashai/sdk/auth/middleware';
 import { db } from '@dashai/generated';
 
-export async function GET() {
+export const GET = withPermission('items:read')(async () => {
   // \`db.<table>.list()\` resolves to the rows array itself \u2014 the typed
   // client unwraps the \`{ rows, total, ... }\` page envelope (see the
   // generated \`client/tables.d.ts\`: \`list(): Promise<ItemsRow[]>\`).
   // Don't reach for \`.rows\` here: it's \`undefined\` on an array, and
   // \`NextResponse.json(undefined)\` throws "Value is not JSON serializable".
+  // Without a \`limit\` it returns ONE page of 100; use \`listPage()\` for
+  // the total, or paginate.
   const rows = await db.items.list({ limit: 50 });
   return NextResponse.json(rows);
-}
+});
 
-export async function POST(request: Request) {
+export const POST = withPermission('items:create')(async (request) => {
   const body = (await request.json().catch(() => null)) as
     | { title?: unknown; done?: unknown }
     | null;
@@ -2635,7 +2738,7 @@ export async function POST(request: Request) {
   const done = typeof body?.done === 'boolean' ? body.done : false;
   const row = await db.items.create({ title, done });
   return NextResponse.json(row, { status: 201 });
-}
+});
 `;
 }
 function appApiAuthSessionTs() {
@@ -3471,6 +3574,151 @@ export default function Error({
 }
 `;
 }
+function libSessionTs() {
+  return `import { cache } from 'react';
+import { getServerSession } from '@dashai/sdk/auth/server';
+
+/**
+ * The current session (or \`null\`), fetched at most ONCE per request.
+ *
+ * \`getServerSession()\` is uncached and costs two backend round trips
+ * (session + RBAC). The root layout reads it to hydrate <AuthProvider>, and
+ * pages read it for their guard; React \`cache()\` makes the second caller
+ * reuse the first one's result within the same server render.
+ *
+ * Use this in layouts, pages and Server Components. Server Actions and route
+ * handlers run in their own request: guard those with
+ * \`requirePermission()\` / \`withPermission()\` instead.
+ */
+export const getSession = cache(() => getServerSession());
+`;
+}
+function appLoadingTsx() {
+  return `// Root loading state. Next.js shows this IMMEDIATELY on navigation while the
+// next page renders on the server (session + data reads), so the user gets
+// feedback within 100 ms instead of a frozen screen. Shaped like the content
+// that is coming: match \`rows\` and the row height to your real list, or it
+// visibly jumps on load. Add a loading.tsx per route segment when a screen's
+// shape differs from a list.
+import { ListSkeleton } from '@/components/states';
+
+export default function Loading() {
+  return (
+    <div className="mx-auto w-full max-w-6xl p-4 md:p-6">
+      <ListSkeleton />
+    </div>
+  );
+}
+`;
+}
+function appActionsTs() {
+  return `'use server';
+
+// Server Actions \u2014 the canonical WRITE path for this module.
+//
+// Every action follows the same four steps, in this order:
+//   1. Check a PERMISSION. The middleware only checks that a session cookie
+//      exists; it says nothing about what the user may do. A Server Action is
+//      a public POST endpoint \u2014 anyone with a cookie can call it directly,
+//      whatever your UI shows or hides.
+//   2. Validate the input (FormData is untrusted).
+//   3. Write through the generated \`db\` client (the module's server-side
+//      dwk_ key \u2014 never send that key to the browser).
+//   4. Revalidate ONE narrow path (or tag) \u2014 the screen that shows the data.
+//      Never call router.refresh() after it: revalidatePath already sends
+//      the fresh render back with the action's response, and a refresh
+//      re-renders everything a second time.
+//
+// Per-user data (rows that belong to one person) also needs an OWNERSHIP
+// check: store \`session.user.id\` on create, and on update/delete compare it
+// before writing. The dwk_ key is the module's ceiling, not a per-user rule.
+import { revalidatePath } from 'next/cache';
+import { requirePermission } from '@dashai/sdk/auth/server';
+import { db } from '@dashai/generated';
+
+export type CreateItemState = { error: string } | null;
+
+export async function createItem(
+  _prev: CreateItemState,
+  formData: FormData,
+): Promise<CreateItemState> {
+  // 1. Throws a DashwiseError (401 no session / 403 denied) \u2192 app/error.tsx.
+  //    The page only renders the form for users who hold the permission, so
+  //    reaching this throw means someone called the action directly.
+  await requirePermission('items:create');
+
+  // 2. Validate.
+  const raw = formData.get('title');
+  const title = typeof raw === 'string' ? raw.trim() : '';
+  if (!title) {
+    return { error: 'Give the item a title.' };
+  }
+
+  // 3. Write.
+  await db.items.create({ title, done: false });
+
+  // 4. One narrow revalidate: only the home page lists items.
+  revalidatePath('/');
+  return null;
+}
+`;
+}
+function componentsNewItemFormTsx() {
+  return `"use client";
+
+// The client half of the canonical write path (see app/actions.ts).
+//
+// Feedback within 100 ms: the submit button reads \`useFormStatus()\` and
+// switches to a pending state the moment the form is submitted, while the
+// Server Action runs. For lists where the new row should appear instantly,
+// layer \`useOptimistic\` on top \u2014 it is DISPLAY-ONLY: the server still checks
+// the permission and is the source of truth when the action returns.
+import { useActionState } from "react";
+import { useFormStatus } from "react-dom";
+import { PlusIcon } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { createItem, type CreateItemState } from "@/app/actions";
+
+export function NewItemForm() {
+  const [state, formAction] = useActionState<CreateItemState, FormData>(
+    createItem,
+    null,
+  );
+  return (
+    <form action={formAction} className="flex flex-wrap items-start gap-2">
+      <label htmlFor="new-item-title" className="sr-only">
+        Title
+      </label>
+      <input
+        id="new-item-title"
+        name="title"
+        required
+        maxLength={200}
+        autoComplete="off"
+        placeholder="New item"
+        className="h-9 min-w-0 flex-1 rounded-md border border-input bg-background px-3 text-sm outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50"
+      />
+      <SubmitButton />
+      {state?.error ? (
+        <p role="alert" className="w-full text-sm text-destructive">
+          {state.error}
+        </p>
+      ) : null}
+    </form>
+  );
+}
+
+function SubmitButton() {
+  const { pending } = useFormStatus();
+  return (
+    <Button type="submit" disabled={pending}>
+      <PlusIcon aria-hidden="true" />
+      {pending ? "Adding\u2026" : "Add item"}
+    </Button>
+  );
+}
+`;
+}
 function seedMjs() {
   return `/**
  * seed.mjs \u2014 OPTIONAL seed/maintenance script template.
@@ -3801,16 +4049,31 @@ Import from there:
 \`\`\`ts
 import { db, qb } from '@dashai/generated';
 
-// Simple CRUD
-const rows = await db.<table>.list();
+// Simple CRUD. list() with no \`limit\` returns ONE page of 100 rows and
+// drops \`total\` \u2014 pass a \`limit\`, use listPage() for the total, or paginate.
+const rows = await db.<table>.list({ limit: 50 });
+const page = await db.<table>.listPage({ limit: 50, offset: 0 }); // { rows, total, ... }
 await db.<table>.create({ /* fields */ });
 
 // Query builder \u2014 a per-table getter (NOT a \`.from()\` call); \`.where()\`
 // takes a single clause object (field \u2192 value or field \u2192 operator), and
 // \`.execute()\` runs it. Chain \`.orderBy()\` / \`.limit()\` / \`.count()\` etc.
 const open = await qb.<table>.where({ status: { equal: 'open' } }).execute();
+
+// Aggregate ON THE SERVER \u2014 one call, not one count() per option.
+const openCount = await qb.<table>.where({ status: { equal: 'open' } }).count();
+const byStatus = await qb.<table>
+  .groupBy(['status'])
+  .agg({ total: { count: '*' } })
+  .execute(); // byStatus.rows = [{ status: 'open', total: 7 }, ...]
 \`\`\`
 
+Children of a linked parent: \`link_row\` fields take no value filters in a
+bare \`where\`, so join through the link and filter the joined side \u2014
+\`qb.comments.joinTask().where({ 'task.id': taskId }).execute()\` \u2014 which runs
+in SQL. Never read the whole child table and filter it in JS: \`list()\` stops
+at 100 rows, so that pattern is slow AND silently wrong past the first page.
+
 The data plane authenticates via the per-module scoped \`dwk_\` API key
 cached in \`~/.config/dashwise/auth.json#modules[${opts.slug}]\` after
 \`dashwise init\` provisions the dev install. \`dashwise dev\` injects it
@@ -3850,10 +4113,67 @@ follows the returned \`redirect_url\` \u2014 the same code runs in dev and in
 production, with no installation id or dev-session id in the request.
 
 In Server Components: \`await getServerSession()\` (from
-\`@dashai/sdk/auth/server\`).
+\`@dashai/sdk/auth/server\`)${isCustom ? ` \u2014 or the per-request cached
+\`getSession()\` from \`lib/session.ts\`, which the root layout already uses` : ""}.
 In Client Components: \`useSession()\` (from
-\`@dashai/sdk/auth/client\`), wrapped in \`<AuthProvider>\` (already
-in \`app/layout.tsx\`).
+\`@dashai/sdk/auth/client\`), wrapped in \`<AuthProvider>\`${isCustom ? ` (already
+in \`app/layout.tsx\`, hydrated server-side through \`initialSession\`)` : ""}.
+
+## Authorization \u2014 every action and route checks a permission
+
+Signing in is wired; **authorization is not automatic.** The middleware only
+checks that a session cookie EXISTS \u2014 it never checks what the user may do.
+And \`db\` / \`qb\` run with the module's \`dwk_\` key, which can touch every
+table the module owns. So:
+
+- **Every Server Action** starts with \`await requirePermission('<table>:<op>')\`
+  (from \`@dashai/sdk/auth/server\`; throws 401/403). A Server Action is a
+  public POST endpoint \u2014 hiding the button does not protect it.
+- **Every route handler** is wrapped: \`export const GET =
+  withPermission('<table>:read')(async (req) => \u2026)\` (from
+  \`@dashai/sdk/auth/middleware\`; answers 401/403).
+- **Per-user data needs an ownership check.** Store \`session.user.id\` on the
+  row and compare it before every update/delete. A permission says the user
+  may edit *items*, not *this* item.
+- **Optimistic UI is display-only.** \`useOptimistic\` changes what the user
+  sees; the server action still checks the permission and its result wins.
+- Shape the UI with \`hasPermissionInSession(session, key)\` (server) or
+  \`useHasPermission(key)\` (client) so nobody sees a button that then 403s.
+
+With no \`rbac\` block in \`module.json\` the platform synthesizes
+\`<table>:create|read|update|delete\` permissions plus admin/editor/viewer
+roles.${isCustom ? ` \`app/actions.ts\` and \`app/api/items/route.ts\` show both guards.` : ""}
+
+## Responsiveness \u2014 rules, not polish
+
+A module runs behind the platform proxy, so every server round trip is
+expensive. These are the defaults; break one only with a reason in the code.
+
+- **Feedback within 100 ms.** Every click that writes shows a pending state
+  immediately: \`useFormStatus()\` in the submit button, or \`useOptimistic\`
+  for lists${isCustom ? ` (\`components/new-item-form.tsx\` shows the pattern)` : ""}.
+  Navigation shows \`loading.tsx\`${isCustom ? ` (\`app/loading.tsx\` renders \`ListSkeleton\`)` : ""}.
+- **One narrow revalidate per write.** After a write, call ONE
+  \`revalidatePath('/the/screen')\` or \`revalidateTag(tag)\` \u2014 the screen
+  that shows the data, not \`'/'\` with \`'layout'\`. **Never call
+  \`router.refresh()\` after it**: the action's response already carries the
+  fresh render, and a refresh renders everything a second time.
+- **Parallel reads.** Independent awaits go in \`Promise.all([...])\`, never
+  one after another. Start reads that don't need the session in parallel
+  with the session lookup, but check the permission before rendering or
+  returning any data. Never rely on the middleware or the layout as the
+  guard: the middleware only checks that a cookie exists and the layout
+  checks no permission.
+- **No writes during a GET render.** Pages and layouts only read. Writes go
+  in Server Actions or POST routes; "touch lastSeen on render" style writes
+  make every view slow and break caching.
+- **\`prefetch={false}\`** on \`<Link>\`s in long row or card lists \u2014 Next
+  otherwise prefetches every visible row's page.
+- **Aggregate on the server.** \`qb.<table>.groupBy([...]).agg({...})\` or
+  \`.count()\` \u2014 never N \`count()\` calls in a loop, and never "list
+  everything and count in JS".
+- **\`list()\` returns one page of 100** and hides \`total\`. Pass a \`limit\`,
+  use \`listPage()\` when you need the total, or paginate.
 ${isCustom ? `
 ## Design & home
 
@@ -3886,8 +4206,10 @@ reads the session or data at render (calls \`getServerSession()\` or a
 \`dwk_\`-authenticated data call). Without it, \`next build\` statically
 prerenders the page with NO Dashwise env vars, the SDK throws
 \`missing apiBaseUrl\`, and the platform's first publish fails with an
-opaque \`BUILD_FAILED\`. The scaffolded \`app/page.tsx\` + \`app/dashboard/page.tsx\`
-already have it \u2014 any new session-gated page you add needs it too.
+opaque \`BUILD_FAILED\`. The scaffolded \`app/layout.tsx\`, \`app/page.tsx\` and
+\`app/dashboard/page.tsx\` already have it \u2014 any new session-gated page you add
+needs it too. Required today; becomes optional once the SDK reads cookies
+before config.
 
 A passing local \`npm run build\` is NOT proof: your \`.env.local\` supplies
 the env the platform build won't have, so it masks the failure. \`GET\` route
@@ -3949,8 +4271,12 @@ what tables it owns.
 
 | Method | Path | Auth | Purpose |
 |---|---|---|---|
-| GET | \`/api/items\` | dwk_ (server-side) | list \`items\` rows via \`db.items.list()\` |
-| POST | \`/api/items\` | dwk_ (server-side) | create an \`items\` row via \`db.items.create()\` |
+| GET | \`/api/items\` | session + \`items:read\` (\`withPermission\`); data via dwk_ server-side | EXAMPLE \u2014 delete or rename. List \`items\` rows via \`db.items.list({ limit: 50 })\` |
+| POST | \`/api/items\` | session + \`items:create\` (\`withPermission\`); data via dwk_ server-side | EXAMPLE \u2014 delete or rename. Create an \`items\` row via \`db.items.create()\` |
+
+Every route and Server Action checks a permission; the middleware only checks
+that a session cookie exists. List each Server Action here too, with its
+permission (custom scaffold: \`createItem\` in \`app/actions.ts\`, \`items:create\`).
 
 ## Business rules
 
@@ -4075,6 +4401,17 @@ var init_scaffold = __esm({
     MODULE_SLUG_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
   }
 });
+function isFreshCloneEntry(name) {
+  return name === ".git" || /^(readme|license|licence)(\..+)?$/i.test(name);
+}
+function entryExists(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function resolveTargetDir(slug, dirFlag) {
   if (dirFlag !== void 0) return { dir: resolve(dirFlag) };
   const cwd = process.cwd();
@@ -4165,16 +4502,32 @@ async function moduleInitCommand(slugArg, options) {
     );
     return 1;
   }
+  let freshClone = false;
+  let keptReadme = false;
   if (!options.provisionOnly && existsSync(dir)) {
     const entries = readdirSync(dir);
     if (entries.length > 0 && !options.force && !manifestExists) {
-      fail(
-        `Directory ${code(dir)} is not empty. Pass ${code("--force")} to scaffold anyway (existing files will be overwritten).`
+      const linked = entries.filter(
+        (name2) => isFreshCloneEntry(name2) && lstatSync(join(dir, name2)).isSymbolicLink()
       );
-      return 1;
+      if (linked.length > 0) {
+        fail(
+          `Directory ${code(dir)} holds ${linked.map((name2) => code(name2)).join(", ")} as a symbolic link. Replace it with a regular file, or pass ${code("--force")} to scaffold anyway (existing files will be overwritten).`
+        );
+        return 1;
+      }
+      if (entries.every(isFreshCloneEntry)) {
+        freshClone = true;
+        keptReadme = entries.some((name2) => /^readme/i.test(name2));
+      } else {
+        fail(
+          `Directory ${code(dir)} is not empty. Pass ${code("--force")} to scaffold anyway (existing files will be overwritten).`
+        );
+        return 1;
+      }
     }
   }
-  const writeMode = options.provisionOnly ? "none" : manifestExists && !options.force ? "missing-only" : "all";
+  const writeMode = options.provisionOnly ? "none" : (manifestExists || freshClone) && !options.force ? "missing-only" : "all";
   if (options.simple && options.custom) {
     fail(
       `Cannot pass both ${code("--simple")} and ${code("--custom")} \u2014 they're mutually exclusive. ${code("--simple")} selects the legacy minimal scaffold; the default (no flag) is the full Next.js scaffold (formerly ${code("--custom")}).`
@@ -4211,8 +4564,8 @@ async function moduleInitCommand(slugArg, options) {
     ["spec.md", specMd(scaffoldOpts)],
     ["agent-log.md", agentLogMd(scaffoldOpts)],
     // Example data-plane route (both flavors) — exercises the generated
-    // SDK against the seeded `items` table. Ships for simple + custom
-    // since both produce `@dashai/generated`.
+    // SDK against the seeded `items` table, guarded by withPermission.
+    // Ships for simple + custom since both produce `@dashai/generated`.
     ["app/api/items/route.ts", appApiItemsRouteTs()],
     // C12/D5 (Wave 2) — commented-out seed-script template. Pairs with
     // `dashwise run -- node seed.mjs`; carries the publish-packs-
@@ -4228,6 +4581,9 @@ async function moduleInitCommand(slugArg, options) {
       ["app/globals.css", globalsCss()],
       ["lib/utils.ts", libUtilsTs()],
       ["lib/request-origin.ts", libRequestOriginTs()],
+      // Per-request cached getServerSession(): the layout (initialSession)
+      // and the pages share one session fetch instead of two.
+      ["lib/session.ts", libSessionTs()],
       ["components/theme-provider.tsx", componentsThemeProviderTsx()],
       // Embedded-first defaults: follow the Dashwise app's theme, and ship the
       // page frame + the empty/loading/error states that a module needs to
@@ -4244,6 +4600,14 @@ async function moduleInitCommand(slugArg, options) {
       // reset() retry, semantic tokens (which resolve now that
       // globals.css maps them in @theme).
       ["app/error.tsx", appErrorTsx()],
+      // Root loading state: renders ListSkeleton instantly on navigation
+      // while the next page's server render is in flight.
+      ["app/loading.tsx", appLoadingTsx()],
+      // The canonical write path: a permission-guarded Server Action with
+      // one narrow revalidatePath, and its form with a useFormStatus
+      // pending state.
+      ["app/actions.ts", appActionsTs()],
+      ["components/new-item-form.tsx", componentsNewItemFormTsx()],
       ["app/dashboard/page.tsx", appDashboardPageTsx()],
       ["app/sign-in-error/page.tsx", appSignInErrorPageTsx()],
       ["app/api/auth/sign-in/route.ts", appApiAuthSignInTs()],
@@ -4278,7 +4642,7 @@ async function moduleInitCommand(slugArg, options) {
   if (writeMode !== "none") {
     for (const [relPath, content] of files) {
       const absPath = join(dir, relPath);
-      if (writeMode === "missing-only" && existsSync(absPath)) {
+      if (writeMode === "missing-only" && (entryExists(absPath) || keptReadme && relPath === "README.md")) {
         skipped++;
         continue;
       }
@@ -4294,6 +4658,10 @@ async function moduleInitCommand(slugArg, options) {
     info(
       `Existing scaffold in ${code(dir)} left untouched (provision-only) \u2014 re-provisioning the backend dev install.`
     );
+  } else if (freshClone) {
+    success(
+      `Scaffolded ${code(slug)} (${kind === "custom" ? "custom Next.js" : "simple module"}) into the clone in ${code(dir)}; ${code(".git")}, README and LICENSE left untouched.`
+    );
   } else if (writeMode === "missing-only") {
     success(
       `Existing module project in ${code(dir)} \u2014 wrote ${written} missing file(s), preserved ${skipped} existing file(s). ${dim("(Pass --force to overwrite everything.)")}`
@@ -5694,7 +6062,7 @@ async function requestDeviceCode(args) {
   );
 }
 async function pollForApproval(args) {
-  const sleep4 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep6 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = args.now ?? (() => Date.now());
   const pollIntervalMs = Math.max(1e3, args.intervalSeconds * 1e3);
   const deadline = now() + args.expiresInSeconds * 1e3;
@@ -5713,7 +6081,7 @@ async function pollForApproval(args) {
     switch (res.status) {
       case "pending":
       case "slow_down":
-        await sleep4(pollIntervalMs);
+        await sleep6(pollIntervalMs);
         continue;
       case "denied":
         return { status: "denied" };
@@ -13528,6 +13896,738 @@ async function sleep3(ms, aborted) {
   }
 }
 
+// src/commands/module/rebuild.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+
+// src/lib/permission-hint.ts
+init_api_client();
+init_output();
+var EXIT_NEEDS_GRANT = 3;
+var EXIT_TIMED_OUT = 4;
+var REBUILD_BUMP_OPERATOR_ONLY = "REBUILD_BUMP_OPERATOR_ONLY";
+var FEATURE_SUBJECTS = {
+  module_runtime_streaming: "Streaming",
+  module_rebuild: "Rebuild",
+  module_building: "Building modules",
+  module_runtime_sizing: "Memory size"
+};
+var OPTION_SUBJECTS = {
+  streaming: "Streaming",
+  memory_mb: "Memory size",
+  reapply: "Re-applying the runtime",
+  timeout: "The timeout",
+  reserved_concurrency: "Reserved concurrency",
+  log_retention: "Log retention"
+};
+var MODULE_RIGHT_CODES = /* @__PURE__ */ new Set([
+  "MODULE_CAPABILITY_DENIED",
+  "PUBLISH_REQUIRES_ADMIN",
+  "NOT_COPY_OWNER"
+]);
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function num(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
+}
+function featureFromPermission(permission) {
+  const m = permission ? /^workspace\.feature\.([a-z0-9_]+)\.use$/.exec(permission) : null;
+  return m?.[1];
+}
+function featureSubject(ctx) {
+  const feature = str(ctx.feature) ?? featureFromPermission(str(ctx.permission));
+  if (feature && FEATURE_SUBJECTS[feature]) return FEATURE_SUBJECTS[feature];
+  return str(ctx.feature_label) ?? (feature ? `"${feature}"` : void 0);
+}
+function needsAdmin(what, module, ask) {
+  const scope = module ? ` for ${module}` : "";
+  return `${what}${scope} needs a Dashwise admin. Ask your Dashwise admin to ${ask}.`;
+}
+function refusalHint(code2, context, subject = {}) {
+  const ctx = context ?? {};
+  const module = subject.module ?? str(ctx.module_slug);
+  const installationId = subject.installationId ?? num(ctx.installation_id);
+  const installLabel = installationId !== void 0 ? ` (install #${installationId})` : "";
+  const named = module ?? "this module";
+  switch (code2) {
+    case "FEATURE_DISABLED":
+    case "PERMISSION_DENIED": {
+      const what = featureSubject(ctx);
+      if (!what) {
+        return {
+          message: `You don't have permission to do this${module ? ` for ${module}` : ""}. Ask your Dashwise admin for access.`,
+          needsGrant: true
+        };
+      }
+      return { message: needsAdmin(what, module, "enable it"), needsGrant: true };
+    }
+    case "RUNTIME_OPTION_OPERATOR_ONLY": {
+      const option = str(ctx.option);
+      const what = (option && OPTION_SUBJECTS[option]) ?? (option ? `"${option}"` : "This runtime option");
+      return { message: needsAdmin(what, module, "change it"), needsGrant: true };
+    }
+    case REBUILD_BUMP_OPERATOR_ONLY: {
+      const bump = str(ctx.bump) ?? "minor";
+      return {
+        message: needsAdmin(`A rebuild with a ${bump} version bump`, module, "run it"),
+        needsGrant: true
+      };
+    }
+    case "IMAGE_TAG_EXISTS":
+      return {
+        message: `This rebuild of ${named} needs a higher version bump than patch. A rebuild with a minor version bump needs a Dashwise admin. Ask your Dashwise admin to run it.`,
+        needsGrant: true
+      };
+    case "RUNTIME_IMAGE_NOT_ELIGIBLE": {
+      const version = str(ctx.version);
+      const target = installationId !== void 0 ? ` --rollout installs:${installationId}` : "";
+      return {
+        message: `${named}${version ? ` v${version}` : ""} was built before streaming support. Rebuild it and upgrade this install first: dashwise module rebuild${module ? ` ${module}` : ""}${target}`,
+        needsGrant: false
+      };
+    }
+    case "RUNTIME_SWAP_PENDING": {
+      const version = str(ctx.version);
+      return {
+        message: `${named}${installLabel} is still finishing its update${version ? ` to v${version}` : ""}, so streaming cannot be turned on yet. Try again in a few minutes.`,
+        needsGrant: false
+      };
+    }
+    case "RUNTIME_OPTION_UNAVAILABLE": {
+      const option = str(ctx.option);
+      const what = (option && OPTION_SUBJECTS[option]) ?? "This runtime option";
+      return { message: `${what} is switched off platform-wide right now.`, needsGrant: false };
+    }
+    case "RUNTIME_CHANGE_IN_PROGRESS": {
+      const op = num(ctx.operation_id);
+      return {
+        message: `A runtime change is already being applied to ${named}${op !== void 0 ? ` (operation #${op})` : ""}. Wait for it, then check: dashwise module runtime${module ? ` ${module}` : ""}`,
+        needsGrant: false
+      };
+    }
+    case "BUILD_IN_PROGRESS": {
+      const buildId = num(ctx.build_id);
+      const status = str(ctx.status);
+      const which = buildId !== void 0 ? ` (#${buildId}${status ? `, ${status}` : ""})` : "";
+      return {
+        message: `A build of ${named} is already running${which}. Wait for it to finish, then run the rebuild again.`,
+        needsGrant: false
+      };
+    }
+    case "REBUILD_SOURCE_NOT_FOUND":
+      return {
+        message: `${named} has no build from source to rebuild. Publish it first: dashwise module publish`,
+        needsGrant: false
+      };
+    case "INSTALLATION_NOT_FOUND":
+      return {
+        message: `${installationId !== void 0 ? `Installation #${installationId}` : "The installation"} was not found, or you cannot see it.`,
+        needsGrant: false
+      };
+    case "PUBLISH_RATE_LIMITED":
+    case "PUBLISH_USER_RATE_LIMITED":
+      return {
+        message: `Too many builds of ${named} in the last hour. Try again later.`,
+        needsGrant: false
+      };
+    default:
+      if (MODULE_RIGHT_CODES.has(code2)) {
+        return {
+          message: `You can't manage ${named}${installLabel}. Ask your Dashwise admin for access.`,
+          needsGrant: true
+        };
+      }
+      return null;
+  }
+}
+var ANSI = /\x1b\[[0-9;]*m/g;
+function reportCliError(message, opts) {
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        error: { code: opts.code ?? "CLI_ERROR", message: message.replace(ANSI, ""), status: null, context: null },
+        hint: null,
+        needs_grant: false
+      })
+    );
+  } else {
+    fail(message);
+  }
+  return 1;
+}
+function reportFailedOutcome(failure, hint, opts) {
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        error: { code: failure.code, message: failure.message ?? null, status: null, context: null },
+        hint: hint?.message ?? null,
+        needs_grant: hint?.needsGrant ?? false,
+        ...opts.extra
+      })
+    );
+  } else {
+    fail(hint?.message ?? opts.fallback);
+  }
+  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+}
+function isTransientPollError(err) {
+  if (!(err instanceof ApiError)) return true;
+  return err.status === 0 || err.status === 429 || err.status >= 500;
+}
+function reportRefusal(err, subject, opts) {
+  if (!(err instanceof ApiError)) {
+    const message = err?.message ?? String(err);
+    if (opts.json) {
+      out(
+        JSON.stringify({
+          error: { code: "CLI_ERROR", message: message.replace(ANSI, ""), status: null, context: null },
+          hint: null,
+          needs_grant: false
+        })
+      );
+    } else {
+      fail(`${opts.action} failed: ${message}`);
+    }
+    return 1;
+  }
+  const hint = err.status === 401 ? { message: "Your login has expired. Run: dashwise login", needsGrant: false } : refusalHint(err.code, err.context, subject);
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        error: { code: err.code, message: err.message, status: err.status, context: err.context ?? null },
+        hint: hint?.message ?? null,
+        needs_grant: hint?.needsGrant ?? false
+      })
+    );
+  } else if (hint) {
+    fail(hint.message);
+  } else {
+    fail(`${opts.action} failed (${err.code}): ${err.message}`);
+  }
+  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+}
+
+// src/commands/module/rebuild.ts
+var PLATFORM_DEFAULTS = ["manifest", "on", "off"];
+var BUMPS = ["patch", "minor", "major"];
+function parseRollout(raw) {
+  if (raw === void 0) return null;
+  const v = raw.trim();
+  if (v === "" || v === "none") return null;
+  if (v === "workspace") return { scope: "workspace" };
+  const ws = /^workspace:(\d+)$/.exec(v);
+  if (ws) return { scope: "workspace", workspace_id: Number(ws[1]) };
+  const inst = /^installs?:(.+)$/.exec(v);
+  if (inst) {
+    const ids = inst[1].split(",").map((s) => s.trim());
+    if (ids.length === 0 || ids.some((s) => !/^\d+$/.test(s) || Number(s) <= 0)) {
+      return `--rollout installs: expects comma-separated installation ids (got "${raw}").`;
+    }
+    const unique = [...new Set(ids.map(Number))];
+    if (unique.length > 50) return "--rollout installs: takes at most 50 installation ids.";
+    return { scope: "installations", installation_ids: unique };
+  }
+  return `--rollout expects none, installs:<id,id> or workspace[:<id>] (got "${raw}").`;
+}
+async function moduleRebuildCommand(slugArg, options) {
+  let slug = slugArg;
+  if (!slug) {
+    try {
+      const fromManifest = readManifest(options.dir)?.module?.slug;
+      if (typeof fromManifest === "string" && fromManifest.length > 0) slug = fromManifest;
+    } catch {
+    }
+  }
+  const json = options.json;
+  const usage2 = (message) => reportCliError(message, { json, code: "USAGE" });
+  if (!slug) {
+    return usage2(
+      `No module slug. Pass one (${code("dashwise module rebuild <slug>")}) or run from a directory with a valid module.json.`
+    );
+  }
+  const bump = (options.bump ?? "patch").trim().toLowerCase();
+  if (!BUMPS.includes(bump)) {
+    return usage2(`--bump expects patch, minor or major (got "${options.bump}").`);
+  }
+  if (bump !== "patch") {
+    const hint = refusalHint(REBUILD_BUMP_OPERATOR_ONLY, { bump }, { module: slug });
+    if (options.json) {
+      out(
+        JSON.stringify({
+          error: { code: REBUILD_BUMP_OPERATOR_ONLY, message: hint.message, status: null, context: { bump } },
+          hint: hint.message,
+          needs_grant: true
+        })
+      );
+    } else {
+      fail(hint.message);
+      publishBumpTip(bump);
+    }
+    return EXIT_NEEDS_GRANT;
+  }
+  let platformDefaults;
+  if (options.platformDefaults !== void 0) {
+    const v = options.platformDefaults.trim().toLowerCase();
+    if (!PLATFORM_DEFAULTS.includes(v)) {
+      return usage2(`--platform-defaults expects manifest, on or off (got "${options.platformDefaults}").`);
+    }
+    platformDefaults = v;
+  }
+  if (options.fromBuild !== void 0 && (!Number.isInteger(options.fromBuild) || options.fromBuild <= 0)) {
+    return usage2(`--from-build expects a positive build id (got "${options.fromBuild}").`);
+  }
+  const rollout = parseRollout(options.rollout);
+  if (typeof rollout === "string") return usage2(rollout);
+  if (!isLoggedIn()) {
+    return reportCliError(`Not logged in. Run ${code("dashwise login")} first.`, { json });
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    return reportCliError(`CLI config missing. Run ${code("dashwise login")}.`, { json });
+  }
+  const auth = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
+  let moduleId;
+  try {
+    const mod = await getModuleBySlug(slug, auth);
+    moduleId = mod.id;
+    slug = mod.slug;
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      return reportCliError(`Module ${code(slug)} not found on the backend.`, { json });
+    }
+    return reportRefusal(err, { module: slug }, { json: options.json, action: "Resolving the module" });
+  }
+  const buildOptions = {
+    ...platformDefaults !== void 0 ? { platform_defaults: platformDefaults } : {},
+    ...options.clean ? { clean: true } : {}
+  };
+  const body = {
+    ...options.fromBuild !== void 0 ? { from_build_id: options.fromBuild } : {},
+    ...Object.keys(buildOptions).length > 0 ? { options: buildOptions } : {},
+    ...rollout ? { rollout } : {},
+    ...options.reason !== void 0 ? { reason: options.reason } : {}
+  };
+  let build;
+  try {
+    build = await rebuildModule(moduleId, body, auth);
+  } catch (err) {
+    return reportRefusal(err, { module: slug }, { json: options.json, action: "Rebuild" });
+  }
+  if (options.noWait) {
+    if (options.json) out(JSON.stringify(build));
+    else {
+      success(`Rebuild of ${code(slug)} queued as build ${code(`#${build.id}`)}.`);
+      info(`Not waiting (${code("--no-wait")}). A rebuild takes about 1\u20133 minutes.`);
+    }
+    return 0;
+  }
+  if (!options.json) info(`Rebuild of ${code(slug)} queued as build ${code(`#${build.id}`)}. Building\u2026`);
+  let waited;
+  try {
+    waited = await waitForBuild(moduleId, build, Boolean(rollout), options, auth);
+  } catch (err) {
+    return reportRefusal(err, { module: slug }, { json: options.json, action: `Checking build #${build.id}` });
+  }
+  const final = waited.build;
+  if (waited.timedOut) {
+    if (options.json) out(JSON.stringify({ ...final, timed_out: true }));
+    else warn(`Still running after ${options.timeoutSec ?? 900}s. Build ${code(`#${build.id}`)} may still finish.`);
+    return EXIT_TIMED_OUT;
+  }
+  if (final.status === "failed") {
+    const failureCode = final.error_code ?? "BUILD_FAILED";
+    const hint = final.error_code ? refusalHint(final.error_code, void 0, { module: slug }) : null;
+    const exit = reportFailedOutcome({ code: failureCode, message: final.error_message }, hint, {
+      json: options.json,
+      fallback: `Build ${code(`#${final.id}`)} failed (${failureCode}): ${final.error_message ?? "(no detail)"}`,
+      extra: { build: final }
+    });
+    if (!options.json) {
+      if (final.log_url) info(`Logs: ${code(final.log_url)}`);
+      if (final.error_code === "IMAGE_TAG_EXISTS") publishBumpTip("minor");
+    }
+    return exit;
+  }
+  const r = final.rollout;
+  if (rollout && r?.status === "failed") {
+    const failureCode = r.code ?? "ROLLOUT_FAILED";
+    const hint = r.code ? refusalHint(r.code, void 0, { module: slug }) : null;
+    if (!options.json) success(`Rebuilt ${code(slug)} as ${code(`v${final.version ?? "?"}`)} ${dim(`(build #${final.id})`)}.`);
+    return reportFailedOutcome({ code: failureCode, message: null }, hint, {
+      json: options.json,
+      fallback: `Upgrading the installs failed (${failureCode}).`,
+      extra: { build: final }
+    });
+  }
+  if (options.json) out(JSON.stringify(final));
+  if (!options.json) success(`Rebuilt ${code(slug)} as ${code(`v${final.version ?? "?"}`)} ${dim(`(build #${final.id})`)}.`);
+  if (!rollout) {
+    if (!options.json) info(`Installs keep their version until upgraded: ${code(`dashwise module install ${slug}`)}`);
+    return 0;
+  }
+  if (!r || r.status !== "completed") {
+    if (!options.json) warn(`The upgrade of installs is still ${r?.status ?? "pending"}. Check with ${code(`dashwise module status ${slug}`)}.`);
+    return 0;
+  }
+  if (!options.json) {
+    const counts = Object.entries(r.counts ?? {}).map(([k, n]) => `${n} ${k}`).join(", ");
+    success(`Installs upgraded to v${r.to_version ?? final.version ?? "?"}: ${counts || "none"}.`);
+    const notUpgraded = (r.counts?.failed ?? 0) + (r.counts?.skipped ?? 0);
+    if (notUpgraded > 0) {
+      warn(
+        `${notUpgraded} install${notUpgraded === 1 ? " was" : "s were"} not upgraded (failed or skipped). Check with ${code(`dashwise module status ${slug}`)}.`
+      );
+    }
+    if ((r.counts?.blocked ?? 0) > 0) {
+      warn(
+        `Blocked installs were left on their version: the upgrade would break other modules or remove data. Upgrade them one by one with ${code(`dashwise module install ${slug}`)} to see why.`
+      );
+    }
+  }
+  return 0;
+}
+async function waitForBuild(moduleId, queued, withRollout, options, auth) {
+  const buildId = queued.id;
+  let lastSeen = queued;
+  const deadline = Date.now() + (options.timeoutSec ?? 900) * 1e3;
+  const interval = options.pollIntervalMs ?? 4e3;
+  let last = "";
+  while (Date.now() < deadline) {
+    await sleep4(interval);
+    let b;
+    try {
+      b = await getModuleBuild(moduleId, buildId, auth);
+    } catch (err) {
+      if (isTransientPollError(err)) continue;
+      throw err;
+    }
+    lastSeen = b;
+    const phase = b.status === "succeeded" && withRollout ? `upgrading installs (${b.rollout?.status ?? "pending"})` : b.status;
+    if (!options.json && phase !== last) {
+      info(`Build ${code(`#${buildId}`)}: ${phase}`);
+      last = phase;
+    }
+    if (b.status === "failed") return { build: b, timedOut: false };
+    if (b.status === "succeeded") {
+      if (!withRollout) return { build: b, timedOut: false };
+      if (b.rollout && (b.rollout.status === "completed" || b.rollout.status === "failed")) {
+        return { build: b, timedOut: false };
+      }
+    }
+  }
+  return { build: lastSeen, timedOut: true };
+}
+function publishBumpTip(bump) {
+  info(
+    `A rebuild you run yourself always bumps patch. To choose the bump, publish from source: ${code(`dashwise module publish --bump ${bump}`)}`
+  );
+}
+function sleep4(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// src/commands/module/runtime.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+var TERMINAL_OPERATION = /* @__PURE__ */ new Set(["succeeded", "failed", "superseded"]);
+async function moduleRuntimeShowCommand(slugArg, options) {
+  const auth = authOrFail(options.json);
+  if (!auth) return 1;
+  const target = await resolveInstall(slugArg, options, auth, "dashwise module runtime <slug>");
+  if (typeof target === "number") return target;
+  let view;
+  try {
+    view = await getInstallationRuntime(target.installationId, auth);
+  } catch (err) {
+    return reportRefusal(
+      err,
+      { module: target.slug, installationId: target.installationId },
+      { json: options.json, action: "Reading the runtime settings" }
+    );
+  }
+  if (options.json) {
+    out(JSON.stringify(view));
+    return 0;
+  }
+  renderRuntime(view);
+  return 0;
+}
+function renderRuntime(view) {
+  const slug = view.module.slug;
+  const desired = view.desired.invoke_mode;
+  const effective = view.effective.invoke_mode;
+  const streamingLine = `${modeLabel(effective)}` + (desired !== null && desired !== effective ? `  ${dim(`(requested: ${modeLabel(desired)})`)}` : "") + (desired === null ? `  ${dim("(platform default)")}` : "");
+  out("");
+  kv("Module:", `${slug} ${dim(`(id ${view.module.id})`)}`);
+  kv("Install:", `#${view.installation_id} ${dim(`(workspace ${view.workspace_id})`)}`);
+  kv("Version:", view.version ?? dim("(none)"));
+  kv("Streaming:", streamingLine);
+  kv(
+    "Memory:",
+    `${view.effective.memory_mb} MB ${dim(view.effective.memory_source === "override" ? "(override)" : "(from module.json machine_size)")}`
+  );
+  kv("Eligible:", view.eligibility.streaming ? "yes" : `no ${dim(`(${eligibilityText(view.eligibility.reason)})`)}`);
+  kv("Granted:", view.grant.module_runtime_streaming ? "yes" : "no");
+  kv("Last change:", view.last_operation ? operationText(view.last_operation) : dim("(none)"));
+  out("");
+  if (!view.grant.module_runtime_streaming) {
+    const hint = refusalHint("FEATURE_DISABLED", { feature: "module_runtime_streaming" }, { module: slug });
+    if (hint) info(hint.message);
+  } else if (!view.eligibility.streaming && view.eligibility.reason === "image_not_eligible") {
+    const hint = refusalHint(
+      "RUNTIME_IMAGE_NOT_ELIGIBLE",
+      { version: view.version ?? void 0 },
+      { module: slug, installationId: view.installation_id }
+    );
+    if (hint) info(hint.message);
+  }
+}
+function modeLabel(mode) {
+  if (mode === "RESPONSE_STREAM") return "on";
+  if (mode === "BUFFERED") return "off";
+  return "default";
+}
+function eligibilityText(reason) {
+  switch (reason) {
+    case "platform_disabled":
+      return "streaming is switched off platform-wide";
+    case "image_not_eligible":
+      return "this version was built before streaming support; rebuild it";
+    case "swap_pending":
+      return "an update is still finishing";
+    default:
+      return reason ?? "unknown";
+  }
+}
+function operationText(op) {
+  const when = op.finished_at ?? op.started_at ?? op.created_at;
+  const err = op.error_code ? ` ${op.error_code}` : "";
+  return `${op.kind} ${op.status}${err} ${dim(`(#${op.id}, ${when})`)}`;
+}
+async function moduleRuntimeSetCommand(slugArg, options) {
+  let streaming;
+  if (options.streaming !== void 0) {
+    const v = options.streaming.trim().toLowerCase();
+    if (v === "on") streaming = "RESPONSE_STREAM";
+    else if (v === "off") streaming = "BUFFERED";
+    else {
+      return usage(`--streaming expects "on" or "off" (got "${options.streaming}").`, options.json);
+    }
+  }
+  if (options.memory !== void 0 && (!Number.isInteger(options.memory) || options.memory <= 0)) {
+    return usage(`--memory expects a whole number of MB (got "${options.memory}").`, options.json);
+  }
+  if (streaming === void 0 && options.memory === void 0) {
+    return usage(`Nothing to change. Pass ${code("--streaming on|off")} (or ${code("--memory <mb>")}).`, options.json);
+  }
+  const auth = authOrFail(options.json);
+  if (!auth) return 1;
+  const target = await resolveInstall(slugArg, options, auth, "dashwise module runtime set <slug>");
+  if (typeof target === "number") return target;
+  let before;
+  try {
+    before = await getInstallationRuntime(target.installationId, auth);
+  } catch (err) {
+    return reportRefusal(
+      err,
+      { module: target.slug, installationId: target.installationId },
+      { json: options.json, action: "Reading the runtime settings" }
+    );
+  }
+  const slug = before.module.slug;
+  const subject = { module: slug, installationId: before.installation_id };
+  if (streaming !== void 0 && !options.yes && !options.json && process.stdin.isTTY) {
+    const ok = await confirm({
+      message: `Turn streaming ${streaming === "RESPONSE_STREAM" ? "on" : "off"} for ${slug} (install #${before.installation_id})? The switch takes about a minute, and pages may come back empty while it runs.`
+    });
+    if (isCancel(ok) || ok !== true) {
+      info("Cancelled. Nothing was changed.");
+      return 1;
+    }
+  }
+  const invokeMode = streaming ?? before.desired.invoke_mode ?? before.effective.invoke_mode;
+  let accepted;
+  try {
+    accepted = await setInstallationRuntime(
+      before.installation_id,
+      {
+        invoke_mode: invokeMode,
+        ...options.memory !== void 0 ? { memory_mb: options.memory } : {},
+        ...options.reason !== void 0 ? { reason: options.reason } : {}
+      },
+      auth
+    );
+  } catch (err) {
+    return reportRefusal(err, subject, { json: options.json, action: "Changing the runtime settings" });
+  }
+  const what = describeChange(streaming, options.memory);
+  if (accepted.noop) {
+    if (options.json) out(JSON.stringify({ accepted, operation: before.last_operation }));
+    else success(`${what} for ${code(slug)} is already in place. Nothing to do.`);
+    return 0;
+  }
+  if (options.noWait || accepted.operation_id === null) {
+    if (options.json) out(JSON.stringify({ accepted, operation: null }));
+    else {
+      success(`${what} for ${code(slug)} accepted (operation #${accepted.operation_id ?? "?"}).`);
+      info(`It takes about a minute. Check with ${code(`dashwise module runtime ${slug}`)}.`);
+    }
+    return 0;
+  }
+  if (!options.json) info(`Applying: ${what.toLowerCase()} for ${code(slug)} (about a minute)\u2026`);
+  let op;
+  try {
+    op = await waitForOperation(before.installation_id, accepted.operation_id, options, auth);
+  } catch (err) {
+    return reportRefusal(err, subject, { json: options.json, action: "Checking the runtime change" });
+  }
+  if (!op) {
+    if (options.json) out(JSON.stringify({ accepted, operation: null, timed_out: true }));
+    else {
+      warn(
+        `Still applying after ${options.timeoutSec ?? 240}s. Check with ${code(`dashwise module runtime ${slug}`)}.`
+      );
+    }
+    return EXIT_TIMED_OUT;
+  }
+  if (op.status === "failed") {
+    const failureCode = op.error_code ?? "UNKNOWN";
+    const hint = op.error_code ? refusalHint(op.error_code, void 0, subject) : null;
+    return reportFailedOutcome({ code: failureCode, message: op.error_message }, hint, {
+      json: options.json,
+      fallback: `The change failed (${failureCode}): ${op.error_message ?? "(no detail)"}`,
+      extra: { accepted, operation: op }
+    });
+  }
+  if (options.json) out(JSON.stringify({ accepted, operation: op }));
+  if (op.status === "succeeded") {
+    if (!options.json) {
+      const outcome = typeof op.result?.outcome === "string" ? op.result.outcome : null;
+      if (outcome === "swap_pending") {
+        success(`${what} for ${code(slug)} is saved. Streaming starts once the module's pending update finishes.`);
+      } else if (outcome === "no_runtime") {
+        success(`${what} for ${code(slug)} is saved. It applies when the module is next deployed.`);
+      } else {
+        success(`${what} for ${code(slug)} is done.`);
+      }
+    }
+    return 0;
+  }
+  if (!options.json) warn(`A newer change replaced this one. Check with ${code(`dashwise module runtime ${slug}`)}.`);
+  return 0;
+}
+function describeChange(streaming, memory) {
+  const parts = [];
+  if (streaming !== void 0) parts.push(`Streaming ${streaming === "RESPONSE_STREAM" ? "on" : "off"}`);
+  if (memory !== void 0) parts.push(`${parts.length ? "memory" : "Memory"} ${memory} MB`);
+  return parts.join(", ");
+}
+async function waitForOperation(installationId, operationId, options, auth) {
+  const deadline = Date.now() + (options.timeoutSec ?? 240) * 1e3;
+  const interval = options.pollIntervalMs ?? 3e3;
+  while (Date.now() < deadline) {
+    await sleep5(interval);
+    let view;
+    try {
+      view = await getInstallationRuntime(installationId, auth);
+    } catch (err) {
+      if (isTransientPollError(err)) continue;
+      throw err;
+    }
+    const op = view.last_operation;
+    if (!op) continue;
+    if (op.id > operationId) {
+      return { id: operationId, status: "superseded", superseded_by_operation_id: op.id };
+    }
+    if (op.id === operationId && TERMINAL_OPERATION.has(op.status)) return op;
+  }
+  return null;
+}
+function usage(message, json) {
+  return reportCliError(message, { json, code: "USAGE" });
+}
+function authOrFail(json) {
+  if (!isLoggedIn()) {
+    reportCliError(`Not logged in. Run ${code("dashwise login")} first.`, { json });
+    return null;
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    reportCliError(`CLI config missing. Run ${code("dashwise login")}.`, { json });
+    return null;
+  }
+  return { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
+}
+async function resolveInstall(slugArg, options, auth, usageLine) {
+  const json = options.json;
+  if (options.install !== void 0) {
+    if (!Number.isInteger(options.install) || options.install <= 0) {
+      return usage(`--install expects a positive integer installation id (got "${options.install}").`, options.json);
+    }
+    return { installationId: options.install, ...slugArg ? { slug: slugArg } : {} };
+  }
+  let slug = slugArg;
+  if (!slug) {
+    try {
+      const fromManifest = readManifest(options.dir)?.module?.slug;
+      if (typeof fromManifest === "string" && fromManifest.length > 0) slug = fromManifest;
+    } catch {
+    }
+  }
+  if (!slug) {
+    return reportCliError(
+      `No module slug. Pass one (${code(usageLine)}), run from a directory with a valid module.json, or target an install with ${code("--install <id>")}.`,
+      { json: options.json, code: "USAGE" }
+    );
+  }
+  let modId;
+  try {
+    modId = (await getModuleBySlug(slug, auth)).id;
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      return reportCliError(`Module ${code(slug)} not found on the backend.`, { json });
+    }
+    return reportCliError(`Could not resolve module ${code(slug)}: ${err.message}`, { json });
+  }
+  const cfg = readConfig();
+  let workspace2;
+  try {
+    workspace2 = await resolveWorkspaceWithFallback({
+      userFlag: options.workspace,
+      cachedWorkspaceId: readModuleEntry(slug)?.workspaceId,
+      configDefault: cfg?.workspaceSlug,
+      apiUrl: resolveApiUrl(),
+      apiToken: cfg?.token ?? ""
+    });
+  } catch (err) {
+    return reportCliError(`Workspace selection failed: ${err.message}`, { json });
+  }
+  let row;
+  try {
+    const matches = (await listWorkspaceInstallations(workspace2.id, auth)).filter(
+      (r) => r.module_id === modId
+    );
+    row = matches.find((r) => !isDevInstallKind(r.kind) && isRealRuntimeUrl(r.runtime_url)) ?? matches.find((r) => !isDevInstallKind(r.kind));
+  } catch (err) {
+    return reportCliError(`Could not read workspace installations: ${err.message}`, { json });
+  }
+  if (!row) {
+    return reportCliError(
+      `${code(slug)} has no deployed install in workspace ${code(workspace2.slug)}. Deploy it with ${code(`dashwise module install ${slug} --workspace ${workspace2.slug}`)}, or pass ${code("--install <id>")}.`,
+      { json }
+    );
+  }
+  return { installationId: row.id, slug };
+}
+function sleep5(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
 // src/program.ts
 init_output();
 var program = new Command();
@@ -14295,6 +15395,67 @@ moduleCmd.command("logs [slug]").description(
     });
   }
 );
+moduleCmd.command("runtime [slug-or-set] [slug]").usage("[slug] [--install <id>] [--json]  |  set [slug] --streaming on|off [options]").description(
+  'Show a deployed install\'s runtime settings: response streaming (on/off, requested vs in effect), memory, whether this version can stream, whether streaming is granted for the workspace, and the last change. `module runtime set --streaming on|off` changes streaming (needs the workspace grant "Module response streaming"; takes about a minute and waits unless --no-wait). `--memory <mb>` is set by Dashwise operators today and is refused with a hint. Exit 3 = a grant is missing (ask your Dashwise admin); exit 4 = `set` stopped waiting before the change finished.'
+).option("--install <id>", "Target an installation id directly (skips slug + workspace resolution).", parseIntOption).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("--streaming <on|off>", "`set` only: turn response streaming on or off.").option("--memory <mb>", "`set` only: memory in MB (operator-only today).", parseIntOption).option("--reason <text>", "`set` only: why; stored in the audit log.").option("-y, --yes", "`set` only: skip the confirmation prompt.").option("--no-wait", "`set` only: return once the change is accepted instead of waiting for it.").option("--timeout <seconds>", "`set` only: max seconds to wait for the change (default 240).", parseIntOption).option(
+  "--json",
+  'One JSON object on stdout: the runtime view; for `set`, { accepted, operation } (+ "timed_out": true on exit 4); on a refusal or a failed change, { error, hint, needs_grant } (plus accepted and operation when the change ran and failed; error.code USAGE for a bad invocation).'
+).action(
+  async (first, second, cmdOpts) => {
+    const target = {
+      ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
+      ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    };
+    if (first === "set") {
+      process.exitCode = await moduleRuntimeSetCommand(second, {
+        ...target,
+        ...cmdOpts.streaming !== void 0 ? { streaming: cmdOpts.streaming } : {},
+        ...cmdOpts.memory !== void 0 ? { memory: cmdOpts.memory } : {},
+        ...cmdOpts.reason !== void 0 ? { reason: cmdOpts.reason } : {},
+        ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
+        ...cmdOpts.wait === false ? { noWait: true } : {},
+        ...cmdOpts.timeout !== void 0 ? { timeoutSec: cmdOpts.timeout } : {}
+      });
+      return;
+    }
+    const setOnly = [
+      cmdOpts.streaming !== void 0 && "--streaming",
+      cmdOpts.memory !== void 0 && "--memory",
+      cmdOpts.reason !== void 0 && "--reason"
+    ].filter(Boolean);
+    if (setOnly.length > 0 || second !== void 0) {
+      process.exitCode = reportCliError(
+        setOnly.length > 0 ? `${setOnly.join(", ")} only work with \`set\`, for example: dashwise module runtime set ${first ?? "<slug>"} --streaming on` : `\`dashwise module runtime\` takes one slug (got "${first}" and "${second}"). To change settings: dashwise module runtime set <slug> --streaming on|off`,
+        { json: cmdOpts.json, code: "USAGE" }
+      );
+      return;
+    }
+    process.exitCode = await moduleRuntimeShowCommand(first, target);
+  }
+);
+moduleCmd.command("rebuild [slug]").description(
+  "Rebuild the module's published source with today's platform image and defaults, as a new patch version, optionally with build options, then optionally upgrade installs. Needs the workspace grant \"Module rebuild\". Waits for the build (and the upgrades) unless `--no-wait`. Exit 3 = a grant is missing (ask your Dashwise admin); exit 4 = stopped waiting before the build (or the upgrades) finished."
+).option("--platform-defaults <mode>", "manifest (default: what module.json says) | on | off.").option("--clean", "Build without the Docker cache and re-pull the base image (same as a normal rebuild until build caching exists).").option("--bump <direction>", "patch (default). minor and major need a Dashwise admin.").option("--rollout <scope>", "none (default) | installs:<id,id> | workspace[:<id>] \u2014 upgrade those installs after the build. Blocked upgrades are reported, never forced.").option("--from-build <id>", "Rebuild the source of this build (default: the build behind the current version).", parseIntOption).option("--reason <text>", "Why; stored in the audit log.").option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("--no-wait", "Return once the build is queued.").option("--timeout <seconds>", "Max seconds to wait for the build and upgrades (default 900).", parseIntOption).option(
+  "--json",
+  'One JSON object on stdout: the final build (the last one seen + "timed_out": true on exit 4), or { error, hint, needs_grant } on a refusal or a failed build or rollout (plus the build when it ran; error.code USAGE for a bad invocation).'
+).action(
+  async (slug, cmdOpts) => {
+    process.exitCode = await moduleRebuildCommand(slug, {
+      ...cmdOpts.platformDefaults !== void 0 ? { platformDefaults: cmdOpts.platformDefaults } : {},
+      ...cmdOpts.clean !== void 0 ? { clean: cmdOpts.clean } : {},
+      ...cmdOpts.bump !== void 0 ? { bump: cmdOpts.bump } : {},
+      ...cmdOpts.rollout !== void 0 ? { rollout: cmdOpts.rollout } : {},
+      ...cmdOpts.fromBuild !== void 0 ? { fromBuild: cmdOpts.fromBuild } : {},
+      ...cmdOpts.reason !== void 0 ? { reason: cmdOpts.reason } : {},
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.wait === false ? { noWait: true } : {},
+      ...cmdOpts.timeout !== void 0 ? { timeoutSec: cmdOpts.timeout } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    });
+  }
+);
 moduleCmd.command("destroy-dev-install").description(
   "Destroy the local-dev install for the current module. Tears down the install row + dashboard tile; if the module had no other installs and was never published, drops the module too. Local module.json is preserved (only the cached runtime token + install id in auth.json get cleared)."
 ).option("--dir <path>", "Project root (default: current directory).").option(
@@ -14417,7 +15578,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.20.1";
+  return "0.22.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);