@dashai/cli 0.21.0 → 0.22.0

package/dist/bin.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import pc from 'picocolors';
-import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, watch, readdirSync, chmodSync, renameSync, mkdtempSync, statSync } from 'fs';
+import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, watch, readdirSync, chmodSync, renameSync, lstatSync, mkdtempSync, statSync } from 'fs';
 import { hostname, tmpdir, platform, homedir } from 'os';
 import { resolve, join, relative, dirname, basename, win32, sep } from 'path';
 import { spawn, spawnSync } from 'child_process';
-import { intro, log, select, isCancel, cancel, spinner, outro, text, multiselect, confirm } from '@clack/prompts';
+import { intro, log, select, isCancel, cancel, spinner, outro, text, confirm, multiselect } from '@clack/prompts';
 import { Command, Option } from 'commander';
 import open from 'open';
 import AdmZip from 'adm-zip';
@@ -286,6 +286,15 @@ function asEnvelope(v) {
   } else if (env.details && typeof env.details === "object") {
     out2.context = env.details;
   }
+  const folded = {};
+  for (const key of TOP_LEVEL_CONTEXT_KEYS) {
+    if (typeof env[key] === "string" && out2.context?.[key] === void 0) {
+      folded[key] = env[key];
+    }
+  }
+  if (Object.keys(folded).length > 0) {
+    out2.context = { ...out2.context ?? {}, ...folded };
+  }
   return out2;
 }
 function codeFromStatus(status) {
@@ -587,7 +596,34 @@ async function getRuntimeLogs(installationId, opts = {}, options = {}) {
     options
   );
 }
-var ApiError, CODE_SHAPE, slugifyFieldName;
+async function getInstallationRuntime(installationId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/runtime`,
+    void 0,
+    options
+  );
+}
+async function setInstallationRuntime(installationId, body, options = {}) {
+  return apiRequest(
+    "PATCH",
+    `/api/installations/${installationId}/runtime`,
+    body,
+    options
+  );
+}
+async function rebuildModule(moduleId, body, options = {}) {
+  return apiRequest("POST", `/api/modules/${moduleId}/rebuild`, body, options);
+}
+async function getModuleBuild(moduleId, buildId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/modules/${moduleId}/builds/${buildId}`,
+    void 0,
+    options
+  );
+}
+var ApiError, CODE_SHAPE, TOP_LEVEL_CONTEXT_KEYS, slugifyFieldName;
 var init_api_client = __esm({
   "src/lib/api-client.ts"() {
     init_config();
@@ -609,6 +645,7 @@ var init_api_client = __esm({
       }
     };
     CODE_SHAPE = /^[A-Z][A-Z0-9_]*$/;
+    TOP_LEVEL_CONTEXT_KEYS = ["feature", "permission", "plane"];
     slugifyFieldName = slugifyUsesName;
   }
 });
@@ -4364,6 +4401,17 @@ var init_scaffold = __esm({
     MODULE_SLUG_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
   }
 });
+function isFreshCloneEntry(name) {
+  return name === ".git" || /^(readme|license|licence)(\..+)?$/i.test(name);
+}
+function entryExists(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function resolveTargetDir(slug, dirFlag) {
   if (dirFlag !== void 0) return { dir: resolve(dirFlag) };
   const cwd = process.cwd();
@@ -4454,16 +4502,32 @@ async function moduleInitCommand(slugArg, options) {
     );
     return 1;
   }
+  let freshClone = false;
+  let keptReadme = false;
   if (!options.provisionOnly && existsSync(dir)) {
     const entries = readdirSync(dir);
     if (entries.length > 0 && !options.force && !manifestExists) {
-      fail(
-        `Directory ${code(dir)} is not empty. Pass ${code("--force")} to scaffold anyway (existing files will be overwritten).`
+      const linked = entries.filter(
+        (name2) => isFreshCloneEntry(name2) && lstatSync(join(dir, name2)).isSymbolicLink()
       );
-      return 1;
+      if (linked.length > 0) {
+        fail(
+          `Directory ${code(dir)} holds ${linked.map((name2) => code(name2)).join(", ")} as a symbolic link. Replace it with a regular file, or pass ${code("--force")} to scaffold anyway (existing files will be overwritten).`
+        );
+        return 1;
+      }
+      if (entries.every(isFreshCloneEntry)) {
+        freshClone = true;
+        keptReadme = entries.some((name2) => /^readme/i.test(name2));
+      } else {
+        fail(
+          `Directory ${code(dir)} is not empty. Pass ${code("--force")} to scaffold anyway (existing files will be overwritten).`
+        );
+        return 1;
+      }
     }
   }
-  const writeMode = options.provisionOnly ? "none" : manifestExists && !options.force ? "missing-only" : "all";
+  const writeMode = options.provisionOnly ? "none" : (manifestExists || freshClone) && !options.force ? "missing-only" : "all";
   if (options.simple && options.custom) {
     fail(
       `Cannot pass both ${code("--simple")} and ${code("--custom")} \u2014 they're mutually exclusive. ${code("--simple")} selects the legacy minimal scaffold; the default (no flag) is the full Next.js scaffold (formerly ${code("--custom")}).`
@@ -4578,7 +4642,7 @@ async function moduleInitCommand(slugArg, options) {
   if (writeMode !== "none") {
     for (const [relPath, content] of files) {
       const absPath = join(dir, relPath);
-      if (writeMode === "missing-only" && existsSync(absPath)) {
+      if (writeMode === "missing-only" && (entryExists(absPath) || keptReadme && relPath === "README.md")) {
         skipped++;
         continue;
       }
@@ -4594,6 +4658,10 @@ async function moduleInitCommand(slugArg, options) {
     info(
       `Existing scaffold in ${code(dir)} left untouched (provision-only) \u2014 re-provisioning the backend dev install.`
     );
+  } else if (freshClone) {
+    success(
+      `Scaffolded ${code(slug)} (${kind === "custom" ? "custom Next.js" : "simple module"}) into the clone in ${code(dir)}; ${code(".git")}, README and LICENSE left untouched.`
+    );
   } else if (writeMode === "missing-only") {
     success(
       `Existing module project in ${code(dir)} \u2014 wrote ${written} missing file(s), preserved ${skipped} existing file(s). ${dim("(Pass --force to overwrite everything.)")}`
@@ -5994,7 +6062,7 @@ async function requestDeviceCode(args) {
   );
 }
 async function pollForApproval(args) {
-  const sleep4 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep6 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = args.now ?? (() => Date.now());
   const pollIntervalMs = Math.max(1e3, args.intervalSeconds * 1e3);
   const deadline = now() + args.expiresInSeconds * 1e3;
@@ -6013,7 +6081,7 @@ async function pollForApproval(args) {
     switch (res.status) {
       case "pending":
       case "slow_down":
-        await sleep4(pollIntervalMs);
+        await sleep6(pollIntervalMs);
         continue;
       case "denied":
         return { status: "denied" };
@@ -13828,6 +13896,738 @@ async function sleep3(ms, aborted) {
   }
 }
 
+// src/commands/module/rebuild.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+
+// src/lib/permission-hint.ts
+init_api_client();
+init_output();
+var EXIT_NEEDS_GRANT = 3;
+var EXIT_TIMED_OUT = 4;
+var REBUILD_BUMP_OPERATOR_ONLY = "REBUILD_BUMP_OPERATOR_ONLY";
+var FEATURE_SUBJECTS = {
+  module_runtime_streaming: "Streaming",
+  module_rebuild: "Rebuild",
+  module_building: "Building modules",
+  module_runtime_sizing: "Memory size"
+};
+var OPTION_SUBJECTS = {
+  streaming: "Streaming",
+  memory_mb: "Memory size",
+  reapply: "Re-applying the runtime",
+  timeout: "The timeout",
+  reserved_concurrency: "Reserved concurrency",
+  log_retention: "Log retention"
+};
+var MODULE_RIGHT_CODES = /* @__PURE__ */ new Set([
+  "MODULE_CAPABILITY_DENIED",
+  "PUBLISH_REQUIRES_ADMIN",
+  "NOT_COPY_OWNER"
+]);
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function num(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
+}
+function featureFromPermission(permission) {
+  const m = permission ? /^workspace\.feature\.([a-z0-9_]+)\.use$/.exec(permission) : null;
+  return m?.[1];
+}
+function featureSubject(ctx) {
+  const feature = str(ctx.feature) ?? featureFromPermission(str(ctx.permission));
+  if (feature && FEATURE_SUBJECTS[feature]) return FEATURE_SUBJECTS[feature];
+  return str(ctx.feature_label) ?? (feature ? `"${feature}"` : void 0);
+}
+function needsAdmin(what, module, ask) {
+  const scope = module ? ` for ${module}` : "";
+  return `${what}${scope} needs a Dashwise admin. Ask your Dashwise admin to ${ask}.`;
+}
+function refusalHint(code2, context, subject = {}) {
+  const ctx = context ?? {};
+  const module = subject.module ?? str(ctx.module_slug);
+  const installationId = subject.installationId ?? num(ctx.installation_id);
+  const installLabel = installationId !== void 0 ? ` (install #${installationId})` : "";
+  const named = module ?? "this module";
+  switch (code2) {
+    case "FEATURE_DISABLED":
+    case "PERMISSION_DENIED": {
+      const what = featureSubject(ctx);
+      if (!what) {
+        return {
+          message: `You don't have permission to do this${module ? ` for ${module}` : ""}. Ask your Dashwise admin for access.`,
+          needsGrant: true
+        };
+      }
+      return { message: needsAdmin(what, module, "enable it"), needsGrant: true };
+    }
+    case "RUNTIME_OPTION_OPERATOR_ONLY": {
+      const option = str(ctx.option);
+      const what = (option && OPTION_SUBJECTS[option]) ?? (option ? `"${option}"` : "This runtime option");
+      return { message: needsAdmin(what, module, "change it"), needsGrant: true };
+    }
+    case REBUILD_BUMP_OPERATOR_ONLY: {
+      const bump = str(ctx.bump) ?? "minor";
+      return {
+        message: needsAdmin(`A rebuild with a ${bump} version bump`, module, "run it"),
+        needsGrant: true
+      };
+    }
+    case "IMAGE_TAG_EXISTS":
+      return {
+        message: `This rebuild of ${named} needs a higher version bump than patch. A rebuild with a minor version bump needs a Dashwise admin. Ask your Dashwise admin to run it.`,
+        needsGrant: true
+      };
+    case "RUNTIME_IMAGE_NOT_ELIGIBLE": {
+      const version = str(ctx.version);
+      const target = installationId !== void 0 ? ` --rollout installs:${installationId}` : "";
+      return {
+        message: `${named}${version ? ` v${version}` : ""} was built before streaming support. Rebuild it and upgrade this install first: dashwise module rebuild${module ? ` ${module}` : ""}${target}`,
+        needsGrant: false
+      };
+    }
+    case "RUNTIME_SWAP_PENDING": {
+      const version = str(ctx.version);
+      return {
+        message: `${named}${installLabel} is still finishing its update${version ? ` to v${version}` : ""}, so streaming cannot be turned on yet. Try again in a few minutes.`,
+        needsGrant: false
+      };
+    }
+    case "RUNTIME_OPTION_UNAVAILABLE": {
+      const option = str(ctx.option);
+      const what = (option && OPTION_SUBJECTS[option]) ?? "This runtime option";
+      return { message: `${what} is switched off platform-wide right now.`, needsGrant: false };
+    }
+    case "RUNTIME_CHANGE_IN_PROGRESS": {
+      const op = num(ctx.operation_id);
+      return {
+        message: `A runtime change is already being applied to ${named}${op !== void 0 ? ` (operation #${op})` : ""}. Wait for it, then check: dashwise module runtime${module ? ` ${module}` : ""}`,
+        needsGrant: false
+      };
+    }
+    case "BUILD_IN_PROGRESS": {
+      const buildId = num(ctx.build_id);
+      const status = str(ctx.status);
+      const which = buildId !== void 0 ? ` (#${buildId}${status ? `, ${status}` : ""})` : "";
+      return {
+        message: `A build of ${named} is already running${which}. Wait for it to finish, then run the rebuild again.`,
+        needsGrant: false
+      };
+    }
+    case "REBUILD_SOURCE_NOT_FOUND":
+      return {
+        message: `${named} has no build from source to rebuild. Publish it first: dashwise module publish`,
+        needsGrant: false
+      };
+    case "INSTALLATION_NOT_FOUND":
+      return {
+        message: `${installationId !== void 0 ? `Installation #${installationId}` : "The installation"} was not found, or you cannot see it.`,
+        needsGrant: false
+      };
+    case "PUBLISH_RATE_LIMITED":
+    case "PUBLISH_USER_RATE_LIMITED":
+      return {
+        message: `Too many builds of ${named} in the last hour. Try again later.`,
+        needsGrant: false
+      };
+    default:
+      if (MODULE_RIGHT_CODES.has(code2)) {
+        return {
+          message: `You can't manage ${named}${installLabel}. Ask your Dashwise admin for access.`,
+          needsGrant: true
+        };
+      }
+      return null;
+  }
+}
+var ANSI = /\x1b\[[0-9;]*m/g;
+function reportCliError(message, opts) {
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        error: { code: opts.code ?? "CLI_ERROR", message: message.replace(ANSI, ""), status: null, context: null },
+        hint: null,
+        needs_grant: false
+      })
+    );
+  } else {
+    fail(message);
+  }
+  return 1;
+}
+function reportFailedOutcome(failure, hint, opts) {
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        error: { code: failure.code, message: failure.message ?? null, status: null, context: null },
+        hint: hint?.message ?? null,
+        needs_grant: hint?.needsGrant ?? false,
+        ...opts.extra
+      })
+    );
+  } else {
+    fail(hint?.message ?? opts.fallback);
+  }
+  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+}
+function isTransientPollError(err) {
+  if (!(err instanceof ApiError)) return true;
+  return err.status === 0 || err.status === 429 || err.status >= 500;
+}
+function reportRefusal(err, subject, opts) {
+  if (!(err instanceof ApiError)) {
+    const message = err?.message ?? String(err);
+    if (opts.json) {
+      out(
+        JSON.stringify({
+          error: { code: "CLI_ERROR", message: message.replace(ANSI, ""), status: null, context: null },
+          hint: null,
+          needs_grant: false
+        })
+      );
+    } else {
+      fail(`${opts.action} failed: ${message}`);
+    }
+    return 1;
+  }
+  const hint = err.status === 401 ? { message: "Your login has expired. Run: dashwise login", needsGrant: false } : refusalHint(err.code, err.context, subject);
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        error: { code: err.code, message: err.message, status: err.status, context: err.context ?? null },
+        hint: hint?.message ?? null,
+        needs_grant: hint?.needsGrant ?? false
+      })
+    );
+  } else if (hint) {
+    fail(hint.message);
+  } else {
+    fail(`${opts.action} failed (${err.code}): ${err.message}`);
+  }
+  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+}
+
+// src/commands/module/rebuild.ts
+var PLATFORM_DEFAULTS = ["manifest", "on", "off"];
+var BUMPS = ["patch", "minor", "major"];
+function parseRollout(raw) {
+  if (raw === void 0) return null;
+  const v = raw.trim();
+  if (v === "" || v === "none") return null;
+  if (v === "workspace") return { scope: "workspace" };
+  const ws = /^workspace:(\d+)$/.exec(v);
+  if (ws) return { scope: "workspace", workspace_id: Number(ws[1]) };
+  const inst = /^installs?:(.+)$/.exec(v);
+  if (inst) {
+    const ids = inst[1].split(",").map((s) => s.trim());
+    if (ids.length === 0 || ids.some((s) => !/^\d+$/.test(s) || Number(s) <= 0)) {
+      return `--rollout installs: expects comma-separated installation ids (got "${raw}").`;
+    }
+    const unique = [...new Set(ids.map(Number))];
+    if (unique.length > 50) return "--rollout installs: takes at most 50 installation ids.";
+    return { scope: "installations", installation_ids: unique };
+  }
+  return `--rollout expects none, installs:<id,id> or workspace[:<id>] (got "${raw}").`;
+}
+async function moduleRebuildCommand(slugArg, options) {
+  let slug = slugArg;
+  if (!slug) {
+    try {
+      const fromManifest = readManifest(options.dir)?.module?.slug;
+      if (typeof fromManifest === "string" && fromManifest.length > 0) slug = fromManifest;
+    } catch {
+    }
+  }
+  const json = options.json;
+  const usage2 = (message) => reportCliError(message, { json, code: "USAGE" });
+  if (!slug) {
+    return usage2(
+      `No module slug. Pass one (${code("dashwise module rebuild <slug>")}) or run from a directory with a valid module.json.`
+    );
+  }
+  const bump = (options.bump ?? "patch").trim().toLowerCase();
+  if (!BUMPS.includes(bump)) {
+    return usage2(`--bump expects patch, minor or major (got "${options.bump}").`);
+  }
+  if (bump !== "patch") {
+    const hint = refusalHint(REBUILD_BUMP_OPERATOR_ONLY, { bump }, { module: slug });
+    if (options.json) {
+      out(
+        JSON.stringify({
+          error: { code: REBUILD_BUMP_OPERATOR_ONLY, message: hint.message, status: null, context: { bump } },
+          hint: hint.message,
+          needs_grant: true
+        })
+      );
+    } else {
+      fail(hint.message);
+      publishBumpTip(bump);
+    }
+    return EXIT_NEEDS_GRANT;
+  }
+  let platformDefaults;
+  if (options.platformDefaults !== void 0) {
+    const v = options.platformDefaults.trim().toLowerCase();
+    if (!PLATFORM_DEFAULTS.includes(v)) {
+      return usage2(`--platform-defaults expects manifest, on or off (got "${options.platformDefaults}").`);
+    }
+    platformDefaults = v;
+  }
+  if (options.fromBuild !== void 0 && (!Number.isInteger(options.fromBuild) || options.fromBuild <= 0)) {
+    return usage2(`--from-build expects a positive build id (got "${options.fromBuild}").`);
+  }
+  const rollout = parseRollout(options.rollout);
+  if (typeof rollout === "string") return usage2(rollout);
+  if (!isLoggedIn()) {
+    return reportCliError(`Not logged in. Run ${code("dashwise login")} first.`, { json });
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    return reportCliError(`CLI config missing. Run ${code("dashwise login")}.`, { json });
+  }
+  const auth = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
+  let moduleId;
+  try {
+    const mod = await getModuleBySlug(slug, auth);
+    moduleId = mod.id;
+    slug = mod.slug;
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      return reportCliError(`Module ${code(slug)} not found on the backend.`, { json });
+    }
+    return reportRefusal(err, { module: slug }, { json: options.json, action: "Resolving the module" });
+  }
+  const buildOptions = {
+    ...platformDefaults !== void 0 ? { platform_defaults: platformDefaults } : {},
+    ...options.clean ? { clean: true } : {}
+  };
+  const body = {
+    ...options.fromBuild !== void 0 ? { from_build_id: options.fromBuild } : {},
+    ...Object.keys(buildOptions).length > 0 ? { options: buildOptions } : {},
+    ...rollout ? { rollout } : {},
+    ...options.reason !== void 0 ? { reason: options.reason } : {}
+  };
+  let build;
+  try {
+    build = await rebuildModule(moduleId, body, auth);
+  } catch (err) {
+    return reportRefusal(err, { module: slug }, { json: options.json, action: "Rebuild" });
+  }
+  if (options.noWait) {
+    if (options.json) out(JSON.stringify(build));
+    else {
+      success(`Rebuild of ${code(slug)} queued as build ${code(`#${build.id}`)}.`);
+      info(`Not waiting (${code("--no-wait")}). A rebuild takes about 1\u20133 minutes.`);
+    }
+    return 0;
+  }
+  if (!options.json) info(`Rebuild of ${code(slug)} queued as build ${code(`#${build.id}`)}. Building\u2026`);
+  let waited;
+  try {
+    waited = await waitForBuild(moduleId, build, Boolean(rollout), options, auth);
+  } catch (err) {
+    return reportRefusal(err, { module: slug }, { json: options.json, action: `Checking build #${build.id}` });
+  }
+  const final = waited.build;
+  if (waited.timedOut) {
+    if (options.json) out(JSON.stringify({ ...final, timed_out: true }));
+    else warn(`Still running after ${options.timeoutSec ?? 900}s. Build ${code(`#${build.id}`)} may still finish.`);
+    return EXIT_TIMED_OUT;
+  }
+  if (final.status === "failed") {
+    const failureCode = final.error_code ?? "BUILD_FAILED";
+    const hint = final.error_code ? refusalHint(final.error_code, void 0, { module: slug }) : null;
+    const exit = reportFailedOutcome({ code: failureCode, message: final.error_message }, hint, {
+      json: options.json,
+      fallback: `Build ${code(`#${final.id}`)} failed (${failureCode}): ${final.error_message ?? "(no detail)"}`,
+      extra: { build: final }
+    });
+    if (!options.json) {
+      if (final.log_url) info(`Logs: ${code(final.log_url)}`);
+      if (final.error_code === "IMAGE_TAG_EXISTS") publishBumpTip("minor");
+    }
+    return exit;
+  }
+  const r = final.rollout;
+  if (rollout && r?.status === "failed") {
+    const failureCode = r.code ?? "ROLLOUT_FAILED";
+    const hint = r.code ? refusalHint(r.code, void 0, { module: slug }) : null;
+    if (!options.json) success(`Rebuilt ${code(slug)} as ${code(`v${final.version ?? "?"}`)} ${dim(`(build #${final.id})`)}.`);
+    return reportFailedOutcome({ code: failureCode, message: null }, hint, {
+      json: options.json,
+      fallback: `Upgrading the installs failed (${failureCode}).`,
+      extra: { build: final }
+    });
+  }
+  if (options.json) out(JSON.stringify(final));
+  if (!options.json) success(`Rebuilt ${code(slug)} as ${code(`v${final.version ?? "?"}`)} ${dim(`(build #${final.id})`)}.`);
+  if (!rollout) {
+    if (!options.json) info(`Installs keep their version until upgraded: ${code(`dashwise module install ${slug}`)}`);
+    return 0;
+  }
+  if (!r || r.status !== "completed") {
+    if (!options.json) warn(`The upgrade of installs is still ${r?.status ?? "pending"}. Check with ${code(`dashwise module status ${slug}`)}.`);
+    return 0;
+  }
+  if (!options.json) {
+    const counts = Object.entries(r.counts ?? {}).map(([k, n]) => `${n} ${k}`).join(", ");
+    success(`Installs upgraded to v${r.to_version ?? final.version ?? "?"}: ${counts || "none"}.`);
+    const notUpgraded = (r.counts?.failed ?? 0) + (r.counts?.skipped ?? 0);
+    if (notUpgraded > 0) {
+      warn(
+        `${notUpgraded} install${notUpgraded === 1 ? " was" : "s were"} not upgraded (failed or skipped). Check with ${code(`dashwise module status ${slug}`)}.`
+      );
+    }
+    if ((r.counts?.blocked ?? 0) > 0) {
+      warn(
+        `Blocked installs were left on their version: the upgrade would break other modules or remove data. Upgrade them one by one with ${code(`dashwise module install ${slug}`)} to see why.`
+      );
+    }
+  }
+  return 0;
+}
+async function waitForBuild(moduleId, queued, withRollout, options, auth) {
+  const buildId = queued.id;
+  let lastSeen = queued;
+  const deadline = Date.now() + (options.timeoutSec ?? 900) * 1e3;
+  const interval = options.pollIntervalMs ?? 4e3;
+  let last = "";
+  while (Date.now() < deadline) {
+    await sleep4(interval);
+    let b;
+    try {
+      b = await getModuleBuild(moduleId, buildId, auth);
+    } catch (err) {
+      if (isTransientPollError(err)) continue;
+      throw err;
+    }
+    lastSeen = b;
+    const phase = b.status === "succeeded" && withRollout ? `upgrading installs (${b.rollout?.status ?? "pending"})` : b.status;
+    if (!options.json && phase !== last) {
+      info(`Build ${code(`#${buildId}`)}: ${phase}`);
+      last = phase;
+    }
+    if (b.status === "failed") return { build: b, timedOut: false };
+    if (b.status === "succeeded") {
+      if (!withRollout) return { build: b, timedOut: false };
+      if (b.rollout && (b.rollout.status === "completed" || b.rollout.status === "failed")) {
+        return { build: b, timedOut: false };
+      }
+    }
+  }
+  return { build: lastSeen, timedOut: true };
+}
+function publishBumpTip(bump) {
+  info(
+    `A rebuild you run yourself always bumps patch. To choose the bump, publish from source: ${code(`dashwise module publish --bump ${bump}`)}`
+  );
+}
+function sleep4(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// src/commands/module/runtime.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+var TERMINAL_OPERATION = /* @__PURE__ */ new Set(["succeeded", "failed", "superseded"]);
+async function moduleRuntimeShowCommand(slugArg, options) {
+  const auth = authOrFail(options.json);
+  if (!auth) return 1;
+  const target = await resolveInstall(slugArg, options, auth, "dashwise module runtime <slug>");
+  if (typeof target === "number") return target;
+  let view;
+  try {
+    view = await getInstallationRuntime(target.installationId, auth);
+  } catch (err) {
+    return reportRefusal(
+      err,
+      { module: target.slug, installationId: target.installationId },
+      { json: options.json, action: "Reading the runtime settings" }
+    );
+  }
+  if (options.json) {
+    out(JSON.stringify(view));
+    return 0;
+  }
+  renderRuntime(view);
+  return 0;
+}
+function renderRuntime(view) {
+  const slug = view.module.slug;
+  const desired = view.desired.invoke_mode;
+  const effective = view.effective.invoke_mode;
+  const streamingLine = `${modeLabel(effective)}` + (desired !== null && desired !== effective ? `  ${dim(`(requested: ${modeLabel(desired)})`)}` : "") + (desired === null ? `  ${dim("(platform default)")}` : "");
+  out("");
+  kv("Module:", `${slug} ${dim(`(id ${view.module.id})`)}`);
+  kv("Install:", `#${view.installation_id} ${dim(`(workspace ${view.workspace_id})`)}`);
+  kv("Version:", view.version ?? dim("(none)"));
+  kv("Streaming:", streamingLine);
+  kv(
+    "Memory:",
+    `${view.effective.memory_mb} MB ${dim(view.effective.memory_source === "override" ? "(override)" : "(from module.json machine_size)")}`
+  );
+  kv("Eligible:", view.eligibility.streaming ? "yes" : `no ${dim(`(${eligibilityText(view.eligibility.reason)})`)}`);
+  kv("Granted:", view.grant.module_runtime_streaming ? "yes" : "no");
+  kv("Last change:", view.last_operation ? operationText(view.last_operation) : dim("(none)"));
+  out("");
+  if (!view.grant.module_runtime_streaming) {
+    const hint = refusalHint("FEATURE_DISABLED", { feature: "module_runtime_streaming" }, { module: slug });
+    if (hint) info(hint.message);
+  } else if (!view.eligibility.streaming && view.eligibility.reason === "image_not_eligible") {
+    const hint = refusalHint(
+      "RUNTIME_IMAGE_NOT_ELIGIBLE",
+      { version: view.version ?? void 0 },
+      { module: slug, installationId: view.installation_id }
+    );
+    if (hint) info(hint.message);
+  }
+}
+function modeLabel(mode) {
+  if (mode === "RESPONSE_STREAM") return "on";
+  if (mode === "BUFFERED") return "off";
+  return "default";
+}
+function eligibilityText(reason) {
+  switch (reason) {
+    case "platform_disabled":
+      return "streaming is switched off platform-wide";
+    case "image_not_eligible":
+      return "this version was built before streaming support; rebuild it";
+    case "swap_pending":
+      return "an update is still finishing";
+    default:
+      return reason ?? "unknown";
+  }
+}
+function operationText(op) {
+  const when = op.finished_at ?? op.started_at ?? op.created_at;
+  const err = op.error_code ? ` ${op.error_code}` : "";
+  return `${op.kind} ${op.status}${err} ${dim(`(#${op.id}, ${when})`)}`;
+}
+async function moduleRuntimeSetCommand(slugArg, options) {
+  let streaming;
+  if (options.streaming !== void 0) {
+    const v = options.streaming.trim().toLowerCase();
+    if (v === "on") streaming = "RESPONSE_STREAM";
+    else if (v === "off") streaming = "BUFFERED";
+    else {
+      return usage(`--streaming expects "on" or "off" (got "${options.streaming}").`, options.json);
+    }
+  }
+  if (options.memory !== void 0 && (!Number.isInteger(options.memory) || options.memory <= 0)) {
+    return usage(`--memory expects a whole number of MB (got "${options.memory}").`, options.json);
+  }
+  if (streaming === void 0 && options.memory === void 0) {
+    return usage(`Nothing to change. Pass ${code("--streaming on|off")} (or ${code("--memory <mb>")}).`, options.json);
+  }
+  const auth = authOrFail(options.json);
+  if (!auth) return 1;
+  const target = await resolveInstall(slugArg, options, auth, "dashwise module runtime set <slug>");
+  if (typeof target === "number") return target;
+  let before;
+  try {
+    before = await getInstallationRuntime(target.installationId, auth);
+  } catch (err) {
+    return reportRefusal(
+      err,
+      { module: target.slug, installationId: target.installationId },
+      { json: options.json, action: "Reading the runtime settings" }
+    );
+  }
+  const slug = before.module.slug;
+  const subject = { module: slug, installationId: before.installation_id };
+  if (streaming !== void 0 && !options.yes && !options.json && process.stdin.isTTY) {
+    const ok = await confirm({
+      message: `Turn streaming ${streaming === "RESPONSE_STREAM" ? "on" : "off"} for ${slug} (install #${before.installation_id})? The switch takes about a minute, and pages may come back empty while it runs.`
+    });
+    if (isCancel(ok) || ok !== true) {
+      info("Cancelled. Nothing was changed.");
+      return 1;
+    }
+  }
+  const invokeMode = streaming ?? before.desired.invoke_mode ?? before.effective.invoke_mode;
+  let accepted;
+  try {
+    accepted = await setInstallationRuntime(
+      before.installation_id,
+      {
+        invoke_mode: invokeMode,
+        ...options.memory !== void 0 ? { memory_mb: options.memory } : {},
+        ...options.reason !== void 0 ? { reason: options.reason } : {}
+      },
+      auth
+    );
+  } catch (err) {
+    return reportRefusal(err, subject, { json: options.json, action: "Changing the runtime settings" });
+  }
+  const what = describeChange(streaming, options.memory);
+  if (accepted.noop) {
+    if (options.json) out(JSON.stringify({ accepted, operation: before.last_operation }));
+    else success(`${what} for ${code(slug)} is already in place. Nothing to do.`);
+    return 0;
+  }
+  if (options.noWait || accepted.operation_id === null) {
+    if (options.json) out(JSON.stringify({ accepted, operation: null }));
+    else {
+      success(`${what} for ${code(slug)} accepted (operation #${accepted.operation_id ?? "?"}).`);
+      info(`It takes about a minute. Check with ${code(`dashwise module runtime ${slug}`)}.`);
+    }
+    return 0;
+  }
+  if (!options.json) info(`Applying: ${what.toLowerCase()} for ${code(slug)} (about a minute)\u2026`);
+  let op;
+  try {
+    op = await waitForOperation(before.installation_id, accepted.operation_id, options, auth);
+  } catch (err) {
+    return reportRefusal(err, subject, { json: options.json, action: "Checking the runtime change" });
+  }
+  if (!op) {
+    if (options.json) out(JSON.stringify({ accepted, operation: null, timed_out: true }));
+    else {
+      warn(
+        `Still applying after ${options.timeoutSec ?? 240}s. Check with ${code(`dashwise module runtime ${slug}`)}.`
+      );
+    }
+    return EXIT_TIMED_OUT;
+  }
+  if (op.status === "failed") {
+    const failureCode = op.error_code ?? "UNKNOWN";
+    const hint = op.error_code ? refusalHint(op.error_code, void 0, subject) : null;
+    return reportFailedOutcome({ code: failureCode, message: op.error_message }, hint, {
+      json: options.json,
+      fallback: `The change failed (${failureCode}): ${op.error_message ?? "(no detail)"}`,
+      extra: { accepted, operation: op }
+    });
+  }
+  if (options.json) out(JSON.stringify({ accepted, operation: op }));
+  if (op.status === "succeeded") {
+    if (!options.json) {
+      const outcome = typeof op.result?.outcome === "string" ? op.result.outcome : null;
+      if (outcome === "swap_pending") {
+        success(`${what} for ${code(slug)} is saved. Streaming starts once the module's pending update finishes.`);
+      } else if (outcome === "no_runtime") {
+        success(`${what} for ${code(slug)} is saved. It applies when the module is next deployed.`);
+      } else {
+        success(`${what} for ${code(slug)} is done.`);
+      }
+    }
+    return 0;
+  }
+  if (!options.json) warn(`A newer change replaced this one. Check with ${code(`dashwise module runtime ${slug}`)}.`);
+  return 0;
+}
+function describeChange(streaming, memory) {
+  const parts = [];
+  if (streaming !== void 0) parts.push(`Streaming ${streaming === "RESPONSE_STREAM" ? "on" : "off"}`);
+  if (memory !== void 0) parts.push(`${parts.length ? "memory" : "Memory"} ${memory} MB`);
+  return parts.join(", ");
+}
+async function waitForOperation(installationId, operationId, options, auth) {
+  const deadline = Date.now() + (options.timeoutSec ?? 240) * 1e3;
+  const interval = options.pollIntervalMs ?? 3e3;
+  while (Date.now() < deadline) {
+    await sleep5(interval);
+    let view;
+    try {
+      view = await getInstallationRuntime(installationId, auth);
+    } catch (err) {
+      if (isTransientPollError(err)) continue;
+      throw err;
+    }
+    const op = view.last_operation;
+    if (!op) continue;
+    if (op.id > operationId) {
+      return { id: operationId, status: "superseded", superseded_by_operation_id: op.id };
+    }
+    if (op.id === operationId && TERMINAL_OPERATION.has(op.status)) return op;
+  }
+  return null;
+}
+function usage(message, json) {
+  return reportCliError(message, { json, code: "USAGE" });
+}
+function authOrFail(json) {
+  if (!isLoggedIn()) {
+    reportCliError(`Not logged in. Run ${code("dashwise login")} first.`, { json });
+    return null;
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    reportCliError(`CLI config missing. Run ${code("dashwise login")}.`, { json });
+    return null;
+  }
+  return { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
+}
+async function resolveInstall(slugArg, options, auth, usageLine) {
+  const json = options.json;
+  if (options.install !== void 0) {
+    if (!Number.isInteger(options.install) || options.install <= 0) {
+      return usage(`--install expects a positive integer installation id (got "${options.install}").`, options.json);
+    }
+    return { installationId: options.install, ...slugArg ? { slug: slugArg } : {} };
+  }
+  let slug = slugArg;
+  if (!slug) {
+    try {
+      const fromManifest = readManifest(options.dir)?.module?.slug;
+      if (typeof fromManifest === "string" && fromManifest.length > 0) slug = fromManifest;
+    } catch {
+    }
+  }
+  if (!slug) {
+    return reportCliError(
+      `No module slug. Pass one (${code(usageLine)}), run from a directory with a valid module.json, or target an install with ${code("--install <id>")}.`,
+      { json: options.json, code: "USAGE" }
+    );
+  }
+  let modId;
+  try {
+    modId = (await getModuleBySlug(slug, auth)).id;
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      return reportCliError(`Module ${code(slug)} not found on the backend.`, { json });
+    }
+    return reportCliError(`Could not resolve module ${code(slug)}: ${err.message}`, { json });
+  }
+  const cfg = readConfig();
+  let workspace2;
+  try {
+    workspace2 = await resolveWorkspaceWithFallback({
+      userFlag: options.workspace,
+      cachedWorkspaceId: readModuleEntry(slug)?.workspaceId,
+      configDefault: cfg?.workspaceSlug,
+      apiUrl: resolveApiUrl(),
+      apiToken: cfg?.token ?? ""
+    });
+  } catch (err) {
+    return reportCliError(`Workspace selection failed: ${err.message}`, { json });
+  }
+  let row;
+  try {
+    const matches = (await listWorkspaceInstallations(workspace2.id, auth)).filter(
+      (r) => r.module_id === modId
+    );
+    row = matches.find((r) => !isDevInstallKind(r.kind) && isRealRuntimeUrl(r.runtime_url)) ?? matches.find((r) => !isDevInstallKind(r.kind));
+  } catch (err) {
+    return reportCliError(`Could not read workspace installations: ${err.message}`, { json });
+  }
+  if (!row) {
+    return reportCliError(
+      `${code(slug)} has no deployed install in workspace ${code(workspace2.slug)}. Deploy it with ${code(`dashwise module install ${slug} --workspace ${workspace2.slug}`)}, or pass ${code("--install <id>")}.`,
+      { json }
+    );
+  }
+  return { installationId: row.id, slug };
+}
+function sleep5(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
 // src/program.ts
 init_output();
 var program = new Command();
@@ -14595,6 +15395,67 @@ moduleCmd.command("logs [slug]").description(
     });
   }
 );
+moduleCmd.command("runtime [slug-or-set] [slug]").usage("[slug] [--install <id>] [--json]  |  set [slug] --streaming on|off [options]").description(
+  'Show a deployed install\'s runtime settings: response streaming (on/off, requested vs in effect), memory, whether this version can stream, whether streaming is granted for the workspace, and the last change. `module runtime set --streaming on|off` changes streaming (needs the workspace grant "Module response streaming"; takes about a minute and waits unless --no-wait). `--memory <mb>` is set by Dashwise operators today and is refused with a hint. Exit 3 = a grant is missing (ask your Dashwise admin); exit 4 = `set` stopped waiting before the change finished.'
+).option("--install <id>", "Target an installation id directly (skips slug + workspace resolution).", parseIntOption).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("--streaming <on|off>", "`set` only: turn response streaming on or off.").option("--memory <mb>", "`set` only: memory in MB (operator-only today).", parseIntOption).option("--reason <text>", "`set` only: why; stored in the audit log.").option("-y, --yes", "`set` only: skip the confirmation prompt.").option("--no-wait", "`set` only: return once the change is accepted instead of waiting for it.").option("--timeout <seconds>", "`set` only: max seconds to wait for the change (default 240).", parseIntOption).option(
+  "--json",
+  'One JSON object on stdout: the runtime view; for `set`, { accepted, operation } (+ "timed_out": true on exit 4); on a refusal or a failed change, { error, hint, needs_grant } (plus accepted and operation when the change ran and failed; error.code USAGE for a bad invocation).'
+).action(
+  async (first, second, cmdOpts) => {
+    const target = {
+      ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
+      ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    };
+    if (first === "set") {
+      process.exitCode = await moduleRuntimeSetCommand(second, {
+        ...target,
+        ...cmdOpts.streaming !== void 0 ? { streaming: cmdOpts.streaming } : {},
+        ...cmdOpts.memory !== void 0 ? { memory: cmdOpts.memory } : {},
+        ...cmdOpts.reason !== void 0 ? { reason: cmdOpts.reason } : {},
+        ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
+        ...cmdOpts.wait === false ? { noWait: true } : {},
+        ...cmdOpts.timeout !== void 0 ? { timeoutSec: cmdOpts.timeout } : {}
+      });
+      return;
+    }
+    const setOnly = [
+      cmdOpts.streaming !== void 0 && "--streaming",
+      cmdOpts.memory !== void 0 && "--memory",
+      cmdOpts.reason !== void 0 && "--reason"
+    ].filter(Boolean);
+    if (setOnly.length > 0 || second !== void 0) {
+      process.exitCode = reportCliError(
+        setOnly.length > 0 ? `${setOnly.join(", ")} only work with \`set\`, for example: dashwise module runtime set ${first ?? "<slug>"} --streaming on` : `\`dashwise module runtime\` takes one slug (got "${first}" and "${second}"). To change settings: dashwise module runtime set <slug> --streaming on|off`,
+        { json: cmdOpts.json, code: "USAGE" }
+      );
+      return;
+    }
+    process.exitCode = await moduleRuntimeShowCommand(first, target);
+  }
+);
+moduleCmd.command("rebuild [slug]").description(
+  "Rebuild the module's published source with today's platform image and defaults, as a new patch version, optionally with build options, then optionally upgrade installs. Needs the workspace grant \"Module rebuild\". Waits for the build (and the upgrades) unless `--no-wait`. Exit 3 = a grant is missing (ask your Dashwise admin); exit 4 = stopped waiting before the build (or the upgrades) finished."
+).option("--platform-defaults <mode>", "manifest (default: what module.json says) | on | off.").option("--clean", "Build without the Docker cache and re-pull the base image (same as a normal rebuild until build caching exists).").option("--bump <direction>", "patch (default). minor and major need a Dashwise admin.").option("--rollout <scope>", "none (default) | installs:<id,id> | workspace[:<id>] \u2014 upgrade those installs after the build. Blocked upgrades are reported, never forced.").option("--from-build <id>", "Rebuild the source of this build (default: the build behind the current version).", parseIntOption).option("--reason <text>", "Why; stored in the audit log.").option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("--no-wait", "Return once the build is queued.").option("--timeout <seconds>", "Max seconds to wait for the build and upgrades (default 900).", parseIntOption).option(
+  "--json",
+  'One JSON object on stdout: the final build (the last one seen + "timed_out": true on exit 4), or { error, hint, needs_grant } on a refusal or a failed build or rollout (plus the build when it ran; error.code USAGE for a bad invocation).'
+).action(
+  async (slug, cmdOpts) => {
+    process.exitCode = await moduleRebuildCommand(slug, {
+      ...cmdOpts.platformDefaults !== void 0 ? { platformDefaults: cmdOpts.platformDefaults } : {},
+      ...cmdOpts.clean !== void 0 ? { clean: cmdOpts.clean } : {},
+      ...cmdOpts.bump !== void 0 ? { bump: cmdOpts.bump } : {},
+      ...cmdOpts.rollout !== void 0 ? { rollout: cmdOpts.rollout } : {},
+      ...cmdOpts.fromBuild !== void 0 ? { fromBuild: cmdOpts.fromBuild } : {},
+      ...cmdOpts.reason !== void 0 ? { reason: cmdOpts.reason } : {},
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.wait === false ? { noWait: true } : {},
+      ...cmdOpts.timeout !== void 0 ? { timeoutSec: cmdOpts.timeout } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    });
+  }
+);
 moduleCmd.command("destroy-dev-install").description(
   "Destroy the local-dev install for the current module. Tears down the install row + dashboard tile; if the module had no other installs and was never published, drops the module too. Local module.json is preserved (only the cached runtime token + install id in auth.json get cleared)."
 ).option("--dir <path>", "Project root (default: current directory).").option(
@@ -14717,7 +15578,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.21.0";
+  return "0.22.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);